From 995a8906f16caa68aa40584199b79bd65a428599 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Mon, 22 Jan 2018 05:01:45 +0000 Subject: [PATCH] DB: 2018-01-22 27 changes to exploits/shellcodes Oracle JDeveloper 11.1.x/12.x - Directory Traversal Shopware 5.2.5/5.3 - Cross-Site Scripting CentOS Web Panel 0.9.8.12 - Multiple Vulnerabilities PHPFreeChat 1.7 - Denial of Service OTRS 5.0.x/6.0.x - Remote Command Execution DarkComet (C2 Server) - File Upload BSDi/x86 - execve(/bin/sh) Shellcode (45 bytes) BSDi/x86 - execve(/bin/sh) Shellcode (46 bytes) BSDi/x86 - execve(/bin/sh) Shellcode (45 bytes) BSDi/x86 - execve(/bin/sh) Shellcode (46 bytes) FreeBSD x86 / x64 - execve(/bin/sh) Anti-Debugging Shellcode (140 bytes) Cisco IOS - New TTY + Privilege Level To 15 + Reverse (21/TCP) Virtual Terminal Shell Shellcode Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes) Cisco IOS - New TTY + Privilege Level To 15 + No Password Shellcode HP-UX - execve(/bin/sh) Shellcode (58 bytes) Cisco IOS - New TTY + Privilege Level To 15 + Reverse (21/TCP) Virtual Terminal Shell Shellcode Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes) Cisco IOS - New TTY + Privilege Level To 15 + No Password Shellcode HP-UX - execve(/bin/sh) Shellcode (58 bytes) Linux/x86 - execve(/bin/sh) + Re-Use Of Strings In .rodata Shellcode (16 bytes) Linux/x86 - execve(/bin/sh) + Re-Use Of Strings In .rodata Shellcode (16 bytes) Windows/x86 (XP SP2) (French) - cmd.exe Shellcode (32 bytes) Windows/x86 (XP SP2) (French) - cmd.exe Shellcode (32 bytes) Windows/x86 - PEB _Kernel32.dll_ ImageBase Finder + Alphanumeric Shellcode (67 bytes) Windows/x86 - PEB _Kernel32.dll_ ImageBase Finder + ASCII Printable Shellcode (49 bytes) Windows/x86 - Reverse Connection + Download A File + Save + Execute Shellcode Windows/x86 - PEB 'Kernel32.dll' ImageBase Finder + Alphanumeric Shellcode (67 bytes) Windows/x86 - PEB 'Kernel32.dll' ImageBase Finder + ASCII Printable Shellcode (49 bytes) Windows/x86 - Reverse TCP + Download A File + Save + Execute Shellcode Windows (9x/NT/2000/XP) - PEB method Shellcode (29 bytes) Windows (9x/NT/2000/XP) - PEB Method Shellcode (31 bytes) Windows (9x/NT/2000/XP) - PEB method Shellcode (35 bytes) Windows (9x/NT/2000/XP) - PEB Method Shellcode (29 bytes) Windows (9x/NT/2000/XP) - PEB Method Shellcode (31 bytes) Windows (9x/NT/2000/XP) - PEB Method Shellcode (35 bytes) Windows/x86 (XP SP2) (English / Arabic) - cmd.exe Shellcode (23 bytes) Windows/x86 (XP SP2) (English / Arabic) - cmd.exe Shellcode (23 bytes) Windows (XP Professional SP2) (English) - MessageBox + Null-Free Shellcode (16 bytes) Windows (XP Professional SP2) (English) - Wordpad + Null-Free Shellcode (12 bytes) Windows (XP Professional SP2) (English) - MessageBox + Null-Free Shellcode (16 bytes) Windows (XP Professional SP2) (English) - Wordpad.exe + Null-Free Shellcode (12 bytes) Windows/x86 (XP SP2) (French) - calc Shellcode (19 bytes) Windows/x86 (XP SP2) (French) - calc.exe Shellcode (19 bytes) Windows/x86 (XP SP3) (English) - cmd.exe Shellcode (26 bytes) Windows/x86 (XP SP3) (English) - cmd.exe Shellcode (26 bytes) Windows/x86 (XP SP2) - write.exe + ExitProcess WinExec Shellcode (16 bytes) Windows/x86 (XP SP2) - WinExec (write.exe) + ExitProcess Shellcode (16 bytes) Windows/x86 (XP SP3) (Russia) - cmd + ExitProcess WinExec Shellcode (12 bytes) Windows/x86 (XP SP3) (Russia) - WinExec(cmd.exe) + ExitProcess Shellcode (12 bytes) Linux/x86 - chmod 0777 /etc/shadow + sys_chmod syscall Shellcode (39 bytes) Linux/x86 - chmod 0777 /etc/shadow + sys_chmod syscall Shellcode (39 bytes) Windows/x86-64 (7) - cmd Shellcode (61 bytes) Windows/x86-64 (7) - cmd.exe Shellcode (61 bytes) Windows - cmd.exe + ExitProcess WinExec Shellcode (195 bytes) Windows - WinExec (cmd.exe) + ExitProcess Shellcode (195 bytes) Windows/ARM (Mobile 6.5 TR WinCE 5.2) - MessageBox Shellcode Windows/ARM (Mobile 6.5 TR WinCE 5.2) - MessageBox Shellcode Windows/x86 (XP Professional SP3) (English) - Add Local Administrator User (secuid0/m0nk) Shellcode (113 bytes) Windows/x86 - Add Local Administrator User (secuid0/m0nk) Shellcode (326 bytes) Windows/x86 (XP Professional SP3) (English) - Add Administrator User (secuid0/m0nk) Shellcode (113 bytes) Windows/x86 - Add Administrator User (secuid0/m0nk) Shellcode (326 bytes) Windows - Add Local Administrator User (RubberDuck/mudbath) + ExitProcess WinExec Shellcode (279 bytes) Windows - Add Administrator User (RubberDuck/mudbath) + ExitProcess WinExec Shellcode (279 bytes) Windows/x86-64 / x86 (2000/XP/7) - URLDownloadToFile (http://bflow.security-portal.cz/down/xy.txt) + WinExec + ExitProcess Shellcode Windows/x86-64 / x86 (2000/XP/7) - URLDownloadToFile (http://bflow.security-portal.cz/down/xy.txt) + WinExec() + ExitProcess Shellcode Windows/x86 - Add Administrator User (ALI/ALI) + Add To RDP Group + Enable RDP From Registry + STOP Firewall + Auto Start Terminal Service + Obfuscated Shellcode (1218 bytes) Windows/x86-64 - Add Administrator User (ALI/ALI) + Add To RDP Group + Enable RDP From Registry + STOP Firewall + Auto Start Terminal Service + Obfuscated Shellcode (1218 bytes) Windows/x86 - Add Administrator User (ALI/ALI) + Add To RDP Group + Enable RDP From Registry + Stop Firewall + Auto Start Terminal Service + Obfuscated Shellcode (1218 bytes) Windows/x86-64 - Add Administrator User (ALI/ALI) + Add To RDP Group + Enable RDP From Registry + Stop Firewall + Auto Start Terminal Service + Obfuscated Shellcode (1218 bytes) BSD / Linux / Windows x86/x86-64 - execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode (194 bytes) BSD / Linux / Windows/x86-64/x86 - execve(_/bin//sh__ {_//bin/sh__ _-c__ _cmd_}_ NULL) Execute Command Shellcode (194 bytes) Linux/x86 - Reverse TCP (127.1.1.1:10) Xterm Shell Shellcode (68 bytes) Linux/x86 - Reverse TCP (127.1.1.1:10) Xterm Shell Shellcode (68 bytes) Linux/x86 - execve(/bin/sh_ -c_ ping localhost) Shellcode (55 bytes) Linux/x86 - execve(/bin/sh_ -c_ ping localhost) Shellcode (55 bytes) Linux/x86 - execve() Using JMP-FSTENV Shellcode (67 bytes) Linux/x86 - execve() Using JMP-FSTENV Shellcode (67 bytes) Linux/x86 - execve() + ROT-7 Shellcode (Encoder/Decoder) (74 bytes) Linux/x86 - execve() + ROT-7 Shellcode (Encoder/Decoder) (74 bytes) Windows/x86 - Create Admin User (X) Shellcode (304 bytes) Windows/x86 - Create Administrator User (X) Shellcode (304 bytes) Windows/x86 (XP Professional SP2) (English) - Wordpad Shellcode (15 bytes) Windows/x86 (XP Professional SP2) - calc Shellcode (57 bytes) Windows/x86 (XP Professional SP2) (English) - Wordpad.exe Shellcode (15 bytes) Windows/x86 (XP Professional SP2) - calc.exe Shellcode (57 bytes) Windows/x86 (XP SP3) (English) - calc Shellcode (16 bytes) Windows/x86 (XP SP3) (English) - calc.exe Shellcode (16 bytes) Windows/x86-64 - cmd.exe WinExec() Shellcode (93 bytes) Windows/x86 - Reverse UDP Keylogger (www.example.com:4444/UDP) Shellcode (493 bytes) Windows/x86-64 - WinExec(cmd.exe) Shellcode (93 bytes) Windows/x86 - Reverse UDP (www.example.com:4444/UDP) Keylogger Shellcode (493 bytes) Linux/x86-64 - Bind TCP (1337/TCP) Shell + Password (pAzzW0rd) + Egghunter Using sys_access() Shellcode (49 bytes) Linux/x86-64 - Bind TCP (1337/TCP) Shell + Password (pAzzW0rd) + Egghunter Using sys_access() Shellcode (49 bytes) --- exploits/java/webapps/43848.txt | 87 +++++ exploits/json/webapps/43849.txt | 335 +++++++++++++++++++ exploits/multiple/webapps/43847.py | 82 +++++ exploits/perl/webapps/43853.txt | 42 +++ exploits/php/webapps/43850.txt | 231 +++++++++++++ exploits/php/webapps/43852.php | 47 +++ files_exploits.csv | 6 + files_shellcodes.csv | 88 ++--- shellcodes/bsdi_x86/{13257.txt => 13257.c} | 0 shellcodes/bsdi_x86/{13258.txt => 13258.c} | 0 shellcodes/freebsd/{13261.txt => 13261.c} | 0 shellcodes/hardware/{13291.txt => 13291.asm} | 0 shellcodes/hardware/{13292.txt => 13292.asm} | 0 shellcodes/hardware/{13293.txt => 13293.asm} | 0 shellcodes/hp-ux/{13295.txt => 13295.c} | 0 15 files changed, 874 insertions(+), 44 deletions(-) create mode 100644 exploits/java/webapps/43848.txt create mode 100644 exploits/json/webapps/43849.txt create mode 100755 exploits/multiple/webapps/43847.py create mode 100644 exploits/perl/webapps/43853.txt create mode 100644 exploits/php/webapps/43850.txt create mode 100644 exploits/php/webapps/43852.php rename shellcodes/bsdi_x86/{13257.txt => 13257.c} (100%) rename shellcodes/bsdi_x86/{13258.txt => 13258.c} (100%) rename shellcodes/freebsd/{13261.txt => 13261.c} (100%) rename shellcodes/hardware/{13291.txt => 13291.asm} (100%) rename shellcodes/hardware/{13292.txt => 13292.asm} (100%) rename shellcodes/hardware/{13293.txt => 13293.asm} (100%) rename shellcodes/hp-ux/{13295.txt => 13295.c} (100%) diff --git a/exploits/java/webapps/43848.txt b/exploits/java/webapps/43848.txt new file mode 100644 index 000000000..fd3a78211 --- /dev/null +++ b/exploits/java/webapps/43848.txt @@ -0,0 +1,87 @@ +[+] Credits: John Page (aka hyp3rlinx) +[+] Website: hyp3rlinx.altervista.org +[+] Source: http://hyp3rlinx.altervista.org/advisories/ORACLE-JDEVELOPER-DIRECTORY-TRAVERSAL.txt +[+] ISR: apparition security + + +Vendor: +============= +www.oracle.com + + +Product: +=========== +JDeveloper IDE + +Oracle JDeveloper is a free integrated development environment that simplifies the development of Java-based +applications addressing every step of the application lifecycle. + + + +Vulnerability Type: +=================== +Directory Traversal + + + +CVE Reference: +============== +CVE-2017-10273 + + + +Security Issue: +================ +Attackers can place malicious files outside intended target directories if tricked into importing corrupt .WAR or .EAR archives. +Later, attackers can potentially request these scripts/files to execute system commands on affected target. + + +Affected versions: +11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, 12.2.1.2.0 + + +References: +============ +http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html + + + +Exploit/POC: +============= +1) create evil .WAR or .EAR archive containing ../ in path name to initiate directory traversal and inside a script to execute system commands. +2) import into JDeveloper +3) files get moved outside target directories to one of the attackers choosing. +4) attacker requests the malicious file contained in target directory. + +BAM! + + +Network Access: +=============== +Local + + + +Severity: +========= +Low + + + +Disclosure Timeline: +============================= +Vendor Notification: October 14, 2016 +Vendor fixes as part of CPU January 16, 2018 +January 17, 2018 : Public Disclosure + + + +[+] Disclaimer +The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. +Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and +that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit +is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility +for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information +or exploits by the author or elsewhere. All content (c). + +hyp3rlinx \ No newline at end of file diff --git a/exploits/json/webapps/43849.txt b/exploits/json/webapps/43849.txt new file mode 100644 index 000000000..6e113bb4c --- /dev/null +++ b/exploits/json/webapps/43849.txt @@ -0,0 +1,335 @@ +Document Title: +=============== +Shopware 5.2.5 & v5.3 - Multiple Cross Site Scripting Web Vulnerabilities + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1922 + +Shopware Security Tracking ID: SW-19834 + +Security Update: +http://community.shopware.com/Downloads_cat_448.html#5.3.4 +http://community.shopware.com/_detail_2035.html + +http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15374 + +CVE-ID: +======= +CVE-2017-15374 + + +Release Date: +============= +2017-09-05 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1922 + + +Common Vulnerability Scoring System: +==================================== +4.4 + + +Vulnerability Class: +==================== +Cross Site Scripting - Persistent + + +Current Estimated Price: +======================== +1.000€ - 2.000€ + + +Product & Service Introduction: +=============================== +Shopware is a modular online shop system that is since 2004 developed in germany. It is available both as +an open source software as well as in commercial editions. The program can be extended in its functions by +installing additional plugins. An open API allows third-party systems, such as payment services or ERP +systems, to be connected. The system is multi shop capable it can thus be generated within an installation +several shops in different domains. A multi-client capability (complete separation of multishops in the +administration area) is by default, but can be achieved in the cluster. + +(Copy of the Vendor Homepage: https://en.shopware.com/ ) + + +Abstract Advisory Information: +============================== +The vulnerability laboratory core research team discovered multiple stored cross site scripting vulnerability in the official Shopware v5.2.5 & 5.3 CMS. + + +Vulnerability Disclosure Timeline: +================================== +2016-10-07: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) +2016-10-08: Vendor Notification (Shopware Security Team) +2016-**-**: Vendor Response/Feedback (Shopware Security Team) +2017-**-**: Vendor Fix/Patch (Shopware Service Developer Team) +2017-09-05: Public Disclosure (Vulnerability Laboratory) +2017-10-25: Security Acknowledgements (Shopware Developer Team) +2017-10-25: Security Acknowledgements (Shopware Security Team) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Shopware AG +Product: Shopware - Content Management System (Web-Application) 5.2.5 + +Shopware AG +Product: Shopware - Content Management System (Web-Application) 5.3 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Medium + + +Technical Details & Description: +================================ +The shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management +system backend modules. Remote attackers are able to inject malicious script code to the firstname, lastname or order +input fields to provoke a persistent execution in the customer and orders section of the backend. The execution occurs +in the shopware administrator backend listing when processing to preview the customers (kunden) or orders (bestellungen). +The injection can be processed by interaction via user registration or by manipulation of the order information inputs. +The web issue can be exploited by low privileged user accounts against higher privileged admin- oder moderator-accounts. + +The security risk of the bugs are estimated as medium with a cvss (common vulnerability scoring system) count of 4.4. +Exploitation of the issue requires a low privileged web-application user account and low or medium user interaction. +Successful exploitation of the vulnerabilities results in persistent phishing mails, session hijacking, persistent +external redirect to malicious sources and application-side manipulation of affected or connected module context. + +Request Method(s): +[+] POST (Registration) +[+] POST (Order Item) +[+] POST (Profile Update) + +Vulnerable Input(s): +[+] Firstname +[+] Lastname +[+] Order Name + +Affected Module(s): +[+] Kunden (Customers) +[+] Bestellungen (Orders) + + +Proof of Concept (PoC): +======================= +The cross site vulnerabilities can be exploited by remote attackers with low privileged shopware user account and low user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + + +Manual steps to reproduce the vulnerability ... +1. Open the the browser and surf to the target shopware v5.2.5 web-application +2. Move to the registration formular +3. Include a script code payload with a iframe src onload tag to the firstname, lastname and name parameters +4. Submit the request via POST method to register the account +5. Move to the inbox and verify via link the account to activate +Note: Now the payloads are executable saved to the Kunden (Customer) section in the backend +6. The administrator visits in the next step the Kunden (Customer) section to preview +7. The script code payload executes in the customers list +8. As next step the attacker places an order via shop +Note: The order name manipulation via registration is as well able to execute script code the context +9. The administrator visits in the next step the Bestellungen (orders) section to preview +10. The script code payload executes in the orders list +11. Successful reproduce of the both cross site vulnerabilities! + +Note: Attackers are able to inject malicious redirects, frames with payloads or other script code tags. +The basic web validation filter of the shopware content management system does not encode the list context. + + +PoC: Vulnerable Source (Execution in Orders - Bestellungen) +
 
20.08.2016 08:34
20044
+536,80
 
+
Rechnung
Standard Versand
+
+Hauptshop Deutsch
Mar'Da>"
+
+
+ + +--- PoC Session Logs [POST] --- +Status: 200[OK] +POST http://shopware.localhost:8080/backend/customer/save?_dc=1471541475086&customerID=22 +Mime Type[application/json] + Request Header: + Host[shopware.localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.2; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0] + Content-Type[application/json] + X-Requested-With[XMLHttpRequest] + Referer[http://shopware.localhost:8080/backend/] + Cookie[SHOPWAREBACKEND=fv4u2kg63p3ff3ht6kd6var803; test; x-ua-device=desktop; session-1=e7f8815a87d6cfa5552abf58325ca4fa184f7b69f9d45ff7b101c17f7ee0a255;] +Connection[keep-alive] +POST-Daten: +{"id":22,"groupKey":"EK","email":"TEST@TEST.de","active":true,"accountMode":0,"confirmationKey": +"","paymentId":5,"firstLogin":"2016-08-18T00:00:00","lastLogin":"2016-08-18T17:22:23","newsletter":0,"validation":0," +languageId":1,"shopId":1,"priceGroupId":0, +"internalComment":"TEST-comment","failedLogins":0,"referer":"","default_billing_address_id":22," +default_shipping_address_id":22, +"newPassword":"","amount":402.9,"orderCount":1,"canceledOrderAmount": 0,"shopName":"Hauptshop Deutsch","language":"Deutsch","birthday":"16.05.1985","title":""," +salutation":"mr","firstname":"TEST[INJECTED SCRIPT CODE]>"