ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
62 lines
No EOL
2 KiB
Text
62 lines
No EOL
2 KiB
Text
Oracle AutoVue 20.0.1 AutoVueX ActiveX Control SaveViewStateToFile Remote
|
|
File Creation / Overwrite Vulnerability
|
|
|
|
tested against: Internet Explorer 8
|
|
Microsoft Windows Server 2003 r2 sp2
|
|
|
|
download url of a test version:
|
|
http://www.oracle.com/technetwork/apps-tech/autovue/index.html
|
|
|
|
file:
|
|
AutoVueDemo2001.zip
|
|
|
|
Background:
|
|
|
|
the mentioned program installs an ActiveX control with the following
|
|
settings:
|
|
|
|
ProgID: AUTOVUEX.AutoVueXCtrl.1
|
|
CLSID: {B6FCC215-D303-11D1-BC6C-0000C078797F}
|
|
Binary path: C:\PROGRA~1\av\avwin\AutoVueX.ocx
|
|
Safe for initialization (registry): true
|
|
Safe for scripting (registry): true
|
|
|
|
This control is marked "safe for scripting" and "safe for initialization",
|
|
Internet Explorer will allows scripting of this control.
|
|
|
|
Vulnerability:
|
|
|
|
The mentioned class contains the vulnerable SaveViewStateToFile() method, from
|
|
the typelib:
|
|
|
|
...
|
|
/* DISPID=116 */
|
|
/* VT_BOOL [11] */
|
|
function SaveViewStateToFile(
|
|
/* VT_BSTR [8] */ $sFileName
|
|
)
|
|
{
|
|
}
|
|
...
|
|
|
|
which allows to create / overwrite files with arbitrary extensions
|
|
inside arbitrary locations.
|
|
|
|
It was experimented that the content of theese files can be
|
|
partially controlled by passing a remote file to the
|
|
RestoreViewStateFromFile() method.
|
|
|
|
The resulting file will look like this:
|
|
|
|
0 : 6b 00 00 00 07 00 41 56 31 37 5f 32 00 0a 00 56 [k.....AV17_2...V]
|
|
10 : 69 65 77 53 74 61 74 65 00 ff ff ff ff 00 00 01 [iewState........]
|
|
20 : 00 00 00 01 00 00 00 6f 8f 96 d8 ca 22 71 c1 86 [.......o...."q..]
|
|
30 : f0 ca b7 56 a0 b0 e0 00 00 00 00 00 00 00 00 41 [...V...........A] <----- controlled section (AAAA)
|
|
40 : 41 41 41 59 fb bb 60 86 f0 ca b7 56 a0 b0 60 00 [AAAY..`....V..`.]
|
|
50 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
|
|
60 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [...............]
|
|
|
|
poc, which overwrites boot.ini:
|
|
|
|
http://retrogod.altervista.org/9sg_autovueiii.zip
|
|
Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/18016.zip (9sg_autovueiii.zip) |