WPS Office 2016 - .ppt Heap Memory Corruption

WPS Office 2016 - .ppt Heap Memory Corruption Application: WPS Office Platforms: Windows Versions: Version before 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WPS Office an acrony...

iScripts EasyCreate 3.0 - Remote Code Execution

iScripts EasyCreate 3.0 - Remote Code Execution !C:/Python27/python.exe -u iScripts EasyCreate 3.0 Remote Code Execution Exploit Vendor: iScripts.com Product web page: http://www.iscripts.com Affected version: 3.0 Summary: iScripts EasyCreate is a private label online website builder. This softwa...

Apache 2.4.7 + PHP 7.0.2 - openssl_seal() Uninitialized Memory Code Execution

Apache 2.4.7 + PHP 7.0.2 - opensslseal Uninitialized Memory Code Execution ?php // Source: http://akat1.pl/?id=1 function getmaps $fh = fopen"/proc/self/maps", "r"; $maps = fread$fh, 331337; fclose$fh; return explode"\n", $maps; function findmap$sym $addr = 0; foreachgetmaps as $record if...

WPS Office 2016 - .doc OneTableDocumentStream Memory Corruption

WPS Office 2016 - .doc OneTableDocumentStream Memory Corruption Application: WPS Office Platforms: Windows Versions: Version before 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WP...

WPS Office 2016 - .xls Heap Memory Corruption

WPS Office 2016 - .xls Heap Memory Corruption Application: WPS Office Platforms: Windows Versions: Version 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WPS Office an acronym for...

WPS Office 2016 - .ppt drawingContainer Memory Corruption

WPS Office 2016 - .ppt drawingContainer Memory Corruption Application: WPS Office Platforms: Windows Versions: Version 2016 Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== WPS Office an...

WordPress Plugin Simple Add Pages or Posts 1.6 - Cross-Site Request Forgery

WordPress Plugin Simple Add Pages or Posts 1.6 - Cross-Site Request Forgery Exploit Title: Wordpress simple add pages or posts CSRF Vulnerability Date: 2016/29/01 Exploit Author: ALIREZAPROMIS Vendor Homepage: https://wordpress.org/plugins/simple-add-pages-or-posts/ Software Link:...

ProjectSend r582 - Multiple Vulnerabilities

ProjectSend r582 - Multiple Vulnerabilities Advisory ID: SGMA-16001 Title: ProjectSend multiple vulnerabilities Product: ProjectSend previously cFTP Version: r582 and probably prior Vendor: www.projectsend.org Vulnerability type: SQL-injection, Auth bypass, Arbitrary File Access, Insecure Object...

Apple Mac OSX iOS - Unsandboxable Kernel Code Exection Due to iokit Double Release in IOKit

Apple Mac OSX iOS - Unsandboxable Kernel Code Exection Due to iokit Double Release in IOKit Source: https://code.google.com/p/google-security-research/issues/detail?id=620 I wanted to demonstrate that these iOS/OS X kernel race condition really are exploitable so here's a PoC which gets RIP on OS...

Apple Mac OSX - IOSCSIPeripheralDeviceType00 Userclient Type 12 Kernel NULL Dereference

Apple Mac OSX - IOSCSIPeripheralDeviceType00 Userclient Type 12 Kernel NULL Dereference / Source: https://code.google.com/p/google-security-research/issues/detail?id=562 Opening userclient type 12 of IOSCSIPeripheralDeviceType00 leads to an exploitable kernel NULL dereference. Tested on OS X 10.1...

Apple Mac OSX - IntelAccelerator::gstqConfigure Kernel NULL Dereference

Apple Mac OSX - IntelAccelerator::gstqConfigure Kernel NULL Dereference / Source: https://code.google.com/p/google-security-research/issues/detail?id=595 The field at IntelAccelerator+0xe60 is a pointer to a GSTContextKernel allocated in the ::gstqCreateInfoMethod. In the ::start method this fiel...

iOS Kernel - IOReportHub Use-After-Free

iOS Kernel - IOReportHub Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=603 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

Apple Mac OSX iOS - Unsandboxable Kernel Use-After-Free in Mach Vouchers

Apple Mac OSX iOS - Unsandboxable Kernel Use-After-Free in Mach Vouchers / Source: https://code.google.com/p/google-security-research/issues/detail?id=553 The mach voucher subsystem fails to correctly handle spoofed no-more-senders messages. ipckobjectserver will be called for mach messages sent ...

Apple Mac OSX iOS - Multiple Kernel Uninitialized Variable Bugs Leading to Code Execution Vulnerabilities

Apple Mac OSX iOS - Multiple Kernel Uninitialized Variable Bugs Leading to Code Execution Vulnerabilities Source: https://code.google.com/p/google-security-research/issues/detail?id=618 The ool variations of the IOKit device.defs functions all incorrectly deal with error conditions. If you run th...

Apple Mac OSX iOS - Double-Delete IOHIDEventQueue::start Code Execution

Apple Mac OSX iOS - Double-Delete IOHIDEventQueue::start Code Execution Source: https://code.google.com/p/google-security-research/issues/detail?id=542 The IOHIDLibUserClient allows us to create and manage IOHIDEventQueues corresponding to available HID devices. Here is the ::start method, which...

VideoLAN VLC Media Player 2.2.1 - .mp4 Heap Memory Corruption

VideoLAN VLC Media Player 2.2.1 - .mp4 Heap Memory Corruption Application: VLC media player Platforms: Windows Versions: Version 2.2.1 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC...

Apple Mac OSX - IOBluetoothHCIUserClient Arbitrary Kernel Code Execution

Apple Mac OSX - IOBluetoothHCIUserClient Arbitrary Kernel Code Execution / Source: https://code.google.com/p/google-security-research/issues/detail?id=569 IOBluetoothHCIUserClient uses an IOCommandGate to dispatch external methods; it passes a pointer to the structInput of the external method as...

Apple Mac OSX Kernel - no-more-senders Use-After-Free

Apple Mac OSX Kernel - no-more-senders Use-After-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=567 Kernel UaF due to audit session port failing to correctly account for spoofed no-more-senders notifications Tested on ElCapitan 10.11 15a284 on MacBookAir 5,2 / ...

iOS Kernel - AppleOscarCMA Use-After-Free

iOS Kernel - AppleOscarCMA Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=605 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

iOS Kernel - AppleOscarGyro Use-After-Free

iOS Kernel - AppleOscarGyro Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=608 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

Apple Mac OSX - OSMetaClassBase::safeMetaCast in IOAccelContext2::connectClient NULL Dereference

Apple Mac OSX - OSMetaClassBase::safeMetaCast in IOAccelContext2::connectClient NULL Dereference / Source: https://code.google.com/p/google-security-research/issues/detail?id=512 IOUserClient::connectClient is an obscure IOKit method which according to the docs is supposed to "Inform a connection...

Apple Mac OSX - gst_configure Kernel Buffer Overflow

Apple Mac OSX - gstconfigure Kernel Buffer Overflow / Source: https://code.google.com/p/google-security-research/issues/detail?id=596 The external method 0x206 of IGAccelGLContext is gstconfigure. This method takes an arbitrary sized input structure passed in rsi but doesn't check the size of tha...

Apple Mac OSX Kernel - IOAccelDisplayPipeUserClient2 Use-After-Free

Apple Mac OSX Kernel - IOAccelDisplayPipeUserClient2 Use-After-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=565 Kernel UaF with IOAccelDisplayPipeUserClient2 with spoofed no more senders notifications repro: while true; do ./iospoofig4; done Likely to crash i...

iOS Kernel - AppleOscarAccelerometer Use-After-Free

iOS Kernel - AppleOscarAccelerometer Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=607 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

iOS Kernel - AppleOscarCompass Use-After-Free

iOS Kernel - AppleOscarCompass Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=606 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

Apple Mac OSX - io_service_close Use-After-Free

Apple Mac OSX - ioserviceclose Use-After-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=597 It turns out that the spoofed no-more-senders notification bug when applied to iokit objects was actually just a more complicated way to hit ::clientClose in parallel. W...

Apple Mac OSX - IOBluetoothHCIPacketLogUserClient Memory Corruption

Apple Mac OSX - IOBluetoothHCIPacketLogUserClient Memory Corruption / Source: https://code.google.com/p/google-security-research/issues/detail?id=572 The OS data types OSArray etc are explicity not thread safe; they rely on their callers to implement the required locking to serialize all accesses...

NETGEAR WNR1000v4 - Authentication Bypass

NETGEAR WNR1000v4 - Authentication Bypass ''' Exploit Title: NetgearWNR1000v4AuthBypass Google Dork: - Date: 06.10.2015 Exploit Author: Daniel Haake Vendor Homepage: http://www.netgear.com/ Software Link: http://downloadcenter.netgear.com/en/product/WNR1000v4 Version: N300 router firmware version...

Ramui Web Hosting Directory Script 4.0 - Remote File Inclusion

Ramui Web Hosting Directory Script 4.0 - Remote File Inclusion Title: Ramui web hosting directory script 4.0 Remote File Include Vulnerability Author: bd0rk Twitter: twitter.com/bd0rk Vendor: http://www.ramui.com Download: http://ramui.com/directory-script/download-v4.html Proof-of-Concept:...

SAP HANA 1.00.095 - hdbindexserver Memory Corruption

SAP HANA 1.00.095 - hdbindexserver Memory Corruption ERPSCAN-15-024 SAP HANA hdbindexserver - Memory corruption Application: SAP HANA Versions Affected: SAP HANA 1.00.095 Vendor URL: http://SAP.com Bugs: Memory corruption, RCE Reported: 17.07.2015 Vendor response: 18.07.2015 Date of Public...

Apple Mac OSX Kernel - IOAccelMemoryInfoUserClient Use-After-Free

Apple Mac OSX Kernel - IOAccelMemoryInfoUserClient Use-After-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=566 Kernel UaF with IOAccelMemoryInfoUserClient with spoofed no more senders notifications repro: while true; do ./iospoofig7; done Tested on ElCapitan...

Apple Mac OSX iOS Kernel - iokit Registry Iterator Manipulation Double-Free

Apple Mac OSX iOS Kernel - iokit Registry Iterator Manipulation Double-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=598 The userspace MIG wrapper IORegistryIteratorExitEntry invokes the following kernel function: kernreturnt isioregistryiteratorexitentry...

Ramui Forum Script 9.0 - SQL Injection

Ramui Forum Script 9.0 - SQL Injection Title: Ramui forum script 9.0 SQL Injection Exploit Author: bd0rk Twitter: twitter.com/bd0rk Vendor: http://www.ramui.com/ Download: http://ramui.com/forum-script/download-v9.html Google-Dork: n/a ---Script-Kiddie protection! : Direct SQL-Path: n/a...

Apple Mac OSX - IOHDIXControllerUserClient::convertClient Buffer Integer Overflow

Apple Mac OSX - IOHDIXControllerUserClient::convertClient Buffer Integer Overflow / Source: https://code.google.com/p/google-security-research/issues/detail?id=511 Method 5 of the IOHDIXController user client is createDrive64. This takes a 0x100 byte structure input from which it reads a userspac...

Apple Mac OSX Kernel - Hypervisor Driver Use-After-Free

Apple Mac OSX Kernel - Hypervisor Driver Use-After-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=580 The hvspace lock group gets an extra ref dropped when you kill a process with an AppleHV userclient; one via IOService::terminateWorker calling the...

Apple Mac OSX iOS - NECP System Control Socket Packet Parsing Kernel Code Execution Integer Overflow

Apple Mac OSX iOS - NECP System Control Socket Packet Parsing Kernel Code Execution Integer Overflow / Source: https://code.google.com/p/google-security-research/issues/detail?id=543 NKE control sockets are documented here:...

Apple Mac OSX iOS Kernel - IOHDIXControllUserClient::clientClose Use-After-FreeDouble-Free

Apple Mac OSX iOS Kernel - IOHDIXControllUserClient::clientClose Use-After-FreeDouble-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=599 OS X and iOS kernel UaF/double free due to lack of locking in IOHDIXControllUserClient::clientClose Here's the clientClose...

iOS Kernel - IOHIDEventService Use-After-Free

iOS Kernel - IOHIDEventService Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=604 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

WordPress Plugin Booking Calendar Contact Form 1.1.24 - addslashes SQL Injection

WordPress Plugin Booking Calendar Contact Form 1.1.24 - addslashes SQL Injection Exploit Title: WordPress appointment-booking-calendar =1.1.24 - SQL injection through ´addslashes´ wordpress ´wpmagicquotes´ function Date: 2016-01-28 Google Dork: Index of...

Secure Item Hub 1.0 iOS - Multiple Vulnerabilities

Secure Item Hub 1.0 iOS - Multiple Vulnerabilities Document Title: =============== Secure Item Hub v1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1682 Release Date: ============= 2016-01-27 Vulnerability Laborator...

BK Mobile jQuery CMS 2.4 - Multiple Vulnerabilities

BK Mobile jQuery CMS 2.4 - Multiple Vulnerabilities Product : BK Mobile CMS Exploit Author : Rahul Pratap Singh Version : 2.4 Home page Link : http://codecanyon.net/item/jquery-mobile-website-with-full-admin-panel/2441358 Website : 0x62626262.wordpress.com Linkedin :...

Google Android - sensord Local Privilege Escalation

Google Android - sensord Local Privilege Escalation / Android sensord 0day root exploit by s0m3b0dy tested on LG L7 PL need pentests? s0m3b0dy1atgmail.com some Android devices have sensord deamon, for some ROMs the deamon is running as root processthere we can use this exploit and ---------...

WordPress Plugin Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities

WordPress Plugin Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities Exploit Title: WordPress appointment-booking-calendar =1.1.24 - Privilege escalation Managing calendars & Persistent XSS Date: 2016-01-28 Google Dork: Index of...

Wireshark - nettrace_3gpp_32_423_file_open Stack Out-of-Bounds Read

Wireshark - nettrace3gpp32423fileopen Stack Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=694 The following crash due to a stack-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file ...

Wireshark - hiqnet_display_data Static Out-of-Bounds Read

Wireshark - hiqnetdisplaydata Static Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=695 The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Wireshark - iseries_check_file_type Stack Out-of-Bounds Read

Wireshark - iseriescheckfiletype Stack Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=697 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshar...

pdfium - opj_j2k_read_mcc libopenjpeg Heap Out-of-Bounds Read

pdfium - opjj2kreadmcc libopenjpeg Heap Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=624 The following crash was encountered in pdfium the Chrome PDF renderer during PDF fuzzing: --- cut --- $ ./pdfiumtest...

pdfium - opj_jp2_apply_pclr libopenjpeg Heap Out-of-Bounds Read

pdfium - opjjp2applypclr libopenjpeg Heap Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=626 The following crash was encountered in pdfium the Chrome PDF renderer during PDF fuzzing: --- cut --- ==9326==ERROR: AddressSanitizer: heap-buffer-overflow ...

Wireshark - dissect_nhdr_extopt Stack Buffer Overflow

Wireshark - dissectnhdrextopt Stack Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=696 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Wireshark - dissect_ber_constrained_bitstring Heap Out-of-Bounds Read

Wireshark - dissectberconstrainedbitstring Heap Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=659 The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed fi...