Hacking Articles Tips Tricks Videos Tutorials


# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44154
# Vulnerability Title: Authenticated Buffer Overflow
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard 
# Date: 2021-11-25
#############################################################
Introduction:
By using an authenticated account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow.

Vulnerability:
When writing to options within RLM, if an input is longer than 1024 chars it will result in a buffer overflow, allowing either a secfault, crashing the program, or potentially resulting in RCE.

Recommendation:
Validate input lengths before copying into a buffer.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Reprise License Manager 14.2 Buffer Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 17:47

Hacking Articles Tips Tricks Videos Tutorials

8 views17:47

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Reprise License Manager 14.2 User Enumeration

https://2.bp.blogspot.com/-4wIBcK0z7y4/WWlvHXARtRI/AAAAAAAAILc/wzdKaT4lYrUxiztYZaNra08YExR9F67-wCLcBGAs/s1600/h14.png
Reprise License Manager version 14.2 suffers from a user enumeration vulnerability.

MD5 | 193bb8c1503c298f61459df2f124a49e

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software 
# CVE ID: CVE-2021-44155
# Vulnerability Title: Unauthenticated User Enumeration
# Severity: Low 
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard 
# Date: 2021-11-25
#############################################################
Introduction: 
An issue was discovered in /goform/login_process in RLM 14.2. When an attacker attempts to login, the response if an username is valid includes "Login Failed", but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.

Vulnerability: 
This vulnerability is triggered upon failed authentication, if an attacker supplies an invalid user with an invalid password no error message is given however if an attacker supplies the application with a valid user with an invalid password an error message is displayed informing the user "Login Failed". The difference in response can be abused in order to allow an attacker to enumerate valid users.

Recommendation:
We recommend displaying generic error messages upon failed authentication to mitigate the possibility of an attacker enumerating valid users.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Reprise License Manager 14.2 User Enumeration

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 17:47

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
ETS5 Password Recovery Tool

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
ETS Password Recovery Tool allows you to recover passwords for an ETS5 project. This is due to a significant design flaw as ETS5 uses a hard-coded password and salt to encrypt the project information.

MD5 | 90915ab46d587526fdc2a5369557661e

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

ETS5 Password Recovery Tool

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 17:47

Hacking Articles Tips Tricks Videos Tutorials

8 views17:47

Hacking Articles Tips Tricks Videos Tutorials

7 views17:47

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Reprise License Manager 14.2 Remote Binary Execution

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Reprise License Manager version 14.2 suffers from an authenticated remote binary execution vulnerability.

MD5 | 168a71810d65bf8de3fe62438600faa2

Download

# Product:  Reprise License Manager 14.2
# Vendor:   Reprise Software
# CVE ID:   CVE-2021-44153
# Vulnerability Title: Authenticated Remote Binary Execution
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard 
# Date:   2021-11-25
#############################################################

Introduction:

When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables.
An attacker can exploit this to run a malicious binary on startup, or when triggering the "Reread/Restart Servers" function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)

Vulnerability:

A license file containing the following, would execute calc.exe as an example of this vulnerability, it is also possible to provide arguments to the executables:

ISV demo "C:\Windows\System32\calc.exe"

If CVE-2018-15573 remains unpatched, files could be created on the system and then executed. 

Recommendation:
Don't allow user-specified binaries to be run. Use a allow-list if absolutely required.