PlumeCMS <= 1.2.4 CSRF "0day" Vulnerability

New "0day" vulnerability discovered regarding PluseCMS.

For more details:

http://www.exploit-db.com/author/?a=3557
http://packetstormsecurity.org/files/author/9536/

D-Link DSL-2640B (ADSL Router) CSRF "0day" Vulnerability

I've discovered a new "0day" vulnerability:

http://www.securityfocus.com/bid/52096/info
http://www.exploit-db.com/author/?a=3557
http://packetstormsecurity.org/files/author/9536/

This vulnerability allows to change administrator password of D-Link DSL-2640B ADSL Router.

SyndeoCMS <= 3.0 CSRF "0day" Vulnerability

Today I've found a new "0day" vulnerability into Syndeocms 3.0 - and lower version - and I've created an exploit in order to automatically add an administrator account when the real administrator browses an "ad hoc" created web page containing a simple html/javascript code.

For more details:

http://www.exploit-db.com/author/?a=3557
http://packetstormsecurity.org/files/author/9536/

Some web sites which published my "0day" vulnerability:

http://1337day.com/exploits/17544
http://exploitsdownload.com/exploit/php/syndeocms-30-csrf-vulnerabili
http://www.allinfosec.com/2012/02/19/webapps-0day-syndeocms-3-0-csrf-vulnerability/
http://www.silobreaker.com/webapps--syndeocms-lt-30-csrf-vulnerability-5_2265494154572201984
http://eternal-todo.com/aggregator/categories/1
http://www.morningstarsecurity.com/news
http://unsecure-os.org/index.php/exploits
http://securit.se/it-sakerhetsnyheter/
http://cxsecurity.com/
http://www.bugsearch.net/

SocialCMS CSRF "0day" Vulnerability

Yestarday I found a "0day" vulnerability into latest version (1.0.2) of "Socialcms" cms (socialcms.com) and created an exploit in order to add an  Administrator account. The vulnerability and related exploit  have been published into Offensive Security Exploit Database. You can find more details here:

http://www.exploit-db.com/author/?a=3557

Other web site have published this "oday" vulnerability:

http://www.allinfosec.com/2012/02/16/webapps-0day-socialcms-csrf-vulnerability
http://www.1337day.com/exploits/17527
http://www.realhacker.net/tag/webapps
http://94hi.com/exploit/html/3244.html

Discovering Cross Site Scripting (XSS) vulnerabilities

Today I wrote a simple perl script to automatically discover XSS vulnerabilities into a web application.
This script can be improved in order to make it more suitable to be used in a web penetration test.

Following the code:

#!/usr/bin/perl 

use strict;
use LWP::Simple;
my ($url, $webpage, @webpage, @name, $result);

if(@ARGV < 1) {
 usage();
}

#Get web page specified by cmd
$webpage = get("http://" . $ARGV[0]);

#Split variable into an arry
@webpage = split(/\n/, $webpage);

#Parsing Web Page to obtain names of "input type=text" 
foreach (@webpage) {
  if($_ =~ /input\stype="text"\sname="(\w{1,30})"/) {
    push(@name, $1);    
  }
}

#Print found search box
if(@name) {
 print "I've found the following search box:\n";  
 foreach (@name) {
   print "$_\n";
 }
 print "and I've discovered that:\n";


#Automatically exploit search box to verify XSS vulnerabilities
 foreach (@name) {
   $result = get("http://" . $ARGV[0] . "?" . $_ . "=<script>alert('test_XSS')</script>");
   if($result =~ /<script>alert\('test_XSS'\)<\/script>/) {
     print "$_ is vulnerable to XSS\n";
   }   
   else { print "$_ isn't vulnerable to XSS\n";}
 }
}

else { 
 print"I have not found search boxes in " . $ARGV[0] . "\n";
}

sub usage() {
 print"Usage: ".$0." <url>\n";
 print "Example: " . $0 . " ivanobinetti.com\n";
 exit;
}

Google as Web Proxy

The simplest  method used to bypass proxy blacklist filter (implemented for example on proxy squid) is to use Google Translate service which can simply become a web proxy. Let's see how this can be done:
suppose that you would like to go to ivanobinetti.com web site which is blocked by proxy blacklist. You only have to go to:

translate.google.com/translate?u=http://www.ivanobinetti.com

Be careful to select a destination language (that one in which you want to translate) different than original language. For example, if you have a english site you can select italian as destination language and, in general, you can select any language except english (which is original language).

Enjoy your new and always available web proxy.

Perl FTP client

I've written a simple FTP client in perl which allows to integrate ftp into batch scripts.

#!/usr/bin/perl
use Net::FTP;

#variables
$server = $ARGV[1];
$user = $ARGV[3];
$password = $ARGV[5];
$method = $ARGV[7];
$file = $ARGV[9];


#input control
if(@ARGV <1 || $ARGV[0] ne "-s" || $ARGV[2] ne "-u" || $ARGV[4] ne "-p" || $ARGV[6] ne "-m" || $ARGV[8] ne "-f")  {
 usage();
}


#core code
$ftp = Net::FTP->new("$server", Debug => 0)
or die "Cannot connect to $server: $@";
$ftp->login("$user",'$password')
or die "Cannot login ", $ftp->message;


if ($method eq "get") {
 $ftp->get("$file")
 or die "get failed ", $ftp->message;
}


elsif ($method eq "put") {
 $ftp->put("$file")
 or die "put failed ", $ftp->message;
}


else {
usage();
}


$ftp->quit;


#sub defined into input control code
sub usage() {
        print "[-] Usage: <". $0 ."> -s <server> -u <user> -p <password> -m <method> -f <file> \n";
        print "[-] Example: ". $0 ." -s 127.0.0.1 -u user -p password -m get -f test.txt\n";
        exit;
}

Note 1. I've used Net::FTP class/module which can be installed simply calling  "shell subroutine" with the following commands:

1. perl -MCPAN -e shell
2. install Net::FTP 

Note 2. As you can imagine, this scripts is only a simple example ad you can add more features to this script to adapt it to your specific context.