The SSL protocol, as used in Oracle Java, encrypts data by using CBC mode with chained initialization vectors. This weakness allows to decrypt HTTP headers by a chosen plain text attack, thus obtaining browser cookies from the target system's browser corresponding to a given HTTPS server. The cookies could then be used by the user to do a session hijacking attack. This module launches the attack against target systems. This systems must be running a browser with the vulnerable Java version for this exploit to work. This module is capable or retrieving the cookies stored in the browser for a specified target domain. The attack begins with an ARP spoofing attack. If this attack is successful, HTTP traffic from the target system will be intercepted and modified. An HTTP response will be modified so the target's browser loads a Java applet. This applet then is used to launch the chosen plain text attack. For this exploit to work, the cipher suite used by the SSL connection between the target system and the target domain must use the CBC mode. This module only works when the target domain server isn't on the same local network as the target system. This exploit wasn't tested on target domains that resolve to more than one IP address. This module doesn't work when the target domain host is accessed by the target system through a proxy, or if the target domain server closes the SSL connections after every request. Note: The ARP attack will send packets with spoofed MAC addresses. The MAC address prefix can be controlled with a parameter. This value should be changed when the module is run against more than one target at the same time.
After successful exploitation an agent will be deployed. This agent will inherit the user identity and capabilities of the abused service, usually those of the user used to login into the ftp server (ftp, for example). However, the uid (as opposite to the euid) of the agent will be that of the super user in most cases (usually 0), and by using the setuid module (see setuid module documentation), it can be changed. When an anonymous user is used, or if the server is configured to do this for other users, the deployed agent will be running in a chroot jail. This situation does not prevent the agent to be used, and after setting the user id to that of the super user, the chroot breaker module (see chroot breaker module documentation) can be used to escape the chroot jail.
This module exploits a vulnerability in W3 Total Cache plugin for Wordpress. Certain macros such as mfunc allow to inject PHP code into comments. By injecting a crafted comment into a valid post an attacker can execute arbitrary PHP code on systems running vulnerable installations of W3 Total Cache.
NetBackup Java user-interface is affected by a remote format string vulnerability. An attacker can exploit this vulnerability by crafting a malicious request that contains format specifiers. A successful attack may result in crashing the server or lead to arbitrary code execution. This may facilitate unauthorized access or privilege escalation with SYSTEM or superuser privileges.
This module exploits a remote command execution vulnerability found in some distributions of UnrealIRCd that contain a backdoor and installs an agent into the target host. The backdoor is present on the file Unreal3.2.8.1.tar.gz that was maliciously replaced on certain mirrors. The vulnerable file has the following MD5 checksum: 752e46f2d873c1679fa99de3f52a274d.
Local File Inclusion vulnerability in admin/index.php in TinyWebGallery 1.7.6 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include local files via the lang parameter, which leads to execute arbitrary PHP code by injecting data into the log files.
Subscribe to Linux