what you don't know can hurt you

HanYazilim Paper Submission System .NET 1.0 Shell Upload

HanYazilim Paper Submission System .NET 1.0 Shell Upload
Posted Feb 22, 2019
Authored by KingSkrupellos

HanYazilim Paper Submission System .NET version 1.0 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
MD5 | 4aaca634076bf068eefce87d76d0b6f3

HanYazilim Paper Submission System .NET 1.0 Shell Upload

Change Mirror Download
#################################################################################

# Exploit Title : HanYazilim Paper Submission System .NET v1.0 Privilege
Escalation / Shell Upload
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 22/02/2019
# Vendor Homepage : hanyazilim.com
# Software Information Link : hanyazilim.com/hakemlimakaletakipsistemi.pdf
videolar.hanyazilim.com
# CKEditor Simogeo Download :
github.com/simogeo/ckeditor-adv_link/archive/master.zip
# Software Version : 1.0
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : High
# Vulnerability Types :
CWE-266: Incorrect Privilege Assignment
CWE-269: Improper Privilege Management
CWE-284: Improper Access Control
CWE-250: Execution with Unnecessary Privileges
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

#################################################################################

# Description about Software :
***************************
HanYazilim Makale Takip Sistemi .NET v1.0 is a kind of Turkish Software
that can be tracked articles

and the journals is used for Turkish University Faculties.

#################################################################################

# Impact and Consequences :
****************************
* This Software [ Product ] HanYazilim Makale Takip Sistemi .NET v1.0
incorrectly assigns

a privilege to a particular actor, creating an unintended sphere of
control for that actor.

* The software does not restrict or incorrectly restricts access to a
resource from an unauthorized actor.

* The software performs an operation at a privilege level that is higher
than the minimum

level required, which creates new weaknesses or amplifies the consequences
of other weaknesses.

* The software does not properly assign, modify, track, or check privileges

for an actor, creating an unintended sphere of control for that actor.

#################################################################################

# Vulnerable Source Code : [ uyelikbilgilerim.aspx ]
*********************************************

<%@ Page Language="C#" MasterPageFile="~/Uye.master" AutoEventWireup="true"
CodeFile="UyelikBilgilerim.aspx.cs" Inherits="UyelikBilgilerim"
Title="Untitled Page" culture="auto" meta:resourcekey="PageResource1"
uiculture="auto" %>

<asp:Content ID="Content1" ContentPlaceHolderID="head" Runat="Server">
<style type="text/css">
.style1
{
width: 801px;
height: 70px;

}
.style7
{
width: 135px;
}
.style351
{
color: #FF0000;
}
.style357
{
width: 135px;
height: 28px;
}
.style358
{
width: 1200px;
height: 28px;
}
</style>
<link href="images/mainstyle.css" rel="stylesheet" type="text/css" />

</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1"
Runat="Server">
<table class="tablosayfaadi">
<tr>
<td class="tablosayfayazi">
<asp:Label ID="Label1" runat="server" Text="Uye Detay/Member
Details"
meta:resourcekey="Label1Resource1"></asp:Label></td>
</tr>
</table>
<table class="style1">
<tr>
<td class="style7">
&nbsp;</td>
<td class="style6">
<asp:Label ID="Label4" runat="server" CssClass="style351"
Text="Label"
Visible="False"
meta:resourcekey="Label4Resource1"></asp:Label>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label2" runat="server" Text="AdA+- SoyadA+-"
meta:resourcekey="Label2Resource1"></asp:Label>
</td>
<td class="style6">
<asp:TextBox ID="TextBox1" runat="server" Width="290px"
meta:resourcekey="TextBox1Resource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator1"
runat="server"
ControlToValidate="TextBox1" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator1Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label5" runat="server" Text="Unvan /Title"
meta:resourcekey="Label5Resource1"></asp:Label></td>
<td class="style8">
<asp:DropDownList ID="DropDownList2" runat="server"
meta:resourcekey="DropDownList2Resource1">
<asp:ListItem Value="1"
meta:resourcekey="ListItemResource1">AraAtA+-rma GAPrevlisi</asp:ListItem>
<asp:ListItem Value="2"
meta:resourcekey="ListItemResource2">Doktor</asp:ListItem>
<asp:ListItem Value="3"
meta:resourcekey="ListItemResource3">Yrd.DoASSent</asp:ListItem>
<asp:ListItem Value="4"
meta:resourcekey="ListItemResource4">DoASS. Dr.</asp:ListItem>
<asp:ListItem Value="5"
meta:resourcekey="ListItemResource5">Prof. Dr.</asp:ListItem>
<asp:ListItem Value="6"
meta:resourcekey="ListItemResource6">DiAer</asp:ListItem>
</asp:DropDownList>
<asp:RequiredFieldValidator ID="RequiredFieldValidator10"
runat="server"
ControlToValidate="DropDownList2" ErrorMessage="*"
InitialValue="0"

meta:resourcekey="RequiredFieldValidator10Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label6" runat="server"
Text="E-Posta /Email"

meta:resourcekey="Label6Resource1"></asp:Label>
</td>
<td class="style6">
<asp:TextBox ID="TextBox3" runat="server" Width="290px"
ReadOnly="True"
meta:resourcekey="TextBox3Resource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator3"
runat="server"
ControlToValidate="TextBox3" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator3Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style357">
<asp:Label ID="Label7" runat="server"
Text="Parola /Password"

meta:resourcekey="Label7Resource1"></asp:Label>
</td>
<td class="style358">
<asp:TextBox ID="TextBox4" runat="server" Width="290px"
meta:resourcekey="TextBox4Resource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator4"
runat="server"
ControlToValidate="TextBox4" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator4Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label8" runat="server"
Text="AdegA Telefonu /Office Telephone"

meta:resourcekey="Label8Resource1"></asp:Label>
</td>
<td class="style6">
<asp:TextBox ID="TextBox5" runat="server" Width="290px"
meta:resourcekey="TextBox5Resource1"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label9" runat="server"
Text="Cep Telefonu /GSM"

meta:resourcekey="Label9Resource1"></asp:Label>
</td>
<td class="style6">
<asp:TextBox ID="TextBox6" runat="server" Width="290px"
meta:resourcekey="TextBox6Resource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator12"
runat="server"
ControlToValidate="TextBox6" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator12Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label10" runat="server"
Text="Adresi /Address"

meta:resourcekey="Label10Resource1"></asp:Label>
</td>
<td class="style6">
<asp:TextBox ID="TextBox7" runat="server" Width="290px"
meta:resourcekey="TextBox7Resource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator9"
runat="server"
ControlToValidate="TextBox7" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator9Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label11" runat="server"
Text="Kurumu /Institution"

meta:resourcekey="Label11Resource1"></asp:Label></td>
<td class="style6">
<asp:TextBox ID="TextBox8" runat="server" Width="290px"
meta:resourcekey="TextBox8Resource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator6"
runat="server"
ControlToValidate="TextBox8" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator6Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label12" runat="server"
Text="GAPrevi /Task"

meta:resourcekey="Label12Resource1"></asp:Label></td>
<td class="style6">
<asp:TextBox ID="Gorevi" runat="server" Width="290px"
meta:resourcekey="GoreviResource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator13"
runat="server"
ControlToValidate="Gorevi" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator13Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label13" runat="server"
Text="AlanA+- /Field"

meta:resourcekey="Label13Resource1"></asp:Label></td>
<td class="style6">
<asp:TextBox ID="Alani" runat="server" Width="290px"
meta:resourcekey="AlaniResource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator7"
runat="server"
ControlToValidate="Alani" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator7Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label14" runat="server"
Text="KA+-sa AzgeASSmiA /Short Biography"

meta:resourcekey="Label14Resource1"></asp:Label></td>
<td class="style6">
<asp:TextBox ID="TextBox10" runat="server" Height="69px"
TextMode="MultiLine"
Width="290px"
meta:resourcekey="TextBox10Resource1"></asp:TextBox>
<asp:RequiredFieldValidator ID="RequiredFieldValidator8"
runat="server"
ControlToValidate="TextBox10" ErrorMessage="*"

meta:resourcekey="RequiredFieldValidator8Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label15" runat="server"
Text="Profil FotografA+- /Profile Photo"

meta:resourcekey="Label15Resource1"></asp:Label>
</td>
<td class="style6" valign="middle">
<asp:Image ID="Image1" runat="server" Height="75px"
Width="75px"
meta:resourcekey="Image1Resource1" />
</td>
</tr>
<tr>
<td class="style7">
&nbsp;</td>
<td class="style6">
<asp:CheckBox ID="CheckBox2" runat="server"
AutoPostBack="True"
oncheckedchanged="CheckBox2_CheckedChanged"
Text="Ayelik Resmini DeAiAtir /Change Profile Photo"
meta:resourcekey="CheckBox2Resource1" />
<asp:FileUpload ID="FileUpload1" runat="server"
Visible="False"
meta:resourcekey="FileUpload1Resource1" />
<asp:RequiredFieldValidator ID="RequiredFieldValidator11"
runat="server"
ControlToValidate="FileUpload1" ErrorMessage="*"
Visible="False"

meta:resourcekey="RequiredFieldValidator11Resource1"></asp:RequiredFieldValidator>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label16" runat="server"
Text="Ayelik Tipi /Membership Type"

meta:resourcekey="Label16Resource1"></asp:Label>
</td>
<td class="style6">
<asp:DropDownList ID="DropDownList1" runat="server"
meta:resourcekey="DropDownList1Resource1">
<asp:ListItem Value="1"
meta:resourcekey="ListItemResource7">Yazar</asp:ListItem>
<asp:ListItem Value="2"
meta:resourcekey="ListItemResource8">Hakem</asp:ListItem>
<asp:ListItem Value="3"
meta:resourcekey="ListItemResource9">EditAPr</asp:ListItem>
</asp:DropDownList>
</td>
</tr>
<tr>
<td class="style7">
<asp:Label ID="Label17" runat="server" Text="Ayelik Durumu
/Membership Status"
meta:resourcekey="Label17Resource1"></asp:Label></td>
<td class="style6">
<asp:CheckBox ID="CheckBox1" runat="server"
meta:resourcekey="CheckBox1Resource1" />
</td>
</tr>
<tr>
<td class="style7">
&nbsp;<asp:Label ID="Label18" runat="server" Text="GA1/4venlik
Kodu"
meta:resourcekey="Label18Resource1"></asp:Label></td>
<td class="style6">
<asp:TextBox ID="TextBox11" runat="server"
meta:resourcekey="TextBox11Resource1"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style7">
&nbsp;</td>
<td class="style6">
<img src="GuvenlikKodu.aspx">&nbsp;<asp:Label
ID="lblDusunceler" runat="server"
Visible="False"
meta:resourcekey="lblDusuncelerResource1"></asp:Label>
</td>
</tr>
<tr>
<td class="style7">
&nbsp;</td>
<td class="style6">
<asp:Button ID="Button1" runat="server" Text="DeAiAtir
/Change" Height="26px"
onclick="Button1_Click1"
meta:resourcekey="Button1Resource1" />
</td>
</tr>
<tr>
<td class="style7">
&nbsp;</td>
<td class="style6">
<asp:Label ID="Label3" runat="server" Text="Label"
Visible="False"
meta:resourcekey="Label3Resource1"></asp:Label>
</td>
</tr>
<tr>
<td class="style7">
&nbsp;</td>
<td class="style6">
&nbsp;</td>
</tr>
</table>
<table class="tablosayfaadi">
<tr>
<td class="tablosayfayazi">
&nbsp;</td>
</tr>
</table>
</asp:Content>

#################################################################################

# Privelege Escalation Exploit :
***************************
# Usage :
*********
# Register yourself as Author => [ Yazar ] account. [ New Admin ]

# Registeration with random e-mail address and choose Professor Doctor.

# Put password for your account.

# Fill All the Blanks. Enter Captchas.

/YeniUyelik.aspx

# After Successfull Registeration => it says =>

Your registration has been completed successfully.

Now you can login to the web site with your username and password..

# Admin Panel Login Path :
************************
/Hata.aspx?Mesaj=3

# Usable Author Control Links :
****************************
/UyeTumMakaleler.aspx?Mesaj=2
/UyeTumMakaleler.aspx?Goster=0
/UyeYayinlanacaklarDefault.aspx?Goster=4
/Arama.aspx
/MakaleGonder.aspx
/Mesajlar.aspx
/GonderilenMesajlar.aspx
/MesajGonder.aspx

Exploitation =>
**************
/ckeditor/plugins/simogeo/Browser.aspx

/UyelikBilgilerim.aspx

It says in Turkish Language :

Ayelik Resmini DeAiAtir. [ Change your Membership picture ]

Choose your .php file to upload from My Profile Photo.

Shell Uploaded Successfully.

Directory File Path :
******************
/UyeResimleri/[RANDOM-NUMBER]_[yourshellnamehere].php

#################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

####################################################################

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

June 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    1 Files
  • 2
    Jun 2nd
    2 Files
  • 3
    Jun 3rd
    19 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    15 Files
  • 6
    Jun 6th
    12 Files
  • 7
    Jun 7th
    11 Files
  • 8
    Jun 8th
    1 Files
  • 9
    Jun 9th
    1 Files
  • 10
    Jun 10th
    15 Files
  • 11
    Jun 11th
    15 Files
  • 12
    Jun 12th
    15 Files
  • 13
    Jun 13th
    8 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    2 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    18 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    22 Files
  • 20
    Jun 20th
    15 Files
  • 21
    Jun 21st
    15 Files
  • 22
    Jun 22nd
    2 Files
  • 23
    Jun 23rd
    1 Files
  • 24
    Jun 24th
    23 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close