[Aditya]

still nothing anyone ??

[gwen12345]

[*] The data:// wrapper works
[*] The php://filter/ wrapper works
[+] Exploit preconditions are satisfied
[*] Potential heaps: 0x7fa760e00040, 0x7fa760c00040, 0x7fa760400040, 0x7fa75f800040, 0x7fa75d000040, 0x7fa75cc00040, 0x7fa75c600040, 0x7fa75c200040, 0x7fa75b800040, 0x7fa75b200040,
0x7fa75ac00040 (using first)

EXPLOIT FAILURE

[*] The data:// wrapper works
[*] The php://filter/ wrapper works
[+] Exploit preconditions are satisfied
[*] Potential heaps: 0x7fa760e00040, 0x7fa760c00040, 0x7fa75f800040, 0x7fa75d000040, 0x7fa75cc00040, 0x7fa75c600040, 0x7fa75c200040, 0x7fa75b800040, 0x7fa75b200040, 0x7fa75ac00040 (using
first)

EXPLOIT FAILURE

[ZenMunk3y]

so zlib isnt available are there any others that are? my understanding is that you need the zlib filter to get you more buckets so the overflow can work?

is bzip2 on the box that works in the same way.

https://www.php.net/manual/en/filters.compression.php

[HRS4156453]

buddyforms looks interesting tbh gonna go look into it more

[patxasec]

[*]The data:// wrapper works
[*]The php://filter/ wrapper works
[+] Exploit preconditions are satisfied
[*]Potential heaps: 0x7fa760e00040, 0x7fa760c00040, 0x7fa760400040, 0x7fa75f800040, 0x7fa75d000040, 0x7fa75cc00040, 0x7fa75c600040, 0x7fa75c200040, 0x7fa75b800040, 0x7fa75b200040,
0x7fa75ac00040 (using first)

    EXPLOIT  FAILURE

[*]The data:// wrapper works
[*]The php://filter/ wrapper works
[+] Exploit preconditions are satisfied
[*]Potential heaps: 0x7fa760e00040, 0x7fa760c00040, 0x7fa75f800040, 0x7fa75d000040, 0x7fa75cc00040, 0x7fa75c600040, 0x7fa75c200040, 0x7fa75b800040, 0x7fa75b200040, 0x7fa75ac00040 (using
first)

    EXPLOIT  FAILURE

[*]at least it works till some point....   

[*]AttributeError: 'NoneType' object has no attribute 'group'

[0xFroggy]

Did anyone search in /var/www/html/wordpress/wp-config.php with LFI? It gives db creentials and keys.

[thedubb1313]

Credentials to the database which isn't exposed to us, not much help I think

[hexaman]

Did anyone search in /var/www/html/wordpress/wp-config.php with LFI? It gives db creentials and keys.

Here is the content:

/** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the installation. * You don't have to use the website, you can copy this file to "wp-config.php" * and fill in the values. * * This file contains the following configurations: * * * Database settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://wordpress.org/documentation/article/editing-wp-config-php/ * * @package WordPress */ // ** Database settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define( 'DB_NAME', 'wordpress' ); /** Database username */ define( 'DB_USER', 'wp_user' ); /** Database password */ define( 'DB_PASSWORD', 'wp_password' ); /** Database hostname */ define( 'DB_HOST', '172.17.0.1' ); /** Database charset to use in creating database tables. */ define( 'DB_CHARSET', 'utf8mb4' ); /** The database collate type. Don't change this if in doubt. */ define( 'DB_COLLATE', '' ); /**#@+ * Authentication unique keys and salts. * * Change these to different unique phrases! You can generate these using * the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}. * * You can change these at any point in time to invalidate all existing cookies. * This will force all users to have to log in again. * * @since 2.6.0 */ define( 'AUTH_KEY',        '(6xl?]9=.f9(<(yxpm9]5<wKsyEc+y&MV6CjjI(0lR2)_6SWDnzO:[g98nOOPaeK' ); define( 'SECURE_AUTH_KEY',  'F<3>KtCm^zs]Mxm Rr*N:&{SWQexFn@ wnQ+bTN5UCF-<gMsT[mH$m))T>BqL}%8' ); define( 'LOGGED_IN_KEY',    ':{yhPsf}tZRfMAut2$Fcne/.@Vs>uukS&JB04 Yy3{`$`6p/Q=d^9=ZpkfP,o%l]' ); define( 'NONCE_KEY',        'sC(jyKu>gY(,&: KS#Jh7x?/CB.hy8!_QcJhPGf@3q<-a,D#?!b}h8 ao;g[<OW;' ); define( 'AUTH_SALT',        '_B& tL]9I?ddS! 0^_,4M)B>aHOl{}e2P(l3=!./]~v#U>dtF7zR=~LnJtLgh&KK' ); define( 'SECURE_AUTH_SALT', '<Cqw6ztRM/y?eGvMzY(~d?:#]v)em`.H!SWbk.7Fj%b@Te<r^^Vh3KQ~B2c|~VvZ' ); define( 'LOGGED_IN_SALT',  '_zl+LT[GqIV{*Hpv>]H:<U5oO[w:]?%Dh(s&Tb-2k`1!WFqKu;elq7t^~v7zS{n[' ); define( 'NONCE_SALT',      't2~PvIO1qeCEa^+J}@h&x<%u~Ml{=0Orqe]l+DD7S}%KP}yi(6v$mHm4cjsK,vCZ' ); /**#@-*/ /** * WordPress database table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_'; /** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the documentation. * * @link https://wordpress.org/documentation/article/debugging-in-wordpress/ */ define( 'WP_DEBUG', false ); /* Add any custom values between this line and the "stop editing" line. */ /* That's all, stop editing! Happy publishing. */ /** Absolute path to the WordPress directory. */ if ( ! defined( 'ABSPATH' ) ) { define( 'ABSPATH', __DIR__ . '/' ); } /** Sets up WordPress vars and included files. */ require_once ABSPATH . 'wp-settings.php'; €@CàÐÐøôô>==€@CàÐÐøôô>==€@CàÐÐøôô>==€@

[knownkai]

The way is RCE with upload

Stages 1 and 2,
libc.so.6 and system() address, the author as given in PNG, witch comfirmrs. via explotation
https://www.ambionics.io/blog/iconv-cve-2024-2961-p1

- dump of libc.so.6    1.9 M         sha256sum 10-3.png 0d2b4e252da10150fb95e311bd83925931ad7bff08bfca25054c3b5e4ab24b1f  10-3.png - and second dump of libc.so.6  1.9 M   sha256sum 10-1.png 0d2b4e252da10150fb95e311bd83925931ad7bff08bfca25054c3b5e4ab24b1f  10-1.png

- /proc/self/maps  locate system 77 K    sha256sum 10.png 26e41aa117098958bbccd228c7d854e7219970a34c3a120f8db3b4bb33291b87  10.png 77 K sha256sum 10-2.png 58615be1dd222e333bb03728bc74b7c2e5bcb6e450bbec3db59ce4c40e4d1332  10-2.png 78 K sha256sum 10-4.png 784f0467f0b2b7e03e0c35a6c76c0b58a549d146c599236b256f1be3f299550d  10-4.png

First and second points of the exploit to RCE:
We have, heap, name of libc, in the libc.so.6 know address to system;

`5575c3ef7000-5575c4181000 rw-p 00000000 00:00 0                          [heap]` `5575c4181000-5575c43f3000 rw-p 00000000 00:00 0                          [heap]` `7fee53407000-7fee5355c000 r-xp 00026000 00:3a 292782                    /usr/lib/x86_64-linux-gnu/libc.so.6` system: 000000000004c490  w  DF .text  000000000000002d  GLIBC_2.2.5 system 000000000004c490 g    DF .text  000000000000002d  GLIBC_PRIVATE __libc_system

We need to modify cnext-exploit.py with it and perhaps wrapwrap. and launch like the video.
https://www.ambionics.io/images/iconv-cv...1/demo.mp4

Bonus, only show the exploit used before us in machine:
In the final of the file PNG1-4

``` 10-4.png 00013410: 20202020 205b7673 79736361 6c6c5d0a      [vsyscall]. 00013420: 0f800f40 0f43e003 d003d0f8 00f400f4  ...@.C.......... 00013430: 3e003d00 3d0f800f 400f43e0 03d003d0  >.=.=...@.C..... 00013440: f800f400 f43e003d 003d0f80 0f400f43  .....>.=.=...@.C 00013450: e003d003 d0f800f4 00f43e00 3d003d0f  ..........>.=.=. 00013460: 800f400f 43e003d0 03d0f800 f400f43e  ..@.C..........> 00013470: 003d003d 0f800f40 0f                .=.=...@. ```

 can u give script and help how to run it

[peterpeter]

The way is RCE with upload

Stages 1 and 2,
libc.so.6 and system() address, the author as given in PNG, witch comfirmrs. via explotation
https://www.ambionics.io/blog/iconv-cve-2024-2961-p1

- dump of libc.so.6    1.9 M         sha256sum 10-3.png 0d2b4e252da10150fb95e311bd83925931ad7bff08bfca25054c3b5e4ab24b1f  10-3.png - and second dump of libc.so.6  1.9 M   sha256sum 10-1.png 0d2b4e252da10150fb95e311bd83925931ad7bff08bfca25054c3b5e4ab24b1f  10-1.png

- /proc/self/maps  locate system 77 K    sha256sum 10.png 26e41aa117098958bbccd228c7d854e7219970a34c3a120f8db3b4bb33291b87  10.png 77 K sha256sum 10-2.png 58615be1dd222e333bb03728bc74b7c2e5bcb6e450bbec3db59ce4c40e4d1332  10-2.png 78 K sha256sum 10-4.png 784f0467f0b2b7e03e0c35a6c76c0b58a549d146c599236b256f1be3f299550d  10-4.png

First and second points of the exploit to RCE:
We have, heap, name of libc, in the libc.so.6 know address to system;

`5575c3ef7000-5575c4181000 rw-p 00000000 00:00 0                          [heap]` `5575c4181000-5575c43f3000 rw-p 00000000 00:00 0                          [heap]` `7fee53407000-7fee5355c000 r-xp 00026000 00:3a 292782                    /usr/lib/x86_64-linux-gnu/libc.so.6` system: 000000000004c490  w  DF .text  000000000000002d  GLIBC_2.2.5 system 000000000004c490 g    DF .text  000000000000002d  GLIBC_PRIVATE __libc_system

We need to modify cnext-exploit.py with it and perhaps wrapwrap. and launch like the video.
https://www.ambionics.io/images/iconv-cv...1/demo.mp4

Bonus, only show the exploit used before us in machine:
In the final of the file PNG1-4

``` 10-4.png 00013410: 20202020 205b7673 79736361 6c6c5d0a      [vsyscall]. 00013420: 0f800f40 0f43e003 d003d0f8 00f400f4  ...@.C.......... 00013430: 3e003d00 3d0f800f 400f43e0 03d003d0  >.=.=...@.C..... 00013440: f800f400 f43e003d 003d0f80 0f400f43  .....>.=.=...@.C 00013450: e003d003 d0f800f4 00f43e00 3d003d0f  ..........>.=.=. 00013460: 800f400f 43e003d0 03d0f800 f400f43e  ..@.C..........> 00013470: 003d003d 0f800f40 0f                .=.=...@. ```

 can u give script and help how to run it

I've been working with it for a while, but I can't seem to get it to work. I've changed the use of zlib, but it still doesn't work. I'll take a break for a bit and then try again later. If I manage to get it working, I'll post it.