OpenNetAdmin 13.03.01 Remote Code Execution

Source: Internet
Author: User
Tags apache log

# Title: OpenNetAdmin Remote Code Execution # vulnerability Author: Mandat0ry (aka Matthew Bryant) # developer Website: http://opennetadmin.com/ #: http://opennetadmin.com/ Download.html # affected version: 13.03.01 # Test System: Ubuntu OpeNetAdmin Remote Code Execution Exploit by Mandat0ry (aka Matthew Bryant) information: This exploit works because adding modules can be done without any sort of authentication. modules are in this form: module [name] = The name of the function that will be run out of the specified ded file module [description] = Irrelevant description of the module (unless some PHP c Ode is injected here hmm ?) Module [file] = The file to be encoded and then the function module [name] will be run from this stored ded file This exploit works by injecting some PHP code into the/var/log/ ona. log file via the module description parameter. everytime a module is added to OpenNetAdmin the description/name/etc are all logged into this log file. so... by simply setting the module filepath ".. /.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /Var/log/ona. log "(add or remove dots at will) we can include the log file as a module. where it gets clever is remember the description is logged! So we can add PHP code into the description and thus the logs and it will be executed on execution sion of this file! The PHP interpreter will ignore everything not enclosed in PHP tags so it will only run the code we inject. this is basically a spin off of Apache log injection exploitation. once the module has been added all you have to do is run it via "dcm. php? Module = ". this all works without any guest account etc. NOTE: Because of the way the logger script works we cannot use any "=" in our injected code as it will be escaped before being added to the logs ("\ = ") so avoid using it! Cool software but the code has a lot to be desired, I imagine their are a LOT more exploits than what I found but once I had rce I was satisfied. proof of concept code for easy exploitation. run this and then go http://www.bkjia.com /Ona/dcm. php? Module = mandat0ry for your shell! <Center> 

 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.