brandonprry

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

brandonprry

%define debug_package %{nil}

Name:           mono
Version:        3.2.6
Release:        1%{?dist}
Summary:        ZOS Mono

License:        MIT
URL:            http://www.google.com
Source0:        mono.tar.gz

brandonprry

The following request is vulnerable to a SQL injection attack from authenticated users.

GET /ossim/report/BusinessAndComplianceISOPCI/ISO27001Bar1.php?date_from=2014-02-28&date_to=2014-03-30 HTTP/1.1
Host: 172.31.16.150
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.150/ossim/report/wizard_run.php?run=ZmRzYWZkc2EjIyNhZG1pbg==
Cookie: PHPSESSID=jllhuhmphk6ma5q8q2i0hm0mr1;
Connection: keep-alive

brandonprry

EMC Cloud Tiering Appliance v10.0 Unauthed XXE

The following authentication request is susceptible to an XXE attack:

POST /api/login HTTP/1.1
Host: 172.31.16.99
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate

brandonprry

EMC Cloud Tiering Appliance v10.0 Unauthed XXE
 
The following authentication request is susceptible to an XXE attack:
 
POST /api/login HTTP/1.1
Host: 172.31.16.99
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate

brandonprry

The following request is vulnerable to a SQL injection attack from authenticated users.
 
GET /ossim/report/BusinessAndComplianceISOPCI/ISO27001Bar1.php?date_from=2014-02-28&date_to=2014-03-30 HTTP/1.1
Host: 172.31.16.150
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.150/ossim/report/wizard_run.php?run=ZmRzYWZkc2EjIyNhZG1pbg==
Cookie: PHPSESSID=jllhuhmphk6ma5q8q2i0hm0mr1;
Connection: keep-alive

brandonprry

Request:

GET /nlw/2014.04.09.1969/json-proxy?refresh=30&url=https://google.com&httpMethod=GET&headers=&postData=&authz=&st=&contentType=JSON&numEntries=3&getSummaries=false&signOwner=true&signViewer=true&gadget=undefined&container=default&bypassSpecCache= HTTP/1.1
Host: developers.socialtext.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://developers.socialtext.net/st/profile/whoaaa@binkmail.com
Cookie: NLW-session=503aac177589fc69b99e505fefde5d4e; NLW-user=T1RLAQLCPVucDWQKiCCbOOWnNwCEHoE5ahAWSGkzQ4h0RJIR8GgjUw6UEPUqFzYNxZooLlCrXpuVE14AcI1wxp-G_Oe6vIiCt-PHOojudJWbXIGNuOqBGzLZMLXKCtakvrqTIF6KoDvU6dKd1D456b4v_FzxwBBs2uz09tUFD6dQn36oDsml2UfoEGcEHD3nGMAYd5li-WhihAtYusVePzsY81W62K-3st4v730%2A

brandonprry

The following request is vulnerable to a SQL injection in the last URI segment:

GET /docushare/dsweb/ResultBackgroundJobMultiple/1 HTTP/1.1
Host: 172.31.16.194:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.31.16.194:8080/docushare/dsweb/DeleteConfirmation/1/Collection-14/Services
Cookie: JSESSIONID=AB82A86859D9C65475DDE5E47216F1A0.tomcat1; AmberUser=64.980A91BBF9D661CB800C2CE5FCCE924AEF4D51CF0280B319873BC31AF0705F0F21.1svt4r2doj13hhu1dc7kf

brandonprry

Unitrends Enterprise Backup 7.3.0

Multiple vulnerabilities exist within this piece of software. The largest one is likely the fact that the ‘auth’ string used for authorization isn’t random at all. After authentication, any requests made by the browser send no cookies and only check this ‘auth’ param, which is completely insufficient. Because of this, unauthenticated users can know what the ‘auth’ parameter should be and make requests as the ‘root’ user.

Unauthenticated root RCE
Because the ‘auth’ variable is not random, an unauthenticated user can post a specially crafted request to the /recoveryconsole/bpl/snmpd.php PHP script. This script does not sanitize the SNMP community string properly which allows the user to execute remote commands as the root user. A metasploit module that exploits this has been given alongside this report. Below is the actual request. To recreate, after authentication, click on Settings -> Clients, Networking, and Notifications -> SNMP and Modify the ‘notpublic’ entry to contain

brandonprry

WebTitan 4.01 (build 148) multiple vulnerabilities
http://www.webtitan.com/free-trial

WebTitan suffers from many command injection attacks, which is exacerbated by the fact that the “role-based” access is superficial only. An attacker with any credentials to the system can execute remote commands as a variety of local users. An authorized attacker can also take advantage of a directory traversal attack as the ‘www’ user and read arbitrary files. The application seems to only change what it displays to the users based on their roles, but these limited users can still successfully perform any request an “admin” can perform.

Because of these vulnerabilities, in the worst case scenario, a limited-access authorized user can eventually run commands remotely as the root user.