3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
54 lines
No EOL
2 KiB
Text
54 lines
No EOL
2 KiB
Text
# Exploit Title: AD Manager Plus 7122 - Remote Code Execution (RCE)
|
||
# Exploit Author: Chan Nyein Wai & Thura Moe Myint
|
||
# Vendor Homepage: https://www.manageengine.com/products/ad-manager/
|
||
# Software Link: https://www.manageengine.com/products/ad-manager/download.html
|
||
# Version: Ad Manager Plus Before 7122
|
||
# Tested on: Windows
|
||
# CVE : CVE-2021-44228
|
||
# Github Repo: https://github.com/channyein1337/research/blob/main/Ad-Manager-Plus-Log4j-poc.md
|
||
|
||
### Description
|
||
|
||
In the summer of 2022, I have been doing security engagement on Synack
|
||
Red Team in the collaboration with my good friend (Thura Moe Myint).
|
||
At that time, Log4j was already widespread on the internet. Manage
|
||
Engine had already patched the Ad Manager Plus to prevent it from
|
||
being affected by the Log4j vulnerability. They had mentioned that
|
||
Log4j was not affected by Ad Manager Plus. However, we determined that
|
||
the Ad Manager Plus was running on our target and managed to exploit
|
||
the Log4j vulnerability.
|
||
|
||
### Exploitation
|
||
|
||
First, Let’s make a login request using proxy.
|
||
|
||
Inject the following payload in the ```methodToCall``` parameter in
|
||
the ```ADSearch.cc``` request.
|
||
|
||
Then you will get the dns callback with username in your burp collabrator.
|
||
|
||
|
||
|
||
|
||
### Notes
|
||
|
||
When we initially reported this vulnerability to Synack, we only
|
||
managed to get a DNS callback and our report was marked as LDAP
|
||
injection. However, we attempted to gain full RCE on the host but were
|
||
not successful. Later, we discovered that Ad Manager Plus was running
|
||
on another target, so we tried to get full RCE on that target. We
|
||
realized that there was a firewall and an anti-virus running on the
|
||
machine, so most of our payloads wouldn't work. After spending a
|
||
considerable amount of time , we eventually managed to bypass the
|
||
firewall and anti-virus, and achieve full RCE.
|
||
|
||
### Conclusion
|
||
|
||
We had already informed Zoho about the log4j vulnerability, and even
|
||
after it was fixed, they decided to reward us with a bonus bounty for
|
||
our report.
|
||
|
||
### Mitigation
|
||
|
||
Updating to a version of Ad Manager Plus higher than 7122 should
|
||
resolve the issue. |