The application exposes several .NET remoting services on port 9010. .NET remoting is a RMI technology similar to Java RMI or CORBA which allows you to invoke methods remotely and retrieve their result. In BMC Track-It!, the .NET remoting services are unauthenticated and unencrypted, meaning that anyone can invoke all the exposed methods remotely. It is possible to capture traffic and decode the packet format by looking at the (incomplete) Microsoft .NET remoting specifications. Using these techniques, two Metasploit modules were produced: one is an exploit module that can upload arbitrary files to the web root and achieve remote code execution, and the other is an auxiliary module that allows retrieval of the SQL and domain administrator credentials. Three other vulnerabilities (SQL injection, arbitrary file download and hardcoded database credentials) were also discovered.
This exploit is based on code from Miklos Szeredi and allows for privilege escalation through the FUSE filesystem. It creates a file with the path '/sh' and sets the permissions to 04755, allowing for execution of the file as root.
This plugin includes a PHP script to accept file uploads that doesn't perform any security check, thus allowing unauthenticated remote file upload, leading to remote code execution. All versions are affected. Uploaded files are stored with their original file name.
ASX to MP3 Converter 2.7.5 is vulnerable to a stack buffer overflow vulnerability. An attacker can exploit this vulnerability by sending a specially crafted M3U file to the application. This will cause a buffer overflow and allow the attacker to execute arbitrary code on the target system.
An HTTP handler that combines multiple CSS, Javascript or URL into one response for faster page load. It can combine, compress and cache response which results in faster page load and better scalability of web application. It is vulnerable to remote file disclosure which allows an attacker to access sensitive files on the server.
This exploit is used to exploit the Shellshock vulnerability in Apache mod_cgi. It allows an attacker to execute arbitrary commands on the vulnerable system by sending a specially crafted HTTP request with an environment variable containing the malicious code. The exploit can be used to launch a reverse shell or a bind shell depending on the payload used.
This exploit is used to execute arbitrary commands on a vulnerable SMTP server using the Shellshock vulnerability. The exploit is tested on Debian 7 (postfix smtp server w/procmail). The vulnerable version is 4.2.x < 4.2.48.
This module exploits the shellshock vulnerability in apache cgi. It allows you to excute any metasploit payload you want.
This exploit is related to the ShellShock vulnerability which was discovered in 2014. It allows an attacker to execute arbitrary code on a vulnerable system by sending specially crafted environment variables to the system. The exploit is demonstrated by using an OpenVPN server configuration file which contains a user authentication script that is vulnerable to ShellShock. The attacker then sends specially crafted username and password environment variables to the server, which are then executed by the server. The attacker can then gain access to the system and execute arbitrary code.
This module exploits a file upload vulnerability in ManageEngine OpManager and Social IT. The vulnerability exists in the FileCollector servlet which accepts unauthenticated file uploads. This module has been tested successfully on OpManager v8.8 - v11.3 and on version 11.0 of SocialIT for Windows and Linux.
Services By CQR