Add exploit for CVE-2016-6267 - Trend Micro Smart Protection Server authenticated RCE. #7191
Conversation
|
This probably would have been landed over a month ago, but obtaining the software for testing has so far been a pain. |
|
Actually, that was pretty easy to validate. |
|
Cool, did it work for you @stevenseeley ? |
|
@busterb like a charm, but module design needs to be a little improved. |
| end | ||
| end | ||
| Exploit::CheckCode::Safe | ||
| end |
There was a problem hiding this comment.
I'm confused by the double Exploit::Checkcode::Safe. Is there a reason for it? Should the second one be unknown, maybe? I feel like it should be unknown.
| end | ||
| end | ||
| end | ||
| Exploit::CheckCode::Safe |
There was a problem hiding this comment.
Same double-safe, even if the response is not as expected.
There was a problem hiding this comment.
You're right. Second one should be unknown. Just fixed it :)
… exploit that shouldn't be here.
| print_status("Version: #{version}") | ||
| print_status("Build: #{build}") | ||
| if (version == 3.0 and build < 1330) or | ||
| (version == 2.6 and build < 2106) or |
There was a problem hiding this comment.
would these version checks be more simple with a Gem::version?
|
I thought I had the vulnerable software to test, but turns out I don't. It looks like I am not able to verify this PR for now. I would like to unassign myself to avoid hijacking the PR. If anybody has an idea where to get the vulnerable software (trial?), please let me know. Thanks! |
…ion Server authenticated RCE.
Release NotesThis module exploits a vulnerability CVE-2016-6267 found in TrendMicro Smart Protection Server where untrusted inputs are fed to ServWebExec system command, leading to command injection. Shell access obtained is within 'webserv' service user context. Please note that authentication is required to exploit this vulnerability. Unpatched versions 2.5, 2.6, and 3.0 are vulnerable. |
Name: Trend Micro Smart Protection Server Exec Remote Code Injection
Module: exploit/linux/http/trendmicro_sps_exec
Platform: Linux
Privileged: No
License: Metasploit Framework License (BSD)
Disclosed: 2016-08-08
This module exploits a vulnerability found in TrendMicro Smart Protection Server where untrusted inputs are fed to ServWebExec system command, leading to command injection. Please note that authentication is required to exploit this vulnerability.
Advisory: http://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/