Re: [The ManageOwnage Series, part XI]: Remote code execution in ServiceDesk, Asset Explorer, Support Center and IT360

Posted by Pedro Ribeiro on Jan 07

Someone has asked me how CVE-2014-5302 can be exploited.

There are 3 things you got to have in mind:
1 – send a null byte (%00) after the file name
2 – send the request as mime type application/octet-stream
3 – send only ASCII data in the request body

Unfortunately it’s not as trivial as uploading an ASCII webshell to
the web root. Because of the way these applications are packaged, the
JSP compiler is not set automatically in the…

McAfee ePolicy Orchestrator Authenticated XXE Credential Exposure

This Metasploit module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the database ‘sa’ user and of the admin user created during installation. This password is encrypted with a static key, and is encrypted using a weak cipher at that (ECB).