From da70b749547dc9bb2a3a359114e0c28811a1ce0f Mon Sep 17 00:00:00 2001 From: h00die Date: Sun, 8 Nov 2020 22:38:53 -0500 Subject: [PATCH] fix version numbers --- .../modules/exploit/linux/http/pulse_secure_gzip_rce.md | 4 ++-- modules/exploits/linux/http/pulse_secure_gzip_rce.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/documentation/modules/exploit/linux/http/pulse_secure_gzip_rce.md b/documentation/modules/exploit/linux/http/pulse_secure_gzip_rce.md index b2f39c9d37..f715813962 100644 --- a/documentation/modules/exploit/linux/http/pulse_secure_gzip_rce.md +++ b/documentation/modules/exploit/linux/http/pulse_secure_gzip_rce.md @@ -1,11 +1,11 @@ ## Vulnerable Application -The Pulse Connect Secure appliance before 9.1R8 suffers from an uncontrolled gzip extraction vulnerability which allows an authenticated attacker +The Pulse Connect Secure appliance before 9.1R9 suffers from an uncontrolled gzip extraction vulnerability which allows an authenticated attacker to overwrite arbitrary files, resulting in Remote Code Execution as root. Admin credentials are required for successful exploitation. NCC Group [wrote](https://research.nccgroup.com/2020/10/26/technical-advisory-pulse-connect-secure-rce-via-uncontrolled-gzip-extraction-cve-2020-8260/) in their findings a few different ways to achieve RCE through the gzip vulnerability. This exploit utilizes the Template Toolkit method -which works up to 9.1R8, whereas the other methods were patched earlier. With this method, since the payload is sent in the perl +which works up to 9.1R8 (possibly more), whereas the other methods were patched earlier. With this method, since the payload is sent in the perl template, there are also no bad characters. Of note, MANY binaries are not in `$PATH`, but are located in `/home/bin/`. Thanks to @wvu for pointing that out. diff --git a/modules/exploits/linux/http/pulse_secure_gzip_rce.py b/modules/exploits/linux/http/pulse_secure_gzip_rce.py index 134732634b..3501663e34 100755 --- a/modules/exploits/linux/http/pulse_secure_gzip_rce.py +++ b/modules/exploits/linux/http/pulse_secure_gzip_rce.py @@ -34,7 +34,7 @@ from metasploit import module metadata = { 'name': 'Pulse Secure VPN gzip RCE', 'description': ''' - The Pulse Connect Secure appliance before 9.1R8 suffers from an uncontrolled gzip extraction vulnerability + The Pulse Connect Secure appliance before 9.1R9 suffers from an uncontrolled gzip extraction vulnerability which allows an attacker to overwrite arbitrary files, resulting in Remote Code Execution as root. Admin credentials are required for successful exploitation. Of note, MANY binaries are not in `$PATH`, but are located in `/home/bin/`