adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement feedback from the PR

Browse Source
This commit is contained in:
Spencer McIntyre
2024-11-20 13:51:39 -05:00
parent 5550e073dd
commit e52edf447c
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/modules/exploit/windows/misc/ivanti_agent_portal_cmdexec.md
+4
View File
@@ -1,10 +1,14 @@
## Vulnerable Application
This module leverages an unauthenticated RCE in Ivanti's EPM Agent Portal where a RPC client can invoke a method
which will run an attacker-specified string on the remote target as NT AUTHORITY\SYSTEM.
This vulnerability is present in versions prior to EPM 2021.1 Su4 and EPM 2022 Su2.
## Verification Steps
1. Install the application
1. Determine which port the vulnerable AgentPortal service is listening on. It has a non-static value.
1. The port used by the AgentPortal service can be found in the registry at `HKLM\SOFTWARE\LANDesk\SharedComponents\LANDeskAgentPortal`
1. Or you could scan for it and probe the high ports (testing suggests it should be in the 49000 - 50000 range).
1. Start msfconsole
1. Do: `use exploit/windows/misc/ivanti_agent_portal_cmdexec`
1. Set the `RPORT`, `PAYLOAD` and any payload-related options