CVE-2020-3153 PoC — Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞

Source

https://github.com/raspberry-pie/CVE-2020-3153

Associated Vulnerability

Title:Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞 (CVE-2020-3153)
Description:Cisco AnyConnect Secure Mobility Client for Windows是美国思科（Cisco）公司的一款基于Windows平台的可通过任何设备安全访问网络和应用的安全移动客户端。基于Windows平台的Cisco AnyConnect Secure Mobility Client 4.8.02042之前版本中的安装程序组件存在代码问题漏洞，该漏洞源于对目录路径的不正确处理。攻击者可利用该漏洞将恶意文件复制到系统层面的目录。

Description

PoC for CVE-2020-3153 Cisco AnyConnect Secure Mobility Client EoP

Readme

# CVE-2020-3153 Cisco AnyConnect Secure Mobility Client EoP PoC

Thanks to Yorick Koster for publishing details. This is a proof of concept for a path traversal vulnerability in Cisco AnyConnect Secure Mobility Client.
Tested with Windows 7 and Windows 10 and AnyConnect version 4.5.x and 4.6.x. For version 4.7.04x and 4.8.x you need to run anypoc_4.7.exe.


Copy the files from [anyconnect.zip](anyconnect.zip) to C:\anyconnect\

1. search and download "anyconnect-win-4.6.03049-predeploy-k9.zip" from the internet

2. unzip anyconnect-win-4.6.03049-predeploy-k9.zip

3. download 7-zip_portable, https://portableapps.com/apps/utilities/7-zip_portable

4. extract anyconnect-win-4.6.03049-posture-predeploy-k9.msi with 7-zip_portable

5. copy cstub.exe to C:\anyconnect\

Run C:\anyconnect\anypoc.exe

or run C:\anyconnect\anypoc_4.7.exe for version 4.7.04x and above

## Links

* https://seclists.org/fulldisclosure/2020/Apr/43
* https://nvd.nist.gov/vuln/detail/CVE-2020-3153
* https://ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal/

File Snapshot


 [4.0K]  /data/pocs/06286254a7d619bd4a98b6c4f73e7f5b3266562d
├── [ 46K]  anyconnect.zip
├── [3.7K]  anypoc.cs
└── [1.1K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!