POC详情： 3d0c266fea70edacf73a22c0cc3a5dcd69044d30

来源
https://github.com/appliedi/Telerik_CVE-2019-18935
关联漏洞
标题： Progress Telerik UI for ASP.NET AJAX 代码问题漏洞 (CVE-2019-18935)
描述：Progress Telerik UI for ASP.NET AJAX是一款HTML编辑器。 Progress Telerik UI for ASP.NET AJAX 2019.3.1023及之前版本中的‘RadAsyncUpload’函数存在代码问题漏洞。远程攻击者可借助特制请求利用该漏洞在w3wp.exe进程上下文中执行任意代码。
描述
TelerikUI Vulnerability Scanner (CVE-2019-18935)
介绍
# TelerikUI Python Scanner
(telerik_rce_scan.py)
<img align="center" src="https://github.com/becrevex/Telerik_CVE-2019-18935/blob/master/pyimp.JPG"/> 

# Examples
<b>Assess an IP for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -t 192.168.44.21

<b>Assess a hostname for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -t vulnerable.telerik.net

<b>Assess a CIDR network range for CVE-2019-18935</b><br>
$ python3 telerik_rce_scan.py -r 23.253.4.0/24

<b>Assess a list of targerts</b><br>
$ python3 telerik_rce_scan.py -iL hosts.txt

------------------------------------------------------------------------------------------------------

# TelerikUI NSE Scanner 
(http-telerik-vuln.nse)

# Installation
Download to your nmap scripts directory (/usr/share/nmap/scripts/)

# Update the nmap scripts database
$ nmap --script-updatedb

# Sample execution:
nmap -sT -p443 --script=http-telerik-vuln 23.253.4.115

# Screen:
<img align="center" src="https://github.com/becrevex/Telerik_CVE-2019-18935/blob/master/screen.JPG"/> 

## Thanks

[@mwulftange](https://twitter.com/mwulftange) initially [discovered](https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html) this vulnerability. [@bao7uo](https://github.com/bao7uo) wrote all of the logic for [breaking RadAsyncUpload encryption](https://github.com/bao7uo/RAU_crypto), which enabled manipulating the file upload configuration object in `rauPostData` and subsequently exploiting insecure deserialization of that object.  And thanks to Noperator (@BishopFox) from whom I _copped_ this language and the Legal Disclaimer below.  

## Legal Disclaimer

Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
文件快照

 [4.0K]  /data/pocs/3d0c266fea70edacf73a22c0cc3a5dcd69044d30
├── [3.7M]  AIC Training Module - Finding Vulnerable Telerik Instances.docx
├── [5.0K]  http-telerik-vuln.nse
├── [4.0K]  img
│   ├── [ 70K]  pyimp.JPG
│   └── [ 85K]  screen.JPG
├── [ 70K]  pyimp.JPG
├── [1.9K]  README.md
├── [ 85K]  screen.JPG
└── [ 17K]  telerik_rce_scan.py

1 directory, 8 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。