CVE-2018-18387 PoC — PlaySMS 权限许可和访问控制问题漏洞

Source

https://github.com/TheeBlind/CVE-2018-18387

Associated Vulnerability

Title:PlaySMS 权限许可和访问控制问题漏洞 (CVE-2018-18387)
Description:PlaySMS是一套基于Web的短信平台。该平台支持连接短信网关、个人信息系统以及企业的群组通讯工具等。 PlaySMS 1.4.2及之前版本中存在权限许可和访问控制问题漏洞。攻击者可利用该漏洞提升权限。

Description

playSMS < = 1.4.2 - Privilege escalation

Readme

# CVE-2018-18387
playSMS &lt; = 1.4.2 - Privilege escalation


TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise.

The attacker need to get access on the box where playSMS is installed and be able to edit playSMS related files, and the daemon must be run as root. In the PHP code, references to a daemon were noticed. Research was conducted on the found daemon. The daemon was located in /usr/local/bin and it had associated files in /etc/init.d/.

This daemon is generally run by root, after being tested with a simple `whoami` command.

The daemon can't be directly modified, yet there is a `while` loop that runs every second which contains a `include init.php`. This file exists in `/var/www/html/playsms`.

Mitigations: Don't run the daemon as root.

The developers were contacted and a fix was released.

Playsms Contacts:

https://playsms.org 

https://github.com/antonraharja/playSMS

File Snapshot


 [4.0K]  /data/pocs/782106878c6ff5f2469d20951528f03b91a2927c
├── [2.0K]  playSMS_Damemon_Privesc.sh
└── [ 986]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!