Rapid7 Vulnerability & Exploit Database

Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload

Back to Search

Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload

Disclosed
06/01/2019
Created
07/23/2019

Description

This module exploits an authenticated insecure file upload and code execution flaw in Ahsay Backup v7.x - v8.1.1.50. To succesfully execute the upload credentials are needed, default on Ahsay Backup trial accounts are enabled so an account can be created. It can be exploited in Windows and Linux environments to get remote code execution (usualy as SYSTEM). This module has been tested successfully on Ahsay Backup v8.1.1.50 with Windows 2003 SP2 Server. Because of this flaw all connected clients can be configured to execute a command before the backup starts. Allowing an attacker to takeover even more systems and make it rain shells! Setting the CREATEACCOUNT to true will create a new account, this is enabled by default. If credeantials are known enter these and run the exploit.

Author(s)

  • Wietse Boonstra

Platform

Windows

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/misc/ahsay_backup_fileupload
msf exploit(ahsay_backup_fileupload) > show targets
    ...targets...
msf exploit(ahsay_backup_fileupload) > set TARGET < target-id >
msf exploit(ahsay_backup_fileupload) > show options
    ...show and set options...
msf exploit(ahsay_backup_fileupload) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;