Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

This module abuses a metacharacter injection vulnerability in the HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 and earlier. The Unified Maintenance Tool contains a 'masterCGI' binary which allows an unauthenticated attacker to execute arbitrary commands by specifing shell metacharaters as the 'user' within the 'ping' action to obtain 'httpd' user access. This module only supports command line payloads, as the httpd process kills the reverse/bind shell spawn after the HTTP 200 OK response.

Search Other Modules

Exploit Rank

• Manual

Exploit Authors

• patrick < patrick [at] osisecurity.com.au >

Vulnerability References

• OSVDB-40521
• BID-25694
• CVE-2007-3010
• http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm

Exploit Targets

• 0 - Automatic Target (default)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/linux/http/ddwrt_cgibin_exec
• exploit/linux/http/dolibarr_cmd_exec
• exploit/linux/http/gpsd_format_string
• exploit/linux/http/linksys_apply_cgi
• exploit/linux/http/peercast_url
• exploit/linux/http/piranha_passwd_exec
• exploit/linux/http/vcms_upload
• exploit/linux/http/webcalendar_settings_exec

Exploit Usage Information

Exploit Module Options