指令類型:portrule
Nmap Script指令摘要
這個指令可利用ClamAV伺服器的漏洞,執行未經身份驗證的ClamAV命令。
ClamAV伺服器0.99.2以及可能還包括其他之前的版本,允許在未經身份驗證的情況下執行危險的服務命令;具體來說,'SCAN' 這個命令可用於列出系統文件,而'SHUTDOWN'這個命令可關閉服務,此漏洞由Alejandro Hernandez(nitr0us)發現。
此指令在不帶參數的情況下測試'SCAN'命令的可用性。
額外資訊
Nmap Script指令參數
clamav-exec.scandb
將資料庫寫入檔案。
clamav-exec.cmd
要執行的指令,選項包括:掃描(scan)和關閉(shutdown)。
vulns.short, vulns.showall
請查閱 vulns 函式庫的文件。
Nmap Script指令範例
nmap -sV --script clamav-exec <target>
nmap --script clamav-exec --script-args cmd='scan',scandb='files.txt' <target>
nmap --script clamav-exec --script-args cmd='shutdown' <target>
Nmap Script指令輸出
PORT STATE SERVICE VERSION
3310/tcp open clam ClamAV 0.99.2 (21714)
| clamav-exec:
| VULNERABLE:
| ClamAV Remote Command Execution
| State: VULNERABLE
| ClamAV 0.99.2, and possibly other previous versions, allow the execution of the
| clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN'
| may be used to enumerate system files and the command 'SHUTDOWN' shut downs the
| service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
|
| Disclosure date: 2016-06-8
| Extra information:
| SCAN command is enabled.
| References:
| https://bugzilla.clamav.net/show_bug.cgi?id=11585
|_ https://twitter.com/nitr0usmx/status/740673507684679680
Nmap Script作者:
Paulino Calderon
License: Same as Nmap--See https://nmap.org/book/man-legal.html