指令類型：portrule
Nmap Script指令摘要
這個指令可利用ClamAV伺服器的漏洞，執行未經身份驗證的ClamAV命令。
ClamAV伺服器0.99.2以及可能還包括其他之前的版本，允許在未經身份驗證的情況下執行危險的服務命令；具體來說，'SCAN' 這個命令可用於列出系統文件，而'SHUTDOWN'這個命令可關閉服務，此漏洞由Alejandro Hernandez（nitr0us）發現。
此指令在不帶參數的情況下測試'SCAN'命令的可用性。
額外資訊
Nmap Script指令參數
clamav-exec.scandb將資料庫寫入檔案。
clamav-exec.cmd要執行的指令，選項包括：掃描（scan）和關閉（shutdown）。
vulns.short, vulns.showall請查閱 vulns 函式庫的文件。
Nmap Script指令範例
nmap -sV --script clamav-exec <target>
nmap --script clamav-exec --script-args cmd='scan',scandb='files.txt' <target>
nmap --script clamav-exec --script-args cmd='shutdown' <target>Nmap Script指令輸出
PORT STATE SERVICE VERSION
3310/tcp open clam ClamAV 0.99.2 (21714)
| clamav-exec:
| VULNERABLE:
| ClamAV Remote Command Execution
| State: VULNERABLE
| ClamAV 0.99.2, and possibly other previous versions, allow the execution of the
| clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN'
| may be used to enumerate system files and the command 'SHUTDOWN' shut downs the
| service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
|
| Disclosure date: 2016-06-8
| Extra information:
| SCAN command is enabled.
| References:
| https://bugzilla.clamav.net/show_bug.cgi?id=11585
|_ https://twitter.com/nitr0usmx/status/740673507684679680Nmap Script作者:
Paulino Calderon
License: Same as Nmap--See https://nmap.org/book/man-legal.html
Comments