Skip to content

Commit

Permalink
Another docs update
Browse files Browse the repository at this point in the history
  • Loading branch information
jheysel-r7 committed Aug 29, 2023
1 parent 47f6211 commit fe8cb33
Showing 1 changed file with 3 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ Ivanti Sentry (formerly Mobileiron Sentry) is vulnerable to an authentication by
allows for code execution in the context of the root user. The vulnerable endpoint `/mics/services/MICSLogService` exposes
a binary web service protocol 'Hessian' which allows remote users to invoke functions within the target. One of the functions
accessible via Hessian and the vulnerable endpoint is `uploadFileUsingFileInput` which accepts a `command` argument
that gets directly fed into a `Runtime.getRuntime().exec(cmd)` call. The command is run in the context of the `tomcat`
user however by default `tomcat` is able to execute commands with sudo thus we can use this to execute the payload in the context
that gets directly fed into a `Runtime.getRuntime().exec(cmd)` call. The command is run in the context of the `tomcat2`
user however by default `tomcat2` is able to execute commands with sudo thus we can use this to execute the payload in the context
of the `root` user.


Expand All @@ -30,7 +30,7 @@ Because the execution context does not allow for command piping or chaining we n
by semi-colon and send each command individually. This delay specifies how long to wait for each command to run.

### USE_SUDO
The command is executed in the context of the `tomcat` user. By default the `tomcat` user has the ability to execute
The command is executed in the context of the `tomcat2` user. By default the `tomcat2` user has the ability to execute
commands with `sudo`. In the event Sentry is installed on an OS that doesn't have the `sudo` binary, this has been left
has a configurable option in case it needs to be disabled.

Expand Down

0 comments on commit fe8cb33

Please sign in to comment.