funoverip / epowner Goto Github PK
View Code? Open in Web Editor NEWMcAfee ePolicy 0wner exploit code
McAfee ePolicy 0wner exploit code
After searching for the error causing the registration request to fail I found the the problem is at file ModeRegsiter.pm at line 124.
When you call the function mode_register_download_keys(), it returns ($reqseckey, $srpubkey) but for some reason you confused the two and you put $srpubkey<-reqseckey and $reqseckey<-srpubkey.
Later this will cause registration error of http 403 and a concatenation error at line 154.
After I Switched the two like this:
...
($reqseckey, $srpubkey) = $this->mode_register_download_keys()
...
everything worked fine. for now...
Thank you.
apt-get update && apt-get install -y libssl-dev lcab && cpan install Crypt::OpenSSL::DSA Crypt::Rijndael Archive::Zip XML::Simple Crypt::OpenSSL::RSA Text::SimpleTable HTML::TokeParser::Simple
maybe will help someone
Not quite sure what is going on but it looks like the script is getting HTTP 500 codes when attempting to grab the 2 bin files (and same on framepkg) during the registration mode.
Although, if i visit the same URL using curl, i can see a returned octet stream for all the URLs and shows up as HTTP 200s.
The agent version for the server are all running "Orchestrator Agent,4.6.0.3262" just an FYI.
I feel like everything should still work there might just be a bug in the way the files are retrieved?
PS. Is there anyway for epowner to use the two bin files if i downloaded them some other way to my local machine? so it wouldnt need to try to request the files from the https server?
Let me know if there is any more info i can get for you, i have a couple more days access to the server.
i couldn't find a vulnerable version of the ePo software on my blog beacuse of your blog cannot be accessed . Could you please give me the url for download those vms ( eposrv + epocli ) for test. thanks for you help.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.