module

Pulse Secure VPN Arbitrary File Disclosure

Try Surface Command
Back to search
Disclosed
Apr 24, 2019
Created
Nov 12, 2019

Description

This module exploits a pre-auth directory traversal in the Pulse Secure
VPN server to dump an arbitrary file. Dumped files are stored in loot.

If the "Automatic" action is set, plaintext and hashed credentials, as
well as session IDs, will be dumped. Valid sessions can be hijacked by
setting the "DSIG" browser cookie to a valid session ID.

For the "Manual" action, please specify a file to dump via the "FILE"
option. /etc/passwd will be dumped by default. If the "PRINT" option is
set, file contents will be printed to the screen, with any unprintable
characters replaced by a period.

Please see related module exploit/linux/http/pulse_secure_cmd_exec for
a post-auth exploit that can leverage the results from this module.

Authors

Orange Tsai
Meh Chang
Alyssa Herrera
Justin Wagner
wvu [email protected]

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/gather/pulse_secure_file_disclosure
    msf auxiliary(pulse_secure_file_disclosure) > show actions
        ...actions...
    msf auxiliary(pulse_secure_file_disclosure) > set ACTION < action-name >
    msf auxiliary(pulse_secure_file_disclosure) > show options
        ...show and set options...
    msf auxiliary(pulse_secure_file_disclosure) > run
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.