CVE 2023-20198

Introduction

The web UI component of Cisco IOS XE Software has a previously undiscovered vulnerability that, when exposed to the internet or untrusted networks, is already being actively exploited, according to Cisco. Due to this vulnerability, a remote, unauthenticated attacker is able to set up an account with privilege level 15 access on a vulnerable system. Afterward, the attacker can take control of the compromised machine using that account.

CVE-2023-20198 is a privilege escalation vulnerability affecting Cisco IOS XE software, receiving the highest possible CVSS score of 10. Successful exploitation of this vulnerability would allow an attacker to create a user account with full administrative privileges.

Disclaimer: Educational Purpose Only

This Proof of Concept (PoC) is presented solely for educational and informational purposes. The intent behind sharing this PoC is to demonstrate potential vulnerabilities in a controlled environment. The goal is to promote understanding of cybersecurity concepts and encourage responsible disclosure.

Important Points:

• Ethical Use: This PoC should only be used in environments and systems where you have explicit authorization. Unauthorized access to computer systems is illegal and unethical.
• Responsible Disclosure: If you discover vulnerabilities as a result of this PoC, it is strongly recommended to report them responsibly to the relevant parties, allowing them adequate time to address and mitigate the issues.
• No Endorsement: This PoC and related materials do not endorse or encourage any form of unauthorized access, hacking, or any other illegal activities.

By accessing and using this PoC, you acknowledge that you are solely responsible for your actions and agree to use this information in compliance with applicable laws and regulations. The author assumes no liability for any misuse or consequences arising from the use of this PoC for any purpose other than education and responsible disclosure.

Features

• User Creation: Demonstrates the creation of a local user account on a target web application.
• Implant Installation: Installs an implant configuration on the target web application.
• Web Server Restart: Restarts the web server on the target to activate the implant.
• Implant Status Check: Checks the status of the implanted code on the target.

Getting Started

Prerequisites

• Python 3.x
• Required Python packages: requests, colorama

Installation

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/Pushkarup/CVE-2023-20198.git
   cd CVE-2023-20198
   

2. Install the required Python packages:

   root@kitploit:~

   pip install colorama
   pip install requests
   

Usage

1. Create a text file containing the target sites (one per line) and save it with a .txt extension. •Collect site list for test using dork labels='cisco-xe-webui'

2. Edit the Variable config_content in line 121 according to your need . Below is a sample config

   root@kitploit:~

    config_content = """
    #This is a sample configuration content
    param1: value1
    param2: value2
    nested_params:
         nested_param1: nested_value1
         nested_param2: nested_value2
   """
   

3. Run the script:

   root@kitploit:~

   python main.py
   

4. Follow the prompts to process the target sites.

Contributing

Contributions are welcome! If you find any issues or have improvements, feel free to open a pull request or create an issue.

License

This project is licensed under the MIT License.

Contact

• GitHub: Pushkar Upadhyay
• LinkedIn: Pushkar Upadhyay

Donations

Show your support

• BTC: 3QqVBBzDBezA9U77PCTwMPQVGb1eecv2SP
• ETH: 0xB779767483831BD98327A449C78FfccE2cc6df0a
• USDT: 0xB779767483831BD98327A449C78FfccE2cc6df0a